devflow-kit 2.5.0 → 3.0.1

package/dist/hud/git.js

@@ -2,15 +2,55 @@ import { execFile } from 'node:child_process';
 import { isTrunkBranch } from '../core/git.js';
 const GIT_TIMEOUT = 1000; // 1s per command
 const GIT_MAXBUFFER = 16 * 1024 * 1024; // 16 MiB — covers >500k refs at ~30 B/ref
-function shellExec(cmd, args, cwd) {
+function shellExec(cmd, args, cwd, trim = 'both') {
     return new Promise((resolve) => {
         execFile(cmd, args, { cwd, timeout: GIT_TIMEOUT, maxBuffer: GIT_MAXBUFFER }, (err, stdout) => {
-            resolve(err ? '' : stdout.trim());
+            if (err)
+                return resolve('');
+            resolve(trim === 'trailing' ? stdout.trimEnd() : stdout.trim());
         });
     });
 }
+/**
+ * The override that stops git running a repository's `core.fsmonitor` command.
+ *
+ * D-NO-FSMONITOR: git runs the command a repository's config names in
+ * `core.fsmonitor` whenever it reads the index — code chosen by whatever
+ * repository the status line is drawn in, on every prompt. Every HUD git call
+ * carries this override (`gitExec`), except the index reads' carve-out below.
+ */
+const FSMONITOR_OFF = ['-c', 'core.fsmonitor=false'];
+/** `core.fsmonitor` as git itself reads it, without touching the index. */
+const FSMONITOR_CONFIG_READ = ['config', '--type=bool', '--get', 'core.fsmonitor'];
+/**
+ * Every HUD git call except the index reads: the override first, so no call
+ * that never needs fsmonitor can run a repository's hook.
+ */
 function gitExec(args, cwd) {
-    return shellExec('git', args, cwd);
+    return shellExec('git', ['-c', 'core.fsmonitor=false', ...args], cwd);
+}
+/**
+ * D-NO-FSMONITOR carve-out: the override for an index read, given the
+ * trimmed stdout of `git config --type=bool --get core.fsmonitor`.
+ *
+ * `true` is the built-in fsmonitor daemon — git's own code, not a command from
+ * the repository — and it is what keeps `status` fast in huge repositories,
+ * where the HUD's 1s timeout would otherwise expire and draw a clean tree. Only
+ * that exact answer drops the override. A hook path (which `--type=bool`
+ * refuses), any other value, an unset key and a failed read all come back as
+ * something else, and keep it: the carve-out fails closed.
+ *
+ * @param fsmonitorConfig - the config read's trimmed stdout; '' when it failed
+ */
+export function fsmonitorOverride(fsmonitorConfig) {
+    return fsmonitorConfig === 'true' ? [] : FSMONITOR_OFF;
+}
+/**
+ * The HUD's index reads (`status`, `diff`): the override unless this refresh's
+ * `core.fsmonitor` read named the built-in daemon (`fsmonitorOverride`).
+ */
+function gitIndexRead(args, cwd, fsmonitorConfig, trim = 'both') {
+    return shellExec('git', [...fsmonitorOverride(fsmonitorConfig), ...args], cwd, trim);
 }
 /**
  * Gather git status for the given working directory.
@@ -21,8 +61,13 @@ export async function gatherGitStatus(cwd) {
     const topLevel = await gitExec(['rev-parse', '--show-toplevel'], cwd);
     if (!topLevel)
         return null;
-    // Branch name — 'HEAD' means detached HEAD state
-    const branch = await gitExec(['rev-parse', '--abbrev-ref', 'HEAD'], cwd);
+    // Branch name — 'HEAD' means detached HEAD state. core.fsmonitor is read once
+    // per refresh, never cached (the setting can change between prompts), and
+    // without the override, which would answer for it.
+    const [branch, fsmonitorConfig] = await Promise.all([
+        gitExec(['rev-parse', '--abbrev-ref', 'HEAD'], cwd),
+        shellExec('git', [...FSMONITOR_CONFIG_READ], cwd),
+    ]);
     if (!branch)
         return null;
     // Dirty check — porcelain v1: two-char XY status prefix per path.
@@ -30,7 +75,7 @@ export async function gatherGitStatus(cwd) {
     // `git status --no-optional-locks` is rejected as an unknown option, which makes
     // shellExec return '' and silently reports every tree as clean. Keeping the flag
     // (in the right position) stops the HUD from writing .git/index on every prompt.
-    const statusOutput = await gitExec(['--no-optional-locks', 'status', '--porcelain'], cwd);
+    const statusOutput = await gitIndexRead(['--no-optional-locks', 'status', '--porcelain'], cwd, fsmonitorConfig, 'trailing');
     let dirty = false;
     let staged = false;
     for (const line of statusOutput.split('\n')) {
@@ -71,7 +116,7 @@ export async function gatherGitStatus(cwd) {
             // NOTE: diff includes the working tree; ahead/behind counts commits only. This asymmetry is
             // deliberate — both reference the same merge base but differ in working-tree inclusion.
             if (mergeBase) {
-                const diffStat = await gitExec(['diff', '--shortstat', mergeBase], cwd);
+                const diffStat = await gitIndexRead(['diff', '--shortstat', mergeBase], cwd, fsmonitorConfig);
                 const filesMatch = diffStat.match(/(\d+)\s+file/);
                 const addMatch = diffStat.match(/(\d+)\s+insertion/);
                 const delMatch = diffStat.match(/(\d+)\s+deletion/);

