honestweek 0.2.0 → 0.3.0

package/lib/history.mjs

@@ -14,12 +14,12 @@
 import { join } from 'node:path';
 
 import { loadConfig } from './config.mjs';
+import { commandConfig } from './config-lookup.mjs';
 import { landedCommitsInWindow } from './git.mjs';
 import { createRedactor } from './redact.mjs';
 import { ensureGitignore } from './init.mjs';
 import { atomicWriteText } from './atomic-json.mjs';
 
-const CONFIG_FILE = 'honestweek.config.json';
 export const HISTORY_FILE = 'honestweek.history.json';
 export const HISTORY_GITIGNORE = [HISTORY_FILE];
 
@@ -84,9 +84,17 @@ export async function runHistory({ cwd = process.cwd(), argv = [], io = defaultI
     io.err('history: needs --from YYYY-MM-DD and --to YYYY-MM-DD, with --from on or before --to.\n');
     return io.exit(1) ?? 1;
   }
+  // The config can sit elsewhere (--config, HONESTWEEK_CONFIG, the user-level file); history's
+  // files then sit beside it, never in an unrelated folder this ran in.
+  const opened = commandConfig({ command: 'history', cwd, argv, err: io.err });
+  if (opened.error) {
+    io.err(`history: ${opened.error}\n`);
+    return io.exit(1) ?? 1;
+  }
+  ({ cwd, argv } = opened);
   let config;
   try {
-    config = loadConfig(join(cwd, CONFIG_FILE));
+    config = loadConfig(opened.found.path);
   } catch (err) {
     io.err(`history: ${err.message}\n`);
     return io.exit(1) ?? 1;

package/lib/init.mjs

@@ -8,25 +8,28 @@
 //
 // Zero runtime dependencies: Node built-ins + the system `git` CLI only.
 
-import { existsSync, readFileSync, writeFileSync, readdirSync } from 'node:fs';
+import { existsSync, lstatSync, mkdirSync, readFileSync, statSync, writeFileSync, readdirSync } from 'node:fs';
 import { createInterface } from 'node:readline';
 import { homedir } from 'node:os';
 import { basename, dirname, join, resolve } from 'node:path';
 
-import { hostTimezone, DEFAULT_OUTPUT_FILES, ROLES, resolveRepoPath } from './config.mjs';
+import { hostTimezone, isEmailShaped, DEFAULT_OUTPUT_FILES, ROLES, resolveRepoPath } from './config.mjs';
 import { PROMPT_GITIGNORE } from './prompt-store.mjs';
 import { DIGEST_GITIGNORE } from './digest-store.mjs';
 import { CARRY_GITIGNORE } from './digest-carry.mjs';
 import { MINE_GITIGNORE } from './mine/ledger.mjs';
 import { HISTORY_GITIGNORE } from './history.mjs';
+import { HARVEST_GITIGNORE } from './harvest.mjs';
+import { SAVED_GITIGNORE } from './saved/store.mjs';
 import { atomicWriteText } from './atomic-json.mjs';
 import { currentCommand } from './invocation.mjs';
-import { privateWordCount, privateWordsNote } from './private-words.mjs';
+import { findConfig, lookupUserConfig, takeConfigFlag, userConfigPath } from './config-lookup.mjs';
+import { isUsedWord, neverPublicWordCount, privateWordCount, privateWordsNote } from './private-words.mjs';
 import { resolveCommonDir } from './worktrees.mjs';
 import { gitExec } from './git.mjs';
-import { checkDisplayOverlap, checkNestedRoles, displayTest, folderKey, repoIdentity, repoKey } from './repo-identity.mjs';
+import { checkDisplayOverlap, checkNestedRoles, checkoutOf, displayTest, folderKey, nestsDisplay, reachesDisplay, repoIdentity, repoKey } from './repo-identity.mjs';
 
-export { checkDisplayOverlap, checkNestedRoles, displayTest, repoIdentity };
+export { checkDisplayOverlap, checkNestedRoles, checkoutOf, displayTest, nestsDisplay, reachesDisplay, repoIdentity };
 
 const CONFIG_FILE = 'honestweek.config.json';
 const EXAMPLE_FILE = 'honestweek.config.example.json';
@@ -34,6 +37,8 @@ const GITIGNORE_FILE = '.gitignore';
 // The line writeInitFiles reports when it adds the config itself to .gitignore.
 const CONFIG_IGNORE_LINE = `${GITIGNORE_FILE} (+${CONFIG_FILE})`;
 const DRAFT_SIDECAR = 'honestweek.draft.json';
+// Run with Codex's folder (JUDGE_DIR in lib/view/codex-judge.mjs, which imports this module).
+const CODEX_JUDGMENTS_GITIGNORE = Object.freeze(['honestweek.codex-judgments/']);
 
