sideby 0.9.2 → 0.10.0

package/README.md

@@ -72,6 +72,7 @@ The agent checks Node and your Host CLIs, installs sideby and the skill, creates
 | See Claude quota (Codex needs no setup) | `sideby quota setup claude --yes` | [Claude quota](docs/guide/usage.md#claude-quota) |
 | Find the cheapest auto-compact size from your own sessions, and use it in one click | `sideby tune` (or the panel's Context tuning tab) | [Context tuning](docs/guide/usage.md#context-tuning) |
 | See each account's model and effort, and set them per account | `sideby model <account>` (or click the model in the panel) | [Model and effort](docs/guide/usage.md#model-and-effort) |
+| Stop Claude sessions from connecting to claude.ai by themselves (Remote Control), for every account at once | `sideby remote-control off` (or the panel's banner) | [Remote Control](docs/guide/usage.md#remote-control) |
 | Move on when an account hits its limit | `sideby next claude` | [Handoff](docs/guide/usage.md#when-an-account-hits-its-limit) |
 | Let a running task move to the next account by itself when quota runs low (off by default; see the risk) | `sideby handoff enable` (or the panel) | [Auto Handoff](docs/guide/usage.md#auto-handoff) |
 | Short commands such as `ccw` | `sideby alias add ccw claude:work` | [Shell functions](docs/guide/configuration.md#shell-functions) |

package/dist/build.json

@@ -1 +1 @@
-{"id":"20261015T120149-abb6bb"}
+{"id":"20261015T150956-8c8f4c"}

package/dist/src/cli/commands.d.ts

@@ -43,6 +43,11 @@ export declare function cmdResume(a: ParsedArgs, io: Io): Promise<number>;
 /** `sideby next <family>`: recommend the Account with the most room, then start it (spec §3.13). */
 export declare function cmdNext(a: ParsedArgs, io: Io): Promise<number>;
 export declare function cmdDoctor(a: ParsedArgs, io: Io): Promise<number>;
+/**
+ * `sideby remote-control [off|undo] [--yes] [--json]` (spec §3.22, ADR-0017): whether Claude sessions connect to
+ * claude.ai by themselves, and turning that off for every Account (a preview with exit 10 until --yes).
+ */
+export declare function cmdRemoteControl(a: ParsedArgs, io: Io): Promise<number>;
 /**
  * `sideby model <account> [<model>|default] [--effort <level>|default] [--yes]` (spec §3.19, ADR-0014): shows the
  * Account's model and effort; with a change, shows it (exit 10) and writes it with --yes.

package/dist/src/cli/commands.js

@@ -10,6 +10,7 @@ import { runHost } from '../core/launch.js';
 import { accountModel, setAccountModel } from '../core/model-choice.js';
 import { resolvePaths, tildify } from '../core/paths.js';
 import { USAGE_DAYS } from '../core/quota-levels.js';
+import { groupsToTurnOff, groupsToUndo, } from '../core/remote-control.js';
 import { SHELLS } from '../core/shell-init.js';
 import { suggestAlias, suggestName } from '../panel/page-logic.js';
 import { createRuntime, UnknownFamilyError } from '../runtime.js';
@@ -413,6 +414,100 @@ async function cmdTuneChange(a, io, action) {
         io.out(r.message);
     return r.ok ? 0 : 1;
 }
+const RC_STATE = {
+    on: 'on',
+    default: 'default',
+    off: 'off',
+    missing: 'no file',
+    blocked: 'cannot change',
+};
+function rcGroupLine(g, home) {
+    const state = RC_STATE[g.state].padEnd(13);
+    const paint = g.state === 'on'
+        ? c.yellow
+        : g.state === 'off'
+            ? c.green
+            : g.state === 'default'
+                ? (x) => x
+                : c.dim;
+    const where = g.reason ? tilde(g.reason, home) : tildify(g.file, home);
+    return `  ${paint(state)} ${c.bold(g.accounts.join(', '))}  ${c.dim(where)}`;
+}
+/**
+ * `sideby remote-control [off|undo] [--yes] [--json]` (spec §3.22, ADR-0017): whether Claude sessions connect to
+ * claude.ai by themselves, and turning that off for every Account (a preview with exit 10 until --yes).
+ */
+export async function cmdRemoteControl(a, io) {
+    const [action, extra] = a.positionals;
+    if (extra !== undefined || (action !== undefined && action !== 'off' && action !== 'undo'))
+        throw new UsageError('usage: sideby remote-control [off|undo] [--yes] [--json]');
+    const wantJson = a.flags.has('json');
+    const rt = await createRuntime();
+    const home = rt.paths.home;
+    const show = (gs) => gs.map((g) => ({ ...g, file: tildify(g.file, home) }));
+    const out = (data) => json(io, { action: action ?? 'status', ...data });
+    const groups = await rt.remoteControl();
+    if (!action) {
+        if (wantJson) {
+            out({ groups: show(groups) });
+            return 0;
+        }
+        if (groups.length === 0) {
+            io.out('No Claude accounts found.');
+            return 0;
+        }
+        io.out('Remote Control: whether Claude sessions connect to claude.ai/code and the Claude app by themselves');
+        for (const g of groups)
+            io.out(rcGroupLine(g, home));
+        io.out(c.dim('  on: every session connects; default: Claude Code or your organization decides; off: only when you run /remote-control'));
+        if (groupsToTurnOff(groups).length)
+            io.out(c.cyan('\nRun `sideby remote-control off` so no session connects by itself (it shows the change first).'));
+        return 0;
+    }
+    const todo = action === 'off' ? groupsToTurnOff(groups) : groupsToUndo(groups);
+    if (todo.length === 0) {
+        const r = action === 'off' ? await rt.remoteControlOff() : await rt.remoteControlUndo();
+        if (wantJson)
+            out({ applied: false, groups: show(groups), message: r.message });
+        else
+            io.out(tilde(r.message, home));
+        return r.ok ? 0 : 1;
+    }
+    if (!a.flags.has('yes')) {
+        if (wantJson)
+            out({
+                applied: false,
+                groups: show(todo),
+                message: `Run again with --yes to ${action === 'off' ? 'turn it off' : 'undo'}.`,
+            });
+        else {
+            io.out(action === 'off'
+                ? 'Turn off Remote Control at startup?'
+                : 'Put back the Remote Control setting sideby replaced?');
+            for (const g of todo) {
+                const to = action === 'off' ? 'false' : 'what it was before';
+                const from = g.state === 'default' ? 'not set' : g.state === 'on' ? 'true' : 'false';
+                io.out(`  ${tildify(g.file, home)}: remoteControlAtStartup ${from} -> ${to}`);
+                io.out(c.dim(`    used by ${g.accounts.join(', ')}`));
+            }
+            io.out(action === 'off'
+                ? 'Sessions already running stay connected until you restart them. You can still start it in a session with /remote-control, and undo this with `sideby remote-control undo`.'
+                : 'New sessions go back to the previous setting.');
+            io.out(`Run again with --yes to ${action === 'off' ? 'turn it off' : 'undo'}.`);
+        }
+        return 10;
+    }
+    const r = action === 'off' ? await rt.remoteControlOff() : await rt.remoteControlUndo();
+    const results = r.results.map((x) => ({ ...x, file: tildify(x.file, home) }));
+    if (wantJson)
+        out({ applied: r.ok, results, message: r.message });
+    else {
+        for (const x of results)
+            io.out(`  ${x.ok ? c.green('ok') : c.red('failed')} ${x.file}: ${x.message}`);
+        io.out(r.message);
+    }
+    return r.ok ? 0 : 1;
+}
 const FROM = {
     sideby: 'set by sideby',
     host: 'from the host config',

package/dist/src/cli/json-schemas.js

@@ -235,6 +235,30 @@ export const OUTPUT_SCHEMAS = {
         })),
         message: Type.Optional(Str),
     }, { title: 'sideby tune apply|undo --json' }),
+    'remote-control': Type.Object({
+        schemaVersion: Version,
+        action: Type.Union([Type.Literal('status'), Type.Literal('off'), Type.Literal('undo')]),
+        applied: Type.Optional(Type.Boolean({ description: 'True once the change was written (or undone).' })),
+        groups: Type.Optional(Type.Array(Type.Object({
+            file: Str,
+            accounts: Type.Array(Str, { description: 'Claude accounts whose settings.json is this file.' }),
+            state: Type.Union([
+                Type.Literal('on'),
+                Type.Literal('default'),
+                Type.Literal('off'),
+                Type.Literal('missing'),
+                Type.Literal('blocked'),
+            ], {
+                description: 'on: remoteControlAtStartup is true; default: not set; off: false; missing: no settings.json; blocked: cannot be changed safely (see reason).',
+            }),
+            reason: Type.Optional(Str),
+            undo: Type.Boolean({
+                description: 'sideby turned it off here and can put the earlier value back.',
+            }),
+        }), { description: 'For status, every file; for a preview, the files that would change.' })),
+        results: Type.Optional(Type.Array(Type.Object({ file: Str, accounts: Type.Array(Str), ok: Type.Boolean(), message: Str }))),
+        message: Type.Optional(Str),
+    }, { title: 'sideby remote-control [off|undo] --json' }),
     model: Type.Object({
         schemaVersion: Version,
         account: Str,

package/dist/src/cli/main.js

@@ -34,6 +34,9 @@ Usage:
                                       from your last 7 days of sessions (read-only)
   sideby model <account> [<model>|default] [--effort <level>|default] [--yes]
                                       show or set the model and effort sideby starts this account with
+  sideby remote-control [off|undo] [--yes]
+                                      whether Claude sessions connect to claude.ai by themselves;
+                                      off stops that for every account (shows the change first)
   sideby handoff status               what Auto Handoff still needs on this machine
   sideby handoff enable [--yes]       turn it on (shows the config change first); --same-family,
                                       --order claude=codex001,cc002, --threshold n, --prepare-at n
@@ -56,8 +59,8 @@ Usage:
   sideby plugins                      list loaded plugins and load errors
 
