@sechroom/cli 2026.6.16 → 2026.6.18

package/dist/index.js

@@ -1558,6 +1558,184 @@ Examples:
   });
 }
 
+// src/sem.ts
+import { dirname as dirname2, join as join2 } from "path";
+import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+var SEM_FILE = ".sem";
+function localSemPath(cwd = process.cwd()) {
+  return join2(cwd, SEM_FILE);
+}
+function resolveSemPathForRead(start = process.cwd()) {
+  let dir = start;
+  while (true) {
+    const candidate = join2(dir, SEM_FILE);
+    if (existsSync2(candidate)) return candidate;
+    const parent = dirname2(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function parseSem(text) {
+  const out = {};
+  for (const raw of text.split("\n")) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq === -1) continue;
+    const key = line.slice(0, eq).trim();
+    const value = line.slice(eq + 1).trim();
+    if (key) out[key] = value;
+  }
+  return out;
+}
+function serializeSem(values) {
+  const header = "# sechroom lane pin (per-location fallback) \u2014 resolved at runtime by operator skills.\n";
+  const body = Object.entries(values).map(([k, v]) => `${k} = ${v}`).join("\n");
+  return header + body + "\n";
+}
+function readSem(path) {
+  const p = path ?? resolveSemPathForRead();
+  if (!p || !existsSync2(p)) return void 0;
+  return { path: p, values: parseSem(readFileSync2(p, "utf8")) };
+}
+function writeSem(values, path = localSemPath()) {
+  mkdirSync2(dirname2(path), { recursive: true });
+  writeFileSync2(path, serializeSem(values));
+  ensureSemIgnored(path);
+  return path;
+}
+function ignoresSem(content) {
+  return content.split("\n").some((line) => {
+    const t = line.trim();
+    return t === ".sem" || t === "/.sem" || t === "**/.sem";
+  });
+}
+function resolveGitignoreTarget(startDir) {
+  let dir = startDir;
+  for (; ; ) {
+    const gi = join2(dir, ".gitignore");
+    if (existsSync2(gi)) return { path: gi, exists: true };
+    const parent = dirname2(dir);
+    if (existsSync2(join2(dir, ".git")) || parent === dir) {
+      return { path: join2(startDir, ".gitignore"), exists: false };
+    }
+    dir = parent;
+  }
+}
+function ensureSemIgnored(semPath) {
+  try {
+    const target = resolveGitignoreTarget(dirname2(semPath));
+    if (target.exists) {
+      const content = readFileSync2(target.path, "utf8");
+      if (ignoresSem(content)) return;
+      const sep = content.length === 0 || content.endsWith("\n") ? "" : "\n";
+      appendFileSync(target.path, `${sep}.sem
+`);
+    } else {
+      writeFileSync2(target.path, ".sem\n");
+    }
+  } catch {
+  }
+}
+
+// src/commands/hook.ts
+async function readStdin() {
+  if (process.stdin.isTTY) return "";
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
+function parseHookInput(raw) {
+  if (!raw.trim()) return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+function resolveLane(flagLane, cwd) {
+  if (flagLane) return flagLane;
+  const env = process.env.SECHROOM_LANE;
+  if (env) return env;
+  const start = cwd ?? process.cwd();
+  const sem = readSem(resolveSemPathForRead(start));
+  return sem?.values["code-lane"];
+}
+function formatContext(bundle, lane) {
+  const s = bundle?.latestSnapshot;
+  if (!s) return null;
+  const lines = [];
+  lines.push(`[sechroom continuity \u2014 resumed lane ${lane}]`);
+  if (s.currentObjective) lines.push(`Objective: ${s.currentObjective}`);
+  if (s.currentState) lines.push(`State: ${s.currentState}`);
+  if (s.lastMeaningfulAction) lines.push(`Last action: ${s.lastMeaningfulAction}`);
