@sechroom/cli 2026.6.238-rc.10da7380 → 2026.6.239-rc.6418da97

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 import { Command } from "commander";
 
 // src/auth.ts
@@ -1590,13 +1590,13 @@ Examples:
 }
 
 // src/commands/checkpoint.ts
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname5, join as join8 } from "path";
+import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname6, join as join9 } from "path";
 
 // src/commands/hook.ts
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync4, statSync as statSync2, writeFileSync as writeFileSync5 } from "fs";
-import { delimiter, dirname as dirname4, join as join7 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync5, statSync as statSync2, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname5, join as join8 } from "path";
 
 // src/sem.ts
 import { dirname as dirname2, join as join5 } from "path";
@@ -1686,6 +1686,9 @@ function writeSem(values, path = localSemPath()) {
   ensureContinuityScaffold(path);
   return path;
 }
+function ensureStateDirIgnored(cwd = process.cwd()) {
+  ensureSemIgnored(localSemPath(cwd));
+}
 var CONTINUITY_FILE_NAME = "continuity.json";
 var CONTINUITY_SCAFFOLD = JSON.stringify(
   {
@@ -1757,6 +1760,10 @@ function ensureSemIgnored(semPath) {
   }
 }
 
+// src/commands/hook-install.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
+import { delimiter, dirname as dirname4, join as join7 } from "path";
+
 // src/setup/clients.ts
 import { existsSync as existsSync5 } from "fs";
 import { homedir as homedir3 } from "os";
@@ -1827,6 +1834,144 @@ function detectInstalledClients(cwd) {
   return detected;
 }
 
