@sechroom/cli 2026.6.23 → 2026.6.24

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 import { Command } from "commander";
 
 // src/auth.ts
@@ -11,14 +11,15 @@ import open from "open";
 
 // src/config.ts
 import { homedir } from "os";
-import { join, dirname, basename } from "path";
+import { join, dirname } from "path";
 import { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync } from "fs";
 var CONFIG_DIR = join(homedir(), ".config", "sechroom");
 var CONFIG_FILE = join(CONFIG_DIR, "config.json");
 var TOKEN_FILE = join(CONFIG_DIR, "token.json");
 var STATE_DIR_NAME = ".sechroom";
-var LOCAL_CONFIG_NAME = join(STATE_DIR_NAME, "config.json");
-var LEGACY_LOCAL_CONFIG_NAME = ".sechroom.json";
+var BASELINE_CONFIG_NAME = ".sechroom.json";
+var OVERRIDE_CONFIG_NAME = join(STATE_DIR_NAME, "config.json");
+var BINDING_FIELDS = ["schemaVersion", "baseUrl", "tenant", "workspaceId", "defaultProjectId"];
 var DEFAULT_BASE_URL = "https://app.sechroom.ai/api";
 var LOCAL_CONFIG_SCHEMA_VERSION = 2;
 function ensureDir() {
@@ -66,54 +67,55 @@ function clearPersisted() {
   rmSync(CONFIG_FILE);
   return CONFIG_FILE;
 }
-function findLocalConfigPath(start = process.cwd()) {
+function readJsonConfig(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function findConfigHome(start = process.cwd()) {
   let dir = start;
   for (; ; ) {
-    const candidate = join(dir, LOCAL_CONFIG_NAME);
-    if (existsSync(candidate)) return candidate;
-    const legacy = join(dir, LEGACY_LOCAL_CONFIG_NAME);
-    if (existsSync(legacy)) return legacy;
+    if (existsSync(join(dir, BASELINE_CONFIG_NAME)) || existsSync(join(dir, OVERRIDE_CONFIG_NAME))) return dir;
     const parent = dirname(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
 }
-function localConfigWritePath(resolvedPath) {
-  const baseDir = resolvedPath ? dirname(resolvedPath) : process.cwd();
-  const dir = basename(baseDir) === STATE_DIR_NAME ? dirname(baseDir) : baseDir;
-  return join(dir, LOCAL_CONFIG_NAME);
-}
 function readLocalConfig() {
-  const path = findLocalConfigPath();
-  if (!path) return {};
-  try {
-    const c = JSON.parse(readFileSync(path, "utf8"));
-    return {
-      schemaVersion: c.schemaVersion,
-      baseUrl: c.baseUrl,
-      tenant: c.tenant,
-      workspaceId: c.workspaceId,
-      defaultProjectId: c.defaultProjectId,
-      path
-    };
-  } catch {
-    return {};
-  }
+  const home = findConfigHome();
+  if (!home) return {};
+  const baselinePath = join(home, BASELINE_CONFIG_NAME);
+  const overridePath = join(home, OVERRIDE_CONFIG_NAME);
+  const merged = { ...readJsonConfig(baselinePath) ?? {}, ...readJsonConfig(overridePath) ?? {} };
+  return {
+    schemaVersion: merged.schemaVersion,
+    baseUrl: merged.baseUrl,
+    tenant: merged.tenant,
+    workspaceId: merged.workspaceId,
+    defaultProjectId: merged.defaultProjectId,
+    path: existsSync(baselinePath) ? baselinePath : overridePath
+  };
 }
 function writeLocalConfig(patch) {
-  const readPath = findLocalConfigPath();
-  let current = {};
-  if (readPath) {
-    try {
-      current = JSON.parse(readFileSync(readPath, "utf8"));
-    } catch {
-    }
-  }
-  const path = localConfigWritePath(readPath);
-  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  const home = findConfigHome() ?? process.cwd();
+  const baselinePath = join(home, BASELINE_CONFIG_NAME);
+  const overridePath = join(home, OVERRIDE_CONFIG_NAME);
+  const current = readJsonConfig(baselinePath) ?? {};
   const next = { ...current, ...patch, schemaVersion: LOCAL_CONFIG_SCHEMA_VERSION };
-  writeFileSync(path, JSON.stringify(next, null, 2), { mode: 384 });
-  return path;
+  writeFileSync(baselinePath, JSON.stringify(next, null, 2), { mode: 420 });
+  const override = readJsonConfig(overridePath);
+  if (override) {
