claude-account-sync 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ccprofiles contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,147 @@
+# ccprofiles
+
+**Profile manager for [Claude Code](https://claude.com/claude-code) multi-account setups.**
+
+Run Claude Code with several accounts — personal subscription, work OAuth, API key, alternative providers — each in its own `CLAUDE_CONFIG_DIR`? Then you know the pain: MCP server lists drift apart, skills get shared via hand-made symlinks, API keys end up in plaintext in your `.zshrc`, and setting up a second machine means an afternoon of copy-paste.
+
+The `ccprofiles` command (short alias `clp`) fixes that:
+
+- 🔎 **Adopt** your existing `.claude*` directories into a declarative manifest — zero manual config
+- 🧩 **Manage MCP servers** across profiles: drift matrix, add/remove everywhere at once, sync one profile's set to others
+- 🔐 **Secrets out of your rc files** — macOS Keychain / libsecret / encrypted file, with `ccprofiles secrets migrate` to clean up existing plaintext keys
+- 🖥️ **Replicate to another machine over LAN** — PIN pairing, end-to-end encrypted, no cloud, works macOS ↔ Windows ↔ Linux ↔ WSL
+- 📦 **Offline bundles** for the no-network case (`ccprofiles export setup.ccb`)
+- 🛟 **Safe by design**: surgical config edits only, automatic backups, `--dry-run` everywhere, never touches your sessions/history
+
+## Install
+
+Requires **Node ≥ 20** (you have it — Claude Code needs it too).
+
+```bash
+npm install -g claude-account-sync
+```
+
+This installs two equivalent commands: `ccprofiles` (full) and `clp` (short). Use whichever you like.
+
+<details><summary>Install from source instead</summary>
+
+```bash
+git clone https://github.com/tmfadhlul/claude-code-profile.git && cd claude-code-profile
+npm install && npm run build
+cd packages/cli && npm link
+```
+
+> Using nvm? `npm link` installs into the *active* node version — re-link after `nvm use <other>`.
+</details>
+
+## Quickstart
+
+```bash
+ccprofiles adopt --yes          # REQUIRED FIRST: scan ~/.claude* and build the manifest
+ccprofiles list                 # see all your profiles
+ccprofiles doctor               # find broken links & plaintext keys
+ccprofiles secrets migrate      # move API keys from .zshrc into the OS keychain
+```
+
+Everything except `list`, `adopt`, and `doctor` needs the manifest, so `ccprofiles adopt --yes` is always step one — commands will remind you if you skip it.
+
+### Manage MCP servers
+
+```bash
+ccprofiles mcp list                                   # server × profile drift matrix
+ccprofiles mcp add shadcn --all --command npx --args "shadcn@latest,mcp"
+ccprofiles mcp sync --from oauth --to office,z        # make profiles match
+```
+
+### New profile for a new account
+
+```bash
+ccprofiles create work --from oauth     # dir + launcher fn + copied MCP set
+# restart shell, then:
+cl-work                          # launches claude with CLAUDE_CONFIG_DIR=~/.claude-work
+```
+
+### Replicate to a second machine
+
+```bash
+# machine A (source of truth)
+ccprofiles serve --allow-secrets
+# → ccprofiles sync server on port 51234
+# → pairing PIN: 123456
+
+# machine B
+ccprofiles pair 192.168.1.10 --port 51234 --pin 123456 --name mac
+ccprofiles sync --from mac --with-secrets
+```
+
+Manifest, MCP servers, skills, commands, launcher functions, and (opt-in) secrets all arrive — rendered for the local OS: PowerShell profile functions and junctions on Windows, `.zshrc`/`.bashrc` functions and symlinks elsewhere.
+
+Two things intentionally don't travel:
+
+- **OAuth sessions** — you still run `/login` once per account on the new machine (Anthropic session state is machine-bound; syncing it would be wrong).
+- The **`default` profile has no `cl-*` launcher** — it's what plain `claude` already launches; only the named profiles get launcher functions.
+
+## How it works
+
+Three layers of state:
+
+1. **Live state** — your actual `.claude*` dirs and shell rc files. Claude Code owns these; ccprofiles edits only the keys it manages (`mcpServers`, its marked rc block, its links).
