Sign builds and releases with a stable code identity

swiftc linker-signs only the inner binary, leaving the bundle unsigned
and its codesign identifier as "launcher" rather than the bundle id. More
importantly it leaves the app ad-hoc signed, and macOS pins an ad-hoc
app's Accessibility grant to its exact cdhash instead of to a designated
requirement. Every build mints a new cdhash, so each rebuild-and-replace
silently revoked the permission while the app stayed listed and ticked
under Privacy & Security — and every release did the same to everyone who
updated. That was the root cause of the window tags never appearing.

- build.sh signs the bundle with its real identifier, honours
  SHANNONCOAT_SIGN_IDENTITY, and fails outright rather than falling back
  to ad-hoc when an identity was asked for explicitly.
- The identity is read from a gitignored .env, so it doesn't have to be
  retyped every build. Parsed rather than sourced, so a stray command in
  the file can't execute as a side effect of building, and so an existing
  environment variable still wins. .env.example carries the full one-time
  setup.
- release.yml imports the certificate into a throwaway keychain, builds,
  verifies, and deletes the keychain on if: always(). It stays inert
  until the three secrets exist, and fails the release rather than
  shipping ad-hoc.
- Guards the empty-password case explicitly: macOS cannot import an
  OpenSSL-produced PKCS#12 with an empty password, and reports it as "MAC
  verification failed (wrong password?)", which sends you hunting for a
  wrong password rather than a missing one. Nothing local catches this,
  since the login keychain imports the PEM pair and needs no password.
- Ignores *.p12 and *.pem as a backstop; the certificate belongs outside
  the working tree entirely.

Verified end-to-end: two from-scratch builds produce byte-identical
designated requirements where ad-hoc differs every time, and six
rebuild-reinstall cycles under a real certificate kept the Accessibility
grant with no System Settings interaction.

This buys permission persistence, not Gatekeeper approval — a
self-signed certificate isn't notarized, so downloads still need
System Settings -> Privacy & Security -> Open Anyway.

.env.example

@@ -0,0 +1,118 @@
+# Local build configuration. Copy to `.env` (gitignored) and fill in.
+#
+#   cp .env.example .env
+#
+# build.sh reads `.env` automatically if it exists. Anything already set in
+# the environment wins over this file, so a one-off
+#
+#   SHANNONCOAT_SIGN_IDENTITY= ./build.sh
+#
+# still forces an ad-hoc build without editing anything.
+
+
+# ---------------------------------------------------------------------------
+# Code-signing identity
+# ---------------------------------------------------------------------------
+# The common name of the code-signing certificate in your keychain. Not a
+# secret — it's a label, not a credential — but it lives here so every build
+# picks it up without you having to remember the variable.
+#
+# Why bother signing at all: macOS pins an *ad-hoc* signed app's
+# Accessibility grant to its exact cdhash, which changes on every build. So
+# an unsigned local build silently loses the permission each time you
+# rebuild and reinstall, while still appearing listed and ticked under
+# Privacy & Security → Accessibility. Signing with a certificate gives the
+# app a stable designated requirement, and the grant survives.
+#
+# Leave empty (or delete the line) to build ad-hoc.
+SHANNONCOAT_SIGN_IDENTITY="shannoncoat Signing"
+
+
+# ---------------------------------------------------------------------------
+# Certificate material — only needed to publish the GitHub Actions secrets
+# ---------------------------------------------------------------------------
+# The build itself never reads these: once the certificate is imported, the
+# private key lives in your keychain and codesign finds it by the identity
+# name above. They're recorded here purely so the `gh secret set` commands
+# at the bottom have somewhere to read from.
+#
+# Keep the .p12 OUTSIDE the working tree. A gitignored file is still one
+# `git add -f`, one editor-indexed backup, or one shared folder away from
+# leaking, and this one holds a private key.
+#
+# The $HOME below is expanded by the shell when you `source .env` (which is
+# how the gh commands at the bottom read it). build.sh parses rather than
+# sources this file, so it takes values literally — which costs nothing
+# here, as the only variable it actually reads is the identity above.
+SHANNONCOAT_P12_PATH="$HOME/.shannoncoat-signing/shannoncoat-signing.p12"
+
+# The .p12 export password. Storing it in plaintext here is weaker than
+# leaving it in your password manager and typing it when prompted — prefer
+# leaving this field empty and letting `gh secret set` ask for it
+# interactively.
+#
+# Leaving the *field* empty is fine. Exporting the .p12 itself with an
+# empty password is not: macOS cannot import one, so CI would fail even
+# though local builds carry on working (they import the PEM pair, which
+# needs no password). Give the export a real password.
+SHANNONCOAT_P12_PASSWORD=""
+
+
+# ---------------------------------------------------------------------------
+# One-time setup
+# ---------------------------------------------------------------------------
+# Generate a ten-year self-signed code-signing certificate (codesign refuses
+# an expired one, and replacing it later resets every user's Accessibility
+# permission again):
+#
+#   mkdir -p ~/.shannoncoat-signing && chmod 700 ~/.shannoncoat-signing
+#   openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
+#     -keyout ~/.shannoncoat-signing/key.pem \
+#     -out ~/.shannoncoat-signing/cert.pem \
+#     -subj "/CN=shannoncoat Signing" \
+#     -addext "basicConstraints=critical,CA:false" \
+#     -addext "keyUsage=critical,digitalSignature" \
+#     -addext "extendedKeyUsage=critical,codeSigning"
+#
+# Bundle it as a .p12. `-legacy` is required: OpenSSL 3's default encoding
+# is one macOS cannot read, and `security import` then fails with a
+# misleading "MAC verification failed (wrong password?)".
+#
+#   openssl pkcs12 -export -legacy \
+#     -inkey ~/.shannoncoat-signing/key.pem \
+#     -in ~/.shannoncoat-signing/cert.pem \
+#     -name "shannoncoat Signing" \
+#     -out ~/.shannoncoat-signing/shannoncoat-signing.p12
+#
+# Import for local builds, then delete the now-redundant loose private key
+# (the .p12 remains your only backup, so keep that):
+#
+#   security import ~/.shannoncoat-signing/shannoncoat-signing.p12 \
+#     -k ~/Library/Keychains/login.keychain-db -T /usr/bin/codesign
+#   rm ~/.shannoncoat-signing/key.pem
+#
+# The first signed build raises a "codesign wants to use key…" dialog —
+# choose Always Allow. Then re-grant Accessibility one final time; from
+# then on it persists across rebuilds.
+#
+# Note that `security find-identity -v -p codesigning` will report "0 valid
+# identities": -v filters to *trusted* certificates and a self-signed one
+# reads as CSSMERR_TP_NOT_TRUSTED. codesign uses it regardless. Drop the -v
+# to see it.
+
+
+# ---------------------------------------------------------------------------
+# Publishing the same certificate to GitHub Actions
+# ---------------------------------------------------------------------------
+# Releases need this too — an ad-hoc release revokes the Accessibility
+# permission of everyone who updates. .github/workflows/release.yml stays
+# inert until all three secrets exist, so nothing breaks in the meantime.
+#
+#   source .env
+#   base64 -i "$SHANNONCOAT_P12_PATH" | gh secret set SIGNING_CERTIFICATE_P12
+#   gh secret set SIGNING_IDENTITY --body "$SHANNONCOAT_SIGN_IDENTITY"
+#   gh secret set SIGNING_CERTIFICATE_PASSWORD   # prompts, so it stays out of shell history
+#
+# This buys permission persistence, not Gatekeeper approval: a self-signed
+# certificate isn't notarized, so downloads are still blocked on first open
+# and need System Settings → Privacy & Security → Open Anyway.

.github/workflows/release.yml

@@ -0,0 +1,155 @@
+name: Release
+
+# Two ways in: a manually pushed version tag, or a direct call from
+# tag-on-version-bump.yml (which fires on VERSION changes on main). The
+# workflow_call path exists because pushes made with the default
+# GITHUB_TOKEN don't trigger other workflows' `on.push` — a tag pushed by
+# that workflow wouldn't reach this one's `tags:` trigger on its own.
+on:
+  push:
+    tags:
+      - "*"
+  workflow_call:
+    inputs:
+      tag:
+        required: true
+        type: string
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    runs-on: macos-latest
+    env:
+      # Not a secret (it's just the certificate's common name), and needed
+      # in a step `if:` — where the `secrets` context isn't available, but
+      # `env` is. Empty when signing isn't configured, which every step
+      # below treats as "fall back to ad-hoc".
+      SIGNING_IDENTITY: ${{ secrets.SIGNING_IDENTITY }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+
+      # Releases need a *stable* code identity, not an ad-hoc one. macOS
+      # pins an ad-hoc app's Accessibility grant to its exact cdhash, which
+      # changes on every build — so each release would silently revoke the
+      # permission users had already granted, leaving a stale entry sitting
+      # in System Settings still ticked (and un-fixable by toggling it).
+      # A certificate gives the app a designated requirement that survives
+      # updates instead.
+      #
+      # This does NOT make the app Gatekeeper-clean: a self-signed cert
+      # isn't notarized, so downloads still need right-click → Open. Only
+      # a paid Developer ID plus notarization changes that.
+      #
+      # One-time setup, ideally with the same self-signed certificate used
+      # for local builds (create it with a long validity — codesign refuses
+      # to use an expired cert, and re-signing under a new one resets every
+      # user's permission again):
+      #   security export -k login.keychain -t identities -f pkcs12 \
+      #     -P '<password>' -o cert.p12
+      #   base64 -i cert.p12
+      # then add three repository secrets — SIGNING_CERTIFICATE_P12 (that
+      # base64 blob), SIGNING_CERTIFICATE_PASSWORD, and SIGNING_IDENTITY
+      # (the certificate's common name).
+      #
+      # If you build the .p12 with OpenSSL 3 rather than exporting it, pass
+      # `-legacy`: its default AES-256/SHA-256 PKCS#12 encoding is one the
+      # macOS Security framework can't read, and `security import` fails
+      # with a misleading "MAC verification failed (wrong password?)".
+      - name: Import signing certificate
+        if: env.SIGNING_IDENTITY != ''
+        env:
+          CERT_P12: ${{ secrets.SIGNING_CERTIFICATE_P12 }}
+          CERT_PASSWORD: ${{ secrets.SIGNING_CERTIFICATE_PASSWORD }}
+        run: |
+          set -euo pipefail
+
+          # macOS cannot import an OpenSSL-produced PKCS#12 that has an
+          # empty password — the two disagree over the spec's empty-string
+          # vs. NULL password ambiguity, and `security import` reports it
+          # as "MAC verification failed (wrong password?)", which sends you
+          # hunting for a wrong password rather than a missing one. Say
+          # what's actually wrong instead.
+          #
+          # Easy to hit, because a local build never exercises this: the
+          # local keychain imports the PEM pair directly and needs no
+          # password at all.
+          if [[ -z "${CERT_PASSWORD:-}" ]]; then
+            echo "error: SIGNING_CERTIFICATE_PASSWORD is empty." >&2
+            echo "The .p12 must be exported with a non-empty password; regenerate it with" >&2
+            echo "  openssl pkcs12 -export -legacy -inkey key.pem -in cert.pem -out cert.p12" >&2
+            echo "and update both SIGNING_CERTIFICATE_P12 and SIGNING_CERTIFICATE_PASSWORD." >&2
+            exit 1
+          fi
+
+          KEYCHAIN="$RUNNER_TEMP/signing.keychain-db"
+          KEYCHAIN_PASSWORD="$(uuidgen)"
+          CERT_PATH="$RUNNER_TEMP/cert.p12"
+
+          printf '%s' "$CERT_P12" | base64 --decode > "$CERT_PATH"
+
+          # A dedicated throwaway keychain, not the login one: it starts
+          # unlocked, needs no interactive prompt, and is deleted at the
+          # end of the job regardless of outcome.
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
+
+          security import "$CERT_PATH" -k "$KEYCHAIN" -P "$CERT_PASSWORD" \
+            -T /usr/bin/codesign
+          # Without this, codesign hits an interactive "allow access to
+          # key?" prompt that nothing can answer on a headless runner.
+          security set-key-partition-list -S apple-tool:,apple: \
+            -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN" >/dev/null
+          # codesign only searches keychains on the search list.
+          security list-keychain -d user -s "$KEYCHAIN" login.keychain-db
+
+          rm -f "$CERT_PATH"
+
+      - name: Build shannoncoat.app
+        run: ./build.sh
+        env:
+          # This workflow only ever runs against a tag (see the trigger
+          # comment above) — told to build.sh directly rather than having
+          # it re-derive that via `git describe`, which needs full tag
+          # refs a CI runner's checkout isn't guaranteed to have fetched.
+          SHANNONCOAT_RELEASE_BUILD: "1"
+          # Empty when unconfigured, which build.sh reads as ad-hoc.
+          SHANNONCOAT_SIGN_IDENTITY: ${{ env.SIGNING_IDENTITY }}
+
+      # Catches a release that silently went out ad-hoc — the failure this
+      # whole arrangement exists to prevent, and one that's invisible in
+      # the artifact until someone's permission stops working.
+      - name: Verify signature
+        run: |
+          set -euo pipefail
+          codesign --verify --strict --verbose=2 ".build/shannoncoat.app"
+          codesign -dvvv ".build/shannoncoat.app" 2>&1 \
+            | grep -E 'Identifier=|Authority=|Signature=' || true
+          if [[ -n "$SIGNING_IDENTITY" ]] \
+             && codesign -dvvv ".build/shannoncoat.app" 2>&1 | grep -q 'Signature=adhoc'; then
+            echo "error: signing was configured but the app is still ad-hoc signed" >&2
+            exit 1
+          fi
+
+      - name: Zip app bundle
+        run: ditto -c -k --sequesterRsrc --keepParent ".build/shannoncoat.app" "shannoncoat.app.zip"
+
+      - name: Publish release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ inputs.tag || github.ref_name }}
+          files: |
+            shannoncoat.app.zip
+          generate_release_notes: true
+
+      # `if: always()` so a failed build can't leave the signing key
+      # sitting in a keychain on the runner.
+      - name: Clean up keychain
+        if: always() && env.SIGNING_IDENTITY != ''
+        run: |
+          security list-keychain -d user -s login.keychain-db || true
+          security delete-keychain "$RUNNER_TEMP/signing.keychain-db" || true

.github/workflows/tag-on-version-bump.yml

@@ -0,0 +1,49 @@
+name: Tag on version bump
+
+on:
+  push:
+    branches: [main]
+    paths: ["VERSION"]
+
+permissions:
+  contents: write
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    outputs:
+      tag: ${{ steps.tag.outputs.tag }}
+      created: ${{ steps.tag.outputs.created }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      # Guards against re-tagging on a no-op push (e.g. VERSION edited then
+      # reverted to the same value in a later commit) — only pushes a tag
+      # that doesn't exist yet.
+      - name: Create tag if new
+        id: tag
+        run: |
+          VERSION="$(tr -d '[:space:]' < VERSION)"
+          TAG="$VERSION"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          if git rev-parse "$TAG" >/dev/null 2>&1; then
+            echo "Tag $TAG already exists, skipping."
+            echo "created=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag -a "$TAG" -m "Release $TAG"
+          git push origin "$TAG"
+          echo "created=true" >> "$GITHUB_OUTPUT"
+
+  release:
+    needs: tag
+    if: needs.tag.outputs.created == 'true'
+    uses: ./.github/workflows/release.yml
+    with:
+      tag: ${{ needs.tag.outputs.tag }}
+    permissions:
+      contents: write

.gitignore

@@ -0,0 +1,156 @@
+# Icon generation: raw Claude.app icon assets extracted as source material
+# for icon/generate-icon.swift — the derived composite (icon/AppIcon.icns)
+# is committed, but Anthropic's own unmodified icon files aren't.
+icon/claude-src/
+icon/AppIcon.iconset/
+
+# Session handoff notes — local only, never committed
+CHECKPOINT.md
+
+# Local build configuration, read by build.sh — holds the code-signing
+# identity and, optionally, the certificate password. See .env.example for
+# the shape of it. Never committed.
+.env
+
+# Belt and braces: private key material must never land in the repo, even
+# gitignored. Keep the certificate itself outside the working tree (the
+# setup notes in .env.example use ~/.shannoncoat-signing/) — this pattern
+# only exists to catch a stray copy before it becomes a commit.
+*.p12
+*.pem
+
+# Local reference material (e.g. nested checkouts of other projects) — not
+# part of this project, never meant to be committed.
+.scratch/
+
+# Xcode
+#
+# gitignore contributors: remember to update Global/Xcode.gitignore, Objective-C.gitignore & Swift.gitignore
+
+## User settings
+xcuserdata/
+
+## Obj-C/Swift specific
+*.hmap
+
+## App packaging
+*.ipa
+*.dSYM.zip
+*.dSYM
+
+## Playgrounds
+timeline.xctimeline
+playground.xcworkspace
+
+# Swift Package Manager
+#
+# Add this line if you want to avoid checking in source code from Swift Package Manager dependencies.
+# Packages/
+# Package.pins
+# Package.resolved
+# *.xcodeproj
+#
+# Xcode automatically generates this directory with a .xcworkspacedata file and xcuserdata
+# hence it is not needed unless you have added a package configuration file to your project
+# .swiftpm
+
+.build/
+
+# CocoaPods
+#
+# We recommend against adding the Pods directory to your .gitignore. However
+# you should judge for yourself, the pros and cons are mentioned at:
+# https://guides.cocoapods.org/using/using-cocoapods.html#should-i-check-the-pods-directory-into-source-control
+#
+# Pods/
+#
+# Add this line if you want to avoid checking in source code from the Xcode workspace
+# *.xcworkspace
+
+# Carthage
+#
+# Add this line if you want to avoid checking in source code from Carthage dependencies.
+# Carthage/Checkouts
+
+Carthage/Build/
+
+# fastlane
+#
+# It is recommended to not store the screenshots in the git repo.
+# Instead, use fastlane to re-generate the screenshots whenever they are needed.
+# For more information about the recommended setup visit:
+# https://docs.fastlane.tools/best-practices/source-control/#source-control
+
+fastlane/report.xml
+fastlane/Preview.html
+fastlane/screenshots/**/*.png
+fastlane/test_output
+
+# AI agents and assistants
+#
+# Some common agent instruction and project configuration files are listed
+# below as commented-out examples. They are often intentionally committed and
+# shared with a team, so only uncomment them if they are local-only in your
+# project.
+
+# GEMINI.md
+# WARP.md
+# CRUSH.md
+# QWEN.md
+
+# OpenAI Codex
+# AGENTS.md
+# .codex/
+
+# Aider
+# .aider.input.history
+# .aider.chat.history.md
+# .aider.llm.history
+# .aider.tags.cache.v*
+# .aiderignore
+
+# Claude Code
+.claude/*.local.json
+.claude/**/*.log
+CLAUDE.local.md
+# .claude/
+
+# Gemini CLI
+# gemini-debug.log
+# .gemini-clipboard/
+# .gemini/
+
+# Cursor AI
+# .cursorrules
+# .cursor/
+# .cursor.json
+# .cursor-settings.yaml
+
+# Continue
+# .continue/
+# .continuerc.json
+
+# Cline
+# .cline/
+# .clinerules
+# cline.json
+
+# Other agent/editor project config
+# .warp/
+# .crush/
+# .codeium/
+# .deepseek/
+# .amazon-codewhisperer/
+# .tabnineignore
+# .tabnine/
+
+# GitHub Copilot
+# .github/copilot-instructions.md
+
+# Windsurf Editor
+# .windsurfrules
+# .windsurf/
+
+# Replit AI Development
+# .replit
+# replit.nix