+    for (const f of BINDING_FIELDS) delete override[f];
+    if (Object.keys(override).length === 0) rmSync(overridePath, { force: true });
+    else writeFileSync(overridePath, JSON.stringify(override, null, 2), { mode: 384 });
+  }
+  return baselinePath;
+}
+function committedBindingPath(dir) {
+  const p = join(dir, BASELINE_CONFIG_NAME);
+  return existsSync(p) ? p : void 0;
 }
 function resolveConfig(flags) {
   const local = readLocalConfig();
@@ -373,8 +375,8 @@ async function promptYesNo(question) {
   const { createInterface } = await import("readline");
   const rl = createInterface({ input: process.stdin, output: process.stderr });
   try {
-    const answer = await new Promise((resolve) => {
-      rl.question(`${question} [y/N] `, resolve);
+    const answer = await new Promise((resolve2) => {
+      rl.question(`${question} [y/N] `, resolve2);
     });
     return /^y(es)?$/i.test(answer.trim());
   } finally {
@@ -387,8 +389,8 @@ async function promptText(question, def) {
   const rl = createInterface({ input: process.stdin, output: process.stderr });
   try {
     const suffix = def ? ` [${def}]` : "";
-    const answer = await new Promise((resolve) => {
-      rl.question(`${question}${suffix} `, resolve);
+    const answer = await new Promise((resolve2) => {
+      rl.question(`${question}${suffix} `, resolve2);
     });
     const trimmed = answer.trim();
     return trimmed.length > 0 ? trimmed : def ?? "";
@@ -414,8 +416,8 @@ async function promptSelect(question, choices, def) {
       process.stderr.write(`  ${marker} ${style.bold(String(i + 1))}. ${c.label}${hint}
 `);
     });
-    const answer = await new Promise((resolve) => {
-      rl.question(`Choose ${style.dim(`[${defIdx + 1}]`)} `, resolve);
+    const answer = await new Promise((resolve2) => {
+      rl.question(`Choose ${style.dim(`[${defIdx + 1}]`)} `, resolve2);
     });
     const trimmed = answer.trim();
     if (!trimmed) return choices[defIdx].value;
@@ -447,8 +449,8 @@ async function promptMultiSelect(question, choices, preselected = []) {
       process.stderr.write(`  ${box} ${style.bold(String(i + 1))}. ${c.label}${hint}
 `);
     });
-    const answer = await new Promise((resolve) => {
-      rl.question(`Select ${style.dim("[Enter = \u25C9]")} `, resolve);
+    const answer = await new Promise((resolve2) => {
+      rl.question(`Select ${style.dim("[Enter = \u25C9]")} `, resolve2);
     });
     const trimmed = answer.trim().toLowerCase();
     if (!trimmed) return preValues();
@@ -1973,7 +1975,7 @@ function mergeHooks(config2) {
   }
   return added;
 }
-function readJsonConfig(path) {
+function readJsonConfig2(path) {
   if (!existsSync4(path)) return {};
   const raw = readFileSync3(path, "utf8");
   if (!raw.trim()) return {};
@@ -1981,7 +1983,7 @@ function readJsonConfig(path) {
 }
 function installHooksJson(path, dryRun) {
   const existed = existsSync4(path) && readFileSync3(path, "utf8").trim().length > 0;
-  const config2 = readJsonConfig(path);
+  const config2 = readJsonConfig2(path);
   const added = mergeHooks(config2);
   if (added === 0 && existed) return { path, status: "current" };
   if (!dryRun) {
@@ -3114,7 +3116,7 @@ async function ensureTenant(baseUrl, g, opts) {
       "Where should this tenant + base URL be saved?",
       [
         { label: "Globally", value: "global", hint: "all projects on this machine" },
-        { label: "This directory", value: "local", hint: ".sechroom/config.json \u2014 project + subdirs" }
+        { label: "This directory", value: "local", hint: ".sechroom.json \u2014 committed, project + subdirs" }
       ],
       local.path ? "local" : "global"
     ) === "local";
@@ -3190,14 +3192,14 @@ async function chooseClients(clientFlag, yes, cwd) {
   return picks.length > 0 ? picks : preselected;
