feat(auth): add shared resource controls

src/auth/auth-commands.ts

@@ -24,6 +24,7 @@ import {
   handleBackup,
   handleList,
   handleShow,
+  handleResources,
   handleRemove,
   handleDefault,
   handleResetDefault,
@@ -74,6 +75,9 @@ class AuthCommands {
     );
     console.log(`  ${color('list', 'command')}                   List all saved profiles`);
     console.log(`  ${color('show <profile>', 'command')}         Show profile details`);
+    console.log(
+      `  ${color('resources <profile>', 'command')}    Show or change shared resource mode`
+    );
     console.log(`  ${color('remove <profile>', 'command')}       Remove saved profile`);
     console.log(`  ${color('default <profile>', 'command')}      Set default profile`);
     console.log(
@@ -105,6 +109,10 @@ class AuthCommands {
     console.log(`  ${dim('# Create clean profile without shared commands/skills/agents')}`);
     console.log(`  ${color('ccs auth create sandbox --bare', 'command')}`);
     console.log('');
+    console.log(`  ${dim('# Change shared resources for an existing account')}`);
+    console.log(`  ${color('ccs auth resources work --mode profile-local', 'command')}`);
+    console.log(`  ${color('ccs auth resources work --mode shared', 'command')}`);
+    console.log('');
     console.log(`  ${dim('# Set work as default')}`);
     console.log(`  ${color('ccs auth default work', 'command')}`);
     console.log('');
@@ -136,6 +144,9 @@ class AuthCommands {
     console.log(
       `  ${color('--bare', 'command')}                    Create clean profile without shared symlinks (no CK/commands/skills)`
     );
+    console.log(
+      `  ${color('--mode <mode>', 'command')}              Shared resource mode for resources: shared|profile-local`
+    );
     console.log(
       `  ${color('--yes, -y', 'command')}                 Skip confirmation prompts (remove)`
     );
@@ -160,6 +171,9 @@ class AuthCommands {
     console.log(
       `  Non-bare account profiles share basic ${color('settings.json', 'path')} with ${color('~/.claude/settings.json', 'path')}; ${color('ccs auth show <profile>', 'command')} shows the link state.`
     );
+    console.log(
+      `  Shared Resources control plugins/commands/skills/agents/settings.json; History Sync controls project/session continuity only.`
+    );
     console.log(
       `  History sync is opt-in: both accounts need shared mode and the same ${color('context_group', 'path')}.`
     );
@@ -170,7 +184,10 @@ class AuthCommands {
       `  To make future plain ${color('ccs', 'command')} resume with an account, set ${color('ccs auth default <profile>', 'command')}; back up the current native lane first with ${color('ccs auth backup default', 'command')}.`
     );
     console.log(
-      `  Existing profiles: open ${color('ccs config', 'command')} -> Accounts -> Edit Context.`
+      `  Existing history sync: open ${color('ccs config', 'command')} -> Accounts -> Edit Context.`
+    );
+    console.log(
+      `  Existing shared resources: use ${color('ccs auth resources <profile> --mode shared|profile-local', 'command')}.`
     );
     console.log(`  Shared context groups are normalized (trim + lowercase) and spaces become "-".`);
     console.log(
@@ -204,6 +221,10 @@ class AuthCommands {
     return handleShow(this.getContext(), args);
   }
 
+  async handleResources(args: string[]): Promise<void> {
+    return handleResources(this.getContext(), args);
+  }
+
   /**
    * Remove profile - delegates to remove-command.ts
    */
@@ -263,6 +284,10 @@ class AuthCommands {
         await this.handleShow(commandArgs);
         break;
 
+      case 'resources':
+        await this.handleResources(commandArgs);
+        break;
+
       case 'remove':
         await this.handleRemove(commandArgs);
         break;

src/auth/commands/backup-command.ts

@@ -10,6 +10,7 @@ import {
   resolveRuntimePlainCcsResumeLane,
 } from '../resume-lane-diagnostics';
 import { isAccountContextMetadata, resolveAccountContextPolicy } from '../account-context';
+import { isProfileLocalSharedResourceMode } from '../shared-resource-policy';
 import { CommandContext, parseArgs } from './types';
 
 interface BackupManifest {
@@ -69,7 +70,7 @@ export async function handleBackup(ctx: CommandContext, args: string[]): Promise
         isAccountContextMetadata(profile) ? profile : undefined
       );
       sourceConfigDir = await ctx.instanceMgr.ensureInstance(profileName, contextPolicy, {
-        bare: profile.bare === true,
+        bare: isProfileLocalSharedResourceMode(profile),
       });
       artifactNames = getContinuityArtifactNames('account');
     }

src/auth/commands/create-command.ts

@@ -21,6 +21,10 @@ import {
   isValidAccountProfileName,
   resolveAccountContextPolicy,
 } from '../account-context';
+import {
+  isProfileLocalSharedResourceMode,
+  sharedResourceModeToMetadata,
+} from '../shared-resource-policy';
 import { exitWithError } from '../../errors';
 import { ExitCode } from '../../errors/exit-codes';
 import { CommandContext, parseArgs } from './types';
@@ -36,11 +40,20 @@ function sanitizeProfileNameForInstance(name: string): string {
  */
 export async function handleCreate(ctx: CommandContext, args: string[]): Promise<void> {
   await initUI();
-  const { profileName, force, shareContext, contextGroup, deeperContinuity, bare, unknownFlags } =
-    parseArgs(args);
+  const {
+    profileName,
+    force,
+    shareContext,
+    contextGroup,
+    deeperContinuity,
+    bare,
+    mode,
+    unknownFlags,
+  } = parseArgs(args);
 
