ccprofiles-core 0.8.1 → 0.9.0

package/dist/adopt.d.ts

@@ -8,5 +8,9 @@ export declare function buildManifest(live: LiveProfile[], platform: Platform, s
  * re-leak a previously migrated token as plaintext. For each profile that existed before,
  * if the old manifest had a secret:// ref whose resolved value matches the newly-discovered
  * plaintext value, restore the ref instead of the plaintext.
+ *
+ * Also carries forward declared-only fields (skipPermissions, launcher env) that live
+ * state cannot represent — buildManifest resets them to defaults, so without this every
+ * snapshot/adopt would silently turn them off.
  */
 export declare function preserveSecretRefs(newM: Manifest, oldM: Manifest, getSecret: (name: string) => Promise<string | null>): Promise<void>;

package/dist/adopt.js

@@ -67,12 +67,19 @@ export function buildManifest(live, platform, sharedRoot = join(platform.home, '
  * re-leak a previously migrated token as plaintext. For each profile that existed before,
  * if the old manifest had a secret:// ref whose resolved value matches the newly-discovered
  * plaintext value, restore the ref instead of the plaintext.
+ *
+ * Also carries forward declared-only fields (skipPermissions, launcher env) that live
+ * state cannot represent — buildManifest resets them to defaults, so without this every
+ * snapshot/adopt would silently turn them off.
  */
 export async function preserveSecretRefs(newM, oldM, getSecret) {
     for (const pr of newM.profiles) {
         const old = oldM.profiles.find(p => p.name === pr.name);
         if (!old)
             continue;
+        pr.skipPermissions = old.skipPermissions;
+        if (Object.keys(pr.env).length === 0)
+            pr.env = old.env;
         for (const [k, v] of Object.entries(old.settingsEnv ?? {})) {
             if (!v.startsWith('secret://'))
                 continue;

package/dist/plugins.d.ts

@@ -50,5 +50,29 @@ export declare function reconcileProfilePlugins(opts: {
     /** ids drifting across profiles — update them here so every profile lands on the same latest. */
     updateIds?: string[];
 }): Promise<string[]>;
+/**
+ * Existing claude-mem cache dirs under a profile (`plugins/cache/<owner>/claude-mem`, any owner).
+ * Disk is the ground truth on purpose: a PROJECT-scope claude-mem install is invisible to
+ * installed_plugins.json's user-scope view (discovery's installedPlugins misses it), yet it still
+ * leaks the same way — `.claude-staffinc` was exactly this case on 2026-07-23. Gating the prune on
+ * install bookkeeping would skip the one profile that needed it most.
+ */
+export declare function claudeMemCacheDirs(configDir: string): Promise<string[]>;
+/**
+ * Keep only the highest-semver version dir under `cacheDir`, delete the rest. Returns removed names.
+ *
+ * Why this is the real fix for the claude-mem leak: the plugin's session-init hook resolves which
+ * worker to launch with `ls -dt <cache>/[0-9]*` — the newest dir by MTIME — and ignores the pinned
+ * version in installed_plugins.json entirely. So a leftover OLD version dir with a fresher mtime is
+ * launched instead of the pinned latest, reviving the shared-`~/.claude-mem`-worker fight even when
+ * every profile's pin is already correct. On 2026-07-23 this ran `.claude-data-plb` (pinned 13.12.1)
+ * up to 187 procs / 20GB swap, all from a stale 13.11.0 dir. Version *parity* (planPluginVersionDrift
+ * + `clp fix`) is necessary but not sufficient; the ambiguity only goes away when one dir remains.
+ *
+ * "Keep highest semver" == keep the intended active version, because `claude plugin update` only ever
+ * moves to the marketplace's latest — there is no way to pin an older one. Non-numeric dirs
+ * (git-sha/"unknown" caches of versionless plugins) are left untouched.
+ */
+export declare function pruneStaleVersionDirs(cacheDir: string): Promise<string[]>;
 /** If a profile's plugins/ is a legacy symlink into the old shared pool, restore it to a real dir. */
 export declare function restoreLegacyPluginSymlink(pluginsDir: string): Promise<boolean>;

