* Rename .claude paths to .openclaude
* test: update skill watcher paths for openclaude
* fix: preserve default secure storage key
Co-authored-by: Cursor <cursoragent@cursor.com>
* chore: address config isolation review comments
* fix: canonicalize secure storage config paths
* test: isolate secure storage config override
* Fix keychain service name config dir handling
Update macOS keychain service naming to honor `OPENCLAUDE_CONFIG_DIR` by resolving the env override directly before falling back to the default config home lookup. Adjust secure storage platform tests to import `envUtils` and keychain helpers dynamically with the same module suffix and restore module mocks correctly, keeping test state isolated and consistent.
* Align diagnostics and keychain with OpenClaude
Updates several utilities to use OpenClaude defaults and naming consistently. Doctor diagnostics now always checks a package name (falling back to `@gitlawb/openclaude`), macOS secure storage service names and related tests now use `OpenClaude`, and keychain prefetch docs were updated to match. This also removes an unused `homeDir` option from local install dir candidates and treats `.claude.json` as a dangerous filesystem target.
* Fix doctor npm uninstall package fallback
Update doctor diagnostics to generate npm global uninstall guidance using a single package-name variable. When `MACRO.PACKAGE_URL` is not set, it now falls back to `@gitlawb/openclaude` instead of `openclaude`, so the suggested cleanup command matches the scoped package install.
* Protect legacy .claude paths from writes
Add .claude to DANGEROUS_DIRECTORIES and sandbox denyWrite lists, extend isClaudeSettingsPath to cover legacy .claude/settings.json paths, and update README to clarify CLAUDE_CONFIG_DIR is not used for background-session storage.
* Protect custom Claude config dir from sandbox writes
* Protect legacy Claude config roots
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
