@sechroom/cli 2026.6.238-rc.10da7380 → 2026.7.1

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 import { Command } from "commander";
 
 // src/auth.ts
@@ -433,6 +433,7 @@ async function requireToken(cfg) {
 import createClient from "openapi-fetch";
 
 // src/ui.ts
+import * as clack from "@clack/prompts";
 var FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
 var quiet = false;
 function setQuiet(q) {
@@ -458,7 +459,7 @@ var err = (s) => style.red(s);
 function active() {
   return !quiet && Boolean(process.stderr.isTTY);
 }
-function spinner(text) {
+function spinner(text2) {
   if (!active()) {
     return { succeed() {
     }, fail() {
@@ -468,9 +469,9 @@ function spinner(text) {
   let i = 0;
   const render = () => {
     i = (i + 1) % FRAMES.length;
-    process.stderr.write(`\r${FRAMES[i]} ${text}`);
+    process.stderr.write(`\r${FRAMES[i]} ${text2}`);
   };
-  process.stderr.write(`\r${FRAMES[0]} ${text}`);
+  process.stderr.write(`\r${FRAMES[0]} ${text2}`);
   const timer = setInterval(render, 80);
   timer.unref?.();
   const clear = () => {
@@ -480,12 +481,12 @@ function spinner(text) {
   return {
     succeed(t) {
       clear();
-      process.stderr.write(`${ok("\u2713")} ${t ?? text}
+      process.stderr.write(`${ok("\u2713")} ${t ?? text2}
 `);
     },
     fail(t) {
       clear();
-      process.stderr.write(`${err("\u2717")} ${t ?? text}
+      process.stderr.write(`${err("\u2717")} ${t ?? text2}
 `);
     },
     stop: clear
@@ -496,31 +497,24 @@ function canPrompt() {
 }
 async function promptYesNo(question) {
   if (!canPrompt()) return false;
-  const { createInterface } = await import("readline");
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    const answer = await new Promise((resolve3) => {
-      rl.question(`${question} [y/N] `, resolve3);
-    });
-    return /^y(es)?$/i.test(answer.trim());
-  } finally {
-    rl.close();
-  }
+  const r = await clack.confirm({
+    message: question,
+    initialValue: false,
+    output: process.stderr
+  });
+  return clack.isCancel(r) ? false : r;
 }
 async function promptText(question, def) {
   if (!canPrompt()) return def ?? "";
-  const { createInterface } = await import("readline");
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    const suffix = def ? ` [${def}]` : "";
-    const answer = await new Promise((resolve3) => {
-      rl.question(`${question}${suffix} `, resolve3);
-    });
-    const trimmed = answer.trim();
-    return trimmed.length > 0 ? trimmed : def ?? "";
-  } finally {
-    rl.close();
-  }
+  const r = await clack.text({
+    message: question,
+    defaultValue: def,
+    placeholder: def,
+    output: process.stderr
+  });
+  if (clack.isCancel(r)) return def ?? "";
+  const trimmed = (r ?? "").trim();
+  return trimmed.length > 0 ? trimmed : def ?? "";
 }
 async function promptSelect(question, choices, def) {
   if (choices.length === 0) throw new Error("promptSelect: no choices");
@@ -529,74 +523,50 @@ async function promptSelect(question, choices, def) {
     def !== void 0 ? choices.findIndex((c) => c.value === def) : 0
   );
   if (!canPrompt()) return choices[defIdx].value;
-  const { createInterface } = await import("readline");
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    process.stderr.write(`${style.bold(question)}
-`);
-    choices.forEach((c, i) => {
-      const marker = i === defIdx ? style.cyan("\u203A") : " ";
-      const hint = c.hint ? ` ${style.dim(`\u2014 ${c.hint}`)}` : "";
-      process.stderr.write(`  ${marker} ${style.bold(String(i + 1))}. ${c.label}${hint}
-`);
-    });
-    const answer = await new Promise((resolve3) => {
-      rl.question(`Choose ${style.dim(`[${defIdx + 1}]`)} `, resolve3);
-    });
-    const trimmed = answer.trim();
-    if (!trimmed) return choices[defIdx].value;
-    const n = Number(trimmed);
-    if (Number.isInteger(n) && n >= 1 && n <= choices.length) return choices[n - 1].value;
-    const byLabel = choices.find(
-      (c) => c.label.toLowerCase().startsWith(trimmed.toLowerCase())
-    );
-    return byLabel ? byLabel.value : choices[defIdx].value;
-  } finally {
-    rl.close();
-  }
+  const r = await clack.select({
+    message: question,
+    // Cast: clack's Option<T> is a conditional type (primitive vs not) that TS
+    // can't verify against a generic T; the runtime shape is correct.
+    options: choices.map((c) => ({ value: c.value, label: c.label, hint: c.hint })),
+    initialValue: choices[defIdx].value,
+    output: process.stderr
+  });
+  return clack.isCancel(r) ? choices[defIdx].value : r;
 }
 async function promptMultiSelect(question, choices, preselected = []) {
   if (choices.length === 0) return [];
-  const pre = (v) => preselected.includes(v);
-  const preValues = () => choices.filter((c) => pre(c.value)).map((c) => c.value);
-  if (!canPrompt()) return preValues();
-  const { createInterface } = await import("readline");
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    process.stderr.write(
-      `${style.bold(question)} ${style.dim("(numbers or 'all', comma-separated; Enter keeps \u25C9)")}
-`
-    );
-    choices.forEach((c, i) => {
-      const box = pre(c.value) ? style.cyan("\u25C9") : "\u25CB";
-      const hint = c.hint ? ` ${style.dim(`\u2014 ${c.hint}`)}` : "";
-      process.stderr.write(`  ${box} ${style.bold(String(i + 1))}. ${c.label}${hint}
-`);
-    });
-    const answer = await new Promise((resolve3) => {
-      rl.question(`Select ${style.dim("[Enter = \u25C9]")} `, resolve3);
-    });
-    const trimmed = answer.trim().toLowerCase();
-    if (!trimmed) return preValues();
-    if (trimmed === "all") return choices.map((c) => c.value);
-    const picks = [];
-    for (const tok of trimmed.split(",").map((t) => t.trim()).filter(Boolean)) {
-      const n = Number(tok);
-      if (Number.isInteger(n) && n >= 1 && n <= choices.length) {
-        picks.push(choices[n - 1].value);
-        continue;
-      }
-      const byLabel = choices.find((c) => c.label.toLowerCase().startsWith(tok));
-      if (byLabel) picks.push(byLabel.value);
-    }
-    const uniq = [...new Set(picks)];
-    return uniq.length > 0 ? uniq : preValues();
-  } finally {
-    rl.close();
-  }
+  const preValues = choices.filter((c) => preselected.includes(c.value)).map((c) => c.value);
+  if (!canPrompt()) return preValues;
+  const r = await clack.multiselect({
+    message: question,
+    // Cast: clack's Option<T> is a conditional type (primitive vs not) that TS
+    // can't verify against a generic T; the runtime shape is correct.
+    options: choices.map((c) => ({ value: c.value, label: c.label, hint: c.hint })),
+    initialValues: preValues,
+    required: false,
+    output: process.stderr
+  });
+  return clack.isCancel(r) ? preValues : r;
 }
-async function withSpinner(text, fn) {
-  const s = spinner(text);
+async function promptAutocomplete(question, choices, def) {
+  if (choices.length === 0) throw new Error("promptAutocomplete: no choices");
+  const defIdx = Math.max(
+    0,
+    def !== void 0 ? choices.findIndex((c) => c.value === def) : 0
+  );
+  if (!canPrompt()) return choices[defIdx].value;
+  const r = await clack.autocomplete({
+    message: question,
+    // Cast: clack's Option<T> is a conditional type (primitive vs not) that TS
+    // can't verify against a generic T; the runtime shape is correct.
+    options: choices.map((c) => ({ value: c.value, label: c.label, hint: c.hint })),
+    placeholder: "Type to filter\u2026",
+    output: process.stderr
+  });
+  return clack.isCancel(r) ? choices[defIdx].value : r;
+}
+async function withSpinner(text2, fn) {
+  const s = spinner(text2);
   try {
     const result = await fn();
     s.succeed();
@@ -1521,7 +1491,7 @@ Examples:
   $ sechroom chat replies 1718049600.123456 --surface slack
   $ sechroom chat stop-tracking 1718049600.123456 --surface slack`
   );
-  chat.command("send <channelId> <text>").description("Send a message to a channel (POST /chat/channel-messages/{surface})").option("--guild <guildId>", "Discord guild snowflake \u2014 required for --surface discord").option("--memory <memoryId>", "Attach a sechroom memory id").option("--no-track", "Don't capture replies to this message").option("--parent <parentMessage>", "Thread under a parent (Slack thread_ts / Discord message id)").option("--source <source>", "Source / lane stamp (renders an attribution footer)", "cli").option("--as <as>", "Slack only: 'bot' (default) or 'user' (your linked Slack identity)", "bot").action(async (channelId, text, opts, cmd) => {
+  chat.command("send <channelId> <text>").description("Send a message to a channel (POST /chat/channel-messages/{surface})").option("--guild <guildId>", "Discord guild snowflake \u2014 required for --surface discord").option("--memory <memoryId>", "Attach a sechroom memory id").option("--no-track", "Don't capture replies to this message").option("--parent <parentMessage>", "Thread under a parent (Slack thread_ts / Discord message id)").option("--source <source>", "Source / lane stamp (renders an attribution footer)", "cli").option("--as <as>", "Slack only: 'bot' (default) or 'user' (your linked Slack identity)", "bot").action(async (channelId, text2, opts, cmd) => {
     const { surface, ...globals } = cmd.optsWithGlobals();
     const json = Boolean(cmd.optsWithGlobals().json);
     const cfg = resolveConfig(globals);
@@ -1531,7 +1501,7 @@ Examples:
         params: { path: { surface: String(surface) } },
         body: {
           channelId,
-          text,
+          text: text2,
           guildId: opts.guild ?? null,
           attachedMemoryId: opts.memory ?? null,
           trackReplies: opts.track,
@@ -1590,13 +1560,13 @@ Examples:
 }
 
