config/state split: agent homes do not belong in ~/.config/deva

[lroolle]

Description

~/.config/deva/<agent> doubles as agent home (default_config_home_for_agent, deva.sh:381) while deva.sh:4141 blanket-mounts ~/.config/deva into every container. Same host files end up visible at two container paths. Agent homes are state, not config.

Type

• Enhancement

Details

Today both mechanisms fire at once: config-root mode rehomes ~/.config/deva/claude/.claude to container $HOME/.claude, and the blanket mount exposes the same files under ~/.config/deva/claude/ inside the container. Agent writes through one alias, tools read the other. It also makes ~/.config/deva impossible to treat as pure deva config for wholesale mounting.

Proposed contract:

• ~/.config/deva/ — deva's own config, auth creds, cloak-profile. Mountable wholesale, exactly what line 4141 wants.
• ~/.local/share/deva/<agent>/ — agent homes/state. Intersects the accounts/ scoping from feat: export DEVA_AUTH_TAG for in-container account identity #497; decide both at once.

Migration: accept the old layout one release with a deprecation warning, then drop. Settle this before the bun port hardens the current layout.

Related Files

• deva.sh (default_config_home_for_agent, resolve_config_base, blanket mount at 4141)
• docs, README

Test Plan

• scripts/test-mount-shape.sh: no target mounted twice under any config mode
• old layout triggers deprecation warning, still works for one release
• new layout resolves agent home from ~/.local/share/deva/

[lroolle]

Live evidence from deva status -g on a running container, both mechanisms firing at once:

~/.config/deva/claude/.claude      -> /home/deva/.claude          rw  (config)
~/.config/deva/claude/.claude.json -> /home/deva/.claude.json     rw  (config)
...
~/.config/deva                     -> /home/deva/.config/deva     rw  (user)

Same host files, two container paths. The agent writes ~/.claude, anything reading ~/.config/deva/claude/.claude sees the alias.