-  if (unknownFlags && unknownFlags.length > 0) {
-    const unknownList = unknownFlags.map((flag) => `"${flag}"`).join(', ');
+  const unsupportedOptions = [...(unknownFlags ?? []), ...(mode !== undefined ? ['--mode'] : [])];
+  if (unsupportedOptions.length > 0) {
+    const unknownList = unsupportedOptions.map((flag) => `"${flag}"`).join(', ');
     console.log(fail(`Unknown option(s): ${unknownList}`));
     console.log('');
     console.log(
@@ -117,8 +130,10 @@ export async function handleCreate(ctx: CommandContext, args: string[]): Promise
     ? ctx.registry.getAllAccountsUnified()[profileName]
     : undefined;
   const previousBare =
-    previousLegacyProfile?.bare === true || previousUnifiedProfile?.bare === true;
+    isProfileLocalSharedResourceMode(previousLegacyProfile) ||
+    isProfileLocalSharedResourceMode(previousUnifiedProfile);
   const effectiveBare = bare === true || (profileExistedBeforeCreate && previousBare);
+  const resourceMetadata = effectiveBare ? sharedResourceModeToMetadata('profile-local') : {};
   const previousContextPolicy =
     profileExistedBeforeCreate && (previousUnifiedProfile || previousLegacyProfile)
       ? resolveAccountContextPolicy(previousUnifiedProfile || previousLegacyProfile)
@@ -200,13 +215,13 @@ export async function handleCreate(ctx: CommandContext, args: string[]): Promise
         ctx.registry.updateAccountUnified(profileName, {
           context_mode: contextMetadata.context_mode,
           context_group: contextMetadata.context_group,
-          ...(effectiveBare ? { bare: true } : {}),
+          ...resourceMetadata,
         });
         ctx.registry.touchAccountUnified(profileName);
       } else {
         ctx.registry.createAccountUnified(profileName, {
           ...contextMetadata,
-          ...(effectiveBare ? { bare: true } : {}),
+          ...resourceMetadata,
         });
       }
     } else {
@@ -216,14 +231,14 @@ export async function handleCreate(ctx: CommandContext, args: string[]): Promise
           type: 'account',
           context_mode: contextMetadata.context_mode,
           context_group: contextMetadata.context_group,
-          ...(effectiveBare ? { bare: true } : {}),
+          ...resourceMetadata,
         });
       } else {
         ctx.registry.createProfile(profileName, {
           type: 'account',
           context_mode: contextMetadata.context_mode,
           context_group: contextMetadata.context_group,
-          ...(effectiveBare ? { bare: true } : {}),
+          ...resourceMetadata,
         });
       }
     }
@@ -282,7 +297,7 @@ export async function handleCreate(ctx: CommandContext, args: string[]): Promise
               `Type:     account\n` +
               `Context:  ${formatAccountContextPolicy(contextPolicy)}\n` +
               `Tokens:   isolated per account\n` +
-              `Settings: ${effectiveBare ? 'profile-local (bare)' : 'shared with ~/.claude/settings.json'}` +
+              `Resources: ${effectiveBare ? 'profile-local (bare)' : 'shared with ~/.claude'}` +
               (effectiveBare ? '\nMode:     bare (no shared symlinks)' : ''),
             'Profile Created'
           )

src/auth/commands/index.ts

@@ -19,5 +19,6 @@ export { handleCreate } from './create-command';
 export { handleBackup } from './backup-command';
 export { handleList } from './list-command';
 export { handleShow } from './show-command';
+export { handleResources } from './resources-command';
 export { handleRemove } from './remove-command';
 export { handleDefault, handleResetDefault } from './default-command';

src/auth/commands/list-command.ts

@@ -7,6 +7,7 @@
 import { ProfileMetadata } from '../../types';
 import { initUI, header, color, dim, warn, table } from '../../utils/ui';
 import { resolveAccountContextPolicy, formatAccountContextPolicy } from '../account-context';
+import { resolveSharedResourcePolicy } from '../shared-resource-policy';
 import { exitWithError } from '../../errors';
 import { ExitCode } from '../../errors/exit-codes';
 import { CommandContext, ListOutput, parseArgs, formatRelativeTime } from './types';
@@ -33,6 +34,8 @@ export async function handleList(ctx: CommandContext, args: string[]): Promise<v
         context_mode: account.context_mode,
         context_group: account.context_group,
         continuity_mode: account.continuity_mode,
+        shared_resource_mode: account.shared_resource_mode,
+        bare: account.bare,
       };
     }
 
@@ -46,6 +49,7 @@ export async function handleList(ctx: CommandContext, args: string[]): Promise<v
         profiles: profileNames.map((name) => {
           const profile = profiles[name];
           const contextPolicy = resolveAccountContextPolicy(profile);
+          const resourcePolicy = resolveSharedResourcePolicy(profile);
           const isDefault = name === defaultProfile;
           const instancePath = ctx.instanceMgr.getInstancePath(name);
 
@@ -58,6 +62,9 @@ export async function handleList(ctx: CommandContext, args: string[]): Promise<v
             context_mode: contextPolicy.mode,
             context_group: contextPolicy.group || null,
             continuity_mode: contextPolicy.mode === 'shared' ? contextPolicy.continuityMode : null,
+            shared_resource_mode: resourcePolicy.mode,
+            shared_resource_inferred: resourcePolicy.inferred,
+            ...(resourcePolicy.profileLocal ? { bare: true } : {}),
             instance_path: instancePath,
           };
         }),
@@ -107,6 +114,7 @@ export async function handleList(ctx: CommandContext, args: string[]): Promise<v
       const profile = profiles[name];
       const isDefault = name === defaultProfile;
       const contextPolicy = resolveAccountContextPolicy(profile);
+      const resourcePolicy = resolveSharedResourcePolicy(profile);
 
