kushi-agents 3.14.0 → 4.0.0

package/.github/copilot-instructions.kushi.md

@@ -6,15 +6,18 @@ This workspace has [Kushi](https://gim-home.github.io/kushi/) installed under `.
 
 When the user types any of the following verbs followed by a project name, route to the corresponding Kushi prompt in `.kushi/prompts/` (no `@Kushi` needed):
 
-| Verb                       | Prompt to run                              |
-| -------------------------- | ------------------------------------------ |
-| `bootstrap <project>`      | `/pull-all-bootstrap`                      |
-| `refresh <project>`        | `/pull-all-refresh`                        |
-| `aggregate <project>`      | `/pull-all-aggregate`                      |
-| `state <project>`          | `/rebuild-state`                           |
-| `consolidate <project>`    | `/consolidate-evidence`                    |
-| `status <project>`         | `/show-run-log`                            |
-| `ask <project> <question>` | `/ask-project` (auto-routes to evidence Q&A) |
+| Verb                       | Prompt to run    |
+| -------------------------- | ---------------- |
+| `bootstrap <project>`      | `/bootstrap`     |
+| `refresh <project>`        | `/refresh`       |
+| `aggregate <project>`      | `/aggregate`     |
+| `state <project>`          | `/state`         |
+| `consolidate <project>`    | `/consolidate`   |
+| `status <project>`         | `/status`        |
+| `ask <project> <question>` | `/ask`           |
+| `fde-intake <project>`     | `/fde-intake`    |
+| `fde-report <project>`     | `/fde-report`    |
+| `fde-triage <project>`     | `/fde-triage`    |
 
 Project Q&A also auto-dispatches when the user names a known project under the engagement root **and** asks a question about it — no prefix needed.
 
@@ -29,10 +32,11 @@ Project Q&A also auto-dispatches when the user names a known project under the e
 ### Layout
 
 - `.kushi/agents/kushi.agent.md` — orchestrator (also addressable as `@Kushi`)
-- `.kushi/prompts/` — verb prompts (`/pull-*`, `/ask-project`, etc.)
+- `.kushi/prompts/` — verb prompts (`/bootstrap`, `/refresh`, `/ask`, etc.)
 - `.kushi/skills/` — per-source pull + render skills
 - `.kushi/instructions/` — doctrine (citations, WorkIQ-first, freshness gates)
-- `.kushi/reference-packs/` — bundled domain doctrine (override at project / user / packaged layers)
+- `.kushi/reference-packs/` — bundled domain doctrine (override at project / workspace / packaged layers)
+- `.kushi/config/` — **user-editable** (project-evidence.yml, integrations.yml, reference-overrides). Seeded on first install; never overwritten on upgrade.
 - `.kushi/kushi-install.json` — profile manifest written by the installer
 
 Full docs: <https://gim-home.github.io/kushi/>

package/bin/cli.mjs

@@ -25,6 +25,8 @@ if (args.includes('--help') || args.includes('-h')) {
   Options:
     --dest <path>       Override destination (relative for vscode, absolute for clawpilot)
     --force             Overwrite existing destination without asking
+    --yes, -y           Accept the default destination and skip the project-root
+                        check (useful for scripted or agent-driven installs)
     --no-settings       Skip .vscode/settings.json update (vscode target only)
     --no-instructions   Skip .github/copilot-instructions.md merge (vscode target only)
     --help, -h          Show this help
@@ -55,6 +57,7 @@ if (args.includes('--clawpilot')) {
 const options = {
   dest: getFlag('--dest'),
   force: args.includes('--force'),
+  yes: args.includes('--yes') || args.includes('-y'),
   noSettings: args.includes('--no-settings'),
   noInstructions: args.includes('--no-instructions'),
   target,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kushi-agents",
-  "version": "3.14.0",
+  "version": "4.0.0",
   "description": "Install Kushi — multi-source project evidence agent with snapshot+stream capture across Email, Teams, OneNote, SharePoint, Meetings, CRM, ADO. WorkIQ-only for M365 sources (Graph / m365_* FORBIDDEN as fallbacks; user-paste is first-class). Host-agnostic.",
   "type": "module",
   "bin": {

