claude-dev-env 8.54.9 → 8.55.0

package/bin/merge_profile_settings.mjs

@@ -0,0 +1,372 @@
+/**
+ * Add the declared profile settings entries to every Claude profile settings.json.
+ *
+ * Each declared entry is one item in a list at a key path, such as one rule in
+ * `permissions.allow`. The merge adds an item only when the list lacks it, so a
+ * second run changes nothing and every other key stays as the file holds it.
+ * Before the first change to a file, the merge copies that file to a
+ * timestamped `.bak` beside it.
+ *
+ * Run `node merge_profile_settings.mjs --dry-run` to list the additions for
+ * every profile on this machine without writing anything.
+ */
+
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { expandHomeDirectoryTokens } from './expand_home_directory_tokens.mjs';
+import { SETTINGS_FILE_NAME } from './install-constants.mjs';
+import {
+    CLAUDE_CONFIG_DIR_ENVIRONMENT_VARIABLE,
+    DEFAULT_CLAUDE_DIRECTORY_NAME,
+    normalizePathForComparison,
+} from './resolve-install-root.mjs';
+import { resolveProfilesRootDirectory } from './select-install-targets.mjs';
+
+export const DRY_RUN_FLAG = '--dry-run';
+export const SESSION_TITLE_GATE_FILE_NAME = 'session_title_status_gate.py';
+export const SESSION_TITLE_GATE_SOURCE_DIRECTORY = fileURLToPath(new URL('../profile-settings/', import.meta.url));
+export const ALL_SESSION_TITLE_GATE_RELATIVE_PATHS = Object.freeze([
+    SESSION_TITLE_GATE_FILE_NAME,
+    join('config', '__init__.py'),
+    join('config', 'session_title_gate_constants.py'),
+]);
+export const SESSION_TITLE_GATE_COMMAND = `python3 ~/.claude/${SESSION_TITLE_GATE_FILE_NAME}`;
+export const AUTO_MODE_DEFAULTS_ENTRY = '$defaults';
+
+const DEFAULT_SETTINGS_INDENT = '    ';
+const DEFAULT_HOST_CONFIGURATION_INDENT = '  ';
+
+/**
+ * @typedef {{ keyPath: string[], items: unknown[] }} DeclaredListEntries
+ */
+
+/** @type {readonly DeclaredListEntries[]} */
+export const DECLARED_PROFILE_SETTINGS = Object.freeze([
+    {
+        keyPath: ['hooks', 'Stop'],
+        items: [
+            {
+                hooks: [
+                    { type: 'command', command: SESSION_TITLE_GATE_COMMAND, timeout: 10 },
+                ],
+            },
+        ],
+    },
+    {
+        keyPath: ['permissions', 'allow'],
+        items: [
+            'mcp__claude-code-remote__set_session_title',
+            'mcp__ccd_session_mgmt__set_session_title',
+            `Bash(${SESSION_TITLE_GATE_COMMAND}:*)`,
+            'Bash(python ~/.claude/scripts/account_broker.py run:*)',
+        ],
+    },
+    {
+        keyPath: ['autoMode', 'allow'],
+        items: [
+            AUTO_MODE_DEFAULTS_ENTRY,
+            'Setting this session\'s title with the set_session_title MCP tool '
+                + '(mcp__claude-code-remote__set_session_title or mcp__ccd_session_mgmt__set_session_title) is allowed, '
+                + 'and so is a live test run of the account broker with '
+                + '`python ~/.claude/scripts/account_broker.py run`: the user installed both tools for these sessions',
+        ],
+    },
+]);
+
+/**
+ * List every Claude profile settings.json on this machine.
+ *
+ * The main profile and the `CLAUDE_CONFIG_DIR` profile count when their
+ * directory exists, so a missing settings.json there is created. A directory
+ * under the profiles root counts only when it already holds a settings.json,
+ * which skips agents homes and other non-profile folders kept beside them.
+ *
+ * @param {{ homeDirectory: string, environment?: Record<string, string | undefined> }} options
+ * @returns {string[]} Absolute settings.json paths, one per profile.