+2. **Manifest** — `~/.ccprofiles/manifest.yaml`, a platform-neutral declaration (paths templated as `{home}`, secrets referenced as `secret://name`). Versioned with local git commits; safe to share.
+3. **Secrets store** — per-machine keychain: macOS Keychain, Linux `secret-tool` (libsecret), or an AES-256-GCM encrypted file as fallback (native Windows and headless Linux — set `CCPROFILES_PASSPHRASE` in your environment for it). Values never appear in the manifest, bundles, or rc files; launchers resolve them at run time via `ccprofiles secrets get`.
+
+> ⚠️ `ccprofiles secrets set <name> <value>` takes the value as an argument, which lands in your shell history — prefer `ccprofiles secrets migrate` (reads from rc files) or clear history after. Interactive prompting is on the roadmap.
+
+`ccprofiles status` shows drift between manifest and live; `ccprofiles apply` reconciles (with backups under `~/.ccprofiles/backups/`); `ccprofiles snapshot` goes the other way (live → manifest).
+
+### Sync security model
+
+Pairing performs an X25519 ECDH key exchange authenticated by the 6-digit PIN shown on the serving device (HMAC confirmation both ways — a MITM on your network cannot complete pairing without the PIN, and the client verifies the server too). All subsequent payloads are AES-256-GCM encrypted with the pairing key. Secrets transfer additionally requires the server to opt in with `--allow-secrets`, and values go straight into the receiving machine's keychain.
+
+## Commands
+
+| Area | Commands |
+|---|---|
+| Profiles | `list` · `create <name> [--from p]` · `adopt [--yes]` · `doctor` |
+| MCP | `mcp list` · `mcp add/rm <name> [--profile p\|--all]` · `mcp sync --from p --to p1,p2\|--all` |
+| Secrets | `secrets set/get/list/rm` · `secrets migrate` |
+| Manifest | `status` · `apply` · `snapshot` |
+| Sync | `serve [--allow-secrets]` · `pair <host> --port n --pin p` · `devices` · `sync --from dev [--with-secrets]` |
+| Bundle | `export <file>` · `import <file>` |
+
+All mutating commands support `--dry-run`. Every mutation backs up the files it touches to `~/.ccprofiles/backups/<timestamp>/` first.
+
+## Troubleshooting
+
+| Symptom | Fix |
+|---|---|
+| `error: no manifest yet` | Run `ccprofiles adopt --yes` first — it builds the manifest from your existing profiles |
+| `zsh: command not found: ccp` | Not linked/installed — see Install; if just linked, run `rehash` |
+| ``cannot reach <host> — is `ccprofiles serve` running?`` | Start `ccprofiles serve` on the other device; check you're on the same network and the port matches |
+| `encrypted-file backend requires a passphrase` | Set `CCPROFILES_PASSPHRASE` (Windows / Linux without libsecret) |
+| Profile shows account `-` after sync | Expected — run `/login` inside that profile once; OAuth sessions don't sync |
+| Something went wrong after `apply` | Restore from `~/.ccprofiles/backups/<latest>/` |
+
+## Roadmap
+
+- Web dashboard on top of `ccprofiles-core`
+- mDNS auto-discovery for `ccprofiles devices`
+- Windows Credential Manager (DPAPI) secrets backend
+- Interactive prompts (`secrets set` without echoing, `adopt` confirmation)
+
+## Development
+
+npm-workspaces monorepo: `packages/core` (library) + `packages/cli` (commander wrapper).
+
+```bash
+npm install
+npm test        # vitest — unit + e2e (incl. an in-process two-machine sync test)
+npm run build
+```
+
+## Related projects
+
+Not to be confused with [samhvw8/claude-code-profile](https://github.com/samhvw8/claude-code-profile) (the `ccp` command) — a great tool for a **different** job: a central hub of reusable skills/agents/hooks/commands, with profiles for different *workflows*. It explicitly does **not** handle MCP servers, secrets, LAN sync, or multiple *accounts* — which are exactly this tool's focus. The two are complementary; this one deliberately uses the `ccprofiles`/`clp` commands to avoid clashing with its `ccp`.
+
+## License
+
+MIT

