U-Pool 0.6.0 — surgical config writes, Windows environment, Claude Desktop

Switching provider in 0.5.0 rewrote the target CLI's config file from the provider
record alone. That removed the leftovers it was meant to remove and everything else
with them — your plugins, your theme, your MCP servers, your project trust levels.

0.6.0 only touches the keys it owns.

Surgical writes

~/.claude/settings.json keeps enabledPlugins, extraKnownMarketplaces, theme,
model, effortLevel, hooks, statusLine and permissions.allow / deny
through a switch. U-Pool manages the env block and three toggle keys, nothing else.

~/.codex/config.toml keeps [mcp_servers.*] with its env tables, [plugins.*],
[projects.*] trust levels, notify, [windows], [features] and
[shell_environment_policy]. U-Pool manages model_provider, model, the
top-level knobs a provider supplies, the bypass pair, web_search, and the
[model_providers] tables — where only the active provider's table survives, since
stale sibling tables were the original bug.

A file that will not parse now refuses the switch rather than being overwritten.

Windows environment variables

Rewriting files was never enough. Codex resolves env_key against the process
environment, so a config.toml naming env_key = "codefast" reads that variable
and ignores what U-Pool wrote. Claude Code honours ANTHROPIC_* from the
environment too. A switch now updates HKCU\Environment and broadcasts
WM_SETTINGCHANGE, so the next shell is on the provider you picked without a
sign-out.

It removes only the names it set itself. Your own MINIMAX_CN_API_KEY or
YUNWU_API_KEY in the same key are not U-Pool's to delete, and neither is an
ANTHROPIC_AUTH_TOKEN you added to settings.json by hand. Switching provider
still replaces the variables that name the account — that is what a switch means.

auth.json

~/.codex/auth.json is written from scratch. A provider with a custom env_key
leaves it empty and takes its key from the environment instead, so the old "set that
variable yourself" warning is gone. A ChatGPT login found there is stashed first and
restored when you switch back to the official provider.

Backups

One current copy beside the original — settings.json.backup,
config.toml.backup, auth.json.backup — overwritten on every change. A switch in
Settings turns it off, and nothing is written while it is off. This replaces the
ten-deep rotation under ~/.u-pool/backups/.

Claude Desktop

A third tab in the header. It writes nothing in this release. Claude Desktop has
no base-URL setting and its only lever is the OS environment, which it shares with
Claude Code, so the tab stores providers and says so rather than guessing.
%APPDATA%\Claude\claude_desktop_config.json is never opened.

Also

• The provider form showed Add provider on the save button while editing. It now
  reads Save changes, and one provider's state can no longer survive into the next.
• "CC Switch" wording removed from the preset picker.
• paths.home() refuses to resolve the real home during a test run, and
  scripts/sandbox.py runs one-off scripts against a throwaway home and a scratch
  registry key.

212 tests. The decisive ones rebuild a settings.json and a config.toml from the
shapes those files actually have in use and assert every foreign key survives.

---

Heads up: this release has not been through a code review pass. It is covered by
tests, and the bundle starts, but the switch has not been exercised by hand in the
built app. Your previous config files are copied to <name>.backup before the first
write as long as backup mode is on, which it is by default.