cue-ai 0.9.2 → 0.9.3

package/src/lib/companion-detect.ts

@@ -16,6 +16,8 @@
 import { readdirSync } from "node:fs";
 import { basename, extname } from "node:path";
 
+import { DEP_PROFILE_RULES, type DetectionResultV2 } from "./auto-detect";
+
 export interface CompanionSignal {
   /** Companion profile to surface in the combine multiselect. */
   profile: string;
@@ -138,3 +140,36 @@ export function detectCompanions(input: CompanionDetectInput): CompanionSignal[]
     }))
     .sort((a, b) => b.confidence - a.confidence || a.profile.localeCompare(b.profile));
 }
+
+/**
+ * Floor applied to dep-detected service companions. In the *main picker* a
+ * service dep deliberately sits below the auto-pick line (it must never
+ * hijack Enter), but in the combine multiselect a direct package.json
+ * dependency is a strong "you'll want this alongside" signal — and a
+ * pre-checked row costs one keystroke to drop. 0.75 clears the picker's
+ * COMBINE_AUTO_CHECK_CONFIDENCE (0.7) so these rows start checked.
+ */
+const SERVICE_COMPANION_CONF = 0.75;
+
+/**
+ * Convert dep-based profile detections (see `DEP_PROFILE_RULES`) into combine
+ * companions: a repo with `stripe` in package.json gets the stripe profile
+ * offered — pre-checked — when the user picks any primary. Only rules marked
+ * `companion: true` qualify (primary stacks like react-native are excluded),
+ * and only profiles installed in this cue install survive.
+ */
+export function serviceCompanions(
+  detections: ReadonlyArray<DetectionResultV2>,
+  knownProfiles: ReadonlySet<string>,
+): CompanionSignal[] {
+  const eligible = new Set(
+    DEP_PROFILE_RULES.filter((r) => r.companion === true).map((r) => r.profile),
+  );
+  return detections
+    .filter((d) => eligible.has(d.profile) && knownProfiles.has(d.profile))
+    .map((d) => ({
+      profile: d.profile,
+      confidence: Math.max(d.confidence, SERVICE_COMPANION_CONF),
+      reason: d.reasons.join(", "),
+    }));
+}

package/src/lib/credentials-sync.test.ts

@@ -3,7 +3,7 @@ import { mkdtemp, mkdir, writeFile, readFile, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
-import { findFreshestCredentials, syncFreshestToSource } from "./credentials-sync";
+import { findFreshestCredentials, listKnownAccountDirs, rescueRuntimeCredentials, syncFreshestToSource } from "./credentials-sync";
 