package/dist/hud/index.js

@@ -7,7 +7,7 @@ import { gatherGitStatus } from './git.js';
 import { parseTranscript } from './transcript.js';
 import { persistSessionCost, aggregateCosts } from './cost-history.js';
 import { gatherConfigCounts } from './components/config-counts.js';
-import { gatherLearningCounts } from './components/learning-counts.js';
+import { gatherLedgerLearningCounts } from './components/learning-counts.js';
 import { render } from './render.js';
 const OVERALL_TIMEOUT = 2000; // 2 second overall timeout
 /**
@@ -55,8 +55,8 @@ async function run() {
     const resolved = resolveComponents(config);
     const components = new Set(resolved);
     const cwd = stdin.cwd || process.cwd();
-    const devflowDir = process.env.DEVFLOW_DIR ||
-        path.join(process.env.HOME || homedir(), '.devflow');
+    // D-ONE-HOME: always $HOME/.devflow — no environment variable relocates it.
+    const devflowDir = path.join(process.env.HOME || homedir(), '.devflow');
     // Determine what data to gather based on enabled components
     const needsGit = components.has('gitBranch') ||
         components.has('gitAheadBehind') ||
@@ -68,12 +68,14 @@ async function run() {
     const needsConfigCounts = components.has('configCounts');
     const needsLearningCounts = components.has('learningCounts');
     const needsSessionCost = components.has('sessionCost');
-    // Parallel data gathering — only fetch what's needed
-    const [git, transcript] = await Promise.all([
+    // Parallel data gathering — only fetch what's needed. The learning counts
+    // ride here because resolving the ledger root is one git call.
+    const [git, transcript, learningCountsData] = await Promise.all([
         needsGit ? gatherGitStatus(cwd) : Promise.resolve(null),
         needsTranscript && stdin.transcript_path
             ? parseTranscript(stdin.transcript_path)
             : Promise.resolve(null),
+        needsLearningCounts ? gatherLedgerLearningCounts(cwd) : Promise.resolve(null),
     ]);
     // Extract usage quota from stdin rate_limits (replaces OAuth fetch)
     const usage = components.has('usageQuota') ? extractUsageFromStdin(stdin) : null;
@@ -90,10 +92,6 @@ async function run() {
     const configCountsData = needsConfigCounts
         ? gatherConfigCounts(cwd)
         : null;
-    // Decisions/pitfalls counts (fast, synchronous filesystem read)
-    const learningCountsData = needsLearningCounts
-        ? gatherLearningCounts(cwd)
-        : null;
     // Cost tracking: persist current session cost, aggregate for weekly/monthly
     const sessionId = stdin.session_id;
     const costUsd = stdin.cost?.total_cost_usd ?? 0;

package/dist/skills/git/references/pr/check-merge-readiness.md

@@ -11,7 +11,7 @@ Load for `check-merge-readiness` under every tracker provider.
    - Values: `APPROVED`, `CHANGES_REQUESTED`, `REVIEW_REQUIRED`, or null
 3. Fetch CI status (same logic as `check-ci-status`)
    Those steps are in `references/pr/check-ci-status.md` — load it and apply them to this `PR_NUMBER`, every arm unchanged.
-4. Read the test-plan evidence at the current head, from `WORKTREE_PATH` (else cwd): `node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/verify-evidence.cjs" verify --pr {PR_NUMBER} --approval; echo "exit=$?"`. The evidence is *known* only on `exit=0` with stdout exactly one `EVIDENCE pr:{PR_NUMBER} …` line; otherwise it is *unknown*. From it read `total`, `VERIFIED-CI`, `ATTESTED-LOCAL` (report the two apart), `exceptions` and `approval`; *verified* = `VERIFIED-CI` + `ATTESTED-LOCAL`, never inferred from an absent field. The script re-derives every state at the head and decides `approval` by the trust rule; it prints nothing it read from the PR.
+4. Read the test-plan evidence at the current head, from `WORKTREE_PATH` (else cwd): `node "$HOME/.devflow/scripts/verify-evidence.cjs" verify --pr {PR_NUMBER} --approval; echo "exit=$?"`. The evidence is *known* only on `exit=0` with stdout exactly one `EVIDENCE pr:{PR_NUMBER} …` line; otherwise it is *unknown*. From it read `total`, `VERIFIED-CI`, `ATTESTED-LOCAL` (report the two apart), `exceptions` and `approval`; *verified* = `VERIFIED-CI` + `ATTESTED-LOCAL`, never inferred from an absent field. The script re-derives every state at the head and decides `approval` by the trust rule; it prints nothing it read from the PR.
 5. Classify (first matching rule wins):
    - `NOT_READY (unresolved threads: {n})` — unresolved_threads > 0
    - `NOT_READY (changes requested)` — reviewDecision == `CHANGES_REQUESTED`

package/dist/skills/git/references/pr/ensure-pr-ready.md

@@ -10,7 +10,7 @@ Load for `ensure-pr-ready` under every tracker provider.
 2. Check for uncommitted changes - if any, create atomic commit using `devflow:git` patterns
 3. Check if branch pushed to remote - if not, push with `-u` flag. If that push is refused and the branch's open PR is cross-repository with maintainer edits off (`gh pr view --json isCrossRepository,maintainerCanModify`), emit `TRACEABILITY: DEGRADED (cannot push to fork)` and go to 4a (4a–4c edit only the PR).
 4a. Check if PR exists - if not, create PR using guidance from (in priority order): (a) `PR_DESCRIPTION_GUIDANCE` if given and not `(none)`, (b) generated from branch context. Compose the PR body via the `devflow:git` template to `$DEVFLOW_BODY_RAW` (a D11 sink: it publishes at repo visibility), then append the caller blocks. Apply the Comment-sink scrub (D11) — a failed one posts neither block; on success: `gh pr create … --body-file "$DEVFLOW_BODY"`.
-   - **Caller blocks**, in order: `PR_WAVE_BLOCK` (`check wave`), then `PR_TEST_PLAN_BLOCK` (`check block`), each when given and not `(none)`. Write it byte for byte to a fresh `mktemp` file with the Write tool, never via a shell string, and run `node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/verify-evidence.cjs" check <wave|block> <file>; echo "exit=$?"`. Only `exit=0` admits it, verbatim; else omit it, never repaired or partly pasted, and emit `TRACEABILITY: DEGRADED (wave block does not match its grammar)` or `TRACEABILITY: DEGRADED (test-plan block does not match its grammar)` with steps 4b/4c's lines. An admitted wave block is the body's only `## Related Issues`: skip 4b.
+   - **Caller blocks**, in order: `PR_WAVE_BLOCK` (`check wave`), then `PR_TEST_PLAN_BLOCK` (`check block`), each when given and not `(none)`. Write it byte for byte to a fresh `mktemp` file with the Write tool, never via a shell string, and run `node "$HOME/.devflow/scripts/verify-evidence.cjs" check <wave|block> <file>; echo "exit=$?"`. Only `exit=0` admits it, verbatim; else omit it, never repaired or partly pasted, and emit `TRACEABILITY: DEGRADED (wave block does not match its grammar)` or `TRACEABILITY: DEGRADED (test-plan block does not match its grammar)` with steps 4b/4c's lines. An admitted wave block is the body's only `## Related Issues`: skip 4b.
 4c. Retitle, only when `APPLY_CONVENTIONS` is `true`: if the PR title breaks the convention in the PR Titles section of `.devflow/conventions.md`, retitle it; skip silently when that file is absent. Two rules, because the title derives from third-party PR titles:
    - **Validate before use.** Skip the retitle (leave the PR title as-is, no error) if the composed title contains any of `` $ ` \ " ' ; | & < > `` or a newline.
    - **Pass as argv, never as command text.** Bind it to a shell variable and pass that variable: `gh pr edit {PR_NUMBER} --title "$DEVFLOW_PR_TITLE"`. Never interpolate it: `$(...)`, backticks and `${...}` all expand inside double quotes.

package/dist/skills/git/references/pr/update-pr-evidence.md

@@ -6,7 +6,7 @@ Load for `update-pr-evidence` under every tracker provider.
 