package/dist/commands/bundle.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+import { type CliContext } from '../context.js';
+export declare function registerBundleCommands(program: Command, ctx: CliContext): void;

package/dist/commands/bundle.js

@@ -0,0 +1,39 @@
+import { exportBundle, importBundle, collectAssets, writeAssets, parseManifest, serializeManifest, saveManifest, discoverProfiles, planApply, executeApply, backupFiles, } from 'ccprofiles-core';
+import { readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { requireManifest } from '../context.js';
+function stamp() { return new Date().toISOString().replace(/[:.]/g, '-'); }
+export function registerBundleCommands(program, ctx) {
+    program.command('export <file>').description('export manifest + assets as a portable bundle (no secrets)')
+        .action(async (file) => {
+        const m = await requireManifest(ctx);
+        const assets = await collectAssets(m, ctx.platform);
+        await writeFile(file, exportBundle(serializeManifest(m), assets));
+        console.log(`exported ${m.profiles.length} profiles + ${Object.keys(assets).length} asset files to ${file}`);
+    });
+    program.command('import <file>').description('import a bundle and apply it')
+        .option('--dry-run')
+        .option('--yes', 'apply without the safety confirmation')
+        .action(async (file, opts) => {
+        const { manifestYaml, assets } = importBundle(await readFile(file));
+        const m = parseManifest(manifestYaml); // also runs assertSafeManifest — rejects injectable identifiers
+        console.log(`bundle: ${m.profiles.length} profiles, ${Object.keys(m.mcpServers).length} mcp servers, ${Object.keys(assets).length} asset files`);
+        if (!opts.dryRun && !opts.yes) {
+            console.log('');
+            console.log('⚠️  Applying a bundle writes shell launcher functions to your rc file and MCP server');
+            console.log('    commands to your Claude config — both execute code on your machine. Only import');
+            console.log('    bundles you created or trust. Re-run with --yes to proceed (or --dry-run to preview).');
+            process.exitCode = 1;
+            return;
+        }
+        if (!opts.dryRun) {
+            await backupFiles([join(ctx.manifestRoot, 'manifest.yaml')], ctx.backupRoot, stamp());
+            await saveManifest(ctx.manifestRoot, m);
+            await writeAssets(assets, m, ctx.platform);
+        }
+        const actions = planApply(m, await discoverProfiles(ctx.home), ctx.platform);
+        const res = await executeApply(actions, { backupRoot: ctx.backupRoot, stamp: stamp(), dryRun: !!opts.dryRun });
+        for (const line of res.performed)
+            console.log(`${opts.dryRun ? '[dry-run] ' : ''}${line}`);
+    });
+}

package/dist/commands/manifest.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+import { type CliContext } from '../context.js';
+export declare function registerManifestCommands(program: Command, ctx: CliContext): void;

package/dist/commands/manifest.js

@@ -0,0 +1,59 @@
+import { discoverProfiles, buildManifest, saveManifest, planApply, executeApply, } from 'ccprofiles-core';
+import { requireManifest } from '../context.js';
+function stamp() { return new Date().toISOString().replace(/[:.]/g, '-'); }
+export function registerManifestCommands(program, ctx) {
+    program.command('status').description('show live-vs-manifest drift').action(async () => {
+        const m = await requireManifest(ctx);
+        const actions = planApply(m, await discoverProfiles(ctx.home), ctx.platform);
+        if (actions.length === 0) {
+            console.log('in sync');
+            return;
+        }
+        const res = await executeApply(actions, { backupRoot: ctx.backupRoot, stamp: stamp(), dryRun: true });
+        for (const line of res.performed)
+            console.log(`pending: ${line}`);
+    });
+    program.command('apply').description('apply manifest to live configs')
+        .option('--dry-run')
+        .action(async (opts) => {
+        const m = await requireManifest(ctx);
+        const actions = planApply(m, await discoverProfiles(ctx.home), ctx.platform);
+        if (actions.length === 0) {
+            console.log('in sync — nothing to do');
+            return;
+        }
+        const res = await executeApply(actions, { backupRoot: ctx.backupRoot, stamp: stamp(), dryRun: !!opts.dryRun });
+        for (const line of res.performed)
+            console.log(`${opts.dryRun ? '[dry-run] ' : ''}${line}`);
+        if (res.backupDir)
+            console.log(`backups: ${res.backupDir}`);
+    });
+    program.command('snapshot').description('overwrite manifest from live state').action(async () => {
+        const m = buildManifest(await discoverProfiles(ctx.home), ctx.platform);
+        await saveManifest(ctx.manifestRoot, m);
+        console.log(`snapshot: ${m.profiles.length} profiles, ${Object.keys(m.mcpServers).length} mcp servers`);
+    });
+    program.command('create <name>').description('create a new profile')
+        .option('--from <profile>', 'copy mcp list and links from an existing profile')
+        .action(async (name, opts) => {
+        const m = await requireManifest(ctx);
+        if (m.profiles.some(p => p.name === name))
+            throw new Error(`profile exists: ${name}`);
+        const src = opts.from ? m.profiles.find(p => p.name === opts.from) : null;
+        if (opts.from && !src)
+            throw new Error(`unknown profile: ${opts.from}`);
+        m.profiles.push({
+            name,
+            dir: `{home}/.claude-${name}`,
+            launcher: `cl-${name}`,
+            auth: 'env',
+            env: {},
+            links: src ? { ...src.links } : (m.hub ? { skills: 'hub', commands: 'hub' } : {}),
+            mcp: src ? [...src.mcp] : [],
+        });
+        await saveManifest(ctx.manifestRoot, m);
+        const actions = planApply(m, await discoverProfiles(ctx.home), ctx.platform);
+        await executeApply(actions, { backupRoot: ctx.backupRoot, stamp: stamp() });
+        console.log(`profile "${name}" created — launcher: cl-${name} (restart your shell)`);
+    });
+}

