feat(auth): add shared resource controls

tests/unit/auth/profile-registry-context-normalization.test.ts

@@ -98,6 +98,7 @@ describe('profile-registry context normalization', () => {
 
     const profile = registry.getProfile('work');
     expect(profile.bare).toBe(true);
+    expect(profile.shared_resource_mode).toBe('profile-local');
   });
 
   it('persists bare flag for unified accounts and merged projection', () => {
@@ -126,8 +127,52 @@ describe('profile-registry context normalization', () => {
 
     const accounts = registry.getAllAccountsUnified();
     expect(accounts.work.bare).toBe(true);
+    expect(accounts.work.shared_resource_mode).toBe('profile-local');
 
     const merged = registry.getAllProfilesMerged();
     expect(merged.work.bare).toBe(true);
+    expect(merged.work.shared_resource_mode).toBe('profile-local');
+  });
+
+  it('lets explicit shared resource mode override stale unified bare metadata', () => {
+    process.env.CCS_UNIFIED_CONFIG = '1';
+    const ccsDir = path.join(tempHome, '.ccs');
+    fs.mkdirSync(ccsDir, { recursive: true });
+    fs.writeFileSync(
+      path.join(ccsDir, 'config.yaml'),
+      [
+        'version: 8',
+        'accounts:',
+        '  work:',
+        '    created: "2026-03-05T00:00:00.000Z"',
+        '    last_used: null',
+        '    shared_resource_mode: shared',
+        '    bare: true',
+        'profiles: {}',
+        'cliproxy:',
+        '  oauth_accounts: {}',
+        '  providers: {}',
+        '  variants: {}',
+      ].join('\n'),
+      'utf8'
+    );
+
+    const registry = new ProfileRegistry();
+    const accounts = registry.getAllAccountsUnified();
+
+    expect(accounts.work.shared_resource_mode).toBe('shared');
+    expect(accounts.work.bare).toBeUndefined();
+  });
+
+  it('persists explicit profile-local mode for legacy profiles', () => {
+    const registry = new ProfileRegistry();
+    registry.createProfile('work', {
+      type: 'account',
+      shared_resource_mode: 'profile-local',
+    });
+
+    const profile = registry.getProfile('work');
+    expect(profile.shared_resource_mode).toBe('profile-local');
+    expect(profile.bare).toBe(true);
   });
 });

tests/unit/auth/shared-resource-policy.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, it } from 'bun:test';
+import {
+  normalizeSharedResourceMetadata,
+  resolveSharedResourcePolicy,
+  sharedResourceModeToMetadata,
+} from '../../../src/auth/shared-resource-policy';
+
+describe('shared resource policy', () => {
+  it('defaults missing metadata to shared resources', () => {
+    const policy = resolveSharedResourcePolicy(undefined);
+
+    expect(policy.mode).toBe('shared');
+    expect(policy.inferred).toBe(true);
+    expect(policy.profileLocal).toBe(false);
+  });
+
+  it('resolves legacy bare metadata as profile-local', () => {
+    const policy = resolveSharedResourcePolicy({ bare: true });
+
+    expect(policy.mode).toBe('profile-local');
+    expect(policy.inferred).toBe(true);
+    expect(policy.profileLocal).toBe(true);
+  });
+
+  it('lets explicit shared mode override stale bare metadata', () => {
+    const normalized = normalizeSharedResourceMetadata({
+      shared_resource_mode: 'shared',
+      bare: true,
+    });
+
+    expect(normalized.shared_resource_mode).toBe('shared');
+    expect(normalized.bare).toBeUndefined();
+    expect(resolveSharedResourcePolicy(normalized).profileLocal).toBe(false);
+  });
+
+  it('normalizes explicit profile-local mode to legacy-compatible bare metadata', () => {
+    const normalized = normalizeSharedResourceMetadata({
+      shared_resource_mode: 'profile-local',
+    });
+
+    expect(normalized.shared_resource_mode).toBe('profile-local');
+    expect(normalized.bare).toBe(true);
+  });
+
+  it('builds write metadata for both supported modes', () => {
+    expect(sharedResourceModeToMetadata('profile-local')).toEqual({
+      shared_resource_mode: 'profile-local',
+      bare: true,
+    });
+    expect(sharedResourceModeToMetadata('shared')).toEqual({
+      shared_resource_mode: 'shared',
+      bare: undefined,
+    });
+  });
+});