Sources/AppDelegate.swift

@@ -0,0 +1,397 @@
+// Menu bar behavior: title dots, per-profile menu, Manage Profiles window.
+// Reads live state from LiveState (push-based, no polling) and calls
+// ProfileStore/ClaudeControl in-process — no subprocess, no text parsing.
+import AppKit
+import ApplicationServices
+
+final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate, LiveStateDelegate {
+    let statusItem = NSStatusBar.system.statusItem(withLength: NSStatusItem.variableLength)
+    let menu = NSMenu()
+    let liveState = LiveState()
+    private var currentInfos: [ProfileInfo] = []
+    private var collisionAlertShown = false
+    private var windowOverlays: [String: WindowOverlay] = [:]
+    private var pendingWindowOverlays: Set<String> = []
+    private var accessibilityPromptShown = false
+    private var accessibilityRecheckScheduled = false
+    private var activationObserver: NSObjectProtocol?
+
+    func applicationDidFinishLaunching(_ notification: Notification) {
+        menu.delegate = self
+        menu.autoenablesItems = false
+        statusItem.menu = menu
+        statusItem.button?.image = menuBarIcon()
+        statusItem.button?.imagePosition = .imageLeft
+
+        liveState.delegate = self
+        ManageWindowController.shared.onProfilesChanged = { [weak self] in self?.liveState.reconcile() }
+        ManageWindowController.shared.onOverlayStyleChanged = { [weak self] in self?.rebuildWindowOverlays() }
+
+        // Every app activation, not just Claude's — LiveState deliberately
+        // filters to the Claude binary, so on its own it never hears that
+        // some unrelated app came forward, which is exactly when the tags
+        // need to get out of the way.
+        activationObserver = NSWorkspace.shared.notificationCenter.addObserver(
+            forName: NSWorkspace.didActivateApplicationNotification, object: nil, queue: .main
+        ) { [weak self] _ in self?.updateOverlayVisibility() }
+        liveState.reconcile()
+
+        // Launching this app fresh with nothing running means there's no
+        // menu-bar title/dots to click yet — offer a picker up front
+        // instead of leaving the user to discover the dropdown.
+        if currentInfos.filter(\.running).isEmpty {
+            showStartupPicker(currentInfos)
+        }
+
+        UpdateChecker.checkAutomaticallyIfDue()
+    }
+
+    // Claude's own app icon (bundled as Contents/Resources/AppIcon.icns —
+    // currently a placeholder, see icon/generate-icon.swift), scaled down
+    // for the menu bar.
+    private func menuBarIcon() -> NSImage {
+        let source = NSApp.applicationIconImage ?? NSImage(named: NSImage.applicationIconName) ?? NSImage()
+        let resized = NSImage(size: NSSize(width: 18, height: 18))
+        resized.lockFocus()
+        source.draw(in: NSRect(x: 0, y: 0, width: 18, height: 18), from: .zero, operation: .sourceOver, fraction: 1.0)
+        resized.unlockFocus()
+        return resized
+    }
+
+    // MARK: - LiveStateDelegate
+
+    func liveStateDidChange(_ infos: [ProfileInfo]) {
+        collisionAlertShown = false
+        currentInfos = infos
+        applyTitle(infos)
+        ManageWindowController.shared.update(infos)
+        updateWindowOverlays(infos)
+    }
+
+    // Each tag decides for itself whether the window it labels is actually
+    // visible underneath it (see WindowOverlay.isTargetVisible) — this just
+    // says "now would be a good time to look again". Activation is the
+    // usual way a window gets buried or uncovered without moving at all,
+    // which no AX notification reports.
+    private func updateOverlayVisibility() {
+        for overlay in windowOverlays.values { overlay.refreshVisibility() }
+    }
+
+    // macOS doesn't notify an app that it has just been granted
+    // Accessibility, and overlays are otherwise only reconsidered when a
+    // Claude window launches, quits or activates — so a permission granted
+    // while this is running would do nothing visible until the user
+    // happened to touch a Claude window, or restarted the app. Polling for
+    // it costs a cheap local check every couple of seconds, and only while
+    // the permission is actually missing: the moment it lands, the guard in
+    // `updateWindowOverlays` passes and this stops rescheduling itself.
+    //
+    // Also covers a subtler case — replacing the installed bundle and
+    // relaunching immediately can start the app before TCC has settled on
+    // the new copy, and a one-shot check there would strand the tags for
+    // the rest of the session over a denial that was only ever momentary.
+    private func scheduleAccessibilityRecheck() {
+        guard !accessibilityRecheckScheduled else { return }
+        accessibilityRecheckScheduled = true
+        DispatchQueue.main.asyncAfter(deadline: .now() + 2) { [weak self] in
+            guard let self else { return }
+            accessibilityRecheckScheduled = false
+            updateWindowOverlays(currentInfos)
+        }
+    }
+
+    // A style change rewrites the tag's shape and size, which is decided
+    // when its panel is built — so the existing ones are dropped (deinit
+    // tears down each panel and its AXObserver) and rebuilt rather than
+    // patched in place.
+    private func rebuildWindowOverlays() {
+        windowOverlays.removeAll()
+        updateWindowOverlays(currentInfos)
+    }
+
+    // Shown on every running *managed* profile — never on "default",
+    // which isn't a shannoncoat profile at all, just the real underlying
+    // Claude install. Removing an entry here deinits its WindowOverlay,
+    // which tears down its AXObserver and hides the tag panel.
+    private func updateWindowOverlays(_ infos: [ProfileInfo]) {
+        let managed = infos.filter { $0.running && $0.profile.name != "default" }
+        let managedNames = Set(managed.map(\.profile.name))
+        windowOverlays = windowOverlays.filter { managedNames.contains($0.key) }
+        pendingWindowOverlays.formIntersection(managedNames)
+
+        // A tag is positioned entirely from Accessibility data, so without
+        // that permission there is nothing to position: `attach` would
+        // burn its dozen retries per profile and give up without a word,
+        // which reads as "the feature is broken" rather than "macOS said
+        // no". Prompt instead — the same call `ClaudeControl.focus` makes
+        // for the same reason.
+        //
+        // Worth knowing when this bites, because it looks impossible:
+        // a local build gets a fresh code identity every time build.sh
+        // runs, and that silently invalidates an existing grant while
+        // leaving the app still listed *and still ticked* under Privacy &
+        // Security → Accessibility. Re-granting means removing that stale
+        // row with "−" and adding the newly built app back; toggling it
+        // off and on again is not enough. (Note that running the binary
+        // straight out of the bundle from a terminal will appear to work
+        // regardless — it inherits the terminal's grant, not the app's,
+        // so it's useless for testing this.)
+        if !managed.isEmpty, !AXIsProcessTrusted() {
+            if !accessibilityPromptShown {
+                accessibilityPromptShown = true
+                ClaudeControl.promptForAccessibility()
+            }
+            scheduleAccessibilityRecheck()
+            return
+        }
+
+        for info in managed
+        where windowOverlays[info.profile.name] == nil && !pendingWindowOverlays.contains(info.profile.name) {
+            guard let pid = info.pid else { continue }
+            let name = info.profile.name
+            pendingWindowOverlays.insert(name)
+            WindowOverlay.attach(profileName: name, color: ProfileColor.dotColor(for: name), pid: pid) { [weak self] overlay in
+                guard let self else { return }
+                pendingWindowOverlays.remove(name)
+                // The profile may have quit again while this was retrying
+                // for its window — don't attach a stale overlay if so.
+                guard currentInfos.contains(where: { $0.profile.name == name && $0.running }) else { return }
+                windowOverlays[name] = overlay
+                // A tag created while some other app is frontmost must not
+                // appear over it — `attach` can complete seconds after the
+                // launch that triggered it, by which point focus has often
+                // moved on.
+                updateOverlayVisibility()
+            }
+        }
+
+        updateOverlayVisibility()
+    }
+
+    // Two profiles sharing a dir is a fatal misconfiguration (would
+    // silently merge their Claude sessions) — surfaced with an alert
+    // rather than crashing the app outright, since that would leave the
+    // user with no way to fix it short of hand-editing files blind.
+    func liveStateFoundCollisions(_ collisions: [ProfileStore.DirCollision]) {
+        guard !collisionAlertShown else { return }
+        collisionAlertShown = true
+        let lines = collisions.map { "\u{2022} \($0.kind): \"\($0.profileA)\" and \"\($0.profileB)\" both use \($0.dir)" }
+        let alert = NSAlert()
+        alert.alertStyle = .critical
+        alert.messageText = "shannoncoat: configuration error"
+        alert.informativeText = "Two profiles can't share a directory:\n\n" + lines.joined(separator: "\n")
+        alert.addButton(withTitle: "OK")
+        alert.runModal()
+    }
+
+    // Title reflects what's ACTUALLY running — one profile shows as a dot
+    // + name; several show as dots only, to keep the menu bar from growing
+    // unbounded, with the full list available via tooltip and the dropdown.
+    private func applyTitle(_ profiles: [ProfileInfo]) {
+        guard let button = statusItem.button else { return }
+        let running = profiles.filter(\.running)
+        switch running.count {
+        case 0:
+            button.attributedTitle = NSAttributedString(string: "")
+            button.toolTip = "Claude not running"
+        case 1:
+            let name = running[0].profile.name
+            let title = NSMutableAttributedString(
+                string: "\u{25cf} ", attributes: [.foregroundColor: ProfileColor.dotColor(for: name)])
+            title.append(NSAttributedString(string: name, attributes: [.foregroundColor: NSColor.labelColor]))
+            button.attributedTitle = title
+            button.toolTip = nil
+        default:
+            let title = NSMutableAttributedString()
+            for info in running {
+                title.append(NSAttributedString(
+                    string: "\u{25cf}", attributes: [.foregroundColor: ProfileColor.dotColor(for: info.profile.name)]))
+            }
+            button.attributedTitle = title
+            button.toolTip = running.map(\.profile.name).joined(separator: ", ")
+        }
+    }
+
+    // MARK: - Menu
+
+    func menuNeedsUpdate(_ menu: NSMenu) {
+        menu.removeAllItems()
+        liveState.reconcile() // correctness backstop; live updates are the primary mechanism
+        let profiles = currentInfos
+        let runningCount = profiles.filter(\.running).count
+
+        let header = NSMenuItem(
+            title: runningCount == 0 ? "Claude not running"
+                : runningCount == 1 ? "1 profile running" : "\(runningCount) profiles running",
+            action: nil, keyEquivalent: "")
+        header.isEnabled = false
+        menu.addItem(header)
+        menu.addItem(.separator())
+
+        let hint = NSMenuItem(title: "\u{21e7}-click to open alongside", action: nil, keyEquivalent: "")
+        hint.isEnabled = false
+        menu.addItem(hint)
+        menu.addItem(.separator())
+
+        for info in profiles {
+            // Click = exclusive switch (quits every other running profile).
+            // Shift-click = open alongside instead, without disturbing
+            // anything else that's running.
+            let title = info.profile.name == liveState.lastActiveName
+                ? "\(info.profile.name)  \u{21c6}" : info.profile.name
+            let item = NSMenuItem(title: title, action: #selector(pick(_:)), keyEquivalent: "")
+            item.target = self
+            item.representedObject = info.profile.name
+            item.image = ProfileColor.dotImage(for: info.profile.name, dimmed: !info.running)
+            item.state = info.running ? .on : .off
+            item.toolTip = info.running ? "Running — click to focus" : "Click to switch • Shift-click to open alongside"
+            menu.addItem(item)
+        }
+
+        menu.addItem(.separator())
+        let manageItem = NSMenuItem(
+            title: "Manage Profiles\u{2026}", action: #selector(openManageWindow), keyEquivalent: ",")
+        manageItem.keyEquivalentModifierMask = [.command]
+        manageItem.target = self
+        menu.addItem(manageItem)
+
+        let closeItem = NSMenuItem(title: "Close Profile", action: nil, keyEquivalent: "")
+        let closeMenu = NSMenu()
+        let closeable = profiles.filter(\.running)
+        if closeable.isEmpty {
+            let none = NSMenuItem(title: "(none running)", action: nil, keyEquivalent: "")
+            none.isEnabled = false
+            closeMenu.addItem(none)
+        } else {
+            for info in closeable {
+                let mi = NSMenuItem(title: info.profile.name, action: #selector(closeProfile(_:)), keyEquivalent: "")
+                mi.target = self
+                mi.representedObject = info.profile.name
+                closeMenu.addItem(mi)
+            }
+        }
+        closeItem.submenu = closeMenu
+        menu.addItem(closeItem)
+
+        menu.addItem(.separator())
+        let aboutItem = NSMenuItem(title: "About shannoncoat", action: #selector(showAbout), keyEquivalent: "")
+        aboutItem.target = self
+        menu.addItem(aboutItem)
+
+        menu.addItem(.separator())
+        let quitClaudeItem = NSMenuItem(title: "Quit Claude", action: #selector(quitClaude), keyEquivalent: "")
+        quitClaudeItem.target = self
+        menu.addItem(quitClaudeItem)
+
+        let quitSelfItem = NSMenuItem(title: "Quit shannoncoat", action: #selector(quitSelf), keyEquivalent: "q")
+        quitSelfItem.target = self
+        menu.addItem(quitSelfItem)
+    }
+
+    // Shown once at launch when nothing is running. A checklist rather
+    // than a single pick: unlike the menu's click/Shift-click (one
+    // profile, exclusive vs. alongside), there's nothing running yet to be
+    // "alongside" of, so this lets several profiles be selected to start
+    // together in one go.
+    private func showStartupPicker(_ profiles: [ProfileInfo]) {
+        guard !profiles.isEmpty else { return }
+        let alert = NSAlert()
+        alert.messageText = "Start Claude"
+        alert.informativeText = "Nothing is running. Choose which profiles to start:"
+        alert.addButton(withTitle: "Start")
+        alert.addButton(withTitle: "Cancel")
+
+        let rowHeight: CGFloat = 22
+        let container = NSView(frame: NSRect(x: 0, y: 0, width: 240, height: rowHeight * CGFloat(profiles.count)))
+        var checkboxes: [(box: NSButton, name: String)] = []
+        for (i, info) in profiles.enumerated() {
+            let y = rowHeight * CGFloat(profiles.count - 1 - i)
+            let box = NSButton(checkboxWithTitle: info.profile.name, target: nil, action: nil)
+            box.frame = NSRect(x: 0, y: y, width: 240, height: rowHeight)
+            box.state = info.profile.name == liveState.lastActiveName ? .on : .off
+            container.addSubview(box)
+            checkboxes.append((box, info.profile.name))
+        }
+        alert.accessoryView = container
+
+        guard alert.runModal() == .alertFirstButtonReturn else { return }
+
+        for (box, name) in checkboxes where box.state == .on {
+            guard let profile = profiles.first(where: { $0.profile.name == name })?.profile else { continue }
+            liveState.markActive(name)
+            ClaudeControl.launch(profile)
+        }
+        DispatchQueue.main.asyncAfter(deadline: .now() + 0.3) { [weak self] in self?.liveState.reconcile() }
+    }
+
+    // MARK: - Actions
+
+    @objc func pick(_ sender: NSMenuItem) {
+        guard let name = sender.representedObject as? String,
+              let profile = currentInfos.first(where: { $0.profile.name == name })?.profile
+        else { return }
+        liveState.markActive(name)
+        if NSApp.currentEvent?.modifierFlags.contains(.shift) == true {
+            openProfile(profile)
+        } else {
+            switchTo(profile)
+        }
+    }
+
+    private func openProfile(_ profile: ResolvedProfile) {
+        if let pid = ClaudeControl.pid(for: profile) {
+            ClaudeControl.focus(pid: pid) { _ in DispatchQueue.main.async { [weak self] in self?.liveState.reconcile() } }
+        } else {
+            ClaudeControl.launch(profile)
+            // The launch notification usually beats this, but a short
+            // explicit poke keeps the UI snappy even if it doesn't.
+            DispatchQueue.main.asyncAfter(deadline: .now() + 0.3) { [weak self] in self?.liveState.reconcile() }
+        }
+    }
+
+    private func switchTo(_ profile: ResolvedProfile) {
+        let others = currentInfos.filter { $0.running && $0.profile.name != profile.name }
+        guard !others.isEmpty else { openProfile(profile); return }
+        var remaining = others.count
+        for info in others {
+            guard let pid = info.pid else { remaining -= 1; continue }
+            ClaudeControl.quit(pid: pid) { [weak self] _ in
+                remaining -= 1
+                if remaining == 0 {
+                    DispatchQueue.main.async { self?.openProfile(profile) }
+                }
+            }
+        }
+    }
+
+    @objc func closeProfile(_ sender: NSMenuItem) {
+        guard let name = sender.representedObject as? String,
+              let info = currentInfos.first(where: { $0.profile.name == name }), let pid = info.pid
+        else { return }
+        ClaudeControl.quit(pid: pid) { _ in DispatchQueue.main.async { [weak self] in self?.liveState.reconcile() } }
+    }
+
+    @objc func openManageWindow() {
+        ManageWindowController.shared.update(currentInfos)
+        ManageWindowController.shared.show()
+    }
+
+    // About lives as a tab in the same window (see ManageWindow.swift)
+    // rather than the standard NSApp About panel — the standard panel
+    // auto-appends its own "Version X (Y)" line from Info.plist's
+    // CFBundleVersion/CFBundleShortVersionString, which are identical in
+    // this build, so it was showing that duplicated alongside our own
+    // version line.
+    @objc func showAbout() {
+        ManageWindowController.shared.update(currentInfos)
+        ManageWindowController.shared.show(tab: .about)
+    }
+
+    @objc func quitClaude() {
+        ClaudeControl.quitAll { DispatchQueue.main.async { [weak self] in self?.liveState.reconcile() } }
+    }
+
+    @objc func quitSelf() {
+        NSApp.terminate(nil)
+    }
+}

