@schneiderjoseph/devia 0.1.0 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # Changelog
 
+## 0.3.0 — 2026-09-09
+
+The standard is unchanged: `VERSION` stays at 0.1.0, no adopter needs `devia sync`.
+
+### devia is for every agent
+
+0.2.0 shipped `--global` serving Claude Code alone and reported the other agents as SKIP. Two of
+those reasons were wrong: they came from an absence never verified. `~/.cursor/rules/` holds
+user-level `.mdc` rules, and `~/.codex/skills/` uses the same `SKILL.md` convention as Claude
+Code. The decision is recorded as G6: no agent is privileged.
+
+`devia skills install --global` now writes, each in the format the agent actually reads:
+
+| Agent | Path | File |
+|---|---|---|
+| Claude Code | `~/.claude/skills/devia/SKILL.md` | skill pack |
+| Codex | `~/.codex/skills/devia/SKILL.md` | skill pack |
+| Cursor | `~/.cursor/rules/devia.mdc` | rules adapter |
+| Gemini | `~/.gemini/GEMINI.md` | universal contract, only when absent or empty |
+| Copilot, Windsurf | — | `SKIP`: user-level configuration is editor settings, not a file devia can place (`12_DEBT.md` D8) |
+
+`CLAUDE_CONFIG_DIR` and `CODEX_HOME` are honoured when set. A directory the agent owns is
+written to freely; a file the **user** owns is written only when absent or empty, and otherwise
+skipped with the reason rather than replaced. `--force` overrides both and names every path.
+
+## 0.2.0 — 2026-09-09
+
+The standard is unchanged: `VERSION` stays at 0.1.0 and no adopter needs `devia sync`. This
+release is the CLI only.
+
+### The skill, once for every project
+
+- `devia skills install --global` installs the skill pack in the agent's own configuration
+  directory instead of one repository, so the contract applies everywhere. Claude Code is
+  supported (`~/.claude/skills/devia/SKILL.md`, or `CLAUDE_CONFIG_DIR` when set); Cursor,
+  Copilot and Windsurf report `SKIP` with the reason, because devia will not guess a path
+  inside someone's home directory
+- It is the only command that writes outside `--root`: off by default, every path printed, an
+  edited file kept without `--force` (`04_PERMISSIONS.md`, `10_NEVER_ALWAYS.md`)
+
+### Bootstrap, fixed
+
+- The skill and every agent adapter told an agent to run `npx devia init`. Since the package is
+  scoped, that resolves to nothing in a repository that has not installed devia: `404 devia@*`.
+  They now say `npm i -D @schneiderjoseph/devia && npx devia init`, which is what a cold start
+  actually needs. Found while installing the skill system-wide, where the cold start is the
+  normal case rather than the exception
+
 ## 0.1.0 — 2026-09-03
 
 First release. Devia consolidates three bodies of work into one maintained standard plus a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@schneiderjoseph/devia",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "One standard, one memory: engineering and design rules plus living project memory for AI coding agents",
   "type": "module",
   "license": "MIT",

package/skills/devia/SKILL.md

@@ -21,9 +21,12 @@ ls .devia
 **No `.devia/`** → initialise before writing any code:
 
 ```bash
+npm i -D @schneiderjoseph/devia    # the package is scoped, the command is not
 npx devia init
 ```
 
+Install first: `npx devia` only resolves once the package is a dependency of the project.
+
 Then fill `.devia/00_OVERVIEW.md` from what the repository actually contains — stack, modules,
 where the truth lives. Read the code to fill it; do not invent it. This is not paperwork: it is
 the difference between a task and a guess (`AGT-002`).

package/src/commands/skills.mjs

@@ -1,4 +1,6 @@
+import os from "node:os";
 import path from "node:path";
+import process from "node:process";
 import { packageRoot, exists, read, writeFile } from "../lib/fs.mjs";
 import { color, heading, status, line } from "../lib/ui.mjs";
 
@@ -36,6 +38,89 @@ export function installAdapters(root, { force = false, agents = Object.keys(ADAP
   return { written, kept };
 }
 
