claude-use 0.3.3 → 0.3.6

package/README.md

@@ -126,7 +126,7 @@ Every top-level entry in `~/.claude` is classified into one of five categories,
 
 This is a safe-by-default posture: only `knowledge` and `settings` are shared out of the box. A configuration profile can open up `history` (or anything else) wholesale, or share individual items within a closed category.
 
-`secret`'s "never, cannot be overridden" is an absolute check `resolve.ts` makes *before* running the two-phase cascade at all — not merely the least-specific layer in that cascade, the way every other category is. This matters because [The cascade](#the-cascade-how-everything-composes)'s general rule is that a specific `entries` override always beats a category default; `secret` is the one deliberate exception, so an explicit `entries: { "secret/.credentials.json": true }` anywhere in any layer is rejected outright, the same as a bare `categories: { secret: true }` would be — path-specificity never gets a chance to apply to this one category.
+`secret`'s "never, cannot be overridden" is an absolute check `resolve/decide.ts` makes *before* running the two-phase cascade at all — not merely the least-specific layer in that cascade, the way every other category is. This matters because [The cascade](#the-cascade-how-everything-composes)'s general rule is that a specific `entries` override always beats a category default; `secret` is the one deliberate exception, so an explicit `entries: { "secret/.credentials.json": true }` anywhere in any layer is rejected outright, the same as a bare `categories: { secret: true }` would be — path-specificity never gets a chance to apply to this one category.
 
 **`~/.claude.json` isn't in this table at all, because — unlike `backups/` above — it isn't sourced from `~/.claude` the way everything else here is.** It's a sibling *file* next to the `~/.claude` directory, not an entry inside it: the OAuth session, personal (user/local-scope) MCP server definitions, and per-project trust decisions (which directories you've approved Claude Code to run in, and what it's allowed to do there). It fully relocates to `$CLAUDE_CONFIG_DIR/.claude.json` when set, the same as everything else — confirmed both in Anthropic's own Agent SDK documentation and empirically in this project's own development. Because it's generated fresh by Claude Code itself the moment it first runs under a new `CLAUDE_CONFIG_DIR`, `claude-use` treats it the same way as `secret`: always identity-local, never part of the shared cascade, and — since it isn't even a descendant of `~/.claude` — never something the resolver's directory walk encounters at all, rather than something explicitly excluded by category. `~/.claude/backups/` holds rolling timestamped copies of it (capped at five, auto-rotating) for Claude Code's own config-migration safety; being a genuine descendant of `~/.claude`, it *is* something the resolver walks past, which is exactly why it's listed under `secret` in the table above rather than merely assumed safe.
 
@@ -458,8 +458,8 @@ src/
   claudeShim.ts            # `claude-use shim enable`/`disable` — the one explicit action that creates/removes a `claude`-named hardlink of the running executable; records claude-shim.json
   cli/
     parsers.ts            # shared CLI-flag parsing helpers (splitTopLevelCommas, parsePair, repeatable-flag collectors)
-  resolve.ts              # public facade re-exporting the resolver below — nothing outside src/resolve/ imports its internals directly
   resolve/
+    pipeline.ts            # resolveDecisions: runs the whole pipeline for one launch, topLevelNames
     types.ts              # every resolver type
     match.ts              # canonicaliseEntryKey, compileMatcher, compareSpecificity
     projects.ts            # forward-only ~/.claude/projects/ path encoder — no decoder exists
@@ -495,23 +495,23 @@ install.sh                 # downloads the latest release's binary for the runni
 
 `schema.ts` models `categories` and `entries` differently despite their identical JSON-object appearance in every example above, because they have opposite key cardinality: `categories` only ever touches the four overridable names in the [category table](#category-based-sharing), so it's a closed `z.strictObject({ runtime: z.boolean().optional(), history: z.boolean().optional(), knowledge: z.boolean().optional(), settings: z.boolean().optional() })` — deliberately omitting `secret` from the shape entirely, so an attempted `secret` key is rejected at parse time rather than relying only on the runtime check described above — while `entries` is genuinely open-ended (any literal or glob path, each required to carry its `<category>/` prefix per the [Category-based sharing](#category-based-sharing) section above) and stays a `z.record(z.string().regex(ENTRY_KEY_RE), EntryValueSchema)`. The closed shape for `categories` also gives editors real key-name autocomplete from the published JSON Schema (the `schema/` directory above), which a record type can't offer.
 
-`ConfigProfile.extends` is a flat `z.array(z.string()).optional()` — a list of other profiles' *names*, resolved by `resolve.ts` loading each named file and walking the resulting graph at runtime. It's correctly **not** a self-referential Zod schema (no `z.lazy()` needed): nothing in `ConfigProfile`'s own shape points back at `ConfigProfile`. Because each profile file validates in isolation, though, Zod has no way to catch a circular `extends` definition (`a` extends `b` extends `a`) — the walker in `resolve.ts` needs its own cycle guard (a visited-set), independent of schema validation.
+`ConfigProfile.extends` is a flat `z.array(z.string()).optional()` — a list of other profiles' *names*, resolved by `resolve/extends.ts` loading each named file and walking the resulting graph at runtime. It's correctly **not** a self-referential Zod schema (no `z.lazy()` needed): nothing in `ConfigProfile`'s own shape points back at `ConfigProfile`. Because each profile file validates in isolation, though, Zod has no way to catch a circular `extends` definition (`a` extends `b` extends `a`) — the walker in `resolve/extends.ts` needs its own cycle guard (a visited-set), independent of schema validation.
 
 The `when` condition object's `env` field is `z.record(z.string().min(1), z.string()).optional()` — zero or more named environment-variable checks, ANDed together within the same `when` object exactly like every other condition, rather than a single fixed `{ name, value }` pair (which would need `when` itself to become an array to check more than one variable, a shape nothing else in this design uses).
 
 ### Why config file loading uses cosmiconfig's `load()`, never its `search()`
 
-Every config file this tool reads — the global config, named configuration profiles, and each `.claude-use.json`/`.claude-use.local.json` found while walking the directory tree — is loaded with [cosmiconfig](https://github.com/cosmiconfig/cosmiconfig)'s `load(filepath)`. Its `search()` method stops at the first config file found while walking upward; this design needs the opposite — every ancestor collected, shallowest-first — so `resolve.ts` does its own directory walk and calls `load()` at each level it visits, getting cosmiconfig's format flexibility without fighting its traversal semantics. JSON and YAML work with zero extra setup (`js-yaml` is a bundled dependency); JS config files work via native dynamic `import`/`require`. TS config files are real too, but cosmiconfig lists `typescript` as an *optional peer dependency*, not a bundled one — since every config file this tool actually defines is `.json`, that's moot in practice, but it means `.ts` config support isn't something this codebase gets "for free" the way JSON/YAML/JS are, and shipping the compiled Node SEA binary with no `node_modules` at runtime (per [Install](#install)) means a `.ts` config file would fail to load unless `typescript` were bundled into the SEA blob specifically for that purpose — not planned, since nothing this tool ships needs it.
+Every config file this tool reads — the global config, named configuration profiles, and each `.claude-use.json`/`.claude-use.local.json` found while walking the directory tree — is loaded with [cosmiconfig](https://github.com/cosmiconfig/cosmiconfig)'s `load(filepath)`. Its `search()` method stops at the first config file found while walking upward; this design needs the opposite — every ancestor collected, shallowest-first — so `launcher/cascade.ts` does its own directory walk and calls `load()` at each level it visits, getting cosmiconfig's format flexibility without fighting its traversal semantics. JSON and YAML work with zero extra setup (`js-yaml` is a bundled dependency); JS config files work via native dynamic `import`/`require`. TS config files are real too, but cosmiconfig lists `typescript` as an *optional peer dependency*, not a bundled one — since every config file this tool actually defines is `.json`, that's moot in practice, but it means `.ts` config support isn't something this codebase gets "for free" the way JSON/YAML/JS are, and shipping the compiled Node SEA binary with no `node_modules` at runtime (per [Install](#install)) means a `.ts` config file would fail to load unless `typescript` were bundled into the SEA blob specifically for that purpose — not planned, since nothing this tool ships needs it.
 
 ### Why `extends` isn't cosmiconfig's `$import`
 
-cosmiconfig also supports an `$import` directive that deep-merges imported files, later imports winning — close to what `extends` needs. (Its default `mergeImportArrays: true` concatenates arrays — imported items first, then local — rather than fully replacing them; only `mergeImportArrays: false` gives array fields the same "later wins" outright-replacement behaviour objects and primitives already get.) It isn't used for two reasons: it resolves imports by relative file path, not by profile name, so a name-to-path resolution step is needed regardless; and it has no awareness of the entries-beat-categories, most-specific-path-wins rule, which has to be bespoke either way. `resolve.ts` implements one flatten function, reused for both the `extends` chain and the outer cascade, rather than splitting the same conceptual merge across two implementations that could drift apart.
+cosmiconfig also supports an `$import` directive that deep-merges imported files, later imports winning — close to what `extends` needs. (Its default `mergeImportArrays: true` concatenates arrays — imported items first, then local — rather than fully replacing them; only `mergeImportArrays: false` gives array fields the same "later wins" outright-replacement behaviour objects and primitives already get.) It isn't used for two reasons: it resolves imports by relative file path, not by profile name, so a name-to-path resolution step is needed regardless; and it has no awareness of the entries-beat-categories, most-specific-path-wins rule, which has to be bespoke either way. `resolve/flatten.ts` implements one flatten function, reused for both the `extends` chain and the outer cascade, rather than splitting the same conceptual merge across two implementations that could drift apart.
 