+  if (s.nextIntendedAction) lines.push(`Next: ${s.nextIntendedAction}`);
+  if (s.resumeInstruction) lines.push(`Resume: ${s.resumeInstruction}`);
+  const constraints = s.activeConstraints ?? [];
+  if (constraints.length) {
+    lines.push("Active constraints:");
+    for (const c of constraints) lines.push(`  - ${c}`);
+  }
+  const questions = s.openQuestions ?? [];
+  if (questions.length) {
+    lines.push("Open questions:");
+    for (const q of questions) lines.push(`  - ${q}`);
+  }
+  const artifacts = s.relevantArtifactIds ?? [];
+  if (artifacts.length) lines.push(`Relevant artifacts: ${artifacts.join(", ")}`);
+  const marker = [s.id, s.createdAt].filter(Boolean).join(" @ ");
+  if (marker) lines.push(`(snapshot ${marker})`);
+  return lines.join("\n");
+}
+function emitSessionStart(additionalContext) {
+  process.stdout.write(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "SessionStart",
+        additionalContext
+      }
+    }) + "\n"
+  );
+}
+function registerHook(program2) {
+  const hook = program2.command("hook").description("Agent-lifecycle hook adapter (Claude Code / Codex) \u2014 bridges hooks to continuity");
+  hook.addHelpText(
+    "after",
+    `
+Examples:
+  # Wire into a SessionStart hook (the surface pipes the hook payload on stdin):
+  $ echo '{"hook_event_name":"SessionStart","cwd":"'"$PWD"'"}' | sechroom hook session-start
+  $ sechroom hook session-start --lane claude-code-chris        override the .sem pin
+
+Lane source (high -> low): --lane  >  SECHROOM_LANE  >  ./.sem code-lane (D-binding-5).
+Fail-soft: no lane / no auth / API error -> exit 0, no context injected, never blocks.`
+  );
+  hook.command("session-start").description("Resume the checkout's lane and emit continuity context for a SessionStart hook").option("--lane <laneId>", "Override the resolved lane (else SECHROOM_LANE, else ./.sem code-lane)").option("--surface <surface>", "Target surface: claude | codex (output is identical for session-start)", "claude").option("--max-artifacts <n>", "Cap artifacts in the resume bundle").action(async (opts, cmd) => {
+    try {
+      const raw = await readStdin();
+      const input = parseHookInput(raw);
+      const lane = resolveLane(opts.lane, input.cwd);
+      if (!lane) return process.exit(0);
+      const cfg = resolveConfig(cmd.optsWithGlobals());
+      const client = await makeClient(cfg);
+      const { data } = await client.POST("/continuity/resume/lane", {
+        body: {
+          laneId: lane,
+          workspaceId: null,
+          maxArtifacts: opts.maxArtifacts != null ? Number(opts.maxArtifacts) : null,
+          includeLookingAtMyself: null,
+          changedSince: null
+        }
+      });
+      const context = formatContext(data, lane);
+      if (context) emitSessionStart(context);
+      return process.exit(0);
+    } catch {
+      return process.exit(0);
+    }
+  });
+}
+
 // src/commands/account.ts
 function registerId(program2) {
   const id = program2.command("id").description("Allocate human-authored id sequences (FR-*, D-*)");
@@ -1775,8 +1953,8 @@ Examples:
 
 // src/setup/apply.ts
 import { createHash as createHash2 } from "crypto";
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2 } from "fs";
-import { dirname as dirname2 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync3 } from "fs";
+import { dirname as dirname3 } from "path";
 
 // src/setup/operator-surface.ts
 var SectionType = {
@@ -1950,22 +2128,22 @@ function parseManagedBlock(content, block) {