       // Status column
       const status = isDefault ? color('[OK] default', 'success') : color('[OK]', 'success');
@@ -122,6 +130,7 @@ export async function handleList(ctx: CommandContext, args: string[]): Promise<v
       if (verbose) {
         row.push(lastUsed);
         row.push(formatAccountContextPolicy(contextPolicy));
+        row.push(resourcePolicy.mode);
       }
 
       return row;
@@ -129,14 +138,14 @@ export async function handleList(ctx: CommandContext, args: string[]): Promise<v
 
     // Headers
     const headers = verbose
-      ? ['Profile', 'Type', 'Status', 'Last Used', 'Context']
+      ? ['Profile', 'Type', 'Status', 'Last Used', 'Context', 'Resources']
       : ['Profile', 'Type', 'Status'];
 
     // Print table
     console.log(
       table(rows, {
         head: headers,
-        colWidths: verbose ? [15, 12, 15, 12, 34] : [15, 12, 15],
+        colWidths: verbose ? [15, 12, 15, 12, 34, 16] : [15, 12, 15],
       })
     );
     console.log('');

src/auth/commands/resources-command.ts

@@ -0,0 +1,141 @@
+import { initUI, header, color, fail, ok, table } from '../../utils/ui';
+import { resolveAccountContextPolicy } from '../account-context';
+import {
+  isSharedResourceMode,
+  resolveSharedResourcePolicy,
+  sharedResourceModeToMetadata,
+  type SharedResourceMode,
+} from '../shared-resource-policy';
+import { exitWithError } from '../../errors';
+import { ExitCode } from '../../errors/exit-codes';
+import { CommandContext, parseArgs } from './types';
+
+function formatMode(mode: SharedResourceMode): string {
+  return mode === 'profile-local' ? 'profile-local' : 'shared';
+}
+
+function modeDescription(mode: SharedResourceMode): string {
+  return mode === 'profile-local'
+    ? 'profile-local resources; plugins/settings/commands/skills/agents are not linked from ~/.claude'
+    : 'shared resources from ~/.claude; plugins/settings/commands/skills/agents are linked into the account';
+}
+
+export async function handleResources(ctx: CommandContext, args: string[]): Promise<void> {
+  await initUI();
+  const { profileName, mode, json } = parseArgs(args);
+
+  if (!profileName) {
+    console.log(fail('Profile name is required'));
+    console.log('');
+    console.log(
+      `Usage: ${color('ccs auth resources <profile> [--mode shared|profile-local] [--json]', 'command')}`
+    );
+    exitWithError('Profile name is required', ExitCode.PROFILE_ERROR);
+  }
+
+  const profiles = ctx.registry.getAllProfilesMerged();
+  const currentProfile = profiles[profileName];
+  if (!currentProfile || currentProfile.type !== 'account') {
+    exitWithError(`Profile not found: ${profileName}`, ExitCode.PROFILE_ERROR);
+  }
+
+  const currentPolicy = resolveSharedResourcePolicy(currentProfile);
+
+  if (mode !== undefined && !isSharedResourceMode(mode)) {
+    exitWithError(
+      'Invalid shared resource mode: expected shared|profile-local',
+      ExitCode.PROFILE_ERROR
+    );
+  }
+
+  if (!mode) {
+    if (json) {
+      console.log(
+        JSON.stringify(
+          {
+            name: profileName,
+            shared_resource_mode: currentPolicy.mode,
+            shared_resource_inferred: currentPolicy.inferred,
+            bare: currentPolicy.profileLocal ? true : undefined,
+          },
+          null,
+          2
+        )
+      );
+      return;
+    }
+
+    console.log(header(`Shared Resources: ${profileName}`));
+    console.log('');
+    console.log(
+      table(
+        [
+          ['Mode', formatMode(currentPolicy.mode)],
+          ['Effective', modeDescription(currentPolicy.mode)],
+        ],
+        { colWidths: [14, 70] }
+      )
+    );
+    console.log('');
+    return;
+  }
+
+  const existsUnified = ctx.registry.hasAccountUnified(profileName);
+  const existsLegacy = ctx.registry.hasProfile(profileName);
+  const previousUnified = existsUnified
+    ? ctx.registry.getAllAccountsUnified()[profileName]
+    : undefined;
+  const previousLegacy = existsLegacy ? ctx.registry.getProfile(profileName) : undefined;
+  const contextPolicy = resolveAccountContextPolicy(currentProfile);
+  const metadata = sharedResourceModeToMetadata(mode);
+
+  try {
+    if (existsUnified) {
+      ctx.registry.updateAccountUnified(profileName, metadata);
+    }
+    if (existsLegacy) {
+      ctx.registry.updateProfile(profileName, metadata);
+    }
+
+    await ctx.instanceMgr.ensureInstance(profileName, contextPolicy, {
+      bare: mode === 'profile-local',
+    });
+  } catch (error) {
+    if (existsUnified && previousUnified) {
+      ctx.registry.updateAccountUnified(profileName, {
+        ...previousUnified,
+        shared_resource_mode: previousUnified.shared_resource_mode,
+        bare: previousUnified.bare,
+      });
+    }
+    if (existsLegacy && previousLegacy) {
+      ctx.registry.updateProfile(profileName, {
+        ...previousLegacy,
+        shared_resource_mode: previousLegacy.shared_resource_mode,
+        bare: previousLegacy.bare,
+      });
+    }
+    throw error;
+  }
+
+  if (json) {
+    console.log(
+      JSON.stringify(
+        {
+          name: profileName,
+          shared_resource_mode: mode,
+          shared_resource_inferred: false,
+          bare: mode === 'profile-local' ? true : undefined,
+        },
+        null,
+        2
+      )
+    );
+    return;
+  }
+
+  console.log(ok(`Shared resources for "${profileName}" set to ${formatMode(mode)}`));
+  console.log('');
+  console.log(modeDescription(mode));
+  console.log('');
+}