package/dist/commands/mcp.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+import { type CliContext } from '../context.js';
+export declare function registerMcpCommands(program: Command, ctx: CliContext): void;

package/dist/commands/mcp.js

@@ -0,0 +1,86 @@
+import { discoverProfiles, saveManifest, planApply, executeApply, } from 'ccprofiles-core';
+import { requireManifest } from '../context.js';
+function stamp() { return new Date().toISOString().replace(/[:.]/g, '-'); }
+async function applyNow(ctx, m, dryRun) {
+    const actions = planApply(m, await discoverProfiles(ctx.home), ctx.platform);
+    const res = await executeApply(actions, { backupRoot: ctx.backupRoot, stamp: stamp(), dryRun });
+    for (const line of res.performed)
+        console.log(`${dryRun ? '[dry-run] ' : ''}${line}`);
+}
+function targets(m, opts) {
+    if (opts.all)
+        return m.profiles.map(p => p.name);
+    if (!opts.profile)
+        throw new Error('specify --profile <name> or --all');
+    if (!m.profiles.some(p => p.name === opts.profile))
+        throw new Error(`unknown profile: ${opts.profile}`);
+    return [opts.profile];
+}
+export function registerMcpCommands(program, ctx) {
+    const mcp = program.command('mcp').description('manage MCP servers across profiles');
+    mcp.command('list').action(async () => {
+        const m = await requireManifest(ctx);
+        const names = Object.keys(m.mcpServers).sort();
+        const header = ' '.repeat(24) + m.profiles.map(p => p.name.padEnd(10)).join('');
+        console.log(header);
+        for (const n of names) {
+            const cells = m.profiles.map(p => (p.mcp.includes(n) ? 'x' : '.').padEnd(10)).join('');
+            console.log(n.padEnd(24) + cells);
+        }
+    });
+    mcp.command('add <name>')
+        .option('--profile <p>').option('--all').option('--dry-run')
+        .option('--command <cmd>').option('--args <csv>')
+        .action(async (name, opts) => {
+        const m = await requireManifest(ctx);
+        if (!m.mcpServers[name]) {
+            if (!opts.command)
+                throw new Error(`unknown server "${name}" — pass --command (and optionally --args) to define it`);
+            m.mcpServers[name] = { command: opts.command, ...(opts.args ? { args: String(opts.args).split(',') } : {}) };
+        }
+        for (const t of targets(m, opts)) {
+            const pr = m.profiles.find(p => p.name === t);
+            if (!pr.mcp.includes(name))
+                pr.mcp.push(name);
+        }
+        if (!opts.dryRun)
+            await saveManifest(ctx.manifestRoot, m);
+        await applyNow(ctx, m, !!opts.dryRun);
+    });
+    mcp.command('rm <name>')
+        .option('--profile <p>').option('--all').option('--dry-run')
+        .action(async (name, opts) => {
+        const m = await requireManifest(ctx);
+        for (const t of targets(m, opts)) {
+            const pr = m.profiles.find(p => p.name === t);
+            pr.mcp = pr.mcp.filter(x => x !== name);
+        }
+        if (!m.profiles.some(p => p.mcp.includes(name)))
+            delete m.mcpServers[name];
+        if (!opts.dryRun)
+            await saveManifest(ctx.manifestRoot, m);
+        await applyNow(ctx, m, !!opts.dryRun);
+    });
+    mcp.command('sync')
+        .requiredOption('--from <p>').option('--to <csv>').option('--all').option('--dry-run')
+        .action(async (opts) => {
+        const m = await requireManifest(ctx);
+        const src = m.profiles.find(p => p.name === opts.from);
+        if (!src)
+            throw new Error(`unknown profile: ${opts.from}`);
+        const to = opts.all
+            ? m.profiles.filter(p => p.name !== src.name).map(p => p.name)
+            : String(opts.to ?? '').split(',').filter(Boolean);
+        if (to.length === 0)
+            throw new Error('specify --to <p1,p2> or --all');
+        for (const t of to) {
+            const pr = m.profiles.find(p => p.name === t);
+            if (!pr)
+                throw new Error(`unknown profile: ${t}`);
+            pr.mcp = [...src.mcp];
+        }
+        if (!opts.dryRun)
+            await saveManifest(ctx.manifestRoot, m);
+        await applyNow(ctx, m, !!opts.dryRun);
+    });
+}