 Options:
-  --json        machine-readable output (list, new, next, alias, doctor, quota, tune, handoff, families, plugins, app,
-                desktop)
+  --json        machine-readable output (list, new, next, alias, doctor, quota, tune, model, remote-control, handoff,
+                families, plugins, app, desktop)
   -h, --help    show this help; \`sideby <command> --help\` for new, alias, login, doctor, families, desktop
   -v, --version show the version
 
@@ -179,6 +182,7 @@ const COMMANDS = {
     quota: { flags: ['json', 'yes'] },
     tune: { flags: ['json', 'yes'] },
     model: { flags: ['json', 'yes'], valued: ['effort'] },
+    'remote-control': { flags: ['json', 'yes'] },
     handoff: {
         flags: ['json', 'yes', 'same-family', 'no-same-family'],
         valued: ['brief', 'to', 'order', 'prepare-at', 'threshold', 'wait-minutes', 'countdown'],
@@ -283,6 +287,8 @@ export async function main(argv) {
                 return await cmds.cmdTune(parsed, io);
             case 'model':
                 return await cmds.cmdModel(parsed, io);
+            case 'remote-control':
+                return await cmds.cmdRemoteControl(parsed, io);
             case 'handoff':
                 return await cmds.cmdHandoff(parsed, io);
             case 'ui':

package/dist/src/core/claude-settings-file.d.ts

@@ -0,0 +1,17 @@
+import type { Account } from '../types.ts';
+export type Json = Record<string, unknown>;
+export declare const isObj: (v: unknown) => v is Json;
+export declare function render(obj: Json, original: string): string;
+export declare function readObject(file: string): Promise<{
+    text: string;
+    obj: Json;
+} | {
+    error: string;
+}>;
+/** Where the Account's settings really live, and whether `settings.json` is a link to it. */
+export declare function locate(account: Account): Promise<{
+    file: string;
+    link: boolean;
+    exists: boolean;
+    broken?: boolean;
+}>;

package/dist/src/core/claude-settings-file.js

@@ -0,0 +1,53 @@
+// One Claude Account's `settings.json`, as the writers of a single key use it (tune apply, ADR-0012; Remote Control,
+// ADR-0017): where it really lives, a safe read, and rendering it back with the file's own indentation.
+import { readFile, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { lstatOrNull, realpathOrNull } from './fs-safe.js';
+const MAX_BYTES = 5_000_000;
+export const isObj = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+function detectIndent(text) {
+    const m = /^([ \t]+)"/m.exec(text);
+    if (!m)
+        return 2;
+    const lead = m[1];
+    return lead.startsWith('\t') ? '\t' : lead.length;
+}
+export function render(obj, original) {
+    const out = JSON.stringify(obj, null, detectIndent(original));
+    return original.endsWith('\n') || original === '' ? `${out}\n` : out;
+}
+export async function readObject(file) {
+    const st = await stat(file).catch(() => null);
+    if (!st?.isFile())
+        return { error: 'it is not a regular file' };
+    if (st.size > MAX_BYTES)
+        return { error: 'it is too large to be a settings file' };
+    const text = await readFile(file, 'utf8');
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return { error: 'it is not valid JSON' };
+    }
+    if (!isObj(parsed))
+        return { error: 'it is not a JSON object' };
+    return { text, obj: parsed };
+}
+/** Where the Account's settings really live, and whether `settings.json` is a link to it. */
+export async function locate(account) {
+    const path = join(account.dir, 'settings.json');
+    const lst = await lstatOrNull(path);
+    // Every path is canonical (no link anywhere in it), so two Accounts that share a file compare equal and the undo
+    // record is found from either of them, even when HOME itself sits behind a link.
+    if (!lst) {
+        const dir = (await realpathOrNull(account.dir)) ?? account.dir;
+        return { file: join(dir, 'settings.json'), link: false, exists: false };
+    }
+    const real = await realpathOrNull(path);
+    if (!lst.isSymbolicLink())
+        return { file: real ?? path, link: false, exists: true };
+    return real
+        ? { file: real, link: true, exists: true }
+        : { file: path, link: true, exists: false, broken: true };
+}

package/dist/src/core/handoff-chain.d.ts

@@ -18,6 +18,8 @@ export interface PlanFile {
     threshold: number;
     /** False when the session cannot write its Brief: no preparing step, and the threshold only ends the turn. */
     agentBrief?: boolean;
+    /** The parent reads `to` from a manual request; a parent from before 0.9.3 does not write it and ignores `to`. */
+    acceptsTo?: true;
 }
 /** What the hook already did in one run. */
 export interface RunState {

package/dist/src/core/handoff-run.js

@@ -8,6 +8,7 @@ import { join } from 'node:path';
 import { HOOK_FAMILIES } from '../handoff/hook.js';
 import { firstPrompt } from '../handoff/messages.js';
 import { aliasArgs } from './config.js';
+import { UserError } from './errors.js';
 import { finishBrief } from './handoff-brief.js';
 import { briefPath, chainDir, ensureChainDir, FILES, HANDOFF_ENV, newId, readJsonFile, writeJsonFile, } from './handoff-chain.js';
 import { runHost, sidebyBinProblem, spawnHost } from './launch.js';
@@ -232,6 +233,7 @@ opts = {}) {
                         prepareAt: settings.prepareAt,
                         threshold: settings.threshold,
                         ...(elig.agentBrief === false ? { agentBrief: false } : {}),
+                        acceptsTo: true,
                     };
                     await writeJsonFile(join(dir, FILES.plan), plan);
                 }
@@ -347,6 +349,11 @@ export async function readyDecision(rt, env, to) {
     const ref = env.SIDEBY_ACCOUNT;
     if (!env[HANDOFF_ENV.run] || !dir || !ref)
         return null;
+    if (to !== undefined) {
+        const plan = await readJsonFile(join(dir, FILES.plan));
+        if (plan && plan.runId === env[HANDOFF_ENV.run] && !plan.acceptsTo)
+            throw new UserError(`this session was started by an older sideby, which cannot hand over to a named account; exit it and start ${to} yourself (\`sideby run ${to}\`), or run \`sideby handoff ready\` without --to`, { code: 'parent-too-old' });
+    }
     const account = await rt.resolve(ref);
     const chain = await readJsonFile(join(dir, FILES.chain));
     return decide(rt, account, chain?.hops.map((h) => h.ref) ?? [account.ref], to);

package/dist/src/core/remote-control.d.ts

@@ -0,0 +1,45 @@
+import type { Account, ReadContext } from '../types.ts';
+export declare const RC_KEY = "remoteControlAtStartup";
+/**
+ * `on`: every session connects by itself; `default`: no key, so the organization's or Claude Code's default decides
+ * (it may connect); `off`: never by itself; `missing`: the Account has no `settings.json`; `blocked`: see `reason`.
+ */
+export type RemoteControlState = 'on' | 'default' | 'off' | 'missing' | 'blocked';
+export interface RemoteControlGroup {
+    /** The real settings file (canonical); for `missing`, where it would be. */
+    file: string;
+    /** Refs of the Accounts whose `settings.json` is `file`, in discovery order. */
+    accounts: string[];
+    state: RemoteControlState;
+    /** For `blocked` and `missing`: why, and what to do. */
+    reason?: string;
+    /** sideby turned it off here and can put the earlier value back. */
+    undo: boolean;
+}
+export interface RemoteControlUndoRecord {
+    file: string;
+    /** The value before sideby wrote `false`, or null when the key was not there. */
+    previous: boolean | null;
+    at: string;
+}
+export interface RemoteControlChange {
+    ok: boolean;
+    /** One line per group that was meant to change. */
+    results: {
+        file: string;
+        accounts: string[];
+        ok: boolean;
+        message: string;
+    }[];
+    message: string;
+}
+/** Every Claude Account's setting, grouped by the file it lives in. Writes nothing. */
+export declare function remoteControlGroups(accounts: readonly Account[], ctx: ReadContext): Promise<RemoteControlGroup[]>;
+/** The groups `off` would change: those that are on, or follow a default that may be on. */
+export declare function groupsToTurnOff(groups: readonly RemoteControlGroup[]): RemoteControlGroup[];
+/** Sets `remoteControlAtStartup` to false in every group that is on or follows the default, remembering each old value. */
+export declare function turnRemoteControlOff(accounts: readonly Account[], ctx: ReadContext): Promise<RemoteControlChange>;
+/** Groups sideby can put back: it wrote `false` there and the key still holds it. */
+export declare function groupsToUndo(groups: readonly RemoteControlGroup[]): RemoteControlGroup[];
+/** Puts back what each file had before `off`, only while the key is still `false`. */
+export declare function undoRemoteControlOff(accounts: readonly Account[], ctx: ReadContext): Promise<RemoteControlChange>;