src/auth/commands/show-command.ts

@@ -10,6 +10,7 @@ import { initUI, header, color, fail, table } from '../../utils/ui';
 import { resolveAccountContextPolicy, formatAccountContextPolicy } from '../account-context';
 import { describeSettingsSync, summarizeAccountHistory } from '../account-profile-diagnostics';
 import { resolveConfiguredPlainCcsResumeLane } from '../resume-lane-diagnostics';
+import { resolveSharedResourcePolicy } from '../shared-resource-policy';
 import { exitWithError } from '../../errors';
 import { ExitCode } from '../../errors/exit-codes';
 import { CommandContext, ProfileOutput, parseArgs } from './types';
@@ -45,7 +46,8 @@ export async function handleShow(ctx: CommandContext, args: string[]): Promise<v
     const isDefault = profileName === defaultProfile;
     const instancePath = ctx.instanceMgr.getInstancePath(profileName);
     const contextPolicy = resolveAccountContextPolicy(profile);
-    const settingsSync = describeSettingsSync(instancePath, { bare: profile.bare === true });
+    const resourcePolicy = resolveSharedResourcePolicy(profile);
+    const settingsSync = describeSettingsSync(instancePath, { bare: resourcePolicy.profileLocal });
     const historySummary = summarizeAccountHistory(instancePath, contextPolicy);
     const plainCcsLane = await resolveConfiguredPlainCcsResumeLane().catch(() => null);
     const plainCcsUsesThisAccount =
@@ -74,6 +76,8 @@ export async function handleShow(ctx: CommandContext, args: string[]): Promise<v
         context_mode: contextPolicy.mode,
         context_group: contextPolicy.group || null,
         continuity_mode: contextPolicy.mode === 'shared' ? contextPolicy.continuityMode : null,
+        shared_resource_mode: resourcePolicy.mode,
+        shared_resource_inferred: resourcePolicy.inferred,
         instance_path: instancePath,
         session_count: sessionCount,
         settings_sync: {
@@ -94,7 +98,7 @@ export async function handleShow(ctx: CommandContext, args: string[]): Promise<v
               },
             }
           : {}),
-        ...(profile.bare ? { bare: true } : {}),
+        ...(resourcePolicy.profileLocal ? { bare: true } : {}),
       };
       console.log(JSON.stringify(output, null, 2));
       return;
@@ -112,6 +116,7 @@ export async function handleShow(ctx: CommandContext, args: string[]): Promise<v
       ['Created', new Date(profile.created).toLocaleString()],
       ['Last Used', profile.last_used ? new Date(profile.last_used).toLocaleString() : 'Never'],
       ['Context', formatAccountContextPolicy(contextPolicy)],
+      ['Resources', resourcePolicy.mode],
       ['Credentials', 'isolated per account'],
       ['Settings', settingsSync.description],
       ['History', formatHistorySummary(historySummary)],
@@ -125,7 +130,7 @@ export async function handleShow(ctx: CommandContext, args: string[]): Promise<v
             ],
           ]
         : []),
-      ...(profile.bare ? [['Bare', 'yes (no shared symlinks)']] : []),
+      ...(resourcePolicy.profileLocal ? [['Bare', 'yes (no shared symlinks)']] : []),
       ['Sessions', `${sessionCount}`],
     ];
 

src/auth/commands/types.ts

@@ -23,6 +23,7 @@ export interface AuthCommandArgs {
   contextGroup?: string;
   deeperContinuity?: boolean;
   bare?: boolean;
+  mode?: string;
   unknownFlags?: string[];
 }
 
@@ -38,6 +39,8 @@ export interface ProfileOutput {
   context_mode?: 'isolated' | 'shared';
   context_group?: string | null;
   continuity_mode?: 'standard' | 'deeper' | null;
+  shared_resource_mode?: 'shared' | 'profile-local';
+  shared_resource_inferred?: boolean;
   instance_path?: string;
   session_count?: number;
   settings_sync?: {
@@ -86,6 +89,7 @@ export interface CommandContext {
 export function parseArgs(args: string[]): AuthCommandArgs {
   let profileName: string | undefined;
   let contextGroup: string | undefined;
+  let mode: string | undefined;
   const unknownFlags = new Set<string>();
   const knownBooleanFlags = new Set([
     '--force',
@@ -97,7 +101,7 @@ export function parseArgs(args: string[]): AuthCommandArgs {
     '--deeper-continuity',
     '--bare',
   ]);
-  const knownValueFlags = new Set(['--context-group']);
+  const knownValueFlags = new Set(['--context-group', '--mode']);
 
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
@@ -114,11 +118,28 @@ export function parseArgs(args: string[]): AuthCommandArgs {
       continue;
     }
 