+// src/commands/hook-install.ts
+var CLAUDE_HOOK_COMMANDS = {
+  SessionStart: "sechroom hook session-start",
+  PreCompact: "sechroom hook pre-compact",
+  SessionEnd: "sechroom hook session-end",
+  // WLP telemetry tap (D-WLP-10) — per-turn executor self-report. No-op (exit 0) unless this
+  // checkout is bound to a decomposition+task via `sechroom telemetry bind`, so it's safe to wire
+  // for every Claude install. Claude-only (it parses a Claude Code transcript).
+  Stop: "sechroom telemetry hook"
+};
+var CODEX_HOOK_COMMANDS = {
+  SessionStart: "sechroom hook session-start",
+  Stop: "sechroom hook session-end --debounce-minutes 10"
+};
+function hasHookCommand(config2, event, command) {
+  const groups = config2.hooks?.[event] ?? [];
+  return groups.some((g) => (g.hooks ?? []).some((h) => h.type === "command" && h.command === command));
+}
+function mergeHooks(config2, commands) {
+  config2.hooks ??= {};
+  let added = 0;
+  for (const [event, command] of Object.entries(commands)) {
+    if (hasHookCommand(config2, event, command)) continue;
+    const groups = config2.hooks[event] ??= [];
+    groups.push({ hooks: [{ type: "command", command }] });
+    added += 1;
+  }
+  return added;
+}
+function readJsonConfig2(path) {
+  if (!existsSync6(path)) return {};
+  const raw = readFileSync4(path, "utf8");
+  if (!raw.trim()) return {};
+  return JSON.parse(raw);
+}
+function installHooksJson(path, commands, dryRun) {
+  const existed = existsSync6(path) && readFileSync4(path, "utf8").trim().length > 0;
+  const config2 = readJsonConfig2(path);
+  const added = mergeHooks(config2, commands);
+  if (added === 0 && existed) return { path, status: "current" };
+  if (!dryRun) {
+    mkdirSync5(dirname4(path), { recursive: true });
+    writeFileSync5(path, JSON.stringify(config2, null, 2) + "\n");
+  }
+  return { path, status: existed ? "merged" : "created" };
+}
+function installClaudeCommands(claudeDir, commands, dryRun) {
+  return installHooksJson(join7(claudeDir, "settings.json"), commands, dryRun);
+}
+function ensureCodexFeaturesHooks(content) {
+  const lines = content.split("\n");
+  const headerIdx = lines.findIndex((l) => l.trim() === "[features]");
+  if (headerIdx === -1) {
+    const base = content.length === 0 || content.endsWith("\n") ? content : content + "\n";
+    return { next: base + "\n[features]\nhooks = true\n", changed: true };
+  }
+  for (let i = headerIdx + 1; i < lines.length; i += 1) {
+    const trimmed = lines[i].trim();
+    if (trimmed.startsWith("[") && trimmed.endsWith("]")) break;
+    const m = lines[i].match(/^(\s*)hooks(\s*)=(\s*)(.*)$/);
+    if (!m) continue;
+    const value = m[4].replace(/\s*#.*$/, "").trim();
+    if (value === "true") return { next: content, changed: false };
+    lines[i] = `${m[1]}hooks${m[2]}=${m[3]}true`;
+    return { next: lines.join("\n"), changed: true };
+  }
+  lines.splice(headerIdx + 1, 0, "hooks = true");
+  return { next: lines.join("\n"), changed: true };
+}
+function installCodexFeatureFlag(path, dryRun) {
+  const existed = existsSync6(path);
+  const content = existed ? readFileSync4(path, "utf8") : "";
+  const { next, changed } = ensureCodexFeaturesHooks(content);
+  if (!changed) return { path, status: "current" };
+  if (!dryRun) {
+    mkdirSync5(dirname4(path), { recursive: true });
+    writeFileSync5(path, next);
+  }
+  return { path, status: existed ? "merged" : "created" };
+}
+function resolveSurfaces(surface, cwd) {
+  if (surface === "claude") return ["claude"];
+  if (surface === "codex") return ["codex"];
+  if (surface === "both") return ["claude", "codex"];
+  if (surface) throw new Error(`--surface must be one of claude | codex | both (got '${surface}')`);
+  const surfaces = detectHookSurfaces(cwd);
+  return surfaces.length > 0 ? surfaces : ["claude", "codex"];
+}
+function describe(result, dryRun) {
+  if (result.status === "current") return `  \u2713 ${result.path} (already configured)`;
+  const verb = dryRun ? "would" : result.status === "created" ? "created" : "updated";
+  return `  \u2713 ${result.path} (${dryRun ? `${verb} ${result.status === "created" ? "create" : "update"}` : verb})`;
+}
+var HOOK_SURFACE_LABEL = {
+  claude: "Claude Code",
+  codex: "Codex"
+};
+function installHookSurfaces(surfaces, opts) {
+  const out = [];
+  for (const surface of surfaces) {
+    if (surface === "claude") {
+      const path = join7(opts.claudeDir, "settings.json");
+      out.push({ surface, results: [installHooksJson(path, CLAUDE_HOOK_COMMANDS, opts.dryRun)] });
+    } else {
+      const hooksJson = installHooksJson(join7(opts.codexHome, "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
+      const featureFlag = installCodexFeatureFlag(join7(opts.codexHome, "config.toml"), opts.dryRun);
+      out.push({ surface, results: [hooksJson, featureFlag] });
+    }
+  }
+  return out;
+}
+function detectHookSurfaces(cwd) {