 ### Resolver mechanics
 
 For each `~/.claude` entry, walk the cascade to a boolean decision. If the decision is uniform for an entire subtree, symlink that directory in one shot. If a deeper path override splits the decision, materialise that directory as a real local directory instead of a symlink and recurse, repeating the check at each level — only directories with an actual split ever get exploded. A conditional entries key is never eligible for the uniform-symlink shortcut, since its decision can only be evaluated per-file.
 
-The pure decision logic — `(entryFacts, cascade, path) => Map<path, boolean>` — takes filesystem/git/env facts as an injected parameter (an entry manifest of path, mtime, and size; a resolved git branch; an env snapshot), rather than reading any of that itself. This is what makes it unit-testable with fake mtimes and a fake branch, per [Testing strategy](#testing-strategy), without touching a real filesystem or `git` — "pure" here means decoupled from I/O via dependency injection, not that no I/O happens anywhere in `resolve.ts`; something still has to walk `~/.claude` and stat its entries to build the manifest this function consumes.
+The pure decision logic — `(entryFacts, cascade, path) => Map<path, boolean>` — takes filesystem/git/env facts as an injected parameter (an entry manifest of path, mtime, and size; a resolved git branch; an env snapshot), rather than reading any of that itself. This is what makes it unit-testable with fake mtimes and a fake branch, per [Testing strategy](#testing-strategy), without touching a real filesystem or `git` — "pure" here means decoupled from I/O via dependency injection, not that no I/O happens anywhere in the resolver; something still has to walk `~/.claude` and stat its entries to build the manifest this function consumes.
 
 **Materialised directories need a write-through reconciliation step, not just a one-way split.** A directory the real Claude Code binary can create new children in at runtime — `history/projects/` chief among them, since Claude Code creates a new project subdirectory there the first time it sees an unfamiliar working directory — is exactly the kind of directory the tool's own conditional and per-project sharing examples recommend materialising. Once materialised, it stops being a live view of `~/.claude/projects/` and becomes a locally-built directory of symlinks (and further materialised subdirectories) frozen at resync time. Anything Claude Code subsequently writes into it — a brand-new project subdirectory, a new session file inside an existing one — lands as a real, untracked child of that materialised directory, not a symlink back to `~/.claude`: invisible to every other identity, and liable to be misread as stale scaffolding and pruned on a later resync.
 
@@ -521,15 +521,15 @@ The reverse direction matters just as much: a directory materialised because of
 
 ### Automated releases (semantic-release)
 
-Every push to `main` (never a tag push — the `semantic-release` job's own `if:` checks `github.ref == 'refs/heads/main'` specifically) runs [semantic-release](https://github.com/semantic-release/semantic-release) after `check` passes. It analyses every commit since the last `vX.Y.Z` tag using the `conventionalcommits` preset — the same convention this project's own commitlint config already enforces — and decides whether a release is warranted at all: a `feat:` commit bumps minor, `fix:`/`perf:` bump patch, a `BREAKING CHANGE:` footer bumps major, and anything else (`chore:`, `docs:`, `ci:`, `test:`) triggers no release on its own. If a release is warranted, it creates and pushes the next tag itself — exactly the step that used to be a manual `git tag`/`git push` earlier in this project's life.
+Every push to `main` runs [semantic-release](https://github.com/semantic-release/semantic-release) after `check` passes, via `release.config.ts` (a typed config, matching how this org's other semantic-release repos — e.g. `graphle` — configure it, rather than the untyped `.releaserc.json` form this project started with). It analyses every commit since the last `vX.Y.Z` tag using the `conventionalcommits` preset — the same convention this project's own commitlint config already enforces — and decides whether a release is warranted at all: a `feat:` commit bumps minor, `fix:`/`perf:` bump patch, a `BREAKING CHANGE:` footer bumps major, and anything else (`chore:`, `docs:`, `ci:`, `test:`) triggers no release on its own. If a release is warranted, it creates and pushes the next tag itself — exactly the step that used to be a manual `git tag`/`git push` earlier in this project's life.
 
-`.releaserc.json` configures five plugins, in this order: `@semantic-release/commit-analyzer` and `@semantic-release/release-notes-generator` (both `conventionalcommits`-preset, deciding the version and generating notes text), `@semantic-release/changelog` (writes `CHANGELOG.md`), `@semantic-release/npm` with **`npmPublish: false`** (bumps `package.json`'s version field and stages it, but never touches the npm registry), `@semantic-release/git` (commits `CHANGELOG.md` + `package.json` with a `chore(release): X.Y.Z [skip ci]` message and pushes it to `main`), and `@semantic-release/exec` (see below). `@semantic-release/github` is not loaded at all. This split is deliberate: semantic-release owns only the version *decision*, the tag, and the changelog — actual npm publishing (this project's own OIDC trusted-publishing job, below), GitHub Release creation (with this project's own multi-platform asset list and release-notes body, not semantic-release's generic one), and the Homebrew/Scoop tap updates all remain this project's existing tag-triggered jobs, completely unchanged. The `[skip ci]` marker on the changelog commit stops it from re-triggering `check`/`semantic-release` on `main`.
+`release.config.ts` configures four plugins, in this order: `@semantic-release/commit-analyzer` and `@semantic-release/release-notes-generator` (both `conventionalcommits`-preset, deciding the version and generating notes text), `@semantic-release/changelog` (writes `CHANGELOG.md`), `@semantic-release/npm` with **`npmPublish: false`** (bumps `package.json`'s version field and stages it, but never touches the npm registry), and `@semantic-release/git` (commits `CHANGELOG.md` + `package.json` with a `chore(release): X.Y.Z [skip ci]` message and pushes it to `main`). `@semantic-release/github` is not loaded at all. This split is deliberate: semantic-release owns only the version *decision*, the tag, and the changelog — actual npm publishing (this project's own OIDC trusted-publishing job, below), GitHub Release creation (with this project's own multi-platform asset list and release-notes body, not semantic-release's generic one), and the Homebrew/Scoop tap updates all remain this project's own jobs. The `[skip ci]` marker on the changelog commit stops it from re-triggering `check`/`semantic-release` on `main`.
 
-One accepted quirk worth knowing rather than being surprised by: semantic-release creates the release tag pointing at the commit that already existed (the actual code change being released) *before* running `@semantic-release/git`'s commit step — so the changelog/version-bump commit lands on `main` **after** the tag, not folded into it. This means checking out a given `vX.Y.Z` tag shows the *previous* version in `package.json` until the next release's tag moves past this commit. This is standard, widely-accepted semantic-release behaviour, not a bug — and harmless here specifically because every job downstream (`publish-npm`'s `npm pkg set version="${GITHUB_REF_NAME#v}"`, every build/verify job's own version assertions) already derives the version from the **tag name** (`GITHUB_REF_NAME`) directly, never from `package.json`'s committed value at that commit.
+One accepted quirk worth knowing rather than being surprised by: semantic-release creates the release tag pointing at the commit that already existed (the actual code change being released) *before* running `@semantic-release/git`'s commit step — so the changelog/version-bump commit lands on `main` **after** the tag, not folded into it. Every downstream job below checks out `ref: main` (not the commit that triggered the run) specifically to pick up this post-release state, matching how this org's other semantic-release repos handle the identical quirk.
 
 **Branch/tag protection had to be disabled for this to work.** `main`'s branch-protection ruleset previously required every push go through a reviewed PR, and a separate ruleset blocked tag creation/deletion outright — both only bypassable by the Admin repository role. semantic-release's own git operations run as the workflow's default `GITHUB_TOKEN`, which doesn't hold that role, so both rulesets were disabled (not deleted — the rule definitions are preserved and can be re-enabled with a single API call or via the repo's Rules settings page) rather than routing around them with a separate bypass credential.
 