 let root: string;
 beforeEach(async () => { root = await mkdtemp(join(tmpdir(), "cue-credsync-")); });
@@ -206,3 +206,123 @@ describe("syncFreshestToSource", () => {
     expect(after.claudeAiOauth.refreshToken).toBe("rt-A");
   });
 });
+
+describe("rescueRuntimeCredentials", () => {
+  test("rescues fresher runtime creds to the account dir owning the uuid", async () => {
+    // The user's bug in miniature: account2 logged in inside the shared
+    // runtime (fresh token lives ONLY there), account2's own dir holds the
+    // dead rotated token. Rescue must return the fresh token home before the
+    // identity guard wipes the runtime for the other account.
+    const account1 = join(root, "accounts", "account1");
+    const account2 = join(root, "accounts", "account2");
+    await writeAccountDir(account1, UUID_A, { refreshToken: "rt-a1", expiresAt: 5000 });
+    await writeAccountDir(account2, UUID_B, { refreshToken: "rt-a2-dead", expiresAt: 1000 });
+
+    const runtimeDir = join(root, "runtime", "core", "claude");
+    await writeAccountDir(runtimeDir, UUID_B, { refreshToken: "rt-a2-fresh", expiresAt: 9999 });
+
+    const result = await rescueRuntimeCredentials(runtimeDir, [account1, account2]);
+    expect(result.rescued).toBe(true);
+    if (result.rescued) expect(result.to).toBe(join(account2, ".credentials.json"));
+
+    const after = JSON.parse(await readFile(join(account2, ".credentials.json"), "utf8"));
+    expect(after.claudeAiOauth.refreshToken).toBe("rt-a2-fresh");
+    // The other account's dir is untouched.
+    const other = JSON.parse(await readFile(join(account1, ".credentials.json"), "utf8"));
+    expect(other.claudeAiOauth.refreshToken).toBe("rt-a1");
+  });
+
+  test("skips when the owner already holds creds as fresh or fresher", async () => {
+    const account = join(root, "accounts", "account2");
+    await writeAccountDir(account, UUID_B, { refreshToken: "rt-owner", expiresAt: 9999 });
+
+    const runtimeDir = join(root, "runtime", "core", "claude");
+    await writeAccountDir(runtimeDir, UUID_B, { refreshToken: "rt-runtime", expiresAt: 9999 });
+
+    const result = await rescueRuntimeCredentials(runtimeDir, [account]);
+    expect(result.rescued).toBe(false);
+    const after = JSON.parse(await readFile(join(account, ".credentials.json"), "utf8"));
+    expect(after.claudeAiOauth.refreshToken).toBe("rt-owner");
+    // The runtime copy must be left untouched too.
+    const runtimeAfter = JSON.parse(await readFile(join(runtimeDir, ".credentials.json"), "utf8"));
+    expect(runtimeAfter.claudeAiOauth.refreshToken).toBe("rt-runtime");
+  });
+
+  test("heals EVERY dir claiming the uuid, not just the first match", async () => {
+    // ~/.claude and an authmux account dir can both hold the same account.
+    const homeClaude = join(root, ".claude");
+    const accountDir = join(root, "accounts", "account2");
+    await writeAccountDir(homeClaude, UUID_B, { refreshToken: "rt-home-dead", expiresAt: 1000 });
+    await writeAccountDir(accountDir, UUID_B, { refreshToken: "rt-acct-dead", expiresAt: 2000 });
+
+    const runtimeDir = join(root, "runtime", "core", "claude");
+    await writeAccountDir(runtimeDir, UUID_B, { refreshToken: "rt-fresh", expiresAt: 9999 });
+