+  const detected = detectInstalledClients(cwd);
+  const surfaces = [];
+  if (detected.includes("claude-code")) surfaces.push("claude");
+  if (detected.includes("codex")) surfaces.push("codex");
+  return surfaces;
+}
+function isSechroomOnPath() {
+  const pathEnv = process.env.PATH ?? "";
+  if (!pathEnv) return false;
+  const names = process.platform === "win32" ? ["sechroom.cmd", "sechroom.exe", "sechroom.bat", "sechroom"] : ["sechroom"];
+  for (const dir of pathEnv.split(delimiter)) {
+    if (!dir) continue;
+    for (const name of names) {
+      if (existsSync6(join7(dir, name))) return true;
+    }
+  }
+  return false;
+}
+function warnIfSechroomNotOnPath(write = (s) => void process.stderr.write(s)) {
+  if (isSechroomOnPath()) return false;
+  write(
+    "\n\u26A0  `sechroom` isn't on your PATH. The hooks run a bare `sechroom hook \u2026` command\n   when your agent fires them, so a non-global install (npx / local) will fail at\n   that point. Install globally so the command resolves:\n     npm i -g @sechroom/cli\n"
+  );
+  return true;
+}
+
 // src/commands/hook.ts
 async function readStdin() {
   if (process.stdin.isTTY) return "";
@@ -1851,13 +1996,13 @@ function resolveLane(flagLane, cwd) {
   if (!base) return void 0;
   return applyWorktreeLaneSuffix(base, start);
 }
-var INTENT_FILE = join7(".sechroom", "continuity.json");
+var INTENT_FILE = join8(".sechroom", "continuity.json");
 function resolveIntentPath(start) {
   let dir = start;
   for (; ; ) {
-    const candidate = join7(dir, INTENT_FILE);
-    if (existsSync6(candidate)) return candidate;
-    const parent = dirname4(dir);
+    const candidate = join8(dir, INTENT_FILE);
+    if (existsSync7(candidate)) return candidate;
+    const parent = dirname5(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
@@ -1866,7 +2011,7 @@ function readIntent(start) {
   const path = resolveIntentPath(start);
   if (!path) return void 0;
   try {
-    return JSON.parse(readFileSync4(path, "utf8"));
+    return JSON.parse(readFileSync5(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -1908,14 +2053,14 @@ async function saveSnapshotFromIntent(cmd, cwd, laneFlag, scopeFlag, defaultScop
 }
 function ledgerPath(start) {
   const intent = resolveIntentPath(start);
-  const dir = intent ? dirname4(intent) : join7(start, ".sechroom");
-  return join7(dir, ".checkpoint-state.json");
+  const dir = intent ? dirname5(intent) : join8(start, ".sechroom");
+  return join8(dir, ".checkpoint-state.json");
 }
 function readLedger(start) {
   try {
     const p = ledgerPath(start);
-    if (!existsSync6(p)) return {};
-    return JSON.parse(readFileSync4(p, "utf8"));
+    if (!existsSync7(p)) return {};
+    return JSON.parse(readFileSync5(p, "utf8"));
   } catch {
     return {};
   }
@@ -1962,13 +2107,13 @@ function recordPush(start, intent) {
     } catch {
       mtimeMs = void 0;
     }
-    mkdirSync5(dirname4(p), { recursive: true });
+    mkdirSync6(dirname5(p), { recursive: true });
     const ledger = {
       lastEpochMs: Date.now(),
       lastMtimeMs: mtimeMs,
       lastHash: intentHash(intent)
     };
-    writeFileSync5(p, JSON.stringify(ledger) + "\n");
+    writeFileSync6(p, JSON.stringify(ledger) + "\n");
   } catch {
   }
 }
@@ -2008,135 +2153,6 @@ function emitSessionStart(additionalContext) {
     }) + "\n"
   );
 }
-var CLAUDE_HOOK_COMMANDS = {
-  SessionStart: "sechroom hook session-start",
-  PreCompact: "sechroom hook pre-compact",
-  SessionEnd: "sechroom hook session-end"
-};
-var CODEX_HOOK_COMMANDS = {
-  SessionStart: "sechroom hook session-start",
-  Stop: "sechroom hook session-end --debounce-minutes 10"
-};
-function hasHookCommand(config2, event, command) {
-  const groups = config2.hooks?.[event] ?? [];
-  return groups.some((g) => (g.hooks ?? []).some((h) => h.type === "command" && h.command === command));
-}
-function mergeHooks(config2, commands) {
-  config2.hooks ??= {};
-  let added = 0;
-  for (const [event, command] of Object.entries(commands)) {
-    if (hasHookCommand(config2, event, command)) continue;
-    const groups = config2.hooks[event] ??= [];
-    groups.push({ hooks: [{ type: "command", command }] });
-    added += 1;
-  }
-  return added;
-}
-function readJsonConfig2(path) {
-  if (!existsSync6(path)) return {};
-  const raw = readFileSync4(path, "utf8");
-  if (!raw.trim()) return {};
-  return JSON.parse(raw);
-}
-function installHooksJson(path, commands, dryRun) {
-  const existed = existsSync6(path) && readFileSync4(path, "utf8").trim().length > 0;
-  const config2 = readJsonConfig2(path);
-  const added = mergeHooks(config2, commands);
-  if (added === 0 && existed) return { path, status: "current" };
-  if (!dryRun) {
-    mkdirSync5(dirname4(path), { recursive: true });
-    writeFileSync5(path, JSON.stringify(config2, null, 2) + "\n");
-  }
-  return { path, status: existed ? "merged" : "created" };