+ */
+export function discoverProfileSettingsPaths(options) {
+    const environment = options.environment ?? {};
+    const allProfileDirectories = [join(options.homeDirectory, DEFAULT_CLAUDE_DIRECTORY_NAME)];
+    const configDirectory = environment[CLAUDE_CONFIG_DIR_ENVIRONMENT_VARIABLE]?.trim();
+    if (configDirectory) {
+        allProfileDirectories.push(configDirectory);
+    }
+    const profilesRoot = resolveProfilesRootDirectory({
+        homeDirectory: options.homeDirectory,
+        environment,
+    });
+    const allSettingsPaths = allProfileDirectories
+        .filter((eachDirectory) => existsSync(eachDirectory))
+        .map((eachDirectory) => resolve(eachDirectory, SETTINGS_FILE_NAME));
+    if (existsSync(profilesRoot)) {
+        for (const eachEntry of readdirSync(profilesRoot, { withFileTypes: true })) {
+            const settingsPath = join(profilesRoot, eachEntry.name, SETTINGS_FILE_NAME);
+            if (eachEntry.isDirectory() && existsSync(settingsPath)) {
+                allSettingsPaths.push(resolve(settingsPath));
+            }
+        }
+    }
+    const seenKeys = new Set();
+    return allSettingsPaths.filter((eachPath) => {
+        const comparisonKey = normalizePathForComparison(eachPath);
+        if (seenKeys.has(comparisonKey)) return false;
+        seenKeys.add(comparisonKey);
+        return true;
+    });
+}
+
+export function mergeDeclaredProfileSettings(settings, declaredSettings, homeDirectory) {
+    const allAdditions = [];
+    for (const { keyPath, items } of declaredSettings) {
+        const targetList = listAtKeyPath(settings, keyPath);
+        for (const eachItem of items) {
+            if (listHoldsItem(targetList, eachItem, homeDirectory)) continue;
+            const addedItem = itemWithExpandedHookCommands(eachItem, homeDirectory);
+            const stopGroup = keyPath.join('.') === 'hooks.Stop'
+                ? targetList.find((eachGroup) => (
+                    eachGroup?.matcher === addedItem.matcher && Array.isArray(eachGroup?.hooks)
+                ))
+                : null;
+            if (stopGroup) {
+                const managedGateIndex = stopGroup.hooks.findIndex(
+                    (eachHook) => typeof eachHook?.command === 'string'
+                        && eachHook.command.replace(/\\/g, '/').includes('/hooks/blocking/session_title_stop_gate.py'),
+                );
+                stopGroup.hooks.splice(
+                    managedGateIndex < 0 ? stopGroup.hooks.length : managedGateIndex,
+                    0,
+                    ...addedItem.hooks,
+                );
+            } else {
+                targetList.push(addedItem);
+            }
+            allAdditions.push(`${keyPath.join('.')}: ${JSON.stringify(addedItem)}`);
+        }
+    }
+    return allAdditions;
+}
+
+/**
+ * Merge the declared entries into one settings.json.
+ *
+ * @param {string} settingsPath
+ * @param {{ dryRun: boolean, homeDirectory: string, timestamp: string,
+ *   declaredSettings?: readonly DeclaredListEntries[] }} options
+ * @returns {{ settingsPath: string, additions: string[], backupPath: string | null }}
+ */
+export function mergeProfileSettingsFile(settingsPath, options) {
+    const settingsText = existsSync(settingsPath) ? readFileSync(settingsPath, 'utf8') : '';
+    const settings = settingsText.trim() ? JSON.parse(settingsText) : {};
+    if (!settings || typeof settings !== 'object' || Array.isArray(settings)) {
+        throw new Error(`${settingsPath} holds a value other than a JSON object`);
+    }
+    const additions = mergeDeclaredProfileSettings(
+        settings,
+        options.declaredSettings ?? DECLARED_PROFILE_SETTINGS,
+        options.homeDirectory,
+    );
+    if (additions.length === 0 || options.dryRun) {
+        return { settingsPath, additions, backupPath: null };
+    }
+    let backupPath = null;
+    if (settingsText) {
+        backupPath = `${settingsPath}.${options.timestamp}.bak`;
+        copyFileSync(settingsPath, backupPath);
+    }
+    mkdirSync(dirname(settingsPath), { recursive: true });
+    writeFileSync(
+        settingsPath,
+        JSON.stringify(settings, null, hostConfigurationIndent(settingsText, DEFAULT_SETTINGS_INDENT)) + '\n',
+    );
+    return { settingsPath, additions, backupPath };
+}
+
+/**
+ * Copy the session-title gate and its constants module to `~/.claude` when a copy is absent or differs.
