Agent profiles: support multiple Claude Code configs with env var stripping

[alexeygrigorev]

Source (maintainer, 2026-06-09)

I have two Claude installations. One is the usual with subscription. Another uses a different config. There is a .claude folder that sets up the second config. You can set up a config directory and then point to this directory and it starts a different session. I want to use that. For Claude, especially for the second one, we also need to be resetting some variables in the same way we do for OpenCode. For all Claude sessions we unset these variables and then we can have the default one and then we can have profiles. These profiles can be configured in the host configuration. As a follow-up, do similar for Codex.

Background

Claude Code supports CLAUDE_CONFIG_DIR to point to a different config directory. The maintainer has two profiles:

1. Default (~/.claude/) — normal Anthropic subscription
2. Z.AI (~/.zlaude/) — uses ANTHROPIC_AUTH_TOKEN, ANTHROPIC_BASE_URL="https://api.z.ai/api/anthropic", and model overrides (glm-5.1, glm-5-turbo)

The setup lives in ~/git/.claude/configure.sh which creates the ~/.zlaude profile.

We already strip 71 API key env vars for OpenCode sessions (SessionTypePickerSheet.OPENCODE_ENV_UNSET_VARS). The same pattern should apply to Claude Code sessions — unset all provider API keys so the profile's own credentials are used, not leaked env vars from the host.

Scope

1. Env var stripping for Claude Code sessions

• When launching a Claude Code session, unset the same provider API key env vars we unset for OpenCode (all 71 vars from OPENCODE_ENV_UNSET_VARS)
• This ensures Claude Code uses its own credentials from CLAUDE_CONFIG_DIR, not leaked host env vars
• The env strip should be the default for ALL Claude Code sessions, not just the second profile

2. Agent profiles in host configuration

• Add a "Claude Code profiles" section to the host configuration (per-host, not global)
• Each profile has:
  • Name (e.g., "Default", "Z.AI")
  • Config directory path on the remote host (e.g., ~/.claude, ~/.zlaude)
  • When launching a Claude session with this profile, set CLAUDE_CONFIG_DIR=<path> before the claude command
• Default profile: no CLAUDE_CONFIG_DIR override (uses Claude Code's default ~/.claude)
• Session type picker shows available profiles for Claude when creating a new session

3. Session creation flow

• In the session type picker, when "Claude Code" is selected, show a profile selector (dropdown or chip row) if multiple profiles are configured
• The selected profile determines the CLAUDE_CONFIG_DIR env var set before launch
• The env var strip (all provider keys) is always applied regardless of profile

Acceptance criteria

• Claude Code sessions strip all provider API key env vars (same 71 as OpenCode)
• Host configuration supports multiple Claude Code profiles (name + config dir path)
• Session type picker shows profile selector when >1 profile exists
• Launching a Claude session with a profile sets CLAUDE_CONFIG_DIR before the claude command
• Default profile (no config dir override) always available
• Existing sessions continue to work without profile configuration (backward compatible)

Non-goals

• Codex profile support (separate follow-up issue)
• Profile sync between Android device and remote host (profiles reference remote paths)
• Creating/managing profiles on the remote host from the app (assume they exist)
• OpenCode profile support (OpenCode already works differently with its SQLite config)

Files

• app/src/main/java/com/pocketshell/app/projects/SessionTypePickerSheet.kt — add profile selector, env strip for Claude
• shared/core-storage/src/main/java/com/pocketshell/core/storage/entity/HostEntity.kt — add profile fields
• app/src/main/java/com/pocketshell/app/hosts/AddEditHostViewModel.kt — profile editing in host form
• app/src/main/java/com/pocketshell/app/projects/FolderListGateway.kt — launch command composition with profile

Refs

• ~/git/.claude/configure.sh — existing profile setup script (zlaude)
• ~/.zlaude/settings.json — Z.AI profile config (ANTHROPIC_AUTH_TOKEN, ANTHROPIC_BASE_URL)
• Claude Code env vars docs — CLAUDE_CONFIG_DIR documentation
• SessionTypePickerSheet.OPENCODE_ENV_UNSET_VARS — existing 71-var env strip pattern

[alexeygrigorev]

Implementation complete -- issue #627

Agent profiles for Claude Code with env var stripping.