Sources/ClaudeControl.swift

@@ -0,0 +1,240 @@
+// Everything about controlling the Claude process itself: launch, focus,
+// quit. Only two real primitives — launch/focus one profile ("open"), and
+// quit one profile ("close"); "switch" (exclusive) is composed from these
+// two in AppDelegate rather than being a third code path here.
+import AppKit
+import ApplicationServices
+import Foundation
+import UniformTypeIdentifiers
+
+enum ClaudeControl {
+    private static let appPathKey = "ClaudeAppPath"
+
+    // Both places an app legitimately lives on macOS: the machine-wide
+    // /Applications and a per-user ~/Applications. Checked in that order,
+    // after any location the user has pointed us at themselves.
+    private static var candidatePaths: [String] {
+        [
+            "/Applications/Claude.app",
+            FileManager.default.homeDirectoryForCurrentUser
+                .appendingPathComponent("Applications/Claude.app").path,
+        ]
+    }
+
+    private static var cachedAppPath: String?
+
+    // Resolved once per launch, because this is consulted on every process
+    // enumeration — which happens on every workspace notification.
+    static var appPath: String {
+        if let cachedAppPath { return cachedAppPath }
+        let resolved = resolveAppPath()
+        cachedAppPath = resolved
+        return resolved
+    }
+
+    static var binaryPath: String { "\(appPath)/Contents/MacOS/Claude" }
+
+    static var isInstalled: Bool { FileManager.default.fileExists(atPath: binaryPath) }
+
+    private static func holdsClaude(_ path: String) -> Bool {
+        FileManager.default.fileExists(atPath: "\(path)/Contents/MacOS/Claude")
+    }
+
+    private static func resolveAppPath() -> String {
+        if let saved = UserDefaults.standard.string(forKey: appPathKey), holdsClaude(saved) {
+            return saved
+        }
+        if let found = candidatePaths.first(where: holdsClaude) {
+            return found
+        }
+        // Found nothing. Report against the standard location anyway, so
+        // anything that surfaces this path names somewhere meaningful
+        // rather than an empty string.
+        return candidatePaths[0]
+    }
+
+    // For an install in neither standard location. Modal by nature, but only
+    // ever reached from an explicit user action that can't proceed without
+    // an answer — better than a menu click that silently does nothing.
+    @discardableResult
+    static func promptForAppLocation() -> Bool {
+        let panel = NSOpenPanel()
+        panel.message = "Couldn't find Claude in Applications. Choose Claude.app to continue."
+        panel.prompt = "Choose"
+        panel.canChooseFiles = true
+        panel.canChooseDirectories = false
+        panel.allowsMultipleSelection = false
+        panel.allowedContentTypes = [.application]
+        panel.directoryURL = URL(fileURLWithPath: "/Applications")
+        NSApp.activate(ignoringOtherApps: true)
+
+        guard panel.runModal() == .OK, let url = panel.url else { return false }
+        guard holdsClaude(url.path) else {
+            let alert = NSAlert()
+            alert.alertStyle = .warning
+            alert.messageText = "That doesn't look like Claude."
+            alert.informativeText = "\(url.lastPathComponent) doesn't contain a Claude executable."
+            alert.runModal()
+            return false
+        }
+
+        UserDefaults.standard.set(url.path, forKey: appPathKey)
+        cachedAppPath = url.path
+        return true
+    }
+
+    static func runningInstances() -> [RunningClaude] {
+        ProcessInspector.listRunningClaude(binaryPath: binaryPath)
+    }
+
+    static func pid(for profile: ResolvedProfile) -> pid_t? {
+        let dir = profile.name == "default" ? nil : profile.appDir
+        return ProcessInspector.pid(forUserDataDir: dir, binaryPath: binaryPath)
+    }
+
+    // MARK: - Launch
+
+    @discardableResult
+    static func launch(_ profile: ResolvedProfile) -> Bool {
+        // Ask once rather than fail silently: a launch that does nothing
+        // gives the user no way to work out that Claude simply isn't where
+        // this expected it to be.
+        if !isInstalled, !promptForAppLocation() { return false }
+
+        let process = Process()
+        process.executableURL = URL(fileURLWithPath: binaryPath)
+        process.standardOutput = FileHandle.nullDevice
+        process.standardError = FileHandle.nullDevice
+
+        if profile.name != "default" {
+            try? FileManager.default.createDirectory(atPath: profile.codeDir, withIntermediateDirectories: true)
+            try? FileManager.default.createDirectory(atPath: profile.appDir, withIntermediateDirectories: true)
+            var env = ProcessInfo.processInfo.environment
+            env["CLAUDE_CONFIG_DIR"] = profile.codeDir
+            process.environment = env
+            process.arguments = ["--user-data-dir=\(profile.appDir)"]
+        }
+
+        do {
+            try process.run()
+            return true
+        } catch {
+            return false
+        }
+    }
+
+    // MARK: - Focus
+
+    // Robust focus: unhide, un-minimize, raise across Spaces via the
+    // Accessibility API directly (replacing the old AppleScript/System
+    // Events call), then NSRunningApplication.activate() as a second push.
+    // Waits briefly for a window to exist if the process was just launched,
+    // rather than giving up immediately. Best-effort by design (a focus
+    // request shouldn't be able to crash or block the caller), but no
+    // longer silent about the one failure that's actually actionable:
+    // Accessibility not granted.
+    static func focus(_ profile: ResolvedProfile, completion: @escaping (Bool) -> Void) {
+        guard let pid = pid(for: profile) else { completion(false); return }
+        focus(pid: pid, completion: completion)
+    }
+
+    static func focus(pid: pid_t, completion: @escaping (Bool) -> Void) {
+        if !AXIsProcessTrusted() {
+            promptForAccessibility()
+        }
+        guard let app = NSRunningApplication(processIdentifier: pid) else { completion(false); return }
+        if app.isHidden { app.unhide() }
+
+        let axApp = AXUIElementCreateApplication(pid)
+        waitForWindow(axApp: axApp, attemptsRemaining: 12) { window in
+            if let window {
+                setMinimized(window, false)
+                AXUIElementPerformAction(window, kAXRaiseAction as CFString)
+            }
+            app.activate()
+            completion(window != nil)
+        }
+    }
+
+    private static func waitForWindow(
+        axApp: AXUIElement, attemptsRemaining: Int, completion: @escaping (AXUIElement?) -> Void
+    ) {
+        if let window = firstWindow(of: axApp) {
+            completion(window)
+        } else if attemptsRemaining <= 0 {
+            completion(nil)
+        } else {
+            DispatchQueue.main.asyncAfter(deadline: .now() + 0.25) {
+                waitForWindow(axApp: axApp, attemptsRemaining: attemptsRemaining - 1, completion: completion)
+            }
+        }
+    }
+
+    private static func firstWindow(of axApp: AXUIElement) -> AXUIElement? {
+        var value: CFTypeRef?
+        guard AXUIElementCopyAttributeValue(axApp, kAXWindowsAttribute as CFString, &value) == .success,
+              let windows = value as? [AXUIElement], let first = windows.first
+        else { return nil }
+        return first
+    }
+
+    private static func setMinimized(_ window: AXUIElement, _ minimized: Bool) {
+        AXUIElementSetAttributeValue(window, kAXMinimizedAttribute as CFString, minimized as CFTypeRef)
+    }
+
+    static func promptForAccessibility() {
+        let options = [kAXTrustedCheckOptionPrompt.takeUnretainedValue(): true] as CFDictionary
+        _ = AXIsProcessTrustedWithOptions(options)
+    }
+
+    // MARK: - Quit
+
+    enum QuitResult { case exited, blockedByOwnDialog, forceKilled, alreadyGone }
+
+    // Fixes a real bug in the old shell version: it waited a flat 5s then
+    // unconditionally SIGKILLed, which would kill Claude out from under its
+    // own "unsaved work" / "generation in progress" confirmation if it
+    // showed one. `.terminate()` is a request the target can legitimately
+    // delay or decline (it can return `.terminateCancel` from its own
+    // applicationShouldTerminate:), not a command it's forced to obey — so
+    // this waits much longer, and if Claude still has a window up at the
+    // end of that window (a sign it's showing its own dialog, or otherwise
+    // isn't done with something) it stops short of forceTerminate and
+    // reports that back instead of killing underneath it.
+    static func quit(pid: pid_t, completion: @escaping (QuitResult) -> Void) {
+        guard let app = NSRunningApplication(processIdentifier: pid) else { completion(.alreadyGone); return }
+        app.terminate()
+        pollForExit(app: app, attemptsRemaining: 40, completion: completion) // 40 * 0.25s = 10s grace period
+    }
+
+    static func quitAll(completion: @escaping () -> Void) {
+        let pids = runningInstances().map(\.pid)
+        guard !pids.isEmpty else { completion(); return }
+        var remaining = pids.count
+        for pid in pids {
+            quit(pid: pid) { _ in
+                remaining -= 1
+                if remaining == 0 { completion() }
+            }
+        }
+    }
+
+    private static func pollForExit(
+        app: NSRunningApplication, attemptsRemaining: Int, completion: @escaping (QuitResult) -> Void
+    ) {
+        if app.isTerminated {
+            completion(.exited)
+        } else if attemptsRemaining <= 0 {
+            if firstWindow(of: AXUIElementCreateApplication(app.processIdentifier)) != nil {
+                completion(.blockedByOwnDialog)
+            } else {
+                app.forceTerminate()
+                completion(.forceKilled)
+            }
+        } else {
+            DispatchQueue.main.asyncAfter(deadline: .now() + 0.25) {
+                pollForExit(app: app, attemptsRemaining: attemptsRemaining - 1, completion: completion)
+            }
+        }
+    }
+}

Sources/LaunchAtLogin.swift

@@ -0,0 +1,21 @@
+// Thin wrapper around the modern login-item API, toggled from the Manage
+// window's Settings tab. Standard, expected baseline behavior for a
+// persistent menu-bar utility that's otherwise easy to forget to reopen
+// after a restart.
+import ServiceManagement
+
+enum LaunchAtLogin {
+    static var isEnabled: Bool {
+        SMAppService.mainApp.status == .enabled
+    }
+
+    static func enable() throws {
+        guard SMAppService.mainApp.status != .enabled else { return }
+        try SMAppService.mainApp.register()
+    }
+
+    static func disable() throws {
+        guard SMAppService.mainApp.status == .enabled else { return }
+        try SMAppService.mainApp.unregister()
+    }
+}

Sources/LiveState.swift

@@ -0,0 +1,87 @@
+// Keeps the menu bar in sync with reality without ever polling. Registers
+// NSWorkspace notifications for launch/terminate/activate/hide/unhide,
+// filtered to Claude's own binary, and reconciles an in-memory
+// [ProfileInfo] the instant one fires (sub-second, push-based) — this is
+// what makes external changes (Force Quit, Spotlight, Dock, a hand quit)
+// show up immediately instead of needing a menu click or an app restart.
+import AppKit
+import Foundation
+
+struct ProfileInfo {
+    let profile: ResolvedProfile
+    let running: Bool
+    let pid: pid_t?
+}
+
+protocol LiveStateDelegate: AnyObject {
+    func liveStateDidChange(_ infos: [ProfileInfo])
+    func liveStateFoundCollisions(_ collisions: [ProfileStore.DirCollision])
+}
+
+final class LiveState {
+    weak var delegate: LiveStateDelegate?
+
+    // Best-effort "last switched to" pointer for the ⇆ marker in the menu —
+    // reflects profiles opened/switched through this app; there's no
+    // ordered history to fall back through if that one gets hand-quit
+    // (matches the "don't overdo it" brief — reality-vs-stopped state is
+    // still always ground-truth, this only affects the ⇆ hint).
+    private(set) var lastActiveName = "default"
+
+    private var observers: [NSObjectProtocol] = []
+
+    init() {
+        let center = NSWorkspace.shared.notificationCenter
+        let names: [Notification.Name] = [
+            NSWorkspace.didLaunchApplicationNotification,
+            NSWorkspace.didTerminateApplicationNotification,
+            NSWorkspace.didActivateApplicationNotification,
+            NSWorkspace.didHideApplicationNotification,
+            NSWorkspace.didUnhideApplicationNotification,
+        ]
+        observers = names.map { name in
+            center.addObserver(forName: name, object: nil, queue: .main) { [weak self] note in
+                self?.handle(note)
+            }
+        }
+        // Deliberately not calling reconcile() here — `delegate` is set by
+        // the caller right after init, and the caller does the first
+        // reconcile itself once it's ready to receive the callback.
+    }
+
+    deinit {
+        let center = NSWorkspace.shared.notificationCenter
+        observers.forEach { center.removeObserver($0) }
+    }
+
+    private func handle(_ note: Notification) {
+        guard let app = note.userInfo?[NSWorkspace.applicationUserInfoKey] as? NSRunningApplication,
+              app.executableURL?.path == ClaudeControl.binaryPath
+        else { return }
+        reconcile()
+    }
+
+    func markActive(_ name: String) {
+        lastActiveName = name
+    }
+
+    // Public so callers (menu open, right after a command completes) can
+    // force an immediate reconcile as a correctness backstop, without that
+    // being the primary update mechanism.
+    func reconcile() {
+        let profiles = ProfileStore.loadAll()
+        let collisions = ProfileStore.findCollisions(among: profiles)
+        guard collisions.isEmpty else {
+            delegate?.liveStateFoundCollisions(collisions)
+            return
+        }
+
+        let running = ClaudeControl.runningInstances()
+        let infos = profiles.map { profile -> ProfileInfo in
+            let dir = profile.name == "default" ? nil : profile.appDir
+            let match = running.first { $0.userDataDir == dir }
+            return ProfileInfo(profile: profile, running: match != nil, pid: match?.pid)
+        }
+        delegate?.liveStateDidChange(infos)
+    }
+}

