ccprofiles-core 0.7.1 → 0.7.3

package/dist/apply.js

@@ -11,8 +11,26 @@ function configPathFor(dir, home, agent) {
         return join(dir, 'config.toml');
     return dir === join(home, '.claude') ? join(home, '.claude.json') : join(dir, '.claude.json');
 }
-function sortKeys(o) {
-    return Object.fromEntries(Object.entries(o).sort(([a], [b]) => a.localeCompare(b)));
+/**
+ * Deep, order-insensitive normalization for drift comparison. Plain-object keys are sorted
+ * recursively at every depth (array element order is preserved — arrays like `args` are
+ * order-significant). Without recursing into nested objects, two semantically identical
+ * server defs could compare unequal purely from key-insertion order — which genuinely
+ * happens: Zod's `.passthrough()` always places schema-declared keys before passthrough
+ * (unknown) keys in its output, e.g. Codex's `startup_timeout_sec` (not in McpServerSchema)
+ * ends up after `env` once a manifest round-trips through the schema, while the live
+ * TOML file has it before `env` in source order — a manifest reload would otherwise never
+ * converge to "in sync" for any Codex server combining an `env` table with a vendor field.
+ */
+function sortKeys(value) {
+    if (Array.isArray(value))
+        return value.map(sortKeys);
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value)
+            .map(([k, v]) => [k, sortKeys(v)])
+            .sort(([a], [b]) => a.localeCompare(b)));
+    }
+    return value;
 }
 const SECRET_PREFIX = 'secret://';
 // exported so adopt.ts (buildManifest) can recognize pooled session-dir symlinks with the

package/dist/assets.js

@@ -4,7 +4,13 @@ import { join, relative } from 'node:path';
 import { renderPath } from './platform.js';
 import { atomicWrite, backupFiles } from './fsutil.js';
 import { physicalLinkEntry } from './links.js';
-const HUB_DIRS = ['skills', 'commands', 'plugins'];
+// Deliberately NOT 'plugins': plugin state syncs via the manifest's declarative
+// `plugins[]`/`marketplaces{}` fields (already inside manifestYaml) plus a `claude plugin
+// install` reconcile after sync/import — never by copying the plugins/ directory tree.
+// That tree is marketplace git clones + installed plugin caches, routinely multi-GB; walking
+// and JSON.stringify-ing it here blew past V8's max string length in sealJson on a real user's
+// machine (their ~/.claude-oauth/plugins/ alone was 3.9 GB).
+const HUB_DIRS = ['skills', 'commands'];
 function safeParts(rel) {
     if (rel.includes('\\') || rel.includes('\0'))
         throw new Error(`unsafe asset path: ${JSON.stringify(rel)}`);

package/dist/syncserver.js

@@ -95,8 +95,11 @@ export async function startSyncServer(deps) {
             }
             return send(res, 404, { error: 'not found' });
         }
-        catch {
-            // never leak internal error detail (paths, parse internals) to callers
+        catch (e) {
+            // never leak internal error detail (paths, parse internals) to callers — but log it
+            // locally (this process's own stderr, never sent over the wire) so whoever runs
+            // `ccprofiles serve` can actually diagnose the failure instead of a bare 500.
+            process.stderr.write(`ccprofiles serve error: ${e.stack ?? e}\n`);
             return send(res, 500, { error: 'internal error' });
         }
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccprofiles-core",
-  "version": "0.7.1",
+  "version": "0.7.3",
   "description": "Core library for ccprofiles — discovery, manifest, secrets, apply, and LAN sync for Claude Code multi-account setups",
   "type": "module",
   "main": "./dist/index.js",