-}
-function ensureCodexFeaturesHooks(content) {
-  const lines = content.split("\n");
-  const headerIdx = lines.findIndex((l) => l.trim() === "[features]");
-  if (headerIdx === -1) {
-    const base = content.length === 0 || content.endsWith("\n") ? content : content + "\n";
-    return { next: base + "\n[features]\nhooks = true\n", changed: true };
-  }
-  for (let i = headerIdx + 1; i < lines.length; i += 1) {
-    const trimmed = lines[i].trim();
-    if (trimmed.startsWith("[") && trimmed.endsWith("]")) break;
-    const m = lines[i].match(/^(\s*)hooks(\s*)=(\s*)(.*)$/);
-    if (!m) continue;
-    const value = m[4].replace(/\s*#.*$/, "").trim();
-    if (value === "true") return { next: content, changed: false };
-    lines[i] = `${m[1]}hooks${m[2]}=${m[3]}true`;
-    return { next: lines.join("\n"), changed: true };
-  }
-  lines.splice(headerIdx + 1, 0, "hooks = true");
-  return { next: lines.join("\n"), changed: true };
-}
-function installCodexFeatureFlag(path, dryRun) {
-  const existed = existsSync6(path);
-  const content = existed ? readFileSync4(path, "utf8") : "";
-  const { next, changed } = ensureCodexFeaturesHooks(content);
-  if (!changed) return { path, status: "current" };
-  if (!dryRun) {
-    mkdirSync5(dirname4(path), { recursive: true });
-    writeFileSync5(path, next);
-  }
-  return { path, status: existed ? "merged" : "created" };
-}
-function resolveSurfaces(surface, cwd) {
-  if (surface === "claude") return ["claude"];
-  if (surface === "codex") return ["codex"];
-  if (surface === "both") return ["claude", "codex"];
-  if (surface) throw new Error(`--surface must be one of claude | codex | both (got '${surface}')`);
-  const surfaces = detectHookSurfaces(cwd);
-  return surfaces.length > 0 ? surfaces : ["claude", "codex"];
-}
-function describe(result, dryRun) {
-  if (result.status === "current") return `  \u2713 ${result.path} (already configured)`;
-  const verb = dryRun ? "would" : result.status === "created" ? "created" : "updated";
-  return `  \u2713 ${result.path} (${dryRun ? `${verb} ${result.status === "created" ? "create" : "update"}` : verb})`;
-}
-var HOOK_SURFACE_LABEL = {
-  claude: "Claude Code",
-  codex: "Codex"
-};
-function installHookSurfaces(surfaces, opts) {
-  const out = [];
-  for (const surface of surfaces) {
-    if (surface === "claude") {
-      const path = join7(opts.claudeDir, "settings.json");
-      out.push({ surface, results: [installHooksJson(path, CLAUDE_HOOK_COMMANDS, opts.dryRun)] });
-    } else {
-      const hooksJson = installHooksJson(join7(opts.codexHome, "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
-      const featureFlag = installCodexFeatureFlag(join7(opts.codexHome, "config.toml"), opts.dryRun);
-      out.push({ surface, results: [hooksJson, featureFlag] });
-    }
-  }
-  return out;
-}
-function detectHookSurfaces(cwd) {
-  const detected = detectInstalledClients(cwd);
-  const surfaces = [];
-  if (detected.includes("claude-code")) surfaces.push("claude");
-  if (detected.includes("codex")) surfaces.push("codex");
-  return surfaces;
-}
-function isSechroomOnPath() {
-  const pathEnv = process.env.PATH ?? "";
-  if (!pathEnv) return false;
-  const names = process.platform === "win32" ? ["sechroom.cmd", "sechroom.exe", "sechroom.bat", "sechroom"] : ["sechroom"];
-  for (const dir of pathEnv.split(delimiter)) {
-    if (!dir) continue;
-    for (const name of names) {
-      if (existsSync6(join7(dir, name))) return true;
-    }
-  }
-  return false;
-}
-function warnIfSechroomNotOnPath(write = (s) => void process.stderr.write(s)) {
-  if (isSechroomOnPath()) return false;
-  write(
-    "\n\u26A0  `sechroom` isn't on your PATH. The hooks run a bare `sechroom hook \u2026` command\n   when your agent fires them, so a non-global install (npx / local) will fail at\n   that point. Install globally so the command resolves:\n     npm i -g @sechroom/cli\n"
-  );
-  return true;
-}
 function registerHook(program2) {
   const hook = program2.command("hook").description("Agent-lifecycle hook adapter (Claude Code / Codex) \u2014 bridges hooks to continuity");
   hook.addHelpText(
@@ -2344,10 +2360,10 @@ Examples:
       const client = await makeClient(cfg);
       return client.POST("/continuity/snapshots", { body });
     });
-    const path = resolveIntentPath(cwd) ?? join8(cwd, INTENT_FILE);
+    const path = resolveIntentPath(cwd) ?? join9(cwd, INTENT_FILE);
     const fileBody = { ...merged, scope, lastSnapshotId: data.snapshotId };
-    mkdirSync6(dirname5(path), { recursive: true });
-    writeFileSync6(path, JSON.stringify(fileBody, null, 2) + "\n");
+    mkdirSync7(dirname6(path), { recursive: true });
+    writeFileSync7(path, JSON.stringify(fileBody, null, 2) + "\n");
     recordPush(cwd, merged);
     if (json) {
       emit({ snapshotId: data.snapshotId, lane, scope, file: path }, true);
@@ -3031,8 +3047,8 @@ Examples:
 