Sources/ManageWindow.swift

@@ -0,0 +1,702 @@
+// One ordinary, non-modal window for everything profile-management related
+// — replaces what would otherwise be a string of separate popup alerts.
+// Opened from the menu bar's "Manage Profiles…" item or the standard
+// Cmd+, shortcut. Fixed-size (not user-resizable) — each tab reports its
+// own natural size via preferredContentSize, and NSTabViewController
+// resizes the window to match automatically, so it's never left showing
+// empty space sized for a different tab or state.
+import AppKit
+
+final class ManageWindowController: NSWindowController {
+    static let shared = ManageWindowController()
+
+    enum Tab: Int { case profiles = 0, settings = 1, about = 2 }
+
+    private let profilesVC = ProfilesViewController()
+    private let settingsVC = SettingsViewController()
+    private let aboutVC = AboutViewController()
+    private let tabs = NSTabViewController()
+
+    // Called after a profile is added/removed so the caller can trigger an
+    // immediate LiveState reconcile instead of waiting on the next
+    // notification.
+    var onProfilesChanged: (() -> Void)? {
+        didSet { profilesVC.onChange = onProfilesChanged }
+    }
+
+    // Called when the window-tag style changes, so open tags can be
+    // rebuilt in the new style immediately rather than at the next
+    // launch/quit of a Claude window.
+    var onOverlayStyleChanged: (() -> Void)? {
+        didSet { settingsVC.onOverlayStyleChanged = onOverlayStyleChanged }
+    }
+
+    private init() {
+        let window = NSWindow(
+            contentRect: NSRect(x: 0, y: 0, width: 420, height: 260),
+            styleMask: [.titled, .closable, .miniaturizable],
+            backing: .buffered, defer: false)
+        window.title = "shannoncoat"
+        window.isReleasedWhenClosed = false
+        window.center()
+
+        profilesVC.title = "Profiles"
+        settingsVC.title = "Settings"
+        aboutVC.title = "About"
+        tabs.addTabViewItem(NSTabViewItem(viewController: profilesVC))
+        tabs.addTabViewItem(NSTabViewItem(viewController: settingsVC))
+        tabs.addTabViewItem(NSTabViewItem(viewController: aboutVC))
+        window.contentViewController = tabs
+
+        super.init(window: window)
+    }
+
+    required init?(coder: NSCoder) { fatalError("init(coder:) has not been implemented") }
+
+    func show(tab: Tab? = nil) {
+        NSApp.activate(ignoringOtherApps: true)
+        if let tab {
+            tabs.selectedTabViewItemIndex = tab.rawValue
+        }
+        window?.makeKeyAndOrderFront(nil)
+    }
+
+    func update(_ infos: [ProfileInfo]) {
+        profilesVC.update(infos)
+    }
+}
+
+// MARK: - Profiles tab
+
+private final class ProfilesViewController: NSViewController, NSTableViewDataSource, NSTableViewDelegate,
+    NSTextFieldDelegate
+{
+    var onChange: (() -> Void)?
+
+    private var infos: [ProfileInfo] = []
+    private let tableView = NSTableView()
+    private let addRemoveControl = NSSegmentedControl()
+    private let detailStack = NSStackView()
+    private let detailAppValue = NSTextField(labelWithString: "")
+    private let detailCodeValue = NSTextField(labelWithString: "")
+    private let detailAppCopyItem = NSMenuItem(title: "Copy Path", action: #selector(copyDetailPath(_:)), keyEquivalent: "")
+    private let detailCodeCopyItem = NSMenuItem(title: "Copy Path", action: #selector(copyDetailPath(_:)), keyEquivalent: "")
+    private let addForm = NSStackView()
+    private let nameField = NSTextField()
+    private let codeField = NSTextField()
+    private let appField = NSTextField()
+    private let errorLabel = NSTextField(labelWithString: "")
+    private var outerStack: NSStackView!
+    private var scrollHeightConstraint: NSLayoutConstraint!
+
+    private static let margin: CGFloat = 20
+    private static let tableWidth: CGFloat = 340
+    private static let minVisibleRows = 3
+    private static let maxVisibleRows = 8
+
+    override func loadView() {
+        view = NSView(frame: NSRect(x: 0, y: 0, width: 420, height: 260))
+
+        let column = NSTableColumn(identifier: .init("profile"))
+        column.title = "Profile"
+        column.width = 340
+        tableView.addTableColumn(column)
+        tableView.headerView = nil
+        tableView.dataSource = self
+        tableView.delegate = self
+        tableView.rowHeight = 24
+        tableView.usesAlternatingRowBackgroundColors = true
+        tableView.menu = buildContextMenu()
+
+        let scroll = NSScrollView()
+        scroll.documentView = tableView
+        scroll.hasVerticalScroller = true
+        scroll.borderType = .bezelBorder
+        scroll.translatesAutoresizingMaskIntoConstraints = false
+
+        addRemoveControl.segmentCount = 2
+        addRemoveControl.trackingMode = .momentary
+        addRemoveControl.segmentStyle = .smallSquare
+        addRemoveControl.setImage(NSImage(systemSymbolName: "plus", accessibilityDescription: "Add Profile"), forSegment: 0)
+        addRemoveControl.setImage(
+            NSImage(systemSymbolName: "minus", accessibilityDescription: "Remove Profile"), forSegment: 1)
+        addRemoveControl.setWidth(28, forSegment: 0)
+        addRemoveControl.setWidth(28, forSegment: 1)
+        addRemoveControl.setEnabled(false, forSegment: 1)
+        addRemoveControl.setToolTip("Add Profile", forSegment: 0)
+        addRemoveControl.setToolTip("Remove Profile", forSegment: 1)
+        addRemoveControl.target = self
+        addRemoveControl.action = #selector(addRemoveClicked(_:))
+        let buttonRow = NSStackView(views: [addRemoveControl, NSView()])
+        buttonRow.orientation = .horizontal
+        buttonRow.translatesAutoresizingMaskIntoConstraints = false
+
+        buildDetailStack()
+        detailStack.isHidden = true
+        detailStack.translatesAutoresizingMaskIntoConstraints = false
+
+        buildAddForm()
+        addForm.isHidden = true
+        addForm.translatesAutoresizingMaskIntoConstraints = false
+
+        let stack = NSStackView(views: [scroll, buttonRow, detailStack, addForm])
+        stack.orientation = .vertical
+        stack.spacing = 12
+        stack.edgeInsets = NSEdgeInsets(top: Self.margin, left: Self.margin, bottom: Self.margin, right: Self.margin)
+        stack.translatesAutoresizingMaskIntoConstraints = false
+        view.addSubview(stack)
+        outerStack = stack
+        scrollHeightConstraint = scroll.heightAnchor.constraint(equalToConstant: heightForRows(0))
+
+        NSLayoutConstraint.activate([
+            stack.topAnchor.constraint(equalTo: view.topAnchor),
+            stack.leadingAnchor.constraint(equalTo: view.leadingAnchor),
+            stack.trailingAnchor.constraint(equalTo: view.trailingAnchor),
+            stack.bottomAnchor.constraint(equalTo: view.bottomAnchor),
+            scroll.widthAnchor.constraint(equalToConstant: Self.tableWidth),
+            scrollHeightConstraint,
+            // `scroll` is the one arranged subview with a real, absolute
+            // width — everything else in this stack ties its width to
+            // *that*, not to `stack` itself (whose own frame spans
+            // edge-to-edge; edgeInsets only govern how the stack lays out
+            // its children, not its own bounds). Left unconstrained, these
+            // rows have no hard width anywhere in their constraint chain —
+            // NSStackView doesn't fill them to the inset content width by
+            // default, so they end up sized/positioned ambiguously (in
+            // practice: flush against the window edge, sometimes wider
+            // than the window).
+            buttonRow.widthAnchor.constraint(equalTo: scroll.widthAnchor),
+            detailStack.widthAnchor.constraint(equalTo: scroll.widthAnchor),
+            addForm.widthAnchor.constraint(equalTo: scroll.widthAnchor),
+        ])
+
+        updatePreferredSize()
+    }
+
+    // Sized to the actual row count (clamped to a sensible range) rather
+    // than one fixed height — with only a couple of profiles that avoids a
+    // big block of empty striped background below the last row; with many
+    // it caps out and scrolls instead of taking over the window.
+    private func heightForRows(_ count: Int) -> CGFloat {
+        let rows = max(Self.minVisibleRows, min(count, Self.maxVisibleRows))
+        return CGFloat(rows) * tableView.rowHeight + 2
+    }
+
+    // NSTabViewController watches its selected child's preferredContentSize
+    // and resizes the window to match live — so recomputing this after
+    // toggling the add form or the path-details row is what makes the
+    // window grow/shrink to fit instead of sitting at one fixed size with
+    // empty space in the states that don't need it.
+    private func updatePreferredSize() {
+        view.layoutSubtreeIfNeeded()
+        preferredContentSize = outerStack.fittingSize
+    }
+
+    // A second, authoritative recompute after every real layout pass —
+    // explicit calls from action handlers (below) update it eagerly for
+    // responsiveness, but this is the one that can't be thrown off by
+    // metrics not being fully resolved yet at the point an eager call runs.
+    override func viewDidLayout() {
+        super.viewDidLayout()
+        preferredContentSize = outerStack.fittingSize
+    }
+
+    // Shows the selected profile's two dirs — the thing you'd otherwise
+    // have to right-click "Reveal" to find out. Not `.isSelectable` — that
+    // makes a label click-into-edit, and the field editor that appears
+    // draws the *untruncated* string at its full intrinsic width, which
+    // can extend past the window and get clipped by it rather than
+    // wrapping or scrolling cleanly. A tooltip (full path) plus a
+    // right-click "Copy Path" menu covers the same "get the value out"
+    // need without that.
+    private func buildDetailStack() {
+        detailAppCopyItem.target = self
+        detailCodeCopyItem.target = self
+        let appMenu = NSMenu()
+        appMenu.addItem(detailAppCopyItem)
+        let codeMenu = NSMenu()
+        codeMenu.addItem(detailCodeCopyItem)
+
+        for (value, menu) in [(detailAppValue, appMenu), (detailCodeValue, codeMenu)] {
+            value.textColor = .secondaryLabelColor
+            value.font = .systemFont(ofSize: NSFont.smallSystemFontSize)
+            value.lineBreakMode = .byTruncatingMiddle
+            value.setContentCompressionResistancePriority(.defaultLow, for: .horizontal)
+            value.menu = menu
+        }
+
+        let appRow = NSStackView(views: [labeled("Claude Desktop:"), detailAppValue])
+        appRow.orientation = .horizontal
+        appRow.spacing = 8
+        let codeRow = NSStackView(views: [labeled("Claude Code:"), detailCodeValue])
+        codeRow.orientation = .horizontal
+        codeRow.spacing = 8
+
+        detailStack.orientation = .vertical
+        detailStack.alignment = .leading
+        detailStack.spacing = 4
+        [appRow, codeRow].forEach(detailStack.addArrangedSubview)
+        appRow.widthAnchor.constraint(equalTo: detailStack.widthAnchor).isActive = true
+        codeRow.widthAnchor.constraint(equalTo: detailStack.widthAnchor).isActive = true
+    }
+
+    private func buildAddForm() {
+        nameField.placeholderString = "Profile name"
+        nameField.delegate = self
+
+        for field in [codeField, appField] {
+            field.lineBreakMode = .byTruncatingMiddle
+            field.setContentCompressionResistancePriority(.defaultLow, for: .horizontal)
+        }
+
+        codeField.placeholderString = "~/.shannoncoat/data/<name>/code"
+        let codeChoose = NSButton(title: "Choose\u{2026}", target: self, action: #selector(chooseCodeDir))
+        let codeRow = NSStackView(views: [labeled("Claude Code:"), codeField, codeChoose])
+        codeRow.orientation = .horizontal
+        codeRow.spacing = 8
+
+        appField.placeholderString = "~/.shannoncoat/data/<name>/app"
+        let appChoose = NSButton(title: "Choose\u{2026}", target: self, action: #selector(chooseAppDir))
+        let appRow = NSStackView(views: [labeled("Claude Desktop:"), appField, appChoose])
+        appRow.orientation = .horizontal
+        appRow.spacing = 8
+
+        errorLabel.textColor = .systemRed
+        errorLabel.font = .systemFont(ofSize: NSFont.smallSystemFontSize)
+        errorLabel.maximumNumberOfLines = 0
+        errorLabel.lineBreakMode = .byWordWrapping
+
+        let createButton = NSButton(title: "Create", target: self, action: #selector(createProfile))
+        createButton.keyEquivalent = "\r"
+        let cancelButton = NSButton(title: "Cancel", target: self, action: #selector(toggleAddForm))
+        let formButtonRow = NSStackView(views: [NSView(), cancelButton, createButton])
+        formButtonRow.orientation = .horizontal
+        formButtonRow.spacing = 8
+
+        let divider = NSBox()
+        divider.boxType = .separator
+
+        addForm.orientation = .vertical
+        addForm.alignment = .leading
+        addForm.spacing = 10
+        [divider, nameField, codeRow, appRow, errorLabel, formButtonRow].forEach(addForm.addArrangedSubview)
+        divider.widthAnchor.constraint(equalTo: addForm.widthAnchor).isActive = true
+        nameField.widthAnchor.constraint(equalTo: addForm.widthAnchor).isActive = true
+        codeRow.widthAnchor.constraint(equalTo: addForm.widthAnchor).isActive = true
+        appRow.widthAnchor.constraint(equalTo: addForm.widthAnchor).isActive = true
+        formButtonRow.widthAnchor.constraint(equalTo: addForm.widthAnchor).isActive = true
+    }
+
+    // Fixed-width, trailing-aligned label so the fields in a two-row form
+    // (differing label lengths: "Claude Code:" vs "Claude Desktop:") start
+    // at the same x position instead of a ragged left edge.
+    private func labeled(_ text: String) -> NSTextField {
+        let field = NSTextField(labelWithString: text)
+        field.font = .systemFont(ofSize: NSFont.systemFontSize)
+        field.textColor = .secondaryLabelColor
+        field.setContentHuggingPriority(.required, for: .horizontal)
+        field.alignment = .right
+        field.widthAnchor.constraint(equalToConstant: 104).isActive = true
+        return field
+    }
+
+    func update(_ infos: [ProfileInfo]) {
+        self.infos = infos
+        tableView.reloadData()
+        scrollHeightConstraint.constant = heightForRows(infos.count)
+        refreshForSelection()
+    }
+
+    private func refreshForSelection() {
+        let row = tableView.selectedRow
+        guard infos.indices.contains(row) else {
+            addRemoveControl.setEnabled(false, forSegment: 1)
+            detailStack.isHidden = true
+            updatePreferredSize()
+            return
+        }
+        let profile = infos[row].profile
+        addRemoveControl.setEnabled(profile.name != "default", forSegment: 1)
+        detailAppValue.stringValue = profile.appDir
+        detailAppValue.toolTip = profile.appDir
+        detailAppCopyItem.representedObject = profile.appDir
+        detailCodeValue.stringValue = profile.codeDir
+        detailCodeValue.toolTip = profile.codeDir
+        detailCodeCopyItem.representedObject = profile.codeDir
+        detailStack.isHidden = false
+        updatePreferredSize()
+    }
+
+    @objc private func copyDetailPath(_ sender: NSMenuItem) {
+        guard let path = sender.representedObject as? String else { return }
+        NSPasteboard.general.clearContents()
+        NSPasteboard.general.setString(path, forType: .string)
+    }
+
+    // MARK: NSTableViewDataSource / Delegate
+
+    func numberOfRows(in tableView: NSTableView) -> Int { infos.count }
+
+    func tableView(_ tableView: NSTableView, viewFor tableColumn: NSTableColumn?, row: Int) -> NSView? {
+        let identifier = NSUserInterfaceItemIdentifier("profileCell")
+        let info = infos[row]
+        let cell: NSTableCellView
+        if let reused = tableView.makeView(withIdentifier: identifier, owner: self) as? NSTableCellView {
+            cell = reused
+        } else {
+            cell = NSTableCellView()
+            cell.identifier = identifier
+            let imageView = NSImageView()
+            let textField = NSTextField(labelWithString: "")
+            imageView.translatesAutoresizingMaskIntoConstraints = false
+            textField.translatesAutoresizingMaskIntoConstraints = false
+            cell.addSubview(imageView)
+            cell.addSubview(textField)
+            cell.imageView = imageView
+            cell.textField = textField
+            NSLayoutConstraint.activate([
+                imageView.leadingAnchor.constraint(equalTo: cell.leadingAnchor, constant: 6),
+                imageView.centerYAnchor.constraint(equalTo: cell.centerYAnchor),
+                imageView.widthAnchor.constraint(equalToConstant: 10),
+                imageView.heightAnchor.constraint(equalToConstant: 10),
+                textField.leadingAnchor.constraint(equalTo: imageView.trailingAnchor, constant: 8),
+                textField.trailingAnchor.constraint(lessThanOrEqualTo: cell.trailingAnchor, constant: -6),
+                textField.centerYAnchor.constraint(equalTo: cell.centerYAnchor),
+            ])
+        }
+        cell.imageView?.image = ProfileColor.dotImage(for: info.profile.name, dimmed: !info.running)
+
+        let text = NSMutableAttributedString(
+            string: info.profile.name, attributes: [.font: NSFont.systemFont(ofSize: NSFont.systemFontSize)])
+        text.append(NSAttributedString(
+            string: "  \(info.running ? "Running" : "Stopped")",
+            attributes: [
+                .font: NSFont.systemFont(ofSize: NSFont.smallSystemFontSize),
+                .foregroundColor: NSColor.secondaryLabelColor,
+            ]))
+        cell.textField?.attributedStringValue = text
+        return cell
+    }
+
+    func tableViewSelectionDidChange(_ notification: Notification) {
+        refreshForSelection()
+    }
+
+    // MARK: NSTextFieldDelegate — live default-path preview as the name is typed
+
+    func controlTextDidChange(_ obj: Notification) {
+        guard (obj.object as? NSTextField) === nameField else { return }
+        let name = nameField.stringValue.isEmpty ? "<name>" : nameField.stringValue
+        codeField.placeholderString = "~/.shannoncoat/data/\(name)/code"
+        appField.placeholderString = "~/.shannoncoat/data/\(name)/app"
+    }
+
+    // MARK: Actions
+
+    @objc private func addRemoveClicked(_ sender: NSSegmentedControl) {
+        switch sender.selectedSegment {
+        case 0: toggleAddForm()
+        case 1: removeSelected()
+        default: break
+        }
+    }
+
+    @objc private func toggleAddForm() {
+        addForm.isHidden.toggle()
+        if !addForm.isHidden {
+            nameField.stringValue = ""
+            codeField.stringValue = ""
+            appField.stringValue = ""
+            errorLabel.stringValue = ""
+            view.window?.makeFirstResponder(nameField)
+        }
+        updatePreferredSize()
+    }
+
+    @objc private func chooseCodeDir() { choose(into: codeField) }
+    @objc private func chooseAppDir() { choose(into: appField) }
+
+    private func choose(into field: NSTextField) {
+        let panel = NSOpenPanel()
+        panel.canChooseDirectories = true
+        panel.canChooseFiles = false
+        panel.allowsMultipleSelection = false
+        guard let window = view.window else { return }
+        panel.beginSheetModal(for: window) { response in
+            if response == .OK, let url = panel.url {
+                field.stringValue = url.path
+            }
+        }
+    }
+
+    @objc private func createProfile() {
+        let name = nameField.stringValue.trimmingCharacters(in: .whitespacesAndNewlines)
+        let code = codeField.stringValue.trimmingCharacters(in: .whitespacesAndNewlines)
+        let app = appField.stringValue.trimmingCharacters(in: .whitespacesAndNewlines)
+        do {
+            try ProfileStore.create(name: name, codeDir: code.isEmpty ? nil : code, appDir: app.isEmpty ? nil : app)
+            toggleAddForm()
+            onChange?()
+        } catch {
+            errorLabel.stringValue = (error as? LocalizedError)?.errorDescription ?? "\(error)"
+            updatePreferredSize()
+        }
+    }
+
+    @objc private func removeSelected() {
+        let row = tableView.selectedRow
+        guard infos.indices.contains(row) else { return }
+        let info = infos[row]
+        guard info.profile.name != "default", let window = view.window else { return }
+
+        let alert = NSAlert()
+        alert.alertStyle = .warning
+        alert.messageText = "Delete profile \u{201C}\(info.profile.name)\u{201D}?"
+        alert.informativeText = info.running
+            ? "This profile is currently running \u{2014} deleting it will quit Claude first. Its Claude Desktop and Claude Code data stay on disk; only the profile pointer is removed."
+            : "Its Claude Desktop and Claude Code data stay on disk; only the profile pointer is removed."
+        alert.addButton(withTitle: "Delete")
+        alert.addButton(withTitle: "Cancel")
+        alert.buttons.first?.hasDestructiveAction = true
+
+        alert.beginSheetModal(for: window) { [weak self] response in
+            guard response == .alertFirstButtonReturn else { return }
+            let finish = {
+                try? ProfileStore.delete(info.profile.name)
+                self?.onChange?()
+            }
+            if info.running, let pid = info.pid {
+                ClaudeControl.quit(pid: pid) { _ in DispatchQueue.main.async(execute: finish) }
+            } else {
+                finish()
+            }
+        }
+    }
+
+    private func buildContextMenu() -> NSMenu {
+        let menu = NSMenu()
+        let revealCode = NSMenuItem(title: "Reveal Code Folder", action: #selector(revealCodeDir), keyEquivalent: "")
+        revealCode.target = self
+        let revealApp = NSMenuItem(
+            title: "Reveal Desktop Folder", action: #selector(revealAppDir), keyEquivalent: "")
+        revealApp.target = self
+        menu.addItem(revealCode)
+        menu.addItem(revealApp)
+        return menu
+    }
+
+    private func clickedInfo() -> ProfileInfo? {
+        let row = tableView.clickedRow
+        guard infos.indices.contains(row) else { return nil }
+        return infos[row]
+    }
+
+    @objc private func revealCodeDir() {
+        guard let info = clickedInfo() else { return }
+        NSWorkspace.shared.selectFile(nil, inFileViewerRootedAtPath: info.profile.codeDir)
+    }
+
+    @objc private func revealAppDir() {
+        guard let info = clickedInfo() else { return }
+        NSWorkspace.shared.selectFile(nil, inFileViewerRootedAtPath: info.profile.appDir)
+    }
+}
+
+// MARK: - Settings tab
+
+private final class SettingsViewController: NSViewController {
+    private let autoUpdateCheckbox = NSButton(
+        checkboxWithTitle: "Automatically check for updates", target: nil, action: nil)
+    private let launchAtLoginCheckbox = NSButton(checkboxWithTitle: "Launch at Login", target: nil, action: nil)
+    private let checkNowButton = NSButton(title: "Check for Updates\u{2026}", target: nil, action: nil)
+    private let tagStyleLabel = NSTextField(labelWithString: "Window tag:")
+    private let tagStylePopUp = NSPopUpButton(frame: .zero, pullsDown: false)
+    private var tagStyleRow: NSStackView!
+    private var stack: NSStackView!
+
+    var onOverlayStyleChanged: (() -> Void)?
+
+    // Order matches the popup's items, so the selected index maps straight
+    // onto a style without a title-string comparison.
+    private static let tagStyles: [(title: String, style: WindowOverlayStyle)] = [
+        ("Name chip", .chip),
+        ("Colored dot", .dot),
+    ]
+
+    override func loadView() {
+        view = NSView(frame: NSRect(x: 0, y: 0, width: 420, height: 150))
+
+        tagStylePopUp.addItems(withTitles: Self.tagStyles.map(\.title))
+        tagStylePopUp.selectItem(at: Self.tagStyles.firstIndex { $0.style == WindowOverlayPosition.style } ?? 0)
+        tagStylePopUp.target = self
+        tagStylePopUp.action = #selector(changeTagStyle)
+
+        tagStyleRow = NSStackView(views: [tagStyleLabel, tagStylePopUp])
+        tagStyleRow.orientation = .horizontal
+        tagStyleRow.spacing = 8
+
+        launchAtLoginCheckbox.target = self
+        launchAtLoginCheckbox.action = #selector(toggleLaunchAtLogin)
+        launchAtLoginCheckbox.state = LaunchAtLogin.isEnabled ? .on : .off
+
+        autoUpdateCheckbox.target = self
+        autoUpdateCheckbox.action = #selector(toggleAutoUpdate)
+        autoUpdateCheckbox.state = UpdateChecker.automaticCheckEnabled ? .on : .off
+
+        checkNowButton.target = self
+        checkNowButton.action = #selector(checkNow)
+        checkNowButton.bezelStyle = .rounded
+
+        stack = NSStackView(views: [launchAtLoginCheckbox, tagStyleRow, autoUpdateCheckbox, checkNowButton])
+        stack.orientation = .vertical
+        stack.alignment = .leading
+        stack.spacing = 14
+        stack.edgeInsets = NSEdgeInsets(top: 20, left: 20, bottom: 20, right: 20)
+        stack.translatesAutoresizingMaskIntoConstraints = false
+        view.addSubview(stack)
+        NSLayoutConstraint.activate([
+            stack.topAnchor.constraint(equalTo: view.topAnchor),
+            stack.leadingAnchor.constraint(equalTo: view.leadingAnchor),
+            stack.trailingAnchor.constraint(lessThanOrEqualTo: view.trailingAnchor),
+            stack.bottomAnchor.constraint(equalTo: view.bottomAnchor),
+        ])
+
+        updatePreferredSize()
+    }
+
+    override func viewDidLayout() {
+        super.viewDidLayout()
+        updatePreferredSize()
+    }
+
+    // NOT `stack.fittingSize` for the width — that was measured observing
+    // it clip a checkbox's label by a consistent amount regardless of
+    // when it's read (loadView vs. viewDidLayout: same result), so this
+    // isn't a measure-too-early timing issue, it's `NSStackView.fittingSize`
+    // itself undercounting a checkbox's true rendered width. Asking each
+    // control directly for its own `intrinsicContentSize` instead — which
+    // is what AutoLayout itself uses to size an unconstrained control —
+    // sidesteps whatever the stack's own aggregation is getting wrong.
+    private func updatePreferredSize() {
+        // Same reasoning for the tag-style row: summed from its two
+        // controls plus the stack spacing rather than trusting the row's
+        // own fittingSize.
+        let rowWidth = tagStyleLabel.intrinsicContentSize.width
+            + tagStylePopUp.intrinsicContentSize.width + tagStyleRow.spacing
+        let widest = [launchAtLoginCheckbox, autoUpdateCheckbox, checkNowButton]
+            .map(\.intrinsicContentSize.width)
+            .max().map { max($0, rowWidth) } ?? rowWidth
+        preferredContentSize = NSSize(width: widest + 40, height: stack.fittingSize.height)
+    }
+
+    @objc private func changeTagStyle() {
+        let index = tagStylePopUp.indexOfSelectedItem
+        guard Self.tagStyles.indices.contains(index) else { return }
+        WindowOverlayPosition.style = Self.tagStyles[index].style
+        onOverlayStyleChanged?()
+    }
+
+    @objc private func toggleLaunchAtLogin() {
+        do {
+            if launchAtLoginCheckbox.state == .on {
+                try LaunchAtLogin.enable()
+            } else {
+                try LaunchAtLogin.disable()
+            }
+        } catch {
+            launchAtLoginCheckbox.state = LaunchAtLogin.isEnabled ? .on : .off
+            NSAlert(error: error).runModal()
+        }
+    }
+
+    @objc private func toggleAutoUpdate() {
+        UpdateChecker.automaticCheckEnabled = autoUpdateCheckbox.state == .on
+    }
+
+    @objc private func checkNow() {
+        UpdateChecker.checkManually { result in
+            DispatchQueue.main.async {
+                let alert = NSAlert()
+                switch result {
+                case .upToDate:
+                    alert.messageText = "You're up to date."
+                    alert.runModal()
+                case .updateAvailable(let version, let url):
+                    alert.messageText = "shannoncoat \(version) is available"
+                    alert.addButton(withTitle: "View Release")
+                    alert.addButton(withTitle: "Later")
+                    if alert.runModal() == .alertFirstButtonReturn {
+                        NSWorkspace.shared.open(url)
+                    }
+                case .failed:
+                    alert.alertStyle = .warning
+                    alert.messageText = "Couldn't check for updates."
+                    alert.runModal()
+                }
+            }
+        }
+    }
+}
+
+// MARK: - About tab
+
+private let projectAuthor = "bdeshi"
+private let projectHomepage = "https://github.com/bdeshi/shannoncoat"
+
+private final class AboutViewController: NSViewController {
+    private static let contentWidth: CGFloat = 340
+
+    override func loadView() {
+        view = NSView(frame: NSRect(x: 0, y: 0, width: 420, height: 150))
+
+        // Centered within a full-width wrapper rather than centered in the
+        // stack directly — the stack is leading-aligned (for the text
+        // rows below), and its own per-arranged-subview alignment
+        // constraint on the icon would conflict with an added centering
+        // constraint on the icon itself.
+        let icon = NSImageView()
+        icon.image = NSApp.applicationIconImage ?? NSImage(named: NSImage.applicationIconName)
+        icon.translatesAutoresizingMaskIntoConstraints = false
+        let iconContainer = NSView()
+        iconContainer.translatesAutoresizingMaskIntoConstraints = false
+        iconContainer.addSubview(icon)
+        NSLayoutConstraint.activate([
+            icon.widthAnchor.constraint(equalToConstant: 96),
+            icon.heightAnchor.constraint(equalToConstant: 96),
+            icon.topAnchor.constraint(equalTo: iconContainer.topAnchor),
+            icon.bottomAnchor.constraint(equalTo: iconContainer.bottomAnchor),
+            icon.centerXAnchor.constraint(equalTo: iconContainer.centerXAnchor),
+        ])
+
+        let description = NSTextField(wrappingLabelWithString:
+            "Runs multiple Claude Desktop profiles side by side, each paired with its own isolated Claude Code config.")
+        description.font = .systemFont(ofSize: NSFont.systemFontSize)
+
+        let authorField = NSTextField(labelWithString: "Author: \(projectAuthor)")
+        let sourceField = NSTextField(labelWithString: "Source: \(projectHomepage)")
+        let versionField = NSTextField(labelWithString: "Version: \(UpdateChecker.displayVersion)")
+        for field in [authorField, sourceField, versionField] {
+            field.textColor = .secondaryLabelColor
+            field.font = .systemFont(ofSize: NSFont.smallSystemFontSize)
+        }
+
+        let stack = NSStackView(views: [iconContainer, description, authorField, sourceField, versionField])
+        stack.orientation = .vertical
+        stack.alignment = .leading
+        stack.spacing = 10
+        stack.edgeInsets = NSEdgeInsets(top: 20, left: 20, bottom: 20, right: 20)
+        stack.translatesAutoresizingMaskIntoConstraints = false
+        view.addSubview(stack)
+
+        NSLayoutConstraint.activate([
+            stack.topAnchor.constraint(equalTo: view.topAnchor),
+            stack.leadingAnchor.constraint(equalTo: view.leadingAnchor),
+            stack.bottomAnchor.constraint(equalTo: view.bottomAnchor),
+            description.widthAnchor.constraint(equalToConstant: Self.contentWidth),
+            iconContainer.widthAnchor.constraint(equalTo: description.widthAnchor),
+        ])
+
+        view.layoutSubtreeIfNeeded()
+        preferredContentSize = NSSize(width: Self.contentWidth + 40, height: stack.fittingSize.height)
+    }
+}