+ *
+ * The Stop hook entry runs the gate, so both files have to land before the entry does.
+ *
+ * @param {{ homeDirectory: string, dryRun: boolean }} options
+ * @returns {{ gatePath: string, changed: boolean }}
+ */
+export function installSessionTitleGate(options) {
+    const claudeDirectory = join(options.homeDirectory, DEFAULT_CLAUDE_DIRECTORY_NAME);
+    const allStaleRelativePaths = ALL_SESSION_TITLE_GATE_RELATIVE_PATHS.filter((eachRelativePath) => {
+        const targetPath = join(claudeDirectory, eachRelativePath);
+        const sourceText = readFileSync(join(SESSION_TITLE_GATE_SOURCE_DIRECTORY, eachRelativePath), 'utf8');
+        return !existsSync(targetPath) || readFileSync(targetPath, 'utf8') !== sourceText;
+    });
+    if (!options.dryRun) {
+        for (const eachRelativePath of allStaleRelativePaths) {
+            const targetPath = join(claudeDirectory, eachRelativePath);
+            mkdirSync(dirname(targetPath), { recursive: true });
+            copyFileSync(join(SESSION_TITLE_GATE_SOURCE_DIRECTORY, eachRelativePath), targetPath);
+        }
+    }
+    return {
+        gatePath: join(claudeDirectory, SESSION_TITLE_GATE_FILE_NAME),
+        changed: allStaleRelativePaths.length > 0,
+    };
+}
+
+/**
+ * Install the gate, then merge the declared entries into each settings.json.
+ *
+ * @param {string[]} allSettingsPaths
+ * @param {{ dryRun: boolean, homeDirectory: string, now?: Date }} options
+ * @returns {{ gate: { gatePath: string, changed: boolean },
+ *   files: { settingsPath: string, additions: string[], backupPath: string | null }[] }}
+ */
+export function mergeProfileSettings(allSettingsPaths, options) {
+    const timestamp = (options.now ?? new Date()).toISOString().replace(/[:.]/g, '-');
+    const gate = installSessionTitleGate(options);
+    const files = allSettingsPaths.map((eachPath) => mergeProfileSettingsFile(eachPath, {
+        dryRun: options.dryRun,
+        homeDirectory: options.homeDirectory,
+        timestamp,
+    }));
+    return { gate, files };
+}
+
+/**
+ * @param {{ gate: { gatePath: string, changed: boolean },
+ *   files: { settingsPath: string, additions: string[], backupPath: string | null }[] }} outcome
+ * @param {boolean} isDryRun
+ * @returns {string[]}
+ */
+export function describeProfileSettingsOutcome(outcome, isDryRun) {
+    const verb = isDryRun ? 'would add' : 'added';
+    const allLines = [
+        outcome.gate.changed
+            ? `${outcome.gate.gatePath}: ${isDryRun ? 'would copy' : 'copied'} session-title gate`
+            : `${outcome.gate.gatePath}: gate current`,
+    ];
+    for (const { settingsPath, additions, backupPath } of outcome.files) {
+        if (additions.length === 0) {
+            allLines.push(`${settingsPath}: no change`);
+            continue;
+        }
+        allLines.push(`${settingsPath}: ${verb} ${additions.length}${backupPath ? ` (backup ${backupPath})` : ''}`);
+        allLines.push(...additions.map((eachAddition) => `  ${eachAddition}`));
+    }
+    return allLines;
+}
+
+/**
+ * @param {Record<string, unknown>} settings
+ * @param {string[]} keyPath
+ * @returns {unknown[]}
+ */
+function listAtKeyPath(settings, keyPath) {
+    let container = settings;
+    for (const eachKey of keyPath.slice(0, -1)) {
+        const child = container[eachKey];
+        if (!child || typeof child !== 'object' || Array.isArray(child)) {
+            container[eachKey] = {};
+        }
+        container = /** @type {Record<string, unknown>} */ (container[eachKey]);
+    }
+    const listKey = keyPath[keyPath.length - 1];
+    if (!Array.isArray(container[listKey])) {
+        container[listKey] = [];
+    }
+    return /** @type {unknown[]} */ (container[listKey]);
+}
+
+/**
+ * @param {unknown[]} targetList
+ * @param {unknown} item
+ * @param {string} homeDirectory
+ * @returns {boolean}
+ */
+function listHoldsItem(targetList, item, homeDirectory) {
+    if (typeof item === 'string') {
+        return targetList.includes(item);
+    }
+    const presentCommands = new Set(
+        targetList.flatMap((eachGroup) => groupCommands(eachGroup, homeDirectory)),
+    );
+    return groupCommands(item, homeDirectory).every((eachCommand) => presentCommands.has(eachCommand));
+}
+
+/**
+ * Copy one declared item, spelling each hook command the way the installer writes it.
