Install where Claude Code actually looks, and for people who use bash

Two ways a stranger could install this cleanly and get nothing.

Claude Code reads its user config from $CLAUDE_CONFIG_DIR when that is set and
~/.claude otherwise. The installer only ever knew the second one. Anyone with it
pointed elsewhere — containers, VMs, anyone keeping separate profiles — got all
26 skills, both manifests and every hook written into a directory Claude Code
never opens, with hook paths baked to match. It reported success and did
nothing, which is the worst way for an installer to be wrong. install.sh,
uninstall.sh and doctor now resolve the same variable, and .claude.json follows
it into the config dir the way Claude Code puts it there.

The shell lane was zsh-only, and the environment half of it did not need to be.
The wrapper genuinely cannot travel — claude-parity.zsh uses whence and print
and is not sourceable by bash — but the env snippet and the secrets line are
plain POSIX exports, and they carry the 1h prompt cache, tool concurrency,
streaming and task support. A default Debian, Ubuntu or Alpine box is every
cloud VM and nearly every container, and all of them installed fine and then ran
with none of it. bash gets the environment now, and install.sh says out loud
that the wrapper is not coming.

tests/install-matrix.sh runs the installer into eight throwaway HOMEs and
asserts the resulting tree rather than reading the installer's own summary:
default, CLAUDE_CONFIG_DIR, a space in the home path, no jq, a bash user, a
repeat run for idempotency, and both uninstall paths. It runs on Linux in CI
every push, which is the environment it exists for. Reverting the config-dir fix
turns it red naming exactly what broke — I checked, because a matrix that cannot
fail is a longer way of writing "probably fine".

Backups keep working when the config dir sits outside $HOME: those files have no
home-relative form, so they are stored under files_abs/ with their full path.

verify.sh 23/23, gate-falsifiability.sh 24/24, install-matrix 8/8.

Author: itsvedantkumar

.github/workflows/verify.yml

@@ -71,6 +71,14 @@ jobs:
       - name: Install jq
         run: sudo apt-get update -qq && sudo apt-get install -y -qq jq
 
+      # Runs install.sh into eight throwaway HOMEs and asserts the resulting tree each time:
+      # a plain install, one with CLAUDE_CONFIG_DIR pointed elsewhere, one whose home path
+      # contains a space, one with jq removed from PATH, a bash user, a second run for
+      # idempotency, and the two uninstall paths. This runner is the environment the matrix
+      # exists for — bash by default, no Homebrew, the shape of a cloud VM or a container.
+      - name: Install matrix (config dir, bash, spaces, no jq, idempotency, uninstall)
+        run: ./tests/install-matrix.sh
+
       - name: install.sh, for real
         run: ./install.sh
 

README.md

@@ -246,6 +246,21 @@ A cloud session clones a repo into a sandbox with no access to your home directo
 committed `.claude/` directory is the only config it can read. That is what `overlay.sh` is
 for. Run it in any repo you dispatch cloud work to.
 
+**`CLAUDE_CONFIG_DIR` is honoured.** Set it and the install goes there instead of `~/.claude`,
+including the hook paths written into `settings.json` and the `.claude.json` MCP entries. If
+you keep separate profiles, or run in a container that puts config somewhere else, set it
+before installing and everything follows.
+
+**Shells.** The environment lane — the 1h prompt cache, tool concurrency, streaming, task
+support — is written to `.zshenv` and, for bash users, to `.bashrc`. The `claude` wrapper is
+zsh only: it is written in zsh and cannot be sourced by bash, so on a bash machine you get the
+environment without the wrapper, and `install.sh` says so when it runs.
+
+`tests/install-matrix.sh` runs the installer into eight throwaway HOMEs and asserts the
+resulting tree: default, `CLAUDE_CONFIG_DIR`, a home path with a space, no `jq`, a bash user, a
+second run for idempotency, and both uninstall paths. It runs on Linux in CI every push. It
+never touches your real home directory, so it is safe to run on the machine you work on.
+
 ## Credentials
 
 `install.sh` copies `secrets.env.example` to `~/.config/agents/secrets.env` with mode 600 when

bin/doctor

@@ -2,6 +2,11 @@
 # Health-check Claude Code setup — catches silent drift (vanished hooks/agents, missing secrets).
 set -uo pipefail
 