-**The tag push itself does not trigger the build/publish/verify pipeline below — GitHub Actions never lets a `GITHUB_TOKEN`-authenticated push start a new workflow run, to prevent recursive loops.** This turned out to hold for an SSH deploy key registered on the repository too, not just the default token — confirmed empirically rather than assumed, since most write-ups of this restriction only discuss `GITHUB_TOKEN` and imply any other credential is exempt. `workflow_dispatch` (and `repository_dispatch`) are explicitly exempt, though, so `@semantic-release/exec`'s `successCmd` re-dispatches this same workflow directly against the new tag: `gh workflow run ci.yml --ref ${nextRelease.gitTag}`. The `success` step only fires once semantic-release has actually created a release, so a push with nothing to release skips it entirely rather than dispatching a pointless run. The `semantic-release` job's `permissions: actions: write` is what lets its own `GITHUB_TOKEN` call the dispatch API — `contents: write` covers the tag/commit push, same as before.
+**The build/publish/verify pipeline below is not a separate tag-triggered workflow run — it's later jobs in this SAME run, gated on `needs: [semantic-release]`.** This project originally tried the opposite: let semantic-release's tag push trigger a second, tag-scoped workflow run, the way `ci.yml` used to be structured before this section was rewritten. That never worked — GitHub Actions never lets a `GITHUB_TOKEN`-authenticated push start a new workflow run, to prevent recursive loops, and (confirmed empirically, since most write-ups only discuss `GITHUB_TOKEN` and imply any other credential is exempt) an SSH deploy key registered on the repository hit the identical restriction. This org's other semantic-release repos (`graphle`, `spot-of-the-day`) never hit this at all, because their own post-release jobs (a Pages redeploy, a Worker deploy) are idempotent and just run unconditionally on every push to `main` — they never need to ask "did a release actually happen." Building five platform binaries, publishing to npm, and updating two external tap repos are not safe to run unconditionally, so this project's `semantic-release` job runs a plain `git describe --exact-match --tags HEAD` right after `npx semantic-release` and exposes the result as job outputs (`published`, `version`, `tag`) — no plugin needed, since it's just a shell check, not a hook into semantic-release's own plugin lifecycle. Every downstream job gates on `needs.semantic-release.outputs.published == 'true'`.
 
 ### Build (Node SEA)
 
@@ -557,7 +557,7 @@ The published JSON Schemas under `schema/` should self-reference (and, if ever s
 
 ## Testing strategy
 
-`resolve.ts`'s cascade and materialisation logic is exactly the kind of thing that's easy to get subtly wrong, so it gets thorough unit tests before anything else is built on it:
+the resolver's cascade and materialisation logic is exactly the kind of thing that's easy to get subtly wrong, so it gets thorough unit tests before anything else is built on it:
 
 - Each cascade layer overriding the last; path overrides beating their parent category
 - Directory rules folding correctly for nested paths, and correctly composing configuration profiles mid-tree
@@ -571,7 +571,7 @@ The published JSON Schemas under `schema/` should self-reference (and, if ever s
 - Conditional entries with injectable/fake mtimes, a fake resolved branch, and a fake env snapshot (never real filesystem/git/environment state, so tests aren't time-dependent, git-dependent, or slow) — a `newerThan` condition including a fresh file and excluding a stale one under the same glob, a `branch` condition applying only on a matching branch, an `env` condition applying only when the right variable is set, and a conditionally-matched subtree always being materialised rather than symlinked
 - A materialised directory reconciling any real (non-symlink) children written since the last resync back into `~/.claude` before re-deciding, and collapsing back into a plain symlink once its split condition no longer holds
 
-`identityManager.ts`, `configProfiles.ts`, `directoryRules.ts`, and `configure.ts` stay thin adapters over `resolve.ts`, so most of their correctness rides on the resolver's own test coverage above. `launcher.ts` carries three separately-testable responsibilities of its own that aren't covered by `resolve.ts`'s purity, and need their own coverage: translating a resolved `Map<path, boolean>` into real filesystem side effects (creating/removing symlinks, materialising/collapsing directories, diffing against the farm's prior state, the per-identity lock and atomic-swap behaviour from [Directory rules](#directory-rules)) against a fake/in-memory filesystem; invoking the real `claude` binary via an injected `spawn` function (argv/env construction, exit-code propagation), never a real subprocess in a unit test; and the ambient-credential guard — given a fake `process.env`, refusing to proceed when any of the six named variables is set and the active identity's `allowAmbientCredential` is unset/false, proceeding when it's true, and proceeding when `CLAUDE_USE_ALLOW_AMBIENT_CREDENTIAL=1` is set for that one call regardless of the identity's own setting.
+`identityManager.ts`, `configProfiles.ts`, `directoryRules.ts`, and `configure.ts` stay thin adapters over the resolver, so most of their correctness rides on the resolver's own test coverage above. `launcher.ts` carries three separately-testable responsibilities of its own that aren't covered by the resolver's purity, and need their own coverage: translating a resolved `Map<path, boolean>` into real filesystem side effects (creating/removing symlinks, materialising/collapsing directories, diffing against the farm's prior state, the per-identity lock and atomic-swap behaviour from [Directory rules](#directory-rules)) against a fake/in-memory filesystem; invoking the real `claude` binary via an injected `spawn` function (argv/env construction, exit-code propagation), never a real subprocess in a unit test; and the ambient-credential guard — given a fake `process.env`, refusing to proceed when any of the six named variables is set and the active identity's `allowAmbientCredential` is unset/false, proceeding when it's true, and proceeding when `CLAUDE_USE_ALLOW_AMBIENT_CREDENTIAL=1` is set for that one call regardless of the identity's own setting.
 
 `check.ts`'s three always-on diagnostics get their own tests too, independent of path/cascade resolution: the ambient-credential check against a fake `process.env` (same fixture as `launcher.ts`'s guard, since they share the same detection logic); the settings-secrets advisory against a fake settings.json with populated `env`/`hooks` fields, confirming it reports counts and key names only, never values; and — since Keychain access is real OS state, not something to fake — a manual/integration-only note that the Keychain-name lookup is exercised against a real `security` call in CI on macOS runners, not unit-tested with a mock.
 