Changed files

Data layer:

• shared/core-storage/src/main/java/com/pocketshell/core/storage/entity/HostEntity.kt -- added claudeProfilesJson: String? column
• shared/core-storage/src/main/java/com/pocketshell/core/storage/AppDatabase.kt -- bumped schema to v14, added MIGRATION_13_14 (ALTER TABLE hosts ADD COLUMN)

UI layer:

• app/src/main/java/com/pocketshell/app/projects/SessionTypePickerSheet.kt -- claudeLaunchCommand() with env strip (same 71 vars as OpenCode), CLAUDE_CONFIG_DIR support, profile selector UI, ClaudeProfile data class with JSON serialization
• app/src/main/java/com/pocketshell/app/projects/FolderListScreen.kt -- wires claudeProfiles from ViewModel to SessionTypePickerSheet, passes profiles to startCommand()
• app/src/main/java/com/pocketshell/app/projects/FolderListViewModel.kt -- added _claudeProfiles StateFlow loaded from host entity during bind()
• app/src/main/java/com/pocketshell/app/hosts/AddEditHostScreen.kt -- added ClaudeProfilesSection composable (add/edit/remove profiles with name + config dir)
• app/src/main/java/com/pocketshell/app/hosts/AddEditHostViewModel.kt -- added claudeProfiles to HostFormState, load/save/dirty-check

Tests:

• app/src/test/java/com/pocketshell/app/projects/SessionTypeChoiceCommandTest.kt -- updated Claude tests for env-stripped form, added profile tests (config dir, shell quoting, fallback, ignore for other agents/shell), added ClaudeProfileTest for JSON round-trip
• shared/core-storage/src/test/java/com/pocketshell/core/storage/AppDatabaseTest.kt -- v13->v14 migration tests (column add + JSON round-trip), claudeProfilesJson assertion on v11 migration

git status --short

M app/src/main/java/com/pocketshell/app/hosts/AddEditHostScreen.kt
M app/src/main/java/com/pocketshell/app/hosts/AddEditHostViewModel.kt
M app/src/main/java/com/pocketshell/app/projects/FolderListScreen.kt
M app/src/main/java/com/pocketshell/app/projects/FolderListViewModel.kt
M app/src/main/java/com/pocketshell/app/projects/SessionTypePickerSheet.kt
M app/src/test/java/com/pocketshell/app/projects/SessionTypeChoiceCommandTest.kt
M shared/core-storage/src/main/java/com/pocketshell/core/storage/AppDatabase.kt
M shared/core-storage/src/main/java/com/pocketshell/core/storage/entity/HostEntity.kt
M shared/core-storage/src/test/java/com/pocketshell/core/storage/AppDatabaseTest.kt

Build output

BUILD SUCCESSFUL in 17s
241 actionable tasks: 72 executed, 4 from cache, 165 up-to-date

Test output

SessionTypeChoiceCommandTest (18 tests) -- ALL PASSED
ClaudeProfileTest (8 tests) -- ALL PASSED
AddEditHostViewModelTest (14 tests) -- ALL PASSED
AppDatabaseTest (16 tests) -- ALL PASSED

Acceptance criteria verdicts

• Claude Code sessions strip all provider API key env vars (same 71 as OpenCode) -- claudeLaunchCommand() uses OPENCODE_ENV_UNSET_VARS, verified by claudeStripsAllSeventyOneProviderVars
• Host configuration supports multiple Claude Code profiles (name + config dir path) -- HostEntity.claudeProfilesJson + ClaudeProfilesSection in AddEditHostScreen + ViewModel load/save
• Session type picker shows profile selector when >1 profile exists -- segmented control shown only when claudeProfiles.size > 1
• Launching a Claude session with a profile sets CLAUDE_CONFIG_DIR before the claude command -- claudeLaunchCommand() prefixes with CLAUDE_CONFIG_DIR=<path>, shell-quoted
• Default profile (no config dir override) always available -- when no profile selected or profile has empty configDir, no CLAUDE_CONFIG_DIR is set
• Existing sessions continue to work without profile configuration -- nullable column migration, empty list default, backward-compatible startCommand(emptyList())

Judgment calls

• Profile UI in host form: Used inline card-based editing (name + config dir per profile, add/remove buttons) instead of a separate screen. Keeps the flow simple for what is typically 1-3 profiles.
• Default profile: The default profile is implicit (no config dir override). When 0 profiles are configured, no selector appears. When 1+ profiles exist, the first entry can represent the default (empty configDir). The profile selector appears only when >1 profiles are configured.
• No FolderListGateway.kt change: The gateway was listed in scope but didn't need modification because the launch command is fully composed in SessionTypeChoice.startCommand() before reaching the gateway.
• ClaudeProfile in SessionTypePickerSheet: The data class lives in the same file as the picker to avoid introducing a new shared model file; it's referenced by AddEditHostViewModel via import.