+# Claude Code reads its user config from $CLAUDE_CONFIG_DIR when set, ~/.claude otherwise.
+# Mirrors install.sh: anything else and this operates on a directory the install never used.
+CDIR="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
+if [ -n "${CLAUDE_CONFIG_DIR:-}" ]; then CJSON="$CDIR/.claude.json"; else CJSON="$HOME/.claude.json"; fi
+
 # --drift: compare the INSTALLED state (~/.claude, ~/.config/agents/bin) against the vstack
 # repo checkout it came from.
 #
@@ -73,22 +78,22 @@ if [ "${1:-}" = "--drift" ]; then
   for f in "$REPO"/claude/hooks/*.sh; do
     [ -e "$f" ] || continue
     b=$(basename "$f")
-    check_item "claude/hooks/$b" "$f" "$HOME/.claude/hooks/$b"
+    check_item "claude/hooks/$b" "$f" "$CDIR/hooks/$b"
   done
   for f in "$REPO"/claude/agents/*.md; do
     [ -e "$f" ] || continue
     b=$(basename "$f")
-    check_item "claude/agents/$b" "$f" "$HOME/.claude/agents/$b"
+    check_item "claude/agents/$b" "$f" "$CDIR/agents/$b"
   done
   for f in "$REPO"/claude/commands/*.md; do
     [ -e "$f" ] || continue
     b=$(basename "$f")
-    check_item "claude/commands/$b" "$f" "$HOME/.claude/commands/$b"
+    check_item "claude/commands/$b" "$f" "$CDIR/commands/$b"
   done
   for d in "$REPO"/claude/skills/*/; do
     [ -d "$d" ] || continue
     s=$(basename "$d")
-    check_item "claude/skills/$s" "${d%/}" "$HOME/.claude/skills/$s"
+    check_item "claude/skills/$s" "${d%/}" "$CDIR/skills/$s"
   done
   for f in "$REPO"/bin/*; do
     [ -e "$f" ] || continue
@@ -99,8 +104,8 @@ if [ "${1:-}" = "--drift" ]; then
   # has been running a while", and it was the one file --drift never looked at. Hand-edit it,
   # get "no drift", then lose the edit on the next update. Same for the statusline and the
   # shell lane.
-  check_item "claude/CLAUDE.md"        "$REPO/claude/CLAUDE.md"        "$HOME/.claude/CLAUDE.md"
-  check_item "claude/statusline.sh"    "$REPO/claude/statusline.sh"    "$HOME/.claude/statusline.sh"
+  check_item "claude/CLAUDE.md"        "$REPO/claude/CLAUDE.md"        "$CDIR/CLAUDE.md"
+  check_item "claude/statusline.sh"    "$REPO/claude/statusline.sh"    "$CDIR/statusline.sh"
   [ -f "$REPO/conductor/settings.managed.toml" ] && \
     check_item "conductor/settings.managed.toml" "$REPO/conductor/settings.managed.toml" "$HOME/.conductor/settings.managed.toml"
   [ -f "$REPO/shell/claude-parity.zsh" ] && \
@@ -121,7 +126,7 @@ if [ "${1:-}" = "--drift" ]; then
   # and have no business in a public repo. Anything outside both sets is unclassified — not
   # necessarily wrong, but nobody has decided what it is, which is exactly the state the dead
   # skillOverrides and sandbox blocks sat in.
-  if command -v jq >/dev/null 2>&1 && [ -f "$HOME/.claude/settings.json" ]; then
+  if command -v jq >/dev/null 2>&1 && [ -f "$CDIR/settings.json" ]; then
     # Claude Code's own settings belong here even though vstack never writes them. Leaving one
     # out pushes the reader toward the wrong remedy: doctor offers "ship it" or "retire it", and
     # retiring a key Claude Code owns means install.sh deletes a working feature. `sandbox` is
@@ -131,7 +136,7 @@ if [ "${1:-}" = "--drift" ]; then
     extra=$(jq -r --slurpfile repo "$REPO/claude/settings.json" --argjson us "$USER_SCOPE" '
       ($repo[0] | keys) as $shipped
       | keys - $shipped - $us
-      | .[]' "$HOME/.claude/settings.json" 2>/dev/null)
+      | .[]' "$CDIR/settings.json" 2>/dev/null)
     if [ -n "$extra" ]; then
       echo "unclassified settings.json key(s) not shipped by the repo and not user-scope:"
       printf '          %s\n' $extra