package/dist/src/core/remote-control.js

@@ -0,0 +1,157 @@
+// Remote Control off by default (spec §3.22, ADR-0017): reads and writes one key, `remoteControlAtStartup`, of each
+// Claude Account's `settings.json`. Accounts that share a file (a link to the Main Account's) form one group and one
+// write. Nothing but that key is ever read out of the file into an output, an error or the undo record; writes go
+// through `writeIfUnchanged`, keep every other key, and never create, replace or retarget a link.
+import { mkdir, readFile, rm, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { locate, readObject, render } from './claude-settings-file.js';
+import { sha256, writeFileAtomic, writeIfUnchanged } from './fs-safe.js';
+export const RC_KEY = 'remoteControlAtStartup';
+const NO_SETTINGS = 'this account has no settings.json; run `sideby doctor --fix` so it shares the main one, then try again';
+function stateOf(v) {
+    return v === true ? 'on' : v === false ? 'off' : 'default';
+}
+function recordPath(ctx, file) {
+    return join(ctx.stateDir, 'remote-control', `${sha256(file).slice(0, 16)}.json`);
+}
+async function readRecord(ctx, file) {
+    try {
+        const r = JSON.parse(await readFile(recordPath(ctx, file), 'utf8'));
+        if (r.file === file && (r.previous === null || typeof r.previous === 'boolean'))
+            return r;
+    }
+    catch {
+        // no record
+    }
+    return null;
+}
+/** Every Claude Account's setting, grouped by the file it lives in. Writes nothing. */
+export async function remoteControlGroups(accounts, ctx) {
+    const byFile = new Map();
+    for (const account of accounts) {
+        if (account.family !== 'claude')
+            continue;
+        const where = await locate(account);
+        const have = byFile.get(where.file);
+        if (have) {
+            have.accounts.push(account.ref);
+            continue;
+        }
+        const group = {
+            file: where.file,
+            accounts: [account.ref],
+            state: 'missing',
+            undo: false,
+        };
+        byFile.set(where.file, group);
+        if (where.broken) {
+            group.state = 'blocked';
+            group.reason =
+                'settings.json is a link to a file that does not exist; run `sideby doctor` to see how to fix it';
+        }
+        else if (!where.exists) {
+            group.reason = NO_SETTINGS;
+        }
+        else {
+            const read = await readObject(where.file);
+            if ('error' in read) {
+                group.state = 'blocked';
+                group.reason = `settings.json cannot be changed safely: ${read.error}. Fix or move the file, then try again`;
+            }
+            else {
+                group.state = stateOf(read.obj[RC_KEY]);
+                group.undo = group.state === 'off' && (await readRecord(ctx, where.file)) !== null;
+            }
+        }
+    }
+    return [...byFile.values()];
+}
+/** The groups `off` would change: those that are on, or follow a default that may be on. */
+export function groupsToTurnOff(groups) {
+    return groups.filter((g) => g.state === 'on' || g.state === 'default');
+}
+async function writeKey(file, change, expect) {
+    const read = await readObject(file);
+    if ('error' in read)
+        return `settings.json cannot be changed safely: ${read.error}.`;
+    const refused = expect(read.obj);
+    if (refused)
+        return refused;
+    const mode = (await stat(file)).mode & 0o777;
+    const wrote = await writeIfUnchanged(file, sha256(read.text), render(change({ ...read.obj }), read.text), mode);
+    return wrote ? null : 'settings.json changed while sideby was writing, so nothing was changed. Try again.';
+}
+/** Sets `remoteControlAtStartup` to false in every group that is on or follows the default, remembering each old value. */
+export async function turnRemoteControlOff(accounts, ctx) {
+    const groups = await remoteControlGroups(accounts, ctx);
+    const todo = groupsToTurnOff(groups);
+    if (todo.length === 0) {
+        const stuck = groups.find((g) => g.state === 'blocked');
+        return stuck
+            ? { ok: false, results: [], message: `Nothing was changed: ${stuck.reason}` }
+            : {
+                ok: true,
+                results: [],
+                message: 'Remote Control already does not start by itself; nothing changed.',
+            };
+    }
+    const results = [];
+    for (const g of todo) {
+        let previous = null;
+        const failed = await writeKey(g.file, (obj) => {
+            previous = typeof obj[RC_KEY] === 'boolean' ? obj[RC_KEY] : null;
+            obj[RC_KEY] = false;
+            return obj;
+        }, (obj) => (obj[RC_KEY] === false ? 'It was turned off meanwhile; nothing changed.' : null));
+        if (failed) {
+            results.push({ file: g.file, accounts: g.accounts, ok: false, message: failed });
+            continue;
+        }
+        const record = { file: g.file, previous, at: new Date().toISOString() };
+        await mkdir(join(ctx.stateDir, 'remote-control'), { recursive: true });
+        await writeFileAtomic(recordPath(ctx, g.file), `${JSON.stringify(record, null, 2)}\n`, 0o600);
+        results.push({ file: g.file, accounts: g.accounts, ok: true, message: 'Turned off.' });
+    }
+    const ok = results.every((r) => r.ok);
+    return {
+        ok,
+        results,
+        message: ok
+            ? 'Done. New sessions no longer connect to claude.ai by themselves; restart sessions that are already running. You can still start it in a session with /remote-control.'
+            : 'Some files could not be changed; see each line.',
+    };
+}
+/** Groups sideby can put back: it wrote `false` there and the key still holds it. */
+export function groupsToUndo(groups) {
+    return groups.filter((g) => g.undo);
+}
+/** Puts back what each file had before `off`, only while the key is still `false`. */
+export async function undoRemoteControlOff(accounts, ctx) {
+    const todo = groupsToUndo(await remoteControlGroups(accounts, ctx));
+    if (todo.length === 0)
+        return { ok: false, results: [], message: 'There is nothing from sideby to undo.' };
+    const results = [];
+    for (const g of todo) {
+        const record = await readRecord(ctx, g.file);
+        if (!record)
+            continue;
+        const failed = await writeKey(g.file, (obj) => {
+            if (record.previous === null)
+                delete obj[RC_KEY];
+            else
+                obj[RC_KEY] = record.previous;
+            return obj;
+        }, (obj) => obj[RC_KEY] === false ? null : 'The setting was changed after sideby set it, so it was left alone.');
+        if (!failed)
+            await rm(recordPath(ctx, g.file), { force: true });
+        results.push({ file: g.file, accounts: g.accounts, ok: !failed, message: failed ?? 'Put back.' });
+    }
+    const ok = results.length > 0 && results.every((r) => r.ok);
+    return {
+        ok,
+        results,
+        message: ok
+            ? 'Undone. New sessions go back to the previous setting.'
+            : 'Some files could not be put back; see each line.',
+    };
+}

package/dist/src/core/tuning-apply.js

@@ -5,49 +5,19 @@
 // shares it; a link is never created, replaced or retargeted.
 import { mkdir, readFile, rm, stat } from 'node:fs/promises';
 import { join } from 'node:path';
+import { isObj, locate, readObject, render } from './claude-settings-file.js';
 import { UserError } from './errors.js';
-import { fileHash, lstatOrNull, realpathOrNull, sha256, writeFileAtomic, writeIfUnchanged, } from './fs-safe.js';
+import { fileHash, sha256, writeFileAtomic, writeIfUnchanged } from './fs-safe.js';
 import { MAX_COMPACT_WINDOW, MIN_COMPACT_WINDOW } from './tuning.js';
 export const TUNE_KEY = 'autoCompactWindow';
 export const MIN_WINDOW = MIN_COMPACT_WINDOW;
 export const MAX_WINDOW = MAX_COMPACT_WINDOW;
-const MAX_BYTES = 5_000_000;
-const isObj = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
 function checkValue(value) {
     if (value === null)
         return;
     if (!Number.isInteger(value) || value < MIN_WINDOW || value > MAX_WINDOW)
         throw new UserError(`${value} is not a usable size: give a whole number of tokens from ${MIN_WINDOW} to ${MAX_WINDOW}, for example 160000`, { code: 'bad-value' });
 }
-function detectIndent(text) {
-    const m = /^([ \t]+)"/m.exec(text);
-    if (!m)
-        return 2;
-    const lead = m[1];
-    return lead.startsWith('\t') ? '\t' : lead.length;
-}
-function render(obj, original) {
-    const out = JSON.stringify(obj, null, detectIndent(original));
-    return original.endsWith('\n') || original === '' ? `${out}\n` : out;
-}
-async function readObject(file) {
-    const st = await stat(file).catch(() => null);
-    if (!st?.isFile())
-        return { error: 'it is not a regular file' };
-    if (st.size > MAX_BYTES)
-        return { error: 'it is too large to be a settings file' };
-    const text = await readFile(file, 'utf8');
-    let parsed;
-    try {
-        parsed = JSON.parse(text);
-    }
-    catch {
-        return { error: 'it is not valid JSON' };
-    }
-    if (!isObj(parsed))
-        return { error: 'it is not a JSON object' };
-    return { text, obj: parsed };
-}
 /** The sizes models save for themselves under `modelSettings`: only those `autoCompactWindow` numbers are read. */
 function overridesOf(obj) {
     const ms = obj.modelSettings;
@@ -61,23 +31,6 @@ function overridesOf(obj) {
     }
     return out;
 }
-/** Where the Account's settings really live, and whether `settings.json` is a link to it. */
-async function locate(account) {
-    const path = join(account.dir, 'settings.json');
-    const lst = await lstatOrNull(path);
-    // Every path is canonical (no link anywhere in it), so two Accounts that share a file compare equal and the undo
-    // record is found from either of them, even when HOME itself sits behind a link.
-    if (!lst) {
-        const dir = (await realpathOrNull(account.dir)) ?? account.dir;
-        return { file: join(dir, 'settings.json'), link: false, exists: false };
-    }
-    const real = await realpathOrNull(path);
-    if (!lst.isSymbolicLink())
-        return { file: real ?? path, link: false, exists: true };
-    return real
-        ? { file: real, link: true, exists: true }
-        : { file: path, link: true, exists: false, broken: true };
-}
 function recordPath(ctx, file) {
     return join(ctx.stateDir, 'tune', `${sha256(file).slice(0, 16)}.json`);
 }

package/dist/src/families/claude/handoff.js

@@ -85,6 +85,7 @@ export const claudeHandoff = {
         ];
         const settings = {
             hooks: {
+                SessionStart: hook('SessionStart'),
                 PostToolUse: hook('PostToolUse'),
                 Stop: hook('Stop'),
                 StopFailure: [