+const SKILL_PACK = path.join("skills", "devia", "SKILL.md");
+const adapter = (file) => path.join("templates", "agents", file);
+
+/**
+ * Where each agent keeps a contract that applies to every project, not one.
+ *
+ * devia is for every agent, so an agent is listed here as soon as its user-level location is
+ * known — and reported as SKIP with the reason when it is not. Each entry carries the file the
+ * agent actually reads: a skill pack where the agent loads skills, its own rules format
+ * otherwise. Guessing a path inside someone's home directory is the confident wrong answer this
+ * tool exists to prevent, so absence of evidence is reported, never rounded up.
+ */
+function globalTargets() {
+  const home = os.homedir();
+  const configDir = (envVar, fallback) =>
+    process.env[envVar] ? path.resolve(process.env[envVar]) : path.join(home, fallback);
+
+  return {
+    claude: {
+      target: path.join(configDir("CLAUDE_CONFIG_DIR", ".claude"), "skills", "devia", "SKILL.md"),
+      source: SKILL_PACK,
+    },
+    codex: {
+      target: path.join(configDir("CODEX_HOME", ".codex"), "skills", "devia", "SKILL.md"),
+      source: SKILL_PACK,
+    },
+    cursor: {
+      target: path.join(home, ".cursor", "rules", "devia.mdc"),
+      source: adapter("cursor.mdc"),
+    },
+    gemini: {
+      // One file the user owns, not a directory devia can add to: written only when it is
+      // absent or empty, so a global instruction file is never silently replaced.
+      target: path.join(home, ".gemini", "GEMINI.md"),
+      source: adapter("AGENTS.md"),
+      onlyWhenEmpty: true,
+    },
+    copilot: {
+      reason: "user-level instructions live in the editor's settings, not a file devia can place",
+    },
+    windsurf: {
+      reason: "no user-level rules file — .windsurfrules is per repository",
+    },
+  };
+}
+
+/**
+ * Install the contract once for every project. This is the only path that writes outside
+ * `--root`: it happens behind `--global`, and it prints every path it touches
+ * (`04_PERMISSIONS.md`).
+ */
+export function installGlobalSkill({ force = false } = {}) {
+  const written = [];
+  const kept = [];
+  const skipped = [];
+
+  for (const [key, entry] of Object.entries(globalTargets())) {
+    if (!entry.target) {
+      skipped.push([key, entry.reason]);
+      continue;
+    }
+    const content = read(path.join(packageRoot, entry.source));
+    if (content === null) {
+      skipped.push([key, `${entry.source} missing from the installed package`]);
+      continue;
+    }
+    if (exists(entry.target) && !force) {
+      const current = read(entry.target) || "";
+      if (entry.onlyWhenEmpty && current.trim()) {
+        skipped.push([key, `${path.basename(entry.target)} already has content — add the contract yourself`]);
+        continue;
+      }
+      if (current.trim()) {
+        kept.push([key, entry.target]);
+        continue;
+      }
+    }
+    writeFile(entry.target, content);
+    written.push([key, entry.target]);
+  }
+  return { written, kept, skipped };
+}
+
 export function installSkill(root, { force = false, agents = Object.keys(SKILL_TARGETS) } = {}) {
   const skill = read(path.join(packageRoot, "skills", "devia", "SKILL.md"));
   const written = [];
@@ -64,12 +149,29 @@ ${color.bold("devia skills")} — the same contract for every coding agent
 
   devia skills list
   devia skills install [--agent all|${Object.keys(ADAPTERS).join("|")}] [--force] [--skill]
+  devia skills install --global [--force]
 
   --skill    also install skills/devia/SKILL.md for Cursor and Claude Code
+  --global   install the skill for every project, in the agent's own configuration
+             directory. The only command that writes outside --root; it prints
+             every path it touches
 `.trim());
     return flags.help ? 0 : 2;
   }
 
+  if (flags.global) {
+    const res = installGlobalSkill({ force: Boolean(flags.force) });
+    heading("devia skills install --global");
+    for (const [key, target] of res.written) status("PASS", key, target);
+    for (const [key, target] of res.kept) status("SKIP", `${key} — already there`, target);
+    for (const [key, reason] of res.skipped) status("SKIP", key, reason);
+    line("");
+    line(color.dim("  The skill is now available in every project. It still expects each"));
+    line(color.dim("  repository to carry its own .devia/ — the skill says how to create one."));
+    line("");
+    return 0;
+  }
+
   if (action === "list") {
     heading("Adapters");
     for (const [key, [, target]] of Object.entries(ADAPTERS)) {

package/templates/agents/AGENTS.md

@@ -10,7 +10,8 @@ This repository uses **devia**: a standard plus a living project memory in `.dev
 4. Read the memory file for the surface you are touching — see
    [`.devia/14_INDEX.md`](.devia/14_INDEX.md)
 
-If `.devia/` is missing, run `npx devia init` and fill `00_OVERVIEW.md` before writing code.
+If `.devia/` is missing, run `npm i -D @schneiderjoseph/devia && npx devia init`, then fill
+`00_OVERVIEW.md` before writing code.
 
 ## While working
 

package/templates/agents/CLAUDE.md

@@ -10,7 +10,8 @@ work, updated with every change.
 3. `.devia/00_OVERVIEW.md` — what this project is
 4. The memory file for the surface you are touching (`.devia/14_INDEX.md`)
 
-No `.devia/`? Run `npx devia init` and fill `00_OVERVIEW.md` before writing code.
+No `.devia/`? Run `npm i -D @schneiderjoseph/devia && npx devia init`, then fill
+`00_OVERVIEW.md` before writing code.
 
 ## Rules that override default behaviour
 

package/templates/agents/cursor.mdc

@@ -7,7 +7,7 @@ This repository runs on devia. `.devia/` is the project memory and it is not opt
 
 1. Before the first edit, read `.devia/AGENTS.md`, `.devia/10_NEVER_ALWAYS.md`,
    `.devia/00_OVERVIEW.md`, and the memory file for the surface you are touching
-   (`.devia/14_INDEX.md`). If `.devia/` does not exist, run `npx devia init` first (AGT-001,
+   (`.devia/14_INDEX.md`). If `.devia/` does not exist, run `npm i -D @schneiderjoseph/devia && npx devia init` first (AGT-001,
    AGT-002).
 2. Never invent an endpoint, field, config key or business rule. Unknown goes to
    `.devia/11_GAPS.md` or to the human — never into the code as a quiet default (AGT-004,

package/templates/agents/windsurfrules.md

@@ -4,7 +4,7 @@ This repository runs on devia. `.devia/` is the project memory.
 
 1. Read `.devia/AGENTS.md`, `.devia/10_NEVER_ALWAYS.md`, `.devia/00_OVERVIEW.md` and the memory
    file for the surface you are touching before editing anything. No `.devia/`? Run
-   `npx devia init` first.
+   `npm i -D @schneiderjoseph/devia && npx devia init` first.
 2. Never invent an endpoint, field, config key or business rule — record the unknown in
    `.devia/11_GAPS.md` or ask.
 3. Decided but not built goes to `.devia/12_DEBT.md`; never delete a line you did not discharge.