vibe-coding-master 0.3.9 → 0.3.10

package/README.md

@@ -257,8 +257,8 @@ Gateway rules:
 Gateway state is stored locally under:
 
 ```text
-~/.vcm/gateway/settings.json
-~/.vcm/gateway/audit.jsonl
+<vcmDataDir>/gateway/settings.json
+<vcmDataDir>/gateway/audit.jsonl
 ```
 
 ### Bind Weixin
@@ -384,11 +384,13 @@ The task header does not include a manual `Refresh` button. Task status, role st
 Translation settings are local and stored in:
 
 ```text
-~/.vcm/settings.json
+<vcmDataDir>/settings.json
 ```
 
 The same file stores recent repository paths. The translation API key is stored locally under `translation.secrets.apiKey`; it is not written to the connected repository, `.ai/vcm/handoffs`, raw terminal logs, or git diffs.
 
+VCM resolves `vcmDataDir` from `VCM_DATA_DIR`. If `VCM_DATA_DIR` is unset or empty, VCM uses `~/.vcm`. In Dev Containers, set `VCM_DATA_DIR=/workspace/.ai/vcm` through `containerEnv` so VCM app state survives container rebuilds.
+
 The sidebar `Settings` section also stores the UI theme preference in this file. The default is `system`, which follows the OS/browser color-scheme preference; users can cycle between `System`, `Light`, and `Dark`.
 
 The same sidebar also has a `Flow pause alert` toggle. It is on by default and controls the local alert that fires when VCM detects that the current role flow has stopped advancing. Short flows use a weak reminder: the soft two-note chime plays 3 times, 1.4 seconds apart. Flows lasting 2 minutes or longer use a strong reminder: VCM shows an alert dialog and repeats the chime until the user confirms it. The alert sound reuses one browser audio context so repeated reminders remain reliable in stricter browsers such as Safari. Safari users may still need to manually set `Safari > Website Settings > Auto-Play > Allow All Auto-Play`; Chrome is recommended for the most reliable alert sound behavior. The `Try alert` button always triggers the strong reminder for testing.
@@ -479,7 +481,7 @@ For `.gitignore`, VCM uses a gitignore-native managed block:
 # VCM:END
 ```
 
-`.ai/vcm/` is the active VCM local control area, and `.claude/worktrees/` is the Claude-compatible task worktree area. VCM keeps the task index in app-local project state under `~/.vcm/projects/`; each task runtime repo keeps its own session, message, orchestration, and translation state.
+`.ai/vcm/` is the active VCM local control area, and `.claude/worktrees/` is the Claude-compatible task worktree area. VCM keeps the task index in app-local project state under `<vcmDataDir>/projects/`; each task runtime repo keeps its own session, message, orchestration, and translation state.
 
 VCM also JSON-merges `.claude/settings.json` to install Claude Code `PreToolUse`, `UserPromptSubmit`, `Stop`, and `PermissionRequest` hooks plus a managed `env.BASH_DEFAULT_TIMEOUT_MS` so foreground watch windows fit inside the Bash tool timeout. The hooks post directly to the local VCM backend, so roles do not need a VCM CLI command to confirm delivery or report turn completion. The `Stop` hook forwards the backend response to Claude Code, which lets VCM block turn-end while a validation job is still running. When Codex Review Gates are installed, VCM also writes `.ai/codex/.codex/config.toml` and `.ai/codex/.codex/hooks.json` so the embedded Codex Reviewer terminal can POST `UserPromptSubmit` and `Stop` events back to VCM.
 
@@ -606,8 +608,8 @@ Embedded terminal output is still written to raw role log files under `.ai/vcm/h
 For a connected repository, VCM uses:
 