 // The clean-room template init writes when no example exists: empty term-lists,
 // placeholder-only values, NO real paths/names/repos/emails.
@@ -116,12 +121,16 @@ function mainWorkTree(dir) {
  * "reference". Each read repository carries `lastAt`, when its newest local commit was made
  * (ms, or null), and the list is ordered: cwd's repository first, then the most recently
  * committed, then those git gave no time for, in folder order. A display-only repository is
- * never asked (AGENTS.md invariant 4), so it has no `lastAt` and sorts with those.
+ * never asked (AGENTS.md invariant 4), so it has no `lastAt` and sorts with those. Nor is a
+ * repository that holds a display-only folder, sits inside one, or has a worktree inside one,
+ * since git reading it would read that folder's history too: it keeps its default role with
+ * no `lastAt`, and init's nested-role refusal (checkNestedRoles) explains the conflict.
  */
 export function findRepos(cwd, authorEmail, { displayPaths = [], hasCommits = authorHasCommits, lastCommitAt = repoLastCommitAt } = {}) {
   // A repo an existing config marks display-only keeps that role and is never
   // passed to git (AGENTS.md invariant 4).
   const isDisplay = displayTest(displayPaths);
+  const nested = nestsDisplay(displayPaths);
   const cwdAbs = resolve(cwd);
   const parent = dirname(cwdAbs);
   const candidates = [cwdAbs];
@@ -159,8 +168,9 @@ export function findRepos(cwd, authorEmail, { displayPaths = [], hasCommits = au
       for (const f of entry.folders) found_.push({ key, repo: { path: f, label: basename(f), role: 'display' } });
       continue;
     }
-    const role = key === cwdKey || hasCommits(entry.path, authorEmail) ? 'featured' : 'reference';
-    const lastAt = lastCommitAt(entry.path);
+    const asked = !nested(entry.path) && !entry.folders.some(nested);
+    const role = key === cwdKey || (asked && hasCommits(entry.path, authorEmail)) ? 'featured' : 'reference';
+    const lastAt = asked ? lastCommitAt(entry.path) : null;
     found_.push({ key, repo: { path: entry.path, label: entry.label, role, lastAt: Number.isFinite(lastAt) ? lastAt : null } });
   }
   // cwd's repository first, then the most recently committed, then the rest in stable
@@ -176,41 +186,93 @@ export function discoverRepos(cwd, authorEmail, opts = {}) {
   return findRepos(cwd, authorEmail, opts).repos;
 }
 
+/** What rewriting the config in `cwd` keeps from the one there: its display-only entries, as
+ *  written, and its private words (the redaction lists and neverPublicTerms, leaving out blank
+ *  entries as the redactor does, and repeats). A rewrite that dropped them would let git read a folder the
+ *  person marked display-only, or stop hiding words they listed. An absent config keeps
+ *  nothing; one that's there but can't be read keeps nothing, and `unreadable` says why ("not
+ *  valid JSON", "not a config object", a plain reason for a file it can't open, or the error
+ *  code), else it's false. Read-only. */
+export function keptFromOldConfig(cwd, file = join(cwd, CONFIG_FILE)) {
+  const none = (why) => ({ display: [], names: [], terms: [], codenames: [], neverPublicTerms: [], unreadable: why });
+  try {
+    const config = JSON.parse(readFileSync(file, 'utf8'));
+    // JSON that isn't a config can't say which folders are display-only either.
+    if (!config || typeof config !== 'object' || Array.isArray(config)) return none('not a config object');
+    if (config.repos !== undefined && !Array.isArray(config.repos)) return none('its repos is not a list');
+    const words = (list) => (Array.isArray(list) ? [...new Set(list.filter(isUsedWord))] : []);
+    const display = (Array.isArray(config?.repos) ? config.repos : [])
+      .filter((r) => r?.role === 'display' && typeof r.path === 'string')
+      .map((r) => ({ path: r.path, label: typeof r.label === 'string' && r.label ? r.label : basename(r.path), role: 'display' }));
+    const r = config?.redaction;
+    return { display, names: words(r?.names), terms: words(r?.terms), codenames: words(r?.codenames), neverPublicTerms: words(config?.privacy?.publicRenditions?.neverPublicTerms), unreadable: false };
+  } catch (err) {
+    // A link to a missing file is still there: lstat sees it where existsSync follows it.
+    let there = true;
+    try {
+      lstatSync(file);
+    } catch {
+      there = false;
+    }
+    return none(!there ? false : err instanceof SyntaxError ? 'not valid JSON' : (UNREADABLE_WHY[err?.code] ?? String(err?.code ?? 'unreadable')));
+  }
+}
+
+/** Plain words for why a config that's there can't be read. */
+const UNREADABLE_WHY = { EACCES: 'permission denied', EPERM: 'permission denied', EISDIR: "it's a folder", ENOENT: 'it links to a file that is missing', ELOOP: 'it links in a loop' };
+
 /** Paths an existing config in `cwd` marks display-only, resolved against `cwd`.
  *  An absent or unreadable config marks none. Read-only. */
 export function existingDisplayRepos(cwd) {
-  try {
-    const config = JSON.parse(readFileSync(join(cwd, CONFIG_FILE), 'utf8'));
-    return (Array.isArray(config?.repos) ? config.repos : []).filter((r) => r?.role === 'display' && typeof r.path === 'string').map((r) => resolveRepoPath(r.path, cwd));
-  } catch {
-    return [];
-  }
+  return keptFromOldConfig(cwd).display.map((d) => resolveRepoPath(d.path, cwd));
+}
+
+/** The config every command run in `cwd` reads when the lookup found it outside `cwd`
+ *  (HONESTWEEK_CONFIG or the user-level file): its path, the folders it marks display-only
+ *  (resolved against its own folder), and why it can't be read, if it can't. null when the
+ *  lookup is off, or this folder has its own config, or there's none elsewhere. Read-only. */
+export function lookedUpConfig(cwd) {
+  const found = findConfig({ cwd });
+  if (found.source !== 'env' && found.source !== 'user') return null;
+  const dir = dirname(found.path);
+  const kept = keptFromOldConfig(dir, found.path);
+  return { path: found.path, unreadable: kept.unreadable, display: kept.display.map((d) => resolveRepoPath(d.path, dir)) };
 }
 