+ *
+ * The installer rewrites every hook command's home tokens to the absolute home
+ * path on each run. Writing that same spelling here keeps a second install from
+ * rewriting the entry this merge added.
+ *
+ * @param {unknown} item
+ * @param {string} homeDirectory
+ * @returns {unknown}
+ */
+function itemWithExpandedHookCommands(item, homeDirectory) {
+    const addedItem = structuredClone(item);
+    const allHooks = Array.isArray(addedItem?.hooks) ? addedItem.hooks : [];
+    for (const eachHook of allHooks) {
+        if (typeof eachHook?.command === 'string') {
+            eachHook.command = expandHomeDirectoryTokens(eachHook.command, homeDirectory);
+        }
+    }
+    return addedItem;
+}
+
+/**
+ * @param {unknown} group
+ * @param {string} homeDirectory
+ * @returns {string[]}
+ */
+function groupCommands(group, homeDirectory) {
+    const allHooks = Array.isArray(group?.hooks) ? group.hooks : [];
+    return allHooks
+        .map((eachHook) => eachHook?.command)
+        .filter((eachCommand) => typeof eachCommand === 'string')
+        .map((eachCommand) => hookCommandComparisonKey(eachCommand, homeDirectory));
+}
+
+/**
+ * Spell a hook command the way both the installer and this merge can compare it.
+ *
+ * Home tokens expand to the one home directory, backslashes become forward
+ * slashes, and on Windows case folds, the same rule normalizePathForComparison
+ * applies to a path.
+ *
+ * @param {string} command
+ * @param {string} homeDirectory
+ * @returns {string}
+ */
+function hookCommandComparisonKey(command, homeDirectory) {
+    const forwardSlashed = expandHomeDirectoryTokens(command, homeDirectory).replace(/\\/g, '/');
+    return process.platform === 'win32' ? forwardSlashed.toLowerCase() : forwardSlashed;
+}
+
+/**
+ * Read the indent the host configuration file already uses.
+ *
+ * ~/.claude/settings.json uses four spaces and ~/.codex/hooks.json uses two.
+ * Forcing four spaces would rewrite every line of one of those files. The first
+ * indented line supplies the indent, tabs included.
+ *
+ * @param {string} settingsText The host configuration file as it stands on disk.
+ * @param {string} [defaultIndent] The indent for a file with no indented line.
+ * @returns {string} The indent one nesting level uses.
+ */
+export function hostConfigurationIndent(settingsText, defaultIndent = DEFAULT_HOST_CONFIGURATION_INDENT) {
+    const firstIndentedLine = /\n([ \t]+)\S/.exec(settingsText);
+    return firstIndentedLine ? firstIndentedLine[1] : defaultIndent;
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+    const isDryRun = process.argv.slice(2).includes(DRY_RUN_FLAG);
+    const homeDirectory = homedir();
+    const outcome = mergeProfileSettings(
+        discoverProfileSettingsPaths({ homeDirectory, environment: process.env }),
+        { dryRun: isDryRun, homeDirectory },
+    );
+    for (const eachLine of describeProfileSettingsOutcome(outcome, isDryRun)) {
+        console.log(eachLine);
+    }
+}

package/bin/merge_profile_settings.test.mjs

@@ -0,0 +1,208 @@
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+
+import {
+    ALL_SESSION_TITLE_GATE_RELATIVE_PATHS,
+    AUTO_MODE_DEFAULTS_ENTRY,
+    DECLARED_PROFILE_SETTINGS,
+    SESSION_TITLE_GATE_FILE_NAME,
+    SESSION_TITLE_GATE_SOURCE_DIRECTORY,
+    discoverProfileSettingsPaths,
+    mergeProfileSettings,
+} from './merge_profile_settings.mjs';
+
+const FIXED_NOW = new Date('2026-10-04T12:00:00.000Z');
+const BACKUP_SUFFIX = '.2026-10-04T12-00-00-000Z.bak';
+const PERMISSION_ALLOW_ITEMS = DECLARED_PROFILE_SETTINGS
+    .find((eachEntry) => eachEntry.keyPath.join('.') === 'permissions.allow').items;
