@sechroom/cli 2026.6.238-rc.10da7380 → 2026.7.1-rc.2c16fefa

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 import { Command } from "commander";
 
 // src/auth.ts
@@ -433,6 +433,7 @@ async function requireToken(cfg) {
 import createClient from "openapi-fetch";
 
 // src/ui.ts
+import * as clack from "@clack/prompts";
 var FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
 var quiet = false;
 function setQuiet(q) {
@@ -458,7 +459,7 @@ var err = (s) => style.red(s);
 function active() {
   return !quiet && Boolean(process.stderr.isTTY);
 }
-function spinner(text) {
+function spinner(text2) {
   if (!active()) {
     return { succeed() {
     }, fail() {
@@ -468,9 +469,9 @@ function spinner(text) {
   let i = 0;
   const render = () => {
     i = (i + 1) % FRAMES.length;
-    process.stderr.write(`\r${FRAMES[i]} ${text}`);
+    process.stderr.write(`\r${FRAMES[i]} ${text2}`);
   };
-  process.stderr.write(`\r${FRAMES[0]} ${text}`);
+  process.stderr.write(`\r${FRAMES[0]} ${text2}`);
   const timer = setInterval(render, 80);
   timer.unref?.();
   const clear = () => {
@@ -480,12 +481,12 @@ function spinner(text) {
   return {
     succeed(t) {
       clear();
-      process.stderr.write(`${ok("\u2713")} ${t ?? text}
+      process.stderr.write(`${ok("\u2713")} ${t ?? text2}
 `);
     },
     fail(t) {
       clear();
-      process.stderr.write(`${err("\u2717")} ${t ?? text}
+      process.stderr.write(`${err("\u2717")} ${t ?? text2}
 `);
     },
     stop: clear
@@ -496,31 +497,24 @@ function canPrompt() {
 }
 async function promptYesNo(question) {
   if (!canPrompt()) return false;
-  const { createInterface } = await import("readline");
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    const answer = await new Promise((resolve3) => {
-      rl.question(`${question} [y/N] `, resolve3);
-    });
-    return /^y(es)?$/i.test(answer.trim());
-  } finally {
-    rl.close();
-  }
+  const r = await clack.confirm({
+    message: question,
+    initialValue: false,
+    output: process.stderr
+  });
+  return clack.isCancel(r) ? false : r;
 }
 async function promptText(question, def) {
   if (!canPrompt()) return def ?? "";
-  const { createInterface } = await import("readline");
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    const suffix = def ? ` [${def}]` : "";
-    const answer = await new Promise((resolve3) => {
-      rl.question(`${question}${suffix} `, resolve3);
-    });
-    const trimmed = answer.trim();
-    return trimmed.length > 0 ? trimmed : def ?? "";
-  } finally {
-    rl.close();
-  }
+  const r = await clack.text({
+    message: question,
+    defaultValue: def,
+    placeholder: def,
+    output: process.stderr
+  });
+  if (clack.isCancel(r)) return def ?? "";
+  const trimmed = (r ?? "").trim();
+  return trimmed.length > 0 ? trimmed : def ?? "";
 }
 async function promptSelect(question, choices, def) {
   if (choices.length === 0) throw new Error("promptSelect: no choices");
@@ -529,74 +523,50 @@ async function promptSelect(question, choices, def) {
     def !== void 0 ? choices.findIndex((c) => c.value === def) : 0
   );
   if (!canPrompt()) return choices[defIdx].value;
-  const { createInterface } = await import("readline");
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    process.stderr.write(`${style.bold(question)}
-`);
-    choices.forEach((c, i) => {
-      const marker = i === defIdx ? style.cyan("\u203A") : " ";
-      const hint = c.hint ? ` ${style.dim(`\u2014 ${c.hint}`)}` : "";
-      process.stderr.write(`  ${marker} ${style.bold(String(i + 1))}. ${c.label}${hint}
-`);
-    });
-    const answer = await new Promise((resolve3) => {
-      rl.question(`Choose ${style.dim(`[${defIdx + 1}]`)} `, resolve3);
-    });
-    const trimmed = answer.trim();
-    if (!trimmed) return choices[defIdx].value;
-    const n = Number(trimmed);
-    if (Number.isInteger(n) && n >= 1 && n <= choices.length) return choices[n - 1].value;
-    const byLabel = choices.find(
-      (c) => c.label.toLowerCase().startsWith(trimmed.toLowerCase())
-    );
-    return byLabel ? byLabel.value : choices[defIdx].value;
-  } finally {
-    rl.close();
-  }
+  const r = await clack.select({
+    message: question,
+    // Cast: clack's Option<T> is a conditional type (primitive vs not) that TS
+    // can't verify against a generic T; the runtime shape is correct.