@@ -590,7 +590,7 @@ pnpm build       # bundle src/cli.ts with esbuild, then node --build-sea= (see B
 pnpm schema      # regenerate schema/*.schema.json from src/config/schema.ts; CI fails if this drifts from what's committed
 ```
 
-Every test run gets `CLAUDE_USE_HOME` set to a throwaway directory by `vitest.config.mts`, and a Vitest setup file (`src/test-setup.ts`) refuses to let any test run at all if that variable is unset or resolves to the real `~/.claude-use` — there is no path by which the test suite can touch a real identity. A farm test that also needs a canonical `~/.claude` to resync against injects its own fake filesystem port rather than touching a real path. Manual, non-test exploration of a locally built binary should follow the same discipline: export `CLAUDE_USE_HOME` (and, if exercising a real farm resync, `CLAUDE_USE_CLAUDE_HOME`) to point at scratch directories, never at your own real identities.
+Every test run gets `CLAUDE_USE_HOME` set to a throwaway directory by `vitest.config.ts`, and a Vitest setup file (`src/test-setup.ts`) refuses to let any test run at all if that variable is unset or resolves to the real `~/.claude-use` — there is no path by which the test suite can touch a real identity. A farm test that also needs a canonical `~/.claude` to resync against injects its own fake filesystem port rather than touching a real path. Manual, non-test exploration of a locally built binary should follow the same discipline: export `CLAUDE_USE_HOME` (and, if exercising a real farm resync, `CLAUDE_USE_CLAUDE_HOME`) to point at scratch directories, never at your own real identities.
 
 Commits are gated by Husky hooks (`pnpm install` wires them up via the `prepare` script): `commit-msg` enforces conventional-commit format, `pre-commit` rejects merge/squash commits on `main` and runs `eslint --fix` on staged files via lint-staged, `pre-push` runs the full test suite. Both `pre-commit` and `pre-push` also reject a commit or push that deletes more than 100 files, as a guard against a sparse-checkout or partial-worktree bug landing a mass deletion.
 

package/dist/cli.cjs

@@ -218432,8 +218432,8 @@ var require_src = __commonJS({
 });
 
 // src/cli.ts
-var import_node_os6 = __toESM(require("node:os"));
-var import_node_path20 = __toESM(require("node:path"));
+var import_node_os6 = __toESM(require("node:os"), 1);
+var import_node_path20 = __toESM(require("node:path"), 1);
 var import_node_crypto4 = require("node:crypto");
 
 // node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/error.js
@@ -221857,7 +221857,7 @@ var categories_default_default = {
 // package.json
 var package_default = {
   name: "claude-use",
-  version: "0.3.3",
+  version: "0.3.6",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "Apache-2.0",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -221873,7 +221873,7 @@ var package_default = {
     "cli"
   ],
   packageManager: "pnpm@11.6.0",
-  type: "commonjs",
+  type: "module",
   engines: {
     node: ">=22.12.0"
   },
@@ -221885,10 +221885,18 @@ var package_default = {
   ],
   scripts: {
     prepare: "husky",
-    typecheck: "tsc --noEmit",
-    lint: "eslint . --max-warnings 0",
-    test: "vitest run",
-    build: "node scripts/build.mts",
+    typecheck: "turbo run _typecheck",
+    _typecheck: "tsc --noEmit",
+    lint: "turbo run _lint",
+    _lint: "eslint . --cache --cache-location .eslintcache --max-warnings 0",
+    test: "turbo run _test",
+    _test: "vitest run",
+    "test:coverage": "turbo run _test:coverage",
+    "_test:coverage": "vitest run --coverage",
+    knip: "turbo run _knip",
+    _knip: "knip --cache",
+    build: "turbo run _build",
+    _build: "node scripts/build.mts",
     "build:bundle": "node scripts/build.mts --bundle-only",
     prepublishOnly: "pnpm build:bundle",
     schema: "node scripts/gen-schema.mts"
@@ -221905,19 +221913,21 @@ var package_default = {
     "@commitlint/config-conventional": "^21.2.0",
     "@eslint/js": "^10.0.1",
     "@semantic-release/changelog": "^7.0.0",
-    "@semantic-release/exec": "^7.1.0",
     "@semantic-release/git": "^11.0.1",
     "@semantic-release/npm": "^13.1.5",
     "@types/node": "^26.1.2",
     "@types/picomatch": "^4.0.3",
+    "@vitest/coverage-v8": "^4.1.10",
     "conventional-changelog-conventionalcommits": "^10.2.1",
     esbuild: "^0.28.1",
     eslint: "^10.8.0",
     globals: "^17.8.0",
     husky: "^9.1.7",
     jiti: "^2.7.0",
+    knip: "^6.31.0",
     "lint-staged": "^17.3.0",
     "semantic-release": "^25.0.8",
+    turbo: "^2.10.8",
     typescript: "^6.0.3",
     "typescript-eslint": "^8.65.0",
     vitest: "^4.1.10"
@@ -221925,7 +221935,7 @@ var package_default = {
 };
 
 // src/config/load.ts
-var import_cosmiconfig = __toESM(require_dist());
+var import_cosmiconfig = __toESM(require_dist(), 1);
 function createExplorer(moduleName = "claude-use") {
   return (0, import_cosmiconfig.cosmiconfigSync)(moduleName, { searchPlaces: [] });
 }
@@ -236609,8 +236619,8 @@ var SHIPPED_CATEGORY_DEFAULTS = Object.freeze({
 });
 
 // src/config/store.ts
-var import_node_fs2 = __toESM(require("node:fs"));
-var import_node_path2 = __toESM(require("node:path"));
+var import_node_fs2 = __toESM(require("node:fs"), 1);
+var import_node_path2 = __toESM(require("node:path"), 1);
 var import_node_crypto = require("node:crypto");
 function isEnoent(error51) {
   return typeof error51 === "object" && error51 !== null && "code" in error51 && error51.code === "ENOENT";
@@ -236690,14 +236700,14 @@ function applyPatch(filePath, schema, patch, options = {}) {
 }
 
 // src/check.ts
-var import_node_os3 = __toESM(require("node:os"));
-var import_node_path13 = __toESM(require("node:path"));
+var import_node_os3 = __toESM(require("node:os"), 1);
+var import_node_path13 = __toESM(require("node:path"), 1);
 
 // src/launcher/cascade.ts
-var import_node_path6 = __toESM(require("node:path"));
+var import_node_path5 = __toESM(require("node:path"), 1);
 
 // src/pathNorm.ts
-var import_node_path3 = __toESM(require("node:path"));
+var import_node_path3 = __toESM(require("node:path"), 1);
 function expandTilde(value, home) {
   if (value === "~") {
     return home;
@@ -236718,8 +236728,249 @@ function isAncestorOrSelf(ancestor, descendant) {
   return descendant.startsWith(withSeparator);
 }
 
+// src/resolve/walk.ts
+var import_node_path4 = __toESM(require("node:path"), 1);
+
+// src/resolve/extends.ts
+function lineariseProfile(rootName, load) {
+  const stack = [];
+  const visited = /* @__PURE__ */ new Set();
+  const order = [];
+  const diagnostics = [];
+  const visit = (name) => {
+    if (stack.includes(name)) {
+      diagnostics.push({
+        code: "EXTENDS_CYCLE",
+        severity: "error",
+        message: `Circular profile extends: ${[...stack, name].join(" -> ")}. The cycle is broken here and "${name}" is not applied twice.`,
+        subject: name
+      });
+      return;
+    }
+    if (visited.has(name)) {
+      return;
+    }
+    const source = load(name);
+    if (source === void 0) {
+      diagnostics.push({
+        code: "MISSING_PROFILE",
+        severity: "error",
+        message: `Configuration profile "${name}" does not exist.`,
+        subject: name
+      });
+      visited.add(name);
+      return;
+    }
+    stack.push(name);
+    for (const dependency of source.profile.extends ?? []) {
+      visit(dependency);
+    }
+    stack.pop();
+    visited.add(name);
+    order.push(name);
+  };
+  visit(rootName);
+  return { order, diagnostics };
+}
+function profileLayers(rootName, load, startId) {
+  const { order, diagnostics } = lineariseProfile(rootName, load);
+  const layers = [];
+  let nextId = startId;
+  for (const name of order) {
+    const source = load(name);
+    if (source === void 0) {
+      continue;
+    }
+    layers.push({
+      id: nextId,
+      kind: "config-profile",
+      source: source.filepath ?? name,
+      ...source.profile.categories === void 0 ? {} : { categories: source.profile.categories },
+      ...source.profile.entries === void 0 ? {} : { entries: source.profile.entries },
+      ...source.entryOrder === void 0 ? {} : { entryOrder: source.entryOrder },
+      ...source.profile.launch === void 0 ? {} : { launch: source.profile.launch }
+    });
+    nextId += 1;
+  }
+  return { layers, nextId, diagnostics };
+}
+
+// src/resolve/walk.ts
+function walkDirectoryAncestors(cwd, options) {
+  const limit = import_node_path4.default.resolve(options.limit ?? options.home);
+  const isReadable = options.isReadable ?? (() => true);
+  const collected = [];
+  let current = import_node_path4.default.resolve(cwd);
+  for (; ; ) {
+    if (!isReadable(current)) {
+      break;
+    }
+    collected.push(current);
+    if (current === limit) {
+      break;
+    }
+    const parent = import_node_path4.default.dirname(current);
+    if (parent === current) {
+      break;
+    }