 ### Process
 
-Run steps 1–4 as ONE Bash invocation from `WORKTREE_PATH` (else cwd) — the trap removes `$S` and the temp files when it exits — with `V="${DEVFLOW_DIR:-$HOME/.devflow}/scripts"`.
+Run steps 1–4 as ONE Bash invocation from `WORKTREE_PATH` (else cwd) — the trap removes `$S` and the temp files when it exits — with `V="$HOME/.devflow/scripts"`.
 
 1. **Verify.** Set `S=`, arm the D11 trap with `[ -n "$S" ] && { rm -- "$S/base" "$S/base.sha256"; rmdir -- "$S"; } 2>/dev/null` added before its `exit`, then the four `mktemp`s and `S="$(mktemp -d)"`. Run `node "$V/verify-evidence.cjs" verify --pr {PR_NUMBER} --state "$S" --block-out "$DEVFLOW_NOTES_RAW" --comment-out "$DEVFLOW_BODY_RAW"`, adding `--publication {REVIEW_PUBLICATION}` only when that is `auto`, `full`, `off` or `stub`, and `--evidence "{EVIDENCE_FILE}"` when given — only a value matching `^[A-Za-z0-9._/-]{1,255}$` reaches the shell; any other is a failed run. Continue only on exit 0 with stdout exactly one line, `EVIDENCE pr:<n> head:<sha> total:<n> VERIFIED-CI:<n> ATTESTED-LOCAL:<n> UNVERIFIED:<n> STALE:<n> FAILED:<n> INDETERMINATE:<n> stale:<ids|none> exceptions:<kinds|none> approval:<yes|no|unchecked> key:<hex> posted:<yes|no|n/a> body:<same|changed>`; otherwise emit `TRACEABILITY: DEGRADED (evidence unavailable)` and stop. The script makes this op's one `gh pr view` read and prints nothing it read from the PR; never read the PR another way.
 2. **Body**, only on `body:changed` (else `UNCHANGED`): `node "$V/redact-secrets.cjs" "$DEVFLOW_NOTES_RAW" "$DEVFLOW_NOTES" && node "$V/verify-evidence.cjs" splice --pr {PR_NUMBER} --state "$S" --block "$DEVFLOW_NOTES" --out "$DEVFLOW_BODY" && gh pr edit {PR_NUMBER} --body-file "$DEVFLOW_BODY"`. Only the composed block is scrubbed (D11); every byte outside its markers is the PR's own and stays identical. `splice` re-reads the body: unchanged since step 1 → it writes; changed → it splices once onto the fresh body and re-reads; changed again → `SPLICE conflict`: `SKIPPED` and `TRACEABILITY: DEGRADED (concurrent edit)`. Any other non-zero → `DEGRADED ({reason})`, naming a printed `SPLICE` token. No edit either way; go to step 4.

package/dist/skills/git/references/tracker/_mcp.md

@@ -91,7 +91,7 @@ framing line instead.
 ```bash
 DEVFLOW_BODY_RAW="$(mktemp)"
 # …compose the body into "$DEVFLOW_BODY_RAW"…
-node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/redact-secrets.cjs" --emit "$DEVFLOW_BODY_RAW"
+node "$HOME/.devflow/scripts/redact-secrets.cjs" --emit "$DEVFLOW_BODY_RAW"
 ```
 
 Line 1 of that result is the framing:

package/dist/skills/git/references/tracker/github/backlink-shipped-issues.md

@@ -16,7 +16,7 @@ The D4 degradation contract and the D11 comment-sink scrub state the rules; what
 
 ```bash
 trap 'GATE=$?; rm -- "$DEVFLOW_BODY_RAW" "$DEVFLOW_BODY" 2>/dev/null; exit "$GATE"' EXIT INT TERM
-node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/redact-secrets.cjs" "$DEVFLOW_BODY_RAW" "$DEVFLOW_BODY" \
+node "$HOME/.devflow/scripts/redact-secrets.cjs" "$DEVFLOW_BODY_RAW" "$DEVFLOW_BODY" \
   && gh issue comment {number} --body-file "$DEVFLOW_BODY"
 ```
 

package/dist/skills/git/references/tracker/github/ensure-traceable-issue.md

@@ -40,7 +40,7 @@ Login fails when using SSO authentication.
 ## Expected Behavior
 User should be logged in successfully.
 EOF
-} && node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/redact-secrets.cjs" \
+} && node "$HOME/.devflow/scripts/redact-secrets.cjs" \
     "$DEVFLOW_BODY_RAW" "$DEVFLOW_BODY" \
   && gh issue create \
     --title "Bug: Login fails for SSO users" \

package/dist/skills/git/references/tracker/github/gather-release-evidence.md

@@ -6,7 +6,7 @@ Load when the resolved tracker provider is `github` and the operation is `gather
 
