Mike Swanson
430c99a76a
1. Variable name collision: VAULT_PATH was used for both the SOPS file relative path (set by case statement) and the vault root override env var. Renamed env var override to VAULT_ROOT_ENV to avoid collision. 2. Wrong directory depth: CLAUDETOOLS_ROOT was navigating 3 levels up from scripts/ landing at .claude/ instead of repo root. Fixed to 4 levels (scripts -> remediation-tool -> skills -> .claude -> repo root). Also added jq as primary vault_path reader (handles Unix paths on Windows), with cygpath-converted Python fallback. Bugs discovered during Mac testing 2026-04-21. Windows worked only because tokens were served from /tmp cache after first acquisition. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>