package/plugin/agents/kushi.agent.md

@@ -95,7 +95,8 @@ When a user message arrives:
 ## Configuration layout
 
 ```
-<USER_HOME>/.copilot/project-evidence.yml          ← personal: alias, engagement_root, active_projects
+<workspace>/.kushi/config/project-evidence.yml     ← personal: alias, engagement_root, active_projects (seeded by installer; never overwritten)
+<workspace>/.kushi/config/integrations.yml         ← optional global CRM/ADO defaults (seeded by installer; never overwritten)
 <engagement-root>/.project-evidence/                ← per-machine, per-user M365 + CRM + ADO config (OneDrive-synced)
    m365/m365-auth.json
    m365/m365-mutable.json

package/plugin/instructions/azure-auth-patterns.instructions.md

@@ -227,7 +227,7 @@ Maintained alongside `auth-and-retry §3` (canonical) — quick lookup:
 | Dynamics 365 / CRM | `<engagement-root>/.project-evidence/crm/config.yml` |
 | Azure DevOps | `<engagement-root>/.project-evidence/ado/config.yml` |
 | Microsoft Graph / M365 / OneNote | `<engagement-root>/.project-evidence/m365/m365-mutable.json` + `<engagement-root>/.project-evidence/m365/m365-auth.json` |
-| WorkIQ CLI path | `~/.copilot/project-evidence.yml` (user-scoped) |
-| Global integrations (optional) | `~/.copilot/integrations/{crm,ado}/` |
+| WorkIQ CLI path | `<workspace>/.kushi/config/project-evidence.yml` (workspace-scoped) |
+| Global integrations (optional) | `<workspace>/.kushi/config/integrations.yml` |
 
 Always read tenant IDs, resource URLs, org URLs, and allowed-tenant lists from these files at the start of each run. **Never hardcode them in skills or prompts.** The only acceptable literal in instructions/prompts is the public Microsoft tenant ID `72f988bf-86f1-41af-91ab-2d7cd011db47` in the user-facing `az login --tenant ...` suggestion text.

package/plugin/instructions/engagement-root-resolution.instructions.md

@@ -11,9 +11,9 @@ The **engagement-root** is the parent folder that contains all of the user's eng
 
 Resolve `<engagement-root>` in this order — first match wins:
 
-1. **`<USER_HOME>/.copilot/project-evidence.yml`** — read `engagement_root:` field (preferred).
+1. **`<workspace>/.kushi/config/project-evidence.yml`** — read `engagement_root:` field (preferred).
 2. **`customer_workspace/FDEDocs/`** — if the user's workspace has this symlink, follow it. Common in FDE-style installs.
-3. **Ask the user** once and persist the answer to `<USER_HOME>/.copilot/project-evidence.yml engagement_root`.
+3. **Ask the user** once and persist the answer to `<workspace>/.kushi/config/project-evidence.yml engagement_root`.
 
 ## Live config location
 
@@ -43,7 +43,7 @@ Once `<engagement-root>` is known, individual projects are subfolders:
 Project name resolution (always fuzzy):
 
 1. Match against keys in `<engagement-root>/.project-evidence/m365/m365-mutable.json m365Mutable.knownSections`.
-2. Match against `active_projects:` in `<USER_HOME>/.copilot/project-evidence.yml`.
+2. Match against `active_projects:` in `<workspace>/.kushi/config/project-evidence.yml`.
 3. Match against actual subfolder names under `<engagement-root>`.
 
 Case-insensitive; ranking `exact > prefix > contains`. Multiple plausible candidates → ask user to pick. Zero candidates AND verb is `bootstrap` → create the folder. Zero candidates AND verb is anything else → ask user.

package/plugin/instructions/run-reports.instructions.md

@@ -24,7 +24,7 @@ Critical for multi-user projects: each contributor's runs are independent, and e
   YYYY-MM-DD-HHmm_<mode>.md
 ```
 
-- `<alias>` — the contributor running the skill (from `~/.copilot/project-evidence.yml#alias`).
+- `<alias>` — the contributor running the skill (from `<workspace>/.kushi/config/project-evidence.yml#alias`).
 - `<mode>` — one of `bootstrap`, `refresh`, `force-refresh`, `consolidate`.
 - Timestamp uses the **start time** of the run, in local time, format `YYYY-MM-DD-HHmm` (no seconds, no timezone — local-time prefix is enough for chronological sort).
 

package/plugin/instructions/side-by-side-config.instructions.md

@@ -52,5 +52,5 @@ End every bootstrap / fix-up turn by listing the live config files (path + size
 ## Why outside the kushi repo
 
 - **Multi-machine portability** — OneDrive-synced beside engagement folders, follows the user wherever they install kushi.
-- **Discoverability** — user can see/edit it next to their engagement work, not buried in `~/.copilot/`.
+- **Discoverability** — user can see/edit it next to their engagement work and inside their workspace at `<workspace>/.kushi/config/`, not buried in an OS-hidden home directory.
 - **Repo-safe** — kushi is meant to be GitHub-published; live filled configs MUST never be committed.

package/plugin/instructions/workiq-only.instructions.md

@@ -47,7 +47,7 @@ For every M365 source in scope:
 
 ## Canonical WorkIQ commands (CODIFIED — do not re-discover)
 
-The CLI is at `C:\Users\ushak\.copilot\bin\workiq.cmd` (resolved from `<USER_HOME>/.copilot/project-evidence.yml workiq.cli_path`; fall back to PATH).
+The CLI is at `<USER_HOME>\.kushi\bin\workiq.cmd` (resolved from `<workspace>/.kushi/config/project-evidence.yml workiq.cli_path`; fall back to PATH; fall back to `~/.kushi/bin/workiq.cmd`).
 
 Invocation shape:
 
@@ -152,7 +152,7 @@ List my Teams meetings between <YYYY-MM-DD> and <YYYY-MM-DD> where the subject c
 
 Before the first WorkIQ query in a run:
 
-1. Resolve CLI path: `<USER_HOME>/.copilot/project-evidence.yml workiq.cli_path` OR `Get-Command workiq`. If missing → log `workiq-not-on-path`, write evidence file pointing at install docs, STOP this source.
+1. Resolve CLI path: `<workspace>/.kushi/config/project-evidence.yml workiq.cli_path` → `Get-Command workiq` → `~/.kushi/bin/workiq.cmd`. If none resolves → log `workiq-not-on-path`, write evidence file pointing at install docs, STOP this source.
 2. Probe with `workiq ask -q "ping"`. If EULA prompt → `workiq accept-eula` once, retry.
 3. Capture `--version` once into run-log for audit.
 

package/plugin/learnings/misc.md

@@ -17,7 +17,7 @@ The user pasting links into `external-links.txt` is the right boundary: auditabl
 **Routing model:**
 
 - `onenote / sharepoint / ado` → delegated to dedicated skills (recorded as `delegated` in registry, not double-pulled here).
-- `loop` → browser path (Playwright, reuses `~/.copilot/playwright-profile/onenote/` because same M365 cookie scope).
+- `loop` → browser path (Playwright, reuses `~/.kushi/playwright-profile/onenote/` because same M365 cookie scope).
 - `web / learn / docs / github / confluence / pdf / unknown` → HTTP path (fetch + @mozilla/readability for HTML extraction).
 - `file` → local file read.
 - Anything matching `<PASTE_*_URL>` or `<TODO*>` → `placeholder`, surfaced in run report until filled.

package/plugin/prompts/bootstrap.prompt.md

@@ -12,7 +12,7 @@ Inputs the agent will resolve:
 - `<window>` — defaults to 30 days. Override with `last 60 days`, `since 2026-04-01`, or `2026-04-01..2026-05-01`.
 