+    const result = await rescueRuntimeCredentials(runtimeDir, [homeClaude, accountDir]);
+    expect(result.rescued).toBe(true);
+
+    for (const dir of [homeClaude, accountDir]) {
+      const after = JSON.parse(await readFile(join(dir, ".credentials.json"), "utf8"));
+      expect(after.claudeAiOauth.refreshToken).toBe("rt-fresh");
+    }
+  });
+
+  test("skips when no account dir matches the runtime's uuid", async () => {
+    const account = join(root, "accounts", "account1");
+    await writeAccountDir(account, UUID_A, { refreshToken: "rt-a1", expiresAt: 1000 });
+
+    const runtimeDir = join(root, "runtime", "core", "claude");
+    await writeAccountDir(runtimeDir, UUID_B, { refreshToken: "rt-b", expiresAt: 9999 });
+
+    const result = await rescueRuntimeCredentials(runtimeDir, [account]);
+    expect(result.rescued).toBe(false);
+    const after = JSON.parse(await readFile(join(account, ".credentials.json"), "utf8"));
+    expect(after.claudeAiOauth.refreshToken).toBe("rt-a1");
+  });
+
+  test("skips when the runtime has no readable accountUuid", async () => {
+    const account = join(root, "accounts", "account1");
+    await writeAccountDir(account, UUID_A, { refreshToken: "rt-a1", expiresAt: 1000 });
+
+    // Credentials without a .claude.json — owner unknowable, must not guess.
+    const runtimeDir = join(root, "runtime", "core", "claude");
+    await writeAccountDir(runtimeDir, undefined, { refreshToken: "rt-mystery", expiresAt: 9999 });
+
+    const result = await rescueRuntimeCredentials(runtimeDir, [account]);
+    expect(result.rescued).toBe(false);
+  });
+
+  test("writes to an owner dir that has identity but no credentials yet", async () => {
+    const account = join(root, "accounts", "account2");
+    await writeAccountDir(account, UUID_B, undefined);
+
+    const runtimeDir = join(root, "runtime", "core", "claude");
+    await writeAccountDir(runtimeDir, UUID_B, { refreshToken: "rt-fresh", expiresAt: 9999 });
+
+    const result = await rescueRuntimeCredentials(runtimeDir, [account]);
+    expect(result.rescued).toBe(true);
+    const after = JSON.parse(await readFile(join(account, ".credentials.json"), "utf8"));
+    expect(after.claudeAiOauth.refreshToken).toBe("rt-fresh");
+  });
+});
+
+describe("listKnownAccountDirs", () => {
+  test("returns ~/.claude plus every ~/.claude-accounts/<name> directory", async () => {
+    await mkdir(join(root, ".claude"), { recursive: true });
+    await mkdir(join(root, ".claude-accounts", "account1"), { recursive: true });
+    await mkdir(join(root, ".claude-accounts", "account2"), { recursive: true });
+    // A stray file must not be listed.
+    await writeFile(join(root, ".claude-accounts", "notes.txt"), "x");
+
+    const dirs = await listKnownAccountDirs(root);
+    expect(dirs).toContain(join(root, ".claude"));
+    expect(dirs).toContain(join(root, ".claude-accounts", "account1"));
+    expect(dirs).toContain(join(root, ".claude-accounts", "account2"));
+    expect(dirs).not.toContain(join(root, ".claude-accounts", "notes.txt"));
+  });
+
+  test("works when ~/.claude-accounts does not exist", async () => {
+    const dirs = await listKnownAccountDirs(root);
+    expect(dirs).toEqual([join(root, ".claude")]);
+  });
+});