package/dist/src/handoff/hook.js

@@ -7,7 +7,7 @@ import { FILES, HANDOFF_ENV, readJsonFile, writeJsonFile, } from '../core/handof
 import { claudeHookReader } from '../families/claude/handoff-hook.js';
 import { codexHookReader } from '../families/codex/handoff-hook.js';
 import { grokHookReader } from '../families/grok/handoff-hook.js';
-import { endTurnMessage, prepareMessage, stopMessage, thresholdMessage } from './messages.js';
+import { endTurnMessage, prepareMessage, sessionStartMessage, stopMessage, thresholdMessage, } from './messages.js';
 import { field } from './reader.js';
 export const HOOK_COMMAND = 'sideby handoff-hook';
 const READERS = {
@@ -17,7 +17,7 @@ const READERS = {
 };
 /** Families whose hooks this entry understands; only they can start a Handoff. */
 export const HOOK_FAMILIES = Object.keys(READERS);
-const EVENTS = new Set(['PostToolUse', 'Stop', 'StopFailure']);
+const EVENTS = new Set(['SessionStart', 'PostToolUse', 'Stop', 'StopFailure']);
 async function readAll(stream) {
     const chunks = [];
     try {
@@ -29,8 +29,8 @@ async function readAll(stream) {
     }
     return Buffer.concat(chunks).toString('utf8');
 }
-const contextOutput = (text) => ({
-    hookSpecificOutput: { hookEventName: 'PostToolUse', additionalContext: text },
+const contextOutput = (text, hookEventName = 'PostToolUse') => ({
+    hookSpecificOutput: { hookEventName, additionalContext: text },
 });
 const blockOutput = (reason) => ({ decision: 'block', reason });
 async function mtimeMs(path) {
@@ -67,6 +67,14 @@ export async function decide(opts) {
             return;
         await writeJsonFile(readyFile, { runId, at: now.toISOString(), ...session, ...r });
     };
+    // The session learns it may move the task on when the user asks; without this it tells the user to start the
+    // other account by hand.
+    if (event === 'SessionStart') {
+        const ref = env.SIDEBY_ACCOUNT;
+        return ref && usable
+            ? { output: contextOutput(sessionStartMessage(ref, usable.brief), 'SessionStart') }
+            : {};
+    }
     const threshold = usable?.threshold ?? 95;
     const pressure = reader.pressure ? await reader.pressure(input, env, now) : null;
     if (event === 'StopFailure') {

package/dist/src/handoff/messages.d.ts

@@ -3,6 +3,8 @@ export declare function thresholdMessage(brief: string, pressure: number): strin
 /** At the threshold when the session cannot write a Brief: sideby puts one together from its records. */
 export declare function endTurnMessage(pressure: number): string;
 export declare function stopMessage(brief: string): string;
+/** At session start (Claude): this session may hand its task to another account when the user asks. */
+export declare function sessionStartMessage(ref: string, brief: string): string;
 declare const WHY: {
     readonly threshold: 'its quota ran low';
     readonly limit: 'its quota ran out';

package/dist/src/handoff/messages.js

@@ -21,6 +21,10 @@ export function endTurnMessage(pressure) {
 export function stopMessage(brief) {
     return `sideby: before you stop, update the handoff brief at ${brief} (${TEMPLATE}; ${RULES}), then end your turn.`;
 }
+/** At session start (Claude): this session may hand its task to another account when the user asks. */
+export function sessionStartMessage(ref, brief) {
+    return `sideby: this session runs in ${ref} under sideby with Auto Handoff. If the user wants this task to go on in another account ("continue in cc008", "hand it back to cc008"), do not ask them to start that account: write a handoff brief to ${brief} (${TEMPLATE}; ${RULES}), run \`sideby handoff ready --to <account>\` (an account or short command), tell the user the account it prints, and end your turn. sideby then ends this session and starts that account in this terminal.`;
+}
 const WHY = {
     threshold: 'its quota ran low',
     limit: 'its quota ran out',

package/dist/src/panel/handler.d.ts

@@ -1,6 +1,7 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { type HandoffSettings } from '../core/config.ts';
 import { type AccountModel } from '../core/model-choice.ts';
+import type { RemoteControlGroup } from '../core/remote-control.ts';
 import type { AccountStatus, DoctorHistory, FamilyInfo, Runtime } from '../runtime.ts';
 import type { Account, FamilyLogo, QuotaResult, QuotaSetupPlan, UsageResult } from '../types.ts';
 import { type PanelTheme } from './theme.ts';
@@ -94,7 +95,12 @@ export interface PanelState {
         settings: HandoffSettings;
         starters: string[];
     };
+    /** Claude settings files grouped as `sideby remote-control` shows them (spec §3.22); absent without Claude Accounts. */
+    remoteControl?: RemoteControlView[];
 }
 /** The `handoff` map of the Panel state, from the statuses and Quota already read for the page. */
 export declare function handoffByFamily(rt: Runtime, accounts: readonly PanelAccount[], now: Date): Record<string, string>;
+export type RemoteControlView = Omit<RemoteControlGroup, 'file'> & {
+    file: string;
+};
 export declare function createPanelHandler(opts: PanelHandlerOptions): PanelHandler;

package/dist/src/panel/handler.js

@@ -197,13 +197,17 @@ async function accountState(rt, account, families) {
         ...(errors.length ? { error: errors.join('; ') } : {}),
     };
 }
+function rcView(groups, home) {
+    return groups.map((g) => ({ ...g, file: tildify(g.file, home) }));
+}
 async function buildState(rt, opts) {
     const ctx = rt.readContext();
-    const [families, accounts, history, quotaSetups] = await Promise.all([
+    const [families, accounts, history, quotaSetups, remoteControl] = await Promise.all([
         rt.familyInfo(),
         rt.accounts(),
         rt.doctorHistory(),
         rt.quotaSetups(),
+        rt.remoteControl(),
     ]);
     const health = healthByAccount(history);
     const aliases = aliasesByAccount(aliasRefs(rt.config.aliases), accounts);
@@ -239,6 +243,7 @@ async function buildState(rt, opts) {
         ...(history ? { history } : {}),
         ...(rt.config.aliases ? { configAliases: aliasRefs(rt.config.aliases) } : {}),
         ...(Object.keys(handoff).length ? { handoff } : {}),
+        ...(remoteControl.length ? { remoteControl: rcView(remoteControl, ctx.home) } : {}),
         autoHandoff: {
             settings: rt.handoffSettings(),
             starters: [...rt.families.values()]
@@ -400,6 +405,24 @@ export function createPanelHandler(opts) {
                 return { ref: found.ref, undone: r.ok, message: r.message };
             },
         },
+        // Remote Control off by default (spec §3.22, ADR-0017): writes `remoteControlAtStartup: false` into each Claude
+        // settings file that turns it on or leaves it to the default; the page shows the files first, from the state.
+        '/api/remote-control/off': {
+            async run() {
+                const rt = await getRuntime();
+                const r = await rt.remoteControlOff();
+                const home = rt.paths.home;
+                return { ...r, results: r.results.map((x) => ({ ...x, file: tildify(x.file, home) })) };
+            },
+        },
+        '/api/remote-control/undo': {
+            async run() {
+                const rt = await getRuntime();
+                const r = await rt.remoteControlUndo();
+                const home = rt.paths.home;
+                return { ...r, results: r.results.map((x) => ({ ...x, file: tildify(x.file, home) })) };
+            },
+        },
         // Auto Handoff (spec §3.17): readiness reads only; configure shows the config change unless `confirm`.
         '/api/handoff/status': {
             writes: () => false,

package/dist/src/panel/i18n.d.ts

@@ -457,6 +457,22 @@ declare const en: {
     'empty.install': string;
     'empty.noFamilies': string;
     'empty.create': string;
+    'rc.title': string;
+    'rc.body.one': string;
+    'rc.body.other': string;
+    'rc.turnOff': string;
+    'rc.keep': string;
+    'rc.hidden': string;
+    'rc.readOnly': string;
+    'rc.confirmTitle': string;
+    'rc.change': string;
+    'rc.notSet': string;
+    'rc.usedBy': string;
+    'rc.confirmNote': string;
+    'rc.confirm': string;
+    'rc.done': string;
+    'rc.failed': string;
+    'rc.undone': string;
     'banner.readOnly': string;
     'banner.plugins.one': string;
     'banner.plugins.other': string;

package/dist/src/panel/i18n.js

@@ -459,6 +459,22 @@ const en = {
     'empty.install': 'Install',
     'empty.noFamilies': 'No tools are registered. Check sideby plugins.',
     'empty.create': 'Create your first account',
+    'rc.title': 'Remote Control starts by itself.',
+    'rc.body.one': 'Sessions of {refs} connect to claude.ai and the Claude app, where every device signed in to that account can read them.',
+    'rc.body.other': 'Sessions of {n} accounts ({refs}) connect to claude.ai and the Claude app, where every device signed in to that account can read them.',
+    'rc.turnOff': 'Turn all off',
+    'rc.keep': 'Keep it on',
+    'rc.hidden': 'Hidden in this browser. sideby remote-control off turns it off later.',
+    'rc.readOnly': 'Run sideby remote-control off to turn it off.',
+    'rc.confirmTitle': 'Turn off Remote Control at startup?',
+    'rc.change': 'remoteControlAtStartup {from} → false',
+    'rc.notSet': 'not set',
+    'rc.usedBy': 'used by {refs}',
+    'rc.confirmNote': 'Running sessions stay connected until you restart them. You can still start it in a session with /remote-control.',
+    'rc.confirm': 'Turn off',
+    'rc.done': 'Remote Control is off for new sessions. Restart sessions that are running.',
+    'rc.failed': 'Could not turn it off: {msg}',
+    'rc.undone': 'Undone. New sessions go back to the previous setting.',
     'banner.readOnly': 'Read-only view. Use the sideby CLI to fix or create accounts.',
     'banner.plugins.one': '{n} plugin problem.',
     'banner.plugins.other': '{n} plugin problems.',
@@ -922,6 +938,22 @@ const zh = {
     'empty.install': '安装',
     'empty.noFamilies': '没有注册任何工具，请检查 sideby plugins。',
     'empty.create': '创建第一个账号',
+    'rc.title': 'Remote Control 会自动打开。',
+    'rc.body.one': '{refs} 的会话会连到 claude.ai 和 Claude 手机 App，登录这个账号的设备都能看到对话。',
+    'rc.body.other': '{n} 个账号（{refs}）的会话会连到 claude.ai 和 Claude 手机 App，登录这个账号的设备都能看到对话。',
+    'rc.turnOff': '全部关闭',
+    'rc.keep': '保持开启',
+    'rc.hidden': '本浏览器不再提示。以后可以运行 sideby remote-control off 关闭。',
+    'rc.readOnly': '运行 sideby remote-control off 关闭。',
+    'rc.confirmTitle': '关闭 Remote Control 自动打开？',
+    'rc.change': 'remoteControlAtStartup {from} → false',
+    'rc.notSet': '未设置',
+    'rc.usedBy': '用于 {refs}',
+    'rc.confirmNote': '已经开着的会话要重开才断开。需要时仍可在会话里运行 /remote-control 手动打开。',
+    'rc.confirm': '确认关闭',
+    'rc.done': '新会话不会再自动打开 Remote Control。开着的会话要重开。',
+    'rc.failed': '没能关闭：{msg}',
+    'rc.undone': '已撤销，新会话恢复原来的设置。',
     'banner.readOnly': '只读视图。修复或创建账号请用 sideby 命令行。',
     'banner.plugins.one': '{n} 个插件问题。',
     'banner.plugins.other': '{n} 个插件问题。',