 ### Process
 
-1a. **Last release tag.** Step 1's `git describe` can return a non-release marker tag. From `WORKTREE_PATH` (else cwd), run `node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/release-trace.cjs" last-tag`: `LAST_TAG <tag>` ⇒ that tag is `{last_tag}`; `LAST_TAG none` ⇒ step 1's initial-commit rule; anything else ⇒ keep step 1's tag and report status `INDETERMINATE (last release tag unresolved)`.
+1a. **Last release tag.** Step 1's `git describe` can return a non-release marker tag. From `WORKTREE_PATH` (else cwd), run `node "$HOME/.devflow/scripts/release-trace.cjs" last-tag`: `LAST_TAG <tag>` ⇒ that tag is `{last_tag}`; `LAST_TAG none` ⇒ step 1's initial-commit rule; anything else ⇒ keep step 1's tag and report status `INDETERMINATE (last release tag unresolved)`.
 3a. **Closing-keyword rule.** A candidate follows, on the same line, a whitespace token matching `^\(?(close[sd]?|fix(e[sd])?|resolve[sd]?|refs):?$` (case-insensitive). Take the next token, plus each further token while the previous one ends in `,`. Split each on `,`, strip one leading `(` and every trailing character in `[.,;:)\]!?]`, drop empties, then apply step 5's anchored gate unchanged. Read each message as `git log --format=%B` lines.
 3b. **This provider's history grammar** is `^#[1-9][0-9]{0,8}$`. A bare number is not a reference here either: a keyword-anchored candidate must carry the `#`, and step 4 renders every number it reads from a merged PR as `#{n}` before step 5's gate.
 4. If `gh` is authenticated and remote is reachable, resolve which issues the range's merged PRs close — **one listing, never one call per commit** — and merge the result with the commit-message set:
@@ -16,4 +16,4 @@ Load when the resolved tracker provider is `github` and the operation is `gather
    - **Coverage:** a range subject carries a PR marker (`(#N)` or `Merge pull request #N`) but no listed PR maps into the range ⇒ `TRACEABILITY: DEGRADED (merged-PR listing did not cover the range)`. A listing of exactly 200 ⇒ status `INDETERMINATE (merged-PR listing hit its 200 cap)`, returning what was collected.
    - **The listing fails** (an older `gh` reports `Unknown JSON field`) ⇒ `TRACEABILITY: DEGRADED ({reason})`, then fall back to `gh pr view N --json closingIssuesReferences` over the PR numbers in `(#N)` / `Merge pull request #N` subjects — after a listing that succeeds, also over each range `(#N)` naming no listed PR — each N gated `^[1-9][0-9]{0,8}$`, filtered and rendered as above, bounded at ≤25 PRs; report the remainder as `THROTTLED ({n} not processed)` and never report the enrichment as complete while PRs went unresolved.
    - On any 4xx → DEGRADED for that item, continue. On 5xx → 1 retry; still 5xx → DEGRADED for that item, continue. On the secondary rate limit of `### Provider signals (GitHub)` in this operation's `backlink-shipped-issues` reference → stop GitHub enrichment immediately, report remaining as `THROTTLED`.
-6. **Per-commit trace map.** In one shell: `trap 'rm -- "$T"' EXIT; T="$(mktemp)"`, then one 40-hex SHA per line into `$T` — each range commit step 4 tied to a PR with ≥1 kept reference (its `mergeCommit.oid`, or a subject naming it). From `WORKTREE_PATH` (else cwd), run `node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/release-trace.cjs" map --from {last_tag} --grammar github --traced-file "$T"; echo "exit=$?"`. Accept only `exit=0` after a first line `TRACE from:<ref> scanned:<n> traced:<n> untraced:<n> exempt:<n> unmatched:<n> bound:<ok|hit>`; copy every line above `exit=0` verbatim under `### TRACE_MAP`. Anything else ⇒ `TRACEABILITY: DEGRADED (trace map unavailable)`, `### TRACE_MAP` = `(unavailable)`, status `INDETERMINATE (trace map unavailable)`. `bound:hit` ⇒ status `INDETERMINATE (trace scan bound 500 hit)`. An `INDETERMINATE` status outranks every other.
+6. **Per-commit trace map.** In one shell: `trap 'rm -- "$T"' EXIT; T="$(mktemp)"`, then one 40-hex SHA per line into `$T` — each range commit step 4 tied to a PR with ≥1 kept reference (its `mergeCommit.oid`, or a subject naming it). From `WORKTREE_PATH` (else cwd), run `node "$HOME/.devflow/scripts/release-trace.cjs" map --from {last_tag} --grammar github --traced-file "$T"; echo "exit=$?"`. Accept only `exit=0` after a first line `TRACE from:<ref> scanned:<n> traced:<n> untraced:<n> exempt:<n> unmatched:<n> bound:<ok|hit>`; copy every line above `exit=0` verbatim under `### TRACE_MAP`. Anything else ⇒ `TRACEABILITY: DEGRADED (trace map unavailable)`, `### TRACE_MAP` = `(unavailable)`, status `INDETERMINATE (trace map unavailable)`. `bound:hit` ⇒ status `INDETERMINATE (trace scan bound 500 hit)`. An `INDETERMINATE` status outranks every other.

package/dist/skills/git/references/tracker/github/manage-debt.md

@@ -34,7 +34,7 @@ post_scrubbed() {
     # scrubber scrub — and the chain publish — whatever the RAW file last held.
     # Never a pipeline: a pipeline's exit status hides a scrubber crash (fail-open).
     printf '%s\n' "$1" > "$DEVFLOW_BODY_RAW" \
-      && node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/redact-secrets.cjs" \
+      && node "$HOME/.devflow/scripts/redact-secrets.cjs" \
         "$DEVFLOW_BODY_RAW" "$DEVFLOW_BODY" \
       && gh issue comment "$2" --body-file "$DEVFLOW_BODY"
 }
@@ -61,7 +61,7 @@ add_tech_debt_item() {
     # edit` replaces the whole body, so what is composed is the body just read plus
     # the new item, under its trailing `## Items` heading.
     printf '%s\n%s\n' "$current_body" "$new_item" > "$DEVFLOW_BODY_RAW" \
-      && node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/redact-secrets.cjs" \
+      && node "$HOME/.devflow/scripts/redact-secrets.cjs" \
         "$DEVFLOW_BODY_RAW" "$DEVFLOW_BODY" \
       && gh issue edit "$TECH_DEBT_ISSUE" --body-file "$DEVFLOW_BODY"
 }
@@ -83,7 +83,7 @@ archive_tech_debt_issue() {
 
 ## Items
 " > "$DEVFLOW_BODY_RAW" \
-      && node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/redact-secrets.cjs" \
+      && node "$HOME/.devflow/scripts/redact-secrets.cjs" \
         "$DEVFLOW_BODY_RAW" "$DEVFLOW_BODY" \
       && new_url=$(gh issue create \
         --title "Tech Debt Backlog" \

package/dist/skills/git/references/tracker/jira/backlink-shipped-issues.md

@@ -44,6 +44,6 @@ For each issue the hoist did not answer, within the operation's `≤50` bound:
 The tool-call contract governs the write; this operation names its steps and restates none of its rules.
 
 1. Compose this post's own content into `$DEVFLOW_BODY_RAW` — a fresh `mktemp` per invocation, under D11's removal `trap`.
-2. Run `node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/redact-secrets.cjs" --emit "$DEVFLOW_BODY_RAW"`.
+2. Run `node "$HOME/.devflow/scripts/redact-secrets.cjs" --emit "$DEVFLOW_BODY_RAW"`.
 3. Require line 1 to be `D11-OK`; verify `<bytes>` against the received body's byte length; echo `SCRUB: N [type:count,…]`; and when N > 0 also emit `SECRET-EXPOSED (rotate {type} credential — the source file still holds it)`.
 4. Post through the *add comment* capability with arguments (issue key, body: {SCRUBBED_BODY}).

package/dist/skills/git/references/tracker/jira/ensure-traceable-issue.md

@@ -41,7 +41,7 @@ Caller-supplied prose reaches the tracker as a QUERY here and nowhere else in th
 The tool-call contract governs every write below; this operation names its steps and restates none of its rules.
 