+    options: choices.map((c) => ({ value: c.value, label: c.label, hint: c.hint })),
+    initialValue: choices[defIdx].value,
+    output: process.stderr
+  });
+  return clack.isCancel(r) ? choices[defIdx].value : r;
 }
 async function promptMultiSelect(question, choices, preselected = []) {
   if (choices.length === 0) return [];
-  const pre = (v) => preselected.includes(v);
-  const preValues = () => choices.filter((c) => pre(c.value)).map((c) => c.value);
-  if (!canPrompt()) return preValues();
-  const { createInterface } = await import("readline");
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    process.stderr.write(
-      `${style.bold(question)} ${style.dim("(numbers or 'all', comma-separated; Enter keeps \u25C9)")}
-`
-    );
-    choices.forEach((c, i) => {
-      const box = pre(c.value) ? style.cyan("\u25C9") : "\u25CB";
-      const hint = c.hint ? ` ${style.dim(`\u2014 ${c.hint}`)}` : "";
-      process.stderr.write(`  ${box} ${style.bold(String(i + 1))}. ${c.label}${hint}
-`);
-    });
-    const answer = await new Promise((resolve3) => {
-      rl.question(`Select ${style.dim("[Enter = \u25C9]")} `, resolve3);
-    });
-    const trimmed = answer.trim().toLowerCase();
-    if (!trimmed) return preValues();
-    if (trimmed === "all") return choices.map((c) => c.value);
-    const picks = [];
-    for (const tok of trimmed.split(",").map((t) => t.trim()).filter(Boolean)) {
-      const n = Number(tok);
-      if (Number.isInteger(n) && n >= 1 && n <= choices.length) {
-        picks.push(choices[n - 1].value);
-        continue;
-      }
-      const byLabel = choices.find((c) => c.label.toLowerCase().startsWith(tok));
-      if (byLabel) picks.push(byLabel.value);
-    }
-    const uniq = [...new Set(picks)];
-    return uniq.length > 0 ? uniq : preValues();
-  } finally {
-    rl.close();
-  }
+  const preValues = choices.filter((c) => preselected.includes(c.value)).map((c) => c.value);
+  if (!canPrompt()) return preValues;
+  const r = await clack.multiselect({
+    message: question,
+    // Cast: clack's Option<T> is a conditional type (primitive vs not) that TS
+    // can't verify against a generic T; the runtime shape is correct.
+    options: choices.map((c) => ({ value: c.value, label: c.label, hint: c.hint })),
+    initialValues: preValues,
+    required: false,
+    output: process.stderr
+  });
+  return clack.isCancel(r) ? preValues : r;
 }
-async function withSpinner(text, fn) {
-  const s = spinner(text);
+async function promptAutocomplete(question, choices, def) {
+  if (choices.length === 0) throw new Error("promptAutocomplete: no choices");
+  const defIdx = Math.max(
+    0,
+    def !== void 0 ? choices.findIndex((c) => c.value === def) : 0
+  );
+  if (!canPrompt()) return choices[defIdx].value;
+  const r = await clack.autocomplete({
+    message: question,
+    // Cast: clack's Option<T> is a conditional type (primitive vs not) that TS
+    // can't verify against a generic T; the runtime shape is correct.
+    options: choices.map((c) => ({ value: c.value, label: c.label, hint: c.hint })),
+    placeholder: "Type to filter\u2026",
+    output: process.stderr
+  });
+  return clack.isCancel(r) ? choices[defIdx].value : r;
+}
+async function withSpinner(text2, fn) {
+  const s = spinner(text2);
   try {
     const result = await fn();
     s.succeed();
@@ -1330,12 +1300,228 @@ workers your loop skills call (e.g. find-prior-art \u2192 substrate-miner).`
 }
 
 // src/commands/channel.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname4, join as join7 } from "path";
 import {
   HttpTransportType,
   HubConnectionBuilder
 } from "@microsoft/signalr";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+// src/commands/hook-install.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
+import { delimiter, dirname as dirname3, join as join6 } from "path";
+
+// src/setup/clients.ts
+import { existsSync as existsSync4 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname2, join as join5 } from "path";
+function claudeDesktopConfigPath(home) {
+  switch (process.platform) {
+    case "darwin":
+      return join5(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+    case "win32":
+      return join5(process.env.APPDATA ?? join5(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
+    default:
+      return join5(home, ".config", "Claude", "claude_desktop_config.json");
+  }
+}
+function clientTargets(cwd, opts = {}) {
+  const home = homedir3();
+  const claudeDir = opts.claudeDir ?? join5(home, ".claude");
+  const codexHome = opts.codexHome ?? join5(home, ".codex");
+  return {
+    "claude-code": {
+      key: "claude-code",
+      label: "Claude Code",
+      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join5(cwd, ".mcp.json"), format: "json" },
+      instruction: { surfaceKey: "claude-code", path: join5(cwd, "CLAUDE.md") }
+    },
+    "claude-desktop": {
+      key: "claude-desktop",
+      label: "Claude Desktop",
+      mcp: { surfaceKey: "claude-desktop", sectionType: SectionType.McpConfig, path: claudeDesktopConfigPath(home), format: "json" },
+      instruction: { surfaceKey: "claude-desktop", path: join5(claudeDir, "CLAUDE.md") }
+    },
+    codex: {
+      key: "codex",
+      label: "Codex CLI",
+      mcp: { surfaceKey: "chatgpt", sectionType: SectionType.McpConfigToml, path: join5(codexHome, "config.toml"), format: "toml" },
+      instruction: { surfaceKey: "chatgpt", path: join5(cwd, "AGENTS.md") }
+    },
+    cursor: {
+      key: "cursor",
+      label: "Cursor",
+      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join5(cwd, ".cursor", "mcp.json"), format: "json" },
+      instruction: { surfaceKey: "chatgpt", path: join5(cwd, "AGENTS.md") }
+    },
+    antigravity: {
+      key: "antigravity",
+      label: "Google Antigravity",
+      // FR-sechroom-247 — Antigravity reads MCP from a GLOBAL, home-relative
+      // `~/.gemini/config/mcp_config.json` (not cwd; not affected by
+      // CLAUDE_CONFIG_DIR / CODEX_HOME). The snippet — `serverUrl`-shaped, no
+      // `type` — comes from the `antigravity` server surface, so we don't
+      // hardcode it here. Instructions go in the project `AGENTS.md`
+      // (cross-tool, shared with Codex/Cursor).