+    current = parent;
+  }
+  return collected.reverse();
+}
+function assembleCascade(input) {
+  const layers = [];
+  const diagnostics = [];
+  let nextId = 0;
+  let identityPin;
+  let directoryConfigProfile;
+  if (input.globalConfig !== void 0) {
+    const { config: config2, entryOrder, filepath } = input.globalConfig;
+    layers.push({
+      id: nextId,
+      kind: "global-config",
+      source: filepath,
+      ...config2.categories === void 0 ? {} : { categories: config2.categories },
+      ...config2.entries === void 0 ? {} : { entries: config2.entries },
+      ...entryOrder === void 0 ? {} : { entryOrder },
+      ...config2.launch === void 0 ? {} : { launch: config2.launch }
+    });
+    nextId += 1;
+  }
+  if (input.baseConfigProfile !== void 0) {
+    const resolved = profileLayers(input.baseConfigProfile, input.loadProfile, nextId);
+    layers.push(...resolved.layers);
+    diagnostics.push(...resolved.diagnostics);
+    nextId = resolved.nextId;
+  }
+  for (const level of input.levels ?? []) {
+    const sources = [];
+    if (level.portable !== void 0) {
+      sources.push({ kind: "portable", config: level.portable.config, ...level.portable.entryOrder === void 0 ? {} : { entryOrder: level.portable.entryOrder }, filepath: level.portable.filepath });
+    }
+    for (const entry of level.rules ?? []) {
+      sources.push({ kind: "directory-rule", config: entry.rule, ...entry.entryOrder === void 0 ? {} : { entryOrder: entry.entryOrder }, filepath: entry.filepath });
+    }
+    if (level.portableLocal !== void 0) {
+      sources.push({ kind: "portable-local", config: level.portableLocal.config, ...level.portableLocal.entryOrder === void 0 ? {} : { entryOrder: level.portableLocal.entryOrder }, filepath: level.portableLocal.filepath });
+    }
+    for (const source of sources) {
+      if (source.config.identity !== void 0) {
+        identityPin = source.config.identity;
+      }
+      if (source.config.configProfile !== void 0) {
+        directoryConfigProfile = source.config.configProfile;
+        const resolved = profileLayers(source.config.configProfile, input.loadProfile, nextId);
+        layers.push(...resolved.layers);
+        diagnostics.push(...resolved.diagnostics);
+        nextId = resolved.nextId;
+      }
+      layers.push({
+        id: nextId,
+        kind: source.kind,
+        source: source.filepath,
+        ...source.config.categories === void 0 ? {} : { categories: source.config.categories },
+        ...source.config.entries === void 0 ? {} : { entries: source.config.entries },
+        ...source.entryOrder === void 0 ? {} : { entryOrder: source.entryOrder },
+        ...source.config.launch === void 0 ? {} : { launch: source.config.launch }
+      });
+      nextId += 1;
+    }
+  }
+  if (input.cliOverride !== void 0) {
+    layers.push({
+      id: nextId,
+      kind: "cli-override",
+      source: "command line",
+      ...input.cliOverride.categories === void 0 ? {} : { categories: input.cliOverride.categories },
+      ...input.cliOverride.entries === void 0 ? {} : { entries: input.cliOverride.entries },
+      ...input.cliOverride.entryOrder === void 0 ? {} : { entryOrder: input.cliOverride.entryOrder },
+      ...input.cliOverride.launch === void 0 ? {} : { launch: input.cliOverride.launch }
+    });
+  }
+  return {
+    layers,
+    diagnostics,
+    ...identityPin === void 0 ? {} : { identityPin },
+    ...directoryConfigProfile === void 0 ? {} : { directoryConfigProfile }
+  };
+}
+
+// src/launcher/cascade.ts
+var PORTABLE_CONFIG_FILENAME = ".claude-use.json";
+var PORTABLE_LOCAL_CONFIG_FILENAME = ".claude-use.local.json";
+function loadCascadeInput(params) {
+  const globalConfig2 = loadConfigFile(params.paths.globalConfigFile, GlobalConfigSchema, params.read);
+  const directoryRules = loadConfigFile(params.paths.directoryRulesFile, DirectoryRulesSchema, params.read);
+  const loadProfile = (name) => {
+    const filepath = import_node_path5.default.join(params.paths.configProfilesDir, `${name}.json`);
+    const loaded = loadConfigFile(filepath, ConfigProfileSchema, params.read);
+    if (loaded === void 0) {
+      return void 0;
+    }
+    return { name, profile: loaded.config, entryOrder: loaded.entryOrder, filepath: loaded.filepath };
+  };
+  const limit = globalConfig2?.config.walkUpLimit;
+  const dirs = walkDirectoryAncestors(params.cwd, {
+    home: params.home,
+    ...limit === void 0 ? {} : { limit: expandTilde(limit, params.home) },
+    ...params.isReadable === void 0 ? {} : { isReadable: params.isReadable }
+  });
+  const levels = [];
+  for (const dir of dirs) {
+    const portable = loadConfigFile(import_node_path5.default.join(dir, PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read);
+    const portableLocal = loadConfigFile(import_node_path5.default.join(dir, PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read);
+    const rules = (directoryRules?.config.rules ?? []).map((rule, index) => ({ rule, index })).filter(({ rule }) => normaliseRulePath(rule.path, params.home) === dir).map(({ rule, index }) => {
+      const entryOrder = directoryRules?.ruleEntryOrders[index];
+      return {
+        rule,
+        ...entryOrder === void 0 ? {} : { entryOrder },
+        filepath: params.paths.directoryRulesFile
+      };
+    });
+    if (portable === void 0 && portableLocal === void 0 && rules.length === 0) {
+      continue;
+    }
+    levels.push({
+      dir,
+      ...portable === void 0 ? {} : { portable: { config: portable.config, entryOrder: portable.entryOrder, filepath: portable.filepath } },
+      ...rules.length === 0 ? {} : { rules },
+      ...portableLocal === void 0 ? {} : { portableLocal: { config: portableLocal.config, entryOrder: portableLocal.entryOrder, filepath: portableLocal.filepath } }
+    });
+  }
+  const input = {
+    home: params.home,
+    ...globalConfig2 === void 0 ? {} : { globalConfig: { config: globalConfig2.config, entryOrder: globalConfig2.entryOrder, filepath: globalConfig2.filepath } },
+    ...params.baseConfigProfile === void 0 ? {} : { baseConfigProfile: params.baseConfigProfile },
+    loadProfile,
+    levels,
+    ...params.cliOverride === void 0 ? {} : { cliOverride: params.cliOverride }
+  };
+  return { input, ...globalConfig2 === void 0 ? {} : { globalConfig: globalConfig2.config } };
+}
+function readDirectorySelections(loaded) {
+  let identity;
+  let configProfile;
+  for (const level of loaded.input.levels ?? []) {
+    for (const source of [level.portable?.config, ...(level.rules ?? []).map((entry) => entry.rule), level.portableLocal?.config]) {
+      if (source === void 0) {
+        continue;
+      }
+      if (source.identity !== void 0) {
+        identity = source.identity;
+      }
+      if (source.configProfile !== void 0) {
+        configProfile = source.configProfile;
+      }
+    }
+  }
+  return { ...identity === void 0 ? {} : { identity }, ...configProfile === void 0 ? {} : { configProfile } };
+}
+
+// src/launcher/farm.ts
+var import_node_path8 = __toESM(require("node:path"), 1);
+
 // src/config/classify.ts
-var import_picomatch = __toESM(require_picomatch2());
+var import_picomatch = __toESM(require_picomatch2(), 1);
 var GLOB_METACHARACTERS = /[*?[\]{}!()]/;
 function isExactPattern(pattern) {
   return !GLOB_METACHARACTERS.test(pattern);
@@ -236793,30 +237044,120 @@ function classifyEntries(names, options) {
   return { classification, unclassified, decidedBy };
 }
 
-// src/resolve/conditions.ts
-var import_picomatch2 = __toESM(require_picomatch2());
-var MILLISECONDS_PER_UNIT = Object.freeze({
-  ms: 1,
-  s: 1e3,
-  m: 6e4,
-  h: 36e5,
-  d: 864e5,
-  w: 6048e5
-});
-var DURATION_PARTS_RE = /^(0|[1-9][0-9]*)(ms|s|m|h|d|w)$/;
-function parseDuration(value) {
-  const parts = DURATION_PARTS_RE.exec(value);
-  if (parts === null) {
-    throw new Error(`"${value}" is not a valid duration. Expected a count followed by ms, s, m, h, d, or w.`);
-  }
-  const [, count, unit] = parts;
-  const multiplier = MILLISECONDS_PER_UNIT[unit];
-  if (count === void 0 || multiplier === void 0) {
-    throw new Error(`"${value}" is not a valid duration.`);
-  }
-  return Number(count) * multiplier;
-}
-function matchBranch(pattern, branch, detached = false) {
+// src/resolve/reconcile.ts
+function parentOf(rel) {
+  const index = rel.lastIndexOf("/");
+  return index === -1 ? "" : rel.slice(0, index);
+}
+function indexByParent(listing) {
+  const children = /* @__PURE__ */ new Map();
+  for (const entry of listing) {
+    const parent = parentOf(entry.rel);
+    const bucket = children.get(parent);
+    if (bucket === void 0) {
+      children.set(parent, [entry]);
+    } else {
+      bucket.push(entry);
+    }
+  }
+  for (const bucket of children.values()) {
+    bucket.sort((a2, b) => a2.rel < b.rel ? -1 : a2.rel > b.rel ? 1 : 0);
+  }
+  return children;
+}
+function planReconciliation(params) {