 ```text
-~/.vcm/projects/<project-id>/config.json
-~/.vcm/projects/<project-id>/tasks/<task>.json
+<vcmDataDir>/projects/<project-id>/config.json
+<vcmDataDir>/projects/<project-id>/tasks/<task>.json
 <baseRepoRoot>/.claude/worktrees/<task>/
 <taskRepoRoot>/.ai/vcm/sessions/<task>.json
 <taskRepoRoot>/.ai/vcm/messages/<task>.jsonl
@@ -621,7 +623,17 @@ For a connected repository, VCM uses:
 <taskRepoRoot>/.ai/vcm/handoffs/logs/{project-manager,architect,coder,reviewer}.log
 ```
 
-The project config is stored under `~/.vcm` so it is durable local app state and is not hidden inside a Git-ignored repository directory. For worktree-backed tasks, `taskRepoRoot` is `<baseRepoRoot>/.claude/worktrees/<task>`; for inline tasks, `taskRepoRoot` is the connected base repo.
+The project config is stored under `vcmDataDir` so it is durable local app state. `vcmDataDir` is `VCM_DATA_DIR` when set, otherwise `~/.vcm`. For Dev Containers, prefer:
+
+```json
+{
+  "containerEnv": {
+    "VCM_DATA_DIR": "/workspace/.ai/vcm"
+  }
+}
+```
+
+For worktree-backed tasks, `taskRepoRoot` is `<baseRepoRoot>/.claude/worktrees/<task>`; for inline tasks, `taskRepoRoot` is the connected base repo.
 
 Because handoffs are scoped to `taskRepoRoot` without an extra task-name directory, VCM allows only one active inline task per connected repository. Use the default worktree mode for parallel tasks.
 

package/dist/backend/gateway/gateway-settings-service.js

@@ -1,10 +1,11 @@
 import path from "node:path";
-import { homedir } from "node:os";
+import { resolveVcmDataDir } from "../vcm-data-dir.js";
 const DEFAULT_BASE_URL = "https://ilinkai.weixin.qq.com";
 const MAX_DEDUPE_IDS = 1000;
 export function createGatewaySettingsService(deps) {
-    const settingsPath = deps.settingsPath ?? path.join(homedir(), ".vcm", "gateway", "settings.json");
-    const auditPath = deps.auditPath ?? path.join(homedir(), ".vcm", "gateway", "audit.jsonl");
+    const dataDir = resolveVcmDataDir();
+    const settingsPath = deps.settingsPath ?? path.join(dataDir, "gateway", "settings.json");
+    const auditPath = deps.auditPath ?? path.join(dataDir, "gateway", "audit.jsonl");
     const now = deps.now ?? (() => new Date().toISOString());
     let cachedSettings = null;
     async function loadSettings() {

package/dist/backend/services/app-settings-service.js

@@ -1,13 +1,13 @@
 import path from "node:path";
-import { homedir } from "node:os";
 import { createHash } from "node:crypto";
 import { VCM_ROLE_NAMES } from "../../shared/constants.js";
 import { CODEX_REVIEW_GATES } from "../../shared/types/codex-review.js";
 import { createDefaultLaunchTemplate } from "../../shared/types/app-settings.js";
 import { CLAUDE_MODEL_OPTIONS, SESSION_EFFORT_OPTIONS } from "../../shared/types/session.js";
+import { resolveVcmDataDir } from "../vcm-data-dir.js";
 const MAX_RECENT_REPOSITORIES = 5;
 export function createAppSettingsService(deps) {
-    const settingsPath = deps.settingsPath ?? path.join(homedir(), ".vcm", "settings.json");
+    const settingsPath = deps.settingsPath ?? path.join(resolveVcmDataDir(), "settings.json");
     const settingsRoot = path.dirname(settingsPath);
     const projectIndexPath = path.join(settingsRoot, "projects", "index.json");
     let cachedSettings = null;

package/dist/backend/vcm-data-dir.js

@@ -0,0 +1,7 @@
+import path from "node:path";
+import { homedir } from "node:os";
+export const VCM_DATA_DIR_ENV = "VCM_DATA_DIR";
+export function resolveVcmDataDir(env = process.env) {
+    const configured = env[VCM_DATA_DIR_ENV]?.trim();
+    return configured ? path.resolve(configured) : path.join(homedir(), ".vcm");
+}

package/docs/codex-review-gates.md

@@ -306,7 +306,7 @@ Codex review outputs live under:
 ```
 