   return null;
 }
 function ensureDir2(path) {
-  mkdirSync2(dirname2(path), { recursive: true });
+  mkdirSync3(dirname3(path), { recursive: true });
 }
 function readOr(path, fallback) {
   try {
-    return readFileSync2(path, "utf8");
+    return readFileSync3(path, "utf8");
   } catch {
     return fallback;
   }
 }
 function mergeMcpJson(path, snippet, dryRun) {
   const incoming = JSON.parse(snippet);
-  const existed = existsSync2(path);
+  const existed = existsSync3(path);
   let current = {};
   if (existed) {
     try {
-      current = JSON.parse(readFileSync2(path, "utf8"));
+      current = JSON.parse(readFileSync3(path, "utf8"));
     } catch {
       return { kind: "mcp", path, status: "skipped", note: "existing file isn't valid JSON \u2014 left untouched" };
     }
@@ -1973,26 +2151,26 @@ function mergeMcpJson(path, snippet, dryRun) {
   current.mcpServers = { ...current.mcpServers ?? {}, ...incoming.mcpServers ?? {} };
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync2(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
+  writeFileSync3(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function mergeCodexToml(path, snippet, dryRun) {
-  const existed = existsSync2(path);
+  const existed = existsSync3(path);
   let body = readOr(path, "");
   body = body.replace(/(^|\n)\[mcp_servers\.sechroom\][^[]*/, "\n").replace(/\n{3,}/g, "\n\n");
   const trimmed = body.trim();
   const next = (trimmed.length > 0 ? trimmed + "\n\n" : "") + snippet.trim() + "\n";
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync2(path, next, { mode: 384 });
+  writeFileSync3(path, next, { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function writeInstructionBlock(path, write, dryRun) {
-  const existed = existsSync2(path);
+  const existed = existsSync3(path);
   const next = computeBlockFile(readOr(path, ""), write);
   if (dryRun) return { kind: "instruction", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync2(path, next);
+  writeFileSync3(path, next);
   return { kind: "instruction", path, status: existed ? "merged" : "created" };
 }
 function computeBlockFile(current, write) {
@@ -2033,7 +2211,7 @@ function applyBlock(path, write, mode, dryRun) {
     const next = computeBlockFile(current, write);
     if (!dryRun) {
       ensureDir2(proposedPath);
-      writeFileSync2(proposedPath, next);
+      writeFileSync3(proposedPath, next);
     }
     return {
       kind: "instruction",
@@ -2104,17 +2282,17 @@ async function applyClient(cfg, setup, target, opts) {
 }
 
 // src/setup/clients.ts
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname3, join as join2 } from "path";
+import { dirname as dirname4, join as join3 } from "path";
 function claudeDesktopConfigPath(home) {
   switch (process.platform) {
     case "darwin":
-      return join2(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+      return join3(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
     case "win32":
-      return join2(process.env.APPDATA ?? join2(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
+      return join3(process.env.APPDATA ?? join3(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
     default:
-      return join2(home, ".config", "Claude", "claude_desktop_config.json");
+      return join3(home, ".config", "Claude", "claude_desktop_config.json");
   }
 }
 function clientTargets(cwd) {
@@ -2123,26 +2301,26 @@ function clientTargets(cwd) {
     "claude-code": {
       key: "claude-code",
       label: "Claude Code",