 // src/commands/checkpoint.ts
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname5, join as join8 } from "path";
+import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname6, join as join9 } from "path";
 
 // src/commands/hook.ts
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync4, statSync as statSync2, writeFileSync as writeFileSync5 } from "fs";
-import { delimiter, dirname as dirname4, join as join7 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync5, statSync as statSync2, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname5, join as join8 } from "path";
 
 // src/sem.ts
 import { dirname as dirname2, join as join5 } from "path";
@@ -1666,9 +1636,9 @@ function readLocalSemValues(cwd = process.cwd()) {
   if (existsSync4(next)) return readSem(next)?.values ?? {};
   return {};
 }
-function parseLaneJson(text) {
+function parseLaneJson(text2) {
   try {
-    const parsed = JSON.parse(text);
+    const parsed = JSON.parse(text2);
     const out = {};
     for (const [k, v] of Object.entries(parsed)) {
       if (typeof v === "string") out[k] = v;
@@ -1686,6 +1656,9 @@ function writeSem(values, path = localSemPath()) {
   ensureContinuityScaffold(path);
   return path;
 }
+function ensureStateDirIgnored(cwd = process.cwd()) {
+  ensureSemIgnored(localSemPath(cwd));
+}
 var CONTINUITY_FILE_NAME = "continuity.json";
 var CONTINUITY_SCAFFOLD = JSON.stringify(
   {
@@ -1757,6 +1730,10 @@ function ensureSemIgnored(semPath) {
   }
 }
 
+// src/commands/hook-install.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
+import { delimiter, dirname as dirname4, join as join7 } from "path";
+
 // src/setup/clients.ts
 import { existsSync as existsSync5 } from "fs";
 import { homedir as homedir3 } from "os";
@@ -1827,6 +1804,144 @@ function detectInstalledClients(cwd) {
   return detected;
 }
 
