Clean-tree rehearsal of v7.40.4: InstallHooks writes $HOME hook paths (inert or cross-profile on custom config roots) + 3 more findings

[Patrickraveaux]

Ran the clone-first rehearsal from #1769 / #1890 against a pinned v7.40.4 (commit be9e8ef) before a side-by-side install: scratch CLAUDE_CONFIG_DIR, AI-native install per the install page, pre/post census compared as named sets, full-tree SHA-256 diff, stray-write monitor on the real profile.

Good news first: 1938 of 1949 payload files landed byte-identical, every consent boundary held (declines included), and the only content drift was the intended import activation in CLAUDE.md. Four findings, biggest first.

1. InstallHooks merges literal $HOME/.claude/hooks/ commands, so the hook layer is inert (or cross-profile) on any custom config root

install/hooks/hooks.json hardcodes every command as $HOME/.claude/hooks/<name>, and the merge path never rewrites it for the detected config root. The $HOME/.claude to §ROOT§ substitution in Tools/InstallEngine.ts:686 only normalizes for the idempotency comparison; it is not a write-path transform.

Repro on a clean tree:

CLAUDE_CONFIG_DIR=/tmp/x bun Tools/InstallHooks.ts --apply
grep -Fc '$HOME/.claude/hooks' /tmp/x/settings.json   # 70

The 97 hook files themselves are copied correctly to /tmp/x/hooks/. Doctor confirms independently: "Hook interpreter resolution — broken", 33 hooks file not found.

Impact: hooks are silently dead on every non-default config root. And since $HOME expands at hook fire time, a scratch profile with hooks installed would execute the DEFAULT profile's hooks wherever that tree exists. DeployComponents gets this right (statusLine is written config-root-absolute), so this looks like a hooks-only path bug, not intended behavior.

Suggested fix: rewrite $HOME/.claude and ~/.claude prefixes to the detected configRoot in InstallHooks' merge before writing settings.json.

2. GenerateKnowledgeSchemaDoc.ts writes to the hardcoded home profile

install/LIFEOS/TOOLS/GenerateKnowledgeSchemaDoc.ts:24 resolves its output as homedir()/.claude/LIFEOS/MEMORY/KNOWLEDGE/_schema.md, ignoring configRoot. DeployCore's memory-scaffold step invokes it, so on a scratch install it exits 1 with ENOENT and the scratch profile never gets its _schema.md. On a machine that does have ~/.claude/LIFEOS/MEMORY/, a sandbox install would write into the real profile instead.

Suggested fix: resolve the output from CLAUDE_CONFIG_DIR / detected configRoot like the sibling tools do.

3. INSTALL.md step 6 (ActivateImports) cannot run as documented

Nothing in INSTALL.md's step sequence places CLAUDE.md; only Setup.md step 4 deploys install/CLAUDE.template.md. Following the install doc in order on a clean tree hits {"ok":false,"error":"CLAUDE.md not found at <configRoot>/CLAUDE.md"} at step 6. Either DeployCore should place the template, or the doc should name the copy as an explicit step before step 6.

4. The commands component is missing from INSTALL.md's component table

Tools/DeployComponents.ts:52 ships a commands component (7 public slash commands in install/commands/), but the step-8 menu lists only hooks / statusline / tooltips / spinner verbs / agents / Pulse / worksweep / derivedsync. An installer AI following the doc never offers it, and census-style verification flags the 7 files as missing.

Happy to re-test any of these against a patched tree.

[danielmiessler]

This is the most valuable thing anyone has sent us in a while. All four findings are real, two are worse than you wrote them up, and all four are fixed.

Finding 1 — confirmed at the code level, not just the repro count. normalizeCommand's §ROOT§ substitution feeds hookKey() for the dedup comparison only; mergeHooks pushes the incoming hook object verbatim, so the literal was written straight through. Your cross-profile execution claim holds: $HOME expands at fire time, so a scratch profile really would run the default profile's hooks. Fixed at the installer, which is where configRoot is already in scope — the payload's HOME-relative paths are resolved before the merge. The dedup key now collapses both forms, so re-running can't duplicate entries. Verified: 70 literals in the payload, 0 in the installed settings.json, and a second --apply reports added: 0, skipped: 74.

Finding 2 — worse than reported, and you named why yourself. The ENOENT on a clean machine is the good outcome; on any machine that already has a real ~/.claude, a sandbox install silently wrote its schema doc into the live profile with no error at all. Fixed to resolve through the shared resolver, with DeployCore threading the config root into the spawn, plus the missing mkdir.

While fixing it we found the same shape one layer down: the shared resolver checked LIFEOS_DIR before CLAUDE_CONFIG_DIR, and a shell that exports LIFEOS_DIR sent isolated installs back to the home profile anyway. Our first fix didn't actually work until that precedence was inverted. Your rehearsal found the class; the class had another member.

Finding 3 — fixed by adding the CLAUDE.md placement as an explicit step before the one that needs it, rather than duplicating Setup.md's fuller step into INSTALL.md.

Finding 4 — fixed in both tables. You found it in INSTALL.md; Setup.md's enhancements table had the same gap.

All of it ships in the next release. The clone-first rehearsal is clearly earning its keep — if you run it against the next cut, we'd like to see the writeup.