 }
 function registerOnboard(program2) {
-  program2.command("onboard").description("Guided first-run setup: configure, sign in, set timezone, detect clients, and wire this project").option("--client <list>", `comma-separated clients (${ALL_CLIENT_KEYS.join(", ")}) or 'all' (default: auto-detected)`).option("--local", "save tenant + base URL to a directory-local .sechroom/config.json instead of the global config", false).option("--workspace <id>", "bind this directory to a workspace (skips the interactive workspace pick)").option("--cli-only", "configure the CLI only \u2014 don't wire any AI client (no MCP config, no agent files)", false).option("--no-mcp", "skip the MCP server config (.mcp.json etc.); still write the agent instruction files").option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--dry-run", "walk through without writing files or changing the profile", false).option("--refresh", "re-fetch descriptors and refresh any out-of-date managed blocks (local edits preserved to .proposed)", false).option("--force", "rewrite every managed block, overwriting local edits inside the markers (content outside untouched)", false).option("--check", "report whether anything would change and exit (0 = all current, 1 = stale/drift/absent); writes nothing", false).option("-y, --yes", "non-interactive: accept defaults (system timezone, detected clients, global config, full wire)", false).addHelpText(
+  program2.command("onboard").description("Guided first-run setup: configure, sign in, set timezone, detect clients, and wire this project").option("--client <list>", `comma-separated clients (${ALL_CLIENT_KEYS.join(", ")}) or 'all' (default: auto-detected)`).option("--local", "save the binding (tenant + base URL + workspace) to a committed .sechroom.json in this repo instead of the global config", false).option("--workspace <id>", "bind this directory to a workspace (skips the interactive workspace pick)").option("--cli-only", "configure the CLI only \u2014 don't wire any AI client (no MCP config, no agent files)", false).option("--no-mcp", "skip the MCP server config (.mcp.json etc.); still write the agent instruction files").option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--dry-run", "walk through without writing files or changing the profile", false).option("--refresh", "re-fetch descriptors and refresh any out-of-date managed blocks (local edits preserved to .proposed)", false).option("--force", "rewrite every managed block, overwriting local edits inside the markers (content outside untouched)", false).option("--check", "report whether anything would change and exit (0 = all current, 1 = stale/drift/absent); writes nothing", false).option("-y, --yes", "non-interactive: accept defaults (system timezone, detected clients, global config, full wire)", false).addHelpText(
     "after",
     `
 Examples:
   $ sechroom onboard                    guided, interactive (asks where to save config + how to wire)
   $ sechroom onboard --cli-only         just the CLI \u2014 no .mcp.json, no agent files
   $ sechroom onboard --no-mcp           agent instructions only, skip MCP config
-  $ sechroom onboard --local            save tenant + base URL to ./.sechroom/config.json
+  $ sechroom onboard --local            save tenant + base URL to a committed ./.sechroom.json
   $ sechroom onboard --workspace wsp_XX  bind this directory to a workspace (no pick prompt)
   $ sechroom onboard --refresh          refresh out-of-date instruction blocks in place
   $ sechroom onboard --check            CI/pre-commit: nonzero exit if instructions are out of date
@@ -3362,15 +3364,174 @@ ${style.bold("Next:")} paste this into your AI agent to get going \u2014
   );
 }
 
+// src/commands/sweep.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+import { dirname as dirname6, isAbsolute, join as join6, resolve } from "path";