 /** Assemble the config object from the inferred pieces and the private words given. The
  *  setup page may give several `authorEmails`, a `goalsFile` and a `history`; init gives none. */
-export function buildConfig({ authorEmail, authorEmails, repos, timezone, names = [], terms = [], goalsFile, history }) {
+export function buildConfig({ authorEmail, authorEmails, repos, timezone, names = [], terms = [], codenames = [], neverPublicTerms = [], goalsFile, history }) {
   return {
     identity: { authorEmails: authorEmails ? [...authorEmails] : authorEmail ? [authorEmail] : [] },
     week: { startsOn: 'monday', timezone: timezone || 'UTC' },
     repos: repos.map((r) => ({ path: r.path, label: r.label, role: r.role })),
-    redaction: { codenames: [], names: [...names], terms: [...terms] },
+    redaction: { codenames: [...codenames], names: [...names], terms: [...terms] },
     curation: { maxItems: 12, automaticMinScore: 2, retentionWeeks: 12, automaticCarryWeeks: 2, categoryCaps: { prompts: 2, ideas: 2, techniques: 3, decisions: 2, reversals: 1, nextSteps: 2 } },
-    privacy: { publicRenditions: { enabled: true, maxAutomaticChangedPercent: 20, generalizationMappings: {}, neverPublicTerms: [] } },
+    privacy: { publicRenditions: { enabled: true, maxAutomaticChangedPercent: 20, generalizationMappings: {}, neverPublicTerms: [...neverPublicTerms] } },
     output: { mode: 'digest', file: DEFAULT_OUTPUT_FILES.digest },
     ...(goalsFile ? { goalsFile } : {}),
     ...(history ? { history } : {}),
   };
 }
 
+const hasLine = (text, entry) => text.split(/\r?\n/).some((l) => l.trim() === entry);
+
+/** Whether `.gitignore` in `cwd` already has `entry` as a line, so ensureGitignore would add nothing. */
+export function gitignoreHas(cwd, entry) {
+  try {
+    return hasLine(readFileSync(join(cwd, GITIGNORE_FILE), 'utf8'), entry);
+  } catch {
+    return false;
+  }
+}
+
 /** Append `entry` to `.gitignore` idempotently (create if absent). Returns true
  *  if a line was added. A new .gitignore gets the system's normal mode, not the owner-only
  *  one private stores get: it's a file the user commits, and it holds no private words. */
 export function ensureGitignore(cwd, entry, fs) {
   const file = join(cwd, GITIGNORE_FILE);
   const existing = existsSync(file) ? readFileSync(file, 'utf8') : '';
-  const present = existing.split(/\r?\n/).some((l) => l.trim() === entry);
-  if (present) return false;
+  if (hasLine(existing, entry)) return false;
   const prefix = existing.length === 0 || existing.endsWith('\n') ? existing : `${existing}\n`;
   atomicWriteText(file, `${prefix}${entry}\n`, fs, { newMode: null });
   return true;
@@ -219,12 +281,12 @@ export function ensureGitignore(cwd, entry, fs) {
 /**
  * writeInitFiles(cwd, config, { force }) -> { wrote, skipped }
  * Writes honestweek.config.json (overwriting only when force), the generic
- * example if absent, and the .gitignore entries: the draft and the other private files, and
- * the config itself when it lists private words. The ONLY disk writes. With `onlyNew` (the
+ * example if absent, and the .gitignore entries: the config itself, which always holds my email
+ * and folder paths, the draft and every other private file honestweek makes. The ONLY disk writes. With `onlyNew` (the
  * setup page), a config already there, even one that appears while this runs, means nothing
- * at all is written.
+ * at all is written. `example: false` leaves the example out (the user-level folder).
  */
-export function writeInitFiles(cwd, config, { force = false, onlyNew = false } = {}) {
+export function writeInitFiles(cwd, config, { force = false, onlyNew = false, example = true } = {}) {
   const wrote = [];
   const skipped = [];
   const configPath = join(cwd, CONFIG_FILE);
@@ -247,18 +309,21 @@ export function writeInitFiles(cwd, config, { force = false, onlyNew = false } =
   }
 
   const examplePath = join(cwd, EXAMPLE_FILE);
-  if (existsSync(examplePath)) {
+  if (!example) {
+    // The user-level folder holds no project, so it gets no example to commit.
+  } else if (existsSync(examplePath)) {
     skipped.push(`${EXAMPLE_FILE} (already exists)`);
   } else {
     writeFileSync(examplePath, `${JSON.stringify(EXAMPLE_CONFIG, null, 2)}\n`);
     wrote.push(EXAMPLE_FILE);
   }
 
