chore: move appdata folder to .claudeDo

src/ClaudeDo.Worker/CLAUDE.md

@@ -129,7 +129,7 @@ Full flow, invariants, and model/effort/max-turns resolution (including the low-
 - **WorktreeManager** — worktrees on `claudedo/{taskId[:8]}` branches; commits with semantic messages, updates DB with head commit + diff stats
 - **CommitMessageBuilder** — `{commitType}(slug): title\n\ndescription\n\nClaudeDo-Task: taskId`; `BuildMerge` is the merge-commit variant (`{commitType}(slug): merge title` + trailer). **Every merge caller passes a blank commit message on purpose** — `TaskMergeService` fills in `BuildMerge` from the task's commit type and its list's name, which is the only place that knows both. Don't reintroduce a caller-side literal.
 - **TaskResetService** — discards a failed task's worktree, resets the row to Idle, preserves run history
-- **AgentFileService** — manages `~/.todo-app/agents/*.md`; list/refresh via SignalR
+- **AgentFileService** — manages `~/.claudeDo/agents/*.md`; list/refresh via SignalR
 - **LogWriter** — async StreamWriter wrapper, auto-creates parent dirs
 
 Each CLI invocation is recorded in `task_runs` via `TaskRunRepository`. ⚠️ Token fields come from
@@ -240,14 +240,14 @@ non-obvious, behaviour-changing. A fixed bug is git history, not a finding.
 
 ## Config
 
-`~/.todo-app/worker.config.json`:
+`~/.claudeDo/worker.config.json`:
 
 - `db_path`, `sandbox_root`, `log_root`
 - `worktree_root_strategy` (`sibling` | `central`), `central_worktree_root`
 - `queue_backstop_interval_ms` (30000) — also the gate/throttle recovery timer
 - `signalr_port` (47821), `claude_bin`
 - `usage_poll_interval_seconds` (60, clamped to min 15 on load)
-- `online_inbox` — `enabled` (false by default; when false the entire `Online/` stack is not registered), `api_base_url` (must be HTTPS or loopback, validated at startup), `poll_interval_seconds` (60), `zitadel.authority`/`client_id`/`scopes`. The refresh token is **not** in this file — DPAPI-encrypted at `~/.todo-app/online-inbox.token`.
+- `online_inbox` — `enabled` (false by default; when false the entire `Online/` stack is not registered), `api_base_url` (must be HTTPS or loopback, validated at startup), `poll_interval_seconds` (60), `zitadel.authority`/`client_id`/`scopes`. The refresh token is **not** in this file — DPAPI-encrypted at `~/.claudeDo/online-inbox.token`.
 
 Per-list config (`list_config` in DB) provides defaults for `model`, `system_prompt`,
 `agent_path`, `max_turns`, `session_skills`; tasks override each individually. `verify_command` is

src/ClaudeDo.Worker/Config/WorkerConfig.cs

@@ -9,20 +9,20 @@ namespace ClaudeDo.Worker.Config;
 public sealed class WorkerConfig
 {
     [JsonPropertyName("db_path")]
-    public string DbPath { get; set; } = "~/.todo-app/todo.db";
+    public string DbPath { get; set; } = "~/.claudeDo/todo.db";
 
     [JsonPropertyName("sandbox_root")]
-    public string SandboxRoot { get; set; } = "~/.todo-app/sandbox";
+    public string SandboxRoot { get; set; } = "~/.claudeDo/sandbox";
 
     [JsonPropertyName("log_root")]
-    public string LogRoot { get; set; } = "~/.todo-app/logs";
+    public string LogRoot { get; set; } = "~/.claudeDo/logs";
 
     /// <summary>"sibling" → place worktrees next to the target repo; "central" → under <see cref="CentralWorktreeRoot"/>.</summary>
     [JsonPropertyName("worktree_root_strategy")]
     public string WorktreeRootStrategy { get; set; } = "sibling";
 
