Claudepot

A control panel for Claude Code and Claude Desktop.
Switch accounts. Watch what's running. Schedule prompts. Find old chats. Reclaim disk space.

What · Why · How · For developers

---

What

Claudepot is a desktop app — with a matching command-line tool — that sits next to Claude Code and Claude Desktop and gives you the things they don't have on their own:

• Account switching. Keep work and personal accounts side by side; switch in one click.
• A live view. See every Claude session that's running right now, including which one is waiting on you.
• Auto-rotation. When the active CLI account hits a usage threshold you set (5h, 7d, 7d-Opus, 7d-Sonnet), Claudepot can swap to a chosen alternate — confirm-mode by default, auto-mode once you trust the rule.
• Scheduled prompts. Have Claude run a prompt every morning, every weekday, or on any cron schedule you like.
• Searchable history. Find that chat from last week. Reopen it. Export it.
• Safe project rename. mv-ing a project folder breaks Claude's session history. Claudepot doesn't.
• Disk cleanup. ~/.claude/ quietly grows to many gigabytes. One click reclaims most of it, with a 7-day undo.
• Privacy on export. Tokens, auth headers, and cookies are stripped before any session leaves your machine.
• Usage snapshot for non-GUI consumers. A ~/.claudepot/usage-snapshot.json (mode 0600) refreshed every 5 minutes lets cron jobs and Claude Code Bash subprocesses pick the least-loaded account without going through the keychain.

It's macOS-first today. Windows and Linux build clean and work, with less polish.

Why

If you use Claude Code or Claude Desktop daily, you've probably hit at least one of these. Each one is a first-class fix in Claudepot, not a workaround.

Pain	What's actually going on
/login doesn't switch accounts when one is already signed in	Claude reads from a single keychain slot. There's no concept of "the other account."
You renamed a project folder and your old sessions disappeared	Claude indexes sessions by the folder's full path. Rename the folder and the index breaks.
~/.claude/ is using 8 GB and you don't know why	Every chat is kept forever as a transcript file, including image data and tool output. Nothing prunes it.
Claude Code freezes on a long conversation	A single transcript over ~50 MB stalls the parser.
You can't tell which Claude session needs your attention	Claude has no notion of "I'm waiting on you" — you have to check each terminal.
You've leaked tokens by pasting a screenshot or exporting a chat	Tokens appear verbatim in transcripts and exports.
You want Claude to run a daily summary at 8am	There's no scheduler.
You hit a rate limit you didn't know existed	The 5-hour window, 7-day window, and Opus split are invisible until you trip them.
You hit the limit while you were typing and have to switch by hand	Once you've authored a rule, Claudepot watches utilization for you and either suggests or applies the swap.

How

Install

Status: beta (0.6.9). Daily-driven on macOS. Windows and Linux builds are green but less seasoned.

You'll need a recent Rust toolchain (rustup.rs) and Node 20+ with pnpm (pnpm.io). No other system dependencies.

git clone https://github.com/xiaolai/claudepot-app.git
cd claudepot-app

# Command-line tool
cargo build -p claudepot-cli --release
# Built binary: ./target/release/claudepot

# Stage the CLI as the GUI's bundled sidecar (Tauri `externalBin`).
# Required before any GUI build or `tauri dev` run — Tauri validates
# this slot at compile time.
mkdir -p src-tauri/binaries
cp target/release/claudepot \
   "src-tauri/binaries/claudepot-cli-$(rustc -Vv | sed -n 's/host: //p')"

# Desktop app
pnpm install
pnpm tauri build --no-bundle      # builds a binary, no installer
# OR
pnpm tauri dev                    # run the GUI in dev mode

Pre-built installers are coming. Until then it's source-build only.

Your data lives at ~/.claudepot/ (override with CLAUDEPOT_DATA_DIR).

First run

Open the app. The left sidebar is your map of the whole product — nine tabs, each one a feature. Start by adding your accounts under Accounts. Three ways:

• Browser OAuth — a one-time browser sign-in, no token handling on your part.
• Import the account Claude Code is currently signed into.
• Paste a refresh token if you already have one.