 VCM stores Codex Review Gate switches outside the repository in the global
-`~/.vcm/settings.json` file as one VCM-wide selected gate list. The
+`<vcmDataDir>/settings.json` file as one VCM-wide selected gate list. The
 project-local `.ai/codex/config.toml` must not store gate enablement, VCM must
 not key these switches by project or task, and VCM must not create a separate
 Codex review settings file for them.
@@ -491,7 +491,7 @@ connected active task and contains three independent toggles:
 - Final Diff
 
 All three toggles default to `off`. Turning on any gate writes the selected
-global gate list to `~/.vcm/settings.json`. Turning all gates off stores an
+global gate list to `<vcmDataDir>/settings.json`. Turning all gates off stores an
 empty selected gate list. VCM then mirrors this global setting into the active
 task's `.ai/vcm/codex-reviews/index.json` as runtime state for PM/tool
 consumption.

package/docs/full-harness-baseline.md

@@ -157,7 +157,7 @@ durable docs, PR text, or commit history.
 | Long-running jobs | `.ai/vcm/jobs/<job-id>/` | Runtime cleanup | Status and logs from `run-long-check` / `watch-job`. |
 | Bootstrap session | `.ai/vcm/bootstrap/session.json` | Runtime cleanup | Last harness-bootstrap terminal metadata. |
 | Bootstrap log | `.ai/vcm/bootstrap/bootstrap.log` | Runtime cleanup | Terminal log for the harness-bootstrap session. |
-| App-local task records | `~/.vcm/projects/<project-id>/tasks/<task-slug>.json` | Runtime cleanup | VCM UI/lifecycle subtask records outside the connected repo. |
+| App-local task records | `<vcmDataDir>/projects/<project-id>/tasks/<task-slug>.json` | Runtime cleanup | VCM UI/lifecycle subtask records outside the connected repo. |
 
 Runtime state under `.ai/vcm/**` is excluded from manifest entries. The manifest
 records `.ai/vcm/` only as a runtime root.

package/docs/gateway-design.md

@@ -491,10 +491,13 @@ Gateway state must live outside connected repositories.
 Recommended files:
 
 ```text
-~/.vcm/gateway/settings.json
-~/.vcm/gateway/audit.jsonl
+<vcmDataDir>/gateway/settings.json
+<vcmDataDir>/gateway/audit.jsonl
 ```
 
+VCM resolves `vcmDataDir` from `VCM_DATA_DIR`; when it is unset or empty, VCM
+uses `~/.vcm`.
+
 Settings shape:
 
 ```json
@@ -631,7 +634,7 @@ The user should be able to:
 - Add `src/backend/api/gateway-routes.ts`.
 - Add desktop UI controls for enable/disable, translation, binding status, and
   current project/task.
-- Store settings under `~/.vcm/gateway/settings.json`.
+- Store settings under `<vcmDataDir>/gateway/settings.json`.
 
 Validation:
 
@@ -761,7 +764,7 @@ task. It should still avoid arbitrary terminal control, approve/reject gates,
 role-specific start/stop controls, shell commands, and direct non-PM prompts.
 
 The third risk is token and message leakage. Gateway credentials and audit logs
-must stay under `~/.vcm/gateway`, with secrets redacted from logs and never
+must stay under `<vcmDataDir>/gateway`, with secrets redacted from logs and never
 written into connected repositories.
 
 The fourth risk is queueing. MVP should not queue multiple arbitrary user

package/docs/product-design.md

@@ -622,7 +622,7 @@ Translation is a local assistant layer beside the role terminal.
 Settings are saved in:
 
 ```text
-~/.vcm/settings.json
+<vcmDataDir>/settings.json
 ```
 
 The settings file stores:
@@ -765,7 +765,7 @@ implementation plan live in `docs/gateway-design.md`.
 App-level settings:
 
 ```text
-~/.vcm/settings.json
+<vcmDataDir>/settings.json
 ```
 
 Stored app-level settings include:
@@ -779,12 +779,13 @@ Stored app-level settings include:
 Gateway state and audit logs:
 