package/src/lib/credentials-sync.ts

@@ -24,7 +24,7 @@
  * touching `~/`.
  */
 
-import { readFile, readdir, copyFile, stat } from "node:fs/promises";
+import { readFile, readdir, copyFile, rename, rm, stat } from "node:fs/promises";
 import { join } from "node:path";
 
 interface CredentialsBlob {
@@ -203,3 +203,97 @@ export async function syncFreshestToSource(
     return { synced: false };
   }
 }
+
+/**
+ * Known Claude account dirs a runtime's credentials could belong to:
+ * `~/.claude` plus every `~/.claude-accounts/<name>` (authmux's parallel
+ * account convention — the CLAUDE_CONFIG_DIRs its claude-<name> aliases set).
+ */
+export async function listKnownAccountDirs(homeDir: string): Promise<string[]> {
+  const dirs = [join(homeDir, ".claude")];
+  const parallelRoot = join(homeDir, ".claude-accounts");
+  try {
+    for (const name of await readdir(parallelRoot)) {
+      const p = join(parallelRoot, name);
+      try {
+        if ((await stat(p)).isDirectory()) dirs.push(p);
+      } catch { /* unreadable entry — skip */ }
+    }
+  } catch { /* no parallel accounts */ }
+  return dirs;
+}
+
+/**
+ * Write a runtime's login-fresh credentials back to the account dir that
+ * OWNS them (matched by accountUuid).
+ *
+ * Why this exists: `/login` inside a cue-launched session writes tokens into
+ * the per-PROFILE runtime dir, not the account's CLAUDE_CONFIG_DIR. The heal
+ * in `syncFreshestToSource` only runs at the next launch *of that same
+ * account* — but runtimes are shared per profile, so when a DIFFERENT
+ * account launches the profile first, the account-identity guard discards
+ * the runtime's `.claude.json`/`.credentials.json`. Anthropic rotates the
+ * refresh token on every refresh, so that discarded copy was the only live
+ * token for the account: its source still holds a dead one → forced re-login
+ * every time two accounts alternate on one profile. Calling this before
+ * materialization (and after the session exits) returns the tokens home
+ * before they can be destroyed.
+ *
+ * Strictness rules mirror `syncFreshestToSource`:
+ *   - runtime must have a readable accountUuid and non-empty refreshToken
+ *   - the owner dir's uuid must match exactly
+ *   - copy only when the runtime's expiresAt is *strictly* newer
+ *   - copy is tmp + atomic rename so a concurrent reader never sees a
+ *     partial file
+ */
+export async function rescueRuntimeCredentials(
+  runtimeClaudeDir: string,
+  accountDirs: string[],
+): Promise<{ rescued: false } | { rescued: true; to: string; expiresAt: number }> {
+  const cand = await readCredentials(runtimeClaudeDir);
+  if (!cand || !cand.accountUuid || cand.refreshToken.trim().length === 0) return { rescued: false };
+
+  const readOwnerExpiresAt = async (dir: string): Promise<number> => {
+    try {
+      const raw = await readFile(join(dir, ".credentials.json"), "utf8");
+      const parsed = JSON.parse(raw) as CredentialsBlob;
+      return parsed?.claudeAiOauth?.expiresAt ?? 0;
+    } catch {
+      return 0; // missing/corrupt — anything is better
+    }
+  };
+
+  // Heal EVERY dir claiming this uuid, not just the first match — `~/.claude`
+  // and an authmux account dir can both hold the same account, and stopping
+  // at the first would leave the other with a dead rotated token.
+  const rescuedTo: string[] = [];
+  for (const dir of accountDirs) {
+    const ownerUuid = await readAccountUuid(dir);
+    if (ownerUuid !== cand.accountUuid) continue;
+    if (cand.expiresAt <= await readOwnerExpiresAt(dir)) continue;
+
+    const dest = join(dir, ".credentials.json");
+    try {
+      // tmp lives next to dest so the rename is same-device atomic; the
+      // cross-device step (runtime → account dir) is the copyFile into tmp,
+      // which a concurrent reader never sees.
+      const tmp = `${dest}.cue-rescue.${process.pid}`;
+      await copyFile(cand.path, tmp);
+      // Re-check freshness right before the swap: the owning account may have
+      // a LIVE session rotating tokens concurrently. A fresher token landing
+      // between the check above and this rename must win. (A write inside
+      // this final window can still lose — Claude Code's own writes are
+      // atomic renames too, so the loser is a whole consistent file, and the
+      // next launch's heal repairs it.)
+      if (cand.expiresAt <= await readOwnerExpiresAt(dir)) {
+        await rm(tmp, { force: true });
+        continue;
+      }
+      await rename(tmp, dest);
+      rescuedTo.push(dest);
+    } catch { /* best-effort per dir — keep trying the others */ }
+  }
+
+  if (rescuedTo.length === 0) return { rescued: false };
+  return { rescued: true, to: rescuedTo.join(", "), expiresAt: cand.expiresAt };
+}

package/src/lib/cwd-resolver.test.ts

@@ -23,18 +23,18 @@ describe("resolveProfileForCwd", () => {
     expect(out).toEqual({ source: "none" });
   });
 
-  test("reads .cue-profile in cwd", async () => {
-    await writeFile(join(root, ".cue-profile"), "frontend\n");
+  test("reads .cue.profile in cwd", async () => {
+    await writeFile(join(root, ".cue.profile"), "frontend\n");
     const out = await resolveProfileForCwd({
       cwd: root,
       homeDir: root,
       configDir: join(root, ".config", "cue"),
     });
-    expect(out).toEqual({ source: "pin-file", profile: "frontend", pinPath: join(root, ".cue-profile") });
+    expect(out).toEqual({ source: "pin-file", profile: "frontend", pinPath: join(root, ".cue.profile") });
   });
 
-  test("walks up to find .cue-profile", async () => {
-    await writeFile(join(root, ".cue-profile"), "backend\n");
+  test("walks up to find .cue.profile", async () => {
+    await writeFile(join(root, ".cue.profile"), "backend\n");
     const child = join(root, "a", "b", "c");
     await mkdir(child, { recursive: true });
     const out = await resolveProfileForCwd({
@@ -42,11 +42,11 @@ describe("resolveProfileForCwd", () => {
       homeDir: root,
       configDir: join(root, ".config", "cue"),
     });
-    expect(out).toEqual({ source: "pin-file", profile: "backend", pinPath: join(root, ".cue-profile") });
+    expect(out).toEqual({ source: "pin-file", profile: "backend", pinPath: join(root, ".cue.profile") });
   });
 