After that, switch with one click from the sidebar, the ⌘K command palette, or the menu-bar tray icon. Two slots, switched independently: one for Claude Code CLI, one for Claude Desktop. Work account in CLI, personal in Desktop, at the same time.

Features, one per sidebar tab

Accounts — Manage every Claude account you have. Add, remove, verify, and switch between them. Two slots — one for the CLI, one for the Desktop app — switched independently. Per-account secrets live in the OS keychain.

Activities — Three time-scales of "what's happening with Claude right now": a live strip (running sessions, sorted by who needs attention first), a today/month dashboard, and a stream of recent events. macOS notifications when a session goes from busy to waiting.

Projects — Every project Claude has ever touched, with all its sessions. Cross-project text search, filters by date / error / size / token count. Rename a project here instead of mv-ing it — Claudepot rewrites every reference Claude has (session transcripts, project map, history file, memory, settings) in nine journaled phases. Resumable on crash, fully reversible.

Knowledge — A project-first view of what Claude knows: a health dashboard, curated Know base (memories, decisions, and evidence), the human-gated Review queue, and Recall over indexed Claude Code + Codex transcripts. The same data is exposed to agents through claudepot mcp memory-server; the registry id remains shared-memory for localStorage compatibility.

Keys — All your API keys and OAuth tokens, in one inventory. Stored in the OS keychain (macOS Keychain / Windows Credential Manager / Linux Secret Service). Copy with self-clearing clipboard — the value wipes itself after 30 seconds.

Providers — Run non-Anthropic models (Bedrock, Vertex, Foundry, OpenRouter, Ollama, vLLM, llama.cpp, …) through the same claude interface. Each route installs as a wrapper binary on PATH (~/.claudepot/bin/<name>) and a separate Desktop profile (~/Library/Application Support/Claude-3p/), so first-party Claude is never touched. Routes are siblings on disk — no swap, no default.

Agents — Schedule a claude -p prompt to run on a cron expression (every weekday at 8am, every Monday morning, anything cron can express) or on demand. Each run lands in a history pane with stdout, stderr, and exit code. macOS uses launchd, Windows uses Task Scheduler, Linux uses systemd-user timers — set up for you, not by hand.

Global — Read-only inspection of your machine-wide Claude Code state across four sub-tabs: Config (cascade view of managed policy / user prefs / global config / plugins / cross-project memory), Memory (CLAUDE.md health — bloat, lines past CC's truncation cutoff), Tips (the CC tips ledger, searchable + filterable), and Updates (Claude Code CLI + Claude Desktop versions, channel, install). Claudepot's own updates live under Settings → About.

Settings — Fifteen sub-panes: General, Appearance (light / dark / system, paper-mono density), Notifications, Network (status-bar dot + status-page polling), Remote (the LAN appliance — start and stop the server the phone talks to, set the admin password, revoke a lost device, and edit the quick-prompt chips above the panel's composer), Rotation (rule-driven auto-swap of the active CLI account when a usage window crosses a threshold — confirm or auto, with a 500-entry audit log), Retention (Claude Code deletes saved conversations older than 30 days on every launch and reports nothing — this pane is the only place that says so, and shows how many of yours are scheduled to go), Health (Claude Code's own self-diagnostic, scraped from claude doctor), MCP (memory-server health + agent-instruction snippet installer), Cleanup (Prune orphaned sessions · Slim strips bulky tool-output payloads · Trash 7-day undo), Protected paths, GitHub PAT, Locks (SQLite-lock recovery), Diagnostics (Claudepot's own self-check), and About.

For developers

Four user-facing nouns: account, cli, desktop, project. Three Rust crates:

Crate	Purpose
claudepot-core	Pure Rust library. All business logic. No Tauri dependency — testable without a webview.
claudepot-cli	Thin clap wrapper over core. No business logic, no HTTP, no keychain.
src-tauri	Tauri 2 desktop shell calling the same core. DTOs in dto.rs; secrets never cross to JS.

The CLI handler is the reference implementation; the GUI wraps the same function with a DTO layer. Both reach the same code.