package/dist/src/panel/page-script.js

@@ -69,6 +69,7 @@ const MAIN = String.raw `
     for (const k of Object.keys(CHOICES)) if (CHOICES[k].includes(raw[k])) p[k] = raw[k]
     if (raw.hideEmail === true) p.hideEmail = true
     if (typeof raw.ahHintAt === 'number') p.ahHintAt = raw.ahHintAt
+    if (raw.rcHide === true) p.rcHide = true
     if (typeof raw.family === 'string') p.family = raw.family
     if (raw.collapsed && typeof raw.collapsed === 'object')
       for (const k of Object.keys(raw.collapsed)) if (raw.collapsed[k] === true) p.collapsed[k] = true
@@ -2380,6 +2381,59 @@ const MAIN = String.raw `
     setKids(box, kids)
   }
 
+  // ---------- Remote Control (spec §3.22) ----------
+  // Shown while some Claude settings file turns Remote Control on. "Turn all off" first lists each file, the change
+  // and the accounts it reaches, in the banner itself; the toast after it carries the undo.
+  const rc = { confirm: false, busy: false }
+  const shortRef = (ref) => ref.replace(/^claude:/, '')
+  function remoteControlBanner() {
+    const groups = S.state.remoteControl || []
+    // API Accounts never sign in to claude.ai, so Remote Control cannot reach their sessions.
+    const api = new Set(S.state.accounts.filter((a) => a.kind === 'api').map((a) => a.ref))
+    const refs = groups.filter((g) => g.state === 'on').flatMap((g) => g.accounts).filter((r) => !api.has(r)).map(shortRef)
+    if (!refs.length || prefs.rcHide) return null
+    const todo = groups.filter((g) => g.state === 'on' || g.state === 'default')
+    const text = h('div', null, h('b', null, t('rc.title') + ' '), tn('rc.body', refs.length, { refs: refs.join(', ') }))
+    if (BOOT.readOnly) return h('div', { class: 'banner banner-warn', role: 'status' }, h('div', null, text, ' ', t('rc.readOnly')))
+    if (!rc.confirm)
+      return h('div', { class: 'banner banner-warn', role: 'status' }, text,
+        h('div', { class: 'banner-actions' },
+          h('button', { class: 'btn btn-sm btn-primary', type: 'button', onclick: () => { rc.confirm = true; renderBanners() } }, t('rc.turnOff')),
+          h('button', { class: 'btn btn-sm', type: 'button', onclick: () => { prefs.rcHide = true; savePrefs(); renderBanners(); toast(t('rc.hidden')) } }, t('rc.keep'))))
+    const lines = todo.map((g) => h('li', null, h('code', null, g.file), ' ',
+      t('rc.change', { from: g.state === 'on' ? 'true' : t('rc.notSet') }), ' ',
+      h('span', { class: 'muted' }, t('rc.usedBy', { refs: g.accounts.map(shortRef).join(', ') }))))
+    return h('div', { class: 'banner banner-warn', role: 'status' },
+      h('div', null, h('b', null, t('rc.confirmTitle')), h('ul', null, lines), h('div', { class: 'small' }, t('rc.confirmNote'))),
+      h('div', { class: 'banner-actions' },
+        h('button', { class: 'btn btn-sm btn-primary', type: 'button', disabled: rc.busy, onclick: remoteControlOff }, rc.busy ? spinner() : null, t('rc.confirm')),
+        h('button', { class: 'btn btn-sm', type: 'button', disabled: rc.busy, onclick: () => { rc.confirm = false; renderBanners() } }, t('btn.cancel'))))
+  }
+  async function remoteControlOff() {
+    rc.busy = true
+    renderBanners()
+    try {
+      const r = await api('/api/remote-control/off', {})
+      if (r.ok) {
+        // Hide the banner now; the reload that follows confirms it.
+        S.state.remoteControl = (S.state.remoteControl || []).map((g) => g.state === 'on' || g.state === 'default' ? { ...g, state: 'off', undo: true } : g)
+        toast(t('rc.done'), { action: { label: t('toast.undo'), run: remoteControlUndo }, duration: 12000 })
+      }
+      else toast(t('rc.failed', { msg: r.message }), { kind: 'fail' })
+    } catch (e) { toast(t('rc.failed', { msg: e.message }), { kind: 'fail' }) }
+    rc.busy = false
+    rc.confirm = false
+    renderBanners()
+    await load({ silent: true })
+  }
+  async function remoteControlUndo() {
+    try {
+      const r = await api('/api/remote-control/undo', {})
+      toast(r.ok ? t('rc.undone') : r.message, { kind: r.ok ? 'ok' : 'fail' })
+    } catch (e) { toast(t('toast.undoFailed', { msg: e.message }), { kind: 'fail' }) }
+    await load({ silent: true })
+  }
+
   // ---------- banners ----------
   function renderBanners() {
     const out = []
@@ -2394,6 +2448,8 @@ const MAIN = String.raw `
         h('div', { class: 'banner-actions' },
           h('button', { class: 'btn btn-sm btn-primary', type: 'button', onclick: () => setPage('handoff') }, t('ah.setUp')),
           h('button', { class: 'btn btn-sm', type: 'button', onclick: () => { prefs.ahHintAt = Date.now(); savePrefs(); renderBanners() } }, t('ah.dismiss')))))
+      const rcBanner = remoteControlBanner()
+      if (rcBanner) out.push(rcBanner)
       const errs = S.state.pluginErrors
       if (errs.length) out.push(h('div', { class: 'banner banner-warn', role: 'status' }, h('div', null,
         h('b', null, tn('banner.plugins', errs.length) + ' '), t('banner.pluginsHint'),

package/dist/src/runtime.d.ts

@@ -9,6 +9,7 @@ import { type HandoffDecision } from './core/handoff-select.ts';
 import { type DoctorHistory } from './core/last-doctor.ts';
 import { type HostLaunch, type PreparedLaunch } from './core/launch.ts';
 import { type Paths } from './core/paths.ts';
+import { type RemoteControlChange, type RemoteControlGroup } from './core/remote-control.ts';
 import { type Shell, type ShellInitWrite } from './core/shell-init.ts';
 import { type TuneEntry, type TuneGroup } from './core/tuning.ts';
 import { type TuneApplyPlan, type TuneChange, type TuneUndoRecord } from './core/tuning-apply.ts';
@@ -227,6 +228,12 @@ export interface Runtime {
     }>;
     /** What could be undone for the Account, or null. */
     tuneUndoInfo(account: Account): Promise<TuneUndoRecord | null>;
+    /** Whether each Claude settings file starts Remote Control by itself (spec §3.22, ADR-0017); grouped by file. */
+    remoteControl(): Promise<RemoteControlGroup[]>;
+    /** Sets `remoteControlAtStartup` to false wherever it is on or left to the default, remembering how to undo it. */
+    remoteControlOff(): Promise<RemoteControlChange>;
+    /** Puts back what `remoteControlOff` replaced, only where the key still holds false. */
+    remoteControlUndo(): Promise<RemoteControlChange>;
     /**
      * Which Account of a Family to move on to (spec §3.13). Throws a UserError with code `no-quota-source`
      * when the Family cannot tell, `no-accounts` when it has none.