Sources/ProcessInspector.swift

@@ -0,0 +1,86 @@
+// Enumerates running Claude processes and their --user-data-dir, without
+// spawning pgrep (avoids both the subprocess-per-check overhead and an
+// assumption that /usr/bin/pgrep exists at a fixed path). Uses the same
+// sysctl(KERN_PROC_ALL)/sysctl(KERN_PROCARGS2) technique ps/pgrep use
+// internally for same-user processes — no extra entitlement needed.
+//
+// Called on demand from live-state notification handlers (see AppDelegate),
+// never on a timer.
+import Darwin
+import Foundation
+
+struct RunningClaude {
+    let pid: pid_t
+    // nil means launched with no --user-data-dir flag at all (i.e. the
+    // "default" profile).
+    let userDataDir: String?
+}
+
+enum ProcessInspector {
+    static func listRunningClaude(binaryPath: String) -> [RunningClaude] {
+        allPIDs().compactMap { pid in
+            guard let info = execInfo(pid: pid), info.execPath == binaryPath else { return nil }
+            let flagPrefix = "--user-data-dir="
+            let dir = info.args.first(where: { $0.hasPrefix(flagPrefix) }).map { String($0.dropFirst(flagPrefix.count)) }
+            return RunningClaude(pid: pid, userDataDir: dir)
+        }
+    }
+
+    static func pid(forUserDataDir dir: String?, binaryPath: String) -> pid_t? {
+        listRunningClaude(binaryPath: binaryPath).first { $0.userDataDir == dir }?.pid
+    }
+
+    private static func allPIDs() -> [pid_t] {
+        var mib: [Int32] = [CTL_KERN, KERN_PROC, KERN_PROC_ALL, 0]
+        var size = 0
+        guard sysctl(&mib, 4, nil, &size, nil, 0) == 0, size > 0 else { return [] }
+
+        let capacity = size / MemoryLayout<kinfo_proc>.stride + 1
+        var procs = [kinfo_proc](repeating: kinfo_proc(), count: capacity)
+        var actualSize = capacity * MemoryLayout<kinfo_proc>.stride
+        guard sysctl(&mib, 4, &procs, &actualSize, nil, 0) == 0 else { return [] }
+
+        let actualCount = actualSize / MemoryLayout<kinfo_proc>.stride
+        return procs[0..<actualCount].map { $0.kp_proc.p_pid }
+    }
+
+    private struct ExecInfo { let execPath: String; let args: [String] }
+
+    // KERN_PROCARGS2 buffer layout: argc (Int32), then the exec path
+    // (NUL-terminated, followed by NUL padding), then argv[0..<argc] each
+    // NUL-terminated, then envp (which we don't read). Same layout `ps`
+    // itself parses.
+    private static func execInfo(pid: pid_t) -> ExecInfo? {
+        var mib: [Int32] = [CTL_KERN, KERN_PROCARGS2, pid]
+        var size = 0
+        guard sysctl(&mib, 3, nil, &size, nil, 0) == 0, size > MemoryLayout<Int32>.size else { return nil }
+
+        var buffer = [UInt8](repeating: 0, count: size)
+        guard sysctl(&mib, 3, &buffer, &size, nil, 0) == 0 else { return nil }
+
+        var argc = Int32(0)
+        withUnsafeMutableBytes(of: &argc) { dst in
+            dst.copyBytes(from: buffer[0..<MemoryLayout<Int32>.size])
+        }
+
+        var offset = MemoryLayout<Int32>.size
+        func readCString() -> String? {
+            guard offset < size else { return nil }
+            let start = offset
+            while offset < size, buffer[offset] != 0 { offset += 1 }
+            guard offset > start else { return nil }
+            let string = String(decoding: buffer[start..<offset], as: UTF8.self)
+            while offset < size, buffer[offset] == 0 { offset += 1 } // skip padding NULs
+            return string
+        }
+
+        guard let execPath = readCString() else { return nil }
+        var args: [String] = []
+        var i: Int32 = 0
+        while i < argc, let arg = readCString() {
+            args.append(arg)
+            i += 1
+        }
+        return ExecInfo(execPath: execPath, args: args)
+    }
+}

Sources/ProfileColor.swift

@@ -0,0 +1,72 @@
+// A stable, well-distributed color per profile name, shared by the menu
+// bar dots and the Manage window's profile list so the same name always
+// reads as the same color everywhere.
+import AppKit
+
+enum ProfileColor {
+    // FNV-1a: a proper avalanching hash, not a preset-palette lookup — the
+    // full hue wheel is available, and single-character name edits (e.g.
+    // "personal" vs "personal2") land on unrelated hues instead of an
+    // adjacent bucket the way a plain sum-of-scalars hash mod'd into a
+    // short color list would.
+    private static func fnv1aHash(_ s: String) -> UInt32 {
+        var hash: UInt32 = 0x811c_9dc5
+        for byte in s.utf8 {
+            hash ^= UInt32(byte)
+            hash = hash &* 0x0100_0193
+        }
+        return hash
+    }
+
+    // A brightness/saturation pair that reads clearly on its own
+    // background — a color bright enough to pop on a dark menu would wash
+    // out on a light one, and vice versa, so this picks per current
+    // appearance rather than using one fixed value for both.
+    private static func isDarkAppearance() -> Bool {
+        NSApp.effectiveAppearance.bestMatch(from: [.aqua, .darkAqua]) == .darkAqua
+    }
+
+    static func dotColor(for name: String) -> NSColor {
+        let hue = CGFloat(fnv1aHash(name) % 360) / 360.0
+        let (saturation, brightness): (CGFloat, CGFloat) = isDarkAppearance() ? (0.90, 1.0) : (1.0, 0.55)
+        return NSColor(calibratedHue: hue, saturation: saturation, brightness: brightness, alpha: 1.0)
+    }
+
+    // Light or dark text, whichever reads better on the given background.
+    // Profile colours come off the full hue wheel (see `dotColor`), whose
+    // luminance varies enormously — yellow against white text is barely
+    // legible where indigo against black text is worse — so this can't be
+    // one fixed choice.
+    //
+    // Chooses on WCAG relative luminance rather than raw brightness,
+    // because the eye is roughly six times more sensitive to green than to
+    // blue and an unweighted average badly misjudges both. 0.179 is where
+    // contrast against white and against black come out equal, so it's the
+    // threshold that maximises contrast either way. Near-white and
+    // near-black rather than pure, which reads as less harsh at 10pt
+    // without measurably costing contrast.
+    static func contrastingTextColor(on background: NSColor) -> NSColor {
+        guard let rgb = background.usingColorSpace(.sRGB) else { return .white }
+        func linear(_ channel: CGFloat) -> CGFloat {
+            channel <= 0.03928 ? channel / 12.92 : pow((channel + 0.055) / 1.055, 2.4)
+        }
+        let luminance = 0.2126 * linear(rgb.redComponent)
+            + 0.7152 * linear(rgb.greenComponent)
+            + 0.0722 * linear(rgb.blueComponent)
+        return luminance > 0.179 ? NSColor(white: 0.10, alpha: 1) : NSColor(white: 0.98, alpha: 1)
+    }
+
+    // `dimmed` marks a profile that isn't actually running right now — the
+    // colored dot still identifies it, but faded, so "open" vs "known but
+    // closed" is visible without reading a tooltip.
+    static func dotImage(for name: String, dimmed: Bool = false) -> NSImage {
+        let size = NSSize(width: 10, height: 10)
+        let image = NSImage(size: size)
+        image.lockFocus()
+        dotColor(for: name).withAlphaComponent(dimmed ? 0.3 : 1.0).setFill()
+        NSBezierPath(ovalIn: NSRect(origin: .zero, size: size)).fill()
+        image.unlockFocus()
+        image.isTemplate = false
+        return image
+    }
+}