-  // A config that lists private words holds those words as written, so it stays out of git.
-  if (privateWordCount(config) > 0 && ensureGitignore(cwd, CONFIG_FILE)) wrote.push(CONFIG_IGNORE_LINE);
+  // Every config holds an email and folder paths, and private words added later are written as
+  // typed, so it stays out of git from the start: ignoring it only once it's committed is too late.
+  if (ensureGitignore(cwd, CONFIG_FILE)) wrote.push(CONFIG_IGNORE_LINE);
   if (ensureGitignore(cwd, DRAFT_SIDECAR)) wrote.push(`${GITIGNORE_FILE} (+${DRAFT_SIDECAR})`);
   else skipped.push(`${GITIGNORE_FILE} (${DRAFT_SIDECAR} already ignored)`);
-  for (const entry of [...PROMPT_GITIGNORE, ...DIGEST_GITIGNORE, ...CARRY_GITIGNORE, ...MINE_GITIGNORE, ...HISTORY_GITIGNORE]) {
+  for (const entry of [...PROMPT_GITIGNORE, ...DIGEST_GITIGNORE, ...CARRY_GITIGNORE, ...MINE_GITIGNORE, ...HISTORY_GITIGNORE, ...HARVEST_GITIGNORE, ...CODEX_JUDGMENTS_GITIGNORE, ...SAVED_GITIGNORE]) {
     if (ensureGitignore(cwd, entry)) wrote.push(`${GITIGNORE_FILE} (+${entry})`);
     else skipped.push(`${GITIGNORE_FILE} (${entry} already ignored)`);
   }
@@ -267,20 +332,54 @@ export function writeInitFiles(cwd, config, { force = false, onlyNew = false } =
 }
 
 function parseFlags(argv) {
-  const flags = { yes: false, force: false };
-  for (const a of argv ?? []) {
+  const taken = takeConfigFlag(argv ?? []);
+  const flags = { yes: false, force: false, user: false, config: taken.config, error: taken.error };
+  for (const a of taken.argv) {
     if (a === '--yes' || a === '-y') flags.yes = true;
     else if (a === '--force') flags.force = true;
+    else if (a === '--user') flags.user = true;
   }
+  if (!flags.error && flags.user && flags.config !== undefined) flags.error = '--user and --config both say where to write; give one.';
   return flags;
 }
 
+/** Where init writes: this folder, the user-level folder (--user), or the file --config names,
+ *  which must be called honestweek.config.json so every command and Settings can find it. */
+function initTarget(cwd, flags) {
+  if (flags.user) return { dir: dirname(lookupUserConfig() ?? userConfigPath()), make: true };
+  if (flags.config === undefined) return { dir: cwd, make: false };
+  const file = resolve(cwd, flags.config);
+  if (basename(file) !== CONFIG_FILE) return { error: `--config for init must name a file called ${CONFIG_FILE}.` };
+  let isFolder = false;
+  try {
+    isFolder = statSync(dirname(file)).isDirectory();
+  } catch {
+    isFolder = false;
+  }
+  if (!isFolder) return { error: `there's no folder at ${dirname(file)} to write ${CONFIG_FILE} in.` };
+  return { dir: resolve(dirname(file)) === resolve(cwd) ? cwd : dirname(file), make: false };
+}
+
 const isYes = (s, dflt) => {
   const t = String(s ?? '').trim().toLowerCase();
   if (t === '') return dflt;
   return t === 'y' || t === 'yes';
 };
 
+/** The question init asks when git doesn't know the person's email, as Setup does. */
+export const EMAIL_QUESTION = "git doesn't know your email. Type the one your commits use, or press Enter to skip: ";
+
+/** Ask for the email commits use; Enter skips. Three tries at most, so a script can't loop. */
+async function askEmail(io) {
+  for (let tries = 0; tries < 3; tries++) {
+    const answer = String((await io.prompt(EMAIL_QUESTION)) ?? '').trim();
+    if (!answer) return null;
+    if (isEmailShaped(answer)) return answer;
+    io.err(`  (that isn't an email address; type one like you@example.com, or press Enter to skip)\n`);
+  }
+  return null;
+}
+
 /** Marker for "stdin ended before a confirmation could be answered". */
 const STDIN_EOF = 'HONESTWEEK_STDIN_EOF';
 