Worktree path

/home/alexey/git/pocketshell/.claude/worktrees/agent-a09d9fe6cbcbf9322

[alexeygrigorev]

APPROVED

Build and test evidence

• ./gradlew :app:compileDebugKotlin :shared:core-storage:compileDebugKotlin -- BUILD SUCCESSFUL in 14s (exit 0)
• ./gradlew :app:testDebugUnitTest --tests "*.SessionTypeChoiceCommandTest" --tests "*.ClaudeProfileTest" -- 18 tests PASSED (exit 0)
• ./gradlew :shared:core-storage:testDebugUnitTest --tests "*.AppDatabaseTest" -- all migration + CRUD tests PASSED (exit 0)
• ./gradlew :app:testDebugUnitTest --tests "*.AddEditHostViewModelTest" -- 11 tests PASSED (exit 0)

All tests are JVM unit tests. No emulator or Docker required. CI workflow (.github/workflows/tests.yml) runs ./gradlew test which covers these. CI-compatible.

CI compatibility check

Verified .github/workflows/tests.yml: the unit job runs ./gradlew test which includes all JVM unit tests. No Docker services, emulator, or special ports needed. Green locally means green on CI.

Per-acceptance-criterion verdict

• AC1: PASS -- claudeLaunchCommand() uses OPENCODE_ENV_UNSET_VARS (same 71 vars as OpenCode). Test claudeStripsAllSeventyOneProviderVars iterates every var and asserts it appears in the command string.
• AC2: PASS -- HostEntity.claudeProfilesJson (nullable TEXT column) stores JSON-serialized profiles. ClaudeProfilesSection composable in AddEditHostScreen provides add/edit/remove UI. AddEditHostViewModel loads/saves/dirty-checks profiles.
• AC3: PASS -- Profile selector is a segmented Row shown only when agentKind == AgentCli.Claude && claudeProfiles.size > 1. Test tag SESSION_TYPE_PICKER_CLAUDE_PROFILE_TAG attached for UI testing.
• AC4: PASS -- claudeLaunchCommand() prefixes with CLAUDE_CONFIG_DIR=<quoted-path> when a non-default profile is selected. Shell quoting uses standard POSIX '..' with '\'' escaping. Test claudeConfigDirIsShellQuoted validates a path containing a single quote.
• AC5: PASS -- claudeProfile state initializes to null (no config dir override). When profile has empty configDir, no CLAUDE_CONFIG_DIR is set. Test claudeProfileWithEmptyConfigDirDoesNotSetEnvVar covers this.
• AC6: PASS -- Migration is ALTER TABLE hosts ADD COLUMN claudeProfilesJson TEXT (nullable, non-destructive). fromJson(null) returns emptyList(). startCommand(profiles = emptyList()) is the default parameter value, so RepoBrowserScreen's existing startCommand() call works without changes.

Migration review

v13 to v14: ALTER TABLE hosts ADD COLUMN claudeProfilesJson TEXT -- adds a nullable column with no default. Non-destructive. Existing data is preserved. Tests verify both the column addition and JSON round-trip through Room.

Env strip correctness

The Claude env strip reuses the identical OPENCODE_ENV_UNSET_VARS list (71 entries) used by OpenCode. The require(name.matches(ENV_VAR_NAME_REGEX)) guard prevents shell injection through env var names. The regex ^[A-Za-z0-9_]+$ is validated by the existing openCodeEnvVarNamesAreShellSafeIdentifiers test.

Security review

• Shell quoting for CLAUDE_CONFIG_DIR uses standard POSIX single-quote escaping with test coverage.
• Env var names are validated against ENV_VAR_NAME_REGEX before interpolation.
• No secrets or credentials are stored in the profiles -- only a name and a remote path.

Scope check

9 files changed, all within declared scope. No files outside scope touched. No scope creep.

Suggested follow-ups (non-blocking)

• The profile selector initializes with no pre-selection when >1 profiles exist. Consider defaulting to the first profile's name so one button appears visually selected on open.
• RepoBrowserScreen calls startCommand() without profiles, so Claude sessions launched from repo browser will always use the default profile. If profiles should be available there too, that is a follow-up enhancement.
• Profiles with empty names can be saved in the host form but are silently dropped by fromJson on reload. Adding validation in the save path would prevent the confusion.