@@ -153,22 +158,22 @@ if [ "${1:-}" = "--drift" ]; then
   # pdf, docx, pptx, xlsx) link in from elsewhere and are expected.
   RUNTIME_TOP='projects sessions session-env shell-snapshots tasks todos plans telemetry plugins cache chrome daemon downloads paste-cache jobs ide statsig backups scheduled-tasks history.jsonl stats-cache.json mcp-needs-auth-cache.json settings.json settings.local.json .credentials.json .last-update-result.json .last-cleanup .cc-writes CLAUDE.md statusline.sh hooks agents commands skills'
   stale=""
-  for p in "$HOME"/.claude/* "$HOME"/.claude/.[!.]*; do
+  for p in "$CDIR"/* "$CDIR"/.[!.]*; do
     [ -e "$p" ] || continue
     b=$(basename "$p")
     case " $RUNTIME_TOP " in *" $b "*) continue ;; esac
     stale="$stale $b"
   done
   for kind in hooks:'*.sh' agents:'*.md' commands:'*.md'; do
     d=${kind%%:*}; pat=${kind#*:}
-    for p in "$HOME"/.claude/"$d"/$pat; do
+    for p in "$CDIR"/"$d"/$pat; do
       [ -e "$p" ] || continue
       [ -L "$p" ] && continue
       b=$(basename "$p")
       [ -e "$REPO/claude/$d/$b" ] || stale="$stale $d/$b"
     done
   done
-  for p in "$HOME"/.claude/skills/*/; do
+  for p in "$CDIR"/skills/*/; do
     [ -d "$p" ] || continue
     s=$(basename "$p")
     [ -L "${p%/}" ] && continue
@@ -259,17 +264,17 @@ fi
 echo "── hooks ──"
 # inject-orchestrator + inject-tokenmaxxing were merged into inject-session-context (2026-08-10)
 for f in $HOOKS; do
-  [ -x "$HOME/.claude/hooks/$f.sh" ] && ok "$f.sh" || bad "$f.sh" "missing/not exec"; done
+  [ -x "$CDIR/hooks/$f.sh" ] && ok "$f.sh" || bad "$f.sh" "missing/not exec"; done
 [ -x "$HOME/.config/agents/bin/claude-bg.sh" ] && ok "claude-bg.sh (headless)" || bad "claude-bg.sh" "missing"
-n=$(ls "$HOME/.claude/agents"/*.md 2>/dev/null | wc -l | tr -d ' ')
+n=$(ls "$CDIR/agents"/*.md 2>/dev/null | wc -l | tr -d ' ')
 [ "$n" -ge "$WANT_AGENTS" ] && ok "subagents ($n)" || bad "subagents" "$n<$WANT_AGENTS"
 echo "── secrets ──"
 [ -f "$HOME/.config/agents/secrets.env" ] && [ "$(get_perms "$HOME/.config/agents/secrets.env")" = "600" ] && ok "secrets.env (600)" || bad "secrets.env" "missing/perms"
 grep -q 'secrets.env' "$HOME/.zshenv" 2>/dev/null && ok "sourced in .zshenv" || bad "zshenv source" "not sourced"
 for w in cloudflare-mcp; do [ -x "$HOME/.config/agents/bin/$w" ] && ok "wrapper $w" || bad "wrapper $w" "missing"; done
 echo "── deploy ──"; [ -x "$HOME/.config/agents/bin/deploy-auto.sh" ] && ok "deploy-auto.sh" || bad "deploy-auto.sh" "missing"
 echo "── memory ──"; [ -d "$HOME/.claude-mem" ] && ok "claude-mem store" || bad "claude-mem" "missing"
-S="$HOME/.claude/settings.json"
+S="$CDIR/settings.json"
 echo "── parity ──"
 [ -z "${ANTHROPIC_API_KEY:-}" ] && ok "no ANTHROPIC_API_KEY in env" || bad "ANTHROPIC_API_KEY" "set — billing API credits, not the Max sub"
 AS=$(claude auth status 2>/dev/null)
@@ -290,7 +295,7 @@ jq -e '.model=="claude-opus-5[1m]" and .effortLevel=="high" and .fastMode==true'
 jq -e '.skillListingMaxDescChars and .skillListingBudgetFraction and (.skillOverrides|length>0)' "$S" >/dev/null 2>&1 \
   && ok "context caps (skill listing)" || bad "context caps" "drifted"
 # claude-mem auto-updates and will silently revert this async flag.
-CM=$(ls -d "$HOME"/.claude/plugins/cache/thedotmack/claude-mem/*/hooks/hooks.json 2>/dev/null | tail -1)
+CM=$(ls -d "$CDIR"/plugins/cache/thedotmack/claude-mem/*/hooks/hooks.json 2>/dev/null | tail -1)
 if [ -n "$CM" ]; then
   jq -e '[.hooks.UserPromptSubmit[].hooks[].async] | all' "$CM" >/dev/null 2>&1 \
     && ok "claude-mem UserPromptSubmit async" || bad "claude-mem UserPromptSubmit" "sync again (plugin updated) — re-apply"