package/dist/commands/profiles.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+import type { CliContext } from '../context.js';
+export declare function registerProfileCommands(program: Command, ctx: CliContext): void;

package/dist/commands/profiles.js

@@ -0,0 +1,71 @@
+import { discoverProfiles, buildManifest, saveManifest, loadManifest, ensureRootGitignore } from 'ccprofiles-core';
+import { existsSync, readFileSync, lstatSync, readlinkSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { execFileSync } from 'node:child_process';
+export function registerProfileCommands(program, ctx) {
+    program.command('list').description('list Claude Code profiles').action(async () => {
+        const live = await discoverProfiles(ctx.home);
+        const rows = live.map(lp => ({
+            name: lp.dirName === '.claude' ? 'default' : lp.dirName.slice('.claude-'.length),
+            dir: lp.dir,
+            account: lp.account ?? '-',
+            mcp: Object.keys(lp.mcpServers).length,
+        }));
+        for (const r of rows)
+            console.log(`${r.name.padEnd(12)} ${String(r.mcp).padStart(3)} mcp  ${r.account.padEnd(28)} ${r.dir}`);
+    });
+    program.command('adopt').description('build manifest from live profiles')
+        .option('--yes', 'write without confirmation')
+        .action(async (opts) => {
+        const live = await discoverProfiles(ctx.home);
+        const manifest = buildManifest(live, ctx.platform);
+        console.log(`Discovered ${manifest.profiles.length} profiles, ${Object.keys(manifest.mcpServers).length} mcp servers.`);
+        if (!opts.yes) {
+            console.log('Re-run with --yes to write the manifest.');
+            return;
+        }
+        if (!existsSync(join(ctx.manifestRoot, '.git'))) {
+            try {
+                execFileSync('git', ['init', ctx.manifestRoot], { stdio: 'ignore' });
+            }
+            catch { /* git optional */ }
+        }
+        await ensureRootGitignore(ctx.manifestRoot);
+        await saveManifest(ctx.manifestRoot, manifest);
+        console.log(`Manifest written to ${join(ctx.manifestRoot, 'manifest.yaml')}`);
+    });
+    program.command('doctor').description('check setup health').action(async () => {
+        const problems = [];
+        const live = await discoverProfiles(ctx.home);
+        for (const lp of live)
+            for (const name of readdirSync(lp.dir)) {
+                const f = join(lp.dir, name);
+                try {
+                    if (lstatSync(f).isSymbolicLink() && !existsSync(f))
+                        problems.push(`broken symlink: ${f} -> ${readlinkSync(f)}`);
+                }
+                catch { /* ignore */ }
+            }
+        if (existsSync(ctx.platform.rcFile)) {
+            const rc = readFileSync(ctx.platform.rcFile, 'utf8');
+            const outsideBlock = rc.split('# >>> ccprofiles managed >>>')[0] + (rc.split('# <<< ccprofiles managed <<<')[1] ?? '');
+            if (/sk-ant-/.test(outsideBlock))
+                problems.push(`plaintext Anthropic key found in ${ctx.platform.rcFile} — run: ccprofiles secrets migrate`);
+        }
+        if (existsSync(join(ctx.manifestRoot, 'manifest.yaml'))) {
+            const m = await loadManifest(ctx.manifestRoot);
+            for (const pr of m.profiles) {
+                const dir = pr.dir.replace('{home}', ctx.home);
+                if (!existsSync(dir))
+                    problems.push(`manifest profile "${pr.name}" missing on disk: ${dir} — run: ccprofiles apply`);
+            }
+        }
+        if (problems.length === 0) {
+            console.log('ok: no problems found');
+            return;
+        }
+        for (const p of problems)
+            console.log(`warn: ${p}`);
+        process.exitCode = 1;
+    });
+}

