claude-account-sync 0.1.0 → 0.2.1

package/README.md

@@ -4,13 +4,14 @@
 
 Run Claude Code with several accounts — personal subscription, work OAuth, API key, alternative providers — each in its own `CLAUDE_CONFIG_DIR`? Then you know the pain: MCP server lists drift apart, skills get shared via hand-made symlinks, API keys end up in plaintext in your `.zshrc`, and setting up a second machine means an afternoon of copy-paste.
 
-The `ccprofiles` command (short alias `clp`) fixes that:
+The `clp` command (also available as `ccprofiles`) fixes that:
 
 - 🔎 **Adopt** your existing `.claude*` directories into a declarative manifest — zero manual config
 - 🧩 **Manage MCP servers** across profiles: drift matrix, add/remove everywhere at once, sync one profile's set to others
-- 🔐 **Secrets out of your rc files** — macOS Keychain / libsecret / encrypted file, with `ccprofiles secrets migrate` to clean up existing plaintext keys
+- 🔐 **Secrets out of your rc files** — macOS Keychain / libsecret / encrypted file, with `clp secrets migrate` to clean up existing plaintext keys
 - 🖥️ **Replicate to another machine over LAN** — PIN pairing, end-to-end encrypted, no cloud, works macOS ↔ Windows ↔ Linux ↔ WSL
-- 📦 **Offline bundles** for the no-network case (`ccprofiles export setup.ccb`)
+- 🖼️ **Web dashboard** — `clp ui` opens a local browser panel to manage everything visually
+- 📦 **Offline bundles** for the no-network case (`clp export setup.ccb`)
 - 🛟 **Safe by design**: surgical config edits only, automatic backups, `--dry-run` everywhere, never touches your sessions/history
 
 ## Install
@@ -21,7 +22,7 @@ Requires **Node ≥ 20** (you have it — Claude Code needs it too).
 npm install -g claude-account-sync
 ```
 
-This installs two equivalent commands: `ccprofiles` (full) and `clp` (short). Use whichever you like.
+This installs two equivalent commands: `clp` (short) and `ccprofiles` (full). The docs below use `clp`.
 
 <details><summary>Install from source instead</summary>
 
@@ -37,26 +38,28 @@ cd packages/cli && npm link
 ## Quickstart
 
 ```bash
-ccprofiles adopt --yes          # REQUIRED FIRST: scan ~/.claude* and build the manifest
-ccprofiles list                 # see all your profiles
-ccprofiles doctor               # find broken links & plaintext keys
-ccprofiles secrets migrate      # move API keys from .zshrc into the OS keychain
+clp adopt --yes          # REQUIRED FIRST: scan ~/.claude* and build the manifest
+clp list                 # see all your profiles
+clp doctor               # find broken links & plaintext keys
+clp secrets migrate      # move API keys from .zshrc into the OS keychain
 ```
 
-Everything except `list`, `adopt`, and `doctor` needs the manifest, so `ccprofiles adopt --yes` is always step one — commands will remind you if you skip it.
+Everything except `list`, `adopt`, and `doctor` needs the manifest, so `clp adopt --yes` is always step one — commands will remind you if you skip it.
+
+Prefer a UI? `clp ui` opens the whole thing in your browser (see below).
 
 ### Manage MCP servers
 
 ```bash
-ccprofiles mcp list                                   # server × profile drift matrix
-ccprofiles mcp add shadcn --all --command npx --args "shadcn@latest,mcp"
-ccprofiles mcp sync --from oauth --to office,z        # make profiles match
+clp mcp list                                   # server × profile drift matrix
+clp mcp add shadcn --all --command npx --args "shadcn@latest,mcp"
+clp mcp sync --from oauth --to office,z        # make profiles match
 ```
 
 ### New profile for a new account
 
 ```bash
-ccprofiles create work --from oauth     # dir + launcher fn + copied MCP set
+clp create work --from oauth     # dir + launcher fn + copied MCP set
 # restart shell, then:
 cl-work                          # launches claude with CLAUDE_CONFIG_DIR=~/.claude-work
 ```
@@ -65,13 +68,13 @@ cl-work                          # launches claude with CLAUDE_CONFIG_DIR=~/.cla
 
 ```bash
 # machine A (source of truth)
-ccprofiles serve --allow-secrets
+clp serve --allow-secrets
 # → ccprofiles sync server on port 51234
 # → pairing PIN: 123456
 
 # machine B
-ccprofiles pair 192.168.1.10 --port 51234 --pin 123456 --name mac
-ccprofiles sync --from mac --with-secrets
+clp pair 192.168.1.10 --port 51234 --pin 123456 --name mac
+clp sync --from mac --with-secrets
 ```
 
 Manifest, MCP servers, skills, commands, launcher functions, and (opt-in) secrets all arrive — rendered for the local OS: PowerShell profile functions and junctions on Windows, `.zshrc`/`.bashrc` functions and symlinks elsewhere.