package/dist/src/runtime.js

@@ -13,6 +13,7 @@ import { mergeDoctorHistory, readDoctorHistory, writeDoctorHistory, } from './co
 import { prepareLaunch, which } from './core/launch.js';
 import { memoStore } from './core/memo-store.js';
 import { resolvePaths } from './core/paths.js';
+import { remoteControlGroups, turnRemoteControlOff, undoRemoteControlOff, } from './core/remote-control.js';
 import { findResumeRoute } from './core/resume.js';
 import { SAME_LOGIN_FAMILIES, sameLoginGroups, sharedQuota } from './core/same-login.js';
 import { shareMeaning } from './core/share-meaning.js';
@@ -574,6 +575,15 @@ export async function createRuntime(opts = {}) {
             onlyClaude(account);
             return undoTune(account, readContext());
         },
+        async remoteControl() {
+            return remoteControlGroups(await accounts(), readContext());
+        },
+        async remoteControlOff() {
+            return turnRemoteControlOff(await accounts(), readContext());
+        },
+        async remoteControlUndo() {
+            return undoRemoteControlOff(await accounts(), readContext());
+        },
         async tuneUndoInfo(account) {
             return account.family === 'claude' ? tuneUndoInfo(account, readContext()) : null;
         },

package/dist/src/types.d.ts

@@ -112,7 +112,7 @@ export interface FamilyDef {
     handoff?: FamilyHandoff;
 }
 /** A Host hook event sideby's handoff hook listens to. */
-export type HandoffHookEvent = 'PostToolUse' | 'Stop' | 'StopFailure';
+export type HandoffHookEvent = 'SessionStart' | 'PostToolUse' | 'Stop' | 'StopFailure';
 /** Whether one run may start a Handoff, or start as the next Account of one, and why not. */
 export interface HandoffEligibility {
     start: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sideby",
-  "version": "0.9.2",
+  "version": "0.10.0",
   "description": "Run work, personal and API-key accounts at the same time, without their configs drifting apart.",
   "license": "MIT",
   "author": "Adonis0123 (https://github.com/Adonis0123)",
@@ -77,5 +77,5 @@
   },
   "packageManager": "pnpm@10.15.0",
   "readmeFilename": "README.md",
-  "readme": "<p align=\"center\">\n  <img alt=\"sideby: work, personal and API-key accounts, one terminal each, one shared config\" src=\"https://raw.githubusercontent.com/Adonis0123/sideby/main/docs/assets/banner.jpg\" width=\"880\">\n</p>\n\n<p align=\"center\">\n  <b>Run work, personal and API-key accounts at the same time, without their configs drifting apart.</b><br>\n  Each account is its own directory and its own terminal. Skills, hooks and settings stay linked to your main account. Claude Code, Codex, Grok Build and pi.\n</p>\n\n<p align=\"center\">\n  <a href=\"https://www.npmjs.com/package/sideby\"><img alt=\"npm\" src=\"https://img.shields.io/npm/v/sideby\"></a>\n  <a href=\"https://github.com/Adonis0123/sideby/actions/workflows/ci.yml\"><img alt=\"CI\" src=\"https://github.com/Adonis0123/sideby/actions/workflows/ci.yml/badge.svg\"></a>\n  <img alt=\"Node 22.18+\" src=\"https://img.shields.io/badge/node-%E2%89%A522.18-339933\">\n  <a href=\"LICENSE\"><img alt=\"MIT\" src=\"https://img.shields.io/badge/license-MIT-blue\"></a>\n</p>\n\n<p align=\"center\">English | <a href=\"README.zh-CN.md\">中文</a></p>\n\n## Why not just an alias?\n\n`CLAUDE_CONFIG_DIR` plus a shell alias already starts a second account. It does not keep skills and settings in one place, and it does not show quota for every account. [Does this break a provider's terms?](docs/guide/faq.md#terms)\n\n| | At the same time | Skills, hooks, settings | Quota and usage | Setup |\n|---|---|---|---|---|\n| `CLAUDE_CONFIG_DIR` and an alias | Yes. Each terminal exports the variable. | Each directory is its own copy. They drift unless you symlink by hand. | That session's status line | One alias per account |\n| [cc-switch](https://github.com/farion1231/cc-switch) | Enabling a provider writes the host's live config, so open sessions share that switch. | Plugin settings are copied across providers as a separate step. | The active provider, from its quota endpoint | Install the desktop app |\n| sideby | Yes. `sideby run` selects the directory for that process and leaves your shell alone. | Linked to the main account. `sideby doctor --fix` repairs copies. Sign-in and sessions stay separate. | Every account, from local files. Claude needs `quota setup`. | `npm i -g sideby`, then `sideby new` and sign in |\n\ncc-switch's docs describe that switch: it writes the live settings file ([README](https://github.com/farion1231/cc-switch#readme)). [#1105](https://github.com/farion1231/cc-switch/issues/1105) and [#2908](https://github.com/farion1231/cc-switch/issues/2908) ask for several sessions at once. [#1106](https://github.com/farion1231/cc-switch/issues/1106) is closed; the maintainer says Claude Code's \"open terminal\" can start one provider without changing the global config.\n\n## Quick start\n\nRequires Node 22.18+ and at least one Host CLI (Claude Code, Codex, Grok Build or pi) installed. AI agents: follow the setup steps in [`llms.txt`](llms.txt) (\"Set up sideby for a user\") instead.\n\n```sh\nnpm i -g sideby\nsideby new claude work        # create ~/.claude-work, sharing ~/.claude's skills and hooks\nsideby login claude:work      # sign in once\nsideby run work               # Claude Code on the work account\nsideby ui                     # every account's quota at http://127.0.0.1:17420\n```\n\n`sideby run claude:main` keeps using `~/.claude` in another terminal at the same time. Arguments after `--` go to the Host: `sideby run work -- --resume`. To try it without installing, run `npx sideby`.\n\n## Set up with your AI agent\n\nPaste this into Claude Code, Codex or any coding agent:\n\n```text\nInstall the sideby CLI (npm package `sideby`) and its agent skill, then set up a second Claude Code account for me.\nFollow \"Set up sideby for a user\" in https://raw.githubusercontent.com/Adonis0123/sideby/main/llms.txt\n```\n\nThe agent checks Node and your Host CLIs, installs sideby and the skill, creates the account, tells you what it shares with your main one and makes its short command work. You sign in once in your browser; the agent gives you that one command. Once the skill is installed, short requests work too: \"add another Claude account, cc008\", \"what do my Codex accounts share?\", \"which account still has quota?\".\n\n## What it looks like\n\n<img alt=\"Two terminals: the personal account and the work account running at the same time, both linked to the main account's skills and settings, then the local quota panel, and at 95% Auto Handoff moving work's session to the next account\" src=\"https://raw.githubusercontent.com/Adonis0123/sideby/main/docs/assets/demo.gif\" width=\"1280\">\n\n<picture>\n  <source media=\"(prefers-color-scheme: dark)\" srcset=\"https://raw.githubusercontent.com/Adonis0123/sideby/main/docs/assets/panel-dark.png\">\n  <source media=\"(prefers-color-scheme: light)\" srcset=\"https://raw.githubusercontent.com/Adonis0123/sideby/main/docs/assets/panel.png\">\n  <img alt=\"sideby panel: every account's 5h and 7d quota, 7-day token usage and health in one page\" src=\"https://raw.githubusercontent.com/Adonis0123/sideby/main/docs/assets/panel.png\" width=\"1280\">\n</picture>\n\n## What else it does\n\n| You want to | Run | Guide |\n|---|---|---|\n| Add an API key account (DeepSeek, a gateway, …) | `sideby new claude deepseek --api` | [API accounts](docs/guide/usage.md#api-accounts) |\n| Find and fix config drift between accounts | `sideby doctor --fix` | [Doctor](docs/guide/usage.md#doctor) |\n| See Claude quota (Codex needs no setup) | `sideby quota setup claude --yes` | [Claude quota](docs/guide/usage.md#claude-quota) |\n| Find the cheapest auto-compact size from your own sessions, and use it in one click | `sideby tune` (or the panel's Context tuning tab) | [Context tuning](docs/guide/usage.md#context-tuning) |\n| See each account's model and effort, and set them per account | `sideby model <account>` (or click the model in the panel) | [Model and effort](docs/guide/usage.md#model-and-effort) |\n| Move on when an account hits its limit | `sideby next claude` | [Handoff](docs/guide/usage.md#when-an-account-hits-its-limit) |\n| Let a running task move to the next account by itself when quota runs low (off by default; see the risk) | `sideby handoff enable` (or the panel) | [Auto Handoff](docs/guide/usage.md#auto-handoff) |\n| Short commands such as `ccw` | `sideby alias add ccw claude:work` | [Shell functions](docs/guide/configuration.md#shell-functions) |\n| Reopen a session from Orca and the like in the account that holds it | `\"resumeRouting\": true` in config | [Resuming from other tools](docs/guide/configuration.md#resuming-from-other-tools) |\n| Open Claude Desktop or the Codex app as one account, several side by side (macOS) | `sideby desktop claude:work` (or the panel) | [Desktop apps](docs/guide/usage.md#desktop-apps) |\n| Open the panel from the Dock or app menu | `sideby app install` | [Panel app](docs/guide/panel.md#panel-app) |\n| Show the panel inside your own local page | `createPanelHandler()` | [Embed the panel](docs/guide/panel.md#embed-the-panel) |\n| Add a Host or a pre-launch check | a local plugin | [Plugins](docs/guide/plugins.md) |\n\n## Supported hosts\n\n| Host | Account directories | Sign-in | Quota | Usage (7 days) |\n|---|---|---|---|---|\n| Claude Code | `~/.claude`, `~/.claude-<name>` | `claude auth login` | ✓ after `quota setup claude` | ✓ |\n| Codex CLI | `~/.codex`, `~/.codex-<name>` | `codex login` | ✓ | ✓ |\n| Grok Build | `~/.grok`, `~/.grok-<name>` | `grok login` | no public source | no public source |\n| pi | `~/.pi/agent`, `~/.pi-<name>/agent` | `/login` inside pi | no public source | no public source |\n\nsideby starts the official binary on your `PATH` and never patches it. Tested versions and per-Host notes are in the [guide](docs/guide/usage.md#host-notes).\n\n## Platforms\n\nmacOS and Linux. CI runs the suite on `ubuntu-latest` and `macos-latest`, Node 22 and 24. **Windows is untested.** `sideby app` only installs a launcher on macOS and Linux. Linked items are symlinks, `sideby shell-init` prints bash and zsh functions, and the Claude quota wrapper runs `/bin/sh`.\n\n## Roadmap\n\n**Gemini CLI.** Gemini can point at another config directory with `GEMINI_CONFIG_DIR`. Older docs use `GEMINI_CLI_HOME`; current builds treat that name as deprecated, and exit on startup if it is set together with an exact directory override. A sideby family still needs a tested Gemini version, a login check that does not read tokens, and a list of which files to link or copy. That is more than a small patch, so it is not in this version.\n\n## Safe by design\n\n- It never edits a Host's global config to switch accounts. It moves a task to another account only when you turn on Auto Handoff, and never proxies requests or pools logins.\n- It never reads, prints or sends a credential value. Nothing leaves your machine: sideby calls no remote service.\n- `doctor --fix` never replaces a real file and never changes where a link points.\n\nDetails and the terms-of-service question are in the [FAQ](docs/guide/faq.md).\n\nUsage questions and ideas go in [Discussions](https://github.com/Adonis0123/sideby/discussions).\n\n## Docs\n\n- [Using sideby](docs/guide/usage.md): accounts, API accounts, Doctor, quota, Handoff, Host notes\n- [Commands](docs/guide/commands.md): every command, exit codes and `--json`\n- [Configuration](docs/guide/configuration.md): `config.json`, aliases, shell functions\n- [Panel](docs/guide/panel.md): the panel, panel app and embedding\n- [Plugins](docs/guide/plugins.md): write your own Family or launch hook\n- [FAQ](docs/guide/faq.md): terms of service, data locations, alternatives, uninstall\n- [Changelog](https://github.com/Adonis0123/sideby/releases)\n\n## For AI agents\n\n- [`llms.txt`](llms.txt): setup steps, commands, JSON contract and plugin API in one index. `sideby families --json` states what each Host's accounts share.\n- [`skills/sideby/SKILL.md`](skills/sideby/SKILL.md): one Agent Skill for seeing, repairing and creating accounts and for moving on when one hits its limit. Install with `npx skills add Adonis0123/sideby -g`; `sideby doctor` warns when the installed copy is for another sideby version.\n- [`AGENTS.md`](AGENTS.md): rules for agents working on this repository.\n\n## License\n\n[MIT](LICENSE)\n"
