profile-manager

README

pm

Launch profile manager for Claude Code and Codex.

pm keeps multiple provider setups — endpoint, API key, model — as named profiles, and launches claude or codex with the right credentials for each one. Switch between a company gateway, a personal Anthropic key, AWS Bedrock, and your claude.ai subscription without editing environment variables or global settings files.

• Interactive TUI — bare pm opens a two-pane picker (profiles / models) with search and per-profile recent models
• Secure key storage — OS keychain, environment variable, shell command, or literal
• Clean auth handoff — the API key is delivered via a per-invocation apiKeyHelper, so your claude.ai login is untouched and Claude Code prints no auth-conflict warnings
• Per-directory model memory — pm remembers which model you last used for each profile in each directory

Install

Requires Go 1.26+ and claude (and/or codex) on your PATH.

go install github.com/boriswu0212/profile-manager/cmd/pm@latest

Or from a checkout:

git clone https://github.com/boriswu0212/profile-manager
cd profile-manager
go install ./cmd/pm

Prebuilt binaries for macOS and Linux (amd64/arm64) are attached to GitHub Releases — download the archive for your platform, extract, and put pm somewhere on your PATH. Binaries are unsigned; if macOS quarantines a browser download, clear it with xattr -d com.apple.quarantine pm.

Quick start

pm add             # create a profile interactively
pm                 # open the TUI picker, Enter launches claude
pm run work        # or launch a profile directly
pm use work        # set the default profile
pm run             # launches the default profile

Pass arguments through to claude after --:

pm run work -- -p "explain this repo"
pm run work -m claude-opus-4-8 -- --continue

Commands

Command	Description
pm	Open the TUI profile/model picker
pm add	Add a profile interactively
pm list (ls)	List profiles (* marks the default)
pm use <profile>	Set the default profile
pm run [profile] [-m model] [-- args...]	Launch claude/codex with a profile; extra args go to the tool
pm status	Show the active profile and recent usage
pm models [profile]	List models available from the profile's endpoint
pm remove <profile> (rm)	Remove a profile

All commands accept --config <path> to use a config file other than ~/.pm.yaml. pm --version prints the build version.

TUI

Key	Action
↑/k, ↓/j	Move (model list wraps around)
←/h, →/l/m	Switch between profile and model panes
Enter	Launch with the selected profile (and model, if in the model pane)
/	Search models
s	Set selected profile as default, or selected model as the profile's default
d	Delete the selected profile (profile pane only)
q, Ctrl+C	Quit

While searching: type to filter, ↑/↓ to move, Enter to launch, Ctrl+S to set the filtered model as default, Esc to cancel.

The model pane pins up to three recently used models for the selected profile above the full list.

Configuration

Profiles live in ~/.pm.yaml. The file can contain literal API keys, so pm keeps it at mode 0600 and warns if the permissions are looser.

default_profile: work
profiles:
  - name: work
    provider: anthropic
    base_url: https://gateway.example.com/v1
    api_key: keychain://work-gateway
    model: claude-sonnet-4-20250514
  - name: personal
    provider: subscription          # use the claude.ai login, no key needed
  - name: bedrock
    provider: bedrock
    region: us-east-1
    aws_profile: dev
    model: us.anthropic.claude-sonnet-4-20250514-v1:0
  - name: codex
    tool: codex
    provider: openai
    base_url: https://api.openai.com/v1
    api_key_cmd: op read op://vault/openai/key
    model: gpt-5.4-mini-codex

Profile fields

Field	Description
name	Profile identifier
tool	claude (default) or codex
provider	anthropic, openai, bedrock, or subscription
base_url	API endpoint (anthropic/openai). Keep the /v1 suffix; pm strips it where Claude Code requires that
api_key	API key — see key sources below
api_key_cmd	Shell command whose stdout is the key (used when api_key is empty)
model	Default model for this profile
region, aws_profile	AWS settings (bedrock only)
env_key	Env var name the key is injected into for codex (default PM_CODEX_API_KEY)

The same file also stores usage state maintained by pm: recent (last 10 profile+model launches, shown in the TUI and pm status) and last_models (per-directory last-used model, up to 50 entries).

API key sources

api_key is interpreted by its form:

• keychain://name — OS keychain (macOS Keychain, Windows Credential Manager, or Linux Secret Service), service pm, account name. Seed it on macOS with security add-generic-password -s pm -a name -w
• ${ENV_VAR} — read from the environment at launch time
• anything else — used literally

When api_key is empty, api_key_cmd is run via sh -c and its trimmed stdout becomes the key.

bedrock and subscription profiles need no key (AWS credentials and the claude.ai login are used instead).

Model selection

The model for a launch is chosen in this order:

1. -m/--model flag (or the model picked in the TUI)
2. The model you last used for this profile in the current directory
3. The profile's model field

Every launch records its model per (directory, profile) in ~/.pm.yaml, and that remembered model becomes the effective default the next time you run the same profile from the same directory — it takes precedence over the profile's model field until you override it again with -m or the TUI. Each project directory therefore sticks to its own model per profile.

How launching works

pm run resolves credentials, prepares the environment, and replaces itself with claude/codex (exec), so there is no wrapper process left running.

• anthropic / openai — sets ANTHROPIC_BASE_URL (with any trailing /v1 stripped, since Claude Code appends its own) and passes the key via claude --settings '{"apiKeyHelper": ...}', along with disableClaudeAiConnectors: true (connectors can't work through a gateway). The helper is the hidden pm _resolve-key <profile> command. ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN are cleared from the environment rather than set, and the settings only apply to that invocation — other sessions keep their claude.ai login. Note: any pre-existing apiKeyHelper entry in ~/.claude/settings.json is removed before launch.
• bedrock — clears ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, and ANTHROPIC_BASE_URL, then sets CLAUDE_CODE_USE_BEDROCK=1, AWS_REGION, and AWS_PROFILE.
• subscription — clears ANTHROPIC_API_KEY, ANTHROPIC_BASE_URL, and Bedrock/Vertex overrides so claude uses your claude.ai login.
• codex (tool: codex) — writes ~/.codex/config.toml with a pm provider pointing at the profile's base_url, and injects the key via the env_key env var. Note: the previous config.toml is not restored after codex exits; keep a copy if you maintain one by hand.

Development

go test ./...
go vet ./...
go build -o pm ./cmd/pm

See CLAUDE.md for architecture notes.

License

MIT. pm only manages launch profiles and hands credentials to claude/codex (its sole API use is listing models for the picker) — it is provided as-is, without warranty of any kind.