+    if (arg === '--mode') {
+      const next = args[i + 1];
+      if (!next || next.startsWith('-')) {
+        mode = '';
+        continue;
+      }
+
+      mode = next;
+      i++;
+      continue;
+    }
+
     if (arg.startsWith('--context-group=')) {
       contextGroup = arg.slice('--context-group='.length);
       continue;
     }
 
+    if (arg.startsWith('--mode=')) {
+      mode = arg.slice('--mode='.length);
+      continue;
+    }
+
     if (arg.startsWith('-')) {
       const normalizedFlag = arg.includes('=') ? arg.slice(0, arg.indexOf('=')) : arg;
       const isKnownFlag =
@@ -149,6 +170,7 @@ export function parseArgs(args: string[]): AuthCommandArgs {
     shareContext: args.includes('--share-context'),
     deeperContinuity: args.includes('--deeper-continuity'),
     bare: args.includes('--bare'),
+    mode,
     contextGroup,
     unknownFlags: [...unknownFlags],
   };

src/auth/profile-continuity-inheritance.ts

@@ -4,6 +4,7 @@ import { warn } from '../utils/ui';
 import InstanceManager from '../management/instance-manager';
 import ProfileRegistry from './profile-registry';
 import { isAccountContextMetadata, resolveAccountContextPolicy } from './account-context';
+import { isProfileLocalSharedResourceMode } from './shared-resource-policy';
 import type { ProfileType } from '../types/profile';
 import { getProfileLookupCandidates, resolveAliasToCanonical } from '../utils/profile-compat';
 import {
@@ -155,7 +156,7 @@ export async function resolveProfileContinuityInheritance(
     );
     const instanceMgr = new InstanceManager();
     const instancePath = await instanceMgr.ensureInstance(sourceAccount, contextPolicy, {
-      bare: mappedProfile.bare === true,
+      bare: isProfileLocalSharedResourceMode(mappedProfile),
     });
 
     return {

src/auth/profile-detector.ts

@@ -213,6 +213,7 @@ class ProfileDetector {
           context_mode: account.context_mode,
           context_group: account.context_group,
           continuity_mode: account.continuity_mode,
+          shared_resource_mode: account.shared_resource_mode,
           bare: account.bare,
         },
       };

src/auth/profile-registry.ts

@@ -12,6 +12,7 @@ import {
   loadOrCreateUnifiedConfig,
   mutateConfig,
 } from '../config/config-loader-facade';
+import { normalizeSharedResourceMetadata, type SharedResourceMode } from './shared-resource-policy';
 
 const logger = createLogger('auth:profile-registry');
 
@@ -50,6 +51,7 @@ interface CreateMetadata {
   context_mode?: 'isolated' | 'shared';
   context_group?: string;
   continuity_mode?: 'standard' | 'deeper';
+  shared_resource_mode?: SharedResourceMode;
   bare?: boolean;
 }
 
@@ -90,7 +92,7 @@ export class ProfileRegistry {
       normalized.continuity_mode = normalized.continuity_mode === 'deeper' ? 'deeper' : 'standard';
     }
 
-    return normalized;
+    return normalizeSharedResourceMetadata(normalized);
   }
 
   private normalizeUnifiedAccountConfig(account: AccountConfig): AccountConfig {
@@ -110,7 +112,7 @@ export class ProfileRegistry {
       normalized.continuity_mode = normalized.continuity_mode === 'deeper' ? 'deeper' : 'standard';
     }
 
-    return normalized;
+    return normalizeSharedResourceMetadata(normalized);
   }
 
   /**
@@ -179,6 +181,7 @@ export class ProfileRegistry {
       context_mode: metadata.context_mode,
       context_group: metadata.context_group,
       continuity_mode: metadata.continuity_mode,
+      shared_resource_mode: metadata.shared_resource_mode,
       bare: metadata.bare,
     });
 
@@ -335,6 +338,7 @@ export class ProfileRegistry {
         context_mode: metadata.context_mode,
         context_group: metadata.context_group,
         continuity_mode: metadata.continuity_mode,
+        shared_resource_mode: metadata.shared_resource_mode,
         bare: metadata.bare,
       });
     });
@@ -462,6 +466,7 @@ export class ProfileRegistry {
         context_mode: account.context_mode,
         context_group: account.context_group,
         continuity_mode: account.continuity_mode,
+        shared_resource_mode: account.shared_resource_mode,
         bare: account.bare,
       };
     }