+  "readme": "<p align=\"center\">\n  <img alt=\"sideby: work, personal and API-key accounts, one terminal each, one shared config\" src=\"https://raw.githubusercontent.com/Adonis0123/sideby/main/docs/assets/banner.jpg\" width=\"880\">\n</p>\n\n<p align=\"center\">\n  <b>Run work, personal and API-key accounts at the same time, without their configs drifting apart.</b><br>\n  Each account is its own directory and its own terminal. Skills, hooks and settings stay linked to your main account. Claude Code, Codex, Grok Build and pi.\n</p>\n\n<p align=\"center\">\n  <a href=\"https://www.npmjs.com/package/sideby\"><img alt=\"npm\" src=\"https://img.shields.io/npm/v/sideby\"></a>\n  <a href=\"https://github.com/Adonis0123/sideby/actions/workflows/ci.yml\"><img alt=\"CI\" src=\"https://github.com/Adonis0123/sideby/actions/workflows/ci.yml/badge.svg\"></a>\n  <img alt=\"Node 22.18+\" src=\"https://img.shields.io/badge/node-%E2%89%A522.18-339933\">\n  <a href=\"LICENSE\"><img alt=\"MIT\" src=\"https://img.shields.io/badge/license-MIT-blue\"></a>\n</p>\n\n<p align=\"center\">English | <a href=\"README.zh-CN.md\">中文</a></p>\n\n## Why not just an alias?\n\n`CLAUDE_CONFIG_DIR` plus a shell alias already starts a second account. It does not keep skills and settings in one place, and it does not show quota for every account. [Does this break a provider's terms?](docs/guide/faq.md#terms)\n\n| | At the same time | Skills, hooks, settings | Quota and usage | Setup |\n|---|---|---|---|---|\n| `CLAUDE_CONFIG_DIR` and an alias | Yes. Each terminal exports the variable. | Each directory is its own copy. They drift unless you symlink by hand. | That session's status line | One alias per account |\n| [cc-switch](https://github.com/farion1231/cc-switch) | Enabling a provider writes the host's live config, so open sessions share that switch. | Plugin settings are copied across providers as a separate step. | The active provider, from its quota endpoint | Install the desktop app |\n| sideby | Yes. `sideby run` selects the directory for that process and leaves your shell alone. | Linked to the main account. `sideby doctor --fix` repairs copies. Sign-in and sessions stay separate. | Every account, from local files. Claude needs `quota setup`. | `npm i -g sideby`, then `sideby new` and sign in |\n\ncc-switch's docs describe that switch: it writes the live settings file ([README](https://github.com/farion1231/cc-switch#readme)). [#1105](https://github.com/farion1231/cc-switch/issues/1105) and [#2908](https://github.com/farion1231/cc-switch/issues/2908) ask for several sessions at once. [#1106](https://github.com/farion1231/cc-switch/issues/1106) is closed; the maintainer says Claude Code's \"open terminal\" can start one provider without changing the global config.\n\n## Quick start\n\nRequires Node 22.18+ and at least one Host CLI (Claude Code, Codex, Grok Build or pi) installed. AI agents: follow the setup steps in [`llms.txt`](llms.txt) (\"Set up sideby for a user\") instead.\n\n```sh\nnpm i -g sideby\nsideby new claude work        # create ~/.claude-work, sharing ~/.claude's skills and hooks\nsideby login claude:work      # sign in once\nsideby run work               # Claude Code on the work account\nsideby ui                     # every account's quota at http://127.0.0.1:17420\n```\n\n`sideby run claude:main` keeps using `~/.claude` in another terminal at the same time. Arguments after `--` go to the Host: `sideby run work -- --resume`. To try it without installing, run `npx sideby`.\n\n## Set up with your AI agent\n\nPaste this into Claude Code, Codex or any coding agent:\n\n```text\nInstall the sideby CLI (npm package `sideby`) and its agent skill, then set up a second Claude Code account for me.\nFollow \"Set up sideby for a user\" in https://raw.githubusercontent.com/Adonis0123/sideby/main/llms.txt\n```\n\nThe agent checks Node and your Host CLIs, installs sideby and the skill, creates the account, tells you what it shares with your main one and makes its short command work. You sign in once in your browser; the agent gives you that one command. Once the skill is installed, short requests work too: \"add another Claude account, cc008\", \"what do my Codex accounts share?\", \"which account still has quota?\".\n\n## What it looks like\n\n<img alt=\"Two terminals: the personal account and the work account running at the same time, both linked to the main account's skills and settings, then the local quota panel, and at 95% Auto Handoff moving work's session to the next account\" src=\"https://raw.githubusercontent.com/Adonis0123/sideby/main/docs/assets/demo.gif\" width=\"1280\">\n\n<picture>\n  <source media=\"(prefers-color-scheme: dark)\" srcset=\"https://raw.githubusercontent.com/Adonis0123/sideby/main/docs/assets/panel-dark.png\">\n  <source media=\"(prefers-color-scheme: light)\" srcset=\"https://raw.githubusercontent.com/Adonis0123/sideby/main/docs/assets/panel.png\">\n  <img alt=\"sideby panel: every account's 5h and 7d quota, 7-day token usage and health in one page\" src=\"https://raw.githubusercontent.com/Adonis0123/sideby/main/docs/assets/panel.png\" width=\"1280\">\n</picture>\n\n## What else it does\n\n| You want to | Run | Guide |\n|---|---|---|\n| Add an API key account (DeepSeek, a gateway, …) | `sideby new claude deepseek --api` | [API accounts](docs/guide/usage.md#api-accounts) |\n| Find and fix config drift between accounts | `sideby doctor --fix` | [Doctor](docs/guide/usage.md#doctor) |\n| See Claude quota (Codex needs no setup) | `sideby quota setup claude --yes` | [Claude quota](docs/guide/usage.md#claude-quota) |\n| Find the cheapest auto-compact size from your own sessions, and use it in one click | `sideby tune` (or the panel's Context tuning tab) | [Context tuning](docs/guide/usage.md#context-tuning) |\n| See each account's model and effort, and set them per account | `sideby model <account>` (or click the model in the panel) | [Model and effort](docs/guide/usage.md#model-and-effort) |\n| Stop Claude sessions from connecting to claude.ai by themselves (Remote Control), for every account at once | `sideby remote-control off` (or the panel's banner) | [Remote Control](docs/guide/usage.md#remote-control) |\n| Move on when an account hits its limit | `sideby next claude` | [Handoff](docs/guide/usage.md#when-an-account-hits-its-limit) |\n| Let a running task move to the next account by itself when quota runs low (off by default; see the risk) | `sideby handoff enable` (or the panel) | [Auto Handoff](docs/guide/usage.md#auto-handoff) |\n| Short commands such as `ccw` | `sideby alias add ccw claude:work` | [Shell functions](docs/guide/configuration.md#shell-functions) |\n| Reopen a session from Orca and the like in the account that holds it | `\"resumeRouting\": true` in config | [Resuming from other tools](docs/guide/configuration.md#resuming-from-other-tools) |\n| Open Claude Desktop or the Codex app as one account, several side by side (macOS) | `sideby desktop claude:work` (or the panel) | [Desktop apps](docs/guide/usage.md#desktop-apps) |\n| Open the panel from the Dock or app menu | `sideby app install` | [Panel app](docs/guide/panel.md#panel-app) |\n| Show the panel inside your own local page | `createPanelHandler()` | [Embed the panel](docs/guide/panel.md#embed-the-panel) |\n| Add a Host or a pre-launch check | a local plugin | [Plugins](docs/guide/plugins.md) |\n\n## Supported hosts\n\n| Host | Account directories | Sign-in | Quota | Usage (7 days) |\n|---|---|---|---|---|\n| Claude Code | `~/.claude`, `~/.claude-<name>` | `claude auth login` | ✓ after `quota setup claude` | ✓ |\n| Codex CLI | `~/.codex`, `~/.codex-<name>` | `codex login` | ✓ | ✓ |\n| Grok Build | `~/.grok`, `~/.grok-<name>` | `grok login` | no public source | no public source |\n| pi | `~/.pi/agent`, `~/.pi-<name>/agent` | `/login` inside pi | no public source | no public source |\n\nsideby starts the official binary on your `PATH` and never patches it. Tested versions and per-Host notes are in the [guide](docs/guide/usage.md#host-notes).\n\n## Platforms\n\nmacOS and Linux. CI runs the suite on `ubuntu-latest` and `macos-latest`, Node 22 and 24. **Windows is untested.** `sideby app` only installs a launcher on macOS and Linux. Linked items are symlinks, `sideby shell-init` prints bash and zsh functions, and the Claude quota wrapper runs `/bin/sh`.\n\n## Roadmap\n\n**Gemini CLI.** Gemini can point at another config directory with `GEMINI_CONFIG_DIR`. Older docs use `GEMINI_CLI_HOME`; current builds treat that name as deprecated, and exit on startup if it is set together with an exact directory override. A sideby family still needs a tested Gemini version, a login check that does not read tokens, and a list of which files to link or copy. That is more than a small patch, so it is not in this version.\n\n## Safe by design\n\n- It never edits a Host's global config to switch accounts. It moves a task to another account only when you turn on Auto Handoff, and never proxies requests or pools logins.\n- It never reads, prints or sends a credential value. Nothing leaves your machine: sideby calls no remote service.\n- `doctor --fix` never replaces a real file and never changes where a link points.\n\nDetails and the terms-of-service question are in the [FAQ](docs/guide/faq.md).\n\nUsage questions and ideas go in [Discussions](https://github.com/Adonis0123/sideby/discussions).\n\n## Docs\n\n- [Using sideby](docs/guide/usage.md): accounts, API accounts, Doctor, quota, Handoff, Host notes\n- [Commands](docs/guide/commands.md): every command, exit codes and `--json`\n- [Configuration](docs/guide/configuration.md): `config.json`, aliases, shell functions\n- [Panel](docs/guide/panel.md): the panel, panel app and embedding\n- [Plugins](docs/guide/plugins.md): write your own Family or launch hook\n- [FAQ](docs/guide/faq.md): terms of service, data locations, alternatives, uninstall\n- [Changelog](https://github.com/Adonis0123/sideby/releases)\n\n## For AI agents\n\n- [`llms.txt`](llms.txt): setup steps, commands, JSON contract and plugin API in one index. `sideby families --json` states what each Host's accounts share.\n- [`skills/sideby/SKILL.md`](skills/sideby/SKILL.md): one Agent Skill for seeing, repairing and creating accounts and for moving on when one hits its limit. Install with `npx skills add Adonis0123/sideby -g`; `sideby doctor` warns when the installed copy is for another sideby version.\n- [`AGENTS.md`](AGENTS.md): rules for agents working on this repository.\n\n## License\n\n[MIT](LICENSE)\n"
 }