 Reads:
-- `<USER_HOME>/.copilot/project-evidence.yml` for alias + engagement-root.
+- `<workspace>/.kushi/config/project-evidence.yml` for alias + engagement-root.
 
 Produces:
 - `<engagement-root>/.project-evidence/m365/{m365-auth,m365-mutable}.json` (per-user filled)

package/plugin/reference-packs/README.md

@@ -11,7 +11,7 @@ When a skill (e.g. `fde-report`, `ask-project`) needs a pack's content, it loads
 | Priority | Location | Purpose | Lifecycle |
 |---:|---|---|---|
 | 1 (highest) | `<engagement-root>/<project>/.kushi-reference/<pack>/` | Per-engagement override | Versioned with the engagement; for project-specific tuning |
-| 2 | `~/.copilot/kushi-reference/<pack>/` | Per-user override | Per machine / per user; never overwritten by installer |
+| 2 | `<workspace>/.kushi/config/reference-overrides/<pack>/` | Workspace override | Per workspace / per machine; never overwritten by installer |
 | 3 (canonical) | `<install-dest>/reference-packs/<pack>/` (i.e. this folder, installed) | Packaged default | Updated via `npm publish` + version bump |
 
 Skills must always:
@@ -33,7 +33,7 @@ Skills must always:
 What does **not** go in a pack:
 
 - Per-engagement data (lives under `<project>/Evidence/`)
-- Per-user identity / configs (lives in `~/.copilot/project-evidence.yml`)
+- Per-user identity / configs (lives in `<workspace>/.kushi/config/project-evidence.yml`)
 - Skill behavior (lives in `plugin/skills/<skill>/SKILL.md`)
 - Cross-cutting agent doctrine (lives in `plugin/instructions/*.instructions.md`)
 

package/plugin/reference-packs/fde/README.md

@@ -23,9 +23,9 @@ Use this pack when a report needs:
 2. **Enumerate and read all human-readable `.md` files** in the pack.
 3. Treat the pack as a **single reference set** — any file here may contribute to the FDE operating model used in reports.
 4. **Apply the 3-layer override order** (highest wins):
-   - `<engagement-root>/<project>/.kushi-reference/fde/`  ← per-engagement override
-   - `~/.copilot/kushi-reference/fde/`                   ← per-user override
-   - `<install-dest>/reference-packs/fde/`               ← packaged default (this folder, installed)
+   - `<engagement-root>/<project>/.kushi-reference/fde/`     ← per-engagement override
+   - `<workspace>/.kushi/config/reference-overrides/fde/`     ← workspace override
+   - `<install-dest>/reference-packs/fde/`                    ← packaged default (this folder, installed)
 5. If two files at the same layer conflict, prefer the more **specific** file for that concept and raise the conflict explicitly in the skill's run-log / Open Questions — never silently average.
 
 ## File ownership

package/plugin/skills/ask-project/SKILL.md

@@ -40,7 +40,7 @@ In order, stop on first hit:
 1. Exact `<engagement-root>/<project>/Evidence/` folder.
 2. Fuzzy match against `discovery.project_aliases` in any `<engagement-root>/<project>/Evidence/<alias>/.settings.yml`.
 3. `<engagement-root>/<project>/external-context/` (lighter-weight projects without full bootstrap).
-4. `~/.copilot/project-evidence.yml` `active_projects` list.
+4. `<workspace>/.kushi/config/project-evidence.yml` `active_projects` list.
 
 If zero matches → ask user. If multiple → list candidates and ask user to pick. **Echo the resolved root path before answering** so the user can confirm.
 

package/plugin/skills/bootstrap-project/SKILL.md

@@ -44,13 +44,13 @@ After every run (success or coverage-gaps), write `<project>/bootstrap-status.md
 Verify in order. Stop on hard failures.
 
 1. **OS + host runtime** — display OS + Node/PowerShell version. Informational.
-2. **WorkIQ install (REQUIRED, hard stop)** — read `<USER_HOME>/.copilot/project-evidence.yml workiq.cli_path`. If missing, probe known paths:
-   - `$HOME\.copilot\bin\workiq.cmd`
+2. **WorkIQ install (REQUIRED, hard stop)** — read `<workspace>/.kushi/config/project-evidence.yml workiq.cli_path`. If missing, probe known paths:
+   - `$HOME\.kushi\bin\workiq.cmd`
    - `$env:LOCALAPPDATA\Programs\WorkIQ\workiq.cmd`
    - `$env:ProgramFiles\WorkIQ\workiq.cmd`
    If found, persist path. If not found, ask user for path (or to install). Test with `<workiq.cli_path> --help`. Without WorkIQ, M365 sources will all fail — STOP.
 3. **Conditional az login** — only if `<engagement-root>/.project-evidence/crm/config.yml` OR `<engagement-root>/.project-evidence/ado/config.yml` exists. Per `az-auth-conditional.instructions.md`. Soft warning on failure, never blocking.
-4. **Engagement-root resolution** — per `engagement-root-resolution.instructions.md`. Persist to `<USER_HOME>/.copilot/project-evidence.yml engagement_root` if newly resolved.
+4. **Engagement-root resolution** — per `engagement-root-resolution.instructions.md`. Persist to `<workspace>/.kushi/config/project-evidence.yml engagement_root` if newly resolved.
 