Sources/ProfileStore.swift

@@ -0,0 +1,180 @@
+// Profile config storage: one ~/.shannoncoat/<name>.json per profile,
+// holding the two dirs a profile needs — Claude Desktop's --user-data-dir,
+// and the CLAUDE_CONFIG_DIR paired with it so any Claude Code session
+// launched from that Desktop instance gets its own isolated config too,
+// instead of sharing one with every other profile. (Claude Code already
+// has its own profile mechanism for use outside Desktop — this isn't a
+// second one, just making sure a managed Desktop session doesn't leak
+// into it.) "default" is implicit — no file for it — and always means the
+// real, untouched ~/.claude + Application Support/Claude.
+import Foundation
+
+struct ResolvedProfile: Equatable {
+    let name: String
+    let codeDir: String
+    let appDir: String
+}
+
+enum ProfileError: LocalizedError {
+    case emptyName
+    case reservedName
+    case invalidName(String)
+    case alreadyExists(String)
+    case notFound(String)
+    case dirCollision(existingProfile: String, dir: String, kind: String)
+
+    var errorDescription: String? {
+        switch self {
+        case .emptyName:
+            return "Name is required."
+        case .reservedName:
+            return "\"default\" is reserved for the real, untouched Claude install."
+        case .invalidName(let name):
+            return "\"\(name)\" isn't a valid profile name (no spaces, slashes, colons, or leading dots)."
+        case .alreadyExists(let name):
+            return "A profile named \"\(name)\" already exists."
+        case .notFound(let name):
+            return "No profile named \"\(name)\"."
+        case .dirCollision(let existingProfile, let dir, let kind):
+            return "\(kind) dir \(dir) is already used by profile \"\(existingProfile)\"."
+        }
+    }
+}
+
+// What lives on disk. Profile name comes from the filename, not a field in
+// here, so there's only one place a profile's name can disagree with
+// itself. `paths` is nested (matching the old YAML's shape) rather than
+// flattened, so a later profile-specific feature has an obvious place to
+// add its own top-level key alongside `paths` without disturbing this one.
+private struct ProfileFile: Codable {
+    var paths: Paths
+
+    struct Paths: Codable {
+        var code: String
+        var desktop: String
+    }
+}
+
+enum ProfileStore {
+    static let root: URL = {
+        let url = FileManager.default.homeDirectoryForCurrentUser.appendingPathComponent(".shannoncoat")
+        try? FileManager.default.createDirectory(at: url, withIntermediateDirectories: true)
+        return url
+    }()
+
+    static let defaultProfile = ResolvedProfile(
+        name: "default",
+        codeDir: FileManager.default.homeDirectoryForCurrentUser.appendingPathComponent(".claude").path,
+        appDir: FileManager.default.homeDirectoryForCurrentUser
+            .appendingPathComponent("Library/Application Support/Claude").path
+    )
+
+    // "~" expands to home; anything else non-absolute resolves relative to
+    // `root` (the config dir itself) rather than the process's cwd; an
+    // already-absolute path is left alone.
+    static func expand(_ raw: String) -> String {
+        if raw.hasPrefix("~") {
+            return (raw as NSString).expandingTildeInPath
+        }
+        if raw.hasPrefix("/") {
+            return raw
+        }
+        return root.appendingPathComponent(raw).path
+    }
+
+    static func validateName(_ name: String) throws {
+        if name.isEmpty { throw ProfileError.emptyName }
+        if name == "default" { throw ProfileError.reservedName }
+        let hasBadChar = name.contains("/") || name.contains(":") || name.hasPrefix(".")
+            || name.rangeOfCharacter(from: .whitespacesAndNewlines) != nil
+        if hasBadChar { throw ProfileError.invalidName(name) }
+    }
+
+    private static func configURL(for name: String) -> URL {
+        root.appendingPathComponent("\(name).json")
+    }
+
+    // Every configured profile plus the implicit `default`, in no
+    // particular order. Config files that fail to decode are skipped
+    // rather than surfaced here — a hand-edited-into-garbage file
+    // shouldn't take the whole menu down.
+    static func loadAll() -> [ResolvedProfile] {
+        var profiles = [defaultProfile]
+        let files = (try? FileManager.default.contentsOfDirectory(
+            at: root, includingPropertiesForKeys: nil)) ?? []
+        for file in files where file.pathExtension == "json" {
+            guard let data = try? Data(contentsOf: file),
+                  let profileFile = try? JSONDecoder().decode(ProfileFile.self, from: data)
+            else { continue }
+            let name = file.deletingPathExtension().lastPathComponent
+            profiles.append(ResolvedProfile(
+                name: name, codeDir: expand(profileFile.paths.code), appDir: expand(profileFile.paths.desktop)))
+        }
+        return profiles
+    }
+
+    struct DirCollision { let profileA: String; let profileB: String; let dir: String; let kind: String }
+
+    // Two profiles secretly sharing a dir would silently merge their Claude
+    // sessions — defeats the entire point of switching. Checked on every
+    // load (see `loadAll` call sites), not just when a profile is created,
+    // so a hand-edited file can't sneak one in unnoticed.
+    static func findCollisions(among profiles: [ResolvedProfile]) -> [DirCollision] {
+        var collisions: [DirCollision] = []
+        for i in profiles.indices {
+            for j in profiles.index(after: i)..<profiles.endIndex {
+                if profiles[i].codeDir == profiles[j].codeDir {
+                    collisions.append(DirCollision(
+                        profileA: profiles[i].name, profileB: profiles[j].name,
+                        dir: profiles[i].codeDir, kind: "Claude Code"))
+                }
+                if profiles[i].appDir == profiles[j].appDir {
+                    collisions.append(DirCollision(
+                        profileA: profiles[i].name, profileB: profiles[j].name,
+                        dir: profiles[i].appDir, kind: "Claude Desktop"))
+                }
+            }
+        }
+        return collisions
+    }
+
+    @discardableResult
+    static func create(name: String, codeDir: String?, appDir: String?) throws -> ResolvedProfile {
+        try validateName(name)
+        let url = configURL(for: name)
+        guard !FileManager.default.fileExists(atPath: url.path) else {
+            throw ProfileError.alreadyExists(name)
+        }
+
+        let rawCode = codeDir?.isEmpty == false ? codeDir! : "data/\(name)/code"
+        let rawApp = appDir?.isEmpty == false ? appDir! : "data/\(name)/app"
+        let resolvedCode = expand(rawCode)
+        let resolvedApp = expand(rawApp)
+
+        for existing in loadAll() {
+            if existing.codeDir == resolvedCode {
+                throw ProfileError.dirCollision(existingProfile: existing.name, dir: resolvedCode, kind: "Claude Code")
+            }
+            if existing.appDir == resolvedApp {
+                throw ProfileError.dirCollision(existingProfile: existing.name, dir: resolvedApp, kind: "Claude Desktop")
+            }
+        }
+
+        try FileManager.default.createDirectory(atPath: resolvedCode, withIntermediateDirectories: true)
+        try FileManager.default.createDirectory(atPath: resolvedApp, withIntermediateDirectories: true)
+
+        let encoder = JSONEncoder()
+        encoder.outputFormatting = [.prettyPrinted, .sortedKeys, .withoutEscapingSlashes]
+        let data = try encoder.encode(ProfileFile(paths: .init(code: rawCode, desktop: rawApp)))
+        try data.write(to: url)
+
+        return ResolvedProfile(name: name, codeDir: resolvedCode, appDir: resolvedApp)
+    }
+
+    static func delete(_ name: String) throws {
+        guard name != "default" else { throw ProfileError.reservedName }
+        let url = configURL(for: name)
+        guard FileManager.default.fileExists(atPath: url.path) else { throw ProfileError.notFound(name) }
+        try FileManager.default.removeItem(at: url)
+    }
+}

Sources/UpdateChecker.swift

@@ -0,0 +1,105 @@
+// Deliberately minimal: fetch the raw VERSION file from `main` on GitHub
+// and compare semver to the bundled version. No silent binary-replacing
+// auto-update — that needs signing/notarization/an appcast server this
+// project doesn't have. A manual check shows an alert (an explicit action
+// that expects a response); the periodic automatic check instead posts a
+// quiet system notification, since that one wasn't asked for in the
+// moment.
+import Foundation
+import UserNotifications
+
+enum UpdateChecker {
+    enum Outcome {
+        case upToDate
+        case updateAvailable(version: String, url: URL)
+        case failed
+    }
+
+    private static let versionURL = URL(string: "https://raw.githubusercontent.com/bdeshi/shannoncoat/main/VERSION")!
+    private static let releaseURL = URL(string: "https://github.com/bdeshi/shannoncoat/releases/latest")!
+    private static let enabledDefaultsKey = "AutomaticUpdateCheckEnabled"
+    private static let lastCheckDefaultsKey = "LastUpdateCheckDate"
+    private static let checkInterval: TimeInterval = 24 * 60 * 60
+
+    static var automaticCheckEnabled: Bool {
+        get { UserDefaults.standard.object(forKey: enabledDefaultsKey) as? Bool ?? true }
+        set { UserDefaults.standard.set(newValue, forKey: enabledDefaultsKey) }
+    }
+
+    static var currentVersion: String {
+        guard let resourceURL = Bundle.main.resourceURL,
+              let contents = try? String(contentsOf: resourceURL.appendingPathComponent("VERSION"), encoding: .utf8)
+        else { return "unknown" }
+        return contents.trimmingCharacters(in: .whitespacesAndNewlines)
+    }
+
+    // What the About panel shows: the version alone for a real release
+    // build (COMMIT is written empty when build.sh finds HEAD sitting
+    // exactly on a tag), or version + short SHA for a dev build, so two
+    // local builds off the same version number are distinguishable.
+    static var displayVersion: String {
+        commitSHA.isEmpty ? currentVersion : "\(currentVersion) (\(commitSHA))"
+    }
+
+    private static var commitSHA: String {
+        guard let resourceURL = Bundle.main.resourceURL,
+              let contents = try? String(contentsOf: resourceURL.appendingPathComponent("COMMIT"), encoding: .utf8)
+        else { return "" }
+        return contents.trimmingCharacters(in: .whitespacesAndNewlines)
+    }
+
+    static func checkManually(completion: @escaping (Outcome) -> Void) {
+        fetchLatestVersion { latest in
+            guard let latest else { completion(.failed); return }
+            if isNewer(latest, than: currentVersion) {
+                completion(.updateAvailable(version: latest, url: releaseURL))
+            } else {
+                completion(.upToDate)
+            }
+        }
+    }
+
+    // Called once at launch; a no-op unless the toggle is on and it's been
+    // at least a day since the last check.
+    static func checkAutomaticallyIfDue() {
+        guard automaticCheckEnabled else { return }
+        let last = UserDefaults.standard.object(forKey: lastCheckDefaultsKey) as? Date ?? .distantPast
+        guard Date().timeIntervalSince(last) > checkInterval else { return }
+        UserDefaults.standard.set(Date(), forKey: lastCheckDefaultsKey)
+
+        fetchLatestVersion { latest in
+            guard let latest, isNewer(latest, than: currentVersion) else { return }
+            postAvailableNotification(version: latest)
+        }
+    }
+
+    private static func fetchLatestVersion(completion: @escaping (String?) -> Void) {
+        URLSession.shared.dataTask(with: versionURL) { data, _, _ in
+            let version = data.flatMap { String(data: $0, encoding: .utf8) }?
+                .trimmingCharacters(in: .whitespacesAndNewlines)
+            completion((version?.isEmpty == false) ? version : nil)
+        }.resume()
+    }
+
+    private static func isNewer(_ a: String, than b: String) -> Bool {
+        let av = a.split(separator: ".").compactMap { Int($0) }
+        let bv = b.split(separator: ".").compactMap { Int($0) }
+        for i in 0..<max(av.count, bv.count) {
+            let x = i < av.count ? av[i] : 0
+            let y = i < bv.count ? bv[i] : 0
+            if x != y { return x > y }
+        }
+        return false
+    }
+
+    private static func postAvailableNotification(version: String) {
+        let center = UNUserNotificationCenter.current()
+        center.requestAuthorization(options: [.alert]) { granted, _ in
+            guard granted else { return }
+            let content = UNMutableNotificationContent()
+            content.title = "shannoncoat \(version) is available"
+            content.body = "Click to view the release notes."
+            center.add(UNNotificationRequest(identifier: "shannoncoat-update-available", content: content, trigger: nil))
+        }
+    }
+}