package/schemas/remote-control.json

@@ -0,0 +1,125 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "sideby/remote-control.json",
+  "type": "object",
+  "required": [
+    "schemaVersion",
+    "action"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "type": "number",
+      "const": 1
+    },
+    "action": {
+      "anyOf": [
+        {
+          "type": "string",
+          "const": "status"
+        },
+        {
+          "type": "string",
+          "const": "off"
+        },
+        {
+          "type": "string",
+          "const": "undo"
+        }
+      ]
+    },
+    "applied": {
+      "type": "boolean",
+      "description": "True once the change was written (or undone)."
+    },
+    "groups": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": [
+          "file",
+          "accounts",
+          "state",
+          "undo"
+        ],
+        "properties": {
+          "file": {
+            "type": "string"
+          },
+          "accounts": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Claude accounts whose settings.json is this file."
+          },
+          "state": {
+            "anyOf": [
+              {
+                "type": "string",
+                "const": "on"
+              },
+              {
+                "type": "string",
+                "const": "default"
+              },
+              {
+                "type": "string",
+                "const": "off"
+              },
+              {
+                "type": "string",
+                "const": "missing"
+              },
+              {
+                "type": "string",
+                "const": "blocked"
+              }
+            ],
+            "description": "on: remoteControlAtStartup is true; default: not set; off: false; missing: no settings.json; blocked: cannot be changed safely (see reason)."
+          },
+          "reason": {
+            "type": "string"
+          },
+          "undo": {
+            "type": "boolean",
+            "description": "sideby turned it off here and can put the earlier value back."
+          }
+        }
+      },
+      "description": "For status, every file; for a preview, the files that would change."
+    },
+    "results": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": [
+          "file",
+          "accounts",
+          "ok",
+          "message"
+        ],
+        "properties": {
+          "file": {
+            "type": "string"
+          },
+          "accounts": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "ok": {
+            "type": "boolean"
+          },
+          "message": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "message": {
+      "type": "string"
+    }
+  },
+  "title": "sideby remote-control [off|undo] --json"
+}

package/skills/sideby/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: sideby
-description: Use when the user runs, or wants to run, several AI coding accounts (Claude Code, Codex, Grok Build, pi) side by side. Covers installing sideby and setting up a new account ("install sideby", "set up another Claude account", "add cc008", "配置一个 cc00x", "再加一个 Codex 账号"), explaining what accounts share and what stays separate ("what do my accounts share?", "这些账号共享了什么"), showing which account a session is ("show [cc001] in the status line", "加上账号标识"), seeing accounts, quota and usage, moving on when one hits its 5-hour or weekly limit, adding a short command (alias), and repairing drifted account directories (skills, hooks, rules or settings not shared, wrong symlinks, credential file permissions). Drives the `sideby` CLI with `--json`; the agent does every step except browser sign-in, filling in secrets and starting interactive sessions, which it hands to the user as one command.
+description: Use when the user runs, or wants to run, several AI coding accounts (Claude Code, Codex, Grok Build, pi) side by side. Covers installing sideby and setting up a new account ("install sideby", "set up another Claude account", "add cc008", "配置一个 cc00x", "再加一个 Codex 账号"), explaining what accounts share and what stays separate ("what do my accounts share?", "这些账号共享了什么"), showing which account a session is ("show [cc001] in the status line", "加上账号标识"), seeing accounts, quota and usage, moving on when one hits its 5-hour or weekly limit, moving the current task to another account ("用 cc008 继续", "交回 cc008"), adding a short command (alias), and repairing drifted account directories (skills, hooks, rules or settings not shared, wrong symlinks, credential file permissions). Drives the `sideby` CLI with `--json`; the agent does every step except browser sign-in, filling in secrets and starting interactive sessions, which it hands to the user as one command (inside an Auto Handoff session, `sideby handoff ready --to` moves the task itself).
 metadata:
-  version: "0.9.2"
+  version: "0.10.0"
   requires:
     bins: [sideby, node]
   cliHelp: sideby --help
@@ -20,7 +20,7 @@ Do every step you can yourself. Only browser sign-in, secrets and interactive se
 - **Never sign in for the user.** Give them `sideby login <ref>` as one line to run in their own terminal (Claude Code: `! sideby login <ref>`). OAuth needs their browser and their decision.
 - **Never put a secret on the command line or in chat.** For API accounts, the user edits `proxy.env` themselves.
 - **Never start a Host session from your shell.** `sideby run`, `sideby next` (without `--dry-run`) and `sideby login` open an interactive session; give the user the command instead.
-- **Never switch, rotate or proxy accounts yourself.** Do not work around sideby by editing config, copying session files or moving credentials. `sideby next` only recommends. Moving a running task on its own is Auto Handoff, which the user turns on: use `sideby handoff enable` (exit 10, then their yes), never hand-edit `config.json`. Inside such a session you may run `sideby handoff ready` when the user asks to hand over.
+- **Never switch, rotate or proxy accounts yourself.** Do not work around sideby by editing config, copying session files or moving credentials. `sideby next` only recommends. Moving a running task on its own is Auto Handoff, which the user turns on: use `sideby handoff enable` (exit 10, then their yes), never hand-edit `config.json`. Inside such a session (the environment has `SIDEBY_HANDOFF_RUN`), when the user wants the task to go on in another account ("用 cc008 继续", "交回 cc008"), do not hand them a command to start it: update the brief, run `sideby handoff ready --to <account>`, tell them the account it prints, and end your turn; sideby starts that account in the same terminal.
 - **Say what you change.** Read-only commands first. What the user asked for (the account they asked to create, its short command, the shell line that makes it work) you do, saying what you do. Changes they did not ask for (`doctor --fix` on other accounts, `quota setup`, `app install`) wait until they have seen the change and agreed.
 - Do not edit Host config files (`settings.json`, `config.toml`, symlinks in account directories) by hand when a `sideby` command does the job.
 
@@ -46,6 +46,7 @@ Account refs are `<family>:<name>`; a bare `<name>` works only when it is unique
 | Create an account with a given name, an API account, or a short command | `sideby new`, `sideby alias add` | `references/accounts.md` |
 | Tune the auto-compact threshold ("which compaction setting costs the fewest tokens"), use the suggestion or undo it | `sideby tune --json`, `sideby tune apply` (exit 10 first), `sideby tune undo` | `references/diagnose.md` |
 | See or set the model and effort an account starts with ("用哪个模型", "set effort to high for cc002") | `sideby model <acct> --json`; `sideby model <acct> <model\|default> --effort <level\|default>` (exit 10 first, then `--yes` after the user agrees) | — |
+| Stop Claude sessions from connecting to claude.ai / the Claude app by themselves ("关闭 remote control", "别让别人远程看到对话") for every account | `sideby remote-control --json`, then `sideby remote-control off` (exits 10 with the change; rerun with `--yes` after they agree); `sideby remote-control undo` puts it back | — |
 | See Claude quota (it shows `not-enabled`) | `sideby quota setup claude` (exits 10) | `references/quota.md` |
 | See everything at once | `sideby ui` (local panel on `127.0.0.1:17420`; `--no-open` prints the address) | — |
 | Start an account | give them `sideby run <ref> [-- host args]` | — |