 Display SETUP summary table with ✅ / ⚙️ / ❌ / ⚠️ / ➖ markers.
 
@@ -62,7 +62,8 @@ Required live files:
 
 | Live file | Template source |
 |---|---|
-| `<USER_HOME>/.copilot/project-evidence.yml` | `templates/init/project-evidence.template.yml` |
+| `<workspace>/.kushi/config/project-evidence.yml` | `templates/init/project-evidence.template.yml` (seeded by installer) |
+| `<workspace>/.kushi/config/integrations.yml` | `templates/init/integrations.template.yml` (seeded by installer) |
 | `<engagement-root>/.project-evidence/m365/m365-auth.json` | `templates/init/m365-auth.template.json` |
 | `<engagement-root>/.project-evidence/m365/m365-mutable.json` | `templates/init/m365-mutable.template.json` |
 | `<engagement-root>/<project>/integrations.yml` | `templates/init/project-integrations.template.yml` |

package/plugin/skills/fde-intake/SKILL.md

@@ -31,7 +31,7 @@ Same algorithm as `ask-project` Step 1. Echo the resolved root path before draft
 Build the pack's virtual filesystem with the **3-layer override order** (highest wins):
 
 1. **Project override** — `<engagement-root>/<project>/.kushi-reference/fde/` (if present)
-2. **User override** — `~/.copilot/kushi-reference/fde/` (if present)
+2. **Workspace override** — `<workspace>/.kushi/config/reference-overrides/fde/` (if present)
 3. **Packaged default** — relative to this skill's install location:
    - vscode target: `<workspace>/.kushi/reference-packs/fde/`
    - clawpilot target: `~/.copilot/m-skills/kushi/reference-packs/fde/`

package/plugin/skills/intro/SKILL.md

@@ -138,7 +138,7 @@ Present this verbatim:
 
 Before opening, check whether any project is already bootstrapped:
 
-1. Read `~/.copilot/project-evidence.yml` (personal config). If `active_projects` has entries, pick the most recent as the demo target — substitute that name into `{{active_project}}` placeholders below.
+1. Read `<workspace>/.kushi/config/project-evidence.yml` (personal config). If `active_projects` has entries, pick the most recent as the demo target — substitute that name into `{{active_project}}` placeholders below.
 2. If none, propose a fictional project named **Contoso Discovery** and tell the user that Try-it prompts will use that name; they can substitute their own at any time.
 
 ### Navigation Keywords
@@ -444,6 +444,6 @@ Reply `next` to see the closing cheat sheet, or `done` to exit.
 - Rule 1.2: Mode selection must always present BOTH options — never auto-route to one mode.
 - Rule 1.3: In walkthrough mode, each moment must wait for `next` / `skip` / `done` / `try` before advancing — never auto-advance.
 - Rule 1.4: `done` must work at every moment — never trap the user.
-- Rule 1.5: Try-it prompts must use the active project name from `~/.copilot/project-evidence.yml`, OR the placeholder `Contoso Discovery` if no projects are configured. Never invent a real-sounding project name.
+- Rule 1.5: Try-it prompts must use the active project name from `<workspace>/.kushi/config/project-evidence.yml`, OR the placeholder `Contoso Discovery` if no projects are configured. Never invent a real-sounding project name.
 - Rule 1.6: Skill descriptions in this file must match `kushi.agent.md` and the live `SKILL.md` files — `self-check` D-checks catch drift.
 - Rule 1.7: Demo moments must reflect the actual verb count in `kushi.agent.md`. If a verb is added or removed, this file must be updated in the same commit (`self-check` warns on drift).

package/plugin/skills/propose-ado-update/SKILL.md

@@ -27,7 +27,7 @@ This skill does **NOT** create a new top-level config file. It reads from the co
 
 **Resolution is fully deterministic** — never ask the user for paths the bootstrap layer already resolved:
 
-1. `<engagement-root>` ← `~/.copilot/project-evidence.yml engagement_root` (per `engagement-root-resolution.instructions.md`).
+1. `<engagement-root>` ← `<workspace>/.kushi/config/project-evidence.yml engagement_root` (per `engagement-root-resolution.instructions.md`).
 2. `<project>` folder ← fuzzy-match per `engagement-root-resolution.instructions.md` (knownSections → active_projects → subfolders).
 3. `<project>/integrations.yml ado.engagement_id` — REQUIRED. If `0` or missing → see "Prerequisites" below; never invent an ID.
 4. `<project>/integrations.yml ado.writes` — if missing, append the block from `<KUSHI_ROOT>/plugin/templates/ado-update/integrations-ado-writes.example.yml` and stop for user confirmation of `fieldRefName`.

package/plugin/skills/pull-misc/README.md

@@ -69,7 +69,7 @@ node runner.mjs --project ABN ... --types web,loop --titles "Architecture"
 
 ## Scheduled / unattended runs
 
-- Browser branch (loop) reuses `~/.copilot/playwright-profile/onenote/`. When MFA fires, runner marks loop links `auth-required` and exits cleanly. User does one interactive bootstrap; next scheduled run silent.
+- Browser branch (loop) reuses `~/.kushi/playwright-profile/onenote/`. When MFA fires, runner marks loop links `auth-required` and exits cleanly. User does one interactive bootstrap; next scheduled run silent.
 - HTTP branch needs no auth for public links. For sites behind SSO (auth'd Confluence, internal dashboards) it returns `auth-required` and is currently NOT supported — paste the content into a `file` link as a workaround, OR add a per-site auth handler in a future version.
 - `placeholder` links surface in the run report every refresh until the user fills them in.
 

package/plugin/skills/pull-misc/SKILL.md

@@ -23,7 +23,7 @@ Pulls **misc** evidence in two shapes per `snapshot-vs-stream.instructions.md`:
 
