Install the skill once for every project, and fix the cold start

[schneiderjoseph]

Installing the skill system-wide exposed a bootstrap that could not work.

The skill and every agent adapter told an agent to run npx devia init. The package is scoped, so in a repository that has not installed devia that resolves to nothing: 404 devia@*. Per-repository that was survivable, since init had usually just been run with the scoped name. As a system-wide skill it is the normal path: the agent meets an unfamiliar repository, and the first command it is told to run fails. They now say
npm i -D @schneiderjoseph/devia && npx devia init.

skills install --global

• Writes the skill pack to the agent's own configuration directory, so the contract applies to every project instead of one
• Claude Code: ~/.claude/skills/devia/SKILL.md, or CLAUDE_CONFIG_DIR when set
• Cursor, Copilot and Windsurf: SKIP with the reason. Their user-level locations are not something devia can determine, and writing to a guessed path in someone's home directory is the confident wrong answer this tool exists to prevent
• The only command that writes outside --root: off by default, every path printed, an edited file kept without --force

The boundary is written down rather than quietly bent: 04_PERMISSIONS.md and 10_NEVER_ALWAYS.md both carry the exception and its guards, and 02_SURFACES.md says what an adopter receives.

Version: package 0.2.0, standard unchanged at 0.1.0. No adopter needs sync.

Verified: 33 tests with and without FORCE_COLOR, including one that asserts a plain skills install writes nothing outside the repository. validate clean, check P0 clear, memory validate clean.

Summary

Type

Devia compliance

• Rules touched (IDs):
• New rule? source cited, severity, priority, validation method:
• Breaking for adopters? (rule id, .devia/ layout, CLI contract):
• CHANGELOG.md updated:
• Generated files rebuilt (npm run build:index):

Checks

• npm run validate passes
• npm test passes
• node bin/devia.mjs check --root . passes
• devia init still produces a valid project (devia validate clean in a scratch repo)

Not verified