@@ -81,21 +84,29 @@ Two things intentionally don't travel:
 - **OAuth sessions** — you still run `/login` once per account on the new machine (Anthropic session state is machine-bound; syncing it would be wrong).
 - The **`default` profile has no `cl-*` launcher** — it's what plain `claude` already launches; only the named profiles get launcher functions.
 
+## Web dashboard
+
+```bash
+clp ui                   # opens http://127.0.0.1:<port>/?t=<token> in your browser
+```
+
+A local panel to manage profiles, MCP servers (interactive drift matrix), secrets (add / reveal / delete / migrate), sync, and doctor — everything the CLI does. It's **localhost-only** and guarded by a per-launch session token plus an Origin check, so nothing off your machine (and no website in your browser) can reach the API. Pass `--no-open` to just print the URL, or `--port <n>` to pin the port.
+
 ## How it works
 
 Three layers of state:
 
-1. **Live state** — your actual `.claude*` dirs and shell rc files. Claude Code owns these; ccprofiles edits only the keys it manages (`mcpServers`, its marked rc block, its links).
+1. **Live state** — your actual `.claude*` dirs and shell rc files. Claude Code owns these; the tool edits only the keys it manages (`mcpServers`, its marked rc block, its links).
 2. **Manifest** — `~/.ccprofiles/manifest.yaml`, a platform-neutral declaration (paths templated as `{home}`, secrets referenced as `secret://name`). Versioned with local git commits; safe to share.
-3. **Secrets store** — per-machine keychain: macOS Keychain, Linux `secret-tool` (libsecret), or an AES-256-GCM encrypted file as fallback (native Windows and headless Linux — set `CCPROFILES_PASSPHRASE` in your environment for it). Values never appear in the manifest, bundles, or rc files; launchers resolve them at run time via `ccprofiles secrets get`.
+3. **Secrets store** — per-machine keychain: macOS Keychain, Linux `secret-tool` (libsecret), or an AES-256-GCM encrypted file as fallback (native Windows and headless Linux — set `CCPROFILES_PASSPHRASE` in your environment for it). Values never appear in the manifest, bundles, or rc files; launcher functions resolve them at run time by calling the CLI.
 
-> ⚠️ `ccprofiles secrets set <name> <value>` takes the value as an argument, which lands in your shell history — prefer `ccprofiles secrets migrate` (reads from rc files) or clear history after. Interactive prompting is on the roadmap.
+> ⚠️ `clp secrets set <name> <value>` takes the value as an argument, which lands in your shell history — prefer `clp secrets migrate` (reads from rc files) or clear history after. Interactive prompting is on the roadmap.
 
-`ccprofiles status` shows drift between manifest and live; `ccprofiles apply` reconciles (with backups under `~/.ccprofiles/backups/`); `ccprofiles snapshot` goes the other way (live → manifest).
+`clp status` shows drift between manifest and live; `clp apply` reconciles (with backups under `~/.ccprofiles/backups/`); `clp snapshot` goes the other way (live → manifest).
 
 ### Sync security model
 
-Pairing performs an X25519 ECDH key exchange authenticated by the 6-digit PIN shown on the serving device (HMAC confirmation both ways — a MITM on your network cannot complete pairing without the PIN, and the client verifies the server too). All subsequent payloads are AES-256-GCM encrypted with the pairing key. Secrets transfer additionally requires the server to opt in with `--allow-secrets`, and values go straight into the receiving machine's keychain.
+Pairing performs an X25519 ECDH key exchange authenticated by the 6-digit PIN shown on the serving device (HMAC confirmation both ways — a MITM on your network cannot complete pairing without the PIN, and the client verifies the server too). All subsequent payloads are AES-256-GCM encrypted with the pairing key. Secrets transfer additionally requires the server to opt in with `--allow-secrets`, and values go straight into the receiving machine's keychain. Pairing locks after 5 wrong PINs.