 1. Compose this post's own content into `$DEVFLOW_BODY_RAW` — a fresh `mktemp` per invocation, under D11's removal `trap`.
-2. Run `node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/redact-secrets.cjs" --emit "$DEVFLOW_BODY_RAW"`.
+2. Run `node "$HOME/.devflow/scripts/redact-secrets.cjs" --emit "$DEVFLOW_BODY_RAW"`.
 3. Require line 1 to be `D11-OK`; verify `<bytes>` against the received body's byte length; echo `SCRUB: N [type:count,…]`; and when N > 0 also emit `SECRET-EXPOSED (rotate {type} credential — the source file still holds it)`.
 4. Post through the *add comment* capability with arguments (issue key, body: {SCRUBBED_BODY}), or on a new issue through the *create issue* capability with the description field carrying the same gated value.
 

package/dist/skills/git/references/tracker/jira/gather-release-evidence.md

@@ -6,7 +6,7 @@ Load when the resolved tracker provider is `jira` and the operation is `gather-r
 
 ### Process
 
-1a. **Last release tag.** Step 1's `git describe` can return a non-release marker tag. From `WORKTREE_PATH` (else cwd), run `node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/release-trace.cjs" last-tag`: `LAST_TAG <tag>` ⇒ that tag is `{last_tag}`; `LAST_TAG none` ⇒ step 1's initial-commit rule; anything else ⇒ keep step 1's tag and report status `INDETERMINATE (last release tag unresolved)`.
+1a. **Last release tag.** Step 1's `git describe` can return a non-release marker tag. From `WORKTREE_PATH` (else cwd), run `node "$HOME/.devflow/scripts/release-trace.cjs" last-tag`: `LAST_TAG <tag>` ⇒ that tag is `{last_tag}`; `LAST_TAG none` ⇒ step 1's initial-commit rule; anything else ⇒ keep step 1's tag and report status `INDETERMINATE (last release tag unresolved)`.
 3a. **Closing-keyword rule.** A candidate follows, on the same line, a whitespace token matching `^\(?(close[sd]?|fix(e[sd])?|resolve[sd]?|refs):?$` (case-insensitive). Take the next token, plus each further token while the previous one ends in `,`. Split each on `,`, strip one leading `(` and every trailing character in `[.,;:)\]!?]`, drop empties, then apply step 5's anchored gate unchanged. Read each message as `git log --format=%B` lines.
 4. Resolve which issues the commit range closes:
    - **There is no closing-reference capability on this provider.** Emit `TRACEABILITY: DEGRADED (unsupported by jira)` once for the whole step and fall back to the commit-message set alone — the refs parsed out of the candidate references the agent extracted from the range's commit messages.
@@ -15,4 +15,4 @@ Load when the resolved tracker provider is `jira` and the operation is `gather-r
    - Confirm the survivors exist with **one** call to the *batch fetch* capability over the whole set, bounded `≤50` with `TRUNCATED ({n} not processed)` for the remainder — **one query, never a per-item loop**.
    - **Because the closing-reference step degraded, the enrichment is incomplete by construction: never report the status as `COMPLETE`.** Report `PARTIAL ({n} DEGRADED)` whenever any step above degraded, and `TRUNCATED ({n} not processed)` whenever the bound was reached. A release that reads `COMPLETE` over an unresolvable evidence set is the one report nobody re-checks.
    - On a tool error for an individual item → DEGRADED for that item, continue. On backpressure → follow `### Provider signals (Jira)` in this operation's `backlink-shipped-issues` reference, which is where this provider's one signal is stated.
-6. **Per-commit trace map.** `{KEY}` is the resolved project key; with none usable, skip the run and take the arm below. From `WORKTREE_PATH` (else cwd), run `node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/release-trace.cjs" map --from {last_tag} --grammar jira --key {KEY}; echo "exit=$?"`. Accept only `exit=0` after a first line `TRACE from:<ref> scanned:<n> traced:<n> untraced:<n> exempt:<n> unmatched:<n> bound:<ok|hit>`; copy every line above `exit=0` verbatim under `### TRACE_MAP`. Anything else ⇒ `TRACEABILITY: DEGRADED (trace map unavailable)`, `### TRACE_MAP` = `(unavailable)`, status `INDETERMINATE (trace map unavailable)`. `bound:hit` ⇒ status `INDETERMINATE (trace scan bound 500 hit)`. An `INDETERMINATE` status outranks every other.
+6. **Per-commit trace map.** `{KEY}` is the resolved project key; with none usable, skip the run and take the arm below. From `WORKTREE_PATH` (else cwd), run `node "$HOME/.devflow/scripts/release-trace.cjs" map --from {last_tag} --grammar jira --key {KEY}; echo "exit=$?"`. Accept only `exit=0` after a first line `TRACE from:<ref> scanned:<n> traced:<n> untraced:<n> exempt:<n> unmatched:<n> bound:<ok|hit>`; copy every line above `exit=0` verbatim under `### TRACE_MAP`. Anything else ⇒ `TRACEABILITY: DEGRADED (trace map unavailable)`, `### TRACE_MAP` = `(unavailable)`, status `INDETERMINATE (trace map unavailable)`. `bound:hit` ⇒ status `INDETERMINATE (trace scan bound 500 hit)`. An `INDETERMINATE` status outranks every other.

package/dist/skills/git/references/tracker/jira/manage-debt.md

@@ -31,7 +31,7 @@ Over `32767` characters the rolling item is closed and a successor is created, e
 The tool-call contract governs every write below; this operation names its steps and restates none of its rules.
 