 ## Tools (in order)
 
-1. **Playwright (browser-scrape, persisted profile)** — for `loop` links. Reuses `~/.copilot/playwright-profile/onenote/` because it's the same M365 cookie scope. Implementation: `plugin/skills/pull-misc/runner.mjs` branch `loop`.
+1. **Playwright (browser-scrape, persisted profile)** — for `loop` links. Reuses `~/.kushi/playwright-profile/onenote/` because it's the same M365 cookie scope. Implementation: `plugin/skills/pull-misc/runner.mjs` branch `loop`.
 2. **HTTP fetch + Readability** — for `web` / `confluence` (anonymous) / `learn` / `docs` / `pdf` links. Implementation: `plugin/skills/pull-misc/runner.mjs` branch `web`.
 3. **Local file read** — for `file` links pointing at project-relative paths. Implementation: `plugin/skills/pull-misc/runner.mjs` branch `file`.
 4. **WorkIQ** — used only for stream/edit-event signals on `loop` links (Loop edit events surface in the M365 search index, same as OneNote stream events). NOT used for body retrieval — Loop bodies require the browser path.
@@ -72,7 +72,7 @@ These three facts are HARD-rule:
 
 ```pwsh
 # A. Playwright profile (only required if external-links.txt contains loop links)
-$prof = "$env:USERPROFILE\.copilot\playwright-profile\onenote"
+$prof = "$env:USERPROFILE\.kushi\playwright-profile\onenote"
 if (-not (Test-Path $prof)) {
   Write-Host "[pull-misc] Playwright profile not yet seeded — loop links will be skipped with last_status: auth-required."
   Write-Host "[pull-misc] Run plugin/skills/pull-onenote/runner.mjs --bootstrap once to seed it."

package/plugin/skills/pull-misc/runner.mjs

@@ -36,7 +36,7 @@ const HEADLESS = !!args.headless;
 const TYPES_FILTER = args.types ? String(args.types).split(',').map(s => s.trim().toLowerCase()) : null;
 const TITLES_FILTER = args.titles ? String(args.titles).split(',').map(s => s.trim()) : null;
 const TIMEOUT_MS = parseInt(args.timeout || '45000', 10);
-const PROFILE_DIR = path.join(os.homedir(), '.copilot', 'playwright-profile', 'onenote');
+const PROFILE_DIR = path.join(os.homedir(), '.kushi', 'playwright-profile', 'onenote');
 
 if (!PROJECT || !LINKS_FILE) {
   console.error('Usage: --project <name> --links-file <path> [--headless] [--types t1,t2] [--titles "t1,t2"]');

package/plugin/skills/pull-onenote/README.md

@@ -21,7 +21,7 @@ When the bootstrap command opens a Chromium window:
 - Wait for the OneNote home page to load.
 - Close the window.
 
-The profile is persisted at `~/.copilot/playwright-profile/onenote/`. Subsequent runs reuse it.
+The profile is persisted at `~/.kushi/playwright-profile/onenote/`. Subsequent runs reuse it.
 
 ## Per-section runs
 

package/plugin/skills/pull-onenote/SKILL.md

@@ -23,7 +23,7 @@ Pulls **onenote** evidence in two shapes per `snapshot-vs-stream.instructions.md
 
 ## Tools (in order)
 
-1. **Playwright (browser-scrape, persisted profile)** — PRIMARY. Drives OneNote-for-Web to enumerate pages and read verbatim bodies via `#PageContentWrapper`. Profile lives at `~/.copilot/playwright-profile/onenote/` and is reused across runs. Implementation: `plugin/skills/pull-onenote/runner.mjs`.
+1. **Playwright (browser-scrape, persisted profile)** — PRIMARY. Drives OneNote-for-Web to enumerate pages and read verbatim bodies via `#PageContentWrapper`. Profile lives at `~/.kushi/playwright-profile/onenote/` and is reused across runs. Implementation: `plugin/skills/pull-onenote/runner.mjs`.
 2. **WorkIQ** — FALLBACK only. Used when the Playwright profile is auth-expired (`auth-required`) and for the stream/edit-event source. Always cite `m365-id-registry` doctrine when invoking; never use as primary for body retrieval (proven non-deterministic).
 3. **Host (m365_*)** — not used (Graph `Notes.Read.All` denied admin consent in this tenant).
 
@@ -145,7 +145,7 @@ Before any retrieval, validate the Playwright profile and (only if used as fallb
 ### A. Playwright profile (PRIMARY)
 
 ```pwsh
-$prof = "$env:USERPROFILE\.copilot\playwright-profile\onenote"
+$prof = "$env:USERPROFILE\.kushi\playwright-profile\onenote"
 if (-not (Test-Path $prof)) {
   Write-Host "[pull-onenote] Playwright profile not yet seeded."
   Write-Host "[pull-onenote] Run plugin/skills/pull-onenote/runner.mjs --bootstrap once interactively to sign in."
@@ -170,7 +170,7 @@ Cookie domains do not share between `*.cloud.microsoft` and `*.sharepoint(-df).c
 
 These are the same selectors `preflightOneNoteWeb` uses. The bootstrap log MUST emit `Sign-in detected (OneNote chrome rendered).` between Step 1/2 and Step 2/2 — its absence is the defect signature of the v3.11.1-and-earlier bug (sign-in was silently skipped, and every subsequent scrape returned `auth-required` regardless of how thoroughly the user signed in). Same anti-pattern applies to any future bootstrap surface (SharePoint, Loop, M365 admin).
 
-**A.3 Profile reset on channel switch:** if migrating from a Chromium profile to Edge (or vice versa), delete `~/.copilot/playwright-profile/onenote/` first. Cookie/cache formats differ.
+**A.3 Profile reset on channel switch:** if migrating from a Chromium profile to Edge (or vice versa), delete `~/.kushi/playwright-profile/onenote/` first. Cookie/cache formats differ.
 