 ```text
-~/.vcm/gateway/settings.json
-~/.vcm/gateway/audit.jsonl
+<vcmDataDir>/gateway/settings.json
+<vcmDataDir>/gateway/audit.jsonl
 ```
 
 Gateway credentials, iLink tokens, DM binding identity, cursors, context tokens,
-and audit logs must stay outside connected repositories.
+and audit logs live under `vcmDataDir`. VCM resolves `vcmDataDir` from
+`VCM_DATA_DIR`; if it is unset or empty, VCM uses `~/.vcm`.
 
 Repository-level VCM state:
 
@@ -796,11 +797,11 @@ Repository-level VCM state:
 Project config:
 
 ```text
-~/.vcm/projects/<project-id>/config.json
-~/.vcm/projects/index.json
+<vcmDataDir>/projects/<project-id>/config.json
+<vcmDataDir>/projects/index.json
 ```
 
-The base repository's `.ai/vcm/` directory stores the task index, while `.claude/worktrees/` stores nested task worktrees. Long-lived project config is stored under `~/.vcm` so it survives outside Git-ignored repo state.
+The base repository's `.ai/vcm/` directory stores task-local runtime state, while `.claude/worktrees/` stores nested task worktrees. Long-lived project config is stored under `vcmDataDir`. In Dev Containers, set `VCM_DATA_DIR=/workspace/.ai/vcm` through `containerEnv` so VCM app state survives container rebuilds.
 
 Task worktree local files:
 
@@ -858,7 +859,7 @@ VCM V1 is successful when:
 - Auto orchestration switches to the target role tab when VCM records `dispatchingAt`, before VCM submits the route-file message.
 - Auto orchestration treats `UserPromptSubmit` as the reliable acceptance confirmation; if confirmation does not arrive, backend PTY retries Enter and records a message `failureReason` after retry exhaustion.
 - Round completion detection waits for the final role in a chained conversation and can alert with prompt plus sound.
-- Translation settings save to `~/.vcm/settings.json`.
+- Translation settings save to `<vcmDataDir>/settings.json`.
 - Translation reads Claude transcript JSONL reliably after start, resume, and restart.
 - Gateway can bind one Weixin DM identity to the desktop VCM instance, send
   translated plain text to PM, and push translated PM replies back to Weixin.

package/docs/v0.2-implementation-plan.md

@@ -91,8 +91,8 @@ src/backend/api/gateway-routes.ts
 Gateway settings and secrets must live in app-local state:
 
 ```text
-~/.vcm/gateway/settings.json
-~/.vcm/gateway/audit.jsonl
+<vcmDataDir>/gateway/settings.json
+<vcmDataDir>/gateway/audit.jsonl
 ```
 
 Gateway credentials must never be written to a connected repository, terminal
@@ -347,7 +347,7 @@ during task cleanup after useful facts are promoted.
 Task records live outside connected repos:
 
 ```text
-~/.vcm/projects/<project-id>/tasks/<task-slug>.json
+<vcmDataDir>/projects/<project-id>/tasks/<task-slug>.json
 ```
 
 Routine completed task plans should not be archived under

package/docs/vcm-cc-best-practices.md

@@ -178,7 +178,7 @@ Current runtime files and directories:
 App-local VCM task records live outside the connected repository:
 
 ```text
-~/.vcm/projects/<project-id>/tasks/<task-slug>.json
+<vcmDataDir>/projects/<project-id>/tasks/<task-slug>.json
 ```
 
 Runtime state is deleted during task cleanup after useful facts are promoted to
@@ -492,13 +492,13 @@ Gateway product rules:
 Gateway settings and secrets live in app-local state:
 
 ```text
-~/.vcm/gateway/settings.json
+<vcmDataDir>/gateway/settings.json
 ```
 
 Gateway audit logs live outside connected repositories:
 
 ```text
-~/.vcm/gateway/audit.jsonl
+<vcmDataDir>/gateway/audit.jsonl
 ```
 
 Rules:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibe-coding-master",
-  "version": "0.3.9",
+  "version": "0.3.10",
   "description": "Local GUI session cockpit for Claude Code role sessions.",
   "type": "module",
   "files": [