+      mcp: { surfaceKey: "antigravity", sectionType: SectionType.McpConfig, path: join5(home, ".gemini", "config", "mcp_config.json"), format: "json" },
+      instruction: { surfaceKey: "antigravity", path: join5(cwd, "AGENTS.md") }
+    }
+  };
+}
+var ALL_CLIENT_KEYS = ["claude-code", "claude-desktop", "codex", "cursor", "antigravity"];
+var DEFAULT_CLIENT_KEY = "claude-code";
+function detectInstalledClients(cwd) {
+  const home = homedir3();
+  const detected = [];
+  if (resolveClaudeTargets({}).some((t) => existsSync4(t.dir))) detected.push("claude-code");
+  if (existsSync4(dirname2(claudeDesktopConfigPath(home)))) detected.push("claude-desktop");
+  if (resolveCodexHomes({}).some((d) => existsSync4(d))) detected.push("codex");
+  if (existsSync4(join5(home, ".cursor")) || existsSync4(join5(cwd, ".cursor"))) detected.push("cursor");
+  if (existsSync4(join5(home, ".gemini"))) detected.push("antigravity");
+  return detected;
+}
+
+// src/commands/hook-install.ts
+var CLAUDE_HOOK_COMMANDS = {
+  SessionStart: "sechroom hook session-start",
+  PreCompact: "sechroom hook pre-compact",
+  SessionEnd: "sechroom hook session-end",
+  // WLP telemetry tap (D-WLP-10) — per-turn executor self-report. No-op (exit 0) unless this
+  // checkout is bound to a decomposition+task via `sechroom telemetry bind`, so it's safe to wire
+  // for every Claude install. Claude-only (it parses a Claude Code transcript).
+  Stop: "sechroom telemetry hook"
+};
+var CODEX_HOOK_COMMANDS = {
+  SessionStart: "sechroom hook session-start",
+  Stop: "sechroom hook session-end --debounce-minutes 10"
+};
+function hasHookCommand(config2, event, command) {
+  const groups = config2.hooks?.[event] ?? [];
+  return groups.some((g) => (g.hooks ?? []).some((h) => h.type === "command" && h.command === command));
+}
+function mergeHooks(config2, commands) {
+  config2.hooks ??= {};
+  let added = 0;
+  for (const [event, command] of Object.entries(commands)) {
+    if (hasHookCommand(config2, event, command)) continue;
+    const groups = config2.hooks[event] ??= [];
+    groups.push({ hooks: [{ type: "command", command }] });
+    added += 1;
+  }
+  return added;
+}
+function readJsonConfig2(path) {
+  if (!existsSync5(path)) return {};
+  const raw = readFileSync3(path, "utf8");
+  if (!raw.trim()) return {};
+  return JSON.parse(raw);
+}
+function installHooksJson(path, commands, dryRun) {
+  const existed = existsSync5(path) && readFileSync3(path, "utf8").trim().length > 0;
+  const config2 = readJsonConfig2(path);
+  const added = mergeHooks(config2, commands);
+  if (added === 0 && existed) return { path, status: "current" };
+  if (!dryRun) {
+    mkdirSync4(dirname3(path), { recursive: true });
+    writeFileSync4(path, JSON.stringify(config2, null, 2) + "\n");
+  }
+  return { path, status: existed ? "merged" : "created" };
+}
+function installClaudeCommands(claudeDir, commands, dryRun) {
+  return installHooksJson(join6(claudeDir, "settings.json"), commands, dryRun);
+}
+function ensureCodexFeaturesHooks(content) {
+  const lines = content.split("\n");
+  const headerIdx = lines.findIndex((l) => l.trim() === "[features]");
+  if (headerIdx === -1) {
+    const base = content.length === 0 || content.endsWith("\n") ? content : content + "\n";
+    return { next: base + "\n[features]\nhooks = true\n", changed: true };
+  }
+  for (let i = headerIdx + 1; i < lines.length; i += 1) {
+    const trimmed = lines[i].trim();
+    if (trimmed.startsWith("[") && trimmed.endsWith("]")) break;
+    const m = lines[i].match(/^(\s*)hooks(\s*)=(\s*)(.*)$/);
+    if (!m) continue;
+    const value = m[4].replace(/\s*#.*$/, "").trim();
+    if (value === "true") return { next: content, changed: false };
+    lines[i] = `${m[1]}hooks${m[2]}=${m[3]}true`;
+    return { next: lines.join("\n"), changed: true };
+  }
+  lines.splice(headerIdx + 1, 0, "hooks = true");
+  return { next: lines.join("\n"), changed: true };
+}
+function installCodexFeatureFlag(path, dryRun) {
+  const existed = existsSync5(path);
+  const content = existed ? readFileSync3(path, "utf8") : "";
+  const { next, changed } = ensureCodexFeaturesHooks(content);
+  if (!changed) return { path, status: "current" };
+  if (!dryRun) {
+    mkdirSync4(dirname3(path), { recursive: true });
+    writeFileSync4(path, next);
+  }
+  return { path, status: existed ? "merged" : "created" };
+}
+function resolveSurfaces(surface, cwd) {
+  if (surface === "claude") return ["claude"];
+  if (surface === "codex") return ["codex"];
+  if (surface === "both") return ["claude", "codex"];
+  if (surface) throw new Error(`--surface must be one of claude | codex | both (got '${surface}')`);
