@sechroom/cli 2026.6.140-rc.176770e1 → 2026.6.141-rc.6cc560b2

package/dist/index.js

@@ -2859,9 +2859,9 @@ auto-resumes where you left off and checkpoints working state before compacting.
 }
 
 // src/setup/skills-offer.ts
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join5 } from "path";
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join6 } from "path";
 
 // src/setup/lane-pin.ts
 var CODE_LANE_PREFIX_BY_CLIENT = {
@@ -2981,6 +2981,34 @@ function resolveSkills(systemRows, personalRows, surface) {
   return [...merged.values()].sort((a, b) => a.name.localeCompare(b.name));
 }
 
+// src/setup/skills-lock.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join5 } from "path";
+var SKILLS_LOCK = ".sechroom-skills.json";
+var DEFAULT_SKILLS_SLUG = "operator-skills";
+function skillsDir(global) {
+  return global ? join5(homedir5(), ".claude", "skills") : join5(process.cwd(), ".claude", "skills");
+}
+function readSkillsLock(dir) {
+  const lockPath = join5(dir, SKILLS_LOCK);
+  if (!existsSync6(lockPath)) return {};
+  try {
+    return JSON.parse(readFileSync5(lockPath, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function writeSkillsLock(dir, lock) {
+  mkdirSync5(dir, { recursive: true });
+  writeFileSync5(join5(dir, SKILLS_LOCK), JSON.stringify(lock, null, 2) + "\n");
+}
+function recordMaterialisedSkills(dir, slug, skills, meta = {}) {
+  const lock = readSkillsLock(dir);
+  lock[slug] = { surface: meta.surface, skills: [...skills].sort() };
+  writeSkillsLock(dir, lock);
+}
+
 // src/setup/skills-offer.ts
 async function fetchFeedRows(cfg, workspaceId) {
   try {
@@ -3020,18 +3048,19 @@ Would materialise ${style.bold(String(resolved.length))} operator skill(s) for $
 Found ${style.bold(String(names.length))} operator skill(s) available to you: ${names.join(", ")}.
 `
   );
-  const dir = join5(homedir5(), ".claude", "skills");
+  const dir = join6(homedir6(), ".claude", "skills");
   const materialise = opts.yes ? true : canPrompt() ? await promptYesNo(`Write them to ${dir}/ so ${surface} can use them?`) : false;
   if (!materialise) return;
   const written = [];
   for (const s of resolved) {
-    mkdirSync5(join5(dir, s.name), { recursive: true });
-    writeFileSync5(
-      join5(dir, s.name, "SKILL.md"),
+    mkdirSync6(join6(dir, s.name), { recursive: true });
+    writeFileSync6(
+      join6(dir, s.name, "SKILL.md"),
       s.body.endsWith("\n") ? s.body : s.body + "\n"
     );
     written.push(s.name);
   }
+  recordMaterialisedSkills(dir, DEFAULT_SKILLS_SLUG, written, { surface });
   process.stderr.write(
     `${style.green("\u2713")} wrote ${written.length} skill(s) to ${dir}
 `
@@ -3191,13 +3220,13 @@ async function runClients(clients, cmd, opts) {
 }
 
 // src/commands/onboard.ts
-import { existsSync as existsSync7 } from "fs";
-import { basename as basename3, join as join7 } from "path";
+import { existsSync as existsSync8 } from "fs";
+import { basename as basename3, join as join8 } from "path";
 
 // src/commands/fanout.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync5, readdirSync, statSync } from "fs";
-import { isAbsolute, join as join6, resolve } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync6, readdirSync, statSync } from "fs";
+import { isAbsolute, join as join7, resolve } from "path";
 var ICON = {
   refresh: "\u21BB",
   bind: "+",
@@ -3217,21 +3246,21 @@ function discoverChildren(root) {
   const out = [];
   for (const name of names.sort()) {
     if (name.startsWith(".") || name === "node_modules") continue;
-    const dir = join6(root, name);
+    const dir = join7(root, name);
     try {
       if (!statSync(dir).isDirectory()) continue;
     } catch {
       continue;
     }
-    if (existsSync6(join6(dir, ".git")) || committedBindingPath(dir)) out.push(name);
+    if (existsSync7(join7(dir, ".git")) || committedBindingPath(dir)) out.push(name);
   }
   return out;
 }
 function readManifest(path) {
-  if (!existsSync6(path)) return null;
+  if (!existsSync7(path)) return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync5(path, "utf8"));
+    parsed = JSON.parse(readFileSync6(path, "utf8"));
   } catch (err2) {
     throw new Error(`couldn't parse ${path}: ${err2 instanceof Error ? err2.message : String(err2)}`);
   }
@@ -3596,10 +3625,10 @@ async function chooseClients(clientFlag, yes, cwd) {
 }
 async function planRecurseChild(entry, root, client, opts) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync7(dir)) {
+  if (!existsSync8(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
-  if (existsSync7(join7(dir, ".sechroom.json"))) {
+  if (existsSync8(join8(dir, ".sechroom.json"))) {
     return {
       label: entry.path,
       dir,
@@ -3672,7 +3701,7 @@ This fan-out will pin the same lane in every repo:
 async function runRecurse(cfg, g, opts) {
   const { yes, dryRun, json } = opts;
   const root = process.cwd();
-  const manifestPath = join7(root, ".sechroom", "repos.json");
+  const manifestPath = join8(root, ".sechroom", "repos.json");
   const fromManifest = readManifest(manifestPath);
   const entries = fromManifest ?? discoverChildren(root).map((path) => ({ path }));
   const sourceLabel = fromManifest ? `manifest ${manifestPath}` : `auto-discovered under ${root}`;
@@ -3886,12 +3915,12 @@ async function printStarterPrompt(mode, cfg) {
 }
 