src/auth/shared-resource-policy.ts

@@ -0,0 +1,97 @@
+export type SharedResourceMode = 'shared' | 'profile-local';
+
+export interface SharedResourceMetadata {
+  shared_resource_mode?: unknown;
+  bare?: unknown;
+}
+
+export interface SharedResourcePolicy {
+  mode: SharedResourceMode;
+  inferred: boolean;
+  profileLocal: boolean;
+}
+
+export interface SharedResourceMetadataUpdate {
+  shared_resource_mode: SharedResourceMode;
+  bare?: boolean | undefined;
+}
+
+export function isSharedResourceMode(value: unknown): value is SharedResourceMode {
+  return value === 'shared' || value === 'profile-local';
+}
+
+export function resolveSharedResourcePolicy(
+  metadata?: SharedResourceMetadata | null
+): SharedResourcePolicy {
+  const explicitMode = metadata?.shared_resource_mode;
+  if (isSharedResourceMode(explicitMode)) {
+    return {
+      mode: explicitMode,
+      inferred: false,
+      profileLocal: explicitMode === 'profile-local',
+    };
+  }
+
+  if (metadata?.bare === true) {
+    return {
+      mode: 'profile-local',
+      inferred: true,
+      profileLocal: true,
+    };
+  }
+
+  return {
+    mode: 'shared',
+    inferred: true,
+    profileLocal: false,
+  };
+}
+
+export function isProfileLocalSharedResourceMode(
+  metadata?: SharedResourceMetadata | null
+): boolean {
+  return resolveSharedResourcePolicy(metadata).profileLocal;
+}
+
+export function sharedResourceModeToMetadata(
+  mode: SharedResourceMode
+): SharedResourceMetadataUpdate {
+  if (mode === 'profile-local') {
+    return {
+      shared_resource_mode: 'profile-local',
+      bare: true,
+    };
+  }
+
+  return {
+    shared_resource_mode: 'shared',
+    bare: undefined,
+  };
+}
+
+export function normalizeSharedResourceMetadata<T extends SharedResourceMetadata>(metadata: T): T {
+  const normalized = { ...metadata } as T & {
+    shared_resource_mode?: SharedResourceMode;
+    bare?: boolean;
+  };
+
+  if (normalized.shared_resource_mode === 'profile-local') {
+    normalized.bare = true;
+    return normalized;
+  }
+
+  if (normalized.shared_resource_mode === 'shared') {
+    delete normalized.bare;
+    return normalized;
+  }
+
+  delete normalized.shared_resource_mode;
+  if (normalized.bare === true) {
+    normalized.shared_resource_mode = 'profile-local';
+    normalized.bare = true;
+  } else {
+    delete normalized.bare;
+  }
+
+  return normalized;
+}

src/commands/command-catalog.ts

@@ -248,6 +248,7 @@ export const AUTH_SUBCOMMANDS = [
   'backup',
   'list',
   'show',
+  'resources',
   'remove',
   'default',
   'reset-default',

src/commands/completion-backend.ts

@@ -108,6 +108,13 @@ function getSuggestionsForCommand(tokensBeforeCurrent: string[]): CompletionSugg
         return completeSubcommands(['default', ...getProfileNames('accounts')], ['--json']);
       if (subcommand === 'show')
         return completeSubcommands(getProfileNames('accounts'), ['--json']);
+      if (subcommand === 'resources')
+        return completeSubcommands(getProfileNames('accounts'), [
+          '--mode',
+          '--mode=shared',
+          '--mode=profile-local',
+          '--json',
+        ]);
       if (subcommand === 'remove')
         return completeSubcommands(getProfileNames('accounts'), ['--yes', '-y']);
       if (subcommand === 'default') return completeSubcommands(getProfileNames('accounts'));

src/commands/help-command.ts

@@ -54,6 +54,7 @@ async function showProfilesHelp(writeLine: HelpWriter): Promise<void> {
     'Profile Types',
     [
       { name: 'ccs auth create <name>', summary: 'Concurrent Claude account profile' },
+      { name: 'ccs auth resources <name>', summary: 'Shared resources for an account profile' },
       { name: 'ccs api create', summary: 'API-backed settings profile' },
       { name: 'ccs cliproxy create <name>', summary: 'Named CLIProxy variant profile' },
       { name: 'ccs env <profile>', summary: 'Export an existing profile for other tools' },

src/commands/sync-command.ts

@@ -45,13 +45,14 @@ export async function handleSyncCommand(): Promise<void> {
   const { InstanceManager } = await import('../management/instance-manager');
   const instanceMgr = new InstanceManager();
   const ProfileRegistry = (await import('../auth/profile-registry')).default;
+  const { isProfileLocalSharedResourceMode } = await import('../auth/shared-resource-policy');
   const registry = new ProfileRegistry();
   const allProfiles = registry.getAllProfilesMerged();
   let mcpSynced = 0;
 
   for (const [name, profile] of Object.entries(allProfiles)) {
-    if (profile.bare) {
-      continue; // Skip bare profiles
+    if (isProfileLocalSharedResourceMode(profile)) {
+      continue; // Skip profile-local shared-resource profiles
     }
 
     if (!instanceMgr.hasInstance(name)) {

src/config/migration-manager.ts

@@ -22,6 +22,7 @@ import { createEmptyUnifiedConfig } from './unified-config-types';
 import { CLIPROXY_PROVIDER_IDS } from '../cliproxy/provider-capabilities';
 import { saveUnifiedConfig, hasUnifiedConfig, loadUnifiedConfig } from './unified-config-loader';
 import { isValidContextGroupName, normalizeContextGroupName } from '../auth/account-context';
+import { isSharedResourceMode, resolveSharedResourcePolicy } from '../auth/shared-resource-policy';
 import { infoBox, warn } from '../utils/ui';
 
 const BACKUP_DIR_PREFIX = 'backup-v1-';
@@ -222,6 +223,16 @@ export async function migrate(dryRun = false): Promise<MigrationResult> {
           context_group: contextMode === 'shared' ? contextGroup : undefined,
           continuity_mode: contextMode === 'shared' ? continuityMode : undefined,
         };
+        const resourcePolicy = resolveSharedResourcePolicy({
+          shared_resource_mode: metadata.shared_resource_mode,
+          bare: metadata.bare,
+        });
+        if (resourcePolicy.mode === 'profile-local') {
+          account.shared_resource_mode = 'profile-local';
+          account.bare = true;
+        } else if (isSharedResourceMode(metadata.shared_resource_mode)) {
+          account.shared_resource_mode = 'shared';
+        }
         unifiedConfig.accounts[name] = account;
       }
       migratedFiles.push('profiles.json → config.yaml.accounts');