+// src/commands/hook-install.ts
+var CLAUDE_HOOK_COMMANDS = {
+  SessionStart: "sechroom hook session-start",
+  PreCompact: "sechroom hook pre-compact",
+  SessionEnd: "sechroom hook session-end",
+  // WLP telemetry tap (D-WLP-10) — per-turn executor self-report. No-op (exit 0) unless this
+  // checkout is bound to a decomposition+task via `sechroom telemetry bind`, so it's safe to wire
+  // for every Claude install. Claude-only (it parses a Claude Code transcript).
+  Stop: "sechroom telemetry hook"
+};
+var CODEX_HOOK_COMMANDS = {
+  SessionStart: "sechroom hook session-start",
+  Stop: "sechroom hook session-end --debounce-minutes 10"
+};
+function hasHookCommand(config2, event, command) {
+  const groups = config2.hooks?.[event] ?? [];
+  return groups.some((g) => (g.hooks ?? []).some((h) => h.type === "command" && h.command === command));
+}
+function mergeHooks(config2, commands) {
+  config2.hooks ??= {};
+  let added = 0;
+  for (const [event, command] of Object.entries(commands)) {
+    if (hasHookCommand(config2, event, command)) continue;
+    const groups = config2.hooks[event] ??= [];
+    groups.push({ hooks: [{ type: "command", command }] });
+    added += 1;
+  }
+  return added;
+}
+function readJsonConfig2(path) {
+  if (!existsSync6(path)) return {};
+  const raw = readFileSync4(path, "utf8");
+  if (!raw.trim()) return {};
+  return JSON.parse(raw);
+}
+function installHooksJson(path, commands, dryRun) {
+  const existed = existsSync6(path) && readFileSync4(path, "utf8").trim().length > 0;
+  const config2 = readJsonConfig2(path);
+  const added = mergeHooks(config2, commands);
+  if (added === 0 && existed) return { path, status: "current" };
+  if (!dryRun) {
+    mkdirSync5(dirname4(path), { recursive: true });
+    writeFileSync5(path, JSON.stringify(config2, null, 2) + "\n");
+  }
+  return { path, status: existed ? "merged" : "created" };
+}
+function installClaudeCommands(claudeDir, commands, dryRun) {
+  return installHooksJson(join7(claudeDir, "settings.json"), commands, dryRun);
+}
+function ensureCodexFeaturesHooks(content) {
+  const lines = content.split("\n");
+  const headerIdx = lines.findIndex((l) => l.trim() === "[features]");
+  if (headerIdx === -1) {
+    const base = content.length === 0 || content.endsWith("\n") ? content : content + "\n";
+    return { next: base + "\n[features]\nhooks = true\n", changed: true };
+  }
+  for (let i = headerIdx + 1; i < lines.length; i += 1) {
+    const trimmed = lines[i].trim();
+    if (trimmed.startsWith("[") && trimmed.endsWith("]")) break;
+    const m = lines[i].match(/^(\s*)hooks(\s*)=(\s*)(.*)$/);
+    if (!m) continue;
+    const value = m[4].replace(/\s*#.*$/, "").trim();
+    if (value === "true") return { next: content, changed: false };
+    lines[i] = `${m[1]}hooks${m[2]}=${m[3]}true`;
+    return { next: lines.join("\n"), changed: true };
+  }
+  lines.splice(headerIdx + 1, 0, "hooks = true");
+  return { next: lines.join("\n"), changed: true };
+}
+function installCodexFeatureFlag(path, dryRun) {
+  const existed = existsSync6(path);
+  const content = existed ? readFileSync4(path, "utf8") : "";
+  const { next, changed } = ensureCodexFeaturesHooks(content);
+  if (!changed) return { path, status: "current" };
+  if (!dryRun) {
+    mkdirSync5(dirname4(path), { recursive: true });
+    writeFileSync5(path, next);
+  }
+  return { path, status: existed ? "merged" : "created" };
+}
+function resolveSurfaces(surface, cwd) {
+  if (surface === "claude") return ["claude"];
+  if (surface === "codex") return ["codex"];
+  if (surface === "both") return ["claude", "codex"];
+  if (surface) throw new Error(`--surface must be one of claude | codex | both (got '${surface}')`);
+  const surfaces = detectHookSurfaces(cwd);
+  return surfaces.length > 0 ? surfaces : ["claude", "codex"];
+}
+function describe(result, dryRun) {
+  if (result.status === "current") return `  \u2713 ${result.path} (already configured)`;
+  const verb = dryRun ? "would" : result.status === "created" ? "created" : "updated";
+  return `  \u2713 ${result.path} (${dryRun ? `${verb} ${result.status === "created" ? "create" : "update"}` : verb})`;
+}
+var HOOK_SURFACE_LABEL = {
+  claude: "Claude Code",
+  codex: "Codex"
+};
+function installHookSurfaces(surfaces, opts) {
+  const out = [];
+  for (const surface of surfaces) {
+    if (surface === "claude") {
+      const path = join7(opts.claudeDir, "settings.json");
+      out.push({ surface, results: [installHooksJson(path, CLAUDE_HOOK_COMMANDS, opts.dryRun)] });
+    } else {
+      const hooksJson = installHooksJson(join7(opts.codexHome, "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
+      const featureFlag = installCodexFeatureFlag(join7(opts.codexHome, "config.toml"), opts.dryRun);
+      out.push({ surface, results: [hooksJson, featureFlag] });
+    }
+  }
+  return out;
+}
+function detectHookSurfaces(cwd) {
+  const detected = detectInstalledClients(cwd);
+  const surfaces = [];
+  if (detected.includes("claude-code")) surfaces.push("claude");
+  if (detected.includes("codex")) surfaces.push("codex");
+  return surfaces;
+}
+function isSechroomOnPath() {
+  const pathEnv = process.env.PATH ?? "";
+  if (!pathEnv) return false;
+  const names = process.platform === "win32" ? ["sechroom.cmd", "sechroom.exe", "sechroom.bat", "sechroom"] : ["sechroom"];
+  for (const dir of pathEnv.split(delimiter)) {
+    if (!dir) continue;
+    for (const name of names) {
+      if (existsSync6(join7(dir, name))) return true;
+    }
+  }
+  return false;
+}
+function warnIfSechroomNotOnPath(write = (s) => void process.stderr.write(s)) {
+  if (isSechroomOnPath()) return false;
+  write(
+    "\n\u26A0  `sechroom` isn't on your PATH. The hooks run a bare `sechroom hook \u2026` command\n   when your agent fires them, so a non-global install (npx / local) will fail at\n   that point. Install globally so the command resolves:\n     npm i -g @sechroom/cli\n"
+  );
+  return true;
+}
+
 // src/commands/hook.ts
 async function readStdin() {
   if (process.stdin.isTTY) return "";
@@ -1851,13 +1966,13 @@ function resolveLane(flagLane, cwd) {
   if (!base) return void 0;
   return applyWorktreeLaneSuffix(base, start);
 }
-var INTENT_FILE = join7(".sechroom", "continuity.json");
+var INTENT_FILE = join8(".sechroom", "continuity.json");
 function resolveIntentPath(start) {
   let dir = start;
   for (; ; ) {
-    const candidate = join7(dir, INTENT_FILE);
-    if (existsSync6(candidate)) return candidate;
-    const parent = dirname4(dir);
+    const candidate = join8(dir, INTENT_FILE);
+    if (existsSync7(candidate)) return candidate;
+    const parent = dirname5(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
@@ -1866,7 +1981,7 @@ function readIntent(start) {
   const path = resolveIntentPath(start);
   if (!path) return void 0;
   try {
-    return JSON.parse(readFileSync4(path, "utf8"));
+    return JSON.parse(readFileSync5(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -1908,14 +2023,14 @@ async function saveSnapshotFromIntent(cmd, cwd, laneFlag, scopeFlag, defaultScop
 }
 function ledgerPath(start) {
   const intent = resolveIntentPath(start);
-  const dir = intent ? dirname4(intent) : join7(start, ".sechroom");
-  return join7(dir, ".checkpoint-state.json");
+  const dir = intent ? dirname5(intent) : join8(start, ".sechroom");
+  return join8(dir, ".checkpoint-state.json");
 }
 function readLedger(start) {
   try {
     const p = ledgerPath(start);
-    if (!existsSync6(p)) return {};
-    return JSON.parse(readFileSync4(p, "utf8"));
+    if (!existsSync7(p)) return {};
+    return JSON.parse(readFileSync5(p, "utf8"));
   } catch {
     return {};
   }
@@ -1962,13 +2077,13 @@ function recordPush(start, intent) {
     } catch {
       mtimeMs = void 0;
     }
-    mkdirSync5(dirname4(p), { recursive: true });
+    mkdirSync6(dirname5(p), { recursive: true });
     const ledger = {
       lastEpochMs: Date.now(),
       lastMtimeMs: mtimeMs,
       lastHash: intentHash(intent)
     };
-    writeFileSync5(p, JSON.stringify(ledger) + "\n");
+    writeFileSync6(p, JSON.stringify(ledger) + "\n");
   } catch {
   }
 }
@@ -2008,135 +2123,6 @@ function emitSessionStart(additionalContext) {
     }) + "\n"
   );
 }
-var CLAUDE_HOOK_COMMANDS = {
-  SessionStart: "sechroom hook session-start",
-  PreCompact: "sechroom hook pre-compact",
-  SessionEnd: "sechroom hook session-end"
-};
-var CODEX_HOOK_COMMANDS = {
-  SessionStart: "sechroom hook session-start",
-  Stop: "sechroom hook session-end --debounce-minutes 10"
-};
-function hasHookCommand(config2, event, command) {
-  const groups = config2.hooks?.[event] ?? [];
-  return groups.some((g) => (g.hooks ?? []).some((h) => h.type === "command" && h.command === command));
-}
-function mergeHooks(config2, commands) {
-  config2.hooks ??= {};
-  let added = 0;
-  for (const [event, command] of Object.entries(commands)) {
-    if (hasHookCommand(config2, event, command)) continue;
-    const groups = config2.hooks[event] ??= [];
-    groups.push({ hooks: [{ type: "command", command }] });
-    added += 1;
-  }
-  return added;
-}
-function readJsonConfig2(path) {
-  if (!existsSync6(path)) return {};
-  const raw = readFileSync4(path, "utf8");
-  if (!raw.trim()) return {};
-  return JSON.parse(raw);
-}
-function installHooksJson(path, commands, dryRun) {
-  const existed = existsSync6(path) && readFileSync4(path, "utf8").trim().length > 0;
-  const config2 = readJsonConfig2(path);
-  const added = mergeHooks(config2, commands);
-  if (added === 0 && existed) return { path, status: "current" };
-  if (!dryRun) {
-    mkdirSync5(dirname4(path), { recursive: true });
-    writeFileSync5(path, JSON.stringify(config2, null, 2) + "\n");
-  }
-  return { path, status: existed ? "merged" : "created" };
-}
-function ensureCodexFeaturesHooks(content) {
-  const lines = content.split("\n");
-  const headerIdx = lines.findIndex((l) => l.trim() === "[features]");
-  if (headerIdx === -1) {
-    const base = content.length === 0 || content.endsWith("\n") ? content : content + "\n";
-    return { next: base + "\n[features]\nhooks = true\n", changed: true };
-  }
-  for (let i = headerIdx + 1; i < lines.length; i += 1) {
-    const trimmed = lines[i].trim();
-    if (trimmed.startsWith("[") && trimmed.endsWith("]")) break;
-    const m = lines[i].match(/^(\s*)hooks(\s*)=(\s*)(.*)$/);
-    if (!m) continue;
-    const value = m[4].replace(/\s*#.*$/, "").trim();
-    if (value === "true") return { next: content, changed: false };
-    lines[i] = `${m[1]}hooks${m[2]}=${m[3]}true`;
-    return { next: lines.join("\n"), changed: true };
-  }
-  lines.splice(headerIdx + 1, 0, "hooks = true");
-  return { next: lines.join("\n"), changed: true };
-}
-function installCodexFeatureFlag(path, dryRun) {
-  const existed = existsSync6(path);
-  const content = existed ? readFileSync4(path, "utf8") : "";
-  const { next, changed } = ensureCodexFeaturesHooks(content);
-  if (!changed) return { path, status: "current" };
-  if (!dryRun) {
-    mkdirSync5(dirname4(path), { recursive: true });
-    writeFileSync5(path, next);
-  }
-  return { path, status: existed ? "merged" : "created" };
-}
-function resolveSurfaces(surface, cwd) {
-  if (surface === "claude") return ["claude"];
-  if (surface === "codex") return ["codex"];
-  if (surface === "both") return ["claude", "codex"];
-  if (surface) throw new Error(`--surface must be one of claude | codex | both (got '${surface}')`);
-  const surfaces = detectHookSurfaces(cwd);
-  return surfaces.length > 0 ? surfaces : ["claude", "codex"];
-}
-function describe(result, dryRun) {
-  if (result.status === "current") return `  \u2713 ${result.path} (already configured)`;
-  const verb = dryRun ? "would" : result.status === "created" ? "created" : "updated";
-  return `  \u2713 ${result.path} (${dryRun ? `${verb} ${result.status === "created" ? "create" : "update"}` : verb})`;
-}
-var HOOK_SURFACE_LABEL = {
-  claude: "Claude Code",
-  codex: "Codex"
-};
-function installHookSurfaces(surfaces, opts) {
-  const out = [];
-  for (const surface of surfaces) {
-    if (surface === "claude") {
-      const path = join7(opts.claudeDir, "settings.json");
-      out.push({ surface, results: [installHooksJson(path, CLAUDE_HOOK_COMMANDS, opts.dryRun)] });
-    } else {
-      const hooksJson = installHooksJson(join7(opts.codexHome, "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
-      const featureFlag = installCodexFeatureFlag(join7(opts.codexHome, "config.toml"), opts.dryRun);
-      out.push({ surface, results: [hooksJson, featureFlag] });
-    }
-  }
-  return out;
-}
-function detectHookSurfaces(cwd) {
-  const detected = detectInstalledClients(cwd);
-  const surfaces = [];
-  if (detected.includes("claude-code")) surfaces.push("claude");
-  if (detected.includes("codex")) surfaces.push("codex");
-  return surfaces;
-}
-function isSechroomOnPath() {
-  const pathEnv = process.env.PATH ?? "";
-  if (!pathEnv) return false;
-  const names = process.platform === "win32" ? ["sechroom.cmd", "sechroom.exe", "sechroom.bat", "sechroom"] : ["sechroom"];
-  for (const dir of pathEnv.split(delimiter)) {
-    if (!dir) continue;
-    for (const name of names) {
-      if (existsSync6(join7(dir, name))) return true;
-    }
-  }
-  return false;
-}
-function warnIfSechroomNotOnPath(write = (s) => void process.stderr.write(s)) {
-  if (isSechroomOnPath()) return false;
-  write(
-    "\n\u26A0  `sechroom` isn't on your PATH. The hooks run a bare `sechroom hook \u2026` command\n   when your agent fires them, so a non-global install (npx / local) will fail at\n   that point. Install globally so the command resolves:\n     npm i -g @sechroom/cli\n"
-  );
-  return true;
-}
 function registerHook(program2) {
   const hook = program2.command("hook").description("Agent-lifecycle hook adapter (Claude Code / Codex) \u2014 bridges hooks to continuity");
   hook.addHelpText(
@@ -2344,10 +2330,10 @@ Examples:
       const client = await makeClient(cfg);
       return client.POST("/continuity/snapshots", { body });
     });
-    const path = resolveIntentPath(cwd) ?? join8(cwd, INTENT_FILE);
+    const path = resolveIntentPath(cwd) ?? join9(cwd, INTENT_FILE);
     const fileBody = { ...merged, scope, lastSnapshotId: data.snapshotId };
-    mkdirSync6(dirname5(path), { recursive: true });
-    writeFileSync6(path, JSON.stringify(fileBody, null, 2) + "\n");
+    mkdirSync7(dirname6(path), { recursive: true });
+    writeFileSync7(path, JSON.stringify(fileBody, null, 2) + "\n");
     recordPush(cwd, merged);
     if (json) {
       emit({ snapshotId: data.snapshotId, lane, scope, file: path }, true);
@@ -3031,8 +3017,8 @@ Examples:
 