-      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join2(cwd, ".mcp.json"), format: "json" },
-      instruction: { surfaceKey: "claude-code", path: join2(cwd, "CLAUDE.md") }
+      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join3(cwd, ".mcp.json"), format: "json" },
+      instruction: { surfaceKey: "claude-code", path: join3(cwd, "CLAUDE.md") }
     },
     "claude-desktop": {
       key: "claude-desktop",
       label: "Claude Desktop",
       mcp: { surfaceKey: "claude-desktop", sectionType: SectionType.McpConfig, path: claudeDesktopConfigPath(home), format: "json" },
-      instruction: { surfaceKey: "claude-desktop", path: join2(home, ".claude", "CLAUDE.md") }
+      instruction: { surfaceKey: "claude-desktop", path: join3(home, ".claude", "CLAUDE.md") }
     },
     codex: {
       key: "codex",
       label: "Codex CLI",
-      mcp: { surfaceKey: "chatgpt", sectionType: SectionType.McpConfigToml, path: join2(home, ".codex", "config.toml"), format: "toml" },
-      instruction: { surfaceKey: "chatgpt", path: join2(cwd, "AGENTS.md") }
+      mcp: { surfaceKey: "chatgpt", sectionType: SectionType.McpConfigToml, path: join3(home, ".codex", "config.toml"), format: "toml" },
+      instruction: { surfaceKey: "chatgpt", path: join3(cwd, "AGENTS.md") }
     },
     cursor: {
       key: "cursor",
       label: "Cursor",
-      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join2(cwd, ".cursor", "mcp.json"), format: "json" },
-      instruction: { surfaceKey: "chatgpt", path: join2(cwd, "AGENTS.md") }
+      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join3(cwd, ".cursor", "mcp.json"), format: "json" },
+      instruction: { surfaceKey: "chatgpt", path: join3(cwd, "AGENTS.md") }
     }
   };
 }
@@ -2151,57 +2329,91 @@ var DEFAULT_CLIENT_KEY = "claude-code";
 function detectInstalledClients(cwd) {
   const home = homedir2();
   const detected = [];
-  if (existsSync3(join2(home, ".claude"))) detected.push("claude-code");
-  if (existsSync3(dirname3(claudeDesktopConfigPath(home)))) detected.push("claude-desktop");
-  if (existsSync3(join2(home, ".codex"))) detected.push("codex");
-  if (existsSync3(join2(home, ".cursor")) || existsSync3(join2(cwd, ".cursor"))) detected.push("cursor");
+  if (existsSync4(join3(home, ".claude"))) detected.push("claude-code");
+  if (existsSync4(dirname4(claudeDesktopConfigPath(home)))) detected.push("claude-desktop");
+  if (existsSync4(join3(home, ".codex"))) detected.push("codex");
+  if (existsSync4(join3(home, ".cursor")) || existsSync4(join3(cwd, ".cursor"))) detected.push("cursor");
   return detected;
 }
 
 // src/setup/skills-offer.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join4 } from "path";
 
-// src/sem.ts
-import { dirname as dirname4, join as join3 } from "path";
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
-var SEM_FILE = ".sem";
-function localSemPath(cwd = process.cwd()) {
-  return join3(cwd, SEM_FILE);
+// src/setup/lane-pin.ts
+var CODE_LANE_PREFIX_BY_CLIENT = {
+  "claude-code": "claude-code",
+  "claude-desktop": "claude-code",
+  cursor: "claude-code",
+  codex: "codex"
+};
+var CLIENT_PRIORITY = ["claude-code", "claude-desktop", "cursor", "codex"];
+function handleFromDisplayName(name) {
+  if (!name) return void 0;
+  const localPart = name.trim().split("@")[0] ?? "";
+  const first = localPart.split(/[\s._-]+/)[0]?.toLowerCase().replace(/[^a-z0-9]/g, "");
+  return first || void 0;
+}
+function codeLanePrefix(clients) {