 
 ## Commands
 
@@ -107,6 +118,7 @@ Pairing performs an X25519 ECDH key exchange authenticated by the 6-digit PIN sh
 | Manifest | `status` · `apply` · `snapshot` |
 | Sync | `serve [--allow-secrets]` · `pair <host> --port n --pin p` · `devices` · `sync --from dev [--with-secrets]` |
 | Bundle | `export <file>` · `import <file>` |
+| Dashboard | `ui [--port n] [--no-open]` |
 
 All mutating commands support `--dry-run`. Every mutation backs up the files it touches to `~/.ccprofiles/backups/<timestamp>/` first.
 
@@ -114,33 +126,33 @@ All mutating commands support `--dry-run`. Every mutation backs up the files it
 
 | Symptom | Fix |
 |---|---|
-| `error: no manifest yet` | Run `ccprofiles adopt --yes` first — it builds the manifest from your existing profiles |
-| `zsh: command not found: ccp` | Not linked/installed — see Install; if just linked, run `rehash` |
-| ``cannot reach <host> — is `ccprofiles serve` running?`` | Start `ccprofiles serve` on the other device; check you're on the same network and the port matches |
+| `error: no manifest yet` | Run `clp adopt --yes` first — it builds the manifest from your existing profiles |
+| `zsh: command not found: clp` | Not linked/installed — see Install; if just linked, run `rehash` |
+| ``cannot reach <host> — is `ccprofiles serve` running?`` | Start `clp serve` on the other device; check you're on the same network and the port matches |
 | `encrypted-file backend requires a passphrase` | Set `CCPROFILES_PASSPHRASE` (Windows / Linux without libsecret) |
 | Profile shows account `-` after sync | Expected — run `/login` inside that profile once; OAuth sessions don't sync |
 | Something went wrong after `apply` | Restore from `~/.ccprofiles/backups/<latest>/` |
 
 ## Roadmap
 
-- Web dashboard on top of `ccprofiles-core`
-- mDNS auto-discovery for `ccprofiles devices`
+- mDNS auto-discovery for `clp devices`
+- Pair devices from the dashboard (currently CLI-only)
 - Windows Credential Manager (DPAPI) secrets backend
 - Interactive prompts (`secrets set` without echoing, `adopt` confirmation)
 
 ## Development
 
-npm-workspaces monorepo: `packages/core` (library) + `packages/cli` (commander wrapper).
+npm-workspaces monorepo: `packages/core` (library) + `packages/cli` (commander wrapper) + `packages/ui` (dashboard). The published CLI is [`claude-account-sync`](https://www.npmjs.com/package/claude-account-sync); the library is [`ccprofiles-core`](https://www.npmjs.com/package/ccprofiles-core).
 
 ```bash
 npm install
 npm test        # vitest — unit + e2e (incl. an in-process two-machine sync test)
-npm run build
+npm run build   # builds core + cli + the dashboard, bundled into the CLI
 ```
 
 ## Related projects
 
-Not to be confused with [samhvw8/claude-code-profile](https://github.com/samhvw8/claude-code-profile) (the `ccp` command) — a great tool for a **different** job: a central hub of reusable skills/agents/hooks/commands, with profiles for different *workflows*. It explicitly does **not** handle MCP servers, secrets, LAN sync, or multiple *accounts* — which are exactly this tool's focus. The two are complementary; this one deliberately uses the `ccprofiles`/`clp` commands to avoid clashing with its `ccp`.
+Not to be confused with [samhvw8/claude-code-profile](https://github.com/samhvw8/claude-code-profile) (the `ccp` command) — a great tool for a **different** job: a central hub of reusable skills/agents/hooks/commands, with profiles for different *workflows*. It explicitly does **not** handle MCP servers, secrets, LAN sync, or multiple *accounts* — which are exactly this tool's focus. The two are complementary; this one deliberately uses the `clp` / `ccprofiles` commands to avoid clashing with its `ccp`.