+  const surfaces = detectHookSurfaces(cwd);
+  return surfaces.length > 0 ? surfaces : ["claude", "codex"];
+}
+function describe(result, dryRun) {
+  if (result.status === "current") return `  \u2713 ${result.path} (already configured)`;
+  const verb = dryRun ? "would" : result.status === "created" ? "created" : "updated";
+  return `  \u2713 ${result.path} (${dryRun ? `${verb} ${result.status === "created" ? "create" : "update"}` : verb})`;
+}
+var HOOK_SURFACE_LABEL = {
+  claude: "Claude Code",
+  codex: "Codex"
+};
+function installHookSurfaces(surfaces, opts) {
+  const out = [];
+  for (const surface of surfaces) {
+    if (surface === "claude") {
+      const path = join6(opts.claudeDir, "settings.json");
+      out.push({ surface, results: [installHooksJson(path, CLAUDE_HOOK_COMMANDS, opts.dryRun)] });
+    } else {
+      const hooksJson = installHooksJson(join6(opts.codexHome, "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
+      const featureFlag = installCodexFeatureFlag(join6(opts.codexHome, "config.toml"), opts.dryRun);
+      out.push({ surface, results: [hooksJson, featureFlag] });
+    }
+  }
+  return out;
+}
+function detectHookSurfaces(cwd) {
+  const detected = detectInstalledClients(cwd);
+  const surfaces = [];
+  if (detected.includes("claude-code")) surfaces.push("claude");
+  if (detected.includes("codex")) surfaces.push("codex");
+  return surfaces;
+}
+function isSechroomOnPath() {
+  const pathEnv = process.env.PATH ?? "";
+  if (!pathEnv) return false;
+  const names = process.platform === "win32" ? ["sechroom.cmd", "sechroom.exe", "sechroom.bat", "sechroom"] : ["sechroom"];
+  for (const dir of pathEnv.split(delimiter)) {
+    if (!dir) continue;
+    for (const name of names) {
+      if (existsSync5(join6(dir, name))) return true;
+    }
+  }
+  return false;
+}
+function warnIfSechroomNotOnPath(write = (s) => void process.stderr.write(s)) {
+  if (isSechroomOnPath()) return false;
+  write(
+    "\n\u26A0  `sechroom` isn't on your PATH. The hooks run a bare `sechroom hook \u2026` command\n   when your agent fires them, so a non-global install (npx / local) will fail at\n   that point. Install globally so the command resolves:\n     npm i -g @sechroom/cli\n"
+  );
+  return true;
+}
+
+// src/commands/channel.ts
 function registerChannel(program2) {
   const channel = program2.command("channel").description(
     "Receive matched substrate events over the held SignalR push leg (D-WLP-9)"
@@ -1358,11 +1544,16 @@ function registerChannel(program2) {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const filter = readFilter(opts);
     const sub = await ensureSubscription(cfg, opts.name, filter);
-    const conn = await openConnection(cfg, (payload) => {
-      process.stdout.write(
+    const seen = /* @__PURE__ */ new Set();
+    const deliver = makeDeliver(
+      filter,
+      seen,
+      (payload) => process.stdout.write(
         (typeof payload === "string" ? payload : JSON.stringify(payload)) + "\n"
-      );
-    });
+      )
+    );
+    const conn = await openConnection(cfg, deliver);
+    await reconcile(cfg, filter, deliver);
     if (json) {
       emit(
         {
@@ -1399,7 +1590,8 @@ function registerChannel(program2) {
     );
     await mcp.connect(new StdioServerTransport());
     await ensureSubscription(cfg, opts.name, filter);
-    const conn = await openConnection(cfg, (payload) => {
+    const seen = /* @__PURE__ */ new Set();
+    const deliver = makeDeliver(filter, seen, (payload) => {
       const { content, meta } = summarizeEvent(payload);
       void mcp.notification({
         method: "notifications/claude/channel",
@@ -1409,6 +1601,8 @@ function registerChannel(program2) {
 `))
       );
     });
+    const conn = await openConnection(cfg, deliver);
+    await reconcile(cfg, filter, deliver);
     process.stderr.write(
       style.dim(
         `sechroom channel (mcp) \u2014 tenant ${cfg.tenant}, tags [${filter.tags.join(", ")}]
@@ -1417,6 +1611,55 @@ function registerChannel(program2) {
     );
     await holdOpen(conn);
   });
+  channel.command("install").description(
+    "Wire `sechroom channel mcp` into the project .mcp.json as a Claude Code channel MCP server (idempotent)"
+  ).option(
+    "--workspace <wsp...>",
+    "Restrict dispatches to these workspace id(s)"
+  ).option(
+    "--tag <tag...>",
+    "Tag(s) a dispatch must carry to match (repeatable). Default targets WLP task dispatches.",
+    ["kind:task"]
+  ).option(
+    "--name <name>",
+    "MCP server + subscription name (idempotent per name)",
+    "sechroom-channel"
+  ).option("--dry-run", "Print what would change; write nothing").action((opts) => {