+const AUTO_MODE_ALLOW_ITEMS = DECLARED_PROFILE_SETTINGS
+    .find((eachEntry) => eachEntry.keyPath.join('.') === 'autoMode.allow').items;
+
+function makeHome() {
+    return mkdtempSync(join(tmpdir(), 'cde-profile-settings-'));
+}
+
+function writeSettings(settingsPath, settings) {
+    mkdirSync(join(settingsPath, '..'), { recursive: true });
+    writeFileSync(settingsPath, JSON.stringify(settings, null, 4) + '\n');
+}
+
+function readSettings(settingsPath) {
+    return JSON.parse(readFileSync(settingsPath, 'utf8'));
+}
+
+function backupFiles(directory) {
+    return readdirSync(directory).filter((eachName) => eachName.endsWith('.bak'));
+}
+
+function expandedGateCommand(homeDirectory) {
+    return `python3 ${homeDirectory.replace(/\\/g, '/')}/.claude/${SESSION_TITLE_GATE_FILE_NAME}`;
+}
+
+function stopCommands(settings) {
+    return settings.hooks.Stop.flatMap((eachGroup) => eachGroup.hooks.map((eachHook) => eachHook.command));
+}
+
+test('a missing settings.json is created with every declared entry and the gate is copied', () => {
+    const homeDirectory = makeHome();
+    const claudeDirectory = join(homeDirectory, '.claude');
+    mkdirSync(claudeDirectory);
+    const settingsPath = join(claudeDirectory, 'settings.json');
+
+    const outcome = mergeProfileSettings([settingsPath], { dryRun: false, homeDirectory, now: FIXED_NOW });
+
+    assert.deepEqual(readSettings(settingsPath), {
+        hooks: {
+            Stop: [{ hooks: [{ type: 'command', command: expandedGateCommand(homeDirectory), timeout: 10 }] }],
+        },
+        permissions: { allow: PERMISSION_ALLOW_ITEMS },
+        autoMode: { allow: AUTO_MODE_ALLOW_ITEMS },
+    });
+    assert.equal(outcome.files[0].backupPath, null);
+    assert.deepEqual(backupFiles(claudeDirectory), []);
+    for (const eachRelativePath of ALL_SESSION_TITLE_GATE_RELATIVE_PATHS) {
+        assert.equal(
+            readFileSync(join(claudeDirectory, eachRelativePath), 'utf8'),
+            readFileSync(join(SESSION_TITLE_GATE_SOURCE_DIRECTORY, eachRelativePath), 'utf8'),
+        );
+    }
+});
+
+test('a gate whose constants module is missing is reported changed and the module is copied', () => {
+    const homeDirectory = makeHome();
+    const settingsPath = join(homeDirectory, '.claude', 'settings.json');
+    mergeProfileSettings([settingsPath], { dryRun: false, homeDirectory, now: FIXED_NOW });
+    const constantsPath = join(homeDirectory, '.claude', 'config', 'session_title_gate_constants.py');
+    unlinkSync(constantsPath);
+
+    const outcome = mergeProfileSettings([settingsPath], { dryRun: false, homeDirectory, now: FIXED_NOW });
+
+    assert.equal(outcome.gate.changed, true);
+    assert.equal(existsSync(constantsPath), true);
+});
+
+test('a file that already holds every entry is left byte for byte, with no backup', () => {
+    const homeDirectory = makeHome();
+    const settingsPath = join(homeDirectory, '.claude', 'settings.json');
+    mergeProfileSettings([settingsPath], { dryRun: false, homeDirectory, now: FIXED_NOW });
+    const textAfterFirstRun = readFileSync(settingsPath, 'utf8');
+
+    const outcome = mergeProfileSettings([settingsPath], { dryRun: false, homeDirectory, now: FIXED_NOW });
+
+    assert.deepEqual(outcome.files[0].additions, []);
+    assert.equal(outcome.gate.changed, false);
+    assert.equal(readFileSync(settingsPath, 'utf8'), textAfterFirstRun);
+    assert.deepEqual(backupFiles(join(homeDirectory, '.claude')), []);
+});
+
+test('a partial file gains only the missing entries, keeps other keys, and is backed up first', () => {
+    const homeDirectory = makeHome();
+    const settingsPath = join(homeDirectory, '.claude', 'settings.json');