src/config/schemas/auth.ts

@@ -27,6 +27,8 @@ export interface AccountConfig {
   context_group?: string;
   /** Shared continuity depth when context_mode='shared' */
   continuity_mode?: 'standard' | 'deeper';
+  /** Account-level shared resource behavior for plugins, commands, skills, agents, and settings.json */
+  shared_resource_mode?: 'shared' | 'profile-local';
   /** Bare profile: no shared symlinks (commands, skills, agents, settings.json) */
   bare?: boolean;
 }

src/dispatcher/flows/account-flow.ts

@@ -7,6 +7,7 @@
 
 import { execClaude } from '../../utils/shell-executor';
 import { maybeWarnAboutResumeLaneMismatch } from '../../auth/resume-lane-warning';
+import { isProfileLocalSharedResourceMode } from '../../auth/shared-resource-policy';
 import { resolveNativeClaudeLaunchArgs } from '../environment-builder';
 import type { ProfileDispatchContext } from '../dispatcher-context';
 
@@ -26,10 +27,11 @@ export async function runAccountFlow(ctx: ProfileDispatchContext): Promise<void>
   const accountMetadata = isAccountContextMetadata(profileInfo.profile)
     ? profileInfo.profile
     : undefined;
-  const isBareProfile =
-    typeof profileInfo.profile === 'object' &&
-    profileInfo.profile !== null &&
-    (profileInfo.profile as { bare?: unknown }).bare === true;
+  const isBareProfile = isProfileLocalSharedResourceMode(
+    typeof profileInfo.profile === 'object' && profileInfo.profile !== null
+      ? (profileInfo.profile as { shared_resource_mode?: unknown; bare?: unknown })
+      : undefined
+  );
   const contextPolicy = resolveAccountContextPolicy(accountMetadata);
 
   // Ensure instance exists (lazy init if needed)

src/shared/claude-extension-setup.ts

@@ -2,6 +2,7 @@ import { loadSettingsFromFile, type ProfileType } from '../auth/profile-detector
 import ProfileDetector from '../auth/profile-detector';
 import { resolveProfileContinuityInheritance } from '../auth/profile-continuity-inheritance';
 import { resolveAccountContextPolicy, isAccountContextMetadata } from '../auth/account-context';
+import { isProfileLocalSharedResourceMode } from '../auth/shared-resource-policy';
 import type { ProfileDetectionResult } from '../auth/profile-detector';
 import {
   getEffectiveEnvVars,
@@ -158,8 +159,12 @@ async function resolveExtensionEnv(
     const policy = resolveAccountContextPolicy(
       isAccountContextMetadata(result.profile) ? result.profile : undefined
     );
+    const sharedResourceMetadata =
+      typeof result.profile === 'object' && result.profile !== null
+        ? (result.profile as { shared_resource_mode?: unknown; bare?: unknown })
+        : undefined;
     const instancePath = await instanceManager.ensureInstance(result.name, policy, {
-      bare: result.profile?.bare === true,
+      bare: isProfileLocalSharedResourceMode(sharedResourceMetadata),
     });
     notes.push('Account profiles authenticate through the isolated Claude config directory.');
     return {

src/types/config.ts

@@ -121,6 +121,8 @@ export interface ProfileMetadata {
   context_group?: string;
   /** Shared continuity depth when context_mode='shared' */
   continuity_mode?: 'standard' | 'deeper';
+  /** Account-level shared resource behavior for plugins, commands, skills, agents, and settings.json */
+  shared_resource_mode?: 'shared' | 'profile-local';
   /** Bare profile: no shared symlinks (commands, skills, agents, settings.json) */
   bare?: boolean;
 }

src/web-server/routes/account-route-helpers.ts

@@ -10,6 +10,9 @@ export interface MergedAccountEntry {
   continuity_mode?: 'standard' | 'deeper';
   context_inferred?: boolean;
   continuity_inferred?: boolean;
+  shared_resource_mode?: 'shared' | 'profile-local';
+  shared_resource_inferred?: boolean;
+  bare?: boolean;
   provider?: string;
   displayName?: string;
 }

src/web-server/routes/account-routes.ts

@@ -26,6 +26,11 @@ import {
   normalizeContextGroupName,
   resolveAccountContextPolicy,
 } from '../../auth/account-context';
+import {
+  isSharedResourceMode,
+  resolveSharedResourcePolicy,
+  sharedResourceModeToMetadata,
+} from '../../auth/shared-resource-policy';
 import {
   buildCliproxyAccountKey,
   parseCliproxyKey,
@@ -79,6 +84,7 @@ router.get('/', async (_req: Request, res: Response): Promise<void> => {
     // Add legacy profiles first
     for (const [name, meta] of Object.entries(legacyProfiles)) {
       const contextPolicy = resolveAccountContextPolicy(meta);
+      const resourcePolicy = resolveSharedResourcePolicy(meta);
       const hasExplicitContextMode =
         meta.context_mode === 'isolated' || meta.context_mode === 'shared';
       const hasExplicitContinuityMode =
@@ -93,6 +99,9 @@ router.get('/', async (_req: Request, res: Response): Promise<void> => {
         context_inferred: !hasExplicitContextMode,
         continuity_inferred:
           contextPolicy.mode === 'shared' ? !hasExplicitContinuityMode : undefined,
+        shared_resource_mode: resourcePolicy.mode,
+        shared_resource_inferred: resourcePolicy.inferred,
+        ...(resourcePolicy.profileLocal ? { bare: true } : {}),
       };
     }
 