 // src/commands/sweep.ts
-import { existsSync as existsSync8 } from "fs";
-import { dirname as dirname6, join as join8, resolve as resolve2 } from "path";
-var DEFAULT_MANIFEST = join8(".sechroom", "repos.json");
+import { existsSync as existsSync9 } from "fs";
+import { dirname as dirname6, join as join9, resolve as resolve2 } from "path";
+var DEFAULT_MANIFEST = join9(".sechroom", "repos.json");
 function planEntry(entry, root) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync8(dir)) {
+  if (!existsSync9(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
   if (committedBindingPath(dir)) {
@@ -3985,106 +4014,21 @@ Examples:
 }
 
 // src/commands/skills.ts
-import { homedir as homedir6 } from "os";
-import { join as join9 } from "path";
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, rmSync as rmSync2, existsSync as existsSync9, readFileSync as readFileSync6 } from "fs";
-var DEFAULT_SLUG = "operator-skills";
-var ROLE_TAGS = ["sechroom:role:skill-template", "role:skill-template"];
-var LOCK = ".sechroom-skills.json";
-function skillsDir(global) {
-  return global ? join9(homedir6(), ".claude", "skills") : join9(process.cwd(), ".claude", "skills");
-}
-function tagValue2(tags, prefix) {
-  return (tags ?? []).find((t) => t.startsWith(prefix))?.slice(prefix.length);
-}
-function hasAny(tags, candidates) {
-  return (tags ?? []).some((t) => candidates.includes(t));
-}
+import { join as join10 } from "path";
+import { existsSync as existsSync10, rmSync as rmSync2 } from "fs";
 function registerSkills(program2) {
-  const skills = program2.command("skills").description("Install + manage operator skills from a bundle");
+  const skills = program2.command("skills").description("Manage operator skills (materialised by `onboard`)");
   skills.addHelpText(
     "after",
     `
 Examples:
-  $ sechroom skills install --code-lane claude-code-chris --design-lane claude-design-chris
-  $ sechroom skills install operator-skills --surface claude-code --local
   $ sechroom skills list
   $ sechroom skills set-lane --code-lane claude-code-chris --design-lane claude-design-chris
   $ sechroom skills lane
-  $ sechroom skills clean`
+  $ sechroom skills clean
+
+To install/refresh skills, run 'sechroom onboard' (it offers to materialise them).`
   );
-  skills.command("install [slug]").description(`Install a skills bundle (default ${DEFAULT_SLUG}) into your personal workspace + write SKILL.md files`).option("--version <v>", "bundle version (default: latest published in the catalogue)").option("--instance <name>", "install as a named, separate instance (install the same bundle more than once)").option("--code-lane <id>", "identity.code-lane binding (e.g. claude-code-chris)").option("--design-lane <id>", "identity.design-lane binding (e.g. claude-design-chris)").option("--surface <s>", "skill target surface to materialise", "claude-code").option("--local", "write to ./.claude/skills instead of ~/.claude/skills").option("--json", "machine output").action(async (slugArg, opts, cmd) => {
-    const slug = slugArg || DEFAULT_SLUG;
-    const client = await makeClient(resolveConfig(cmd.optsWithGlobals()));
-    const pw = await runApi("resolving personal workspace", () => client.GET("/me/personal-workspace", {}));
-    const personalWsId = pw?.id || pw?.workspaceId || pw?.personalWorkspaceId || pw?.item?.id;
-    if (!personalWsId) fail("Could not resolve your personal workspace.");
-    let version = opts.version;
-    if (!version) {
-      const cat = await runApi("reading the bundle catalogue", () => client.GET("/me/bundles", {}));
-      const item = (cat?.bundles ?? cat?.Bundles ?? []).find((b) => (b.slug ?? b.Slug) === slug);
-      if (!item) fail(`Bundle '${slug}' is not in your self-serve catalogue (must be UserInstallable + Published).`);
-      version = item.latestVersion ?? item.LatestVersion;
-      if (!version) fail(`Bundle '${slug}' has no installable (Published) version.`);
-    }
-    const installOptions = {};
-    if (opts.codeLane) installOptions["identity.code-lane"] = opts.codeLane;
-    if (opts.designLane) installOptions["identity.design-lane"] = opts.designLane;
-    const res = await runApi(
-      `installing ${slug}@${version}${opts.instance ? ` (${opts.instance})` : ""}`,
-      () => client.POST("/me/bundles/{slug}/versions/{version}/install", {
-        params: { path: { slug, version } },
-        // instance: null/absent = the default instance (reinstall updates in
-        // place); a name installs a separate instance.
-        body: { installOptions, instance: opts.instance ?? null }
-      })
-    );
-    const status = String(res?.status ?? res?.Status ?? "");
-    if (status && status.toLowerCase() !== "completed") {