@@ -414,9 +513,12 @@ export const TERMS_QUESTION = 'Client, company or project words to hide, separat
 
 /** Ask for the names and client words to keep private. Either can be skipped. Each answer is
  *  read back as it will be stored, on the person's own terminal, so a misread shows before
- *  anything is written. */
-async function askPrivateWords(io) {
+ *  anything is written. Words the old config already lists stay, and only their count is
+ *  printed; the answers add to them. */
+async function askPrivateWords(io, kept) {
   io.out(`\n${PRIVATE_WORDS_INTRO}\n`);
+  const keptCount = keptWordCount(kept);
+  if (keptCount) io.out(`  Your old config already lists ${count(keptCount, 'private word')}. They stay; add any others below.\n`);
   const ask = async (question) => {
     const answer = await io.prompt(question);
     const words = parseWordList(answer);
@@ -424,23 +526,30 @@ async function askPrivateWords(io) {
     else if (answer.trim()) io.out('  Nothing to hide there: each entry needs at least two characters.\n');
     return words;
   };
-  const names = await ask(NAMES_QUESTION);
-  const terms = await ask(TERMS_QUESTION);
-  return { names, terms };
+  const both = (old, added) => [...new Set([...old, ...added])];
+  const names = both(kept.names, await ask(NAMES_QUESTION));
+  const terms = both(kept.terms, await ask(TERMS_QUESTION));
+  return { names, terms, codenames: [...kept.codenames], neverPublicTerms: [...kept.neverPublicTerms] };
 }
 
+const keptWordCount = (kept) => kept.names.length + kept.terms.length + kept.codenames.length + kept.neverPublicTerms.length;
+
+/** The private words a config init writes lists, counted as keptWordCount counts them: the
+ *  redaction lists and neverPublicTerms, so what init prints about them agrees. */
+const configWordCount = (config) => privateWordCount(config) + neverPublicWordCount(config);
+
 const count = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
 
 /** What the config will say, in a few lines, instead of the whole file. */
 function summarize(config) {
   const roles = ROLES.map((role) => [role, config.repos.filter((r) => r.role === role).length]).filter(([, n]) => n > 0);
-  const { names, terms, codenames } = config.redaction;
-  const words = names.length + terms.length + codenames.length;
+  const { names } = config.redaction;
+  const words = configWordCount(config);
   return [
     `  You: ${config.identity.authorEmails.join(', ') || 'no email found (fill in identity.authorEmails before build)'}. A commit counts as yours only when ${config.identity.authorEmails.length > 1 ? 'one of these addresses' : 'this address'} wrote it.`,
     `  Weeks: start on Monday, in ${config.week.timezone}.`,
     `  Repositories: ${config.repos.length} (${roles.map(([role, n]) => `${n} ${role}`).join(', ')}).`,
-    `  Private words: ${words ? `${count(names.length, 'name')}, ${count(terms.length + codenames.length, 'client or project word')}` : 'none'}.`,
+    `  Private words: ${words ? `${count(names.length, 'name')}, ${count(words - names.length, 'client or project word')}` : 'none'}.`,
     `  Weekly summary: a private digest written to ${config.output.file}.`,
   ].join('\n');
 }
@@ -455,10 +564,12 @@ function reportWrite(io, result, config) {
   const had = result.skipped.filter(isIgnoreLine).length;
   if (had) io.out(`  skipped ${GITIGNORE_FILE} (${count(had, 'entry was', 'entries were')} already there)\n`);
   if (result.wrote.includes(CONFIG_IGNORE_LINE)) {
-    io.out(`  ${CONFIG_FILE} lists your private words, so it's now in ${GITIGNORE_FILE}. That keeps git from picking up a new file, not one it already tracks: if you've committed it before, git rm --cached ${CONFIG_FILE} stops that.\n`);
+    io.out(`  ${CONFIG_FILE} holds your email, folder paths and any private words, so it's now in ${GITIGNORE_FILE}. If you committed it before, listing it there doesn't remove it from git: run git rm --cached ${CONFIG_FILE}.\n`);
   }
   const cmd = currentCommand();
-  if (config && privateWordCount(config) === 0) io.out(`\n${privateWordsNote(cmd, { restart: false })}\n`);
+  // Only the redaction lists hide a word in the person's own pages, so the note's gate is
+  // privateWordCount; words kept out of public versions only are named in it, not counted as hiding.
+  if (config && privateWordCount(config) === 0) io.out(`\n${privateWordsNote(cmd, { restart: false, publicOnly: neverPublicWordCount(config) })}\n`);
   io.out(`\nNext, find, check and replay your sessions in your browser:\n  ${cmd} view\nFor a weekly summary of last week, start with:\n  ${cmd} discover\n`);
 }
 
