One plugin shelf. A loadout per terminal.

1. Resolve. Read the profile, follow its extends, and list what is installed with claude plugin list --json. ccshelf reports plugins that a profile names but you lack, with the install command. Nothing is installed silently.
2. Compile. Write a settings file that sets enabledPlugins to false for every installed plugin the profile does not list. ccshelf regenerates it on each run, so a plugin you install tomorrow does not leak in. The same file can hide claude.ai connectors and named MCP servers.
3. Validate. Claude Code ignores an invalid settings file without a message, so ccshelf checks the generated JSON against a closed schema before every launch.
4. Start. On macOS and Linux ccshelf replaces itself with claude using exec, so job control and exit codes are exactly those of plain claude. On Windows it starts claude and waits.

Closed profile schema implemented

The generator writes only an allowlist of settings keys. A profile can never write permissions, hooks, apiKeyHelper or endpoint settings, and its environment names pass an allowlist. Protects against a profile that redirects your prompts to another endpoint or runs code at start.

Trust the resolved closure, pinned by commit SHA implemented

Shared profiles need explicit trust. The trust hash covers the profile, its parents, the MCP registry entries it uses, its prompt file and the source commit. --yes never accepts trust, and CI fails closed. Project profiles are off by default. A source can follow a branch only through an explicit setting, and every new commit on it needs trust again. Protects against a changed tag, branch or registry entry slipping in after you approved.

No shadowing, protected plugins implemented

A project profile can never shadow another source's profile. The org config can list plugins and MCP servers (audit, secret scanning) that no profile may mask. Protects against a repository or a profile switching off a control the organization requires.

Private, verified cache implemented

Cache directories are owner-only (mode 0700, files 0600) and created without following symlinks. ccshelf re-hashes each content-addressed file before reuse. It never writes secrets to disk or to argv, and it redacts output. Protects against another local user, or a stale file, changing what claude receives.

Hardened CI and releases signed release available

The Action is pinned by full commit SHA and embeds the expected checksum of the binary it downloads. cosign signs the release checksums. Archives have GitHub build provenance and an SBOM. Workflows use permissions: {} and least privilege. Protects against a tampered binary or a compromised action in your pipeline.

Read the full security design and the security policy.

The test suites pass on native macOS, Linux and Windows CI runners, across amd64 and arm64. Only macOS has driven the real claude. GHE Server is designed for but untested.

Linux and macOS

curl -fsSL https://github.com/yorch/ccshelf/releases/latest/download/install.sh | sh

Supports amd64 and arm64. WSL uses the Linux installer. Installs into ~/.local/bin, without sudo, and needs curl. To pin a version and require cosign signature verification, run curl -fsSL https://github.com/yorch/ccshelf/releases/latest/download/install.sh | sh -s -- --version v0.2.0 --require-signature. SHA-256 verification against that release's checksums.txt is always required. The installer checks the signature when cosign is installed.

Windows

irm https://github.com/yorch/ccshelf/releases/latest/download/install.ps1 | iex

Supports amd64 and arm64 in Windows PowerShell 5.1 or PowerShell 7. Installs into %LOCALAPPDATA%\Programs\ccshelf. Add -AddToPath to update your user PATH. To pin a version and require cosign, run & ([scriptblock]::Create((irm https://github.com/yorch/ccshelf/releases/latest/download/install.ps1))) -Version v0.2.0 -RequireSignature. The binaries are not notarized or Authenticode-signed yet. ccshelf is unofficial and not affiliated with Anthropic. See the README for all options, manual verification and uninstall instructions.

Build from source

git clone https://github.com/yorch/ccshelf
cd ccshelf
go build -o ccshelf ./cmd/ccshelf
./ccshelf version

Needs the Go version in go.mod or newer. Put the binary on your PATH, or run go install ./cmd/ccshelf from the checkout to install into $(go env GOPATH)/bin. ccshelf update leaves a go install copy to Go and prints the command to run.

Try it

ccshelf new sre-night --from base --plugin sre-kit@acme
ccshelf ls
ccshelf show sre-night
ccshelf dry-run sre-night
ccshelf run sre-night
ccshelf run --account personal sre-night --resume

Create a personal profile, list profiles from every source, see the resolved plugins and trust closure, print the exact claude command without running it, then run it. The last line shows the argument order: ccshelf flags first, then the profile name, then whatever goes to claude.

Every command works with flags alone. On a terminal, ccshelf asks for missing values and prints the equivalent command line, so you can script it later.

Missing plugins

ccshelf run --install-missing sre-night
ccshelf run --install-missing --yes sre-night
ccshelf run --install-missing=sre-kit@acme --yes sre-night

A profile chooses plugins. It does not install them. When a plugin of the profile is not installed, ccshelf run warns and prints the /plugin install command. With --install-missing, ccshelf prints claude plugin install --scope user for each missing plugin, asks you to confirm, and installs them. --yes skips the question. --install-missing=id,id installs only the plugins that you name, and each one must be in the profile.

It installs only from a marketplace that you already added, and it never adds one. It runs after the trust check and not for a profile from a project source. Managed policy applies, because Claude Code does the install. With --yes, plugins install without a question, so use it only for profiles that you trust. dry-run never installs. See decision D-65.

For an organization

ccshelf lint
ccshelf compile --check
ccshelf catalog build

Run these in your org data repository, or through the reusable GitHub Action, which installs a checksum-verified release and runs one command. Start from the fictional template in examples/org-data-repo and read the Action guide.

Launcher

run <profile>

Start claude with the profile. Arguments after the name go to claude. Without a name, a picker appears on a terminal. --install-missing installs the plugins of the profile that are not installed.

dry-run <profile>

Print the exact claude command and run nothing.

show <profile>

The resolved plugins, MCP servers and trust closure.

ls

List profiles from every source.

new <profile>

Create a personal profile, optionally --from another.

trust <profile>

Show what a shared profile does and record trust, pinned to a commit.

The full reference, with every flag, is the command-line design in the repository.