@schneiderjoseph/devia 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 0.2.0 — 2026-09-09
+
+The standard is unchanged: `VERSION` stays at 0.1.0 and no adopter needs `devia sync`. This
+release is the CLI only.
+
+### The skill, once for every project
+
+- `devia skills install --global` installs the skill pack in the agent's own configuration
+  directory instead of one repository, so the contract applies everywhere. Claude Code is
+  supported (`~/.claude/skills/devia/SKILL.md`, or `CLAUDE_CONFIG_DIR` when set); Cursor,
+  Copilot and Windsurf report `SKIP` with the reason, because devia will not guess a path
+  inside someone's home directory
+- It is the only command that writes outside `--root`: off by default, every path printed, an
+  edited file kept without `--force` (`04_PERMISSIONS.md`, `10_NEVER_ALWAYS.md`)
+
+### Bootstrap, fixed
+
+- The skill and every agent adapter told an agent to run `npx devia init`. Since the package is
+  scoped, that resolves to nothing in a repository that has not installed devia: `404 devia@*`.
+  They now say `npm i -D @schneiderjoseph/devia && npx devia init`, which is what a cold start
+  actually needs. Found while installing the skill system-wide, where the cold start is the
+  normal case rather than the exception
+
 ## 0.1.0 — 2026-09-03
 
 First release. Devia consolidates three bodies of work into one maintained standard plus a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@schneiderjoseph/devia",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "One standard, one memory: engineering and design rules plus living project memory for AI coding agents",
   "type": "module",
   "license": "MIT",

package/skills/devia/SKILL.md

@@ -21,9 +21,12 @@ ls .devia
 **No `.devia/`** → initialise before writing any code:
 
 ```bash
+npm i -D @schneiderjoseph/devia    # the package is scoped, the command is not
 npx devia init
 ```
 
+Install first: `npx devia` only resolves once the package is a dependency of the project.
+
 Then fill `.devia/00_OVERVIEW.md` from what the repository actually contains — stack, modules,
 where the truth lives. Read the code to fill it; do not invent it. This is not paperwork: it is
 the difference between a task and a guess (`AGT-002`).

package/src/commands/skills.mjs

@@ -1,4 +1,6 @@
+import os from "node:os";
 import path from "node:path";
+import process from "node:process";
 import { packageRoot, exists, read, writeFile } from "../lib/fs.mjs";
 import { color, heading, status, line } from "../lib/ui.mjs";
 
@@ -36,6 +38,62 @@ export function installAdapters(root, { force = false, agents = Object.keys(ADAP
   return { written, kept };
 }
 
+/**
+ * Where an agent keeps skills for every project, not one.
+ *
+ * Only agents whose user-level location devia can actually determine are listed. The rest are
+ * reported as SKIP with the reason: guessing a path in someone's home directory and writing to
+ * it is exactly the kind of confident wrong answer this tool exists to prevent.
+ */
+function globalSkillTargets() {
+  const home = os.homedir();
+  const claudeDir = process.env.CLAUDE_CONFIG_DIR
+    ? path.resolve(process.env.CLAUDE_CONFIG_DIR)
+    : path.join(home, ".claude");
+  return {
+    claude: {
+      target: path.join(claudeDir, "skills", "devia", "SKILL.md"),
+    },
+    cursor: {
+      reason: "no user-level skill directory — use the per-project .cursor/rules/devia.mdc",
+    },
+    copilot: {
+      reason: "instructions are per-repository — .github/copilot-instructions.md",
+    },
+    windsurf: {
+      reason: "rules are per-repository — .windsurfrules",
+    },
+  };
+}
+
+/**
+ * Install the skill once for every project. This is the only path that writes outside `--root`,
+ * it happens only behind `--global`, and it prints every path it touches (04_PERMISSIONS.md).
+ */
+export function installGlobalSkill({ force = false } = {}) {
+  const skill = read(path.join(packageRoot, "skills", "devia", "SKILL.md"));
+  const written = [];
+  const kept = [];
+  const skipped = [];
+  for (const [key, entry] of Object.entries(globalSkillTargets())) {
+    if (!entry.target) {
+      skipped.push([key, entry.reason]);
+      continue;
+    }
+    if (skill === null) {
+      skipped.push([key, "skill pack missing from the installed package"]);
+      continue;
+    }
+    if (exists(entry.target) && !force) {
+      kept.push([key, entry.target]);
+      continue;
+    }
+    writeFile(entry.target, skill);
+    written.push([key, entry.target]);
+  }
+  return { written, kept, skipped };
+}
+
 export function installSkill(root, { force = false, agents = Object.keys(SKILL_TARGETS) } = {}) {
   const skill = read(path.join(packageRoot, "skills", "devia", "SKILL.md"));
   const written = [];
@@ -64,12 +122,29 @@ ${color.bold("devia skills")} — the same contract for every coding agent
 