 // src/setup/apply.ts
 import { createHash as createHash3 } from "crypto";
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync7, existsSync as existsSync7 } from "fs";
-import { dirname as dirname6 } from "path";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync8, existsSync as existsSync8 } from "fs";
+import { dirname as dirname7 } from "path";
 var MARKER_BEGIN = "<!-- @sechroom/cli:begin";
 var MARKER_END = "<!-- @sechroom/cli:end";
 function normalizeBody(s) {
@@ -3085,22 +3071,22 @@ function parseManagedBlock(content, block) {
   return null;
 }
 function ensureDir2(path) {
-  mkdirSync7(dirname6(path), { recursive: true });
+  mkdirSync8(dirname7(path), { recursive: true });
 }
 function readOr(path, fallback) {
   try {
-    return readFileSync5(path, "utf8");
+    return readFileSync6(path, "utf8");
   } catch {
     return fallback;
   }
 }
 function mergeMcpJson(path, snippet, dryRun) {
   const incoming = JSON.parse(snippet);
-  const existed = existsSync7(path);
+  const existed = existsSync8(path);
   let current = {};
   if (existed) {
     try {
-      current = JSON.parse(readFileSync5(path, "utf8"));
+      current = JSON.parse(readFileSync6(path, "utf8"));
     } catch {
       return { kind: "mcp", path, status: "skipped", note: "existing file isn't valid JSON \u2014 left untouched" };
     }
@@ -3108,26 +3094,26 @@ function mergeMcpJson(path, snippet, dryRun) {
   current.mcpServers = { ...current.mcpServers ?? {}, ...incoming.mcpServers ?? {} };
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync7(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
+  writeFileSync8(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function mergeCodexToml(path, snippet, dryRun) {
-  const existed = existsSync7(path);
+  const existed = existsSync8(path);
   let body = readOr(path, "");
   body = body.replace(/(^|\n)\[mcp_servers\.sechroom\][^[]*/, "\n").replace(/\n{3,}/g, "\n\n");
   const trimmed = body.trim();
   const next = (trimmed.length > 0 ? trimmed + "\n\n" : "") + snippet.trim() + "\n";
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync7(path, next, { mode: 384 });
+  writeFileSync8(path, next, { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function writeInstructionBlock(path, write, dryRun) {
-  const existed = existsSync7(path);
+  const existed = existsSync8(path);
   const next = computeBlockFile(readOr(path, ""), write);
   if (dryRun) return { kind: "instruction", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync7(path, next);
+  writeFileSync8(path, next);
   return { kind: "instruction", path, status: existed ? "merged" : "created" };
 }
 function computeBlockFile(current, write) {
@@ -3168,7 +3154,7 @@ function applyBlock(path, write, mode, dryRun) {
     const next = computeBlockFile(current, write);
     if (!dryRun) {
       ensureDir2(proposedPath);
-      writeFileSync7(proposedPath, next);
+      writeFileSync8(proposedPath, next);
     }
     return {
       kind: "instruction",
@@ -3292,8 +3278,8 @@ auto-resumes where you left off and checkpoints working state before compacting.
 }
 