+    const originalSettings = {
+        model: 'opus',
+        hooks: {
+            Stop: [{ hooks: [{ type: 'command', command: expandedGateCommand(homeDirectory), timeout: 30 }] }],
+            PreToolUse: [{ matcher: 'Bash', hooks: [{ type: 'command', command: 'python3 guard.py' }] }],
+        },
+        permissions: { allow: ['Read', 'mcp__claude-code-remote__set_session_title'], deny: ['Bash(rm:*)'] },
+        autoMode: { allow: ['Pushing to my fork is allowed'], environment: ['Source control: example'] },
+    };
+    writeSettings(settingsPath, originalSettings);
+    const originalText = readFileSync(settingsPath, 'utf8');
+
+    const outcome = mergeProfileSettings([settingsPath], { dryRun: false, homeDirectory, now: FIXED_NOW });
+
+    const mergedSettings = readSettings(settingsPath);
+    assert.equal(mergedSettings.model, 'opus');
+    assert.deepEqual(mergedSettings.hooks.Stop, originalSettings.hooks.Stop);
+    assert.deepEqual(mergedSettings.hooks.PreToolUse, originalSettings.hooks.PreToolUse);
+    assert.deepEqual(mergedSettings.permissions.deny, ['Bash(rm:*)']);
+    assert.deepEqual(mergedSettings.permissions.allow, [
+        'Read',
+        'mcp__claude-code-remote__set_session_title',
+        ...PERMISSION_ALLOW_ITEMS.filter((eachItem) => eachItem !== 'mcp__claude-code-remote__set_session_title'),
+    ]);
+    assert.deepEqual(mergedSettings.autoMode.allow, ['Pushing to my fork is allowed', ...AUTO_MODE_ALLOW_ITEMS]);
+    assert.ok(mergedSettings.autoMode.allow.includes(AUTO_MODE_DEFAULTS_ENTRY));
+    assert.deepEqual(mergedSettings.autoMode.environment, ['Source control: example']);
+    assert.equal(outcome.files[0].backupPath, `${settingsPath}${BACKUP_SUFFIX}`);
+    assert.equal(readFileSync(outcome.files[0].backupPath, 'utf8'), originalText);
+});
+
+test('a gate hook written with backslashes counts as present', () => {
+    const homeDirectory = makeHome();
+    const settingsPath = join(homeDirectory, '.claude', 'settings.json');
+    const backslashedGateCommand = `python3 ${homeDirectory.replace(/\//g, '\\')}\\.claude\\${SESSION_TITLE_GATE_FILE_NAME}`;
+    writeSettings(settingsPath, {
+        hooks: { Stop: [{ hooks: [{ type: 'command', command: backslashedGateCommand, timeout: 10 }] }] },
+    });
+
+    mergeProfileSettings([settingsPath], { dryRun: false, homeDirectory, now: FIXED_NOW });
+
+    assert.deepEqual(stopCommands(readSettings(settingsPath)), [backslashedGateCommand]);
+});
+
+test('the gate hook is added beside a different Stop hook', () => {
+    const homeDirectory = makeHome();
+    const settingsPath = join(homeDirectory, '.claude', 'settings.json');
+    writeSettings(settingsPath, {
+        hooks: { Stop: [{ hooks: [{ type: 'command', command: 'python3 other_stop.py' }] }] },
+    });
+
+    mergeProfileSettings([settingsPath], { dryRun: false, homeDirectory, now: FIXED_NOW });
+
+    assert.deepEqual(stopCommands(readSettings(settingsPath)), ['python3 other_stop.py', expandedGateCommand(homeDirectory)]);
+});
+
+test('discovery finds the main, CLAUDE_CONFIG_DIR, and every profile settings.json once, and each is merged', () => {
+    const homeDirectory = makeHome();
+    const profilesRoot = join(homeDirectory, '.claude-profiles');
+    mkdirSync(join(homeDirectory, '.claude'));
+    writeSettings(join(profilesRoot, 'work', 'settings.json'), { model: 'work' });
+    writeSettings(join(profilesRoot, 'home', 'settings.json'), { model: 'home' });
+    mkdirSync(join(profilesRoot, 'work.agents'));
+    const configDirectory = join(homeDirectory, 'custom-config');
+    mkdirSync(configDirectory);
+
+    const allSettingsPaths = discoverProfileSettingsPaths({
+        homeDirectory,