 // src/setup/apply.ts
 import { createHash as createHash3 } from "crypto";
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync7, existsSync as existsSync7 } from "fs";
-import { dirname as dirname6 } from "path";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync8, existsSync as existsSync8 } from "fs";
+import { dirname as dirname7 } from "path";
 var MARKER_BEGIN = "<!-- @sechroom/cli:begin";
 var MARKER_END = "<!-- @sechroom/cli:end";
 function normalizeBody(s) {
@@ -3085,22 +3101,22 @@ function parseManagedBlock(content, block) {
   return null;
 }
 function ensureDir2(path) {
-  mkdirSync7(dirname6(path), { recursive: true });
+  mkdirSync8(dirname7(path), { recursive: true });
 }
 function readOr(path, fallback) {
   try {
-    return readFileSync5(path, "utf8");
+    return readFileSync6(path, "utf8");
   } catch {
     return fallback;
   }
 }
 function mergeMcpJson(path, snippet, dryRun) {
   const incoming = JSON.parse(snippet);
-  const existed = existsSync7(path);
+  const existed = existsSync8(path);
   let current = {};
   if (existed) {
     try {
-      current = JSON.parse(readFileSync5(path, "utf8"));
+      current = JSON.parse(readFileSync6(path, "utf8"));
     } catch {
       return { kind: "mcp", path, status: "skipped", note: "existing file isn't valid JSON \u2014 left untouched" };
     }
@@ -3108,26 +3124,26 @@ function mergeMcpJson(path, snippet, dryRun) {
   current.mcpServers = { ...current.mcpServers ?? {}, ...incoming.mcpServers ?? {} };
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync7(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
+  writeFileSync8(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function mergeCodexToml(path, snippet, dryRun) {
-  const existed = existsSync7(path);
+  const existed = existsSync8(path);
   let body = readOr(path, "");
   body = body.replace(/(^|\n)\[mcp_servers\.sechroom\][^[]*/, "\n").replace(/\n{3,}/g, "\n\n");
   const trimmed = body.trim();
   const next = (trimmed.length > 0 ? trimmed + "\n\n" : "") + snippet.trim() + "\n";
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync7(path, next, { mode: 384 });
+  writeFileSync8(path, next, { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function writeInstructionBlock(path, write, dryRun) {
-  const existed = existsSync7(path);
+  const existed = existsSync8(path);
   const next = computeBlockFile(readOr(path, ""), write);
   if (dryRun) return { kind: "instruction", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync7(path, next);
+  writeFileSync8(path, next);
   return { kind: "instruction", path, status: existed ? "merged" : "created" };
 }
 function computeBlockFile(current, write) {
@@ -3168,7 +3184,7 @@ function applyBlock(path, write, mode, dryRun) {
     const next = computeBlockFile(current, write);
     if (!dryRun) {
       ensureDir2(proposedPath);
-      writeFileSync7(proposedPath, next);
+      writeFileSync8(proposedPath, next);
     }
     return {
       kind: "instruction",
@@ -3292,8 +3308,8 @@ auto-resumes where you left off and checkpoints working state before compacting.
 }
 