+  const conservative = params.manifest === void 0;
+  const diagnostics = [];
+  const actions = [];
+  const farmChildren = indexByParent(params.farmListing);
+  const canonicalByRel = new Map(params.canonicalListing.map((entry) => [entry.rel, entry]));
+  const materialised = /* @__PURE__ */ new Set([""]);
+  if (params.manifest !== void 0) {
+    for (const rel of params.manifest.materialised) {
+      materialised.add(rel);
+    }
+  } else {
+    for (const entry of params.farmListing) {
+      if (entry.kind === "dir") {
+        materialised.add(entry.rel);
+      }
+    }
+    diagnostics.push({
+      code: "FARM_MANIFEST_MISSING",
+      severity: "warning",
+      message: "The previous farm's manifest is missing or unreadable, so there is no record of which directories the farm built itself. Every real directory in the farm was treated as materialised and every real child examined for adoption. This over-adopts rather than risking data Claude Code wrote being discarded."
+    });
+  }
+  const visit = (dir) => {
+    for (const child of farmChildren.get(dir) ?? []) {
+      if (child.kind === "symlink") {
+        actions.push({ kind: "skip", rel: child.rel, reason: "is-symlink" });
+        continue;
+      }
+      if (child.kind === "dir" && materialised.has(child.rel)) {
+        actions.push({ kind: "skip", rel: child.rel, reason: "tracked-materialised-dir" });
+        visit(child.rel);
+        continue;
+      }
+      if (child.kind === "dir") {
+        const grandchildren = farmChildren.get(child.rel) ?? [];
+        if (grandchildren.length === 0) {
+          if (canonicalByRel.has(child.rel)) {
+            actions.push({ kind: "skip", rel: child.rel, reason: "identical-content" });
+          } else {
+            actions.push({ kind: "adopt", rel: child.rel, reason: "absent-from-canonical" });
+          }
+          continue;
+        }
+        visit(child.rel);
+        continue;
+      }
+      const canonical = canonicalByRel.get(child.rel);
+      if (canonical === void 0) {
+        actions.push({ kind: "adopt", rel: child.rel, reason: "absent-from-canonical" });
+        continue;
+      }
+      if (canonical.contentHash !== void 0 && canonical.contentHash === child.contentHash) {
+        actions.push({ kind: "skip", rel: child.rel, reason: "identical-content" });
+        continue;
+      }
+      actions.push({ kind: "adopt-conflict", rel: child.rel });
+      diagnostics.push({
+        code: "RECONCILE_CONFLICT",
+        severity: "warning",
+        message: `"${child.rel}" exists both in the farm and in the canonical ~/.claude with different content. The canonical copy is left authoritative and the farm's copy is preserved alongside it rather than either being discarded.`,
+        subject: child.rel
+      });
+    }
+  };
+  visit("");
+  return { actions, diagnostics, conservative };
+}
+
+// src/resolve/conditions.ts
+var import_picomatch2 = __toESM(require_picomatch2(), 1);
+var MILLISECONDS_PER_UNIT = Object.freeze({
+  ms: 1,
+  s: 1e3,
+  m: 6e4,
+  h: 36e5,
+  d: 864e5,
+  w: 6048e5
+});
+var DURATION_PARTS_RE = /^(0|[1-9][0-9]*)(ms|s|m|h|d|w)$/;
+function parseDuration(value) {
+  const parts = DURATION_PARTS_RE.exec(value);
+  if (parts === null) {
+    throw new Error(`"${value}" is not a valid duration. Expected a count followed by ms, s, m, h, d, or w.`);
+  }
+  const [, count, unit] = parts;
+  const multiplier = MILLISECONDS_PER_UNIT[unit];
+  if (count === void 0 || multiplier === void 0) {
+    throw new Error(`"${value}" is not a valid duration.`);
+  }
+  return Number(count) * multiplier;
+}
+function matchBranch(pattern, branch, detached = false) {
   if (branch === void 0 || branch === "" || detached) {
     return false;
   }
@@ -236871,7 +237212,7 @@ function isVacuousWhen(when) {
 }
 
 // src/resolve/match.ts
-var import_picomatch3 = __toESM(require_picomatch2());
+var import_picomatch3 = __toESM(require_picomatch2(), 1);
 
 // src/resolve/projects.ts
 var NON_ALPHANUMERIC = /[^A-Za-z0-9]/g;
@@ -237360,15 +237701,15 @@ function dedupeDiagnostics(diagnostics) {
 }
 
 // src/resolve/plan.ts
-var import_node_path4 = __toESM(require("node:path"));
-function parentOf(rel) {
+var import_node_path6 = __toESM(require("node:path"), 1);
+function parentOf2(rel) {
   const index = rel.lastIndexOf("/");
   return index === -1 ? "" : rel.slice(0, index);
 }
 function buildChildIndex(facts) {
   const children = /* @__PURE__ */ new Map();
   for (const rel of facts.entries.keys()) {
-    const parent = parentOf(rel);
+    const parent = parentOf2(rel);
     const bucket = children.get(parent);
     if (bucket === void 0) {
       children.set(parent, [rel]);
@@ -237410,7 +237751,7 @@ function planFarm(params) {
     }
     return value;
   };
-  const linkTarget = (rel) => import_node_path4.default.join(params.facts.claudeHome, rel);
+  const linkTarget = (rel) => import_node_path6.default.join(params.facts.claudeHome, rel);
   const visit = (rel) => {
     const fact = params.facts.entries.get(rel);
     const decision = params.decisions.get(rel);
@@ -237456,264 +237797,7 @@ function planFarm(params) {
   return { entries, materialised, links };
 }
 
-// src/resolve/walk.ts
-var import_node_path5 = __toESM(require("node:path"));
-
-// src/resolve/extends.ts
-function lineariseProfile(rootName, load) {
-  const stack = [];
-  const visited = /* @__PURE__ */ new Set();
-  const order = [];
-  const diagnostics = [];
-  const visit = (name) => {
-    if (stack.includes(name)) {
-      diagnostics.push({
-        code: "EXTENDS_CYCLE",
-        severity: "error",
-        message: `Circular profile extends: ${[...stack, name].join(" -> ")}. The cycle is broken here and "${name}" is not applied twice.`,
-        subject: name
-      });
-      return;
-    }
-    if (visited.has(name)) {
-      return;
-    }
-    const source = load(name);
-    if (source === void 0) {
-      diagnostics.push({
-        code: "MISSING_PROFILE",
-        severity: "error",
-        message: `Configuration profile "${name}" does not exist.`,
-        subject: name
-      });
-      visited.add(name);
-      return;
-    }
-    stack.push(name);
-    for (const dependency of source.profile.extends ?? []) {
-      visit(dependency);
-    }
-    stack.pop();
-    visited.add(name);
-    order.push(name);
-  };
-  visit(rootName);
-  return { order, diagnostics };
-}
-function profileLayers(rootName, load, startId) {
-  const { order, diagnostics } = lineariseProfile(rootName, load);
-  const layers = [];
-  let nextId = startId;
-  for (const name of order) {
-    const source = load(name);
-    if (source === void 0) {
-      continue;
-    }
-    layers.push({
-      id: nextId,
-      kind: "config-profile",
-      source: source.filepath ?? name,
-      ...source.profile.categories === void 0 ? {} : { categories: source.profile.categories },
-      ...source.profile.entries === void 0 ? {} : { entries: source.profile.entries },
-      ...source.entryOrder === void 0 ? {} : { entryOrder: source.entryOrder },
-      ...source.profile.launch === void 0 ? {} : { launch: source.profile.launch }
-    });
-    nextId += 1;
-  }
-  return { layers, nextId, diagnostics };
-}
-
-// src/resolve/walk.ts
-function walkDirectoryAncestors(cwd, options) {
-  const limit = import_node_path5.default.resolve(options.limit ?? options.home);
-  const isReadable = options.isReadable ?? (() => true);
-  const collected = [];
-  let current = import_node_path5.default.resolve(cwd);
-  for (; ; ) {
-    if (!isReadable(current)) {
-      break;
-    }
-    collected.push(current);
-    if (current === limit) {
-      break;
-    }
-    const parent = import_node_path5.default.dirname(current);
-    if (parent === current) {
-      break;
-    }
-    current = parent;
-  }
-  return collected.reverse();
-}
-function assembleCascade(input) {
-  const layers = [];
-  const diagnostics = [];
-  let nextId = 0;
-  let identityPin;
-  let directoryConfigProfile;
-  if (input.globalConfig !== void 0) {
-    const { config: config2, entryOrder, filepath } = input.globalConfig;
-    layers.push({
-      id: nextId,
-      kind: "global-config",
-      source: filepath,
-      ...config2.categories === void 0 ? {} : { categories: config2.categories },
-      ...config2.entries === void 0 ? {} : { entries: config2.entries },
-      ...entryOrder === void 0 ? {} : { entryOrder },
-      ...config2.launch === void 0 ? {} : { launch: config2.launch }
-    });
-    nextId += 1;
-  }
-  if (input.baseConfigProfile !== void 0) {
-    const resolved = profileLayers(input.baseConfigProfile, input.loadProfile, nextId);
-    layers.push(...resolved.layers);
-    diagnostics.push(...resolved.diagnostics);
-    nextId = resolved.nextId;
-  }
-  for (const level of input.levels ?? []) {
-    const sources = [];
-    if (level.portable !== void 0) {