+    const path = join7(process.cwd(), ".mcp.json");
+    const dryRun = Boolean(opts.dryRun);
+    const args = ["channel", "mcp", "--name", opts.name];
+    for (const w of opts.workspace ?? [])
+      args.push("--workspace", w);
+    for (const t of opts.tag ?? []) args.push("--tag", t);
+    const entry = { command: "sechroom", args };
+    const config2 = readMcpConfig(path);
+    config2.mcpServers ??= {};
+    const existing = config2.mcpServers[opts.name];
+    const status = JSON.stringify(existing) === JSON.stringify(entry) ? "current" : existing ? "updated" : "created";
+    if (status !== "current" && !dryRun) {
+      config2.mcpServers[opts.name] = entry;
+      mkdirSync5(dirname4(path), { recursive: true });
+      writeFileSync5(path, JSON.stringify(config2, null, 2) + "\n");
+    }
+    const verb = status === "current" ? "already configured" : dryRun ? `would ${status === "created" ? "create" : "update"}` : status;
+    process.stdout.write(`${style.green("channel")} ${path} (${verb})
+`);
+    process.stdout.write(
+      style.dim(`  server "${opts.name}": sechroom ${args.join(" ")}
+`)
+    );
+    if (status !== "current") {
+      process.stdout.write(
+        style.dim(
+          `
+Load it (Channels research preview) by launching your agent with:
+  claude --dangerously-load-development-channels server:${opts.name}
+`
+        )
+      );
+    }
+    warnIfSechroomNotOnPath();
+  });
   channel.addHelpText(
     "after",
     `
@@ -1425,11 +1668,23 @@ Examples:
   $ sechroom channel connect --tag kind:task --tag status:in-progress
   $ sechroom channel connect --workspace wsp_X --json | jq .
 
-  # As a Claude Code channel (research preview, v2.1.80+):
-  #   add to .mcp.json:  { "mcpServers": { "sechroom": { "command": "npx", "args": ["@sechroom/cli", "channel", "mcp"] } } }
-  #   then:  claude --dangerously-load-development-channels server:sechroom`
+  # Wire it as a Claude Code channel MCP server (research preview, v2.1.80+):
+  $ sechroom channel install --workspace wsp_X --tag kind:task --tag status:in-progress
+  #   then:  claude --dangerously-load-development-channels server:sechroom-channel`
   );
 }
+function readMcpConfig(path) {
+  if (!existsSync6(path)) return {};
+  const raw = readFileSync4(path, "utf8");
+  if (!raw.trim()) return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return fail(
+      `Could not parse ${path} as JSON \u2014 fix or remove it before installing the channel.`
+    );
+  }
+}
 function readFilter(opts) {
   const tags = opts.tag ?? [];
   const workspaceScope = opts.workspace ?? [];
@@ -1482,20 +1737,134 @@ function holdOpen(conn) {
     process.on("SIGTERM", stop);
   });
 }
-function summarizeEvent(payload) {
+function parseEvent(payload) {
   let data = payload;
   if (typeof payload === "string") {
     try {
       data = JSON.parse(payload);
     } catch {
-      return { content: payload, meta: {} };
+      return { eventType: "", memoryId: "", workspaceId: "", tags: void 0 };
     }
   }
   const obj = data ?? {};
   const inner = obj.data ?? obj;
-  const eventType = str(inner.eventType ?? inner.EventType ?? obj.type) || "substrate.event";
-  const memoryId = str(inner.memoryId ?? inner.MemoryId);
-  const workspaceId = str(inner.workspaceId ?? inner.WorkspaceId);
+  const rawTags = inner.tags ?? inner.Tags;
+  return {
+    eventType: str(inner.eventType ?? inner.EventType ?? obj.type) || "substrate.event",
+    memoryId: str(inner.memoryId ?? inner.MemoryId),
+    workspaceId: str(inner.workspaceId ?? inner.WorkspaceId),
+    tags: Array.isArray(rawTags) ? rawTags.filter((t) => typeof t === "string") : void 0
+  };
+}
+function shouldDeliver(payload, filter) {
+  const { workspaceId, tags } = parseEvent(payload);
+  if (filter.workspaceScope.length > 0 && (!workspaceId || !filter.workspaceScope.includes(workspaceId)))
+    return false;
+  if (filter.tags.length > 0) {
+    if (!tags) return false;
+    return facetedTagMatch(tags, filter.tags);
+  }
+  return true;
+}
+function makeDeliver(filter, seen, forward) {
+  return (payload) => {
+    if (!shouldDeliver(payload, filter)) return;
+    const { memoryId } = parseEvent(payload);
+    if (memoryId) {
+      if (seen.has(memoryId)) return;
+      seen.add(memoryId);
+    }
+    forward(payload);
+  };
+}
+async function reconcile(cfg, filter, deliver) {
+  if (filter.workspaceScope.length === 0) {
+    process.stderr.write(
+      style.dim(
+        "channel: no --workspace to reconcile against; live feed only (a dropped dispatch won't be recovered).\n"
+      )
+    );
+    return;
+  }
+  if (filter.tags.length === 0) return;
+  let token;
+  try {
+    token = await requireToken(cfg);