 // src/setup/skills-offer.ts
-import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "fs";
-import { join as join9 } from "path";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "fs";
+import { join as join10 } from "path";
 
 // src/setup/lane-pin.ts
 var CODE_LANE_PREFIX_BY_CLIENT = {
@@ -3409,8 +3425,8 @@ Found ${summary} available to you for ${surface}.
   if (skills.length > 0) {
     const written = [];
     for (const s of skills) {
-      mkdirSync8(join9(sDir, s.name), { recursive: true });
-      writeFileSync8(join9(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
+      mkdirSync9(join10(sDir, s.name), { recursive: true });
+      writeFileSync9(join10(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
       written.push(s.name);
     }
     recordMaterialisedSkills(sDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -3418,11 +3434,11 @@ Found ${summary} available to you for ${surface}.
 `);
   }
   if (agents.length > 0) {
-    mkdirSync8(aDir, { recursive: true });
+    mkdirSync9(aDir, { recursive: true });
     const written = [];
     for (const a of agents) {
       const file = `${a.name}.md`;
-      writeFileSync8(join9(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
+      writeFileSync9(join10(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
       written.push(file);
     }
     recordMaterialisedSkills(aDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -3805,13 +3821,13 @@ Wired to namespace '${slug}'. Restart your AI client (or reload MCP) to pick it
 }
 
 // src/commands/onboard.ts
-import { existsSync as existsSync9 } from "fs";
-import { basename as basename2, join as join11 } from "path";
+import { existsSync as existsSync10 } from "fs";
+import { basename as basename2, join as join12 } from "path";
 
 // src/commands/fanout.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
-import { isAbsolute, join as join10, resolve } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync7, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
+import { isAbsolute, join as join11, resolve } from "path";
 var ICON = {
   refresh: "\u21BB",
   bind: "+",
@@ -3831,21 +3847,21 @@ function discoverChildren(root) {
   const out = [];
   for (const name of names.sort()) {
     if (name.startsWith(".") || name === "node_modules") continue;
-    const dir = join10(root, name);
+    const dir = join11(root, name);
     try {
       if (!statSync3(dir).isDirectory()) continue;
     } catch {
       continue;
     }
-    if (existsSync8(join10(dir, ".git")) || committedBindingPath(dir)) out.push(name);
+    if (existsSync9(join11(dir, ".git")) || committedBindingPath(dir)) out.push(name);
   }
   return out;
 }
 function readManifest(path) {
-  if (!existsSync8(path)) return null;
+  if (!existsSync9(path)) return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync6(path, "utf8"));
+    parsed = JSON.parse(readFileSync7(path, "utf8"));
   } catch (err2) {
     throw new Error(`couldn't parse ${path}: ${err2 instanceof Error ? err2.message : String(err2)}`);
   }
@@ -4222,10 +4238,10 @@ async function chooseScope(scopeFlag, yes) {
 }
 async function planRecurseChild(entry, root, client, opts) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync9(dir)) {
+  if (!existsSync10(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
-  if (existsSync9(join11(dir, ".sechroom.json"))) {
+  if (existsSync10(join12(dir, ".sechroom.json"))) {
     return {
       label: entry.path,
       dir,
@@ -4298,7 +4314,7 @@ This fan-out will pin the same lane in every repo:
 async function runRecurse(cfg, g, opts) {
   const { yes, dryRun, json } = opts;
   const root = process.cwd();
-  const manifestPath = join11(root, ".sechroom", "repos.json");
+  const manifestPath = join12(root, ".sechroom", "repos.json");
   const fromManifest = readManifest(manifestPath);
   const entries = fromManifest ?? discoverChildren(root).map((path) => ({ path }));
   const sourceLabel = fromManifest ? `manifest ${manifestPath}` : `auto-discovered under ${root}`;
@@ -4810,23 +4826,23 @@ Examples:
 