install.sh

@@ -5,10 +5,10 @@
 # timestamped backup dir first, and it never touches secrets you already have.
 #
 # Lanes it materialises:
-#   ~/.claude/                 hooks, agents, commands, skills, settings
+#   $CLAUDE_CONFIG_DIR, or ~/.claude   hooks, agents, commands, skills, settings
 #   ~/.config/agents/bin/      CLI wrappers (deploy, headless runner, MCP shims, doctor)
 #   ~/.config/agents/shell/    zsh parity wrapper + env snippet, wired into .zshrc/.zshenv
-#   ~/.claude.json             MCP server entries (merged, never clobbered)
+#   .claude.json               MCP server entries (merged, never clobbered)
 #
 # Usage:
 #   ./install.sh                  install the config
@@ -20,6 +20,17 @@
 set -euo pipefail
 
 SRC="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Claude Code reads its user config from $CLAUDE_CONFIG_DIR when that is set, and from
+# ~/.claude otherwise. vstack hardcoded ~/.claude, so anyone running with CLAUDE_CONFIG_DIR
+# pointed elsewhere — VMs, containers, and anyone keeping separate profiles — got a complete,
+# clean-looking install into a directory Claude Code never reads. It failed silently and
+# looked like success, which is the worst way for an installer to be wrong.
+#
+# .claude.json follows the same rule: it sits inside the config dir when one is named, and
+# beside it at ~/.claude.json when it is not.
+CDIR="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
+if [ -n "${CLAUDE_CONFIG_DIR:-}" ]; then CJSON="$CDIR/.claude.json"; else CJSON="$HOME/.claude.json"; fi
 BK="$HOME/.config/agents/backups/install-$(date +%Y%m%d-%H%M%S)"
 DRY=0
 WITH_DEPS=0
@@ -52,17 +63,23 @@ HAVE_JQ=1
 command -v jq >/dev/null || { HAVE_JQ=0; echo "warn: jq not found — settings and MCP merge will be skipped (brew install jq / apt install jq)" >&2; }
 
 if [ "$DRY" = 0 ]; then
-  mkdir -p "$BK" "$HOME/.claude/hooks" "$HOME/.claude/agents" "$HOME/.claude/commands" \
-           "$HOME/.claude/skills" \
+  mkdir -p "$BK" "$CDIR/hooks" "$CDIR/agents" "$CDIR/commands" \
+           "$CDIR/skills" \
            "$HOME/.config/agents/bin" "$HOME/.config/agents/shell"
   chmod 700 "$HOME/.config/agents/backups"
 fi
 # Backups preserve the real path under files/ — the old flat `tr / _` names were a lossy
 # encoding that misparsed any future filename containing an underscore on restore.
 back(){ [ "$DRY" = 1 ] && return 0; [ -f "$1" ] || return 0
-  rel="${1#$HOME/}"
-  mkdir -p "$BK/files/$(dirname "$rel")"
-  cp "$1" "$BK/files/$rel"
+  # Paths under $HOME are stored HOME-relative so uninstall can map them back. A config dir
+  # moved outside $HOME by CLAUDE_CONFIG_DIR has no such relative form, so it is stored under
+  # files_abs/ with its full path and restored to exactly where it came from.
+  case "$1" in
+    "$HOME"/*) rel="${1#$HOME/}"; dest="$BK/files/$rel" ;;
+    *)         dest="$BK/files_abs${1}" ;;
+  esac
+  mkdir -p "$(dirname "$dest")"
+  cp "$1" "$dest"
   return 0
 }
 
@@ -84,20 +101,20 @@ if [ "$DRY" = 0 ] && [ -f "$SRC/.claude/verify.sh" ]; then
 fi
 