+var DEFAULT_MANIFEST = join6(".sechroom", "repos.json");
+function planEntry(entry, root) {
+  const dir = isAbsolute(entry.path) ? entry.path : resolve(root, entry.path);
+  if (!existsSync6(dir)) {
+    return { entry, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
+  }
+  if (committedBindingPath(dir)) {
+    return {
+      entry,
+      dir,
+      disposition: "refresh",
+      argv: ["onboard", "--refresh", "--yes"],
+      reason: "bound (committed .sechroom.json) \u2014 refresh in place"
+    };
+  }
+  if (entry.workspaceId) {
+    return {
+      entry,
+      dir,
+      disposition: "bind",
+      argv: ["onboard", "--yes", "--local", "--workspace", entry.workspaceId],
+      reason: `unbound \u2014 bind to ${entry.workspaceId} + commit .sechroom.json`
+    };
+  }
+  return {
+    entry,
+    dir,
+    disposition: "skip-unbound",
+    argv: [],
+    reason: "unbound + no workspaceId in the manifest \u2014 add one or run `sechroom onboard` there"
+  };
+}
+function passthroughGlobals(g) {
+  const out = [];
+  if (g.baseUrl) out.push("--base-url", g.baseUrl);
+  if (g.tenant) out.push("--tenant", g.tenant);
+  return out;
+}
+var ICON = {
+  refresh: "\u21BB",
+  bind: "+",
+  "skip-missing": "\u2013",
+  "skip-unbound": "\u26A0"
+};
+function registerSweep(program2) {
+  program2.command("sweep").description("Orchestration-root fan-out: run `sechroom onboard` in every repo listed in ./.sechroom/repos.json").option("--manifest <path>", "path to the repos manifest", DEFAULT_MANIFEST).option("--dry-run", "print the plan (per-repo disposition + the onboard command) without running anything", false).addHelpText(
+    "after",
+    `
+Manifest \u2014 ./.sechroom/repos.json (per-operator, gitignored, alongside lane.json):
+  {
+    "repos": [
+      { "path": "sechroom",      "workspaceId": "wsp_XXXX" },
+      { "path": "../other-repo", "workspaceId": "wsp_YYYY" },
+      { "path": "already-bound" }
+    ]
+  }
+
+Per repo (paths resolve relative to the manifest's root):
+  ${ICON.refresh} bound        committed .sechroom.json present  \u2192 onboard --refresh (manifest workspace ignored)
+  ${ICON.bind} unbound      bind to the manifest workspaceId    \u2192 onboard --local --workspace <id>
+  ${ICON["skip-missing"]} missing      directory does not exist            \u2192 skipped
+  ${ICON["skip-unbound"]} no workspace unbound + no workspaceId in manifest  \u2192 skipped (add one, or onboard manually)
+
+Examples:
+  $ sechroom sweep --dry-run            preview every repo's disposition, run nothing
+  $ sechroom sweep                      onboard the whole tree from the root
+  $ sechroom --tenant ocd sweep         force a tenant for every child (else each resolves its own)`
+  ).action((opts, cmd) => {
+    const g = cmd.optsWithGlobals();
+    const json = Boolean(g.json);
+    const dryRun = Boolean(opts.dryRun);
+    const manifestPath = resolve(opts.manifest);
+    if (!existsSync6(manifestPath)) {
+      fail(`no manifest at ${manifestPath} \u2014 create ./.sechroom/repos.json listing the repos under this root (see \`sechroom sweep --help\`).`);
+    }
+    let manifest;
+    try {
+      manifest = JSON.parse(readFileSync5(manifestPath, "utf8"));
+    } catch (err2) {
+      fail(`couldn't parse ${manifestPath}: ${err2 instanceof Error ? err2.message : String(err2)}`);
+    }
+    const repos = Array.isArray(manifest.repos) ? manifest.repos.filter((r) => r && typeof r.path === "string") : [];
+    if (repos.length === 0) {
+      if (json) {
+        process.stdout.write(JSON.stringify({ manifest: manifestPath, repos: [] }) + "\n");
+      } else {
+        process.stderr.write(`${warn("\u26A0")} ${manifestPath} lists no repos \u2014 nothing to do.