 // src/setup/skills-offer.ts
-import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "fs";
-import { join as join9 } from "path";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "fs";
+import { join as join10 } from "path";
 
 // src/setup/lane-pin.ts
 var CODE_LANE_PREFIX_BY_CLIENT = {
@@ -3409,8 +3395,8 @@ Found ${summary} available to you for ${surface}.
   if (skills.length > 0) {
     const written = [];
     for (const s of skills) {
-      mkdirSync8(join9(sDir, s.name), { recursive: true });
-      writeFileSync8(join9(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
+      mkdirSync9(join10(sDir, s.name), { recursive: true });
+      writeFileSync9(join10(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
       written.push(s.name);
     }
     recordMaterialisedSkills(sDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -3418,11 +3404,11 @@ Found ${summary} available to you for ${surface}.
 `);
   }
   if (agents.length > 0) {
-    mkdirSync8(aDir, { recursive: true });
+    mkdirSync9(aDir, { recursive: true });
     const written = [];
     for (const a of agents) {
       const file = `${a.name}.md`;
-      writeFileSync8(join9(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
+      writeFileSync9(join10(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
       written.push(file);
     }
     recordMaterialisedSkills(aDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -3651,20 +3637,20 @@ Examples:
       fail("no workspace \u2014 pass --workspace <id> or bind one (`sechroom config set --local workspaceId <id>`).");
     const kind = String(opts.kind).toLowerCase() === "standard" ? "standard" : "reference";
     const body = typeof opts.body === "string" && opts.body.trim().length > 0 ? opts.body.trim() : "_TODO: write this section, then edit the memo and re-run the regen._";
-    const text = `# ${title}
+    const text2 = `# ${title}
 
 ${body}
 `;
     const tags = ["agent-setup-bundle", "scope:sechroom", `kind:${kind}`, "archetype:document"];
     if (opts.dryRun) {
-      emit({ dryRun: true, workspaceId, title, kind, tags, text }, json);
+      emit({ dryRun: true, workspaceId, title, kind, tags, text: text2 }, json);
       return;
     }
     const data = await runApi("Authoring convention memo", async () => {
       const client = await makeClient(cfg);
       return client.POST("/memories", {
         body: {
-          text,
+          text: text2,
           type: kind,
           content: "{}",
           confidence: 1,
@@ -3805,13 +3791,13 @@ Wired to namespace '${slug}'. Restart your AI client (or reload MCP) to pick it
 }
 
 // src/commands/onboard.ts
-import { existsSync as existsSync9 } from "fs";
-import { basename as basename2, join as join11 } from "path";
+import { existsSync as existsSync10 } from "fs";
+import { basename as basename2, join as join12 } from "path";
 
