fix: write log file to ~/.tero instead of /tmp

- Move log file from /tmp/tero.log to ~/.tero/environments/{env}/tero.log
  to avoid permission errors when multiple users share /tmp
- Gracefully fall back to no-op logger instead of panicking on file errors
- Truncate log file at session start if it exceeds 5MB
- Update doc references in CLAUDE.md, AGENTS.md, Taskfile.yml, .envrc

Author: binarylogic

.envrc

@@ -26,7 +26,7 @@ export WORKOS_CLIENT_ID="client_01JQCC2CJMTB8AY2JRMZXFY9R1"
 # Set to "true" to automatically transition from onboarding complete screen to app
 export TERO_SKIP_TO_APP="true"
 
-# Development: Enable debug logging (logs written to /tmp/tero.log)
+# Development: Enable debug logging (logs written to ~/.tero/environments/{env}/tero.log)
 export TERO_DEBUG="true"
 
 # Load local overrides if they exist

AGENTS.md

@@ -53,5 +53,5 @@ internal/auth/       Authentication.
 ```bash
 task do              # Format, lint, test - run before commits
 task run             # Fast iteration
-tail -f /tmp/tero.log  # Watch logs
+tail -f ~/.tero/environments/prd/tero.log  # Watch logs
 ```

Taskfile.yml

@@ -217,7 +217,7 @@ tasks:
     desc: Reset dev environment (auth, config, database, logs)
     cmds:
       - go run ./cmd/tero reset --db
-      - rm -f /tmp/tero.log
+      - rm -f ~/.tero/environments/*/tero.log
       - echo "Reset complete"
 
   # ===========================================================================

internal/cmd/execute.go

@@ -19,7 +19,7 @@ func Execute(version string) {
 		level = log.LevelDebug
 	}
 
-	scope := log.RootScope(log.New(level))
+	scope := log.RootScope(log.New(cliConfig.Environment(), level))
 
 	defer func() {
 		if r := recover(); r != nil {

internal/log/logger.go

@@ -1,8 +1,10 @@
 package log
 
 import (
+	"io"
 	"log/slog"
 	"os"
+	"path/filepath"
 )
 
 // Re-export slog attribute constructors so callers don't need to import log/slog
@@ -53,12 +55,39 @@ func Wrap(l *slog.Logger) Logger {
 	return &logger{l}
 }
 
-// New creates a new logger that writes to /tmp/tero.log
+// LogPath returns the log file path for the given environment.
+func LogPath(env string) (string, error) {
+	homeDir, err := os.UserHomeDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(homeDir, ".tero", "environments", env, "tero.log"), nil
+}
+
+const maxLogSize = 5 * 1024 * 1024 // 5MB
+
+// New creates a new logger that writes to ~/.tero/environments/{env}/tero.log.
 // Appends to existing log file, with a clear session separator.
-func New(level Level) Logger {
-	logFile, err := os.OpenFile("/tmp/tero.log", os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0644)
+// Truncates the file at session start if it exceeds 5MB.
+// Falls back to a no-op logger if the log file cannot be opened.
+func New(env string, level Level) Logger {
+	logPath, err := LogPath(env)
+	if err != nil {
+		return &logger{slog.New(slog.NewTextHandler(io.Discard, nil))}
+	}
+
+	if err := os.MkdirAll(filepath.Dir(logPath), 0o755); err != nil {
+		return &logger{slog.New(slog.NewTextHandler(io.Discard, nil))}
+	}
+
+	// Truncate if over size limit before opening for append.
+	if info, err := os.Stat(logPath); err == nil && info.Size() > maxLogSize {
+		_ = os.Truncate(logPath, 0)
+	}
+
+	logFile, err := os.OpenFile(logPath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644)
 	if err != nil {
-		panic(err)
+		return &logger{slog.New(slog.NewTextHandler(io.Discard, nil))}
 	}
 
 	// Write session separator (ignore errors - best effort logging)