 # --- hooks / agents / commands ------------------------------------------------------------
-for f in "$SRC"/claude/hooks/*.sh;    do back "$HOME/.claude/hooks/$(basename "$f")"; run cp "$f" "$HOME/.claude/hooks/"; done
-for f in "$SRC"/claude/agents/*.md;   do back "$HOME/.claude/agents/$(basename "$f")";   run cp "$f" "$HOME/.claude/agents/";   done
-for f in "$SRC"/claude/commands/*.md; do back "$HOME/.claude/commands/$(basename "$f")"; run cp "$f" "$HOME/.claude/commands/"; done
-[ "$DRY" = 0 ] && chmod 755 "$HOME"/.claude/hooks/*.sh
+for f in "$SRC"/claude/hooks/*.sh;    do back "$CDIR/hooks/$(basename "$f")"; run cp "$f" "$CDIR/hooks/"; done
+for f in "$SRC"/claude/agents/*.md;   do back "$CDIR/agents/$(basename "$f")";   run cp "$f" "$CDIR/agents/";   done
+for f in "$SRC"/claude/commands/*.md; do back "$CDIR/commands/$(basename "$f")"; run cp "$f" "$CDIR/commands/"; done
+[ "$DRY" = 0 ] && chmod 755 "$CDIR"/hooks/*.sh
 say "installed  hooks, agents, commands"
 
 # --- global directives + statusline ---------------------------------------------------------
 # CLAUDE.md is the standing instruction file every session reads. It is backed up first: it is
 # the file most likely to have been hand-edited on a machine that has been running a while.
-back "$HOME/.claude/CLAUDE.md"
-run cp "$SRC/claude/CLAUDE.md" "$HOME/.claude/CLAUDE.md"
-back "$HOME/.claude/statusline.sh"
-run cp "$SRC/claude/statusline.sh" "$HOME/.claude/statusline.sh"
-[ "$DRY" = 0 ] && chmod 755 "$HOME/.claude/statusline.sh"
+back "$CDIR/CLAUDE.md"
+run cp "$SRC/claude/CLAUDE.md" "$CDIR/CLAUDE.md"
+back "$CDIR/statusline.sh"
+run cp "$SRC/claude/statusline.sh" "$CDIR/statusline.sh"
+[ "$DRY" = 0 ] && chmod 755 "$CDIR/statusline.sh"
 say "installed  CLAUDE.md, statusline.sh"
 
 # --- conductor user settings ------------------------------------------------------------------
@@ -125,18 +142,18 @@ fi
 for d in "$SRC"/claude/skills/*/; do
   s=$(basename "$d")
   [ "$DRY" = 1 ] && { say "would: install skill $s"; continue; }
-  [ -d "$HOME/.claude/skills/$s" ] && cp -R "$HOME/.claude/skills/$s" "$BK/skills_$s"
-  rm -rf "${HOME:?}/.claude/skills/$s"
+  [ -d "$CDIR/skills/$s" ] && cp -R "$CDIR/skills/$s" "$BK/skills_$s"
+  rm -rf "${CDIR:?}/skills/$s"
   # NB: strip the trailing slash. BSD/macOS `cp -R src/ dest/` copies src CONTENTS into dest,
   # not src itself, which would scatter SKILL.md and references/ across the skills root.
-  cp -R "${d%/}" "$HOME/.claude/skills/"
+  cp -R "${d%/}" "$CDIR/skills/"
 done
 # The licence and the attribution travel with the skills. Shipping LICENSE.pstack alone left
 # the installed tree claiming one origin for skills that actually come from four.
 for meta in LICENSE.pstack ATTRIBUTION.md; do
-  [ -f "$SRC/claude/skills/$meta" ] && run cp "$SRC/claude/skills/$meta" "$HOME/.claude/skills/"
+  [ -f "$SRC/claude/skills/$meta" ] && run cp "$SRC/claude/skills/$meta" "$CDIR/skills/"
 done
-[ "$DRY" = 0 ] && find "$HOME/.claude/skills" -name "*.sh" -exec chmod 755 {} + 2>/dev/null
+[ "$DRY" = 0 ] && find "$CDIR/skills" -name "*.sh" -exec chmod 755 {} + 2>/dev/null
 say "installed  skills ($(find "$SRC"/claude/skills -maxdepth 1 -mindepth 1 -type d | wc -l | tr -d ' '))"
 