+  } catch {
+    return;
+  }
+  const qs = `filterTags=${encodeURIComponent(filter.tags.join(","))}&limit=100`;
+  let recovered = 0;
+  for (const ws of filter.workspaceScope) {
+    try {
+      const resp = await fetch(
+        `${cfg.baseUrl}/workspaces/${encodeURIComponent(ws)}/memories/feed?${qs}`,
+        {
+          headers: {
+            authorization: `Bearer ${token}`,
+            tenant: cfg.tenant,
+            "x-sechroom-surface": "cli"
+          }
+        }
+      );
+      if (!resp.ok) {
+        process.stderr.write(
+          err(
+            `channel: reconcile query for ${ws} failed (HTTP ${resp.status})
+`
+          )
+        );
+        continue;
+      }
+      const data = await resp.json();
+      for (const m of data.results ?? []) {
+        if (!m.id) continue;
+        deliver({
+          eventType: "reconcile",
+          memoryId: m.id,
+          workspaceId: ws,
+          tags: m.tags ?? []
+        });
+        recovered++;
+      }
+    } catch (e) {
+      process.stderr.write(
+        err(`channel: reconcile error for ${ws}: ${String(e)}
+`)
+      );
+    }
+  }
+  if (recovered > 0)
+    process.stderr.write(
+      style.dim(
+        `channel: reconciled ${recovered} already-queued event(s) on connect.
+`
+      )
+    );
+}
+function facetedTagMatch(eventTags, filterTags) {
+  const have = new Set(eventTags);
+  const groups = /* @__PURE__ */ new Map();
+  for (const f of filterTags) {
+    const ns = f.endsWith(":*") ? f.slice(0, -2) : namespaceOf(f);
+    const group = groups.get(ns) ?? [];
+    group.push(f);
+    groups.set(ns, group);
+  }
+  for (const [ns, group] of groups) {
+    const ok2 = group.some(
+      (f) => f.endsWith(":*") ? eventTags.some((t) => namespaceOf(t) === ns) : have.has(f)
+    );
+    if (!ok2) return false;
+  }
+  return true;
+}
+function namespaceOf(tag) {
+  const i = tag.indexOf(":");
+  return i >= 0 ? tag.slice(0, i) : tag;
+}
+function summarizeEvent(payload) {
+  const { eventType, memoryId, workspaceId } = parseEvent(payload);
   const content = memoryId ? `${eventType}: ${memoryId}${workspaceId ? ` (workspace ${workspaceId})` : ""}` : typeof payload === "string" ? payload : JSON.stringify(payload);
   const meta = {};
   if (eventType) meta.event_type = eventType;
@@ -1521,7 +1890,7 @@ Examples:
   $ sechroom chat replies 1718049600.123456 --surface slack
   $ sechroom chat stop-tracking 1718049600.123456 --surface slack`
   );
-  chat.command("send <channelId> <text>").description("Send a message to a channel (POST /chat/channel-messages/{surface})").option("--guild <guildId>", "Discord guild snowflake \u2014 required for --surface discord").option("--memory <memoryId>", "Attach a sechroom memory id").option("--no-track", "Don't capture replies to this message").option("--parent <parentMessage>", "Thread under a parent (Slack thread_ts / Discord message id)").option("--source <source>", "Source / lane stamp (renders an attribution footer)", "cli").option("--as <as>", "Slack only: 'bot' (default) or 'user' (your linked Slack identity)", "bot").action(async (channelId, text, opts, cmd) => {
+  chat.command("send <channelId> <text>").description("Send a message to a channel (POST /chat/channel-messages/{surface})").option("--guild <guildId>", "Discord guild snowflake \u2014 required for --surface discord").option("--memory <memoryId>", "Attach a sechroom memory id").option("--no-track", "Don't capture replies to this message").option("--parent <parentMessage>", "Thread under a parent (Slack thread_ts / Discord message id)").option("--source <source>", "Source / lane stamp (renders an attribution footer)", "cli").option("--as <as>", "Slack only: 'bot' (default) or 'user' (your linked Slack identity)", "bot").action(async (channelId, text2, opts, cmd) => {
     const { surface, ...globals } = cmd.optsWithGlobals();
     const json = Boolean(cmd.optsWithGlobals().json);
     const cfg = resolveConfig(globals);
@@ -1531,7 +1900,7 @@ Examples:
         params: { path: { surface: String(surface) } },
         body: {
           channelId,
-          text,
+          text: text2,
           guildId: opts.guild ?? null,
           attachedMemoryId: opts.memory ?? null,
           trackReplies: opts.track,
@@ -1590,28 +1959,28 @@ Examples:
 }
 
 // src/commands/checkpoint.ts
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname5, join as join8 } from "path";
+import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname7, join as join10 } from "path";
 
 // src/commands/hook.ts
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync4, statSync as statSync2, writeFileSync as writeFileSync5 } from "fs";