 
 ## License
 

package/dist/commands/secrets.js

@@ -15,6 +15,38 @@ const KEY_VARS = ['ANTHROPIC_API_KEY', 'CLAUDE_CODE_OAUTH_TOKEN', 'ANTHROPIC_AUT
 // posix: export VAR="sk-..."   powershell: $env:VAR = "sk-..."
 const MIGRATE_RE_POSIX = new RegExp(`^(\\s*(?:export\\s+)?(${KEY_VARS.join('|')})\\s*=\\s*)"?(sk-[A-Za-z0-9_-]+)"?(.*)$`);
 const MIGRATE_RE_PWSH = new RegExp(`^(\\s*\\$env:(${KEY_VARS.join('|')})\\s*=\\s*)"?(sk-[A-Za-z0-9_-]+)"?(.*)$`);
+/** Move plaintext keys out of the shell rc file into the secrets store. Shared by the CLI and the UI API. */
+export async function migrateRcSecrets(ctx, opts = {}) {
+    const rcFile = ctx.platform.rcFile;
+    if (!existsSync(rcFile))
+        return [];
+    const store = await secretsStore(ctx);
+    const lines = (await readFile(rcFile, 'utf8')).split('\n');
+    const migrated = [];
+    const out = [];
+    for (const line of lines) {
+        const pwsh = line.match(MIGRATE_RE_PWSH);
+        const posix = pwsh ? null : line.match(MIGRATE_RE_POSIX);
+        const match = pwsh ?? posix;
+        if (!match) {
+            out.push(line);
+            continue;
+        }
+        const [, prefix, varName, secretValue, suffix] = match;
+        const secretName = varName.toLowerCase().replaceAll('_', '-');
+        if (!opts.dryRun)
+            await store.set(secretName, secretValue);
+        out.push(pwsh
+            ? `${prefix}(ccprofiles secrets get ${secretName})${suffix}`
+            : `${prefix}"$(ccprofiles secrets get ${secretName})"${suffix}`);
+        migrated.push(secretName);
+    }
+    if (migrated.length && !opts.dryRun) {
+        await backupFiles([rcFile], ctx.backupRoot, new Date().toISOString().replace(/[:.]/g, '-'));
+        await atomicWrite(rcFile, out.join('\n'));
+    }
+    return migrated;
+}
 export function registerSecretsCommands(program, ctx) {
     const sec = program.command('secrets').description('manage secrets (values never stored in configs)');
     sec.command('set <name> [value]').action(async (name, value) => {
@@ -44,40 +76,11 @@ export function registerSecretsCommands(program, ctx) {
         console.log(`removed ${name}`);
     });
     sec.command('migrate').option('--dry-run').action(async (opts) => {
-        const rcFile = ctx.platform.rcFile;
-        if (!existsSync(rcFile)) {
-            console.log('no rc file found');
-            return;
-        }
-        const store = await secretsStore(ctx);
-        const lines = (await readFile(rcFile, 'utf8')).split('\n');
-        const migrated = [];
-        const out = [];
-        for (const line of lines) {
-            const pwsh = line.match(MIGRATE_RE_PWSH);
-            const posix = pwsh ? null : line.match(MIGRATE_RE_POSIX);
-            const match = pwsh ?? posix;
-            if (!match) {
-                out.push(line);
-                continue;
-            }
-            const [, prefix, varName, secretValue, suffix] = match;
-            const secretName = varName.toLowerCase().replaceAll('_', '-');
-            if (!opts.dryRun)
-                await store.set(secretName, secretValue);
-            out.push(pwsh
-                ? `${prefix}(ccprofiles secrets get ${secretName})${suffix}`
-                : `${prefix}"$(ccprofiles secrets get ${secretName})"${suffix}`);
-            migrated.push(secretName);
-        }
+        const migrated = await migrateRcSecrets(ctx, opts);
         if (migrated.length === 0) {
             console.log('no plaintext keys found');
             return;
         }
-        if (!opts.dryRun) {
-            await backupFiles([rcFile], ctx.backupRoot, new Date().toISOString().replace(/[:.]/g, '-'));
-            await atomicWrite(rcFile, out.join('\n'));
-        }
         for (const n of migrated)
             console.log(`${opts.dryRun ? '[dry-run] ' : ''}migrated ${n}`);
     });

package/dist/context.js

@@ -8,6 +8,7 @@ import { registerSecretsCommands } from './commands/secrets.js';
 import { registerManifestCommands } from './commands/manifest.js';
 import { registerSyncCommands } from './commands/sync.js';
 import { registerBundleCommands } from './commands/bundle.js';
+import { registerUiCommand } from './ui/command.js';
 export function makeContext(env = process.env) {
     const testHome = env.CCPROFILES_TEST_HOME;