@@ -473,18 +584,51 @@ export function foundLine(repos, folded) {
 
 /** The display-only folders an existing config lists, and the email inferred from git. No
  *  folder of a display-only repository (its main checkout, a worktree, or a plain subfolder
- *  of either) is passed to git, so the email there comes from the global git config. */
-export function inferIdentity(cwd, { inferEmail = inferAuthorEmail } = {}) {
-  const displayPaths = existingDisplayRepos(cwd);
+ *  of either) is passed to git, nor one that holds a display-only folder, sits inside one, or
+ *  sits in a checkout that holds one (nestsDisplay), so the email there comes from the global
+ *  git config. */
+export function inferIdentity(cwd, { inferEmail = inferAuthorEmail, configDir = cwd } = {}) {
+  // Writing a config elsewhere (init --user, --config) still never runs git on a folder any
+  // config marks display-only: the one here, the one being rewritten, or the one every other
+  // command run here reads (HONESTWEEK_CONFIG, the user-level file).
+  const displayPaths = [...new Set([...existingDisplayRepos(cwd), ...(resolve(configDir) === resolve(cwd) ? [] : existingDisplayRepos(configDir)), ...(lookedUpConfig(cwd)?.display ?? [])])];
   const isDisplay = displayTest(displayPaths);
-  return { displayPaths, authorEmail: inferEmail(cwd, { isDisplay: isDisplay(cwd, { walk: true }) }) };
+  return { displayPaths, authorEmail: inferEmail(cwd, { isDisplay: isDisplay(cwd, { walk: true }) || nestsDisplay(displayPaths)(cwd) }) };
 }
 
 /** Core init flow with injectable cwd/argv/io (for testability). */
 export async function runInit({ cwd = process.cwd(), argv = [], io = defaultIo(), inferEmail = inferAuthorEmail } = {}) {
   const flags = parseFlags(argv);
-  io.out(`honestweek init: set up ${CONFIG_FILE} in ${resolve(cwd)}.${flags.yes ? '' : ' Nothing is written until you say yes.'}\n`);
-  const { displayPaths, authorEmail } = inferIdentity(cwd, { inferEmail });
+  const target = flags.error ? { error: flags.error } : initTarget(cwd, flags);
+  if (target.error) {
+    io.err(`honestweek init: ${target.error} Nothing was written.\n`);
+    return 1;
+  }
+  // The config goes in `dir`: this folder, unless --user or --config said otherwise. The
+  // repositories are still looked for here and in the folders next to it.
+  const dir = target.dir;
+  io.out(`honestweek init: set up ${CONFIG_FILE} in ${resolve(dir)}.${flags.yes ? '' : ' Nothing is written until you say yes.'}\n`);
+  // A config that's there but can't be read can't say which folders are display-only, so init
+  // stops before it runs git anywhere (AGENTS.md invariant 4; issue 171).
+  const kept = keptFromOldConfig(dir);
+  if (kept.unreadable) {
+    io.err(`${CONFIG_FILE} is here but can't be read (${kept.unreadable}), so init can't tell which folders you marked display-only, and it runs git nowhere until it can. Fix the file, or move it away to start fresh, then run init again. Nothing was written.\n`);
+    return 1;
+  }
+  // Writing elsewhere, the config in this folder still marks folders display-only, and so does
+  // the one the other commands read from this folder (HONESTWEEK_CONFIG, the user-level file).
+  const here = resolve(dir) === resolve(cwd) ? null : keptFromOldConfig(cwd);
+  const around = lookedUpConfig(cwd);
+  const blocked = here?.unreadable ? { path: join(resolve(cwd), CONFIG_FILE), why: here.unreadable } : around?.unreadable ? { path: around.path, why: around.unreadable } : null;
+  if (blocked) {
+    io.err(`${blocked.path} can't be read (${blocked.why}), so init can't tell which folders you marked display-only, and it runs git nowhere until it can. Fix the file, or move it away, then run init again. Nothing was written.\n`);
+    return 1;
+  }
+  const identity = inferIdentity(cwd, { inferEmail, configDir: dir });
+  const { displayPaths } = identity;
+  // Asked in a terminal, a missing email is a question rather than a warning: build's authorship
+  // check needs it (issue 163). With --yes there's nobody to ask.
+  const authorEmail = identity.authorEmail ?? (flags.yes ? null : await askEmail(io));
   if (!authorEmail) {
     io.err(
       'Warning: could not infer your git user.email. identity.authorEmails will be empty. Fill it in before running build, or the authorship check cannot pass.\n'
@@ -494,10 +638,26 @@ export async function runInit({ cwd = process.cwd(), argv = [], io = defaultIo()
   const { repos, folded } = findRepos(cwd, authorEmail, { displayPaths });
   if (repos.length) io.out(`${foundLine(repos, folded)}\n`);
   const timezone = hostTimezone();
-  const configExists = existsSync(join(cwd, CONFIG_FILE));
+  const configExists = existsSync(join(dir, CONFIG_FILE));
+  // A rewrite keeps the old config's private words, and its display-only folders the list
+  // doesn't show: the person never saw those, so never chose to drop them. The list names each
+  // folder of a display-only repository separately (findRepos), so they're matched by folder,
+  // not by repository. Only counts are printed, since a label can be a client's name, and a
+  // kept folder joins the nested check by its path alone, so a refusal names it by its folder.
+  const shown = new Set(repos.map((r) => folderKey(r.path)));
+  const unseen = kept.display.filter((d) => !shown.has(folderKey(resolveRepoPath(d.path, dir))));
+  const keptWords = keptWordCount(kept);
+  const sayKeptFolders = () => {
+    if (unseen.length) io.out(`Keeping ${count(unseen.length, 'display-only folder')} from your old config that this search didn't list.\n`);
+  };
+  const forCheck = (list) => [...list.map((r) => ({ ...r, path: resolveRepoPath(r.path, cwd) })), ...unseen.map((d) => ({ path: resolveRepoPath(d.path, dir), role: 'display' }))];
   // A config with no repositories is one view and discover refuse, so none is written.
   // Nor is one where git would read a display-only repository (checkDisplayOverlap): the same
-  // repository as display and read, or one inside the other.
+  // repository as display and read, or one inside the other. The display-only folders the old
+  // config lists join the nested check, so a repository holding one, or whose folder is inside
+  // one, or has a worktree inside one, is refused rather than written as one git reads.
+  const listedDisplay = displayPaths.map((p) => ({ path: p, role: 'display' }));
+  const overlap = (list) => checkDisplayOverlap(list) ?? checkNestedRoles([...list, ...listedDisplay]);
   const refuseNested = (line) => {
     io.err(`${line} Nothing was written.
 `);
@@ -515,10 +675,13 @@ export async function runInit({ cwd = process.cwd(), argv = [], io = defaultIo()
       return 0;
     }
     if (!repos.length) return noRepos();
-    const nested = checkDisplayOverlap(repos);
+    const list = [...repos, ...unseen];
+    const nested = overlap(forCheck(repos));
     if (nested) return refuseNested(nested);
-    const config = buildConfig({ authorEmail, repos, timezone });
-    reportWrite(io, writeInitFiles(cwd, config, { force: true }), config);
+    sayKeptFolders();
+    if (keptWords) io.out(`Keeping the ${count(keptWords, 'private word')} your old config lists.\n`);
+    const config = buildConfig({ authorEmail, repos: list, timezone, names: kept.names, terms: kept.terms, codenames: kept.codenames, neverPublicTerms: kept.neverPublicTerms });
+    reportWrite(io, writeTo(dir, config, target), config);
     return 0;
   }
 
