ccprofiles-core 0.8.0 → 0.9.0

package/dist/adopt.d.ts

@@ -8,5 +8,9 @@ export declare function buildManifest(live: LiveProfile[], platform: Platform, s
  * re-leak a previously migrated token as plaintext. For each profile that existed before,
  * if the old manifest had a secret:// ref whose resolved value matches the newly-discovered
  * plaintext value, restore the ref instead of the plaintext.
+ *
+ * Also carries forward declared-only fields (skipPermissions, launcher env) that live
+ * state cannot represent — buildManifest resets them to defaults, so without this every
+ * snapshot/adopt would silently turn them off.
  */
 export declare function preserveSecretRefs(newM: Manifest, oldM: Manifest, getSecret: (name: string) => Promise<string | null>): Promise<void>;

package/dist/adopt.js

@@ -67,12 +67,19 @@ export function buildManifest(live, platform, sharedRoot = join(platform.home, '
  * re-leak a previously migrated token as plaintext. For each profile that existed before,
  * if the old manifest had a secret:// ref whose resolved value matches the newly-discovered
  * plaintext value, restore the ref instead of the plaintext.
+ *
+ * Also carries forward declared-only fields (skipPermissions, launcher env) that live
+ * state cannot represent — buildManifest resets them to defaults, so without this every
+ * snapshot/adopt would silently turn them off.
  */
 export async function preserveSecretRefs(newM, oldM, getSecret) {
     for (const pr of newM.profiles) {
         const old = oldM.profiles.find(p => p.name === pr.name);
         if (!old)
             continue;
+        pr.skipPermissions = old.skipPermissions;
+        if (Object.keys(pr.env).length === 0)
+            pr.env = old.env;
         for (const [k, v] of Object.entries(old.settingsEnv ?? {})) {
             if (!v.startsWith('secret://'))
                 continue;

package/dist/discovery.d.ts

@@ -24,24 +24,19 @@ export interface LiveProfile {
 }
 /**
  * Pull a comparable installed version out of each entry of installed_plugins.json's `plugins` map.
+ * The value is an ARRAY of install records (one per scope), not an object.
  *
- * Real-world shapes to survive (all four seen on one machine):
- *  - the value is an ARRAY of install records (one per scope: user/project/local), not an object
- *  - a released plugin has a real `version` ('13.11.0') alongside a `gitCommitSha`; the two move
- *    together, so either identifies the code — but the version reads better in a warning
- *  - a plugin pinned by git sha rather than a release has no real version, and Claude Code spells
- *    that inconsistently: the literal 'unknown' in some releases, the SHORT sha in others, for the
- *    very same commit ('unknown' vs 'e14e8fe2c1fc', both with sha 'e14e8fe2c1fca591…')
- *  - so a short-sha `version` must not be compared against a full `gitCommitSha` either — same
- *    commit, different string
- *
- * Hence: use `version` only when it is a real version, i.e. not missing, not 'unknown', and not
- * merely a prefix of the entry's own sha. Otherwise use the full `gitCommitSha`, which is the one
- * canonical spelling every profile agrees on.
- *
- * ponytail: takes the first scope's version when a plugin is installed at several scopes at once.
- * Per-scope drift is a different (rarer) bug than the cross-profile drift this exists to catch;
- * widen to Record<id, Record<scope, version>> if that ever bites.
+ * ONLY a real release `version` counts. `gitCommitSha` looks like a tempting fallback for the
+ * versionless plugins (Claude Code writes `"version": "unknown"` for those) but it is unusable as
+ * an identity, and comparing it produced drift that `fix` could never clear:
+ *  - it is the sha of the whole MARKETPLACE repo, not of the plugin — two profiles whose plugin
+ *    files are byte-identical still hold different shas if they installed at different times
+ *  - Claude Code never refreshes it when `claude plugin update` finds nothing to do, so the stale
+ *    value outlives every update. Seen on a real machine: context7 at 205b6e0b in one profile and
+ *    e14e8fe2 in three others, identical file contents, identical marketplace snapshot, and
+ *    `clp fix` looping forever because update kept (correctly) no-opping.
+ * A versionless plugin therefore contributes no drift signal at all. Detecting nothing beats
+ * detecting noise that has no remedy.
  */
 export declare function readInstalledPluginVersions(plugins: Record<string, unknown>): Record<string, string>;
 export declare function discoverProfiles(home: string): Promise<LiveProfile[]>;