     const platform = detectPlatform(testHome ? { home: testHome, shell: env.SHELL } : {});
@@ -38,5 +39,6 @@ export function buildProgram(ctx) {
     registerManifestCommands(program, ctx);
     registerSyncCommands(program, ctx);
     registerBundleCommands(program, ctx);
+    registerUiCommand(program, ctx);
     return program;
 }

package/dist/ui/api.js

@@ -0,0 +1,255 @@
+import { discoverProfiles, buildManifest, saveManifest, planApply, executeApply, ensureRootGitignore, loadManifest, loadDevices, fetchRemote, fetchSecrets, writeAssets, parseManifest, backupFiles, } from 'ccprofiles-core';
+import { existsSync, readFileSync, lstatSync, readlinkSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { requireManifest } from '../context.js';
+import { secretsStore, migrateRcSecrets } from '../commands/secrets.js';
+import { sendJson, readJson, HttpError } from './http.js';
+function stamp() { return new Date().toISOString().replace(/[:.]/g, '-'); }
+function profileName(dirName) {
+    return dirName === '.claude' ? 'default' : dirName.slice('.claude-'.length);
+}
+export function buildRoutes(ctx) {
+    const routes = [];
+    const add = (method, pattern, handler) => routes.push({ method, pattern, handler });
+    async function applyAndReport(m) {
+        const actions = planApply(m, await discoverProfiles(ctx.home), ctx.platform);
+        return executeApply(actions, { backupRoot: ctx.backupRoot, stamp: stamp() });
+    }
+    // requireManifest throws a plain Error; surface "no manifest yet" as a 409 the UI can detect.
+    async function mustManifest() {
+        try {
+            return await requireManifest(ctx);
+        }
+        catch (e) {
+            throw new HttpError(409, e.message);
+        }
+    }
+    function targetsOf(m, targets) {
+        if (targets === 'all')
+            return m.profiles.map(p => p.name);
+        for (const t of targets)
+            if (!m.profiles.some(p => p.name === t))
+                throw new HttpError(400, `unknown profile: ${t}`);
+        return targets;
+    }
+    // ── adopt / profiles / status / apply / doctor ──────────────────────────────
+    add('POST', /^\/api\/adopt$/, async (_m, _req, res) => {
+        const manifest = buildManifest(await discoverProfiles(ctx.home), ctx.platform);
+        if (!existsSync(join(ctx.manifestRoot, '.git'))) {
+            try {
+                execFileSync('git', ['init', ctx.manifestRoot], { stdio: 'ignore' });
+            }
+            catch { /* git optional */ }
+        }
+        await ensureRootGitignore(ctx.manifestRoot);
+        await saveManifest(ctx.manifestRoot, manifest);
+        sendJson(res, 200, { profiles: manifest.profiles.length, mcpServers: Object.keys(manifest.mcpServers).length });
+    });
+    add('GET', /^\/api\/profiles$/, async (_m, _req, res) => {
+        const live = await discoverProfiles(ctx.home);
+        let manifest = null;
+        if (existsSync(join(ctx.manifestRoot, 'manifest.yaml')))
+            manifest = await loadManifest(ctx.manifestRoot);
+        const rows = live.map(lp => {
+            const name = profileName(lp.dirName);
+            const decl = manifest?.profiles.find(p => p.name === name) ?? null;
+            return {
+                name, dir: lp.dir, auth: decl?.auth ?? (lp.account ? 'oauth' : 'env'),
+                account: lp.account, mcp: Object.keys(lp.mcpServers).length,
+                launcher: decl?.launcher ?? (name === 'default' ? null : `cl-${name}`),
+                adopted: !!decl,
+            };
+        });
+        sendJson(res, 200, rows);
+    });
+    add('POST', /^\/api\/profiles$/, async (_m, req, res) => {
+        const { name, from } = await readJson(req);
+        if (!name)
+            throw new HttpError(400, 'name required');
+        const m = await mustManifest();
+        if (m.profiles.some(p => p.name === name))
+            throw new HttpError(409, `profile exists: ${name}`);
+        const src = from ? m.profiles.find(p => p.name === from) : null;
+        if (from && !src)
+            throw new HttpError(400, `unknown profile: ${from}`);
+        m.profiles.push({
+            name, dir: `{home}/.claude-${name}`, launcher: `cl-${name}`, auth: 'env', env: {},
+            links: src ? { ...src.links } : (m.hub ? { skills: 'hub', commands: 'hub' } : {}),
+            mcp: src ? [...src.mcp] : [],
+        });