 // src/commands/fanout.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
-import { isAbsolute, join as join10, resolve } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync7, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
+import { isAbsolute, join as join11, resolve } from "path";
 var ICON = {
   refresh: "\u21BB",
   bind: "+",
@@ -3831,21 +3817,21 @@ function discoverChildren(root) {
   const out = [];
   for (const name of names.sort()) {
     if (name.startsWith(".") || name === "node_modules") continue;
-    const dir = join10(root, name);
+    const dir = join11(root, name);
     try {
       if (!statSync3(dir).isDirectory()) continue;
     } catch {
       continue;
     }
-    if (existsSync8(join10(dir, ".git")) || committedBindingPath(dir)) out.push(name);
+    if (existsSync9(join11(dir, ".git")) || committedBindingPath(dir)) out.push(name);
   }
   return out;
 }
 function readManifest(path) {
-  if (!existsSync8(path)) return null;
+  if (!existsSync9(path)) return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync6(path, "utf8"));
+    parsed = JSON.parse(readFileSync7(path, "utf8"));
   } catch (err2) {
     throw new Error(`couldn't parse ${path}: ${err2 instanceof Error ? err2.message : String(err2)}`);
   }
@@ -4029,28 +4015,17 @@ async function pickWorkspace(client, opts = {}) {
   if (candidates.length === 0) candidates = all;
   const dirToks = new Set(nameTokens(dirName));
   const isMatch = (w) => nameTokens(w.name).some((t) => dirToks.has(t));
-  const suggestions = candidates.filter(isMatch);
-  let pool = candidates;
-  if (candidates.length > 12 && suggestions.length === 0) {
-    const q = (await promptText(`Filter ${candidates.length} workspaces (substring, Enter to list all)?`, "")).trim().toLowerCase();
-    if (q) {
-      const hits = candidates.filter((w) => `${w.name} ${workspacePath(w, byId)}`.toLowerCase().includes(q));
-      if (hits.length > 0) pool = hits;
-      else process.stderr.write(`no match for "${q}" \u2014 listing all
-`);
-    }
-  }
   const SKIP = "__skip__";
   const byPath = (a, b) => workspacePath(a, byId).localeCompare(workspacePath(b, byId));
-  const matched = pool.filter(isMatch).sort(byPath);
-  const rest = pool.filter((w) => !isMatch(w)).sort(byPath);
+  const matched = candidates.filter(isMatch).sort(byPath);
+  const rest = candidates.filter((w) => !isMatch(w)).sort(byPath);
   const choices = [
     ...matched.map((w) => ({ label: workspacePath(w, byId), value: w.id, hint: style.dim(`matches "${dirName}"`) })),
     ...rest.map((w) => ({ label: workspacePath(w, byId), value: w.id, hint: w.id })),
     { label: style.dim("skip \u2014 don't bind a workspace"), value: SKIP, hint: void 0 }
   ];
   const defaultValue = matched.length === 1 ? matched[0].id : SKIP;
-  const chosen = await promptSelect(promptLabel, choices, defaultValue);
+  const chosen = candidates.length > 12 ? await promptAutocomplete(promptLabel, choices, defaultValue) : await promptSelect(promptLabel, choices, defaultValue);
   if (chosen === SKIP) return void 0;
   const picked = byId.get(chosen);
   const collisions = all.filter((w) => w.id !== picked.id && namesCollide(w.name, picked.name));
@@ -4222,10 +4197,10 @@ async function chooseScope(scopeFlag, yes) {
 }
 async function planRecurseChild(entry, root, client, opts) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync9(dir)) {
+  if (!existsSync10(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
-  if (existsSync9(join11(dir, ".sechroom.json"))) {
+  if (existsSync10(join12(dir, ".sechroom.json"))) {
     return {
       label: entry.path,
       dir,
@@ -4298,7 +4273,7 @@ This fan-out will pin the same lane in every repo:
 async function runRecurse(cfg, g, opts) {
   const { yes, dryRun, json } = opts;
   const root = process.cwd();
-  const manifestPath = join11(root, ".sechroom", "repos.json");
+  const manifestPath = join12(root, ".sechroom", "repos.json");
   const fromManifest = readManifest(manifestPath);
   const entries = fromManifest ?? discoverChildren(root).map((path) => ({ path }));
   const sourceLabel = fromManifest ? `manifest ${manifestPath}` : `auto-discovered under ${root}`;
@@ -4810,23 +4785,23 @@ Examples:
 
 // src/commands/reset.ts
 import { homedir as homedir4 } from "os";
-import { join as join12 } from "path";
-import { existsSync as existsSync10, readFileSync as readFileSync7, rmSync as rmSync3 } from "fs";
+import { join as join13 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync8, rmSync as rmSync3 } from "fs";
 var SKILLS_LOCK2 = ".sechroom-skills.json";
-var localSkillsDir = () => join12(process.cwd(), ".claude", "skills");
-var globalSkillsDir = () => join12(homedir4(), ".claude", "skills");
-var localAgentsDir = () => join12(process.cwd(), ".claude", "agents");
-var globalAgentsDir = () => join12(homedir4(), ".claude", "agents");
+var localSkillsDir = () => join13(process.cwd(), ".claude", "skills");
+var globalSkillsDir = () => join13(homedir4(), ".claude", "skills");
+var localAgentsDir = () => join13(process.cwd(), ".claude", "agents");
+var globalAgentsDir = () => join13(homedir4(), ".claude", "agents");
 function removeMaterialisedSkills(dir) {
   const removed = [];
-  const lockPath = join12(dir, SKILLS_LOCK2);
-  if (!existsSync10(lockPath)) return removed;
+  const lockPath = join13(dir, SKILLS_LOCK2);
+  if (!existsSync11(lockPath)) return removed;
   try {
-    const lock = JSON.parse(readFileSync7(lockPath, "utf8"));
+    const lock = JSON.parse(readFileSync8(lockPath, "utf8"));
     for (const entry of Object.values(lock)) {
       for (const name of entry.skills ?? []) {
-        const p = join12(dir, name);
-        if (existsSync10(p)) {
+        const p = join13(dir, name);
+        if (existsSync11(p)) {
           rmSync3(p, { recursive: true, force: true });
           removed.push(p);
         }
@@ -4871,18 +4846,18 @@ function registerReset(program2) {
       }
     }
     const removed = [];
-    const stateDir = join12(process.cwd(), ".sechroom");
-    if (existsSync10(stateDir)) {
+    const stateDir = join13(process.cwd(), ".sechroom");
+    if (existsSync11(stateDir)) {
       rmSync3(stateDir, { recursive: true, force: true });
       removed.push(stateDir);
     }
-    const legacyCfg = join12(process.cwd(), ".sechroom.json");
-    if (existsSync10(legacyCfg)) {
+    const legacyCfg = join13(process.cwd(), ".sechroom.json");
+    if (existsSync11(legacyCfg)) {
       rmSync3(legacyCfg, { force: true });
       removed.push(legacyCfg);
     }
-    const legacySem = join12(process.cwd(), ".sem");
-    if (existsSync10(legacySem)) {
+    const legacySem = join13(process.cwd(), ".sem");
+    if (existsSync11(legacySem)) {
       rmSync3(legacySem, { force: true });
       removed.push(legacySem);
     }
@@ -4908,8 +4883,8 @@ function registerReset(program2) {
 }
 