+`);
+      }
+      return;
+    }
+    const root = dirname6(dirname6(manifestPath));
+    const globals = passthroughGlobals(g);
+    const plans = repos.map((entry) => planEntry(entry, root));
+    if (!json) {
+      process.stderr.write(
+        `${style.bold("sweep")} ${style.dim(`(${plans.length} repo${plans.length === 1 ? "" : "s"} from ${manifestPath})`)}
+`
+      );
+    }
+    const results = [];
+    for (const plan of plans) {
+      const runs = plan.argv.length > 0;
+      const argv = runs ? [...globals, ...plan.argv] : [];
+      const skipped2 = !runs;
+      if (!json) {
+        const head = `  ${ICON[plan.disposition]} ${style.cyan(plan.entry.path)} ${style.dim(plan.reason)}`;
+        process.stderr.write(head + "\n");
+        if (runs && dryRun) process.stderr.write(`      ${style.dim(`would run: sechroom ${argv.join(" ")}`)}
+`);
+      }
+      let exitCode = skipped2 ? null : 0;
+      if (runs && !dryRun) {
+        const res = spawnSync(process.execPath, [process.argv[1], ...argv], {
+          cwd: plan.dir,
+          stdio: json ? "ignore" : "inherit"
+        });
+        exitCode = res.status;
+        if (!json) {
+          process.stderr.write(
+            exitCode === 0 ? `      ${ok("\u2713")} ${style.dim("onboard ok")}
+` : `      ${warn("\u2717")} ${style.dim(`onboard exited ${exitCode ?? "signal"}`)}
+`
+          );
+        }
+      }
+      results.push({
+        path: plan.entry.path,
+        dir: plan.dir,
+        disposition: plan.disposition,
+        ran: runs && !dryRun,
+        exitCode,
+        reason: plan.reason
+      });
+    }
+    if (json) {
+      process.stdout.write(JSON.stringify({ manifest: manifestPath, dryRun, repos: results }) + "\n");
+      return;
+    }
+    const ran = results.filter((r) => r.ran);
+    const failed = ran.filter((r) => r.exitCode !== 0);
+    const skipped = results.filter((r) => r.disposition.startsWith("skip"));
+    const wouldRun = results.filter((r) => !r.disposition.startsWith("skip"));
+    const tally = (dryRun ? [wouldRun.length ? `${wouldRun.length} would onboard` : null, skipped.length ? `${skipped.length} would skip` : null] : [
+      ran.length ? `${ran.length - failed.length}/${ran.length} onboarded` : null,
+      skipped.length ? `${skipped.length} skipped` : null,
+      failed.length ? `${failed.length} failed` : null
+    ]).filter(Boolean).join(", ");
+    process.stderr.write(`
+${failed.length ? warn("\u26A0") : ok("\u2713")} ${tally || "nothing to do"}${dryRun ? style.dim(" (dry run)") : ""}
+`);
+    if (failed.length) process.exit(1);
+  });
+}
+
 // src/commands/skills.ts
 import { homedir as homedir6 } from "os";
-import { join as join6 } from "path";
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, rmSync as rmSync2, existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+import { join as join7 } from "path";
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, rmSync as rmSync2, existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
 var DEFAULT_SLUG = "operator-skills";
 var ROLE_TAGS = ["sechroom:role:skill-template", "role:skill-template"];
 var LOCK = ".sechroom-skills.json";
 function skillsDir(global) {
-  return global ? join6(homedir6(), ".claude", "skills") : join6(process.cwd(), ".claude", "skills");
+  return global ? join7(homedir6(), ".claude", "skills") : join7(process.cwd(), ".claude", "skills");
 }
 function tagValue2(tags, prefix) {
   return (tags ?? []).find((t) => t.startsWith(prefix))?.slice(prefix.length);
@@ -3448,13 +3609,13 @@ Examples:
       const name = tagValue2(tags, "skill:");
       if (!name) continue;
       const body = m.text ?? m.Text ?? "";
-      mkdirSync6(join6(dir, name), { recursive: true });
-      writeFileSync6(join6(dir, name, "SKILL.md"), body.endsWith("\n") ? body : body + "\n");
+      mkdirSync6(join7(dir, name), { recursive: true });