 **A.4 OneNote-for-Web reachability pre-flight — HARD rule (kushi v3.11.0+):** before navigating to any section URL, the runner MUST probe `https://onenote.cloud.microsoft/` and classify the end-state into exactly one of three buckets:
 

package/plugin/skills/pull-onenote/runner.mjs

@@ -40,7 +40,7 @@ const args = Object.fromEntries(
   }, [])
 );
 
-const PROFILE_DIR = path.join(os.homedir(), '.copilot', 'playwright-profile', 'onenote');
+const PROFILE_DIR = path.join(os.homedir(), '.kushi', 'playwright-profile', 'onenote');
 const HEADLESS = !!args.headless;
 const BOOTSTRAP = !!args.bootstrap;
 const PREFLIGHT = !!args.preflight;

package/plugin/templates/init/integrations.template.yml

@@ -0,0 +1,19 @@
+# Kushi — optional global integrations defaults.
+#
+# Seeded by the installer on first install. Never overwritten on upgrade.
+# Per-project `integrations.yml` (inside the engagement folder) always
+# takes precedence over this file.
+#
+# Most users can leave this file as-is. Fill it in only if you want a
+# default CRM / ADO configuration that applies across all projects.
+
+# Microsoft Dataverse (CRM) defaults.
+# crm:
+#   environment_url: 'https://<org>.crm.dynamics.com'
+#   tenant_id:       '72f988bf-86f1-41af-91ab-2d7cd011db47'   # Microsoft tenant
+
+# Azure DevOps defaults.
+# ado:
+#   organization: 'https://dev.azure.com/<org>'
+#   project:      '<default-project>'
+#   tenant_id:    '72f988bf-86f1-41af-91ab-2d7cd011db47'      # Microsoft tenant

package/plugin/templates/init/project-evidence.template.yml

@@ -1,32 +1,38 @@
-# Personal config for Kushi.
-# Copy to:  ~/.copilot/project-evidence.yml   (Linux/macOS)
-#           %USERPROFILE%\.copilot\project-evidence.yml   (Windows)
+# Kushi — personal config.
 #
-# Each team member maintains their own copy. Nothing in here is a secret,
-# but it IS personal — never commit a filled copy to a shared repo.
+# This file was seeded by the installer on first install. It is YOUR copy,
+# never overwritten on reinstall / --force / upgrade. Each team member
+# maintains their own. Nothing here is a secret, but it IS personal —
+# add `.kushi/config/` to .gitignore before committing the rest of .kushi/.
+#
+# Edit the values below (lines marked FILL ME IN), then run `bootstrap <project>`.
 
-# Short id used as your evidence subfolder name (e.g. "alex", "jordan").
+# FILL ME IN — short id used as your evidence subfolder name (e.g. "alex", "jordan").
 alias: <your-alias>
 
+# FILL ME IN
 display_name: <Your Full Name>
 email: your.email@example.com
 
-# Where your engagement-root lives — i.e. the parent folder that contains
+# FILL ME IN — where your engagement-root lives. The parent folder containing
 # one subfolder per project (typically synced from a team SharePoint library).
 # Examples:
 #   Windows : 'C:\Users\<you>\OneDrive - <Tenant>\<Team>\Engagement Assets'
 #   macOS   : '/Users/<you>/OneDrive - <Tenant>/<Team>/Engagement Assets'
 projects_root: '<engagement-root>'
 
-# Default OneNote notebook to scan for project pages.
+# FILL ME IN — default OneNote notebook to scan for project pages.
 default_onenote_notebook: <Your Notebook Name>
 
-# Projects you actively work on. Kushi scans only these unless you ask otherwise.
-# Match is fuzzy against subfolder names under projects_root.
+# FILL ME IN — projects you actively work on. Kushi scans only these unless
+# you ask otherwise. Match is fuzzy against subfolder names under projects_root.
 active_projects:
   - <ProjectA>
   # - <ProjectB>
-  # - <add more here>
 
-# (Optional) where the global integrations live, if not the default.
-# integrations_root: '<USER_HOME>/.copilot/integrations'
+# (Optional) Path to the WorkIQ CLI. If omitted, Kushi resolves in this order:
+#   1. this `cli_path` value
+#   2. `workiq` on PATH
+#   3. ~/.kushi/bin/workiq.cmd  (Windows) / ~/.kushi/bin/workiq  (Linux/macOS)
+# workiq:
+#   cli_path: 'C:\Users\<you>\.kushi\bin\workiq.cmd'

package/plugin/templates/init/project-user-settings.template.yml

@@ -21,7 +21,7 @@ teams_chats:
   search_keywords: []
 
 onenote:
-  notebook: '{{ONENOTE_NOTEBOOK}}'        # default from ~\.copilot\project-evidence.yml
+  notebook: '{{ONENOTE_NOTEBOOK}}'        # default from <workspace>\.kushi\config\project-evidence.yml
   section: '{{ONENOTE_SECTION}}'          # e.g. 'Noridian.one'
   page_filter: ''                         # optional substring filter
 

package/src/constants.mjs

@@ -22,6 +22,21 @@ export const PLUGIN_SOURCE_DIR = 'plugin';
 /** Asset subdirectories under plugin/ that get copied. */
 export const ASSET_DIRS = ['agents', 'instructions', 'prompts', 'skills', 'templates', 'reference-packs'];
 