     [JsonPropertyName("central_worktree_root")]
-    public string CentralWorktreeRoot { get; set; } = "~/.todo-app/worktrees";
+    public string CentralWorktreeRoot { get; set; } = "~/.claudeDo/worktrees";
 
     [JsonPropertyName("queue_backstop_interval_ms")]
     public int QueueBackstopIntervalMs { get; set; } = 30_000;

src/ClaudeDo.Worker/Online/OnlineTokenStore.cs

@@ -7,7 +7,7 @@ namespace ClaudeDo.Worker.Online;
 
 /// <summary>
 /// Persists the Zitadel refresh token encrypted with DPAPI (CurrentUser scope).
-/// Windows-only; the file lives at ~/.todo-app/online-inbox.token.
+/// Windows-only; the file lives at ~/.claudeDo/online-inbox.token.
 /// </summary>
 [SupportedOSPlatform("windows")]
 public sealed class OnlineTokenStore

src/ClaudeDo.Worker/Planning/PlanningSessionManager.cs

@@ -382,7 +382,7 @@ public sealed class PlanningSessionManager
         await File.WriteAllTextAsync(path, token, ct);
         // Best-effort current-user-only ACL on Windows. On non-Windows the inherited
         // perms from the parent dir apply; acceptable because sessionDir is already
-        // under the user's home (~/.todo-app/sessions/).
+        // under the user's home (~/.claudeDo/sessions/).
         if (OperatingSystem.IsWindows())
         {
             try

src/ClaudeDo.Worker/Planning/WindowsTerminalLauncher.cs

@@ -8,7 +8,7 @@
 //   wt.exe treats ';' as a tab/command delimiter in EVERY argument, regardless of
 //   quoting (microsoft/terminal#13264), so nothing containing ';' may appear on the wt
 //   command line. Every token we place there is a controlled constant or a filesystem
-//   path under ~/.todo-app/sessions/<taskId> — none can contain ';' — and each is
+//   path under ~/.claudeDo/sessions/<taskId> — none can contain ';' — and each is
 //   single-quoted for PowerShell.
 //
 //   The free-text task brief is NEVER passed as an argument. An interactive `claude`

src/ClaudeDo.Worker/Program.cs

@@ -36,6 +36,8 @@ var mutex = new Mutex(true, @"Local\ClaudeDoWorker", out var createdNew);
 if (!createdNew)
     return; // another instance already owns the port; exit 0
 
+Paths.MigrateLegacyAppDataRoot();
+
 var cfg = WorkerConfig.Load();
 
 var builder = WebApplication.CreateBuilder(args);
@@ -171,9 +173,7 @@ builder.Services.AddSingleton<QueueService>();
 builder.Services.AddHostedService(sp => sp.GetRequiredService<QueueService>());
 
 // Planning session services.
-var planningSessionsDir = Path.Combine(
-    Environment.GetFolderPath(Environment.SpecialFolder.UserProfile),
-    ".todo-app", "planning-sessions");
+var planningSessionsDir = Path.Combine(Paths.AppDataRoot(), "planning-sessions");
 builder.Services.AddSingleton(sp =>
     new PlanningSessionManager(
         sp.GetRequiredService<IDbContextFactory<ClaudeDoDbContext>>(),

src/ClaudeDo.Worker/Runner/InteractiveLaunchSpecService.cs

@@ -261,7 +261,7 @@ public sealed class InteractiveLaunchSpecService
 
     /// <summary>Builds a LaunchSpec for an embedded ConPTY "merge helper" session that drives the
     /// given tasks to a merged/Done state via the mcp__claudedo__* tools. Writes a per-session
-    /// system prompt + task brief under ~/.todo-app/merge-helper-sessions/&lt;guid&gt; and exposes
+    /// system prompt + task brief under ~/.claudeDo/merge-helper-sessions/&lt;guid&gt; and exposes
     /// that dir plus the list's repo dir via --add-dir. cwd is the list's working directory.
     /// handlerTaskId (the id returned by CreateMergeHelperTaskAsync) is rendered into the brief so
     /// the session can call handoff_list_handler/submit_task_for_review on its own handler task.