CLI reference

claudepot account   list | add | remove | inspect | verify
claudepot cli       status | use <email> | clear | run <email> -- <cmd>
claudepot desktop   status | use <email> | identity | reconcile | adopt
                    clear | launch | quit
claudepot project   list | show | move | clean | remove | trash | repair
claudepot session   list-orphans | move | adopt-orphan | rebuild-index
                    backfill-exchanges | view | export | search | worktrees
                    prune | slim | trash {list|restore|empty}
                    live | send | inbound {status|grant|revoke}
                                                    # address a RUNNING
                                                    # Claude Code session
claudepot remote    status | set-password | enable  # LAN appliance: reach
                    disable | approvals | revoke-all  # Claudepot from a phone
                    serve                           # `approvals off` keeps the
                                                    # panel, drops the one
                                                    # capability that GRANTS
claudepot agent     draft | list | show            (alias: automation)
claudepot lesson    harvest | list | accept | reject | compile | status
                                                    # the knowledge compiler
claudepot corpus    index | status | detect         # cross-machine transcript
                                                    # corpus + free, no-model
                                                    # candidate detection
claudepot memory    list | view | log               # CLAUDE.md + memory files
claudepot activity  recent | reindex                # anomaly + milestone cards
claudepot usage     report                          # local token/cost rollup
claudepot usage     refresh                         # refetch each account's usage snapshot
claudepot update    check | cli | desktop | config  # CC + Desktop updates
claudepot settings  auto-memory {status|enable|disable|clear}
claudepot mcp       memory-server | print-snippet | install-snippet
claudepot codex     index | rebuild | forget        # Codex transcript indexing
claudepot experimental board                        # durable agent-written
                    open | list | get | push |      # boards — ON TRIAL, may be
                    show | clear | rm |             # removed; no compatibility
                    export | import                 # promise. Writer identity
                                                    # is self-declared, not
                                                    # authenticated.
claudepot export / import                           # *.claudepot.tar.zst bundles
                    export --since-peer <id>        # ship only what changed
                    import --mode=merge             # union into an existing
                            --prefer-imported|-target #  project; refuses an
                                                    #  id collision otherwise
claudepot migrate   inspect | undo
claudepot doctor                                    # health check
claudepot status                                    # ground-truth auth status
claudepot logs      [--open | --tail]

Run claudepot --help (or claudepot <command> --help) for the authoritative, always-current surface.

Every command supports --json with a stable shape (scriptable), --quiet, --verbose, --yes. Exit codes: 0 ok · 1 general · 2 ambiguous / drift · 3 auth failure · 4 Desktop quit failed · 5 network.

claudepot cli run <email> -- <cmd> launches a one-shot command with CLAUDE_CODE_OAUTH_TOKEN injected, leaving the on-disk slot untouched.

Develop

cargo check --workspace
cargo test  --workspace               # 1700+ Rust tests
pnpm test                             # Vitest + RTL, jsdom (~400 tests)
pnpm test:coverage                    # with coverage report
pnpm tauri dev                        # GUI hot reload (Vite :11220, HMR :11221)

Path-handling code (sanitize, unsanitize, canonicalize, tilde expansion) is the highest-risk surface; it's golden-tested on Linux / macOS / Windows in CI. See .claude/rules/paths.md.

The full design docs (dev-docs/implementation-plan.md and a 3400-line CC/Desktop internals reference) are internal working documents — dev-docs/ is local-only and not shipped in this repository.

Security posture

• Tokens never logged, toasted, or sent to the webview. Truncated in any human output (sk-ant-oat01-Abc…xyz).
• Per-account secrets in the OS keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service).
• Distinct keychain surfaces on macOS: Claude Code's Claude Code-credentials item and Claudepot's cross-binary secrets (account credentials, GitHub PAT) go through the /usr/bin/security subprocess with verified writes; the keyring crate is reserved for slots only one binary reads. They are not interchangeable.
• Redaction (sk-ant-*, OAuth bearers, JWTs, Authorization headers, URL params, cookies) runs before any session event reaches the UI or the SQLite index.
• SQLite WAL/SHM sidecars are forced to chmod 0600.
• Tauri opener scope is narrowed to https://console.anthropic.com/settings/keys.

Full rules in .claude/rules/architecture.md.

License

ISC — see LICENSE.