+  for (const c of CLIENT_PRIORITY) if (clients.includes(c)) return CODE_LANE_PREFIX_BY_CLIENT[c];
+  return "claude-code";
+}
+function writePin(code, design) {
+  const values = {};
+  if (code) values["code-lane"] = code;
+  if (design) values["design-lane"] = design;
+  if (Object.keys(values).length === 0) return;
+  const target = writeSem(values);
+  process.stderr.write(`${ok("\u2713")} lane pin written \u2192 ${target} ${style.dim("(./.sem, git-ignored)")}
+`);
 }
-function resolveSemPathForRead(start = process.cwd()) {
-  let dir = start;
-  while (true) {
-    const candidate = join3(dir, SEM_FILE);
-    if (existsSync4(candidate)) return candidate;
-    const parent = dirname4(dir);
-    if (parent === dir) return void 0;
-    dir = parent;
+async function ensureLanePin(cfg, opts) {
+  if (opts.dryRun) return;
+  if (readSem()) return;
+  let wf;
+  let profile;
+  try {
+    const client = await makeClient(cfg);
+    [wf, profile] = await Promise.all([
+      client.GET("/me/workflow-preferences", {}).then((r) => r.data).catch(() => void 0),
+      client.GET("/me/profile", {}).then((r) => r.data).catch(() => void 0)
+    ]);
+  } catch {
   }
-}
-function parseSem(text) {
-  const out = {};
-  for (const raw of text.split("\n")) {
-    const line = raw.trim();
-    if (!line || line.startsWith("#")) continue;
-    const eq = line.indexOf("=");
-    if (eq === -1) continue;
-    const key = line.slice(0, eq).trim();
-    const value = line.slice(eq + 1).trim();
-    if (key) out[key] = value;
+  const handle = handleFromDisplayName(profile?.effectiveDisplayName);
+  const prefix = codeLanePrefix(opts.clients ?? ["claude-code"]);
+  const codeGuess = wf?.defaultCodeLane ?? (handle ? `${prefix}-${handle}` : void 0);
+  const designGuess = wf?.defaultDesignLane ?? (handle ? `claude-design-${handle}` : void 0);
+  if (!canPrompt() || opts.yes) {
+    if (opts.yes && (codeGuess || designGuess)) writePin(codeGuess, designGuess);
+    return;
   }
-  return out;
-}
-function serializeSem(values) {
-  const header = "# sechroom lane pin (per-location fallback) \u2014 resolved at runtime by operator skills.\n";
-  const body = Object.entries(values).map(([k, v]) => `${k} = ${v}`).join("\n");
-  return header + body + "\n";
-}
-function readSem(path) {
-  const p = path ?? resolveSemPathForRead();
-  if (!p || !existsSync4(p)) return void 0;
-  return { path: p, values: parseSem(readFileSync3(p, "utf8")) };
+  if (codeGuess || designGuess) {
+    process.stderr.write(
+      `
+I can pin this checkout's lane so operator skills + the continuity hook resolve your identity:
+`
+    );
+    if (codeGuess) process.stderr.write(`  ${style.dim("code-lane")}   = ${style.cyan(codeGuess)}
+`);
+    if (designGuess) process.stderr.write(`  ${style.dim("design-lane")} = ${style.cyan(designGuess)}
+`);
+    if (await promptYesNo("Pin these?")) {
+      writePin(codeGuess, designGuess);
+      return;
+    }
+  }
+  const code = await promptText("Code-lane id (e.g. claude-code-you, blank to skip)?", codeGuess ?? "");
+  const design = await promptText("Design-lane id (e.g. claude-design-you, blank to skip)?", designGuess ?? "");
+  if (!code && !design) {
+    process.stderr.write(
+      `  ${style.dim("skipped \u2014 set later with")} ${style.cyan("sechroom skills set-lane --code-lane \u2026 --design-lane \u2026")}
+`
+    );
+    return;
+  }
+  writePin(code || void 0, design || void 0);
 }
 
 // src/setup/skills-offer.ts
@@ -2248,37 +2460,13 @@ Found ${style.bold(String(names.length))} operator skill(s) installed in your wo