-import { delimiter, dirname as dirname4, join as join7 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync6, statSync as statSync2, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname6, join as join9 } from "path";
 
 // src/sem.ts
-import { dirname as dirname2, join as join5 } from "path";
-import { appendFileSync, existsSync as existsSync4, mkdirSync as mkdirSync4, readdirSync, readFileSync as readFileSync3, statSync, writeFileSync as writeFileSync4 } from "fs";
-var SEM_FILE = join5(".sechroom", "lane.json");
+import { dirname as dirname5, join as join8 } from "path";
+import { appendFileSync, existsSync as existsSync7, mkdirSync as mkdirSync6, readdirSync, readFileSync as readFileSync5, statSync, writeFileSync as writeFileSync6 } from "fs";
+var SEM_FILE = join8(".sechroom", "lane.json");
 var STATE_DIR_NAME2 = ".sechroom";
 function localSemPath(cwd = process.cwd()) {
-  return join5(cwd, SEM_FILE);
+  return join8(cwd, SEM_FILE);
 }
 function resolveSemPathForRead(start = process.cwd()) {
   let dir = start;
   while (true) {
-    const candidate = join5(dir, SEM_FILE);
-    if (existsSync4(candidate)) return candidate;
-    const parent = dirname2(dir);
+    const candidate = join8(dir, SEM_FILE);
+    if (existsSync7(candidate)) return candidate;
+    const parent = dirname5(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
@@ -1621,23 +1990,23 @@ function applyWorktreeLaneSuffix(lane, start = process.cwd()) {
     let dir = start;
     let gitPath;
     for (; ; ) {
-      const candidate = join5(dir, ".git");
-      if (existsSync4(candidate)) {
+      const candidate = join8(dir, ".git");
+      if (existsSync7(candidate)) {
         gitPath = candidate;
         break;
       }
-      const parent = dirname2(dir);
+      const parent = dirname5(dir);
       if (parent === dir) break;
       dir = parent;
     }
     if (!gitPath || statSync(gitPath).isDirectory()) return lane;
-    const gitFile = readFileSync3(gitPath, "utf8");
+    const gitFile = readFileSync5(gitPath, "utf8");
     const common = gitFile.trim().match(/^gitdir:\s*(.+)\/worktrees\/[^/\s]+\s*$/);
     if (!common) return lane;
-    const worktreesDir = join5(common[1], "worktrees");
+    const worktreesDir = join8(common[1], "worktrees");
     const siblings = readdirSync(worktreesDir).filter((n) => {
       try {
-        return statSync(join5(worktreesDir, n)).isDirectory();
+        return statSync(join8(worktreesDir, n)).isDirectory();
       } catch {
         return false;
       }
@@ -1658,17 +2027,17 @@ function serializeSem(values) {
 }
 function readSem(path) {
   const p = path ?? resolveSemPathForRead();
-  if (!p || !existsSync4(p)) return void 0;
-  return { path: p, values: parseLaneJson(readFileSync3(p, "utf8")) };
+  if (!p || !existsSync7(p)) return void 0;
+  return { path: p, values: parseLaneJson(readFileSync5(p, "utf8")) };
 }
 function readLocalSemValues(cwd = process.cwd()) {
-  const next = join5(cwd, SEM_FILE);
-  if (existsSync4(next)) return readSem(next)?.values ?? {};
+  const next = join8(cwd, SEM_FILE);
+  if (existsSync7(next)) return readSem(next)?.values ?? {};
   return {};
 }
-function parseLaneJson(text) {
+function parseLaneJson(text2) {
   try {
-    const parsed = JSON.parse(text);
+    const parsed = JSON.parse(text2);
     const out = {};
     for (const [k, v] of Object.entries(parsed)) {
       if (typeof v === "string") out[k] = v;
@@ -1680,12 +2049,15 @@ function parseLaneJson(text) {
 }
 var STATE_DIR_IGNORE = `${STATE_DIR_NAME2}/`;
 function writeSem(values, path = localSemPath()) {
-  mkdirSync4(dirname2(path), { recursive: true });
-  writeFileSync4(path, serializeSem(values));
+  mkdirSync6(dirname5(path), { recursive: true });
+  writeFileSync6(path, serializeSem(values));
   ensureSemIgnored(path);
   ensureContinuityScaffold(path);
   return path;
 }
+function ensureStateDirIgnored(cwd = process.cwd()) {
+  ensureSemIgnored(localSemPath(cwd));
+}
 var CONTINUITY_FILE_NAME = "continuity.json";
 var CONTINUITY_SCAFFOLD = JSON.stringify(
   {
@@ -1705,9 +2077,9 @@ var CONTINUITY_SCAFFOLD = JSON.stringify(
 ) + "\n";
 function ensureContinuityScaffold(semPath) {
   try {
-    const target = join5(dirname2(semPath), CONTINUITY_FILE_NAME);
-    if (existsSync4(target)) return;
-    writeFileSync4(target, CONTINUITY_SCAFFOLD);
+    const target = join8(dirname5(semPath), CONTINUITY_FILE_NAME);
+    if (existsSync7(target)) return;
+    writeFileSync6(target, CONTINUITY_SCAFFOLD);
   } catch {
   }
 }
@@ -1720,8 +2092,8 @@ function ignoresSem(content) {
 function inGitRepo(startDir) {
   let dir = startDir;
   for (; ; ) {
-    if (existsSync4(join5(dir, ".git"))) return true;