+/**
+ * User-editable config directory under the install destination.
+ * Seeded on first install only; never overwritten on reinstall / --force / upgrade.
+ */
+export const CONFIG_DIR = 'config';
+
+/**
+ * Files seeded into <dest>/config/ on first install only.
+ * Each entry: { template: <path under plugin/templates/init/>, target: <name in config/> }
+ */
+export const CONFIG_SEED_FILES = [
+  { template: 'init/project-evidence.template.yml', target: 'project-evidence.yml' },
+  { template: 'init/integrations.template.yml',     target: 'integrations.yml'     },
+];
+
 /** Files to exclude from consumer installs (relative to plugin/). */
 export const EXCLUDED_FILES = [];
 
@@ -40,6 +55,46 @@ export const PROJECT_GITHUB_EXCLUDED_FILES = [
   'config/m365-mutable.json'
 ];
 
+/**
+ * Files / directories that indicate the cwd is a sane install target.
+ *
+ * Two flavors:
+ *   - 'code'       — a software project root (any common ecosystem).
+ *   - 'engagement' — a Kushi engagement folder (Evidence/State/integrations live here,
+ *                    or this dir already has a prior Kushi install / reference pack).
+ *
+ * Either flavor suppresses the "this directory does not look like a project root"
+ * warning. If neither is present and the directory is non-empty, the installer
+ * shows an actionable warning. If the directory is empty, it shows a friendly
+ * INFO message instead — empty dirs are the normal "starting fresh" case.
+ */
+export const PROJECT_MARKERS = [
+  // ── code project roots ──────────────────────────────────────────────────
+  { name: 'package.json',      kind: 'code', type: 'file' },
+  { name: '.git',              kind: 'code', type: 'dir'  },
+  { name: 'pyproject.toml',    kind: 'code', type: 'file' },
+  { name: 'requirements.txt',  kind: 'code', type: 'file' },
+  { name: 'Cargo.toml',        kind: 'code', type: 'file' },
+  { name: 'go.mod',            kind: 'code', type: 'file' },
+  { name: 'pom.xml',           kind: 'code', type: 'file' },
+  { name: 'build.gradle',      kind: 'code', type: 'file' },
+  { name: 'build.gradle.kts',  kind: 'code', type: 'file' },
+  { name: 'composer.json',     kind: 'code', type: 'file' },
+  { name: 'Gemfile',           kind: 'code', type: 'file' },
+  { name: 'mix.exs',           kind: 'code', type: 'file' },
+  // ── .NET (glob, not literal name) ───────────────────────────────────────
+  { glob: /\.csproj$/i,        kind: 'code', type: 'file' },
+  { glob: /\.fsproj$/i,        kind: 'code', type: 'file' },
+  { glob: /\.sln$/i,           kind: 'code', type: 'file' },
+  // ── Kushi engagement folders ────────────────────────────────────────────
+  { name: 'Evidence',          kind: 'engagement', type: 'dir'  },
+  { name: 'State',             kind: 'engagement', type: 'dir'  },
+  { name: 'integrations.yml',  kind: 'engagement', type: 'file' },
+  { name: 'integrations.yaml', kind: 'engagement', type: 'file' },
+  { name: '.kushi',            kind: 'engagement', type: 'dir'  },
+  { name: '.kushi-reference',  kind: 'engagement', type: 'dir'  },
+];
+
 /** VS Code settings keys → the .kushi subdirectory they point at. */
 export const SETTINGS_MAP = {
   'chat.agentFilesLocations':        'agents',

package/src/main.mjs

@@ -10,11 +10,13 @@ import {
   CLAWPILOT_AGENT_SOURCE,
   CLAWPILOT_SKILL_DEST,
   PLUGIN_SOURCE_DIR,
+  PROJECT_MARKERS,
 } from './constants.mjs';
 import { promptForDestination } from './prompt.mjs';
 import { copyAssets, copyProjectFiles } from './copy-assets.mjs';
 import { mergeSettings } from './settings.mjs';
 import { mergeCopilotInstructions } from './copilot-instructions.mjs';
+import { seedConfig } from './seed-config.mjs';
 import {
   resolveProfile,
   makeIncludeFilter,
@@ -82,14 +84,8 @@ export async function main(options = {}) {
  */
 async function installVscode(options, resolved, version) {
   const projectRoot = process.cwd();
-  const hasProjectMarker =
-    fs.existsSync(path.join(projectRoot, 'package.json')) ||
-    fs.existsSync(path.join(projectRoot, '.git'));
-
-  if (!hasProjectMarker) {
-    console.warn(
-      '  WARN: This directory does not look like a project root (no package.json or .git found). Proceeding anyway.\n',
-    );
+  if (!options.yes) {
+    warnIfNotProjectRoot(projectRoot);
   }
 
   let dest;
@@ -112,6 +108,8 @@ async function installVscode(options, resolved, version) {
       console.error('\n  Destination must be within the current project.\n');
       process.exit(1);
     }
+  } else if (options.yes) {
+    dest = DEFAULT_DEST;
   } else {
     dest = await promptForDestination(DEFAULT_DEST);
   }
@@ -132,6 +130,13 @@ async function installVscode(options, resolved, version) {
   const manifestPath = writeInstalledManifest(fullDest, resolved, version);
   console.log(`    - kushi-install.json (profile manifest)`);
 
+  const { seeded, preserved } = seedConfig(PKG_ROOT, fullDest);
+  if (seeded.length > 0 || preserved.length > 0) {
+    console.log(`\n  Config (.kushi/config/ — user-editable, preserved across upgrades):`);
+    for (const f of seeded)    console.log(`    - ${f} -> seeded from template`);
+    for (const f of preserved) console.log(`    - ${f} -> preserved (already exists)`);
+  }
+
   if (!options.noSettings) {
     const { created, keysAdded, keysUnchanged } = mergeSettings(
       projectRoot,
@@ -224,6 +229,13 @@ async function installClawpilot(options, resolved, version) {
   writeInstalledManifest(fullDest, resolved, version);
   console.log(`    - kushi-install.json (profile manifest)`);
 