@@ -100,6 +109,7 @@ router.get('/', async (_req: Request, res: Response): Promise<void> => {
     for (const [name, account] of Object.entries(unifiedAccounts)) {
       const rawAccount = rawUnifiedAccounts[name];
       const contextPolicy = resolveAccountContextPolicy(account);
+      const resourcePolicy = resolveSharedResourcePolicy(account);
       const hasExplicitContextMode =
         rawAccount?.context_mode === 'isolated' || rawAccount?.context_mode === 'shared';
       const hasExplicitContinuityMode =
@@ -114,6 +124,9 @@ router.get('/', async (_req: Request, res: Response): Promise<void> => {
         context_inferred: !hasExplicitContextMode,
         continuity_inferred:
           contextPolicy.mode === 'shared' ? !hasExplicitContinuityMode : undefined,
+        shared_resource_mode: resourcePolicy.mode,
+        shared_resource_inferred: resourcePolicy.inferred,
+        ...(resourcePolicy.profileLocal ? { bare: true } : {}),
       };
     }
 
@@ -305,7 +318,7 @@ router.put('/:name/context', async (req: Request, res: Response): Promise<void>
 
     const previousUnified = existsUnified ? registry.getAllAccountsUnified()[name] : undefined;
     const previousLegacy = existsLegacy ? registry.getProfile(name) : undefined;
-    const isBare = previousUnified?.bare === true || previousLegacy?.bare === true;
+    const resourcePolicy = resolveSharedResourcePolicy(previousUnified ?? previousLegacy);
 
     try {
       if (existsUnified) {
@@ -315,13 +328,21 @@ router.put('/:name/context', async (req: Request, res: Response): Promise<void>
         registry.updateProfile(name, metadata);
       }
 
-      await instanceMgr.ensureInstance(name, policy, { bare: isBare });
+      await instanceMgr.ensureInstance(name, policy, { bare: resourcePolicy.profileLocal });
     } catch (error) {
       if (existsUnified && previousUnified) {
-        registry.updateAccountUnified(name, previousUnified);
+        registry.updateAccountUnified(name, {
+          ...previousUnified,
+          shared_resource_mode: previousUnified.shared_resource_mode,
+          bare: previousUnified.bare,
+        });
       }
       if (existsLegacy && previousLegacy) {
-        registry.updateProfile(name, previousLegacy);
+        registry.updateProfile(name, {
+          ...previousLegacy,
+          shared_resource_mode: previousLegacy.shared_resource_mode,
+          bare: previousLegacy.bare,
+        });
       }
       throw error;
     }
@@ -342,6 +363,89 @@ router.put('/:name/context', async (req: Request, res: Response): Promise<void>
   }
 });
 
+/**
+ * PUT /api/accounts/:name/shared-resources - Update account shared resource mode
+ */
+router.put('/:name/shared-resources', async (req: Request, res: Response): Promise<void> => {
+  try {
+    const registry = createProfileRegistry();
+    const instanceMgr = createInstanceManager();
+    const { name } = req.params;
+
+    if (!name) {
+      res.status(400).json({ error: 'Missing account name' });
+      return;
+    }
+
+    const cliproxyKey = !hasAuthAccount(name) ? parseCliproxyKey(name) : null;
+    if (cliproxyKey) {
+      res.status(400).json({
+        error: `Shared resource mode is not supported for CLIProxy account: ${name}`,
+      });
+      return;
+    }
+
+    const existsUnified = isUnifiedMode() && registry.hasAccountUnified(name);
+    const existsLegacy = registry.hasProfile(name);
+    if (!existsUnified && !existsLegacy) {
+      res.status(404).json({ error: `Account not found: ${name}` });
+      return;
+    }
+
+    const mode = req.body?.shared_resource_mode;
+    if (!isSharedResourceMode(mode)) {
+      res.status(400).json({
+        error: 'Missing or invalid shared_resource_mode: expected shared|profile-local',
+      });
+      return;
+    }
+
+    const previousUnified = existsUnified ? registry.getAllAccountsUnified()[name] : undefined;
+    const previousLegacy = existsLegacy ? registry.getProfile(name) : undefined;
+    const previousMetadata = previousUnified ?? previousLegacy;
+    const contextPolicy = resolveAccountContextPolicy(previousMetadata);
+    const metadata = sharedResourceModeToMetadata(mode);
+
+    try {
+      if (existsUnified) {
+        registry.updateAccountUnified(name, metadata);
+      }
+      if (existsLegacy) {
+        registry.updateProfile(name, metadata);
+      }
+
+      await instanceMgr.ensureInstance(name, contextPolicy, {
+        bare: mode === 'profile-local',
+      });
+    } catch (error) {
+      if (existsUnified && previousUnified) {
+        registry.updateAccountUnified(name, {
+          ...previousUnified,
+          shared_resource_mode: previousUnified.shared_resource_mode,
+          bare: previousUnified.bare,
+        });
+      }
+      if (existsLegacy && previousLegacy) {
+        registry.updateProfile(name, {
+          ...previousLegacy,
+          shared_resource_mode: previousLegacy.shared_resource_mode,
+          bare: previousLegacy.bare,
+        });
+      }
+      throw error;
+    }
+
+    res.json({
+      name,
+      shared_resource_mode: mode,
+      shared_resource_inferred: false,
+      bare: mode === 'profile-local' ? true : undefined,
+    });
+  } catch (error) {
+    res.status(500).json({ error: (error as Error).message });
+  }
+});
+
 /**
  * DELETE /api/accounts/reset-default - Reset to CCS default
  */