 1. Compose this post's own content into `$DEVFLOW_BODY_RAW` — a fresh `mktemp` per invocation, under D11's removal `trap`. `$DEVFLOW_BODY_RAW` is the scrubber's input and nothing else ever reads it.
-2. Run `node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/redact-secrets.cjs" --emit "$DEVFLOW_BODY_RAW"`.
+2. Run `node "$HOME/.devflow/scripts/redact-secrets.cjs" --emit "$DEVFLOW_BODY_RAW"`.
 3. Require line 1 to be `D11-OK`; verify `<bytes>` against the received body's byte length; echo `SCRUB: N [type:count,…]`; and when N > 0 also emit `SECRET-EXPOSED (rotate {type} credential — the source file still holds it)`.
 4. Post through the *update description* capability with arguments (issue key, description: {SCRUBBED_BODY}).
 5. Over the `32767` cap after redaction, truncate in **preservation order** — the first line, then the status and DEGRADED lines, then the pointer sentence; the untrusted middle is what gets cut — and end with `NOTE: body exceeded the 32767-character cap after redaction — truncated/stub posted`.

package/dist/skills/git/references/tracker/jira/post-wave-report.md

@@ -28,6 +28,6 @@ Load when the resolved tracker provider is `jira` and the operation is `post-wav
 The tool-call contract governs the write; this operation names its steps and restates none of its rules.
 
 1. Compose this post's own content into `$DEVFLOW_BODY_RAW` — a fresh `mktemp` per invocation, under D11's removal `trap`.
-2. Run `node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/redact-secrets.cjs" --emit "$DEVFLOW_BODY_RAW"`.
+2. Run `node "$HOME/.devflow/scripts/redact-secrets.cjs" --emit "$DEVFLOW_BODY_RAW"`.
 3. Require line 1 to be `D11-OK`; verify `<bytes>` against the received body's byte length; echo `SCRUB: N [type:count,…]`; and when N > 0 also emit `SECRET-EXPOSED (rotate {type} credential — the source file still holds it)`.
 4. Post through the *add comment* capability with arguments (issue key, body: {SCRUBBED_BODY}).

package/dist/skills/git/references/tracker/jira/setup-task.md

@@ -7,7 +7,7 @@ Load when the resolved tracker provider is `jira` and the operation is `setup-ta
 ### Setup — session-scoped, resolved once before any step below
 
 - Resolve the capability set and the current-user identity exactly once per spawn, per the tool-call contract. Nothing in this operation probes a second time.
-- **Site.** From `## Project` in the configuration the preamble already read. It must satisfy `^https://[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9-]+)+$` — **no userinfo, no port, no path**. Anything else ⇒ `TRACEABILITY: DEGRADED (unusable site)` and no tracker call.
+- **Site.** The settings line's `SITE`, else `## Project` in the configuration the preamble already read. It must satisfy `^https://[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9-]+)+$` — **no userinfo, no port, no path**. Anything else ⇒ `TRACEABILITY: DEGRADED (unusable site)` and no tracker call.
 - **Project key.** Resolved and shape-gated by the preamble's chain; consumed here, never re-derived.
 - **Issue types.** Read the *project and issue-type metadata* capability HERE, once, and enumerate the types this run may use. Required-field metadata is read at this same point and nowhere else.
 - No usable site or no project key ⇒ `TRACEABILITY: DEGRADED (tracker not configured)`.

package/dist/skills/git/references/tracker/linear/backlink-shipped-issues.md

@@ -48,6 +48,6 @@ For each issue the hoist did not answer, within the operation's `≤50` bound:
 The tool-call contract governs the write; this operation names its steps and restates none of its rules.
 
 1. Compose this post's own content into `$DEVFLOW_BODY_RAW` — a fresh `mktemp` per invocation, under D11's removal `trap`.
-2. Run `node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/redact-secrets.cjs" --emit "$DEVFLOW_BODY_RAW"`.
+2. Run `node "$HOME/.devflow/scripts/redact-secrets.cjs" --emit "$DEVFLOW_BODY_RAW"`.
 3. Require line 1 to be `D11-OK`; verify `<bytes>` against the received body's byte length; echo `SCRUB: N [type:count,…]`; and when N > 0 also emit `SECRET-EXPOSED (rotate {type} credential — the source file still holds it)`.
 4. Post through the *add comment* capability with arguments (issue reference, body: {SCRUBBED_BODY}).

package/dist/skills/git/references/tracker/linear/ensure-traceable-issue.md

@@ -41,7 +41,7 @@ Caller-supplied prose reaches the tracker as a QUERY here and nowhere else in th
 The tool-call contract governs every write below; this operation names its steps and restates none of its rules.
 
 1. Compose this post's own content into `$DEVFLOW_BODY_RAW` — a fresh `mktemp` per invocation, under D11's removal `trap`.
-2. Run `node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/redact-secrets.cjs" --emit "$DEVFLOW_BODY_RAW"`.
+2. Run `node "$HOME/.devflow/scripts/redact-secrets.cjs" --emit "$DEVFLOW_BODY_RAW"`.
 3. Require line 1 to be `D11-OK`; verify `<bytes>` against the received body's byte length; echo `SCRUB: N [type:count,…]`; and when N > 0 also emit `SECRET-EXPOSED (rotate {type} credential — the source file still holds it)`.
 4. Post through the *add comment* capability with arguments (issue reference, body: {SCRUBBED_BODY}), or on a new issue through the *create issue* capability with the description field carrying the same gated value.
 

package/dist/skills/git/references/tracker/linear/gather-release-evidence.md

@@ -6,7 +6,7 @@ Load when the resolved tracker provider is `linear` and the operation is `gather
 