-      sources.push({ kind: "portable", config: level.portable.config, ...level.portable.entryOrder === void 0 ? {} : { entryOrder: level.portable.entryOrder }, filepath: level.portable.filepath });
-    }
-    for (const entry of level.rules ?? []) {
-      sources.push({ kind: "directory-rule", config: entry.rule, ...entry.entryOrder === void 0 ? {} : { entryOrder: entry.entryOrder }, filepath: entry.filepath });
-    }
-    if (level.portableLocal !== void 0) {
-      sources.push({ kind: "portable-local", config: level.portableLocal.config, ...level.portableLocal.entryOrder === void 0 ? {} : { entryOrder: level.portableLocal.entryOrder }, filepath: level.portableLocal.filepath });
-    }
-    for (const source of sources) {
-      if (source.config.identity !== void 0) {
-        identityPin = source.config.identity;
-      }
-      if (source.config.configProfile !== void 0) {
-        directoryConfigProfile = source.config.configProfile;
-        const resolved = profileLayers(source.config.configProfile, input.loadProfile, nextId);
-        layers.push(...resolved.layers);
-        diagnostics.push(...resolved.diagnostics);
-        nextId = resolved.nextId;
-      }
-      layers.push({
-        id: nextId,
-        kind: source.kind,
-        source: source.filepath,
-        ...source.config.categories === void 0 ? {} : { categories: source.config.categories },
-        ...source.config.entries === void 0 ? {} : { entries: source.config.entries },
-        ...source.entryOrder === void 0 ? {} : { entryOrder: source.entryOrder },
-        ...source.config.launch === void 0 ? {} : { launch: source.config.launch }
-      });
-      nextId += 1;
-    }
-  }
-  if (input.cliOverride !== void 0) {
-    layers.push({
-      id: nextId,
-      kind: "cli-override",
-      source: "command line",
-      ...input.cliOverride.categories === void 0 ? {} : { categories: input.cliOverride.categories },
-      ...input.cliOverride.entries === void 0 ? {} : { entries: input.cliOverride.entries },
-      ...input.cliOverride.entryOrder === void 0 ? {} : { entryOrder: input.cliOverride.entryOrder },
-      ...input.cliOverride.launch === void 0 ? {} : { launch: input.cliOverride.launch }
-    });
-  }
-  return {
-    layers,
-    diagnostics,
-    ...identityPin === void 0 ? {} : { identityPin },
-    ...directoryConfigProfile === void 0 ? {} : { directoryConfigProfile }
-  };
-}
-
-// src/resolve/reconcile.ts
-function parentOf2(rel) {
-  const index = rel.lastIndexOf("/");
-  return index === -1 ? "" : rel.slice(0, index);
-}
-function indexByParent(listing) {
-  const children = /* @__PURE__ */ new Map();
-  for (const entry of listing) {
-    const parent = parentOf2(entry.rel);
-    const bucket = children.get(parent);
-    if (bucket === void 0) {
-      children.set(parent, [entry]);
-    } else {
-      bucket.push(entry);
-    }
-  }
-  for (const bucket of children.values()) {
-    bucket.sort((a2, b) => a2.rel < b.rel ? -1 : a2.rel > b.rel ? 1 : 0);
-  }
-  return children;
-}
-function planReconciliation(params) {
-  const conservative = params.manifest === void 0;
-  const diagnostics = [];
-  const actions = [];
-  const farmChildren = indexByParent(params.farmListing);
-  const canonicalByRel = new Map(params.canonicalListing.map((entry) => [entry.rel, entry]));
-  const materialised = /* @__PURE__ */ new Set([""]);
-  if (params.manifest !== void 0) {
-    for (const rel of params.manifest.materialised) {
-      materialised.add(rel);
-    }
-  } else {
-    for (const entry of params.farmListing) {
-      if (entry.kind === "dir") {
-        materialised.add(entry.rel);
-      }
-    }
-    diagnostics.push({
-      code: "FARM_MANIFEST_MISSING",
-      severity: "warning",
-      message: "The previous farm's manifest is missing or unreadable, so there is no record of which directories the farm built itself. Every real directory in the farm was treated as materialised and every real child examined for adoption. This over-adopts rather than risking data Claude Code wrote being discarded."
-    });
-  }
-  const visit = (dir) => {
-    for (const child of farmChildren.get(dir) ?? []) {
-      if (child.kind === "symlink") {
-        actions.push({ kind: "skip", rel: child.rel, reason: "is-symlink" });
-        continue;
-      }
-      if (child.kind === "dir" && materialised.has(child.rel)) {
-        actions.push({ kind: "skip", rel: child.rel, reason: "tracked-materialised-dir" });
-        visit(child.rel);
-        continue;
-      }
-      if (child.kind === "dir") {
-        const grandchildren = farmChildren.get(child.rel) ?? [];
-        if (grandchildren.length === 0) {
-          if (canonicalByRel.has(child.rel)) {
-            actions.push({ kind: "skip", rel: child.rel, reason: "identical-content" });
-          } else {
-            actions.push({ kind: "adopt", rel: child.rel, reason: "absent-from-canonical" });
-          }
-          continue;
-        }
-        visit(child.rel);
-        continue;
-      }
-      const canonical = canonicalByRel.get(child.rel);
-      if (canonical === void 0) {
-        actions.push({ kind: "adopt", rel: child.rel, reason: "absent-from-canonical" });
-        continue;
-      }
-      if (canonical.contentHash !== void 0 && canonical.contentHash === child.contentHash) {
-        actions.push({ kind: "skip", rel: child.rel, reason: "identical-content" });
-        continue;
-      }
-      actions.push({ kind: "adopt-conflict", rel: child.rel });
-      diagnostics.push({
-        code: "RECONCILE_CONFLICT",
-        severity: "warning",
-        message: `"${child.rel}" exists both in the farm and in the canonical ~/.claude with different content. The canonical copy is left authoritative and the farm's copy is preserved alongside it rather than either being discarded.`,
-        subject: child.rel
-      });
-    }
-  };
-  visit("");
-  return { actions, diagnostics, conservative };
-}
-
-// src/resolve.ts
+// src/resolve/pipeline.ts
 function topLevelNames(facts) {
   const names = /* @__PURE__ */ new Set();
   for (const rel of facts.entries.keys()) {
@@ -237747,83 +237831,9 @@ function resolveDecisions(input) {
   };
 }
 
-// src/launcher/cascade.ts
-var PORTABLE_CONFIG_FILENAME = ".claude-use.json";
-var PORTABLE_LOCAL_CONFIG_FILENAME = ".claude-use.local.json";
-function loadCascadeInput(params) {
-  const globalConfig2 = loadConfigFile(params.paths.globalConfigFile, GlobalConfigSchema, params.read);
-  const directoryRules = loadConfigFile(params.paths.directoryRulesFile, DirectoryRulesSchema, params.read);
-  const loadProfile = (name) => {
-    const filepath = import_node_path6.default.join(params.paths.configProfilesDir, `${name}.json`);
-    const loaded = loadConfigFile(filepath, ConfigProfileSchema, params.read);
-    if (loaded === void 0) {
-      return void 0;
-    }
-    return { name, profile: loaded.config, entryOrder: loaded.entryOrder, filepath: loaded.filepath };
-  };
-  const limit = globalConfig2?.config.walkUpLimit;
-  const dirs = walkDirectoryAncestors(params.cwd, {
-    home: params.home,
-    ...limit === void 0 ? {} : { limit: expandTilde(limit, params.home) },
-    ...params.isReadable === void 0 ? {} : { isReadable: params.isReadable }
-  });
-  const levels = [];
-  for (const dir of dirs) {
-    const portable = loadConfigFile(import_node_path6.default.join(dir, PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read);
-    const portableLocal = loadConfigFile(import_node_path6.default.join(dir, PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read);
-    const rules = (directoryRules?.config.rules ?? []).map((rule, index) => ({ rule, index })).filter(({ rule }) => normaliseRulePath(rule.path, params.home) === dir).map(({ rule, index }) => {
-      const entryOrder = directoryRules?.ruleEntryOrders[index];
-      return {
-        rule,
-        ...entryOrder === void 0 ? {} : { entryOrder },
-        filepath: params.paths.directoryRulesFile
-      };
-    });
-    if (portable === void 0 && portableLocal === void 0 && rules.length === 0) {
-      continue;
-    }
-    levels.push({
-      dir,
-      ...portable === void 0 ? {} : { portable: { config: portable.config, entryOrder: portable.entryOrder, filepath: portable.filepath } },
-      ...rules.length === 0 ? {} : { rules },
-      ...portableLocal === void 0 ? {} : { portableLocal: { config: portableLocal.config, entryOrder: portableLocal.entryOrder, filepath: portableLocal.filepath } }
-    });
-  }
-  const input = {
-    home: params.home,
-    ...globalConfig2 === void 0 ? {} : { globalConfig: { config: globalConfig2.config, entryOrder: globalConfig2.entryOrder, filepath: globalConfig2.filepath } },
-    ...params.baseConfigProfile === void 0 ? {} : { baseConfigProfile: params.baseConfigProfile },
-    loadProfile,
-    levels,
-    ...params.cliOverride === void 0 ? {} : { cliOverride: params.cliOverride }