 // src/commands/reset.ts
 import { homedir as homedir4 } from "os";
-import { join as join12 } from "path";
-import { existsSync as existsSync10, readFileSync as readFileSync7, rmSync as rmSync3 } from "fs";
+import { join as join13 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync8, rmSync as rmSync3 } from "fs";
 var SKILLS_LOCK2 = ".sechroom-skills.json";
-var localSkillsDir = () => join12(process.cwd(), ".claude", "skills");
-var globalSkillsDir = () => join12(homedir4(), ".claude", "skills");
-var localAgentsDir = () => join12(process.cwd(), ".claude", "agents");
-var globalAgentsDir = () => join12(homedir4(), ".claude", "agents");
+var localSkillsDir = () => join13(process.cwd(), ".claude", "skills");
+var globalSkillsDir = () => join13(homedir4(), ".claude", "skills");
+var localAgentsDir = () => join13(process.cwd(), ".claude", "agents");
+var globalAgentsDir = () => join13(homedir4(), ".claude", "agents");
 function removeMaterialisedSkills(dir) {
   const removed = [];
-  const lockPath = join12(dir, SKILLS_LOCK2);
-  if (!existsSync10(lockPath)) return removed;
+  const lockPath = join13(dir, SKILLS_LOCK2);
+  if (!existsSync11(lockPath)) return removed;
   try {
-    const lock = JSON.parse(readFileSync7(lockPath, "utf8"));
+    const lock = JSON.parse(readFileSync8(lockPath, "utf8"));
     for (const entry of Object.values(lock)) {
       for (const name of entry.skills ?? []) {
-        const p = join12(dir, name);
-        if (existsSync10(p)) {
+        const p = join13(dir, name);
+        if (existsSync11(p)) {
           rmSync3(p, { recursive: true, force: true });
           removed.push(p);
         }
@@ -4871,18 +4887,18 @@ function registerReset(program2) {
       }
     }
     const removed = [];
-    const stateDir = join12(process.cwd(), ".sechroom");
-    if (existsSync10(stateDir)) {
+    const stateDir = join13(process.cwd(), ".sechroom");
+    if (existsSync11(stateDir)) {
       rmSync3(stateDir, { recursive: true, force: true });
       removed.push(stateDir);
     }
-    const legacyCfg = join12(process.cwd(), ".sechroom.json");
-    if (existsSync10(legacyCfg)) {
+    const legacyCfg = join13(process.cwd(), ".sechroom.json");
+    if (existsSync11(legacyCfg)) {
       rmSync3(legacyCfg, { force: true });
       removed.push(legacyCfg);
     }
-    const legacySem = join12(process.cwd(), ".sem");
-    if (existsSync10(legacySem)) {
+    const legacySem = join13(process.cwd(), ".sem");
+    if (existsSync11(legacySem)) {
       rmSync3(legacySem, { force: true });
       removed.push(legacySem);
     }
@@ -4908,8 +4924,8 @@ function registerReset(program2) {
 }
 
 // src/commands/skills.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync9, statSync as statSync4, writeFileSync as writeFileSync9 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync10, statSync as statSync4, writeFileSync as writeFileSync10 } from "fs";
+import { join as join14 } from "path";
 function filenameFromDisposition(header) {
   if (!header) return void 0;
   const m = /filename\*?=(?:UTF-8'')?"?([^";]+)"?/i.exec(header);
@@ -4917,11 +4933,11 @@ function filenameFromDisposition(header) {
 }
 function resolveOutputPath(output, serverFilename) {
   const filename = serverFilename || "skills.zip";
-  if (!output) return join13(process.cwd(), filename);
-  const looksLikeDir = output.endsWith("/") || existsSync11(output) && statSync4(output).isDirectory();
+  if (!output) return join14(process.cwd(), filename);
+  const looksLikeDir = output.endsWith("/") || existsSync12(output) && statSync4(output).isDirectory();
   if (looksLikeDir) {
-    mkdirSync9(output, { recursive: true });
-    return join13(output, filename);
+    mkdirSync10(output, { recursive: true });
+    return join14(output, filename);
   }
   return output;
 }
@@ -4952,7 +4968,7 @@ async function downloadZip(label, call, output) {
   const buf = Buffer.from(res.data);
   const filename = filenameFromDisposition(res.response.headers.get("content-disposition")) ?? "skills.zip";
   const path = resolveOutputPath(output, filename);
-  writeFileSync9(path, buf);
+  writeFileSync10(path, buf);
   return { path, bytes: buf.length, filename };
 }
 function registerSkills(program2) {
@@ -5120,12 +5136,12 @@ Examples:
 }
 
 // src/commands/sweep.ts
-import { existsSync as existsSync12 } from "fs";
-import { dirname as dirname7, join as join14, resolve as resolve2 } from "path";
-var DEFAULT_MANIFEST = join14(".sechroom", "repos.json");
+import { existsSync as existsSync13 } from "fs";
+import { dirname as dirname8, join as join15, resolve as resolve2 } from "path";
+var DEFAULT_MANIFEST = join15(".sechroom", "repos.json");
 function planEntry(entry, root) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync12(dir)) {
+  if (!existsSync13(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
   if (committedBindingPath(dir)) {
@@ -5201,7 +5217,7 @@ Examples:
 `);
       return;
     }
-    const root = dirname7(dirname7(manifestPath));
+    const root = dirname8(dirname8(manifestPath));
     const plans = repos.map((entry) => planEntry(entry, root));
     if (!json) {
       process.stderr.write(
@@ -5219,6 +5235,14 @@ Examples:
 }
 