 ### Process
 
-1a. **Last release tag.** Step 1's `git describe` can return a non-release marker tag. From `WORKTREE_PATH` (else cwd), run `node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/release-trace.cjs" last-tag`: `LAST_TAG <tag>` ⇒ that tag is `{last_tag}`; `LAST_TAG none` ⇒ step 1's initial-commit rule; anything else ⇒ keep step 1's tag and report status `INDETERMINATE (last release tag unresolved)`.
+1a. **Last release tag.** Step 1's `git describe` can return a non-release marker tag. From `WORKTREE_PATH` (else cwd), run `node "$HOME/.devflow/scripts/release-trace.cjs" last-tag`: `LAST_TAG <tag>` ⇒ that tag is `{last_tag}`; `LAST_TAG none` ⇒ step 1's initial-commit rule; anything else ⇒ keep step 1's tag and report status `INDETERMINATE (last release tag unresolved)`.
 3a. **Closing-keyword rule.** A candidate follows, on the same line, a whitespace token matching `^\(?(close[sd]?|fix(e[sd])?|resolve[sd]?|refs):?$` (case-insensitive). Take the next token, plus each further token while the previous one ends in `,`. Split each on `,`, strip one leading `(` and every trailing character in `[.,;:)\]!?]`, drop empties, then apply step 5's anchored gate unchanged. Read each message as `git log --format=%B` lines.
 4. Resolve which issues the commit range closes:
    - **There is no closing-reference capability on this provider.** Emit `TRACEABILITY: DEGRADED (unsupported by linear)` once for the whole step and fall back to the commit-message set alone — the references parsed out of the candidate references the agent extracted from the range's commit messages. The magic words this provider recognises in a pull-request body are the SERVER's own behaviour and are not a capability this operation can read back: a body that closed an issue leaves no signal here, which is precisely why this step degrades instead of guessing.
@@ -15,4 +15,4 @@ Load when the resolved tracker provider is `linear` and the operation is `gather
    - Confirm the survivors exist with **one** call to the *batch fetch* capability over the whole set, bounded `≤50` with `TRUNCATED ({n} not processed)` for the remainder — **one query, never a per-item loop**.
    - **Because the closing-reference step degraded, the enrichment is incomplete by construction: never report the status as `COMPLETE`.** Report `PARTIAL ({n} DEGRADED)` whenever any step above degraded, and `TRUNCATED ({n} not processed)` whenever the bound was reached. A release that reads `COMPLETE` over an unresolvable evidence set is the one report nobody re-checks.
    - On a tool error for an individual item → DEGRADED for that item, continue. On backpressure → follow `### Provider signals (Linear)` in this operation's `backlink-shipped-issues` reference, which is where this provider's one signal is stated.
-6. **Per-commit trace map.** `{KEY}` is the resolved team key; with none usable, skip the run and take the arm below. From `WORKTREE_PATH` (else cwd), run `node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/release-trace.cjs" map --from {last_tag} --grammar linear --key {KEY}; echo "exit=$?"`. Accept only `exit=0` after a first line `TRACE from:<ref> scanned:<n> traced:<n> untraced:<n> exempt:<n> unmatched:<n> bound:<ok|hit>`; copy every line above `exit=0` verbatim under `### TRACE_MAP`. Anything else ⇒ `TRACEABILITY: DEGRADED (trace map unavailable)`, `### TRACE_MAP` = `(unavailable)`, status `INDETERMINATE (trace map unavailable)`. `bound:hit` ⇒ status `INDETERMINATE (trace scan bound 500 hit)`. An `INDETERMINATE` status outranks every other.
+6. **Per-commit trace map.** `{KEY}` is the resolved team key; with none usable, skip the run and take the arm below. From `WORKTREE_PATH` (else cwd), run `node "$HOME/.devflow/scripts/release-trace.cjs" map --from {last_tag} --grammar linear --key {KEY}; echo "exit=$?"`. Accept only `exit=0` after a first line `TRACE from:<ref> scanned:<n> traced:<n> untraced:<n> exempt:<n> unmatched:<n> bound:<ok|hit>`; copy every line above `exit=0` verbatim under `### TRACE_MAP`. Anything else ⇒ `TRACEABILITY: DEGRADED (trace map unavailable)`, `### TRACE_MAP` = `(unavailable)`, status `INDETERMINATE (trace map unavailable)`. `bound:hit` ⇒ status `INDETERMINATE (trace scan bound 500 hit)`. An `INDETERMINATE` status outranks every other.

package/dist/skills/git/references/tracker/linear/manage-debt.md

@@ -31,7 +31,7 @@ Over `32767` characters the rolling item is closed and a successor is created, e
 The tool-call contract governs every write below; this operation names its steps and restates none of its rules.
 
 1. Compose this post's own content into `$DEVFLOW_BODY_RAW` — a fresh `mktemp` per invocation, under D11's removal `trap`. `$DEVFLOW_BODY_RAW` is the scrubber's input and nothing else ever reads it.
-2. Run `node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/redact-secrets.cjs" --emit "$DEVFLOW_BODY_RAW"`.
+2. Run `node "$HOME/.devflow/scripts/redact-secrets.cjs" --emit "$DEVFLOW_BODY_RAW"`.
 3. Require line 1 to be `D11-OK`; verify `<bytes>` against the received body's byte length; echo `SCRUB: N [type:count,…]`; and when N > 0 also emit `SECRET-EXPOSED (rotate {type} credential — the source file still holds it)`.
 4. Post through the *update description* capability with arguments (issue reference, description: {SCRUBBED_BODY}).
 5. Over the `32767` cap after redaction, truncate in **preservation order** — the first line, then the status and DEGRADED lines, then the pointer sentence; the untrusted middle is what gets cut — and end with `NOTE: body exceeded the 32767-character cap after redaction — truncated/stub posted`.

package/dist/skills/git/references/tracker/linear/post-wave-report.md

@@ -28,6 +28,6 @@ Load when the resolved tracker provider is `linear` and the operation is `post-w
 The tool-call contract governs the write; this operation names its steps and restates none of its rules.
 
 1. Compose this post's own content into `$DEVFLOW_BODY_RAW` — a fresh `mktemp` per invocation, under D11's removal `trap`.
-2. Run `node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/redact-secrets.cjs" --emit "$DEVFLOW_BODY_RAW"`.
+2. Run `node "$HOME/.devflow/scripts/redact-secrets.cjs" --emit "$DEVFLOW_BODY_RAW"`.
 3. Require line 1 to be `D11-OK`; verify `<bytes>` against the received body's byte length; echo `SCRUB: N [type:count,…]`; and when N > 0 also emit `SECRET-EXPOSED (rotate {type} credential — the source file still holds it)`.
 4. Post through the *add comment* capability with arguments (issue reference, body: {SCRUBBED_BODY}).

package/dist/skills/git/references/tracker/linear/setup-task.md

@@ -7,7 +7,7 @@ Load when the resolved tracker provider is `linear` and the operation is `setup-
 ### Setup — session-scoped, resolved once before any step below
 
 - Resolve the capability set exactly once per spawn, per the tool-call contract. Nothing in this operation probes a second time, or waits on *identify current user* — absent on a stock server here.
-- **Site.** From `## Project` in the configuration the preamble already read. It must satisfy `^https://[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9-]+)+$` — **no userinfo, no port, no path**. Anything else ⇒ `TRACEABILITY: DEGRADED (unusable site)` and no tracker call.
+- **Site.** The settings line's `SITE`, else `## Project` in the configuration the preamble already read. It must satisfy `^https://[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9-]+)+$` — **no userinfo, no port, no path**. Anything else ⇒ `TRACEABILITY: DEGRADED (unusable site)` and no tracker call.
 - **Team key.** Resolved and shape-gated by the preamble's chain; consumed here, never re-derived.
 - **Issue types.** Read the *project and issue-type metadata* capability HERE, once, and enumerate the types this run may use. Required-field metadata is read at this same point and nowhere else.
 - No usable site or no team key ⇒ `TRACEABILITY: DEGRADED (tracker not configured)`.