package/dist/commands/secrets.d.ts

@@ -0,0 +1,5 @@
+import type { Command } from 'commander';
+import { SecretsStore } from 'ccprofiles-core';
+import type { CliContext } from '../context.js';
+export declare function secretsStore(ctx: CliContext): Promise<SecretsStore>;
+export declare function registerSecretsCommands(program: Command, ctx: CliContext): void;

package/dist/commands/secrets.js

@@ -0,0 +1,84 @@
+import { SecretsStore, FileBackend, defaultBackend, backupFiles, atomicWrite } from 'ccprofiles-core';
+import { readFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+export async function secretsStore(ctx) {
+    const pw = ctx.env.CCPROFILES_PASSPHRASE;
+    const backend = pw
+        ? new FileBackend(ctx.secretsFilePath, pw)
+        : await defaultBackend(ctx.platform, {
+            filePath: ctx.secretsFilePath,
+            passphrase: async () => { throw new Error('set CCPROFILES_PASSPHRASE for the encrypted-file backend'); },
+        });
+    return new SecretsStore(backend, ctx.secretsIndexPath);
+}
+const KEY_VARS = ['ANTHROPIC_API_KEY', 'CLAUDE_CODE_OAUTH_TOKEN', 'ANTHROPIC_AUTH_TOKEN'];
+// posix: export VAR="sk-..."   powershell: $env:VAR = "sk-..."
+const MIGRATE_RE_POSIX = new RegExp(`^(\\s*(?:export\\s+)?(${KEY_VARS.join('|')})\\s*=\\s*)"?(sk-[A-Za-z0-9_-]+)"?(.*)$`);
+const MIGRATE_RE_PWSH = new RegExp(`^(\\s*\\$env:(${KEY_VARS.join('|')})\\s*=\\s*)"?(sk-[A-Za-z0-9_-]+)"?(.*)$`);
+export function registerSecretsCommands(program, ctx) {
+    const sec = program.command('secrets').description('manage secrets (values never stored in configs)');
+    sec.command('set <name> [value]').action(async (name, value) => {
+        if (value === undefined)
+            throw new Error('value required (interactive prompt lands in Plan 2)');
+        const store = await secretsStore(ctx);
+        await store.set(name, value);
+        console.log(`stored ${name} (${store.backendName})`);
+    });
+    sec.command('get <name>').action(async (name) => {
+        const store = await secretsStore(ctx);
+        const v = await store.get(name);
+        if (v === null) {
+            process.exitCode = 1;
+            return;
+        }
+        console.log(v);
+    });
+    sec.command('list').action(async () => {
+        const store = await secretsStore(ctx);
+        for (const n of await store.list())
+            console.log(`${n}  (${store.backendName})`);
+    });
+    sec.command('rm <name>').action(async (name) => {
+        const store = await secretsStore(ctx);
+        await store.delete(name);
+        console.log(`removed ${name}`);
+    });
+    sec.command('migrate').option('--dry-run').action(async (opts) => {
+        const rcFile = ctx.platform.rcFile;
+        if (!existsSync(rcFile)) {
+            console.log('no rc file found');
+            return;
+        }
+        const store = await secretsStore(ctx);
+        const lines = (await readFile(rcFile, 'utf8')).split('\n');
+        const migrated = [];
+        const out = [];
+        for (const line of lines) {
+            const pwsh = line.match(MIGRATE_RE_PWSH);
+            const posix = pwsh ? null : line.match(MIGRATE_RE_POSIX);
+            const match = pwsh ?? posix;
+            if (!match) {
+                out.push(line);
+                continue;
+            }
+            const [, prefix, varName, secretValue, suffix] = match;
+            const secretName = varName.toLowerCase().replaceAll('_', '-');
+            if (!opts.dryRun)
+                await store.set(secretName, secretValue);
+            out.push(pwsh
+                ? `${prefix}(ccprofiles secrets get ${secretName})${suffix}`
+                : `${prefix}"$(ccprofiles secrets get ${secretName})"${suffix}`);
+            migrated.push(secretName);
+        }
+        if (migrated.length === 0) {
+            console.log('no plaintext keys found');
+            return;
+        }
+        if (!opts.dryRun) {
+            await backupFiles([rcFile], ctx.backupRoot, new Date().toISOString().replace(/[:.]/g, '-'));
+            await atomicWrite(rcFile, out.join('\n'));
+        }
+        for (const n of migrated)
+            console.log(`${opts.dryRun ? '[dry-run] ' : ''}migrated ${n}`);
+    });
+}

package/dist/commands/sync.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+import type { CliContext } from '../context.js';
+export declare function registerSyncCommands(program: Command, ctx: CliContext): void;