+        await saveManifest(ctx.manifestRoot, m);
+        await applyAndReport(m);
+        sendJson(res, 200, { ok: true });
+    });
+    add('PATCH', /^\/api\/profiles\/([^/]+)$/, async (mtch, req, res) => {
+        const m = await mustManifest();
+        const pr = m.profiles.find(p => p.name === mtch[1]);
+        if (!pr)
+            throw new HttpError(404, `unknown profile: ${mtch[1]}`);
+        const body = await readJson(req);
+        if (body.env)
+            pr.env = body.env;
+        if (body.links)
+            pr.links = body.links;
+        if (body.launcher !== undefined)
+            pr.launcher = body.launcher;
+        await saveManifest(ctx.manifestRoot, m);
+        await applyAndReport(m);
+        sendJson(res, 200, { ok: true });
+    });
+    add('GET', /^\/api\/status$/, async (_m, _req, res) => {
+        const m = await mustManifest();
+        const actions = planApply(m, await discoverProfiles(ctx.home), ctx.platform);
+        const r = await executeApply(actions, { backupRoot: ctx.backupRoot, stamp: stamp(), dryRun: true });
+        sendJson(res, 200, { inSync: actions.length === 0, pending: r.performed });
+    });
+    add('POST', /^\/api\/apply$/, async (_m, _req, res) => {
+        const m = await mustManifest();
+        const r = await applyAndReport(m);
+        sendJson(res, 200, { performed: r.performed, backupDir: r.backupDir });
+    });
+    add('GET', /^\/api\/doctor$/, async (_m, _req, res) => {
+        const problems = [];
+        const live = await discoverProfiles(ctx.home);
+        for (const lp of live)
+            for (const nm of readdirSync(lp.dir)) {
+                const f = join(lp.dir, nm);
+                try {
+                    if (lstatSync(f).isSymbolicLink() && !existsSync(f))
+                        problems.push(`broken symlink: ${f} -> ${readlinkSync(f)}`);
+                }
+                catch { /* skip */ }
+            }
+        if (existsSync(ctx.platform.rcFile)) {
+            const rc = readFileSync(ctx.platform.rcFile, 'utf8');
+            const outside = rc.split('# >>> ccprofiles managed >>>')[0] + (rc.split('# <<< ccprofiles managed <<<')[1] ?? '');
+            if (/sk-ant-/.test(outside))
+                problems.push(`plaintext Anthropic key in ${ctx.platform.rcFile} — run secrets migrate`);
+        }
+        if (existsSync(join(ctx.manifestRoot, 'manifest.yaml'))) {
+            const m = await loadManifest(ctx.manifestRoot);
+            for (const pr of m.profiles) {
+                const dir = pr.dir.replace('{home}', ctx.home);
+                if (!existsSync(dir))
+                    problems.push(`manifest profile "${pr.name}" missing on disk: ${dir} — run apply`);
+            }
+        }
+        sendJson(res, 200, { problems });
+    });
+    // ── mcp ─────────────────────────────────────────────────────────────────────
+    add('GET', /^\/api\/mcp$/, async (_m, _req, res) => {
+        const m = await mustManifest();
+        sendJson(res, 200, {
+            servers: Object.keys(m.mcpServers).sort(),
+            profiles: m.profiles.map(p => ({ name: p.name, has: p.mcp })),
+        });
+    });
+    add('POST', /^\/api\/mcp$/, async (_m, req, res) => {
+        const { name, command, args, targets } = await readJson(req);
+        if (!name)
+            throw new HttpError(400, 'name required');
+        const m = await mustManifest();
+        if (!m.mcpServers[name]) {
+            if (!command)
+                throw new HttpError(400, `unknown server "${name}" — command required to define it`);
+            m.mcpServers[name] = { command, ...(args && args.length ? { args } : {}) };
+        }
+        for (const t of targetsOf(m, targets)) {
+            const pr = m.profiles.find(p => p.name === t);
+            if (!pr.mcp.includes(name))
+                pr.mcp.push(name);
+        }
+        await saveManifest(ctx.manifestRoot, m);
+        await applyAndReport(m);
+        sendJson(res, 200, { ok: true });
+    });
+    add('DELETE', /^\/api\/mcp\/([^/]+)$/, async (mtch, req, res) => {
+        const { targets } = await readJson(req);
+        const m = await mustManifest();
+        const name = decodeURIComponent(mtch[1]);
+        for (const t of targetsOf(m, targets)) {
+            const pr = m.profiles.find(p => p.name === t);