   test("stops walking at homeDir", async () => {
-    await writeFile(join(root, ".cue-profile"), "should-not-find");
+    await writeFile(join(root, ".cue.profile"), "should-not-find");
     const home = join(root, "home");
     const child = join(home, "user");
     await mkdir(child, { recursive: true });
@@ -100,7 +100,7 @@ describe("resolveProfileForCwd", () => {
   });
 
   test("--cue-profile flag (passed via override) wins over everything", async () => {
-    await writeFile(join(root, ".cue-profile"), "frontend");
+    await writeFile(join(root, ".cue.profile"), "frontend");
     const out = await resolveProfileForCwd({
       cwd: root,
       homeDir: root,

package/src/lib/cwd-resolver.ts

@@ -3,7 +3,7 @@
  *
  * Resolution precedence (stop at first hit):
  *   1. `opts.override` (matches the --cue-profile CLI flag)
- *   2. `.cue-profile` file walking up from cwd; stops at git repo root or homeDir
+ *   2. `.cue.profile` file walking up from cwd; stops at git repo root or homeDir
  *   3. `<configDir>/repo-defaults.json` keyed by git repo root absolute path
  *   4. `<configDir>/default-profile` (composition list: one profile per line
  *      and/or `+`-joined; composed into a `core+...` selector)
@@ -81,7 +81,7 @@ async function findGitRoot(startDir: string, stopAt: string): Promise<string | n
 export async function resolveProfileForCwd(opts: ResolveOptions): Promise<ResolveResult> {
   if (opts.override) return { source: "flag", profile: opts.override };
 
-  const pinPath = await findUpward(opts.cwd, ".cue-profile", opts.homeDir);
+  const pinPath = await findUpward(opts.cwd, ".cue.profile", opts.homeDir);
   if (pinPath) {
     const profile = (await readFile(pinPath, "utf8")).trim();
     if (profile) return { source: "pin-file", profile, pinPath };

package/src/lib/dashboard-merge.test.ts

@@ -12,17 +12,22 @@ import { fileURLToPath } from "node:url";
 
 import { createHandler } from "./dashboard-server";
 
+const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const TEST_PROFILE = "dash-merge-test";
+const TEST_DIR = join(REPO_ROOT, "profiles", TEST_PROFILE);
+
 // Sibling test files set CUE_PROFILES_DIR / SOUL_PROFILES_DIR to a temp dir;
 // clear any leak so the dashboard resolves the repo's real profiles/ tree.
+// Also clean a leftover TEST_DIR up front: the save test expects a clean slate
+// (first save → created), so a dir left behind by an interrupted prior run
+// would make the first save return 400 "already exists" and fail. afterAll
+// alone doesn't cover that — a crashed run never reaches it. (race fix)
 beforeEach(() => {
   delete process.env.CUE_PROFILES_DIR;
   delete process.env.SOUL_PROFILES_DIR;
+  rmSync(TEST_DIR, { recursive: true, force: true });
 });
 
-const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
-const TEST_PROFILE = "dash-merge-test";
-const TEST_DIR = join(REPO_ROOT, "profiles", TEST_PROFILE);
-
 function post(path: string, body: unknown): Promise<Response> {
   const handler = createHandler();
   return handler(new Request(`http://x${path}`, {

package/src/lib/dashboard-server.ts

@@ -61,7 +61,7 @@ export type ApiResult<T> = { ok: true; data: T } | { ok: false; error: string };
  */
 function resolveProfileQuery(explicit: string | null): string | null {
   if (explicit) return explicit;
-  const pin = join(process.cwd(), ".cue-profile");
+  const pin = join(process.cwd(), ".cue.profile");
   if (existsSync(pin)) {
     try {
       const txt = readFileSync(pin, "utf8").trim().split("\n")[0]?.trim();