package/dist/commands/sync.js

@@ -0,0 +1,84 @@
+import { startSyncServer, pairWithServer, fetchRemote, fetchSecrets, loadDevices, saveDevices, parseManifest, saveManifest, writeAssets, discoverProfiles, planApply, executeApply, backupFiles, } from 'ccprofiles-core';
+import { join } from 'node:path';
+import { secretsStore } from './secrets.js';
+function stamp() { return new Date().toISOString().replace(/[:.]/g, '-'); }
+export function registerSyncCommands(program, ctx) {
+    program.command('serve').description('serve this device for pairing/sync')
+        .option('--port <n>', 'port (default: random)', v => parseInt(v, 10))
+        .option('--host <ip>', 'interface to bind (default: 0.0.0.0 — all interfaces; set your LAN IP to restrict)')
+        .option('--allow-secrets', 'allow paired devices to pull secret values')
+        .action(async (opts) => {
+        const server = await startSyncServer({
+            manifestRoot: ctx.manifestRoot,
+            platform: ctx.platform,
+            port: opts.port,
+            host: opts.host,
+            allowSecrets: opts.allowSecrets,
+            secretValues: async (names) => {
+                const store = await secretsStore(ctx);
+                const wanted = names.length ? names : await store.list();
+                const out = {};
+                for (const n of wanted) {
+                    const v = await store.get(n);
+                    if (v !== null)
+                        out[n] = v;
+                }
+                return out;
+            },
+        });
+        console.log(`ccprofiles sync server on ${server.host}:${server.port}`);
+        if (server.host === '0.0.0.0')
+            console.log('(reachable from all network interfaces — pass --host <lan-ip> to restrict)');
+        console.log(`pairing PIN: ${server.pin}`);
+        console.log('(pairing locks after 5 wrong PINs — restart serve to reset)');
+        if (opts.allowSecrets)
+            console.log('secrets transfer: ENABLED for paired devices');
+        console.log('Ctrl-C to stop');
+        await new Promise(() => { });
+    });
+    program.command('pair <host>').description('pair with a serving device')
+        .requiredOption('--pin <pin>', 'PIN shown on the serving device')
+        .requiredOption('--port <n>', 'port shown on the serving device', (v) => parseInt(v, 10))
+        .option('--name <name>', 'name for this peer', undefined)
+        .action(async (host, opts) => {
+        const device = await pairWithServer(host, opts.port, opts.pin, opts.name ?? host);
+        const devices = (await loadDevices(ctx.manifestRoot)).filter(d => d.name !== device.name);
+        devices.push(device);
+        await saveDevices(ctx.manifestRoot, devices);
+        console.log(`paired with ${device.name} (${host}:${opts.port})`);
+    });
+    program.command('devices').description('list paired devices').action(async () => {
+        for (const d of await loadDevices(ctx.manifestRoot))
+            console.log(`${d.name.padEnd(16)} ${d.host}:${d.port}`);
+    });
+    program.command('sync').description('pull manifest + assets from a paired device and apply')
+        .requiredOption('--from <device>')
+        .option('--with-secrets', 'also transfer secret values into the local store')
+        .option('--dry-run')
+        .action(async (opts) => {
+        const device = (await loadDevices(ctx.manifestRoot)).find(d => d.name === opts.from);
+        if (!device)
+            throw new Error(`unknown device: ${opts.from} — run: ccprofiles pair <host> --port <p> --pin <pin>`);
+        const { manifestYaml, assets } = await fetchRemote(device);
+        const m = parseManifest(manifestYaml); // validate before touching anything
+        console.log(`pulled manifest: ${m.profiles.length} profiles, ${Object.keys(m.mcpServers).length} mcp servers, ${Object.keys(assets).length} asset files`);
+        if (!opts.dryRun) {
+            await backupFiles([join(ctx.manifestRoot, 'manifest.yaml')], ctx.backupRoot, stamp());
+            await saveManifest(ctx.manifestRoot, m);
+            await writeAssets(assets, m, ctx.platform);
+        }
+        const actions = planApply(m, await discoverProfiles(ctx.home), ctx.platform);
+        const res = await executeApply(actions, { backupRoot: ctx.backupRoot, stamp: stamp(), dryRun: !!opts.dryRun });
+        for (const line of res.performed)
+            console.log(`${opts.dryRun ? '[dry-run] ' : ''}${line}`);
+        if (opts.withSecrets) {
+            const values = await fetchSecrets(device, []);
+            if (!opts.dryRun) {
+                const store = await secretsStore(ctx);
+                for (const [k, v] of Object.entries(values))
+                    await store.set(k, v);
+            }
+            console.log(`${opts.dryRun ? '[dry-run] ' : ''}secrets transferred: ${Object.keys(values).join(', ') || 'none'}`);
+        }
+    });
+}