package/dist/discovery.js

@@ -2,38 +2,38 @@ import { access, readdir, readFile, readlink } from 'node:fs/promises';
 import { join } from 'node:path';
 import { readCodexMcpServers } from './codex.js';
 import { logicalLinkEntry } from './links.js';
+/**
+ * ccprofiles manages a profile's USER-scope plugins. A project-scope install belongs to some project
+ * directory, not to the profile, and `claude plugin update/uninstall` only ever act on user scope —
+ * counting one made those calls fail with `Plugin "x" is not installed at scope user`. Entries
+ * predating the `scope` field are treated as user.
+ */
+function userScopeEntries(entries) {
+    return (Array.isArray(entries) ? entries : [entries])
+        .filter((e) => e && (e.scope ?? 'user') === 'user');
+}
 /**
  * Pull a comparable installed version out of each entry of installed_plugins.json's `plugins` map.
+ * The value is an ARRAY of install records (one per scope), not an object.
  *
- * Real-world shapes to survive (all four seen on one machine):
- *  - the value is an ARRAY of install records (one per scope: user/project/local), not an object
- *  - a released plugin has a real `version` ('13.11.0') alongside a `gitCommitSha`; the two move
- *    together, so either identifies the code — but the version reads better in a warning
- *  - a plugin pinned by git sha rather than a release has no real version, and Claude Code spells
- *    that inconsistently: the literal 'unknown' in some releases, the SHORT sha in others, for the
- *    very same commit ('unknown' vs 'e14e8fe2c1fc', both with sha 'e14e8fe2c1fca591…')
- *  - so a short-sha `version` must not be compared against a full `gitCommitSha` either — same
- *    commit, different string
- *
- * Hence: use `version` only when it is a real version, i.e. not missing, not 'unknown', and not
- * merely a prefix of the entry's own sha. Otherwise use the full `gitCommitSha`, which is the one
- * canonical spelling every profile agrees on.
- *
- * ponytail: takes the first scope's version when a plugin is installed at several scopes at once.
- * Per-scope drift is a different (rarer) bug than the cross-profile drift this exists to catch;
- * widen to Record<id, Record<scope, version>> if that ever bites.
+ * ONLY a real release `version` counts. `gitCommitSha` looks like a tempting fallback for the
+ * versionless plugins (Claude Code writes `"version": "unknown"` for those) but it is unusable as
+ * an identity, and comparing it produced drift that `fix` could never clear:
+ *  - it is the sha of the whole MARKETPLACE repo, not of the plugin — two profiles whose plugin
+ *    files are byte-identical still hold different shas if they installed at different times
+ *  - Claude Code never refreshes it when `claude plugin update` finds nothing to do, so the stale
+ *    value outlives every update. Seen on a real machine: context7 at 205b6e0b in one profile and
+ *    e14e8fe2 in three others, identical file contents, identical marketplace snapshot, and
+ *    `clp fix` looping forever because update kept (correctly) no-opping.
+ * A versionless plugin therefore contributes no drift signal at all. Detecting nothing beats
+ * detecting noise that has no remedy.
  */
 export function readInstalledPluginVersions(plugins) {
     const out = {};
     for (const [id, entries] of Object.entries(plugins)) {
-        for (const e of Array.isArray(entries) ? entries : [entries]) {
-            const { version, gitCommitSha } = (e ?? {});
-            const sha = typeof gitCommitSha === 'string' && gitCommitSha ? gitCommitSha : null;
-            const ver = typeof version === 'string' && version && version !== 'unknown' ? version : null;
-            const isShaSpelling = !!ver && !!sha && sha.startsWith(ver);
-            const v = ver && !isShaSpelling ? ver : sha ?? ver;
-            if (v) {
-                out[id] = v;
+        for (const { version } of userScopeEntries(entries)) {
+            if (typeof version === 'string' && version && version !== 'unknown') {
+                out[id] = version;
                 break;
             }
         }
@@ -129,7 +129,7 @@ export async function discoverProfiles(home) {
             try {
                 const ip = JSON.parse(await readFile(join(dir, 'plugins', 'installed_plugins.json'), 'utf8'));
                 if (ip && typeof ip.plugins === 'object' && ip.plugins !== null) {
-                    installedPlugins.push(...Object.keys(ip.plugins));
+                    installedPlugins.push(...Object.entries(ip.plugins).filter(([, v]) => userScopeEntries(v).length).map(([id]) => id));
                     installedPluginVersions = readInstalledPluginVersions(ip.plugins);
                 }
             }