+  const { seeded, preserved } = seedConfig(PKG_ROOT, fullDest);
+  if (seeded.length > 0 || preserved.length > 0) {
+    console.log(`\n  Config (${displayDest}\\config\\ — user-editable, preserved across upgrades):`);
+    for (const f of seeded)    console.log(`    - ${f} -> seeded from template`);
+    for (const f of preserved) console.log(`    - ${f} -> preserved (already exists)`);
+  }
+
   // Mirror agents/kushi.agent.md as top-level SKILL.md for Clawpilot discovery.
   const agentSrc = path.join(PKG_ROOT, PLUGIN_SOURCE_DIR, CLAWPILOT_AGENT_SOURCE);
   const skillDst = path.join(fullDest, CLAWPILOT_SKILL_DEST);
@@ -276,4 +288,90 @@ async function confirmOverwriteIfExists(fullDest, displayDest, force) {
     console.log('\n  Cancelled.\n');
     process.exit(0);
   }
+}
+
+/**
+ * Detect whether the cwd looks like a sane install target and, if not, print
+ * an actionable message. Three cases:
+ *
+ *   1. A code marker (package.json, .git, pyproject.toml, *.csproj, ...) or an
+ *      engagement marker (Evidence/, State/, integrations.yml, .kushi/, ...)
+ *      is present → silent, proceed.
+ *   2. The directory is empty → friendly INFO ("starting fresh — Kushi will
+ *      create a new install here"). Empty dirs are the normal first-run case
+ *      and should not produce a WARN.
+ *   3. The directory has files but no recognized marker → WARN with the
+ *      actual fix (run `git init`, cd to an engagement folder, or pass --yes
+ *      to skip this check in scripted use).
+ *
+ * @param {string} projectRoot
+ */
+function warnIfNotProjectRoot(projectRoot) {
+  const marker = findProjectMarker(projectRoot);
+  if (marker) return;
+
+  let entries;
+  try {
+    entries = fs
+      .readdirSync(projectRoot)
+      .filter((n) => n !== '.DS_Store' && n !== 'Thumbs.db');
+  } catch {
+    entries = [];
+  }
+
+  if (entries.length === 0) {
+    console.log(
+      '  INFO: Empty directory detected — Kushi will create a fresh install here.\n',
+    );
+    return;
+  }
+
+  console.warn(
+    '  WARN: This directory has files but no recognized project marker',
+  );
+  console.warn(
+    '        (e.g. package.json, .git, pyproject.toml, *.csproj, or a Kushi',
+  );
+  console.warn(
+    '        engagement folder containing Evidence/, State/, or integrations.yml).',
+  );
+  console.warn('');
+  console.warn('  If this is intentional, press Enter to accept the default path.');
+  console.warn('  Otherwise, Ctrl+C and either:');
+  console.warn('    • run `git init` first (for a new code project), or');
+  console.warn('    • cd into your engagement folder (where Evidence/ lives), or');
+  console.warn('    • re-run with `--yes` to suppress this check in scripted use.\n');
+}
+
+/**
+ * Return the first matching project/engagement marker in `dir`, or null.
+ * @param {string} dir
+ * @returns {{ name: string, kind: 'code'|'engagement', type: 'file'|'dir' } | null}
+ */
+function findProjectMarker(dir) {
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return null;
+  }
+
+  for (const marker of PROJECT_MARKERS) {
+    if (marker.glob) {
+      const hit = entries.find(
+        (e) => e.isFile() && marker.glob.test(e.name),
+      );
+      if (hit) return { name: hit.name, kind: marker.kind, type: 'file' };
+      continue;
+    }
+    const hit = entries.find((e) => e.name === marker.name);
+    if (!hit) continue;
+    if (marker.type === 'dir' && hit.isDirectory()) {
+      return { name: marker.name, kind: marker.kind, type: 'dir' };
+    }
+    if (marker.type === 'file' && hit.isFile()) {
+      return { name: marker.name, kind: marker.kind, type: 'file' };
+    }
+  }
+  return null;
 }

package/src/seed-config.mjs

@@ -0,0 +1,44 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import {
+  CONFIG_DIR,
+  CONFIG_SEED_FILES,
+  PLUGIN_SOURCE_DIR,
+} from './constants.mjs';
+
+/**
+ * Seed <dest>/config/ with user-editable config files on FIRST INSTALL ONLY.
+ *
+ * Rules:
+ *   - If <dest>/config/<file> already exists → skip (never overwrite).
+ *   - Behavior is identical regardless of --force; config/ is user territory.
+ *   - Returns a per-file result so the installer can summarize what happened.
+ *
+ * @param {string} sourcePkgDir – root of the npm package
+ * @param {string} destAbsolute – absolute install destination (e.g. <workspace>/.kushi)
+ * @returns {{ seeded: string[], preserved: string[] }}
+ */
+export function seedConfig(sourcePkgDir, destAbsolute) {
+  const configDir = path.join(destAbsolute, CONFIG_DIR);
+  fs.mkdirSync(configDir, { recursive: true });
+
+  const seeded = [];
+  const preserved = [];
+
+  for (const { template, target } of CONFIG_SEED_FILES) {
+    const src = path.join(sourcePkgDir, PLUGIN_SOURCE_DIR, 'templates', template);
+    const dst = path.join(configDir, target);
+
+    if (!fs.existsSync(src)) continue;
+
+    if (fs.existsSync(dst)) {
+      preserved.push(target);
+      continue;
+    }
+
+    fs.cpSync(src, dst);
+    seeded.push(target);
+  }
+
+  return { seeded, preserved };
+}