 // src/commands/skills.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync9, statSync as statSync4, writeFileSync as writeFileSync9 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync10, statSync as statSync4, writeFileSync as writeFileSync10 } from "fs";
+import { join as join14 } from "path";
 function filenameFromDisposition(header) {
   if (!header) return void 0;
   const m = /filename\*?=(?:UTF-8'')?"?([^";]+)"?/i.exec(header);
@@ -4917,11 +4892,11 @@ function filenameFromDisposition(header) {
 }
 function resolveOutputPath(output, serverFilename) {
   const filename = serverFilename || "skills.zip";
-  if (!output) return join13(process.cwd(), filename);
-  const looksLikeDir = output.endsWith("/") || existsSync11(output) && statSync4(output).isDirectory();
+  if (!output) return join14(process.cwd(), filename);
+  const looksLikeDir = output.endsWith("/") || existsSync12(output) && statSync4(output).isDirectory();
   if (looksLikeDir) {
-    mkdirSync9(output, { recursive: true });
-    return join13(output, filename);
+    mkdirSync10(output, { recursive: true });
+    return join14(output, filename);
   }
   return output;
 }
@@ -4952,7 +4927,7 @@ async function downloadZip(label, call, output) {
   const buf = Buffer.from(res.data);
   const filename = filenameFromDisposition(res.response.headers.get("content-disposition")) ?? "skills.zip";
   const path = resolveOutputPath(output, filename);
-  writeFileSync9(path, buf);
+  writeFileSync10(path, buf);
   return { path, bytes: buf.length, filename };
 }
 function registerSkills(program2) {
@@ -5120,12 +5095,12 @@ Examples:
 }
 
 // src/commands/sweep.ts
-import { existsSync as existsSync12 } from "fs";
-import { dirname as dirname7, join as join14, resolve as resolve2 } from "path";
-var DEFAULT_MANIFEST = join14(".sechroom", "repos.json");
+import { existsSync as existsSync13 } from "fs";
+import { dirname as dirname8, join as join15, resolve as resolve2 } from "path";
+var DEFAULT_MANIFEST = join15(".sechroom", "repos.json");
 function planEntry(entry, root) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync12(dir)) {
+  if (!existsSync13(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
   if (committedBindingPath(dir)) {
@@ -5201,7 +5176,7 @@ Examples:
 `);
       return;
     }
-    const root = dirname7(dirname7(manifestPath));
+    const root = dirname8(dirname8(manifestPath));
     const plans = repos.map((entry) => planEntry(entry, root));
     if (!json) {
       process.stderr.write(
@@ -5219,6 +5194,14 @@ Examples:
 }
 