package/src/lib/picker.test.ts

@@ -295,7 +295,7 @@ describe("buildCompanionOptions", () => {
     const full = buildConflictMap([...companionOptions, ...overflowOptions]);
     expect(resolveConflicts(["medusa-next", "medusa-vite"], full)).toEqual(["medusa-next"]);
     // Regression guard: the old curated-only map (the CRITICAL bug) let BOTH survive
-    // into the written .cue-profile while the live UI showed the conflict blocked.
+    // into the written .cue.profile while the live UI showed the conflict blocked.
     const stale = buildConflictMap(companionOptions);
     expect(resolveConflicts(["medusa-next", "medusa-vite"], stale)).toEqual([
       "medusa-next",

package/src/lib/picker.ts

@@ -5,7 +5,7 @@
  *   - renderProfileList(): pure formatter (testable)
  *   - runPicker(): interactive TUI driven by @clack/prompts; opens stdin/stdout
  *
- * Picker writes the chosen profile to ./.cue-profile unless --no-pin is passed.
+ * Picker writes the chosen profile to ./.cue.profile unless --no-pin is passed.
  * Cancel (esc / Ctrl-C) → exit code 130 (caller handles).
  */
 
@@ -80,7 +80,7 @@ export function renderProfileList(opts: PickerOption[], render: RenderOptions):
 export interface PickerInput {
   cwd: string;
   options: PickerOption[];
-  /** Skip writing .cue-profile if true. */
+  /** Skip writing .cue.profile if true. */
   noPin?: boolean;
   /**
    * Optional hook invoked after the user picks a profile (and pin confirm),
@@ -701,7 +701,7 @@ export function compressCombo(parts: string[], max = 3): string {
  * Control sentinels (SHOW_ALL / SKIP_COMBINE) are dropped here as a write-
  * boundary backstop: the upstream filters (asciiMultiselect strips SHOW_ALL,
  * runPicker guards on SKIP_COMBINE) are the primary defense, but this is the
- * last transform before the selector is joined and persisted to .cue-profile,
+ * last transform before the selector is joined and persisted to .cue.profile,
  * so a sentinel must never survive it even if an upstream path regresses.
  */
 const CONTROL_SENTINELS = new Set<string>([SHOW_ALL, SKIP_COMBINE]);
@@ -1050,7 +1050,7 @@ async function asciiMultiselect(opts: {
   // after "show all" is revealed. resolveConflicts acts only on values actually
   // selected, so seeding the map with not-yet-revealed options is harmless — and
   // skipping them is the CRITICAL bug where medusa-vite + medusa-next both
-  // survive into the written .cue-profile.
+  // survive into the written .cue.profile.
   const conflictMap = buildConflictMap([
     ...opts.options,
     ...(opts.overflow?.options ?? []),
@@ -1484,7 +1484,7 @@ export async function runPicker(input: PickerInput): Promise<PickerOutput> {
       process.exit(130);
     }
     if (pinChoice === true) {
-      await writeFile(join(input.cwd, ".cue-profile"), `${choice}\n`);
+      await writeFile(join(input.cwd, ".cue.profile"), `${choice}\n`);
       pinned = true;
     }
   }

package/src/lib/profile-merge.test.ts

@@ -44,6 +44,14 @@ describe("mergeProfiles", () => {
     expect(p.skills.some((id) => id.startsWith("design/"))).toBe(true);
   });
 
+  test("core pins subagents to Sonnet (cost-knob regression guard)", async () => {
+    // A future core edit must not silently drop this — it fans out to every
+    // inheriting profile and is the one automatic Opus→Sonnet lever. Surfaced
+    // into settings.json `env` by buildClaudeSettings (runtime-materializer).
+    const core = await loadProfile("core");
+    expect(core.env.CLAUDE_CODE_SUBAGENT_MODEL).toBe("claude-sonnet-4-6");
+  });
+
   test("skill conflicts are deduped to unique pairs (not per-directive)", async () => {
     const p = await mergeProfiles(["medusa-dev", "designer"]);
     const keys = p.skillConflicts.map((c) => [c.skillA, c.skillB].sort().join("|") + c.domain);

package/src/lib/profile-names.test.ts

@@ -14,7 +14,7 @@ import { describe, expect, test } from "bun:test";
 import { readdirSync, existsSync } from "node:fs";
 import { join, resolve } from "node:path";
 