 # --- agent bin ----------------------------------------------------------------------------
@@ -188,7 +205,7 @@ fi
 #     git show "${s}:claude/settings.json" | jq -r 'keys[]'; done | sort -u
 # that the key appears there and not in the current file. Check 21 enforces exactly that.
 RETIRED='[]'
-US="$HOME/.claude/settings.json"; back "$US"
+US="$CDIR/settings.json"; back "$US"
 [ -f "$US" ] || { [ "$DRY" = 0 ] && echo '{}' > "$US"; }
 if [ "$DRY" = 0 ] && [ "$HAVE_JQ" = 0 ]; then
   # No jq: never hand-merge JSON. Write the portable settings only when there is nothing
@@ -201,7 +218,7 @@ if [ "$DRY" = 0 ] && [ "$HAVE_JQ" = 0 ]; then
   fi
 elif [ "$DRY" = 0 ]; then
   tmp=$(mktemp)
-  jq -s --arg h "$HOME/.claude/hooks" --argjson retired "$RETIRED" '
+  jq -s --arg h "$CDIR/hooks" --argjson retired "$RETIRED" '
     ((.[1] | del(.hooks)) as $portable
       | (.[0] * $portable)
       | .skillOverrides = ($portable.skillOverrides // {})
@@ -235,7 +252,7 @@ fi
 # --- MCP servers ---------------------------------------------------------------------------
 # Merged into the GLOBAL mcpServers map. Ours win on key collision; anything else you have
 # configured is preserved. Project-scoped servers stay yours to add (see mcp/README).
-CJ="$HOME/.claude.json"
+CJ="$CJSON"
 if [ "$HAVE_JQ" = 0 ]; then
   say "skipped    MCP merge (no jq)"
 elif [ -f "$CJ" ] && [ "$DRY" = 0 ]; then
@@ -246,9 +263,9 @@ elif [ -f "$CJ" ] && [ "$DRY" = 0 ]; then
      "$CJ" "$tmp.servers" > "$tmp"
   jq -e . "$tmp" >/dev/null && cat "$tmp" > "$CJ"
   rm -f "$tmp" "$tmp.servers"
-  say "merged     MCP servers into ~/.claude.json"
+  say "merged     MCP servers into $CJSON"
 else
-  say "skipped    MCP merge (no ~/.claude.json yet — run claude once, then re-run this)"
+  say "skipped    MCP merge (no $CJSON yet — run claude once, then re-run this)"
 fi
 
 # --- shell lane ----------------------------------------------------------------------------
@@ -264,7 +281,36 @@ fi
 if [ "$DRY" = 0 ] && ! grep -q 'agents/secrets.env' "$HOME/.zshenv" 2>/dev/null; then
   printf '\n[ -f "$HOME/.config/agents/secrets.env" ] && set -a && . "$HOME/.config/agents/secrets.env" && set +a\n' >> "$HOME/.zshenv"
 fi
-say "installed  shell lane (.zshrc, .zshenv)"
+
+# bash gets the same environment. The wrapper does not travel — claude-parity.zsh is written
+# in zsh (whence -p, print -r, local -a) and cannot be sourced by bash — but the env snippet
+# and the secrets line are plain POSIX exports, and they are the part that actually changes
+# behaviour: the 1h prompt cache, tool concurrency, streaming, task support.
+#
+# Only zsh users got any of it, which meant a default Debian, Ubuntu or Alpine box — every
+# cloud VM and nearly every container — installed cleanly and then ran with none of it. Both
+# rc files are written when both shells are present, because a machine can have both.
+SHELL_LANES=".zshrc, .zshenv"
+if [ "$DRY" = 0 ]; then
+  for rc in .bashrc .profile; do
+    # .profile only when there is no .bashrc: writing both double-exports on login shells.
+    [ "$rc" = .profile ] && [ -f "$HOME/.bashrc" ] && continue
+    [ "$rc" = .bashrc ] || [ -f "$HOME/$rc" ] || [ -n "${BASH_VERSION:-}" ] || continue
+    back "$HOME/$rc"
+    if ! grep -q '>>> claude-parity env >>>' "$HOME/$rc" 2>/dev/null; then
+      cat "$SRC/shell/zshenv.snippet" >> "$HOME/$rc"
+      SHELL_LANES="$SHELL_LANES, $rc"
+    fi
+    if ! grep -q 'agents/secrets.env' "$HOME/$rc" 2>/dev/null; then
+      printf '\n[ -f "$HOME/.config/agents/secrets.env" ] && set -a && . "$HOME/.config/agents/secrets.env" && set +a\n' >> "$HOME/$rc"
+    fi
+  done
+  case "${SHELL:-}" in
+    *zsh) ;;
+    *) say "note       the claude wrapper is zsh-only; \$SHELL is ${SHELL:-unset}, so you get the env lane without it" ;;
+  esac
+fi
+say "installed  shell lane ($SHELL_LANES)"
 
 # --- verify ----------------------------------------------------------------------------------
 say ""