   const written = [];
   for (const [name, m] of byName) {
     const body = m.text ?? m.Text ?? "";
-    mkdirSync3(join4(dir, name), { recursive: true });
-    writeFileSync3(join4(dir, name, "SKILL.md"), body.endsWith("\n") ? body : body + "\n");
+    mkdirSync4(join4(dir, name), { recursive: true });
+    writeFileSync4(join4(dir, name, "SKILL.md"), body.endsWith("\n") ? body : body + "\n");
     written.push(name);
   }
   process.stderr.write(`${style.green("\u2713")} wrote ${written.length} skill(s) to ${dir}
 `);
-  if (readSem()) return;
-  const setLane = opts.yes ? false : canPrompt() ? await promptYesNo("Set your lane now so the skills can resolve their identity slots?") : false;
-  if (!setLane) {
-    process.stderr.write(
-      `  ${style.dim("run")} ${style.cyan("sechroom skills set-lane --code-lane \u2026 --design-lane \u2026")} ${style.dim("when ready.")}
-`
-    );
-    return;
-  }
-  let wf;
-  try {
-    const client = await makeClient(cfg);
-    wf = await client.GET("/me/workflow-preferences", {}).then((r) => r.data).catch(() => void 0);
-  } catch {
-  }
-  const code = await promptText("Code-lane id (e.g. claude-code-you)?", wf?.defaultCodeLane);
-  const design = await promptText("Design-lane id (e.g. claude-design-you)?", wf?.defaultDesignLane);
-  const values = {};
-  if (code) values["code-lane"] = code;
-  if (design) values["design-lane"] = design;
-  if (Object.keys(values).length === 0) return;
-  const target = localSemPath();
-  writeFileSync3(target, serializeSem(values));
-  process.stderr.write(`${style.green("\u2713")} lane pin written \u2192 ${target}
-`);
+  await ensureLanePin(cfg, { yes: opts.yes, dryRun: opts.dryRun, clients: [surface] });
 }
 
 // src/commands/setup.ts
@@ -2389,36 +2577,40 @@ Next \u2014 verify: ${verify.description}
 }
 function registerSetup(program2) {
   const setup = program2.command("setup").description("Granular onboarding steps (init runs these together)");
-  setup.command("mcp <client>").description(`Write only the MCP config for a client (${ALL_CLIENT_KEYS.join(", ")})`).option("--dry-run", "print what would be written without writing", false).action(async (client, opts, cmd) => {
-    await runSingle(client, cmd, { dryRun: Boolean(opts.dryRun), mcp: true, agentFiles: false });
+  setup.command("mcp <clients...>").description(`Write only the MCP config for one or more clients (${ALL_CLIENT_KEYS.join(", ")}, or 'all')`).option("--dry-run", "print what would be written without writing", false).addHelpText("after", "\nExamples:\n  $ sechroom setup mcp codex\n  $ sechroom setup mcp claude-code codex\n  $ sechroom setup mcp all").action(async (clients, opts, cmd) => {
+    await runClients(clients, cmd, { dryRun: Boolean(opts.dryRun), mcp: true, agentFiles: false });
   });
-  setup.command("agent-files <client>").description(`Write only the agent instruction file for a client (${ALL_CLIENT_KEYS.join(", ")})`).option("--dry-run", "print what would be written without writing", false).option("--copy", "make a personal copy you can edit (default: prompt on a TTY, else skip)").action(async (client, opts, cmd) => {
-    await runSingle(client, cmd, { dryRun: Boolean(opts.dryRun), mcp: false, agentFiles: true, copy: opts.copy });