-import { SIGNALS } from "./auto-detect";
+import { DEP_PROFILE_RULES } from "./auto-detect";
 import { STACK_PROFILES, PROFILE_KEYWORDS as DISCOVER_KEYWORDS } from "../commands/discover";
 import { PROFILE_KEYWORDS as AI_KEYWORDS } from "../commands/ai";
 
@@ -36,8 +36,8 @@ describe("profile-name references resolve to real profiles", () => {
     expect(real.size).toBeGreaterThan(10);
   });
 
-  test("auto-detect SIGNALS reference only real profiles", () => {
-    const missing = [...new Set(SIGNALS.map((s) => s.profile))].filter((p) => !real.has(p));
+  test("auto-detect DEP_PROFILE_RULES reference only real profiles", () => {
+    const missing = [...new Set(DEP_PROFILE_RULES.map((r) => r.profile))].filter((p) => !real.has(p));
     expect(missing).toEqual([]);
   });
 

package/src/lib/runtime-install.ts

@@ -0,0 +1,166 @@
+/**
+ * Shared profile-runtime preparation helpers.
+ *
+ * `launch` and `install` both need the same boring setup: wildcard expansion,
+ * MCP registry loading, user memory reads, and the materializeRuntime call.
+ * Keeping it here avoids the installer drifting from the hot launch path.
+ */
+
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { homedir } from "node:os";
+
+import type { AgentKind, ResolvedProfile } from "../../profiles/_types";
+import { configDir } from "./config-paths";
+import { debug } from "./debug-log";
+import { listAllSkillIds, resolveLocalSkill } from "./resolver-local";
+import { materializeRuntime, type McpServerConfig, type MaterializeOutput } from "./runtime-materializer";
+
+export type RuntimeAgent = Extract<AgentKind, "claude-code" | "codex">;
+
+export const RUNTIME_AGENTS: RuntimeAgent[] = ["claude-code", "codex"];
+
+export function isRuntimeAgent(agent: AgentKind | string): agent is RuntimeAgent {
+  return agent === "claude-code" || agent === "codex";
+}
+
+export function runtimeAgentSubdir(agent: RuntimeAgent): "claude" | "codex" {
+  return agent === "claude-code" ? "claude" : "codex";
+}
+
+export function runtimeDirFor(profileName: string, agent: RuntimeAgent, runtimeRoot = join(configDir(), "runtime")): string {
+  return join(runtimeRoot, profileName, runtimeAgentSubdir(agent));
+}
+
+export async function expandSkillWildcards(profile: ResolvedProfile): Promise<void> {
+  if (!profile.skills.local.some((s) => s.id === "*/*")) return;
+  const allIds = await listAllSkillIds();
+  const wildcard = profile.skills.local.find((s) => s.id === "*/*")!;
+  const existing = new Set(profile.skills.local.filter((s) => s.id !== "*/*").map((s) => s.id));
+  profile.skills.local = [
+    ...profile.skills.local.filter((s) => s.id !== "*/*"),
+    ...allIds.filter((id) => !existing.has(id)).map((id) => ({ ...wildcard, id })),
+  ];
+}
+
+export async function loadMcpRegistry(agent: RuntimeAgent): Promise<Record<string, McpServerConfig>> {
+  const root = process.env.CUE_REPO_ROOT ?? process.env.SOUL_REPO_ROOT ?? resolve(import.meta.dirname, "..", "..");
+  const files = agent === "claude-code"
+    ? ["claude_runtime.sanitized.json", "claude.sanitized.json"]
+    : ["codex.sanitized.json"];
+
+  const merged: Record<string, McpServerConfig> = {};
+  for (const file of files) {
+    try {
+      const text = await readFile(join(root, "resources", "mcps", "configs", file), "utf8");
+      const raw = JSON.parse(text) as { servers?: Record<string, McpServerConfig> };
+      for (const [id, config] of Object.entries(raw.servers ?? {})) {
+        if (!(id in merged)) merged[id] = config;
+      }
+    } catch {
+      // Missing registries are tolerated; validate/doctor report broken refs.
+    }