 // src/commands/telemetry.ts
+import {
+  existsSync as existsSync14,
+  mkdirSync as mkdirSync11,
+  readFileSync as readFileSync9,
+  rmSync as rmSync4,
+  writeFileSync as writeFileSync11
+} from "fs";
+import { dirname as dirname9, join as join16 } from "path";
 function registerTelemetry(program2) {
   const telemetry = program2.command("telemetry").description(
     "Emit WLP run telemetry (an executor leg's progress events) into a decomposition run"
@@ -5253,10 +5236,9 @@ function registerTelemetry(program2) {
   ).action(async (opts, cmd) => {
     const json = Boolean(cmd.optsWithGlobals().json);
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const kind = normalizeKind(opts.kind);
     const event = {
       taskId: opts.task,
-      kind,
+      kind: normalizeKind(opts.kind),
       tokensIn: opts.tokensIn ?? null,
       tokensOut: opts.tokensOut ?? null,
       contextUsed: opts.contextUsed ?? null,
@@ -5265,36 +5247,226 @@ function registerTelemetry(program2) {
       approvalState: opts.approval ?? null,
       verdict: opts.verdict ?? null
     };
-    const token = await requireToken(cfg);
-    const resp = await fetch(
-      `${cfg.baseUrl}/decompositions/${encodeURIComponent(opts.decomposition)}/run/telemetry`,
-      {
-        method: "POST",
-        headers: {
-          authorization: `Bearer ${token}`,
-          tenant: cfg.tenant,
-          "content-type": "application/json",
-          "x-sechroom-surface": "cli"
-        },
-        body: JSON.stringify({ events: [event] })
-      }
-    );
-    if (!resp.ok)
-      fail(
-        `Telemetry emit failed (HTTP ${resp.status}): ${await resp.text()}`
-      );
-    const body = await resp.json();
+    let body;
+    try {
+      body = await postTelemetry(cfg, opts.decomposition, [event]);
+    } catch (e) {
+      return fail(`Telemetry emit failed: ${e.message}`);
+    }
     if (json) {
       emit(body, true);
     } else {
       process.stderr.write(
         style.green("telemetry emitted") + style.dim(
-          ` \u2014 ${kind} for task ${opts.task}; run now carries ${body.eventCount} event${body.eventCount === 1 ? "" : "s"}
+          ` \u2014 ${event.kind} for task ${opts.task}; run now carries ${body.eventCount} event${body.eventCount === 1 ? "" : "s"}
 `
         )
       );
     }
   });
+  telemetry.command("bind").description(
+    "Bind this checkout to a decomposition+task so the Stop hook auto-emits per-turn telemetry"
+  ).requiredOption(
+    "--decomposition <id>",
+    "Decomposition id this session executes"
+  ).requiredOption("--task <id>", "Task id this session executes").action((opts, cmd) => {
+    const json = Boolean(cmd.optsWithGlobals().json);
+    const dir = join16(process.cwd(), ".sechroom");
+    mkdirSync11(dir, { recursive: true });
+    const path = join16(dir, BINDING_FILE);
+    const binding = {
+      decompositionId: opts.decomposition,
+      taskId: opts.task
+    };
+    writeFileSync11(path, JSON.stringify(binding, null, 2) + "\n");
+    ensureStateDirIgnored(process.cwd());
+    if (json) {
+      emit({ bound: true, ...binding, path }, true);
+    } else {
+      process.stdout.write(
+        style.green("telemetry bound") + style.dim(
+          ` \u2014 decomposition ${binding.decompositionId}, task ${binding.taskId} (${path})
+`
+        )
+      );
+    }
+  });
+  telemetry.command("unbind").description("Clear this checkout's telemetry binding").action((_opts, cmd) => {
+    const json = Boolean(cmd.optsWithGlobals().json);
+    const path = join16(process.cwd(), ".sechroom", BINDING_FILE);
+    const existed = existsSync14(path);
+    if (existed) rmSync4(path);
+    if (json) emit({ unbound: existed, path }, true);
+    else
+      process.stdout.write(
+        existed ? "telemetry binding cleared\n" : "no telemetry binding to clear\n"
+      );
+  });
+  telemetry.command("hook").description(
+    "Per-turn telemetry self-report for a Claude Code Stop hook (reads stdin; no-op unless bound). Fail-soft."
+  ).action(async (_opts, cmd) => {
+    try {
+      const raw = await readStdin2();
+      const input = parseHookInput2(raw);
+      const cwd = input.cwd ?? process.cwd();
+      const binding = findBinding(cwd);
+      if (!binding) return process.exit(0);
+      const usage = input.transcript_path ? parseTranscript(input.transcript_path) : null;
+      if (!usage) return process.exit(0);
+      const cfg = resolveConfig(cmd.optsWithGlobals());
+      await postTelemetry(cfg, binding.decompositionId, [
+        {
+          taskId: binding.taskId,
+          kind: "Parsed",
+          tokensIn: usage.tokensIn,
+          tokensOut: usage.tokensOut,
+          contextUsed: usage.contextUsed,
+          contextWindow: usage.contextWindow,
+          text: null,
+          approvalState: null,
+          verdict: null
+        }
+      ]);
+      return process.exit(0);
+    } catch {
+      return process.exit(0);
+    }
+  });
+  telemetry.command("install").description(
+    "Wire the per-turn telemetry Stop hook into Claude Code settings (also folded into `sechroom hook install`)"
+  ).option(
+    "--scope <scope>",
+    "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global"
+  ).option("--local", "alias for --scope project").option("--dry-run", "Print what would change; write nothing").action((opts, cmd) => {
+    const g = cmd.optsWithGlobals();
+    const dryRun = Boolean(opts.dryRun);
+    const cwd = process.cwd();
+    let scope;
+    try {
+      scope = opts.local ? "project" : resolveScope(opts.scope);
+    } catch (err2) {
+      process.stderr.write(`${err2.message}
+`);
+      return process.exit(2);
+    }
+    const targets = resolveClaudeTargets({
+      override: g.claudeConfigDir,
+      scope,
+      cwd
+    });
+    const commands = { Stop: "sechroom telemetry hook" };
+    try {
+      const multi = targets.length > 1;
+      const results = targets.map((t) => {
+        const r = installClaudeCommands(t.dir, commands, dryRun);
+        process.stdout.write(
+          `${HOOK_SURFACE_LABEL.claude}${multi ? ` (${t.label})` : ""}:
+`
+        );
+        process.stdout.write(describe(r, dryRun) + "\n");
+        return r;
+      });
+      if (dryRun) {
+        process.stdout.write("\n(dry run \u2014 no files were written.)\n");
+      } else if (results.every((r) => r.status === "current")) {
+        process.stdout.write("\nAlready up to date \u2014 nothing to change.\n");
+      } else {
+        process.stdout.write(
+          "\nRestart your agent for the hook to take effect, then bind a task with `sechroom telemetry bind`.\n"
+        );
+      }
+    } catch (err2) {
+      process.stderr.write(
+        `telemetry install failed: ${err2.message}
+`
+      );
+      return process.exit(1);
+    }
+    warnIfSechroomNotOnPath();
+    return process.exit(0);
+  });
+}
+var BINDING_FILE = "telemetry.json";
+async function postTelemetry(cfg, decompositionId, events) {
+  const token = await requireToken(cfg);
+  const resp = await fetch(
+    `${cfg.baseUrl}/decompositions/${encodeURIComponent(decompositionId)}/run/telemetry`,
+    {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${token}`,
+        tenant: cfg.tenant,
+        "content-type": "application/json",
+        "x-sechroom-surface": "cli"
+      },
+      body: JSON.stringify({ events })
+    }
+  );
+  if (!resp.ok) throw new Error(`HTTP ${resp.status}: ${await resp.text()}`);
+  return await resp.json();
+}
+function findBinding(start) {
+  let dir = start;
+  for (; ; ) {
+    const path = join16(dir, ".sechroom", BINDING_FILE);
+    if (existsSync14(path)) {
+      try {
+        const b = JSON.parse(
+          readFileSync9(path, "utf8")
+        );
+        if (b.decompositionId && b.taskId)
+          return { decompositionId: b.decompositionId, taskId: b.taskId };
+      } catch {
+      }
+      return null;
+    }
+    const parent = dirname9(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function parseTranscript(path) {
+  if (!existsSync14(path)) return null;
+  let tokensIn = 0;
+  let tokensOut = 0;
+  let contextUsed = 0;
+  let model = "";
+  for (const line of readFileSync9(path, "utf8").split("\n")) {
+    if (!line.trim()) continue;
+    let obj;
+    try {
+      obj = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    const usage = obj.type === "assistant" ? obj.message?.usage : void 0;
+    if (!usage) continue;
+    const input = (usage.input_tokens ?? 0) + (usage.cache_creation_input_tokens ?? 0) + (usage.cache_read_input_tokens ?? 0);
+    tokensIn += input;
+    tokensOut += usage.output_tokens ?? 0;
+    contextUsed = input;
+    if (obj.message?.model) model = obj.message.model;
+  }
+  if (tokensIn === 0 && tokensOut === 0) return null;
+  return { tokensIn, tokensOut, contextUsed, contextWindow: windowFor(model) };
+}
+function windowFor(model) {
+  const m = model.toLowerCase();
+  return m.includes("[1m]") || m.includes("-1m") ? 1e6 : 2e5;
+}
+async function readStdin2() {
+  if (process.stdin.isTTY) return "";
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
+function parseHookInput2(raw) {
+  if (!raw.trim()) return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
 }
 var KINDS = {
   raw: "Raw",
@@ -5516,7 +5688,7 @@ Examples:
 function resolveVersion() {
   try {
     const pkg = JSON.parse(
-      readFileSync8(new URL("../package.json", import.meta.url), "utf8")
+      readFileSync10(new URL("../package.json", import.meta.url), "utf8")
     );
     return pkg.version ?? "0.0.0";
   } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.6.238-rc.10da7380",
+  "version": "2026.7.1",
   "description": "Sechroom CLI — a thin, generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.",
   "type": "module",
   "license": "UNLICENSED",
@@ -24,11 +24,12 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
+    "@clack/prompts": "^1.6.0",
     "@microsoft/signalr": "^10.0.0",
+    "@modelcontextprotocol/sdk": "^1.12.0",
     "commander": "^12.1.0",
     "open": "^10.1.0",
-    "openapi-fetch": "^0.13.0",
-    "@modelcontextprotocol/sdk": "^1.12.0"
+    "openapi-fetch": "^0.13.0"
   },
   "devDependencies": {
     "@types/node": "^20.14.0",