+      writeFileSync6(join7(dir, name, "SKILL.md"), body.endsWith("\n") ? body : body + "\n");
       written.push(name);
     }
     mkdirSync6(dir, { recursive: true });
-    const lockPath = join6(dir, LOCK);
-    const lock = existsSync6(lockPath) ? JSON.parse(readFileSync5(lockPath, "utf8")) : {};
+    const lockPath = join7(dir, LOCK);
+    const lock = existsSync7(lockPath) ? JSON.parse(readFileSync6(lockPath, "utf8")) : {};
     lock[slug] = { surface: opts.surface, version, instance: wantInstance, skills: written.sort() };
     writeFileSync6(lockPath, JSON.stringify(lock, null, 2) + "\n");
     if (opts.json) return emit({ slug, version, instance: wantInstance, surface: opts.surface, dir, installed: written }, true);
@@ -3478,15 +3639,15 @@ Examples:
   skills.command("clean [slug]").description(`Remove materialised skill files written by install (default ${DEFAULT_SLUG})`).option("--local", "clean ./.claude/skills instead of ~/.claude/skills").option("--json", "machine output").action(async (slugArg, opts) => {
     const slug = slugArg || DEFAULT_SLUG;
     const dir = skillsDir(!opts.local);
-    const lockPath = join6(dir, LOCK);
-    if (!existsSync6(lockPath)) fail(`No skills lockfile at ${lockPath}; nothing to clean.`);
-    const lock = JSON.parse(readFileSync5(lockPath, "utf8"));
+    const lockPath = join7(dir, LOCK);
+    if (!existsSync7(lockPath)) fail(`No skills lockfile at ${lockPath}; nothing to clean.`);
+    const lock = JSON.parse(readFileSync6(lockPath, "utf8"));
     const entry = lock[slug];
     if (!entry) fail(`No installed record for '${slug}' in ${lockPath}.`);
     const removed = [];
     for (const name of entry.skills) {
-      const skillPath = join6(dir, name);
-      if (existsSync6(skillPath)) {
+      const skillPath = join7(dir, name);
+      if (existsSync7(skillPath)) {
         rmSync2(skillPath, { recursive: true, force: true });
         removed.push(name);
       }
@@ -3582,21 +3743,21 @@ Examples:
 
 // src/commands/reset.ts
 import { homedir as homedir7 } from "os";
-import { join as join7 } from "path";
-import { existsSync as existsSync7, readFileSync as readFileSync6, rmSync as rmSync3 } from "fs";
+import { join as join8 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync7, rmSync as rmSync3 } from "fs";
 var SKILLS_LOCK = ".sechroom-skills.json";
-var localSkillsDir = () => join7(process.cwd(), ".claude", "skills");
-var globalSkillsDir = () => join7(homedir7(), ".claude", "skills");
+var localSkillsDir = () => join8(process.cwd(), ".claude", "skills");
+var globalSkillsDir = () => join8(homedir7(), ".claude", "skills");
 function removeMaterialisedSkills(dir) {
   const removed = [];
-  const lockPath = join7(dir, SKILLS_LOCK);
-  if (!existsSync7(lockPath)) return removed;
+  const lockPath = join8(dir, SKILLS_LOCK);
+  if (!existsSync8(lockPath)) return removed;
   try {
-    const lock = JSON.parse(readFileSync6(lockPath, "utf8"));
+    const lock = JSON.parse(readFileSync7(lockPath, "utf8"));
     for (const entry of Object.values(lock)) {
       for (const name of entry.skills ?? []) {
-        const p = join7(dir, name);
-        if (existsSync7(p)) {
+        const p = join8(dir, name);
+        if (existsSync8(p)) {
           rmSync3(p, { recursive: true, force: true });
           removed.push(p);
         }
@@ -3627,18 +3788,18 @@ function registerReset(program2) {
       }
     }
     const removed = [];
-    const stateDir = join7(process.cwd(), ".sechroom");
-    if (existsSync7(stateDir)) {
+    const stateDir = join8(process.cwd(), ".sechroom");
+    if (existsSync8(stateDir)) {
       rmSync3(stateDir, { recursive: true, force: true });
       removed.push(stateDir);
     }
-    const legacyCfg = join7(process.cwd(), ".sechroom.json");
-    if (existsSync7(legacyCfg)) {
+    const legacyCfg = join8(process.cwd(), ".sechroom.json");
+    if (existsSync8(legacyCfg)) {