-      fail(`Install did not complete (status=${status}; ${res?.failureReason ?? res?.FailureReason ?? ""}).`);
-    }
-    const feed = await runApi(
-      "materialising skill files",
-      () => client.GET("/workspaces/{workspaceId}/memories/feed", {
-        // cascadeWorkspaces: skills land in an "Operator Skills" SUB-workspace of
-        // the personal workspace, so we recurse from the personal-ws root.
-        // includeText: the feed omits bodies by default; we need them for SKILL.md.
-        params: {
-          path: { workspaceId: personalWsId },
-          query: { limit: 200, cascadeWorkspaces: true, includeText: true }
-        }
-      })
-    );
-    const rows = feed?.results ?? feed?.Results ?? [];
-    const dir = skillsDir(!opts.local);
-    const wantInstance = opts.instance || "default";
-    const written = [];
-    const bundleTagPrefix = `sechroom:bundle:${slug}@`;
-    for (const r of rows) {
-      const m = r.item ?? r;
-      const tags = m.tags ?? m.Tags ?? [];
-      if (!hasAny(tags, ROLE_TAGS)) continue;
-      if (tagValue2(tags, "target:") !== opts.surface) continue;
-      if (!tags.some((t) => t.startsWith(bundleTagPrefix))) continue;
-      if ((tagValue2(tags, "sechroom:skill-instance:") ?? "default") !== wantInstance) continue;
-      const name = tagValue2(tags, "skill:");
-      if (!name) continue;
-      const body = m.text ?? m.Text ?? "";
-      mkdirSync6(join9(dir, name), { recursive: true });
-      writeFileSync6(join9(dir, name, "SKILL.md"), body.endsWith("\n") ? body : body + "\n");
-      written.push(name);
-    }
-    mkdirSync6(dir, { recursive: true });
-    const lockPath = join9(dir, LOCK);
-    const lock = existsSync9(lockPath) ? JSON.parse(readFileSync6(lockPath, "utf8")) : {};
-    lock[slug] = { surface: opts.surface, version, instance: wantInstance, skills: written.sort() };
-    writeFileSync6(lockPath, JSON.stringify(lock, null, 2) + "\n");
-    if (opts.json) return emit({ slug, version, instance: wantInstance, surface: opts.surface, dir, installed: written }, true);
-    const instanceNote = opts.instance ? ` (${opts.instance})` : "";
-    console.log(style.green(`Installed ${slug}@${version}${instanceNote} \u2014 ${written.length} skill(s) \u2192 ${dir}`));
-    written.forEach((n) => console.log("  " + style.dim("\u2022") + " " + n));
-    if (written.length === 0) console.log(style.dim(`  (no '${opts.surface}' skill bodies found; check --surface)`));
-  });
   skills.command("list").description("List your installed bundles (GET /me/bundle-installs)").option("--json", "machine output").action(async (opts, cmd) => {
     const client = await makeClient(resolveConfig(cmd.optsWithGlobals()));
     const data = await runApi("reading your installs", () => client.GET("/me/bundle-installs", {}));
@@ -4097,24 +4041,22 @@ Examples:
       console.log(`  ${i.bundleSlug ?? i.BundleSlug}@${i.bundleVersion ?? i.BundleVersion ?? "?"}${tag}`);
     });
   });
-  skills.command("clean [slug]").description(`Remove materialised skill files written by install (default ${DEFAULT_SLUG})`).option("--local", "clean ./.claude/skills instead of ~/.claude/skills").option("--json", "machine output").action(async (slugArg, opts) => {
-    const slug = slugArg || DEFAULT_SLUG;
+  skills.command("clean [slug]").description(`Remove skill files materialised by onboard (default ${DEFAULT_SKILLS_SLUG})`).option("--local", "clean ./.claude/skills instead of ~/.claude/skills").option("--json", "machine output").action(async (slugArg, opts) => {
+    const slug = slugArg || DEFAULT_SKILLS_SLUG;
     const dir = skillsDir(!opts.local);
-    const lockPath = join9(dir, LOCK);
-    if (!existsSync9(lockPath)) fail(`No skills lockfile at ${lockPath}; nothing to clean.`);
-    const lock = JSON.parse(readFileSync6(lockPath, "utf8"));
+    const lock = readSkillsLock(dir);
     const entry = lock[slug];
-    if (!entry) fail(`No installed record for '${slug}' in ${lockPath}.`);
+    if (!entry) fail(`No materialised skills recorded for '${slug}' in ${join10(dir, SKILLS_LOCK)}.`);
     const removed = [];
     for (const name of entry.skills) {
-      const skillPath = join9(dir, name);
-      if (existsSync9(skillPath)) {
+      const skillPath = join10(dir, name);
+      if (existsSync10(skillPath)) {
         rmSync2(skillPath, { recursive: true, force: true });
         removed.push(name);
       }
     }
     delete lock[slug];
-    writeFileSync6(lockPath, JSON.stringify(lock, null, 2) + "\n");
+    writeSkillsLock(dir, lock);
     if (opts.json) return emit({ slug, removed, dir }, true);
     console.log(style.green(`Removed ${removed.length} skill(s) for ${slug} from ${dir}`));
   });
@@ -4204,21 +4146,21 @@ Examples:
 