@@ -529,18 +692,34 @@ export async function runInit({ cwd = process.cwd(), argv = [], io = defaultIo()
 
   // First confirmation: the repositories (after any edits).
   const finalRepos = await editAllowlist(io, repos);
-  const nested = checkDisplayOverlap(finalRepos.map((r) => ({ ...r, path: resolveRepoPath(r.path, cwd) })));
-  if (nested) return refuseNested(nested);
+  const finalList = [...finalRepos, ...unseen];
+  // A repository that holds a display-only folder, or sits inside one, can be marked
+  // display-only too, so init offers that rather than stopping (issue 163). The folder init runs
+  // in defaults to no, since marking it means git reads none of it. The reason shown is the
+  // culprit's own, so the question never names a different repository than the line above it.
+  for (let nested = overlap(forCheck(finalRepos)); nested; nested = overlap(forCheck(finalRepos))) {
+    const display = [...forCheck(finalRepos).filter((x) => x.role === 'display'), ...listedDisplay];
+    const reasonFor = (r) => (r.role === 'display' ? null : checkNestedRoles([{ ...r, path: resolveRepoPath(r.path, cwd) }, ...display]));
+    const culprit = finalRepos.find((r) => reasonFor(r) !== null);
+    if (!culprit) return refuseNested(nested);
+    const reason = reasonFor(culprit);
+    const here = repoIdentity(resolveRepoPath(culprit.path, cwd)) === repoIdentity(resolve(cwd));
+    const answer = await io.prompt(`\n${reason}\nMark ${culprit.label} display-only too? [${here ? 'y/N' : 'Y/n'}] `);
+    if (!isYes(answer, !here)) return refuseNested(reason);
+    culprit.role = 'display';
+    io.out(`  ${culprit.label} is display-only now, so git won't read it.\n`);
+  }
+  sayKeptFolders();
   const ok1 = await io.prompt(`\nUse ${finalRepos.length === 1 ? 'this repository' : `these ${finalRepos.length} repositories`}? [Y/n] `);
   if (!isYes(ok1, true)) {
     io.out('Aborted; nothing was written.\n');
     return 1;
   }
 
-  const { names, terms } = await askPrivateWords(io);
+  const { names, terms, codenames, neverPublicTerms } = await askPrivateWords(io, kept);
 