package/dist/plugins.d.ts

@@ -50,5 +50,29 @@ export declare function reconcileProfilePlugins(opts: {
     /** ids drifting across profiles — update them here so every profile lands on the same latest. */
     updateIds?: string[];
 }): Promise<string[]>;
+/**
+ * Existing claude-mem cache dirs under a profile (`plugins/cache/<owner>/claude-mem`, any owner).
+ * Disk is the ground truth on purpose: a PROJECT-scope claude-mem install is invisible to
+ * installed_plugins.json's user-scope view (discovery's installedPlugins misses it), yet it still
+ * leaks the same way — `.claude-staffinc` was exactly this case on 2026-07-23. Gating the prune on
+ * install bookkeeping would skip the one profile that needed it most.
+ */
+export declare function claudeMemCacheDirs(configDir: string): Promise<string[]>;
+/**
+ * Keep only the highest-semver version dir under `cacheDir`, delete the rest. Returns removed names.
+ *
+ * Why this is the real fix for the claude-mem leak: the plugin's session-init hook resolves which
+ * worker to launch with `ls -dt <cache>/[0-9]*` — the newest dir by MTIME — and ignores the pinned
+ * version in installed_plugins.json entirely. So a leftover OLD version dir with a fresher mtime is
+ * launched instead of the pinned latest, reviving the shared-`~/.claude-mem`-worker fight even when
+ * every profile's pin is already correct. On 2026-07-23 this ran `.claude-data-plb` (pinned 13.12.1)
+ * up to 187 procs / 20GB swap, all from a stale 13.11.0 dir. Version *parity* (planPluginVersionDrift
+ * + `clp fix`) is necessary but not sufficient; the ambiguity only goes away when one dir remains.
+ *
+ * "Keep highest semver" == keep the intended active version, because `claude plugin update` only ever
+ * moves to the marketplace's latest — there is no way to pin an older one. Non-numeric dirs
+ * (git-sha/"unknown" caches of versionless plugins) are left untouched.
+ */
+export declare function pruneStaleVersionDirs(cacheDir: string): Promise<string[]>;
 /** If a profile's plugins/ is a legacy symlink into the old shared pool, restore it to a real dir. */
 export declare function restoreLegacyPluginSymlink(pluginsDir: string): Promise<boolean>;

package/dist/plugins.js

@@ -1,5 +1,6 @@
-import { cp, lstat, mkdir, readlink, unlink } from 'node:fs/promises';
+import { cp, lstat, mkdir, readdir, readlink, rm, unlink } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
+import { join } from 'node:path';
 export function marketplaceOf(id) {
     const at = id.lastIndexOf('@');
     return at > 0 ? id.slice(at + 1) : null;
@@ -72,6 +73,76 @@ export async function reconcileProfilePlugins(opts) {
     }
     return log;
 }
+/**
+ * Existing claude-mem cache dirs under a profile (`plugins/cache/<owner>/claude-mem`, any owner).
+ * Disk is the ground truth on purpose: a PROJECT-scope claude-mem install is invisible to
+ * installed_plugins.json's user-scope view (discovery's installedPlugins misses it), yet it still
+ * leaks the same way — `.claude-staffinc` was exactly this case on 2026-07-23. Gating the prune on
+ * install bookkeeping would skip the one profile that needed it most.
+ */
+export async function claudeMemCacheDirs(configDir) {
+    const cacheRoot = join(configDir, 'plugins', 'cache');
+    let owners;
+    try {
+        owners = await readdir(cacheRoot);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const owner of owners) {
+        const d = join(cacheRoot, owner, 'claude-mem');
+        if (existsSync(d))
+            out.push(d);
+    }
+    return out;
+}
+/** Compare dotted numeric version names ("13.9.2" < "13.11.0"). Missing parts count as 0. */
+function compareVersionDir(a, b) {
+    const pa = a.split('.'), pb = b.split('.');
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+        const x = Number(pa[i] ?? 0), y = Number(pb[i] ?? 0);
+        if (x !== y)
+            return x - y;
+    }
+    return 0;
+}
+/**
+ * Keep only the highest-semver version dir under `cacheDir`, delete the rest. Returns removed names.
+ *
+ * Why this is the real fix for the claude-mem leak: the plugin's session-init hook resolves which
+ * worker to launch with `ls -dt <cache>/[0-9]*` — the newest dir by MTIME — and ignores the pinned
+ * version in installed_plugins.json entirely. So a leftover OLD version dir with a fresher mtime is
+ * launched instead of the pinned latest, reviving the shared-`~/.claude-mem`-worker fight even when
+ * every profile's pin is already correct. On 2026-07-23 this ran `.claude-data-plb` (pinned 13.12.1)
+ * up to 187 procs / 20GB swap, all from a stale 13.11.0 dir. Version *parity* (planPluginVersionDrift
+ * + `clp fix`) is necessary but not sufficient; the ambiguity only goes away when one dir remains.
+ *
+ * "Keep highest semver" == keep the intended active version, because `claude plugin update` only ever
+ * moves to the marketplace's latest — there is no way to pin an older one. Non-numeric dirs
+ * (git-sha/"unknown" caches of versionless plugins) are left untouched.
+ */
+export async function pruneStaleVersionDirs(cacheDir) {
+    let names;
+    try {
+        names = await readdir(cacheDir);
+    }
+    catch {
+        return [];
+    }
+    const versions = names.filter(n => /^\d/.test(n)).sort(compareVersionDir);
+    if (versions.length <= 1)
+        return [];
+    const keep = versions[versions.length - 1];
+    const removed = [];
+    for (const v of versions) {
+        if (v === keep)
+            continue;
+        await rm(join(cacheDir, v), { recursive: true, force: true });
+        removed.push(v);
+    }
+    return removed;
+}
 /** If a profile's plugins/ is a legacy symlink into the old shared pool, restore it to a real dir. */
 export async function restoreLegacyPluginSymlink(pluginsDir) {
     let st = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccprofiles-core",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Core library for ccprofiles — discovery, manifest, secrets, apply, and LAN sync for Claude Code multi-account setups",
   "type": "module",
   "main": "./dist/index.js",