Sources/WindowOverlay.swift

@@ -0,0 +1,604 @@
+// A small floating tag pinned to a Claude window's corner, showing which
+// profile it belongs to — every profile launches the same app with the
+// same icon and title, so there's otherwise no way to tell two open
+// Claude windows apart at a glance. Kept in sync live via AXObserver
+// notifications (move/resize/miniaturize/destroy) rather than polling —
+// only a persistent process can hold a watcher like this at all, which is
+// exactly the gap the old one-shot CLI script couldn't close.
+import AppKit
+import ApplicationServices
+
+// How the tag is drawn. A dot is for when the colour alone already
+// identifies the window and the name is just clutter; it's never rotated,
+// having no reading direction to preserve.
+enum WindowOverlayStyle: String {
+    case chip, dot
+}
+
+// The window corner a tag is anchored to. Anchoring to the *nearest*
+// corner rather than always the top-right is what holds a tag still
+// through a resize: one parked near the bottom-left tracks that corner,
+// so dragging the top-right handle no longer drags the tag with it.
+enum WindowOverlayCorner: String {
+    case topLeft, topRight, bottomLeft, bottomRight
+
+    var isTop: Bool { self == .topLeft || self == .topRight }
+    var isLeft: Bool { self == .topLeft || self == .bottomLeft }
+
+    // Quadrant test rather than four distance comparisons — same answer,
+    // and it stays well-defined for a tag sitting dead centre.
+    static func nearest(to point: NSPoint, in frame: NSRect) -> WindowOverlayCorner {
+        switch (point.y > frame.midY, point.x < frame.midX) {
+        case (true, true): return .topLeft
+        case (true, false): return .topRight
+        case (false, true): return .bottomLeft
+        case (false, false): return .bottomRight
+        }
+    }
+}
+
+// Where one profile's tag sits on its window, persisted so a drag survives
+// a relaunch. Stored per profile rather than once for everything: two
+// windows side by side are exactly the case these tags exist for, and
+// wanting each one's tag somewhere different is the normal outcome — one
+// window's sidebar is not another's.
+//
+// Offsets are stored as the user dropped them and are never written back
+// clamped. A window too small to honour the full offset shows the tag
+// pushed in as far as it fits (see `WindowOverlay.frame(window:screen:)`), but the
+// stored distance is left intact, so widening the window again restores
+// the chosen spot instead of leaving the tag stuck where a temporary
+// resize squeezed it.
+struct WindowOverlayPlacement {
+    // Top-right by default — top-left is where every window's close/
+    // minimize/zoom controls live, which the tag must never sit over.
+    var corner: WindowOverlayCorner = .topRight
+    var insetX: CGFloat = 8
+    var insetY: CGFloat = 6
+    var isVertical: Bool = false
+
+    private static func key(_ field: String, _ profile: String) -> String {
+        "WindowOverlay\(field).\(profile)"
+    }
+
+    // From the version that kept a single shared offset. Read as a seed for
+    // a profile with nothing stored yet, so an existing tag stays where it
+    // already is instead of jumping on the first launch after upgrading.
+    private static let legacyInsetXKey = "WindowOverlayRightInset"
+    private static let legacyInsetYKey = "WindowOverlayTopInset"
+
+    private static func number(_ defaults: UserDefaults, _ keys: String...) -> CGFloat? {
+        for key in keys {
+            if let value = defaults.object(forKey: key) as? Double { return CGFloat(value) }
+        }
+        return nil
+    }
+
+    static func load(for profile: String) -> WindowOverlayPlacement {
+        let defaults = UserDefaults.standard
+        var placement = WindowOverlayPlacement()
+        if let raw = defaults.string(forKey: key("Corner", profile)),
+           let corner = WindowOverlayCorner(rawValue: raw) {
+            placement.corner = corner
+        }
+        if let x = number(defaults, key("InsetX", profile), legacyInsetXKey) { placement.insetX = x }
+        if let y = number(defaults, key("InsetY", profile), legacyInsetYKey) { placement.insetY = y }
+        placement.isVertical = defaults.bool(forKey: key("Vertical", profile))
+        return placement
+    }
+
+    func save(for profile: String) {
+        let defaults = UserDefaults.standard
+        defaults.set(corner.rawValue, forKey: Self.key("Corner", profile))
+        defaults.set(Double(insetX), forKey: Self.key("InsetX", profile))
+        defaults.set(Double(insetY), forKey: Self.key("InsetY", profile))
+        defaults.set(isVertical, forKey: Self.key("Vertical", profile))
+    }
+}
+
+// Chip or dot. Unlike placement this really is one setting for the whole
+// app — it's a single control in Settings, not something chosen per window.
+enum WindowOverlayPosition {
+    private static let styleKey = "WindowOverlayStyle"
+
+    static var style: WindowOverlayStyle {
+        get {
+            (UserDefaults.standard.string(forKey: styleKey)).flatMap(WindowOverlayStyle.init(rawValue:)) ?? .chip
+        }
+        set { UserDefaults.standard.set(newValue.rawValue, forKey: styleKey) }
+    }
+}
+
+// Draws the tag itself. Custom drawing rather than a laid-out NSTextField
+// because both of the things this has to get right — centring the text on
+// the chip's actual midline, and rotating the whole chip when it's parked
+// against a side edge — are a transform and two draw calls here, versus
+// fighting a label's intrinsic baseline placement and its unrotatable
+// frame.
+private final class TagView: NSView {
+    var text: String
+    var color: NSColor
+    var style: WindowOverlayStyle
+    var isVertical: Bool
+    // Which side edge a vertical chip is against, which decides the way it
+    // reads: bottom-to-top on the left, top-to-bottom on the right, so the
+    // text always leans into the window rather than away from it. Ignored
+    // when horizontal.
+    var isLeftSide: Bool
+
+    static let thickness: CGFloat = 13
+    static let dotDiameter: CGFloat = 11
+    private static let horizontalPadding: CGFloat = 7
+    private static let maxLength: CGFloat = 140
+    static let font = NSFont.systemFont(ofSize: 10, weight: .semibold)
+
+    init(text: String, color: NSColor, style: WindowOverlayStyle, isVertical: Bool, isLeftSide: Bool) {
+        self.text = text
+        self.color = color
+        self.style = style
+        self.isVertical = isVertical
+        self.isLeftSide = isLeftSide
+        super.init(frame: .zero)
+    }
+
+    required init?(coder: NSCoder) { fatalError("init(coder:) has not been implemented") }
+
+    // The chip's extent along its reading direction, before any rotation.
+    private static func chipLength(for text: String) -> CGFloat {
+        let width = (text as NSString).size(withAttributes: [.font: font]).width
+        return min(maxLength, (width + horizontalPadding * 2).rounded(.up))
+    }
+
+    // Rotation is a property of the drawing, not of the panel, so the
+    // panel's own width and height swap over for a vertical chip.
+    static func size(text: String, style: WindowOverlayStyle, isVertical: Bool) -> NSSize {
+        switch style {
+        case .dot:
+            return NSSize(width: dotDiameter, height: dotDiameter)
+        case .chip:
+            let length = chipLength(for: text)
+            return isVertical
+                ? NSSize(width: thickness, height: length)
+                : NSSize(width: length, height: thickness)
+        }
+    }
+
+    override func draw(_ dirtyRect: NSRect) {
+        guard let ctx = NSGraphicsContext.current?.cgContext else { return }
+
+        if style == .dot {
+            color.setFill()
+            NSBezierPath(ovalIn: bounds).fill()
+            return
+        }
+
+        ctx.saveGState()
+        defer { ctx.restoreGState() }
+
+        // Lay the chip out once, horizontally, around the origin — then
+        // rotate the whole coordinate space if it belongs on a side edge.
+        // One layout path serves both orientations, so the vertical case
+        // can't drift out of step with the horizontal one.
+        ctx.translateBy(x: bounds.midX, y: bounds.midY)
+        if isVertical { ctx.rotate(by: isLeftSide ? .pi / 2 : -.pi / 2) }
+
+        let length = Self.chipLength(for: text)
+        let rect = NSRect(
+            x: -length / 2, y: -Self.thickness / 2, width: length, height: Self.thickness)
+        color.setFill()
+        NSBezierPath(roundedRect: rect, xRadius: Self.thickness / 2, yRadius: Self.thickness / 2).fill()
+
+        let paragraph = NSMutableParagraphStyle()
+        paragraph.alignment = .center
+        paragraph.lineBreakMode = .byTruncatingTail
+        let attributes: [NSAttributedString.Key: Any] = [
+            .font: Self.font,
+            .foregroundColor: ProfileColor.contrastingTextColor(on: color),
+            .paragraphStyle: paragraph,
+        ]
+        let attributed = NSAttributedString(string: text, attributes: attributes)
+        // Drawn into a rect exactly one line tall and centred on the
+        // chip's midline. Handing it the chip's full height instead would
+        // top-align the text inside it — the reason the old label sat
+        // high rather than centred.
+        let lineHeight = attributed.size().height
+        attributed.draw(in: NSRect(
+            x: rect.minX + Self.horizontalPadding, y: rect.midY - lineHeight / 2,
+            width: rect.width - Self.horizontalPadding * 2, height: lineHeight))
+    }
+}
+
+final class WindowOverlay: NSObject, NSWindowDelegate {
+    let pid: pid_t
+    private let axWindow: AXUIElement
+    private var observer: AXObserver?
+    private let panel: NSPanel
+    private let tagView: TagView
+    private let profileName: String
+    private var placement: WindowOverlayPlacement
+    // True only while `reposition` is moving the panel itself — see
+    // `windowDidMove`, which must ignore those moves.
+    private var isRepositioning = false
+    private var dragSettle: DispatchWorkItem?
+    private var isMinimized = false
+
+    init?(profileName: String, color: NSColor, pid: pid_t) {
+        let axApp = AXUIElementCreateApplication(pid)
+        guard let window = Self.firstWindow(of: axApp) else { return nil }
+        self.pid = pid
+        self.axWindow = window
+        self.profileName = profileName
+        let placement = WindowOverlayPlacement.load(for: profileName)
+        self.placement = placement
+
+        let style = WindowOverlayPosition.style
+        let tagView = TagView(
+            text: profileName, color: color, style: style,
+            isVertical: style == .chip && placement.isVertical,
+            isLeftSide: placement.corner.isLeft)
+        tagView.autoresizingMask = [.width, .height]
+        self.tagView = tagView
+
+        let panel = NSPanel(
+            contentRect: NSRect(origin: .zero, size: NSSize(width: 1, height: 1)),
+            styleMask: [.borderless, .nonactivatingPanel],
+            backing: .buffered, defer: false)
+        panel.isOpaque = false
+        panel.backgroundColor = .clear
+        panel.hasShadow = true
+        panel.level = .floating
+        // Draggable (so it can be moved off whatever it's obstructing),
+        // but .nonactivatingPanel keeps a click/drag from stealing focus
+        // away from the Claude window underneath.
+        panel.isMovableByWindowBackground = true
+        panel.collectionBehavior = [.stationary, .ignoresCycle]
+        panel.contentView = tagView
+
+        self.panel = panel
+        super.init()
+        panel.delegate = self
+
+        guard reposition() else { return nil }
+        startObserving()
+    }
+
+    // A cold Electron launch can take a second or more between the
+    // process starting (which is what triggers `updateWindowOverlays`,
+    // via NSWorkspace's launch notification) and its first window
+    // actually existing — the same race ClaudeControl.focus's
+    // waitForWindow already handles for the same reason. `init?` can't
+    // retry on its own (once it returns nil, that attempt is done), so
+    // this polls it every quarter second for up to ~3s before giving up.
+    static func attach(
+        profileName: String, color: NSColor, pid: pid_t, attemptsRemaining: Int = 12,
+        completion: @escaping (WindowOverlay?) -> Void
+    ) {
+        if let overlay = WindowOverlay(profileName: profileName, color: color, pid: pid) {
+            completion(overlay)
+        } else if attemptsRemaining > 0 {
+            DispatchQueue.main.asyncAfter(deadline: .now() + 0.25) {
+                attach(
+                    profileName: profileName, color: color, pid: pid, attemptsRemaining: attemptsRemaining - 1,
+                    completion: completion)
+            }
+        } else {
+            completion(nil)
+        }
+    }
+
+    deinit {
+        dragSettle?.cancel()
+        stopObserving()
+        panel.orderOut(nil)
+    }
+
+    private static func firstWindow(of axApp: AXUIElement) -> AXUIElement? {
+        var value: CFTypeRef?
+        guard AXUIElementCopyAttributeValue(axApp, kAXWindowsAttribute as CFString, &value) == .success,
+              let windows = value as? [AXUIElement], let first = windows.first
+        else { return nil }
+        return first
+    }
+
+    private static func frame(of window: AXUIElement) -> CGRect? {
+        var posValue: CFTypeRef?
+        var sizeValue: CFTypeRef?
+        guard AXUIElementCopyAttributeValue(window, kAXPositionAttribute as CFString, &posValue) == .success,
+              AXUIElementCopyAttributeValue(window, kAXSizeAttribute as CFString, &sizeValue) == .success,
+              CFGetTypeID(posValue) == AXValueGetTypeID(), CFGetTypeID(sizeValue) == AXValueGetTypeID()
+        else { return nil }
+        var point = CGPoint.zero
+        var size = CGSize.zero
+        guard AXValueGetValue(posValue as! AXValue, .cgPoint, &point),
+              AXValueGetValue(sizeValue as! AXValue, .cgSize, &size)
+        else { return nil }
+        return CGRect(origin: point, size: size)
+    }
+
+    private static func screen(containing axFrame: CGRect) -> NSScreen? {
+        NSScreen.screens.first { $0.frame.minX <= axFrame.midX && axFrame.midX <= $0.frame.maxX } ?? NSScreen.main
+    }
+
+    // AX coordinates are top-left-origin (screen top = y 0); AppKit screen
+    // coordinates are bottom-left-origin. Returns the window's frame
+    // translated into AppKit's space.
+    private static func appKitFrame(of axFrame: CGRect, on screen: NSScreen) -> NSRect {
+        NSRect(x: axFrame.origin.x, y: screen.frame.maxY - axFrame.origin.y - axFrame.height,
+               width: axFrame.width, height: axFrame.height)
+    }
+
+    private var currentGeometry: (window: NSRect, screen: NSScreen)? {
+        guard let axFrame = Self.frame(of: axWindow), let screen = Self.screen(containing: axFrame)
+        else { return nil }
+        return (Self.appKitFrame(of: axFrame, on: screen), screen)
+    }
+
+    // The tag's frame for a given window frame: measured inward from its
+    // anchored corner, with the offsets clamped so it always stays over
+    // the window no matter how small that window gets. Only the *drawn*
+    // position is clamped — see WindowOverlayPlacement.
+    //
+    // Then clamped again, into whatever part of the window is actually on
+    // screen. A window dragged half off the edge takes its anchored corner
+    // with it, and a tag that follows it out of view identifies nothing —
+    // the whole point is telling, at a glance, which profile the window you
+    // can still see belongs to. Clamped to the window's *visible* portion
+    // rather than to the screen at large so the tag stays on the thing it
+    // labels instead of drifting off onto its own. `visibleFrame` keeps it
+    // clear of the menu bar and Dock, which would hide it just as
+    // effectively as the screen edge.
+    //
+    // Both clamps are presentational only — neither is written back to
+    // `placement`, which changes solely when the user drags the tag. So the
+    // anchor is remembered throughout, and the tag returns to it the moment
+    // the window is fully back on screen.
+    private func frame(window: NSRect, screen: NSScreen) -> NSRect {
+        let style = WindowOverlayPosition.style
+        let size = TagView.size(
+            text: profileName, style: style,
+            isVertical: style == .chip && placement.isVertical)
+        let corner = placement.corner
+        let insetX = placement.insetX
+            .clamped(to: 0...max(0, window.width - size.width))
+        let insetY = placement.insetY
+            .clamped(to: 0...max(0, window.height - size.height))
+        var origin = NSPoint(
+            x: corner.isLeft ? window.minX + insetX : window.maxX - insetX - size.width,
+            y: corner.isTop ? window.maxY - insetY - size.height : window.minY + insetY)
+
+        // A window entirely off screen leaves nothing to clamp into; fall
+        // back to the screen so the tag stays reachable rather than being
+        // pinned to an empty rect.
+        let onScreen = window.intersection(screen.visibleFrame)
+        let bounds = onScreen.isEmpty ? screen.visibleFrame : onScreen
+        origin.x = origin.x.clamped(to: bounds.minX...max(bounds.minX, bounds.maxX - size.width))
+        origin.y = origin.y.clamped(to: bounds.minY...max(bounds.minY, bounds.maxY - size.height))
+        return NSRect(origin: origin, size: size)
+    }
+
+    // Puts the tag where the current placement says it belongs. Returns
+    // false (and hides the tag) if the window has no readable frame right
+    // now — minimized, or Accessibility not granted.
+    @discardableResult
+    private func reposition() -> Bool {
+        guard let (windowFrame, screen) = currentGeometry else {
+            panel.orderOut(nil)
+            return false
+        }
+        let style = WindowOverlayPosition.style
+        tagView.style = style
+        tagView.isVertical = style == .chip && placement.isVertical
+        tagView.isLeftSide = placement.corner.isLeft
+        tagView.needsDisplay = true
+
+        isRepositioning = true
+        defer { isRepositioning = false }
+        let tagFrame = frame(window: windowFrame, screen: screen)
+        panel.setFrame(tagFrame, display: true)
+        // The shadow is derived from the content's alpha, so a shape or
+        // size change leaves a stale one behind without this.
+        panel.invalidateShadow()
+        // Positioned either way — only the showing is conditional, so a
+        // hidden tag still knows where it belongs and can be revealed later
+        // without recomputing anything.
+        if isMinimized || !isTargetVisible(tagFrame: tagFrame) {
+            panel.orderOut(nil)
+        } else if !panel.isVisible {
+            panel.orderFrontRegardless()
+        }
+        return true
+    }
+
+    // Re-evaluate whether the tag should currently be on screen. Called
+    // when some app activates, which is the usual way a window ends up
+    // buried or uncovered without moving at all.
+    func refreshVisibility() {
+        reposition()
+    }
+
+    // A tag is a floating panel, which puts it above every ordinary window
+    // on the system rather than merely above the window it belongs to. Left
+    // alone it hovers over the browser, the editor, everything — even when
+    // its own window is buried or on another Space.
+    //
+    // There is no cross-process way to attach one window above another:
+    // `addChildWindow` is same-process only, and the private ordering call
+    // window managers use is a one-shot operation that goes stale the
+    // moment anything else reorders, so it wouldn't avoid this work either.
+    // So the tag is shown only when the window it labels is genuinely
+    // visible underneath it.
+    //
+    // The window server returns its list strictly front-to-back, which
+    // answers both halves in one pass: walk forward, and anything
+    // overlapping the tag before we reach our own window is covering it.
+    // Reaching our window with nothing in the way means the tag is showing
+    // real estate that actually belongs to that window; never reaching it
+    // means the window isn't on screen at all — minimized, hidden, or on
+    // another Space — and the tag has nothing to label.
+    private func isTargetVisible(tagFrame: NSRect) -> Bool {
+        guard let listing = CGWindowListCopyWindowInfo(
+            [.optionOnScreenOnly, .excludeDesktopElements], kCGNullWindowID) as? [[String: Any]]
+        else { return true }  // can't tell — better a stray tag than a missing one
+
+        let tag = Self.cgRect(of: tagFrame)
+        let ownPid = getpid()
+        for entry in listing {
+            guard let owner = entry[kCGWindowOwnerPID as String] as? pid_t,
+                  let boundsDict = entry[kCGWindowBounds as String],
+                  let bounds = CGRect(dictionaryRepresentation: boundsDict as! CFDictionary)
+            else { continue }
+            // Identified by owner alone, deliberately. Matching the exact
+            // rect meant comparing a freshly-read AX frame against the
+            // window server's snapshot, and mid-move the two disagree —
+            // AX already reports the new position while the listing still
+            // has the old one. The match then failed, the walk continued
+            // past our own window, and the first unrelated window that
+            // happened to overlap the tag "occluded" it. Whether that
+            // occurred came down to what was nearby, which is why it
+            // looked as though only certain drag directions broke it.
+            //
+            // A dialog of the same app landing here counts as reaching our
+            // window, which is right: Claude covering its own window is
+            // not a reason to disown the tag.
+            if owner == pid, bounds.intersects(tag) { return true }
+            // Our own tags are in this list too, and one tag sitting over
+            // another's window must not hide it.
+            if owner == ownPid { continue }
+            // Only ordinary windows can bury another ordinary window.
+            // Everything above that band — the menu bar, the Dock,
+            // notification banners, and the invisible one-pixel markers
+            // some utilities park in a screen corner — is permanently in
+            // front of everything and would veto the tag forever. One such
+            // marker at the bottom-left corner is what made a tag vanish
+            // there, and only there: it takes a move off two edges at once
+            // for the tag to clamp into that exact pixel.
+            guard (entry[kCGWindowLayer as String] as? Int) == 0 else { continue }
+            if bounds.intersects(tag) { return false }
+        }
+        return false
+    }
+
+    // AppKit is bottom-left-origin per screen; the window server is
+    // top-left-origin from the primary screen (screens[0], the one with the
+    // menu bar).
+    private static func cgRect(of rect: NSRect) -> CGRect {
+        let primaryMaxY = NSScreen.screens.first?.frame.maxY ?? rect.maxY
+        return CGRect(x: rect.minX, y: primaryMaxY - rect.maxY, width: rect.width, height: rect.height)
+    }
+
+    // MARK: - User placement
+
+    // Fires for every panel move — ours (from `reposition`, when the
+    // tracked window itself moves/resizes) and the user's (dragging the
+    // tag). Only the latter should redefine the placement, which is what
+    // the `isRepositioning` guard filters for.
+    //
+    // Re-deriving the offset from our own moves too looks like it should
+    // be a harmless no-op — recomputing the very offset we just positioned
+    // against — but it isn't, because the two halves read the window at
+    // different instants. AppKit posts this notification synchronously
+    // from inside `setFrame`, and during a live window drag the AX frame
+    // read here is already newer than the one `reposition` derived the
+    // origin from, so each move event bakes in the few points the window
+    // travelled in between. Those errors accumulate across the hundreds
+    // of events one drag produces, until the offset saturates and the tag
+    // has walked clear across its window — off-screen entirely, if that
+    // edge of the window is.
+    func windowDidMove(_ notification: Notification) {
+        guard !isRepositioning else { return }
+        scheduleDragSettle()
+    }
+
+    // A tag drag emits a continuous stream of moves, and re-anchoring on
+    // each one would snap the tag out from under the cursor mid-gesture
+    // (and flip its orientation repeatedly on the way past an edge). So
+    // the placement is only committed once the moves stop, which is as
+    // close to a "drag ended" signal as a background-movable window gets
+    // — NSWindow has no such delegate callback, unlike live resize.
+    private func scheduleDragSettle() {
+        dragSettle?.cancel()
+        let work = DispatchWorkItem { [weak self] in self?.commitUserPlacement() }
+        dragSettle = work
+        DispatchQueue.main.asyncAfter(deadline: .now() + 0.2, execute: work)
+    }
+
+    private func commitUserPlacement() {
+        guard let windowFrame = currentGeometry?.window else { return }
+        let tagFrame = panel.frame
+        let centre = NSPoint(x: tagFrame.midX, y: tagFrame.midY)
+        let corner = WindowOverlayCorner.nearest(to: centre, in: windowFrame)
+
+        // Orientation follows whichever edge the tag ended up nearest: a
+        // chip against a side reads vertically, so it can sit close in
+        // without covering the window's own controls. Dots have no
+        // reading direction, so they're never rotated.
+        let toSide = min(centre.x - windowFrame.minX, windowFrame.maxX - centre.x)
+        let toTopOrBottom = min(windowFrame.maxY - centre.y, centre.y - windowFrame.minY)
+        let isVertical = WindowOverlayPosition.style == .chip && toSide < toTopOrBottom
+
+        // Offsets run inward from the anchored corner. Stored unclamped at
+        // the top end (a drag outside the window is clamped to zero, but a
+        // long reach into a wide window is kept in full) so a later resize
+        // can restore it.
+        let insetX = corner.isLeft
+            ? tagFrame.minX - windowFrame.minX : windowFrame.maxX - tagFrame.maxX
+        let insetY = corner.isTop
+            ? windowFrame.maxY - tagFrame.maxY : tagFrame.minY - windowFrame.minY
+
+        placement = WindowOverlayPlacement(
+            corner: corner, insetX: max(0, insetX), insetY: max(0, insetY), isVertical: isVertical)
+        placement.save(for: profileName)
+
+        // Snap into the committed placement — this is what applies a
+        // rotation the drag just earned, and squares the tag up against
+        // its corner.
+        reposition()
+    }
+
+    // MARK: - Live tracking
+
+    private func startObserving() {
+        var newObserver: AXObserver?
+        guard AXObserverCreate(pid, WindowOverlay.axCallback, &newObserver) == .success, let newObserver
+        else { return }
+        observer = newObserver
+
+        let refcon = Unmanaged.passUnretained(self).toOpaque()
+        for name in [
+            kAXMovedNotification, kAXResizedNotification, kAXUIElementDestroyedNotification,
+            kAXWindowMiniaturizedNotification, kAXWindowDeminiaturizedNotification,
+        ] {
+            AXObserverAddNotification(newObserver, axWindow, name as CFString, refcon)
+        }
+        CFRunLoopAddSource(CFRunLoopGetCurrent(), AXObserverGetRunLoopSource(newObserver), .defaultMode)
+    }
+
+    private func stopObserving() {
+        guard let observer else { return }
+        CFRunLoopRemoveSource(CFRunLoopGetCurrent(), AXObserverGetRunLoopSource(observer), .defaultMode)
+        self.observer = nil
+    }
+
+    private static let axCallback: AXObserverCallback = { _, _, notification, refcon in
+        guard let refcon else { return }
+        let overlay = Unmanaged<WindowOverlay>.fromOpaque(refcon).takeUnretainedValue()
+        switch notification as String {
+        case kAXUIElementDestroyedNotification:
+            overlay.panel.orderOut(nil)
+        case kAXWindowMiniaturizedNotification:
+            overlay.isMinimized = true
+            overlay.reposition()
+        case kAXWindowDeminiaturizedNotification:
+            overlay.isMinimized = false
+            overlay.reposition()
+        default:
+            overlay.reposition()
+        }
+    }
+}
+
+extension Comparable {
+    func clamped(to range: ClosedRange<Self>) -> Self {
+        min(max(self, range.lowerBound), range.upperBound)
+    }
+}

Sources/main.swift

@@ -0,0 +1,10 @@
+// Entry point. Its own file only because swiftc restricts top-level
+// executable statements to a file named main.swift once a module has more
+// than one source file.
+import Cocoa
+
+let delegate = AppDelegate()
+let app = NSApplication.shared
+app.delegate = delegate
+app.setActivationPolicy(.accessory)
+app.run()

