feat(selfserve): scope-aware config/identity paths, user settings merge, version fallback

[michiosw]

What & why

Foundations for self-serve on the CLI side (ENG-442) — the changes that let one binary serve both an MDM-managed Mac and a self-serve one, with enterprise behaviour byte-identical. No user-facing command yet; that's #277.

• Scope-aware config + identity paths. managedconfig.ResolvePath() resolves env override > system /Library (if present) > user ~/Library, and Load() records the Scope. System (MDM) config always wins; an invalid system file is an error, never a silent fall-through to user scope. Installation identity follows the same scope so a user config reads a user installation.json, never the MDM one.
• ~/.claude/settings.json hooks merge (internal/claudemanaged/usersettings.go): remove-ours-then-append-canonical per event, operating on map[string]any so all foreign content survives. Ownership is the shared IsManagedHookCommand predicate (disjoint from Guard hooks). Writes preserve the existing file mode, create new files 0600, and back up first.
• cli-<version> deployment-version fallback reported to the ledger when no MDM package marker exists (self-serve brew installs).

How to review / test — pure Go, nothing to install

go build ./... && go vet ./... && go test ./...

The behaviour is fully covered by unit tests — no real filesystem-of-record, keychain, or daemon needed:

• managedconfig/config_test.go: the env/system/user resolution matrix incl. invalid-system-no-fall-through.
• installation/state_test.go: scope-derived identity path.
• claudemanaged/usersettings_test.go: foreign-content preservation, stale-path replacement, Guard hooks left untouched, idempotency, malformed JSON, mode preservation.

Risk

The enterprise default path is unchanged: with no env override and a system /Library config present, resolution and the installation path are identical to pre-self-serve. Only the new user-scope branch is added.

Part of the ENG-442 kontext-cli stack: #276 -> #277 -> #278.

[michiosw]

• fix(selfserve): harden managed observe cli readiness #286
• feat(observe): surface revoked install tokens; doctor managed-observe section #278
• feat(setup): kontext setup / --uninstall for self-serve managed observe #277
• feat(selfserve): scope-aware config/identity paths, user settings merge, version fallback #276 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Greptile Summary

This PR adds self-serve managed-observe foundations while keeping the existing enterprise path intact. It changes:

• Adds scope-aware managed config resolution across env, system, and user locations.
• Ties installation identity storage to the resolved config scope.
• Adds user-level Claude settings merge, backup, and removal helpers for managed hooks.
• Reports a CLI-version fallback when no MDM deployment marker exists.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

_{Reviews (3): Last reviewed commit: "feat(selfserve): scope-aware config/iden..." | Re-trigger Greptile}

[michiosw]

@greptileai

[michiosw]

@greptileai