       rmSync3(legacyCfg, { force: true });
       removed.push(legacyCfg);
     }
-    const legacySem = join7(process.cwd(), ".sem");
-    if (existsSync7(legacySem)) {
+    const legacySem = join8(process.cwd(), ".sem");
+    if (existsSync8(legacySem)) {
       rmSync3(legacySem, { force: true });
       removed.push(legacySem);
     }
@@ -3665,7 +3826,7 @@ function registerReset(program2) {
 function resolveVersion() {
   try {
     const pkg = JSON.parse(
-      readFileSync7(new URL("../package.json", import.meta.url), "utf8")
+      readFileSync8(new URL("../package.json", import.meta.url), "utf8")
     );
     return pkg.version ?? "0.0.0";
   } catch {
@@ -3681,7 +3842,7 @@ Examples:
   $ sechroom onboard                              guided first-run: configure, sign in, wire this project
   $ sechroom login                                sign in via browser (OAuth + PKCE)
   $ sechroom config set tenant ocd                set your tenant (global)
-  $ sechroom config set --local tenant cli-smoke  pin tenant for this directory (.sechroom/config.json)
+  $ sechroom config set --local tenant cli-smoke  pin tenant for this directory (committed .sechroom.json)
   $ sechroom config show                          resolved config + which source won
 
   $ sechroom memory create --text "a note" --title "Note" --tag idea
@@ -3693,7 +3854,7 @@ Examples:
   $ sechroom --json memory search "auth"           compact JSON for scripts and agents
   $ SECHROOM_TOKEN=<bearer> sechroom --json memory get mem_XXXX    headless
 
-Config precedence (high -> low): --flag  >  env (SECHROOM_*)  >  ./.sechroom/config.json (legacy ./.sechroom.json)  >  global  >  default.
+Config precedence (high -> low): --flag  >  env (SECHROOM_*)  >  directory-local (committed ./.sechroom.json, shadowed per-field by the gitignored ./.sechroom/config.json override)  >  global  >  default.
 Run 'sechroom <command> --help' for command-specific examples.`
 );
 program.hook("preAction", (_thisCmd, actionCmd) => {
@@ -3719,11 +3880,11 @@ config.addHelpText(
 Examples:
   $ sechroom config set baseUrl https://app.sechroom.ai/api   prod (staging: https://staging.app.sechroom.ai/api)
   $ sechroom config set tenant ocd
-  $ sechroom config set --local tenant cli-smoke              this dir + subdirs (.sechroom/config.json)
+  $ sechroom config set --local tenant cli-smoke              this dir + subdirs (committed .sechroom.json)
   $ sechroom config set clientId dyn-XXXX                     global-only escape hatch (no DCR endpoint)
   $ sechroom config show --json`
 );
-config.command("set <key> <value>").description("Set baseUrl | tenant | workspaceId | defaultProjectId | clientId (clientId is global-only)").option("--local", "Write to the directory-local .sechroom/config.json (nearest up the tree, else cwd; migrates a legacy .sechroom.json) instead of the global config").action((key, value, opts) => {
+config.command("set <key> <value>").description("Set baseUrl | tenant | workspaceId | defaultProjectId | clientId (clientId is global-only)").option("--local", "Write the committed directory-local .sechroom.json (nearest up the tree, else cwd) instead of the global config").action((key, value, opts) => {
   if (opts.local) {
     if (!["baseUrl", "tenant", "workspaceId", "defaultProjectId"].includes(key)) {
       process.stderr.write(`--local supports only: baseUrl | tenant | workspaceId | defaultProjectId (clientId is global)
@@ -3782,6 +3943,7 @@ registerChat(program);
 registerInit(program);
 registerSetup(program);
 registerOnboard(program);
+registerSweep(program);
 registerSkills(program);
 registerReset(program);
 program.parseAsync().catch((err2) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.6.23",
+  "version": "2026.6.24",
   "description": "Sechroom CLI — a thin, generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.",
   "type": "module",
   "license": "UNLICENSED",