   devia skills list
   devia skills install [--agent all|${Object.keys(ADAPTERS).join("|")}] [--force] [--skill]
+  devia skills install --global [--force]
 
   --skill    also install skills/devia/SKILL.md for Cursor and Claude Code
+  --global   install the skill for every project, in the agent's own configuration
+             directory. The only command that writes outside --root; it prints
+             every path it touches
 `.trim());
     return flags.help ? 0 : 2;
   }
 
+  if (flags.global) {
+    const res = installGlobalSkill({ force: Boolean(flags.force) });
+    heading("devia skills install --global");
+    for (const [key, target] of res.written) status("PASS", key, target);
+    for (const [key, target] of res.kept) status("SKIP", `${key} — already there`, target);
+    for (const [key, reason] of res.skipped) status("SKIP", key, reason);
+    line("");
+    line(color.dim("  The skill is now available in every project. It still expects each"));
+    line(color.dim("  repository to carry its own .devia/ — the skill says how to create one."));
+    line("");
+    return 0;
+  }
+
   if (action === "list") {
     heading("Adapters");
     for (const [key, [, target]] of Object.entries(ADAPTERS)) {

package/templates/agents/AGENTS.md

@@ -10,7 +10,8 @@ This repository uses **devia**: a standard plus a living project memory in `.dev
 4. Read the memory file for the surface you are touching — see
    [`.devia/14_INDEX.md`](.devia/14_INDEX.md)
 
-If `.devia/` is missing, run `npx devia init` and fill `00_OVERVIEW.md` before writing code.
+If `.devia/` is missing, run `npm i -D @schneiderjoseph/devia && npx devia init`, then fill
+`00_OVERVIEW.md` before writing code.
 
 ## While working
 

package/templates/agents/CLAUDE.md

@@ -10,7 +10,8 @@ work, updated with every change.
 3. `.devia/00_OVERVIEW.md` — what this project is
 4. The memory file for the surface you are touching (`.devia/14_INDEX.md`)
 
-No `.devia/`? Run `npx devia init` and fill `00_OVERVIEW.md` before writing code.
+No `.devia/`? Run `npm i -D @schneiderjoseph/devia && npx devia init`, then fill
+`00_OVERVIEW.md` before writing code.
 
 ## Rules that override default behaviour
 

package/templates/agents/cursor.mdc

@@ -7,7 +7,7 @@ This repository runs on devia. `.devia/` is the project memory and it is not opt
 
 1. Before the first edit, read `.devia/AGENTS.md`, `.devia/10_NEVER_ALWAYS.md`,
    `.devia/00_OVERVIEW.md`, and the memory file for the surface you are touching
-   (`.devia/14_INDEX.md`). If `.devia/` does not exist, run `npx devia init` first (AGT-001,
+   (`.devia/14_INDEX.md`). If `.devia/` does not exist, run `npm i -D @schneiderjoseph/devia && npx devia init` first (AGT-001,
    AGT-002).
 2. Never invent an endpoint, field, config key or business rule. Unknown goes to
    `.devia/11_GAPS.md` or to the human — never into the code as a quiet default (AGT-004,

package/templates/agents/windsurfrules.md

@@ -4,7 +4,7 @@ This repository runs on devia. `.devia/` is the project memory.
 
 1. Read `.devia/AGENTS.md`, `.devia/10_NEVER_ALWAYS.md`, `.devia/00_OVERVIEW.md` and the memory
    file for the surface you are touching before editing anything. No `.devia/`? Run
-   `npx devia init` first.
+   `npm i -D @schneiderjoseph/devia && npx devia init` first.
 2. Never invent an endpoint, field, config key or business rule — record the unknown in
    `.devia/11_GAPS.md` or ask.
 3. Decided but not built goes to `.devia/12_DEBT.md`; never delete a line you did not discharge.