package/dist/context.d.ts

@@ -0,0 +1,15 @@
+import { Command } from 'commander';
+import { type Manifest, type Platform } from 'ccprofiles-core';
+export interface CliContext {
+    home: string;
+    platform: Platform;
+    manifestRoot: string;
+    secretsIndexPath: string;
+    secretsFilePath: string;
+    backupRoot: string;
+    env: NodeJS.ProcessEnv;
+}
+export declare function makeContext(env?: NodeJS.ProcessEnv): CliContext;
+/** Load the manifest, or explain how to create one — never a raw ENOENT. */
+export declare function requireManifest(ctx: CliContext): Promise<Manifest>;
+export declare function buildProgram(ctx: CliContext): Command;

package/dist/context.js

@@ -0,0 +1,42 @@
+import { Command } from 'commander';
+import { detectPlatform, loadManifest } from 'ccprofiles-core';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { registerProfileCommands } from './commands/profiles.js';
+import { registerMcpCommands } from './commands/mcp.js';
+import { registerSecretsCommands } from './commands/secrets.js';
+import { registerManifestCommands } from './commands/manifest.js';
+import { registerSyncCommands } from './commands/sync.js';
+import { registerBundleCommands } from './commands/bundle.js';
+export function makeContext(env = process.env) {
+    const testHome = env.CCPROFILES_TEST_HOME;
+    const platform = detectPlatform(testHome ? { home: testHome, shell: env.SHELL } : {});
+    const manifestRoot = env.CCPROFILES_HOME ?? join(platform.home, '.ccprofiles');
+    return {
+        home: platform.home,
+        platform,
+        manifestRoot,
+        secretsIndexPath: join(manifestRoot, 'secret-names.json'),
+        secretsFilePath: join(manifestRoot, 'secrets.enc'),
+        backupRoot: join(manifestRoot, 'backups'),
+        env,
+    };
+}
+/** Load the manifest, or explain how to create one — never a raw ENOENT. */
+export async function requireManifest(ctx) {
+    if (!existsSync(join(ctx.manifestRoot, 'manifest.yaml'))) {
+        throw new Error('no manifest yet — run: ccprofiles adopt --yes  (builds one from your existing .claude* profiles)');
+    }
+    return loadManifest(ctx.manifestRoot);
+}
+export function buildProgram(ctx) {
+    const program = new Command('ccprofiles').description('Manage multiple Claude Code accounts/profiles (alias: clp)');
+    program.exitOverride(); // throw instead of process.exit — required for tests
+    registerProfileCommands(program, ctx);
+    registerMcpCommands(program, ctx);
+    registerSecretsCommands(program, ctx);
+    registerManifestCommands(program, ctx);
+    registerSyncCommands(program, ctx);
+    registerBundleCommands(program, ctx);
+    return program;
+}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { buildProgram, makeContext } from './context.js';
+buildProgram(makeContext()).parseAsync(process.argv).catch((e) => {
+    if (e.code?.startsWith?.('commander.'))
+        process.exit(1);
+    console.error(`error: ${e.message}`);
+    process.exit(1);
+});

package/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "claude-account-sync",
+  "version": "0.1.0",
+  "description": "Manage multiple Claude Code accounts/profiles — MCP drift sync, keychain secrets, and encrypted LAN replication between machines. CLI: ccprofiles (alias clp).",
+  "type": "module",
+  "bin": { "ccprofiles": "./dist/index.js", "clp": "./dist/index.js" },
+  "files": ["dist", "README.md"],
+  "license": "MIT",
+  "repository": { "type": "git", "url": "git+https://github.com/tmfadhlul/claude-code-profile.git", "directory": "packages/cli" },
+  "homepage": "https://github.com/tmfadhlul/claude-code-profile#readme",
+  "bugs": "https://github.com/tmfadhlul/claude-code-profile/issues",
+  "keywords": ["claude-code", "claude", "profiles", "accounts", "mcp", "cli", "sync", "multi-account", "keychain"],
+  "engines": { "node": ">=20" },
+  "dependencies": { "ccprofiles-core": "^0.1.1", "commander": "^12.1.0" }
+}