   // Second confirmation: what the config will say, before writing.
-  const config = buildConfig({ authorEmail, repos: finalRepos, timezone, names, terms });
+  const config = buildConfig({ authorEmail, repos: finalList, timezone, names, terms, codenames, neverPublicTerms });
   io.out(`\n${CONFIG_FILE} will say:\n${summarize(config)}\nIt's a plain JSON file, so you can open it and change any of this later.\n`);
   const writeDefault = !configExists; // default-yes for fresh setup, default-no to overwrite
   const ok2 = await io.prompt(`\nWrite ${CONFIG_FILE} now? [${writeDefault ? 'Y/n' : 'y/N'}] `);
@@ -549,10 +728,17 @@ export async function runInit({ cwd = process.cwd(), argv = [], io = defaultIo()
     return 1;
   }
 
-  reportWrite(io, writeInitFiles(cwd, config, { force: true }), config);
+  reportWrite(io, writeTo(dir, config, target), config);
   return 0;
 }
 
+/** writeInitFiles in init's target folder, made first when it's the user-level one, which gets
+ *  no example file: it holds no project to commit one in. */
+function writeTo(dir, config, target) {
+  if (target.make) mkdirSync(dir, { recursive: true, mode: 0o700 });
+  return writeInitFiles(dir, config, { force: true, example: !target.make });
+}
+
 export default async function run(argv) {
   // A stdin that ends before the questions are answered lands here. Left
   // unhandled that was a silent exit 0 with nothing written, which reads as

package/lib/mine.mjs

@@ -20,21 +20,23 @@
 //
 // Zero runtime dependencies: Node built-ins only.
 
-import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { mkdirSync, writeFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 
 import { loadConfig } from './config.mjs';
+import { findConfig, noteConfig } from './config-lookup.mjs';
 import { createRedactor } from './redact.mjs';
 import { CORPUS_KINDS, enumerateSessions } from './mine/corpus.mjs';
 import { detectSession } from './mine/detect.mjs';
 import { rankFindings, publishable, PUBLISHABLE_THRESHOLD } from './mine/rank.mjs';
 import { renderDraft } from './mine/draft.mjs';
 import { ALL_STATUSES, backlog, errorSignal, loadLedger, mergeFindings, nextToDraft, recordRun, saveLedger, setStatus } from './mine/ledger.mjs';
+import { currentCommand } from './invocation.mjs';
 
 const USAGE = `honestweek mine: find solved third-party problems in your session logs.
 
 Usage:
-  honestweek mine [options]
+  ${currentCommand()} mine [options]
 
 What it does:
   Reads your agent session logs, finds sessions where software you did NOT write
@@ -42,8 +44,11 @@ What it does:
   ledger. With --draft it also writes the top undecided one up as a post.
 
 Options:
-  --config <path>   Config file (default: honestweek.config.json).
-  --ledger <path>   Findings ledger (default: honestweek.findings.json).
+  --config <path>   Config file (default: the one honestweek finds: this folder's
+                    honestweek.config.json, then HONESTWEEK_CONFIG, then
+                    ~/.honestweek/honestweek.config.json).
+  --ledger <path>   Findings ledger (default: honestweek.findings.json, beside
+                    the config).
   --since <date>    Only sessions starting on/after this ISO date.
   --corpus <list>   Comma-separated: claude-code,codex,cowork (default: all).
   --draft           Write a draft for the top undecided finding and mark it drafted.
@@ -154,9 +159,14 @@ export default async function run(argv) {
   // loaded, must fail LOUD: continuing would silently rank the user's own-repo issues
   // as third-party evidence (mine.ownRepos gone) and run with the redaction denylist
   // off, in a command whose output the docs say to commit.
-  const configPath = resolve(args.config ?? 'honestweek.config.json');
+  // The config can sit elsewhere (HONESTWEEK_CONFIG, the user-level file); the ledger and drafts
+  // then sit beside it, never in an unrelated folder this ran in.
+  const found = findConfig({ cwd: process.cwd(), flag: args.config });
+  noteConfig((s) => process.stderr.write(s), 'mine', found, { writes: true });
+  const configPath = resolve(found.path);
+  const base = found.dir;
   let config = {};
-  if (args.config !== undefined || existsSync(configPath)) {
+  if (found.source !== 'none') {
     try {
       config = loadConfig(configPath);
     } catch (err) {
@@ -167,7 +177,7 @@ export default async function run(argv) {
     process.stderr.write(`honestweek mine: no config at ${configPath}; continuing without repo context.\n`);
   }
 
-  const ledgerPath = resolve(args.ledger ?? config?.mine?.ledger ?? 'honestweek.findings.json');
+  const ledgerPath = args.ledger !== undefined ? resolve(args.ledger) : resolve(base, config?.mine?.ledger ?? 'honestweek.findings.json');
   const ledger = loadLedger(ledgerPath);
   const now = new Date();
 
@@ -322,7 +332,7 @@ export default async function run(argv) {
     const target = nextToDraft(ledger);
     if (target) {
       const { path, body, title } = renderDraft(target, { config, now, redactor });
-      const outPath = resolve(path);
+      const outPath = resolve(base, path);
       mkdirSync(dirname(outPath), { recursive: true });
       writeFileSync(outPath, body, 'utf8');
       setStatus(ledger, target.key, 'drafted', { now, draftPath: path });