 // src/commands/telemetry.ts
+import {
+  existsSync as existsSync14,
+  mkdirSync as mkdirSync11,
+  readFileSync as readFileSync9,
+  rmSync as rmSync4,
+  writeFileSync as writeFileSync11
+} from "fs";
+import { dirname as dirname9, join as join16 } from "path";
 function registerTelemetry(program2) {
   const telemetry = program2.command("telemetry").description(
     "Emit WLP run telemetry (an executor leg's progress events) into a decomposition run"
@@ -5253,10 +5277,9 @@ function registerTelemetry(program2) {
   ).action(async (opts, cmd) => {
     const json = Boolean(cmd.optsWithGlobals().json);
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const kind = normalizeKind(opts.kind);
     const event = {
       taskId: opts.task,
-      kind,
+      kind: normalizeKind(opts.kind),
       tokensIn: opts.tokensIn ?? null,
       tokensOut: opts.tokensOut ?? null,
       contextUsed: opts.contextUsed ?? null,
@@ -5265,36 +5288,226 @@ function registerTelemetry(program2) {
       approvalState: opts.approval ?? null,
       verdict: opts.verdict ?? null
     };
-    const token = await requireToken(cfg);
-    const resp = await fetch(
-      `${cfg.baseUrl}/decompositions/${encodeURIComponent(opts.decomposition)}/run/telemetry`,
-      {
-        method: "POST",
-        headers: {
-          authorization: `Bearer ${token}`,
-          tenant: cfg.tenant,
-          "content-type": "application/json",
-          "x-sechroom-surface": "cli"
-        },
-        body: JSON.stringify({ events: [event] })
-      }
-    );
-    if (!resp.ok)
-      fail(
-        `Telemetry emit failed (HTTP ${resp.status}): ${await resp.text()}`
-      );
-    const body = await resp.json();
+    let body;
+    try {
+      body = await postTelemetry(cfg, opts.decomposition, [event]);
+    } catch (e) {
+      return fail(`Telemetry emit failed: ${e.message}`);
+    }
     if (json) {
       emit(body, true);
     } else {
       process.stderr.write(
         style.green("telemetry emitted") + style.dim(
-          ` \u2014 ${kind} for task ${opts.task}; run now carries ${body.eventCount} event${body.eventCount === 1 ? "" : "s"}
+          ` \u2014 ${event.kind} for task ${opts.task}; run now carries ${body.eventCount} event${body.eventCount === 1 ? "" : "s"}
 `
         )
       );
     }
   });
+  telemetry.command("bind").description(
+    "Bind this checkout to a decomposition+task so the Stop hook auto-emits per-turn telemetry"
+  ).requiredOption(
+    "--decomposition <id>",
+    "Decomposition id this session executes"
+  ).requiredOption("--task <id>", "Task id this session executes").action((opts, cmd) => {
+    const json = Boolean(cmd.optsWithGlobals().json);
+    const dir = join16(process.cwd(), ".sechroom");
+    mkdirSync11(dir, { recursive: true });
+    const path = join16(dir, BINDING_FILE);
+    const binding = {
+      decompositionId: opts.decomposition,
+      taskId: opts.task
+    };
+    writeFileSync11(path, JSON.stringify(binding, null, 2) + "\n");
+    ensureStateDirIgnored(process.cwd());
+    if (json) {
+      emit({ bound: true, ...binding, path }, true);
+    } else {
+      process.stdout.write(
+        style.green("telemetry bound") + style.dim(
+          ` \u2014 decomposition ${binding.decompositionId}, task ${binding.taskId} (${path})
+`
+        )
+      );
+    }
+  });
+  telemetry.command("unbind").description("Clear this checkout's telemetry binding").action((_opts, cmd) => {
+    const json = Boolean(cmd.optsWithGlobals().json);
+    const path = join16(process.cwd(), ".sechroom", BINDING_FILE);
+    const existed = existsSync14(path);
+    if (existed) rmSync4(path);
+    if (json) emit({ unbound: existed, path }, true);
+    else
+      process.stdout.write(
+        existed ? "telemetry binding cleared\n" : "no telemetry binding to clear\n"
+      );
+  });
+  telemetry.command("hook").description(
+    "Per-turn telemetry self-report for a Claude Code Stop hook (reads stdin; no-op unless bound). Fail-soft."
+  ).action(async (_opts, cmd) => {
+    try {
+      const raw = await readStdin2();
+      const input = parseHookInput2(raw);
+      const cwd = input.cwd ?? process.cwd();
+      const binding = findBinding(cwd);
+      if (!binding) return process.exit(0);
+      const usage = input.transcript_path ? parseTranscript(input.transcript_path) : null;
+      if (!usage) return process.exit(0);
+      const cfg = resolveConfig(cmd.optsWithGlobals());
+      await postTelemetry(cfg, binding.decompositionId, [
+        {
+          taskId: binding.taskId,
+          kind: "Parsed",
+          tokensIn: usage.tokensIn,
+          tokensOut: usage.tokensOut,
+          contextUsed: usage.contextUsed,
+          contextWindow: usage.contextWindow,
+          text: null,
+          approvalState: null,
+          verdict: null
+        }
+      ]);
+      return process.exit(0);
+    } catch {
+      return process.exit(0);
+    }
+  });
+  telemetry.command("install").description(
+    "Wire the per-turn telemetry Stop hook into Claude Code settings (also folded into `sechroom hook install`)"
+  ).option(
+    "--scope <scope>",
+    "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global"
+  ).option("--local", "alias for --scope project").option("--dry-run", "Print what would change; write nothing").action((opts, cmd) => {
+    const g = cmd.optsWithGlobals();
+    const dryRun = Boolean(opts.dryRun);
+    const cwd = process.cwd();
+    let scope;
+    try {
+      scope = opts.local ? "project" : resolveScope(opts.scope);
+    } catch (err2) {
+      process.stderr.write(`${err2.message}
+`);
+      return process.exit(2);
+    }
+    const targets = resolveClaudeTargets({
+      override: g.claudeConfigDir,
+      scope,
+      cwd
+    });
+    const commands = { Stop: "sechroom telemetry hook" };
+    try {
+      const multi = targets.length > 1;
+      const results = targets.map((t) => {
+        const r = installClaudeCommands(t.dir, commands, dryRun);
+        process.stdout.write(
+          `${HOOK_SURFACE_LABEL.claude}${multi ? ` (${t.label})` : ""}:
+`
+        );
+        process.stdout.write(describe(r, dryRun) + "\n");
+        return r;
+      });
+      if (dryRun) {
+        process.stdout.write("\n(dry run \u2014 no files were written.)\n");
+      } else if (results.every((r) => r.status === "current")) {
+        process.stdout.write("\nAlready up to date \u2014 nothing to change.\n");
+      } else {
+        process.stdout.write(
+          "\nRestart your agent for the hook to take effect, then bind a task with `sechroom telemetry bind`.\n"
+        );
+      }
+    } catch (err2) {
+      process.stderr.write(
+        `telemetry install failed: ${err2.message}
+`
+      );
+      return process.exit(1);
+    }
+    warnIfSechroomNotOnPath();
+    return process.exit(0);
+  });
+}
+var BINDING_FILE = "telemetry.json";
+async function postTelemetry(cfg, decompositionId, events) {
+  const token = await requireToken(cfg);
+  const resp = await fetch(
+    `${cfg.baseUrl}/decompositions/${encodeURIComponent(decompositionId)}/run/telemetry`,
+    {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${token}`,
+        tenant: cfg.tenant,
+        "content-type": "application/json",
+        "x-sechroom-surface": "cli"
+      },
+      body: JSON.stringify({ events })
+    }
+  );
+  if (!resp.ok) throw new Error(`HTTP ${resp.status}: ${await resp.text()}`);
+  return await resp.json();
+}
+function findBinding(start) {
+  let dir = start;
+  for (; ; ) {
+    const path = join16(dir, ".sechroom", BINDING_FILE);
+    if (existsSync14(path)) {
+      try {
+        const b = JSON.parse(
+          readFileSync9(path, "utf8")
+        );
+        if (b.decompositionId && b.taskId)
+          return { decompositionId: b.decompositionId, taskId: b.taskId };
+      } catch {
+      }
+      return null;
+    }
+    const parent = dirname9(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function parseTranscript(path) {
+  if (!existsSync14(path)) return null;
+  let tokensIn = 0;
+  let tokensOut = 0;
+  let contextUsed = 0;
+  let model = "";
+  for (const line of readFileSync9(path, "utf8").split("\n")) {
+    if (!line.trim()) continue;
+    let obj;
+    try {
+      obj = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    const usage = obj.type === "assistant" ? obj.message?.usage : void 0;
+    if (!usage) continue;
+    const input = (usage.input_tokens ?? 0) + (usage.cache_creation_input_tokens ?? 0) + (usage.cache_read_input_tokens ?? 0);
+    tokensIn += input;
+    tokensOut += usage.output_tokens ?? 0;
+    contextUsed = input;
+    if (obj.message?.model) model = obj.message.model;
+  }
+  if (tokensIn === 0 && tokensOut === 0) return null;
+  return { tokensIn, tokensOut, contextUsed, contextWindow: windowFor(model) };
+}
+function windowFor(model) {
+  const m = model.toLowerCase();
+  return m.includes("[1m]") || m.includes("-1m") ? 1e6 : 2e5;
+}
+async function readStdin2() {
+  if (process.stdin.isTTY) return "";
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
+function parseHookInput2(raw) {
+  if (!raw.trim()) return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
 }
 var KINDS = {
   raw: "Raw",
@@ -5516,7 +5729,7 @@ Examples:
 function resolveVersion() {
   try {
     const pkg = JSON.parse(
-      readFileSync8(new URL("../package.json", import.meta.url), "utf8")
+      readFileSync10(new URL("../package.json", import.meta.url), "utf8")
     );
     return pkg.version ?? "0.0.0";
   } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.6.238-rc.10da7380",
+  "version": "2026.6.239-rc.6418da97",
   "description": "Sechroom CLI — a thin, generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.",
   "type": "module",
   "license": "UNLICENSED",