-  };
-  return { input, ...globalConfig2 === void 0 ? {} : { globalConfig: globalConfig2.config } };
-}
-function readDirectorySelections(loaded) {
-  let identity;
-  let configProfile;
-  for (const level of loaded.input.levels ?? []) {
-    for (const source of [level.portable?.config, ...(level.rules ?? []).map((entry) => entry.rule), level.portableLocal?.config]) {
-      if (source === void 0) {
-        continue;
-      }
-      if (source.identity !== void 0) {
-        identity = source.identity;
-      }
-      if (source.configProfile !== void 0) {
-        configProfile = source.configProfile;
-      }
-    }
-  }
-  return { ...identity === void 0 ? {} : { identity }, ...configProfile === void 0 ? {} : { configProfile } };
-}
-
-// src/launcher/farm.ts
-var import_node_path8 = __toESM(require("node:path"));
-
 // src/launcher/lock.ts
 var import_node_crypto2 = require("node:crypto");
-var import_node_path7 = __toESM(require("node:path"));
+var import_node_path7 = __toESM(require("node:path"), 1);
 var DEFAULT_STALE_AFTER_MS = 12e4;
 var DEFAULT_RETRY_DELAY_MS = 50;
 var DEFAULT_MAX_ATTEMPTS = 200;
@@ -238403,7 +238413,7 @@ function evaluateAmbientCredentialGuard(params) {
 }
 
 // src/launcher/identity.ts
-var import_node_path9 = __toESM(require("node:path"));
+var import_node_path9 = __toESM(require("node:path"), 1);
 function isNonEmpty(value) {
   return value !== void 0 && value !== "";
 }
@@ -238449,8 +238459,8 @@ function loadIdentity(identitiesDir, name, fs9) {
 }
 
 // src/paths.ts
-var import_node_os = __toESM(require("node:os"));
-var import_node_path10 = __toESM(require("node:path"));
+var import_node_os = __toESM(require("node:os"), 1);
+var import_node_path10 = __toESM(require("node:path"), 1);
 function resolveClaudeUseHome() {
   const fromEnv = process.env.CLAUDE_USE_HOME;
   if (fromEnv !== void 0 && fromEnv !== "") {
@@ -238484,13 +238494,13 @@ function resolveLayoutPaths() {
 // src/realPorts.ts
 var import_node_child_process2 = require("node:child_process");
 var import_node_crypto3 = require("node:crypto");
-var import_node_fs3 = __toESM(require("node:fs"));
-var import_node_path12 = __toESM(require("node:path"));
+var import_node_fs3 = __toESM(require("node:fs"), 1);
+var import_node_path12 = __toESM(require("node:path"), 1);
 var import_node_sea = require("node:sea");
 
 // src/versionDiscovery.ts
-var import_node_os2 = __toESM(require("node:os"));
-var import_node_path11 = __toESM(require("node:path"));
+var import_node_os2 = __toESM(require("node:os"), 1);
+var import_node_path11 = __toESM(require("node:path"), 1);
 function defaultVersionsDir() {
   return import_node_path11.default.join(import_node_os2.default.homedir(), ".local", "share", "claude", "versions");
 }
@@ -239089,9 +239099,9 @@ function registerCheckCommand(program2, paths) {
 }
 
 // src/configure.ts
-var import_node_fs6 = __toESM(require("node:fs"));
-var import_node_os4 = __toESM(require("node:os"));
-var import_node_path16 = __toESM(require("node:path"));
+var import_node_fs6 = __toESM(require("node:fs"), 1);
+var import_node_os4 = __toESM(require("node:os"), 1);
+var import_node_path16 = __toESM(require("node:path"), 1);
 
 // node_modules/.pnpm/@clack+core@1.4.3/node_modules/@clack/core/dist/index.mjs
 var import_node_process2 = require("node:process");
@@ -240135,8 +240145,8 @@ ${b}
 var i = `${(0, import_node_util3.styleText)("gray", S_BAR)}  `;
 
 // src/identityManager.ts
-var import_node_fs4 = __toESM(require("node:fs"));
-var import_node_path14 = __toESM(require("node:path"));
+var import_node_fs4 = __toESM(require("node:fs"), 1);
+var import_node_path14 = __toESM(require("node:path"), 1);
 var IdentityNotFoundError = class extends Error {
   constructor(name) {
     super(`No identity named "${name}" \u2014 run \`claude-use identity add ${name}\` first.`);
@@ -240255,8 +240265,8 @@ function registerIdentityCommand(program2, paths) {
 }
 
 // src/configProfiles.ts
-var import_node_fs5 = __toESM(require("node:fs"));
-var import_node_path15 = __toESM(require("node:path"));
+var import_node_fs5 = __toESM(require("node:fs"), 1);
+var import_node_path15 = __toESM(require("node:path"), 1);
 
 // src/cli/parsers.ts
 function splitTopLevelCommas(input) {
@@ -240791,11 +240801,10 @@ async function runProfileDirectMode(context) {
     deps.prompts.cancel("Cancelled.");
     return;
   }
-  const profileName = chosen;
-  const profile = readProfile(deps.paths, profileName) ?? {};
+  const profile = readProfile(deps.paths, chosen) ?? {};
   const current = resolveCategoryState((name) => profile.categories?.[name]);
   const selected = await deps.prompts.multiselect({
-    message: `Which categories should configuration profile "${profileName}" share?`,
+    message: `Which categories should configuration profile "${chosen}" share?`,
     options: OVERRIDABLE_CATEGORIES.map((name) => ({
       value: name,
       label: CATEGORY_LABELS[name],
@@ -240818,8 +240827,8 @@ async function runProfileDirectMode(context) {
     deps.log.info("No changes.");
     return;
   }
-  setProfileCategories(deps.paths, profileName, patch);
-  deps.log.info(`Updated configuration profile "${profileName}".`);
+  setProfileCategories(deps.paths, chosen, patch);
+  deps.log.info(`Updated configuration profile "${chosen}".`);
 }
 async function runCategoriesMode(context) {
   const { deps } = context;
@@ -240931,8 +240940,8 @@ function registerConfigureCommand(program2, paths) {
 }
 
 // src/claudeShim.ts
-var import_node_fs7 = __toESM(require("node:fs"));
-var import_node_path17 = __toESM(require("node:path"));
+var import_node_fs7 = __toESM(require("node:fs"), 1);
+var import_node_path17 = __toESM(require("node:path"), 1);
 var ClaudeShimStateSchema = external_exports.strictObject({
   targetPath: external_exports.string().min(1),
   method: external_exports.enum(["hardlink", "copy"]),
@@ -241107,8 +241116,8 @@ function registerShimCommand(program2, paths) {
 }
 
 // src/doctor.ts
-var import_node_fs8 = __toESM(require("node:fs"));
-var import_node_path18 = __toESM(require("node:path"));
+var import_node_fs8 = __toESM(require("node:fs"), 1);
+var import_node_path18 = __toESM(require("node:path"), 1);
 function validateJson(schema, input) {
   if (input.raw === void 0) {
     return { ok: false, message: `${input.path} is missing.` };
@@ -241501,7 +241510,7 @@ function buildCliOverride(params) {
 }
 
 // src/launcher/flags.ts
-var import_node_path19 = __toESM(require("node:path"));
+var import_node_path19 = __toESM(require("node:path"), 1);
 function isEnvFlagSet(value) {
   return value === "1";
 }
@@ -241547,7 +241556,7 @@ function splitExtraFlags(value) {
 }
 
 // src/launcher/spawn.ts
-var import_node_os5 = __toESM(require("node:os"));
+var import_node_os5 = __toESM(require("node:os"), 1);
 function exitCodeFor(result) {
   if (result.status !== null) {
     return result.status;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-use",
-  "version": "0.3.3",
+  "version": "0.3.6",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "Apache-2.0",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",
@@ -16,7 +16,7 @@
     "cli"
   ],
   "packageManager": "pnpm@11.6.0",
-  "type": "commonjs",
+  "type": "module",
   "engines": {
     "node": ">=22.12.0"
   },
@@ -28,10 +28,18 @@
   ],
   "scripts": {
     "prepare": "husky",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint . --max-warnings 0",
-    "test": "vitest run",
-    "build": "node scripts/build.mts",
+    "typecheck": "turbo run _typecheck",
+    "_typecheck": "tsc --noEmit",
+    "lint": "turbo run _lint",
+    "_lint": "eslint . --cache --cache-location .eslintcache --max-warnings 0",
+    "test": "turbo run _test",
+    "_test": "vitest run",
+    "test:coverage": "turbo run _test:coverage",
+    "_test:coverage": "vitest run --coverage",
+    "knip": "turbo run _knip",
+    "_knip": "knip --cache",
+    "build": "turbo run _build",
+    "_build": "node scripts/build.mts",
     "build:bundle": "node scripts/build.mts --bundle-only",
     "prepublishOnly": "pnpm build:bundle",
     "schema": "node scripts/gen-schema.mts"
@@ -48,19 +56,21 @@
     "@commitlint/config-conventional": "^21.2.0",
     "@eslint/js": "^10.0.1",
     "@semantic-release/changelog": "^7.0.0",
-    "@semantic-release/exec": "^7.1.0",
     "@semantic-release/git": "^11.0.1",
     "@semantic-release/npm": "^13.1.5",
     "@types/node": "^26.1.2",
     "@types/picomatch": "^4.0.3",
+    "@vitest/coverage-v8": "^4.1.10",
     "conventional-changelog-conventionalcommits": "^10.2.1",
     "esbuild": "^0.28.1",
     "eslint": "^10.8.0",
     "globals": "^17.8.0",
     "husky": "^9.1.7",
     "jiti": "^2.7.0",
+    "knip": "^6.31.0",
     "lint-staged": "^17.3.0",
     "semantic-release": "^25.0.8",
+    "turbo": "^2.10.8",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.65.0",
     "vitest": "^4.1.10"