+  setup.command("agent-files <clients...>").description(`Write only the agent instruction file(s) for one or more clients (${ALL_CLIENT_KEYS.join(", ")}, or 'all')`).option("--dry-run", "print what would be written without writing", false).option("--copy", "make a personal copy you can edit (default: prompt on a TTY, else skip)").addHelpText("after", "\nExamples:\n  $ sechroom setup agent-files claude-code        CLAUDE.md\n  $ sechroom setup agent-files claude-code codex  CLAUDE.md + AGENTS.md in one run\n  $ sechroom setup agent-files all").action(async (clients, opts, cmd) => {
+    await runClients(clients, cmd, { dryRun: Boolean(opts.dryRun), mcp: false, agentFiles: true, copy: opts.copy });
   });
 }
-async function runSingle(client, cmd, opts) {
+async function runClients(clients, cmd, opts) {
   const cfg = resolveConfig(cmd.optsWithGlobals());
   const targets = clientTargets(process.cwd());
-  const target = targets[client];
-  if (!target) fail(`unknown client '${client}'. Known: ${ALL_CLIENT_KEYS.join(", ")}.`);
+  const keys = resolveClientKeys(clients.join(","));
   const setupData = await withSpinner("Fetching setup descriptors", () => fetchSetup(cfg));
   const personalWorkspaceId = await getPersonalWorkspaceId(cfg);
   if (opts.agentFiles && !opts.dryRun) {
-    await maybeOfferCopies(cfg, setupData, targets, [client], personalWorkspaceId, copyChoice(opts));
+    await maybeOfferCopies(cfg, setupData, targets, keys, personalWorkspaceId, copyChoice(opts));
   }
-  const actions = await applyClient(cfg, setupData, target, {
-    dryRun: opts.dryRun,
-    mcp: opts.mcp,
-    agentFiles: opts.agentFiles,
-    personalWorkspaceId
-  });
   const json = cmd.optsWithGlobals().json;
+  const result = [];
+  for (const key of keys) {
+    const target = targets[key];
+    const actions = await applyClient(cfg, setupData, target, {
+      dryRun: opts.dryRun,
+      mcp: opts.mcp,
+      agentFiles: opts.agentFiles,
+      personalWorkspaceId
+    });
+    result.push({ client: key, actions });
+    if (!json) printActions(target, actions);
+  }
   if (json) {
-    emit({ dryRun: opts.dryRun, client, actions }, true);
-  } else {
-    printActions(target, actions);
-    process.stdout.write(opts.dryRun ? "\n(dry run \u2014 nothing written)\n" : "\nDone.\n");
+    emit({ dryRun: opts.dryRun, clients: result }, true);
+    return;
   }
+  process.stdout.write(opts.dryRun ? "\n(dry run \u2014 nothing written)\n" : "\nDone.\n");
 }
 
 // src/commands/onboard.ts
@@ -2712,12 +2904,14 @@ Examples:
         emit({ dryRun, baseUrl: cfg.baseUrl, tenant: cfg.tenant, workspaceId: cfg.workspaceId ?? null, timezone: tz, wire, clients: [] }, true);
         return;
       }
+      if (!dryRun) await ensureLanePin(cfg, { yes, dryRun, clients: detectInstalledClients(process.cwd()) });
       process.stdout.write(
         `
 ${style.bold("Done.")} The CLI is configured for ${style.cyan(cfg.tenant)} \u2014 no AI-client files written.
 Try: ${style.cyan('sechroom memory search "..."')}  or  ${style.cyan("sechroom --help")}
 `
       );
+      await printStarterPrompt("cli");
       return;
     }
     const keys = await chooseClients(opts.client, yes, process.cwd());
@@ -2762,6 +2956,9 @@ Try: ${style.cyan('sechroom memory search "..."')}  or  ${style.cyan("sechroom -
       }
       process.exit(wouldChange === 0 ? 0 : 1);
     }
+    if (!json && !dryRun) {
+      await ensureLanePin(cfg, { yes, dryRun, clients: keys });
+    }
     if (!json && !dryRun) {
       await maybeOfferSkills(cfg, personalWorkspaceId, { yes, dryRun, surface: "claude-code" });
     }
@@ -2790,6 +2987,7 @@ ${style.bold("Done.")} Restart your AI client (or reload MCP) to pick up the new
 ${style.bold("Done.")} Agent instructions written (no MCP config).