VERSION

@@ -0,0 +1 @@
+0.0.8

build.sh

@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+# Builds "shannoncoat.app" — a menu bar app (no Dock icon, no window) with a
+# custom icon (icon/AppIcon.icns — see icon/generate-icon.swift) for
+# Finder/Spotlight. It stays running in the menu bar: click the status item
+# to switch profiles, or open Manage Profiles… (Cmd+,) to add/remove one.
+# Launch at Login is a toggle inside the app itself.
+#
+# Builds into ./.build (gitignored) rather than installing straight into an
+# Applications dir — copy/drag the .app from there yourself. It's a fully
+# native, self-contained bundle — no bundled script, so copying it anywhere
+# after the build is safe.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SOURCES_DIR="$SCRIPT_DIR/Sources"
+
+# Local, gitignored build configuration — currently just the code-signing
+# identity, which otherwise has to be remembered and retyped on every
+# build. See .env.example.
+#
+# Parsed rather than sourced, for two reasons: a stray command in the file
+# shouldn't execute as a side effect of building, and this lets an existing
+# environment variable win, so `SHANNONCOAT_SIGN_IDENTITY= ./build.sh`
+# still forces a one-off ad-hoc build without editing the file.
+ENV_FILE="$SCRIPT_DIR/.env"
+if [[ -f "$ENV_FILE" ]]; then
+  while IFS='=' read -r key value || [[ -n "$key" ]]; do
+    key="${key#"${key%%[![:space:]]*}"}"   # strip leading whitespace
+    key="${key#export }"
+    [[ "$key" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || continue   # skips blanks and # comments
+    value="${value%"${value##*[![:space:]]}"}"             # strip trailing whitespace
+    value="${value%\"}"; value="${value#\"}"
+    value="${value%\'}"; value="${value#\'}"
+    [[ -n "${!key+set}" ]] && continue                     # already in the environment; leave it
+    printf -v "$key" '%s' "$value"
+    export "${key?}"
+  done <"$ENV_FILE"
+fi
+VERSION_FILE="$SCRIPT_DIR/VERSION"
+ICON_SRC="$SCRIPT_DIR/icon/AppIcon.icns"
+OUT_DIR="${1:-$SCRIPT_DIR/.build}"
+APP="$OUT_DIR/shannoncoat.app"
+
+# Read from the repo's VERSION file so the .app and the script it bundles
+# never report different numbers.
+VERSION="$(cat "$VERSION_FILE" 2>/dev/null)"
+[[ -n "$VERSION" ]] || { echo "error: couldn't read $VERSION_FILE" >&2; exit 1; }
+
+mkdir -p "$OUT_DIR" "$APP/Contents/MacOS" "$APP/Contents/Resources"
+
+[[ -f "$ICON_SRC" ]] || { echo "error: $ICON_SRC missing (see icon/generate-icon.swift)" >&2; exit 1; }
+cp "$ICON_SRC" "$APP/Contents/Resources/AppIcon.icns"
+
+cat >"$APP/Contents/Info.plist" <<PLIST
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>CFBundleName</key><string>shannoncoat</string>
+  <key>CFBundleDisplayName</key><string>shannoncoat</string>
+  <key>CFBundleIdentifier</key><string>com.local.shannoncoat</string>
+  <key>CFBundleVersion</key><string>$VERSION</string>
+  <key>CFBundleShortVersionString</key><string>$VERSION</string>
+  <key>CFBundlePackageType</key><string>APPL</string>
+  <key>CFBundleExecutable</key><string>launcher</string>
+  <key>CFBundleIconFile</key><string>AppIcon</string>
+  <key>LSUIElement</key><true/>
+  <key>NSHighResolutionCapable</key><true/>
+</dict>
+</plist>
+PLIST
+
+command -v swiftc >/dev/null || { echo "error: swiftc not found (install Xcode Command Line Tools: xcode-select --install)" >&2; exit 1; }
+
+# VERSION travels in Resources (not baked into the binary) so the About
+# panel and the update checker read the same file this script stamped into
+# Info.plist above.
+cp "$VERSION_FILE" "$APP/Contents/Resources/VERSION"
+
+# COMMIT is the short SHA the About tab appends to the version, so one dev
+# build is distinguishable from another — left empty for a real release
+# build, since the version number alone is unambiguous there. A release
+# build is one of:
+#   - SHANNONCOAT_RELEASE_BUILD set by release.yml, which already knows
+#     for certain whether it's building a tag — trusted outright rather
+#     than re-derived, since `git describe` needs full tag refs that a
+#     CI runner's shallow checkout isn't guaranteed to have fetched.
+#   - a local/manual build with HEAD sitting exactly on a tag (checked
+#     via `git describe`, which is reliable here since a normal
+#     non-shallow local clone has its full tag history).
+GIT_SHA=""
+if [[ -n "${SHANNONCOAT_RELEASE_BUILD:-}" ]]; then
+  : # release build — leave GIT_SHA empty
+elif git -C "$SCRIPT_DIR" rev-parse --git-dir >/dev/null 2>&1 \
+    && ! git -C "$SCRIPT_DIR" describe --tags --exact-match >/dev/null 2>&1; then
+  GIT_SHA="$(git -C "$SCRIPT_DIR" rev-parse --short HEAD 2>/dev/null || true)"
+fi
+printf '%s' "$GIT_SHA" >"$APP/Contents/Resources/COMMIT"
+
+swiftc -O "$SOURCES_DIR"/*.swift -o "$APP/Contents/MacOS/launcher"
+
+# Sign the bundle, not just the binary swiftc linker-signed for us — and
+# with the bundle's real identifier rather than the "launcher" executable
+# name codesign would otherwise infer.
+#
+# This matters well beyond tidiness, because the window tags need
+# Accessibility. macOS ties that grant to a *properly signed* app's
+# designated requirement, which survives a rebuild, but falls back to
+# pinning an ad-hoc-signed app to its exact cdhash — and every build
+# produces a new one. So with the ad-hoc default below, each build +
+# reinstall silently invalidates the permission, while the app stays
+# listed and stays ticked under Privacy & Security → Accessibility. It
+# looks granted and isn't, and no amount of toggling that row fixes it:
+# the stale entry has to be removed with "−" and the new build added back.
+#
+# To stop paying that tax on every build, make a self-signed code-signing
+# certificate once (Keychain Access → Certificate Assistant → Create a
+# Certificate…, type "Code Signing", self-signed) and point this at it:
+#
+#   SHANNONCOAT_SIGN_IDENTITY="My Local Signing Cert" ./build.sh
+#
+# then re-grant Accessibility one final time. The identity is stable from
+# then on, so later builds keep the permission.
+if [[ -n "${SHANNONCOAT_SIGN_IDENTITY:-}" ]]; then
+  # An identity was asked for explicitly, so falling back to ad-hoc would
+  # quietly reintroduce the very problem it was set to avoid — and a
+  # release that ships ad-hoc revokes the Accessibility permission of
+  # everyone who updates. Fail the build instead.
+  codesign --force --sign "$SHANNONCOAT_SIGN_IDENTITY" \
+    --identifier "com.local.shannoncoat" "$APP" \
+    || { echo "error: signing with \"$SHANNONCOAT_SIGN_IDENTITY\" failed" >&2; exit 1; }
+else
+  codesign --force --sign - --identifier "com.local.shannoncoat" "$APP" >/dev/null 2>&1 \
+    || echo "warning: codesign failed; Accessibility permission may not stick" >&2
+fi
+
+touch "$APP"
+echo "Built: $APP"
+echo "Copy it to /Applications (or ~/Applications) to install."

icon/generate-icon.swift

@@ -0,0 +1,115 @@
+// Generates a placeholder AppIcon.iconset — a plain rounded-square
+// background with the coat glyph on top. Deliberately not derived from
+// Claude's own icon assets (unlike the old version of this file, which
+// composited on top of Claude.app's icon) — this is a stand-in until a
+// real icon is designed, so it draws everything itself from vector shapes.
+//
+// Usage:
+//   swift icon/generate-icon.swift icon/AppIcon.iconset
+//   iconutil -c icns icon/AppIcon.iconset -o icon/AppIcon.icns
+//   rm -rf icon/AppIcon.iconset
+import Cocoa
+
+// Renders at exact pixel dimensions via an explicit NSBitmapImageRep rather
+// than NSImage.lockFocus() — lockFocus rasterizes at the *main screen's*
+// backing scale factor, which would silently double every size on a Retina
+// display instead of producing the exact px asked for.
+func renderIcon(pixels: Int) -> Data {
+    let s = CGFloat(pixels)
+    guard let rep = NSBitmapImageRep(
+        bitmapDataPlanes: nil,
+        pixelsWide: pixels,
+        pixelsHigh: pixels,
+        bitsPerSample: 8,
+        samplesPerPixel: 4,
+        hasAlpha: true,
+        isPlanar: false,
+        colorSpaceName: .deviceRGB,
+        bytesPerRow: 0,
+        bitsPerPixel: 0
+    ) else { fatalError("could not create bitmap rep") }
+    rep.size = NSSize(width: s, height: s)
+
+    NSGraphicsContext.saveGraphicsState()
+    let ctx = NSGraphicsContext(bitmapImageRep: rep)
+    NSGraphicsContext.current = ctx
+    ctx?.imageInterpolation = .high
+
+    // Base: a plain rounded-square background (macOS "squircle"-ish corner
+    // radius), a neutral slate color — no borrowed assets.
+    let bg = NSColor(calibratedRed: 0.30, green: 0.32, blue: 0.36, alpha: 1.0)
+    let bgPath = NSBezierPath(roundedRect: NSRect(x: 0, y: 0, width: s, height: s),
+                               xRadius: s * 0.22, yRadius: s * 0.22)
+    bg.setFill()
+    bgPath.fill()
+
+    // Foreground: the same coat glyph as before — an original shape, not
+    // derived from any borrowed icon.
+    let coat = NSColor(calibratedRed: 0.62, green: 0.44, blue: 0.24, alpha: 1.0)
+    let coatShadow = NSColor(calibratedRed: 0.48, green: 0.33, blue: 0.16, alpha: 1.0)
+    let midX = s * 0.5
+    let topY = s * 0.62
+    let collarOutX = s * 0.34
+    let collarInX = s * 0.11
+    let shoulderY = s * 0.53
+    let waistY = s * 0.30
+    let waistHalf = s * 0.30
+    let hemY = s * 0.06
+    let hemHalf = s * 0.40
+
+    let path = NSBezierPath()
+    path.move(to: NSPoint(x: midX, y: topY))
+    path.line(to: NSPoint(x: midX - collarOutX, y: shoulderY))
+    path.line(to: NSPoint(x: midX - collarInX, y: shoulderY - s * 0.07))
+    path.line(to: NSPoint(x: midX - waistHalf, y: waistY))
+    path.line(to: NSPoint(x: midX - hemHalf, y: hemY))
+    path.line(to: NSPoint(x: midX + hemHalf, y: hemY))
+    path.line(to: NSPoint(x: midX + waistHalf, y: waistY))
+    path.line(to: NSPoint(x: midX + collarInX, y: shoulderY - s * 0.07))
+    path.line(to: NSPoint(x: midX + collarOutX, y: shoulderY))
+    path.close()
+    coat.setFill()
+    path.fill()
+
+    // A thin darker strip down the centerline reads as the coat's front
+    // seam/placket, breaking up the flat fill at larger sizes.
+    let seam = NSBezierPath()
+    seam.move(to: NSPoint(x: midX, y: topY))
+    seam.line(to: NSPoint(x: midX, y: hemY))
+    seam.lineWidth = max(s * 0.012, 1)
+    coatShadow.setStroke()
+    seam.stroke()
+
+    let buttonRadius = max(s * 0.02, 0.75)
+    for t: CGFloat in [0.20, 0.42, 0.64] {
+        let y = hemY + (shoulderY - hemY) * t
+        let r = NSRect(x: midX - buttonRadius, y: y - buttonRadius, width: buttonRadius * 2, height: buttonRadius * 2)
+        coatShadow.setFill()
+        NSBezierPath(ovalIn: r).fill()
+    }
+
+    ctx?.flushGraphics()
+    NSGraphicsContext.restoreGraphicsState()
+
+    guard let png = rep.representation(using: .png, properties: [:]) else {
+        fatalError("failed to encode PNG at \(pixels)px")
+    }
+    return png
+}
+
+let sizes: [(name: String, px: Int)] = [
+    ("icon_16x16", 16), ("icon_16x16@2x", 32),
+    ("icon_32x32", 32), ("icon_32x32@2x", 64),
+    ("icon_128x128", 128), ("icon_128x128@2x", 256),
+    ("icon_256x256", 256), ("icon_256x256@2x", 512),
+    ("icon_512x512", 512), ("icon_512x512@2x", 1024),
+]
+
+let outDir = CommandLine.arguments.count > 1 ? CommandLine.arguments[1] : "AppIcon.iconset"
+try? FileManager.default.createDirectory(atPath: outDir, withIntermediateDirectories: true)
+for (name, px) in sizes {
+    let data = renderIcon(pixels: px)
+    let path = "\(outDir)/\(name).png"
+    try? data.write(to: URL(fileURLWithPath: path))
+    print("wrote \(path)")
+}

shannoncoat.sh

@@ -1,182 +0,0 @@
-#!/usr/bin/env bash
-# shannoncoat - run more than one claude desktop profile on mac.
-#
-# claude desktop app seems to keep everything important in one config directory,
-# so a different --user-data-dir gives a practically separate install.
-# and CLAUDE_CONFIG_DIR env var can isolate claude code sessions natively.
-# this script combines these to isolate both desktop sessions and the claude
-# code sessions they run.
-#
-# profiles are yaml files in ~/.shannoncoat:
-#   # ~/.shannoncoat/client1.yaml -> profile named "client1"
-#   paths:
-#     code: ~/work/client1/.claude/code
-#     desktop: ~/work/client1/.claude/desktop
-#
-# claude code inside the desktop app can run in some folder which already
-# defines a CLAUDE_CONFIG_DIR with direnv etc, that variable can be defined
-# this way to allow both individual and desktop sessions work properly:
-#   export CLAUDE_CONFIG_DIR="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
-#
-
-set -euo pipefail
-
-APP="${CLAUDE_APP_PATH:-/Applications/Claude.app}"
-BIN="$APP/Contents/MacOS/Claude"
-ROOT="$HOME/.shannoncoat"
-DEFAULT="default"
-APP_DIR=""
-CODE_DIR=""
-CODE_KEY="code"
-DESKTOP_KEY="desktop"
-
-show_usage() {
-  cat <<EOF
-Usage: $0 <command> [profile]
-
-  launch <profile>   open a profile, leaving others running
-  switch <profile>   quit all other profiles, then open this one
-  quit <profile>     quit a profile
-  list               list all running profiles
-
-Profiles are yaml files in ~/.shannoncoat/. Syntax:
-  # profile-name.yaml
-  paths:
-    $CODE_KEY: ~/path/to/claude/code
-    $DESKTOP_KEY: ~/path/to/claude/desktop
-EOF
-}
-
-# expand leading ~ in path string to $HOME
-tilde_path() {
-  local p="$1"
-  echo "${p/#\~/$HOME}"
-}
-
-# pull one key out of the yaml, simple job avoid yq for now
-read_key() {
-  local file="$1" key="$2"
-  sed -EHn "s/^\s+$key:\s+//p" "$file" | tr -d '"'
-}
-
-# set APP_DIR and CODE_DIR for a profile, or keep empty for $DEFAULT
-get_dirs() {
-  local name="$1" file="$ROOT/$1.yaml"
-
-  [[ "$name" == "$DEFAULT" ]] && { return; }
-  if [[ ! -f "$file" ]]; then
-    echo "no profile named $name (expected $file)" >&2
-    exit 1
-  fi
-  APP_DIR="$(tilde_path "$(read_key "$file" $DESKTOP_KEY)")"
-  CODE_DIR="$(tilde_path "$(read_key "$file" $CODE_KEY)")"
-}
-
-# match a claude data dir to its profile name
-dir_to_profile() {
-  local dir="$1" file name
-  [[ "$dir" == "$DEFAULT" ]] && { echo "$DEFAULT"; return; }
-  for file in "$ROOT"/*.yaml; do
-    [[ -f "$file" ]] || continue
-    name="$(basename "$file" .yaml)"
-    if [[ "$(tilde_path "$(read_key "$file" $DESKTOP_KEY)")" == "$dir" ]]; then
-      echo "$name"
-      return
-    fi
-  done
-  echo "$dir"
-}
-
-# get all running claude processes as "pid<TAB>user-data-dir"
-running_info() {
-  local pid args dir
-  while read -r pid args; do
-    # if args has --user-data-dir=, extract it, otherwise use $DEFAULT
-    if [[ "$args" == *--user-data-dir=* ]]; then
-      dir="${args#*--user-data-dir=}"
-      dir="${dir%% *}"
-    else
-      dir="$DEFAULT"
-    fi
-    printf '%s\t%s\n' "$pid" "$dir"
-  done < <(pgrep -fl "$BIN" || true)
-}
-
-# get pid of a profile's claude process
-profile_to_pid() {
-  get_dirs "$1"
-  running_info | awk -F'\t' -v d="${APP_DIR:-default}" '$2 == d { print $1; exit }'
-}
-
-# switch focus to a process window, shell/term needs accessibility permissions
-app_focus() {
-  local pid="$1"
-  osascript > /dev/null 2>&1 <<EOF || true
-tell application "System Events"
-  set proc to first process whose unix id is $pid
-  set frontmost of proc to true
-  try
-    perform action "AXRaise" of window 1 of proc
-  end try
-end tell
-EOF
-}
-
-# start a claude desktop process with the right env vars and user-data-dir
-app_start() {
-  get_dirs "$1"
-  # app dir empty means default profile, just open normally
-  [[ -z "$APP_DIR" ]] && { open -a "$APP"; return; }
-  mkdir -p "$APP_DIR" "$CODE_DIR"
-  CLAUDE_CONFIG_DIR="$CODE_DIR" "$BIN" --user-data-dir="$APP_DIR" > /dev/null 2>&1 &
-  disown
-}
-
-# list all running profiles
-cmd_list() {
-  local pid dir
-  while read -r pid dir; do
-    printf 'profile: %s\tpid: %s\n' "$(dir_to_profile "$dir")" "$pid"
-  done < <(running_info)
-}
-
-# launch a profile or focus window if already running
-cmd_launch() {
-  local name="${1:?profile name required}" pid
-  pid="$(profile_to_pid "$name")"
-  [[ -n "$pid" ]] && { app_focus "$pid"; return; }
-  app_start "$name"
-}
-
-# switch to a profile quitting all others
-cmd_switch() {
-  local name="${1:?profile name required}" pid dir keep
-  # marks which profile to keep running, "default" if empty
-  get_dirs "$name"
-  keep="${APP_DIR:-"$DEFAULT"}"
-  # quit all other running claudes except the one to $keep
-  while read -r pid dir; do
-    [[ "$dir" == "$keep" ]] && continue
-    kill "$pid" 2>/dev/null || true
-  done < <(running_info)
-  # then launch selected profile
-  cmd_launch "$name"
-}
-
-# quit a profile if running
-cmd_quit() {
-  local name="${1:?profile name required}" pid
-  pid="$(profile_to_pid "$name")"
-  [[ -z "$pid" ]] && { echo "$name isn't running"; return; }
-  kill "$pid"
-}
-
-# main entry point
-case "${1:-}" in
-  launch)    cmd_launch "${2:-}" ;;
-  switch)    cmd_switch "${2:-}" ;;
-  quit)      cmd_quit   "${2:-}" ;;
-  list)      cmd_list ;;
-  -h|--help) show_usage; exit 0 ;;
-  *)         show_usage; exit 1 ;;
-esac