+  }
+
+  // The curated master registry wins over the runtime snapshot.
+  const master = agent === "claude-code" ? "claude.sanitized.json" : "codex.sanitized.json";
+  try {
+    const text = await readFile(join(root, "resources", "mcps", "configs", master), "utf8");
+    const raw = JSON.parse(text) as { servers?: Record<string, McpServerConfig> };
+    for (const [id, config] of Object.entries(raw.servers ?? {})) {
+      merged[id] = config;
+    }
+  } catch (err) {
+    debug("runtime-install:master-config", err);
+  }
+
+  return merged;
+}
+
+export async function readUserAgentMemory(agent: RuntimeAgent): Promise<string> {
+  const path = agent === "claude-code"
+    ? join(homedir(), ".claude", "CLAUDE.md")
+    : join(homedir(), ".codex", "AGENTS.md");
+  try {
+    return await readFile(path, "utf8");
+  } catch {
+    return "";
+  }
+}
+
+export async function pickClaudeCredentialsSource(): Promise<string> {
+  if (process.env.CLAUDE_CONFIG_DIR) return process.env.CLAUDE_CONFIG_DIR;
+
+  const homeClaude = join(homedir(), ".claude");
+  if (existsSync(join(homeClaude, ".credentials.json"))) return homeClaude;
+
+  try {
+    const { spawnSync } = await import("node:child_process");
+    const { statSync } = await import("node:fs");
+    const res = spawnSync("authmux", ["parallel", "--list", "--json"], {
+      encoding: "utf8",
+      timeout: 3000,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    if (res.status === 0 && res.stdout) {
+      const parsed = JSON.parse(res.stdout) as { data?: { profiles?: Array<{ name: string; configDir: string }> } };
+      const profiles = parsed?.data?.profiles ?? [];
+      const withMtime = profiles
+        .map((p) => {
+          const credsPath = join(p.configDir, ".credentials.json");
+          let mtime = 0;
+          try { mtime = statSync(credsPath).mtimeMs; } catch { /* missing */ }
+          return { ...p, mtime };
+        })
+        .filter((p) => p.mtime > 0)
+        .sort((a, b) => b.mtime - a.mtime);
+      const pick = withMtime[0];
+      if (pick) {
+        process.stderr.write(`▸ cue: inheriting auth from authmux profile "${pick.name}"\n`);
+        return pick.configDir;
+      }
+    }
+  } catch {
+    // authmux not installed or query failed.
+  }
+
+  return homeClaude;
+}
+
+export async function resolveClaudeCredentialsSource(options: { healFromRuntime?: boolean } = {}): Promise<string> {
+  const picked = await pickClaudeCredentialsSource();
+  if (!options.healFromRuntime) return picked;
+
+  try {
+    const { syncFreshestToSource } = await import("./credentials-sync");
+    const result = await syncFreshestToSource(picked, join(configDir(), "runtime"));
+    if (result.synced) {
+      process.stderr.write(
+        `▸ cue: refreshed source credentials from a sibling runtime (rotated refresh-token healed)\n`,
+      );
+    }
+  } catch (err) {
+    debug("runtime-install:runtime-heal", err);
+  }
+  return picked;
+}
+
+export interface PrepareRuntimeOptions {
+  profile: ResolvedProfile;
+  agent: RuntimeAgent;
+  userMemory?: string;
+  credentialsSource?: string;
+}
+
+export async function prepareRuntime(options: PrepareRuntimeOptions): Promise<MaterializeOutput> {
+  return materializeRuntime({
+    profile: options.profile,
+    agent: options.agent,
+    runtimeRoot: join(configDir(), "runtime"),
+    skillSourceLookup: (id) => resolveLocalSkill(id),
+    mcpRegistry: await loadMcpRegistry(options.agent),
+    userClaudeMd: options.userMemory ?? await readUserAgentMemory(options.agent),
+    credentialsSource: options.credentialsSource,
+  });
+}