 `
     );
+    if (!dryRun) await printStarterPrompt("agent", cfg);
   });
 }
 async function chooseWire(opts, yes) {
@@ -2807,11 +3005,38 @@ async function chooseWire(opts, yes) {
   }
   return opts.mcp === false ? "agent-only" : "full";
 }
+var FALLBACK_AGENT_PROMPT = "Resume my sechroom continuity, summarise what I was last working on, then suggest the next step.";
+async function printStarterPrompt(mode, cfg) {
+  if (mode === "cli") {
+    process.stdout.write(
+      `
+${style.bold("Next:")} pick up where you left off \u2014
+  ${style.cyan("sechroom continuity resume-me")}
+`
+    );
+    return;
+  }
+  let primary = FALLBACK_AGENT_PROMPT;
+  if (cfg) {
+    try {
+      const client = await makeClient(cfg);
+      const { data } = await client.GET("/me/onboarding/starter-prompt", {});
+      if (data?.primary) primary = data.primary;
+    } catch {
+    }
+  }
+  process.stdout.write(
+    `
+${style.bold("Next:")} paste this into your AI agent to get going \u2014
+  ${style.cyan(`"${primary}"`)}
+`
+  );
+}
 
 // src/commands/skills.ts
 import { homedir as homedir4 } from "os";
-import { dirname as dirname5, join as join5 } from "path";
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4, rmSync as rmSync2, existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
+import { join as join5 } from "path";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5, rmSync as rmSync2, existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
 var DEFAULT_SLUG = "operator-skills";
 var ROLE_TAGS = ["sechroom:role:skill-template", "role:skill-template"];
 var LOCK = ".sechroom-skills.json";
@@ -2894,15 +3119,15 @@ Examples:
       const name = tagValue2(tags, "skill:");
       if (!name) continue;
       const body = m.text ?? m.Text ?? "";
-      mkdirSync4(join5(dir, name), { recursive: true });
-      writeFileSync4(join5(dir, name, "SKILL.md"), body.endsWith("\n") ? body : body + "\n");
+      mkdirSync5(join5(dir, name), { recursive: true });
+      writeFileSync5(join5(dir, name, "SKILL.md"), body.endsWith("\n") ? body : body + "\n");
       written.push(name);
     }
-    mkdirSync4(dir, { recursive: true });
+    mkdirSync5(dir, { recursive: true });
     const lockPath = join5(dir, LOCK);
     const lock = existsSync5(lockPath) ? JSON.parse(readFileSync4(lockPath, "utf8")) : {};
     lock[slug] = { surface: opts.surface, version, instance: wantInstance, skills: written.sort() };
-    writeFileSync4(lockPath, JSON.stringify(lock, null, 2) + "\n");
+    writeFileSync5(lockPath, JSON.stringify(lock, null, 2) + "\n");
     if (opts.json) return emit({ slug, version, instance: wantInstance, surface: opts.surface, dir, installed: written }, true);
     const instanceNote = opts.instance ? ` (${opts.instance})` : "";
     console.log(style.green(`Installed ${slug}@${version}${instanceNote} \u2014 ${written.length} skill(s) \u2192 ${dir}`));
@@ -2938,7 +3163,7 @@ Examples:
       }
     }
     delete lock[slug];
-    writeFileSync4(lockPath, JSON.stringify(lock, null, 2) + "\n");
+    writeFileSync5(lockPath, JSON.stringify(lock, null, 2) + "\n");
     if (opts.json) return emit({ slug, removed, dir }, true);
     console.log(style.green(`Removed ${removed.length} skill(s) for ${slug} from ${dir}`));
   });
@@ -2948,10 +3173,9 @@ Examples:
     const values = readSem(target)?.values ?? {};
     if (opts.codeLane) values["code-lane"] = opts.codeLane;
     if (opts.designLane) values["design-lane"] = opts.designLane;
-    mkdirSync4(dirname5(target), { recursive: true });
-    writeFileSync4(target, serializeSem(values));
+    writeSem(values, target);
     if (cmd.optsWithGlobals().json) return emit({ path: target, values }, true);
-    console.log(style.green(`Wrote lane pin \u2192 ${target}`));
+    console.log(style.green(`Wrote lane pin \u2192 ${target} ${style.dim("(git-ignored)")}`));
     Object.entries(values).forEach(([k, v]) => console.log("  " + style.dim(k) + " = " + v));
   });
   skills.command("lane").description("Show the lane pin resolved from ./.sem (nearest in this checkout)").option("--json", "machine output").action((opts, cmd) => {
@@ -3217,6 +3441,7 @@ registerWorkspace(program);
 registerProject(program);
 registerFiling(program);
 registerContinuity(program);
+registerHook(program);
 registerId(program);
 registerAccount(program);
 registerChat(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.6.16",
+  "version": "2026.6.18",
   "description": "Sechroom CLI — a thin, generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.",
   "type": "module",
   "license": "UNLICENSED",