+            pr.mcp = pr.mcp.filter(x => x !== name);
+        }
+        if (!m.profiles.some(p => p.mcp.includes(name)))
+            delete m.mcpServers[name];
+        await saveManifest(ctx.manifestRoot, m);
+        await applyAndReport(m);
+        sendJson(res, 200, { ok: true });
+    });
+    add('POST', /^\/api\/mcp\/sync$/, async (_m, req, res) => {
+        const { from, to } = await readJson(req);
+        const m = await mustManifest();
+        const src = m.profiles.find(p => p.name === from);
+        if (!src)
+            throw new HttpError(400, `unknown profile: ${from}`);
+        for (const t of targetsOf(m, to)) {
+            if (t === src.name)
+                continue;
+            m.profiles.find(p => p.name === t).mcp = [...src.mcp];
+        }
+        await saveManifest(ctx.manifestRoot, m);
+        await applyAndReport(m);
+        sendJson(res, 200, { ok: true });
+    });
+    // ── secrets ─────────────────────────────────────────────────────────────────
+    add('GET', /^\/api\/secrets$/, async (_m, _req, res) => {
+        const store = await secretsStore(ctx);
+        sendJson(res, 200, { names: await store.list(), backend: store.backendName });
+    });
+    add('GET', /^\/api\/secrets\/([^/]+)$/, async (mtch, _req, res) => {
+        const store = await secretsStore(ctx);
+        const value = await store.get(decodeURIComponent(mtch[1]));
+        if (value === null)
+            throw new HttpError(404, 'not found');
+        sendJson(res, 200, { value });
+    });
+    add('PUT', /^\/api\/secrets\/([^/]+)$/, async (mtch, req, res) => {
+        const { value } = await readJson(req);
+        if (typeof value !== 'string')
+            throw new HttpError(400, 'value required');
+        const store = await secretsStore(ctx);
+        await store.set(decodeURIComponent(mtch[1]), value);
+        sendJson(res, 200, { ok: true });
+    });
+    add('DELETE', /^\/api\/secrets\/([^/]+)$/, async (mtch, _req, res) => {
+        const store = await secretsStore(ctx);
+        await store.delete(decodeURIComponent(mtch[1]));
+        sendJson(res, 200, { ok: true });
+    });
+    add('POST', /^\/api\/secrets\/migrate$/, async (_m, _req, res) => {
+        sendJson(res, 200, { migrated: await migrateRcSecrets(ctx) });
+    });
+    // ── devices / sync ──────────────────────────────────────────────────────────
+    add('GET', /^\/api\/devices$/, async (_m, _req, res) => {
+        sendJson(res, 200, await loadDevices(ctx.manifestRoot));
+    });
+    add('POST', /^\/api\/sync$/, async (_m, req, res) => {
+        const { from, withSecrets, dryRun } = await readJson(req);
+        const device = (await loadDevices(ctx.manifestRoot)).find(d => d.name === from);
+        if (!device)
+            throw new HttpError(400, `unknown device: ${from}`);
+        const { manifestYaml, assets } = await fetchRemote(device);
+        const m = parseManifest(manifestYaml);
+        if (!dryRun) {
+            await backupFiles([join(ctx.manifestRoot, 'manifest.yaml')], ctx.backupRoot, stamp());
+            await saveManifest(ctx.manifestRoot, m);
+            await writeAssets(assets, m, ctx.platform);
+        }
+        const actions = planApply(m, await discoverProfiles(ctx.home), ctx.platform);
+        const r = await executeApply(actions, { backupRoot: ctx.backupRoot, stamp: stamp(), dryRun: !!dryRun });
+        let secrets = [];
+        if (withSecrets) {
+            const values = await fetchSecrets(device, []);
+            if (!dryRun) {
+                const store = await secretsStore(ctx);
+                for (const [k, v] of Object.entries(values))
+                    await store.set(k, v);
+            }
+            secrets = Object.keys(values);
+        }
+        sendJson(res, 200, { performed: r.performed, secrets });
+    });
+    return routes;
+}

package/dist/ui/command.js

@@ -0,0 +1,42 @@
+import { existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawn } from 'node:child_process';
+import { startUiServer } from './server.js';
+import { newUiToken } from './token.js';
+function defaultUiDir() {
+    // this file compiles to dist/ui/command.js; the built frontend is copied to dist/webui
+    const here = dirname(fileURLToPath(import.meta.url)); // .../dist/ui
+    return join(dirname(here), 'webui'); // .../dist/webui
+}
+function openBrowser(url) {