package/dist/targets/claude-code/claude-paths.js

@@ -1,6 +1,5 @@
 import { homedir, platform } from 'os';
 import * as path from 'path';
-import { getGitRoot } from '../../core/git.js';
 /**
  * Get the OS-specific path for Claude Code managed settings.
  * Managed settings have highest precedence and cannot be overridden by users.
@@ -19,6 +18,22 @@ export function getManagedSettingsPath() {
     }
     throw new Error(`Managed settings not supported on platform: ${os}`);
 }
+/**
+ * The home directory — `HOME`, else the passwd entry `os.homedir()` reports —
+ * or null when neither names one. Never throws: `os.homedir()` itself throws on
+ * a system with no passwd entry for the user.
+ */
+export function readHomeDirectory(env = process.env, osHomedir = homedir) {
+    const fromEnv = env.HOME;
+    if (fromEnv)
+        return fromEnv;
+    try {
+        return osHomedir() || null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Get home directory with proper fallback and validation
  * Priority: process.env.HOME > os.homedir()
@@ -26,81 +41,68 @@ export function getManagedSettingsPath() {
  * @throws {Error} If unable to determine home directory
  */
 export function getHomeDirectory() {
-    const home = process.env.HOME || homedir();
-    if (!home) {
+    const home = readHomeDirectory();
+    if (home === null) {
         throw new Error('Unable to determine home directory. Set HOME environment variable.');
     }
     return home;
 }
 /**
- * Get Claude Code directory with environment variable override support
- * Priority: CLAUDE_CODE_DIR env var > ~/.claude
+ * The Claude Code configuration directory: `CLAUDE_CONFIG_DIR` when it is an
+ * absolute path, else `~/.claude`.
  *
- * @throws {Error} If CLAUDE_CODE_DIR is invalid (not absolute, outside home)
+ * D-CLAUDE-CONFIG-DIR: Claude Code itself relocates its whole configuration tree
+ * (settings.json, agents, skills, rules, history.jsonl) to `CLAUDE_CONFIG_DIR`, so
+ * devflow installs into — and uninstalls from — the directory Claude Code actually
+ * reads, and no other variable names the Claude directory: an install anywhere
+ * else is invisible to the session.
+ * A relative value is ignored rather than resolved against the cwd: an install
+ * target that moves with the working directory is never the one Claude Code loads.
+ * Never throws — the fallback is always a well-formed path.
  */
 export function getClaudeDirectory() {
-    if (process.env.CLAUDE_CODE_DIR) {
-        const customDir = process.env.CLAUDE_CODE_DIR;
-        // Validate path is absolute
-        if (!path.isAbsolute(customDir)) {
-            throw new Error('CLAUDE_CODE_DIR must be an absolute path');
-        }
-        // Warn if outside home directory (security best practice)
-        const home = getHomeDirectory();
-        if (!customDir.startsWith(home)) {
-            console.warn('⚠️  CLAUDE_CODE_DIR is outside home directory. Ensure this is intentional.');
-        }
-        return customDir;
+    const configured = process.env.CLAUDE_CONFIG_DIR;
+    if (configured !== undefined && configured !== '' && path.isAbsolute(configured)) {
+        return configured;
     }
     return path.join(getHomeDirectory(), '.claude');
 }
 /**
- * Get Devflow directory with environment variable override support
- * Priority: DEVFLOW_DIR env var > ~/.devflow
+ * The devflow machine root: always `~/.devflow`.
  *
- * @throws {Error} If DEVFLOW_DIR is invalid (not absolute, outside home)
+ * D-ONE-HOME: there is one machine root and no environment variable relocates it.
+ * The CLI, the HUD, every hook and every prompt resolve `$HOME/.devflow` the same
+ * way, so no value exported in one shell can split an install from the hooks and
+ * prompts that read it. Per-repo data lives under `<repo>/.devflow`, which is
+ * project data, not an install location.
  */
 export function getDevFlowDirectory() {
-    if (process.env.DEVFLOW_DIR) {
-        const customDir = process.env.DEVFLOW_DIR;
-        // Validate path is absolute
-        if (!path.isAbsolute(customDir)) {
-            throw new Error('DEVFLOW_DIR must be an absolute path');
-        }
-        // Warn if outside home directory (security best practice)
-        const home = getHomeDirectory();
-        if (!customDir.startsWith(home)) {
-            console.warn('⚠️  DEVFLOW_DIR is outside home directory. Ensure this is intentional.');
-        }
-        return customDir;
-    }
     return path.join(getHomeDirectory(), '.devflow');
 }
 /**
- * Get installation paths based on scope (async, non-blocking)
- * @param scope - 'user' or 'local'
- * @returns Object with claudeDir and devflowDir
- * @throws {Error} If local scope selected but not in a git repository
+ * The machine-wide install locations.
+ *
+ * D-SCOPE-RETIRED: devflow has exactly one install scope — the user's machine —
+ * because every hook and prompt reads `~/.devflow`. `init --scope local`
+ * refuses and points at `devflow uninstall --scope local`, the one reader of a
+ * repo-local layout (D-LEGACY-LOCAL-CLEANUP in uninstall.ts).
  */
-export async function getInstallationPaths(scope) {
-    if (scope === 'user') {
-        return {
-            claudeDir: getClaudeDirectory(),
-            devflowDir: getDevFlowDirectory(),
-            gitRoot: null,
-        };
-    }
-    else {
-        // Local scope - install to git repository root
-        const gitRoot = await getGitRoot();
-        if (!gitRoot) {
-            throw new Error('Local scope requires a git repository. Run "git init" first or use --scope user');
-        }
-        return {
-            claudeDir: path.join(gitRoot, '.claude'),
-            devflowDir: path.join(gitRoot, '.devflow'),
-            gitRoot,
-        };
+export function getInstallationPaths() {
+    return {
+        claudeDir: getClaudeDirectory(),
+        devflowDir: getDevFlowDirectory(),
+    };
+}
+/**
+ * {@link getInstallationPaths} as a Result: the one way these paths fail is a
+ * process with no home directory, which a command reports and exits on rather
+ * than catching a throw.
+ */
+export function resolveInstallationPaths() {
+    const homeDir = readHomeDirectory();
+    if (homeDir === null) {
+        return { ok: false, error: 'Unable to determine home directory. Set HOME environment variable.' };
     }
+    return { ok: true, value: { homeDir, ...getInstallationPaths() } };
 }
 //# sourceMappingURL=claude-paths.js.map