 // src/commands/reset.ts
 import { homedir as homedir7 } from "os";
-import { join as join10 } from "path";
-import { existsSync as existsSync10, readFileSync as readFileSync7, rmSync as rmSync3 } from "fs";
-var SKILLS_LOCK = ".sechroom-skills.json";
-var localSkillsDir = () => join10(process.cwd(), ".claude", "skills");
-var globalSkillsDir = () => join10(homedir7(), ".claude", "skills");
+import { join as join11 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync7, rmSync as rmSync3 } from "fs";
+var SKILLS_LOCK2 = ".sechroom-skills.json";
+var localSkillsDir = () => join11(process.cwd(), ".claude", "skills");
+var globalSkillsDir = () => join11(homedir7(), ".claude", "skills");
 function removeMaterialisedSkills(dir) {
   const removed = [];
-  const lockPath = join10(dir, SKILLS_LOCK);
-  if (!existsSync10(lockPath)) return removed;
+  const lockPath = join11(dir, SKILLS_LOCK2);
+  if (!existsSync11(lockPath)) return removed;
   try {
     const lock = JSON.parse(readFileSync7(lockPath, "utf8"));
     for (const entry of Object.values(lock)) {
       for (const name of entry.skills ?? []) {
-        const p = join10(dir, name);
-        if (existsSync10(p)) {
+        const p = join11(dir, name);
+        if (existsSync11(p)) {
           rmSync3(p, { recursive: true, force: true });
           removed.push(p);
         }
@@ -4263,18 +4205,18 @@ function registerReset(program2) {
       }
     }
     const removed = [];
-    const stateDir = join10(process.cwd(), ".sechroom");
-    if (existsSync10(stateDir)) {
+    const stateDir = join11(process.cwd(), ".sechroom");
+    if (existsSync11(stateDir)) {
       rmSync3(stateDir, { recursive: true, force: true });
       removed.push(stateDir);
     }
-    const legacyCfg = join10(process.cwd(), ".sechroom.json");
-    if (existsSync10(legacyCfg)) {
+    const legacyCfg = join11(process.cwd(), ".sechroom.json");
+    if (existsSync11(legacyCfg)) {
       rmSync3(legacyCfg, { force: true });
       removed.push(legacyCfg);
     }
-    const legacySem = join10(process.cwd(), ".sem");
-    if (existsSync10(legacySem)) {
+    const legacySem = join11(process.cwd(), ".sem");
+    if (existsSync11(legacySem)) {
       rmSync3(legacySem, { force: true });
       removed.push(legacySem);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.6.140-rc.176770e1",
+  "version": "2026.6.141-rc.6cc560b2",
   "description": "Sechroom CLI — a thin, generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.",
   "type": "module",
   "license": "UNLICENSED",