+    const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open';
+    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+    try {
+        spawn(cmd, args, { stdio: 'ignore', detached: true }).unref();
+    }
+    catch { /* non-fatal */ }
+}
+export function registerUiCommand(program, ctx) {
+    program.command('ui').description('open the web dashboard (localhost)')
+        .option('--port <n>', 'port (default: random)', v => parseInt(v, 10))
+        .option('--no-open', 'do not open the browser automatically')
+        .action(async (opts) => {
+        const uiDir = ctx.env.CCPROFILES_UI_DIR ?? defaultUiDir();
+        if (!existsSync(join(uiDir, 'index.html'))) {
+            console.log(`dashboard assets not found at ${uiDir} — build first: npm run build`);
+            return;
+        }
+        const token = newUiToken();
+        const srv = await startUiServer(ctx, { port: opts.port, token, uiDir });
+        const url = `http://127.0.0.1:${srv.port}/?t=${token}`;
+        console.log(`ccprofiles dashboard: ${url}`);
+        console.log('(localhost only · Ctrl-C to stop)');
+        if (opts.open !== false)
+            openBrowser(url);
+        globalThis.__uiServerClose = srv.close;
+        globalThis.__uiOnListening?.();
+        if (!ctx.env.CCPROFILES_UI_DIR)
+            await new Promise(() => { }); // run until Ctrl-C in real use
+    });
+}

package/dist/ui/http.js

@@ -0,0 +1,42 @@
+export class HttpError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+export class BadRequest extends HttpError {
+    constructor(message = 'invalid request') { super(400, message); }
+}
+export async function readBody(req) {
+    const chunks = [];
+    for await (const c of req)
+        chunks.push(c);
+    return Buffer.concat(chunks).toString('utf8');
+}
+export async function readJson(req) {
+    const raw = await readBody(req);
+    if (!raw)
+        return {};
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        throw new BadRequest('invalid JSON body');
+    }
+}
+export function sendJson(res, code, body) {
+    const text = JSON.stringify(body);
+    res.writeHead(code, { 'content-type': 'application/json', 'content-length': Buffer.byteLength(text) });
+    res.end(text);
+}
+export function matchRoute(routes, method, path) {
+    for (const route of routes) {
+        if (route.method !== method)
+            continue;
+        const match = path.match(route.pattern);
+        if (match)
+            return { route, match };
+    }
+    return null;
+}

package/dist/ui/server.js

@@ -0,0 +1,36 @@
+import { createServer } from 'node:http';
+import { buildRoutes } from './api.js';
+import { matchRoute, sendJson, HttpError } from './http.js';
+import { tokenOk, originOk } from './token.js';
+import { serveStatic } from './static.js';
+export async function startUiServer(ctx, opts) {
+    const routes = buildRoutes(ctx);
+    const server = createServer(async (req, res) => {
+        const url = req.url ?? '/';
+        const path = url.split('?')[0];
+        if (!path.startsWith('/api/'))
+            return serveStatic(res, url, opts.uiDir);
+        const address = server.address();
+        const port = typeof address === 'object' && address ? address.port : 0;
+        if (!originOk(req.headers.origin, port))
+            return sendJson(res, 403, { error: 'bad origin' });
+        if (!tokenOk(req.headers['x-ccp-token'], opts.token))
+            return sendJson(res, 401, { error: 'unauthorized' });
+        const m = matchRoute(routes, req.method ?? 'GET', path);
+        if (!m)
+            return sendJson(res, 404, { error: 'not found' });
+        try {
+            await m.route.handler(m.match, req, res);
+        }
+        catch (e) {
+            if (e instanceof HttpError)
+                return sendJson(res, e.status, { error: e.message });
+            process.stderr.write(`ui api error: ${e.stack ?? e}\n`);
+            return sendJson(res, 500, { error: 'internal error' });
+        }
+    });
+    await new Promise(resolve => server.listen(opts.port ?? 0, '127.0.0.1', resolve));
+    const address = server.address();
+    const port = typeof address === 'object' && address ? address.port : 0;
+    return { port, close: () => new Promise((resolve, reject) => server.close(e => (e ? reject(e) : resolve()))) };
+}