+        environment: { CLAUDE_CONFIG_DIR: configDirectory },
+    });
+    const allSettingsPathsWithSharedConfig = discoverProfileSettingsPaths({
+        homeDirectory,
+        environment: { CLAUDE_CONFIG_DIR: join(profilesRoot, 'work') },
+    });
+    mergeProfileSettings(allSettingsPaths, { dryRun: false, homeDirectory, now: FIXED_NOW });
+
+    assert.deepEqual([...allSettingsPaths].sort(), [
+        resolve(homeDirectory, '.claude', 'settings.json'),
+        resolve(profilesRoot, 'home', 'settings.json'),
+        resolve(profilesRoot, 'work', 'settings.json'),
+        resolve(configDirectory, 'settings.json'),
+    ].sort());
+    assert.equal(allSettingsPathsWithSharedConfig.length, 3);
+    for (const eachPath of allSettingsPaths) {
+        assert.deepEqual(stopCommands(readSettings(eachPath)), [expandedGateCommand(homeDirectory)]);
+        assert.deepEqual(readSettings(eachPath).autoMode.allow, AUTO_MODE_ALLOW_ITEMS);
+    }
+    assert.equal(readSettings(join(profilesRoot, 'work', 'settings.json')).model, 'work');
+    assert.equal(backupFiles(join(profilesRoot, 'home')).length, 1);
+});
+
+test('a dry run reports additions and writes nothing', () => {
+    const homeDirectory = makeHome();
+    const settingsPath = join(homeDirectory, '.claude', 'settings.json');
+    writeSettings(settingsPath, { model: 'opus' });
+    const originalText = readFileSync(settingsPath, 'utf8');
+
+    const outcome = mergeProfileSettings([settingsPath], { dryRun: true, homeDirectory, now: FIXED_NOW });
+
+    assert.equal(outcome.files[0].additions.length, 7);
+    assert.equal(outcome.gate.changed, true);
+    assert.equal(readFileSync(settingsPath, 'utf8'), originalText);
+    assert.deepEqual(backupFiles(join(homeDirectory, '.claude')), []);
+    assert.equal(existsSync(join(homeDirectory, '.claude', SESSION_TITLE_GATE_FILE_NAME)), false);
+});

package/installable-surfaces.manifest.json

@@ -10,7 +10,8 @@
     "system-prompts",
     "scripts",
     "_shared",
-    "audit-rubrics"
+    "audit-rubrics",
+    "profile-settings"
   ],
   "root_files": [
     "AGENTS.md",

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.54.9",
+    "version": "8.55.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {
@@ -9,7 +9,7 @@
         "cde": "bin/cde.mjs"
     },
     "scripts": {
-        "test": "node --test \"bin/*.test.mjs\" \".agents/skills/**/*.test.mjs\" \"tests/fresh-session/**/*.test.mjs\" \"scripts/ci/*.test.mjs\""
+        "test": "node --test --test-concurrency=1 \"bin/*.test.mjs\" \".agents/skills/**/*.test.mjs\" \"tests/fresh-session/**/*.test.mjs\" \"scripts/ci/*.test.mjs\""
     },
     "files": [
         "bin/",
@@ -25,6 +25,7 @@
         "settings.json",
         "installable-surfaces.manifest.json",
         "_shared/",
+        "profile-settings/",
         "audit-rubrics/",
         "codex-rules/",
         "pstack-codex-models.md",

package/profile-settings/config/__init__.py

@@ -0,0 +1 @@
+"""Constants package installed beside the Stop hook gate."""

package/profile-settings/config/session_title_gate_constants.py

@@ -0,0 +1,15 @@
+"""Constants for the session-title Stop hook gate."""
+
+ALL_TITLE_TOOL_NAMES = frozenset(
+    {
+        "mcp__claude-code-remote__set_session_title",
+        "mcp__ccd_session_mgmt__set_session_title",
+    }
+)
+INSTRUCTION = (
+    "Call set_session_title (session id from get_session) before you stop. "
+    'Title = "<emoji> <brief task name>", one line in a narrow sidebar. '
+    "\U0001f6a9 = Jon must act (question, approval, a step only he can do). "
+    "✅ = fully done (merged or nothing left). "
+    "⏳ = work, CI, or a merge queue still running and nothing waits on Jon."
+)