package/dist/plugins.js

@@ -1,5 +1,6 @@
-import { cp, lstat, mkdir, readlink, unlink } from 'node:fs/promises';
+import { cp, lstat, mkdir, readdir, readlink, rm, unlink } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
+import { join } from 'node:path';
 export function marketplaceOf(id) {
     const at = id.lastIndexOf('@');
     return at > 0 ? id.slice(at + 1) : null;
@@ -72,6 +73,76 @@ export async function reconcileProfilePlugins(opts) {
     }
     return log;
 }
+/**
+ * Existing claude-mem cache dirs under a profile (`plugins/cache/<owner>/claude-mem`, any owner).
+ * Disk is the ground truth on purpose: a PROJECT-scope claude-mem install is invisible to
+ * installed_plugins.json's user-scope view (discovery's installedPlugins misses it), yet it still
+ * leaks the same way — `.claude-staffinc` was exactly this case on 2026-07-23. Gating the prune on
+ * install bookkeeping would skip the one profile that needed it most.
+ */
+export async function claudeMemCacheDirs(configDir) {
+    const cacheRoot = join(configDir, 'plugins', 'cache');
+    let owners;
+    try {
+        owners = await readdir(cacheRoot);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const owner of owners) {
+        const d = join(cacheRoot, owner, 'claude-mem');
+        if (existsSync(d))
+            out.push(d);
+    }
+    return out;
+}
+/** Compare dotted numeric version names ("13.9.2" < "13.11.0"). Missing parts count as 0. */
+function compareVersionDir(a, b) {
+    const pa = a.split('.'), pb = b.split('.');
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+        const x = Number(pa[i] ?? 0), y = Number(pb[i] ?? 0);
+        if (x !== y)
+            return x - y;
+    }
+    return 0;
+}
+/**
+ * Keep only the highest-semver version dir under `cacheDir`, delete the rest. Returns removed names.
+ *
+ * Why this is the real fix for the claude-mem leak: the plugin's session-init hook resolves which
+ * worker to launch with `ls -dt <cache>/[0-9]*` — the newest dir by MTIME — and ignores the pinned
+ * version in installed_plugins.json entirely. So a leftover OLD version dir with a fresher mtime is
+ * launched instead of the pinned latest, reviving the shared-`~/.claude-mem`-worker fight even when
+ * every profile's pin is already correct. On 2026-07-23 this ran `.claude-data-plb` (pinned 13.12.1)
+ * up to 187 procs / 20GB swap, all from a stale 13.11.0 dir. Version *parity* (planPluginVersionDrift
+ * + `clp fix`) is necessary but not sufficient; the ambiguity only goes away when one dir remains.
+ *
+ * "Keep highest semver" == keep the intended active version, because `claude plugin update` only ever
+ * moves to the marketplace's latest — there is no way to pin an older one. Non-numeric dirs
+ * (git-sha/"unknown" caches of versionless plugins) are left untouched.
+ */
+export async function pruneStaleVersionDirs(cacheDir) {
+    let names;
+    try {
+        names = await readdir(cacheDir);
+    }
+    catch {
+        return [];
+    }
+    const versions = names.filter(n => /^\d/.test(n)).sort(compareVersionDir);
+    if (versions.length <= 1)
+        return [];
+    const keep = versions[versions.length - 1];
+    const removed = [];
+    for (const v of versions) {
+        if (v === keep)
+            continue;
+        await rm(join(cacheDir, v), { recursive: true, force: true });
+        removed.push(v);
+    }
+    return removed;
+}
 /** If a profile's plugins/ is a legacy symlink into the old shared pool, restore it to a real dir. */
 export async function restoreLegacyPluginSymlink(pluginsDir) {
     let st = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccprofiles-core",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "description": "Core library for ccprofiles — discovery, manifest, secrets, apply, and LAN sync for Claude Code multi-account setups",
   "type": "module",
   "main": "./dist/index.js",