-    const parent = dirname2(dir);
+    if (existsSync7(join8(dir, ".git"))) return true;
+    const parent = dirname5(dir);
     if (parent === dir) return false;
     dir = parent;
   }
@@ -1729,104 +2101,34 @@ function inGitRepo(startDir) {
 function resolveGitignoreTarget(startDir) {
   let dir = startDir;
   for (; ; ) {
-    const gi = join5(dir, ".gitignore");
-    if (existsSync4(gi)) return { path: gi, exists: true };
-    const parent = dirname2(dir);
-    if (existsSync4(join5(dir, ".git")) || parent === dir) {
-      return { path: join5(startDir, ".gitignore"), exists: false };
+    const gi = join8(dir, ".gitignore");
+    if (existsSync7(gi)) return { path: gi, exists: true };
+    const parent = dirname5(dir);
+    if (existsSync7(join8(dir, ".git")) || parent === dir) {
+      return { path: join8(startDir, ".gitignore"), exists: false };
     }
     dir = parent;
   }
 }
 function ensureSemIgnored(semPath) {
   try {
-    const checkoutDir = dirname2(dirname2(semPath));
+    const checkoutDir = dirname5(dirname5(semPath));
     if (!inGitRepo(checkoutDir)) return;
     const target = resolveGitignoreTarget(checkoutDir);
     if (target.exists) {
-      const content = readFileSync3(target.path, "utf8");
+      const content = readFileSync5(target.path, "utf8");
       if (ignoresSem(content)) return;
       const sep = content.length === 0 || content.endsWith("\n") ? "" : "\n";
       appendFileSync(target.path, `${sep}${STATE_DIR_IGNORE}
 `);
     } else {
-      writeFileSync4(target.path, `${STATE_DIR_IGNORE}
+      writeFileSync6(target.path, `${STATE_DIR_IGNORE}
 `);
     }
   } catch {
   }
 }
 
-// src/setup/clients.ts
-import { existsSync as existsSync5 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname3, join as join6 } from "path";
-function claudeDesktopConfigPath(home) {
-  switch (process.platform) {
-    case "darwin":
-      return join6(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
-    case "win32":
-      return join6(process.env.APPDATA ?? join6(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
-    default:
-      return join6(home, ".config", "Claude", "claude_desktop_config.json");
-  }
-}
-function clientTargets(cwd, opts = {}) {
-  const home = homedir3();
-  const claudeDir = opts.claudeDir ?? join6(home, ".claude");
-  const codexHome = opts.codexHome ?? join6(home, ".codex");
-  return {
-    "claude-code": {
-      key: "claude-code",
-      label: "Claude Code",
-      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join6(cwd, ".mcp.json"), format: "json" },
-      instruction: { surfaceKey: "claude-code", path: join6(cwd, "CLAUDE.md") }
-    },
-    "claude-desktop": {
-      key: "claude-desktop",
-      label: "Claude Desktop",
-      mcp: { surfaceKey: "claude-desktop", sectionType: SectionType.McpConfig, path: claudeDesktopConfigPath(home), format: "json" },
-      instruction: { surfaceKey: "claude-desktop", path: join6(claudeDir, "CLAUDE.md") }
-    },
-    codex: {
-      key: "codex",
-      label: "Codex CLI",
-      mcp: { surfaceKey: "chatgpt", sectionType: SectionType.McpConfigToml, path: join6(codexHome, "config.toml"), format: "toml" },
-      instruction: { surfaceKey: "chatgpt", path: join6(cwd, "AGENTS.md") }
-    },
-    cursor: {
-      key: "cursor",
-      label: "Cursor",
-      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join6(cwd, ".cursor", "mcp.json"), format: "json" },
-      instruction: { surfaceKey: "chatgpt", path: join6(cwd, "AGENTS.md") }
-    },
-    antigravity: {
-      key: "antigravity",
-      label: "Google Antigravity",
-      // FR-sechroom-247 — Antigravity reads MCP from a GLOBAL, home-relative
-      // `~/.gemini/config/mcp_config.json` (not cwd; not affected by
-      // CLAUDE_CONFIG_DIR / CODEX_HOME). The snippet — `serverUrl`-shaped, no
-      // `type` — comes from the `antigravity` server surface, so we don't
-      // hardcode it here. Instructions go in the project `AGENTS.md`
-      // (cross-tool, shared with Codex/Cursor).
-      mcp: { surfaceKey: "antigravity", sectionType: SectionType.McpConfig, path: join6(home, ".gemini", "config", "mcp_config.json"), format: "json" },
-      instruction: { surfaceKey: "antigravity", path: join6(cwd, "AGENTS.md") }
-    }
-  };
-}
-var ALL_CLIENT_KEYS = ["claude-code", "claude-desktop", "codex", "cursor", "antigravity"];
-var DEFAULT_CLIENT_KEY = "claude-code";
-function detectInstalledClients(cwd) {
-  const home = homedir3();
-  const detected = [];
-  if (resolveClaudeTargets({}).some((t) => existsSync5(t.dir))) detected.push("claude-code");
-  if (existsSync5(dirname3(claudeDesktopConfigPath(home)))) detected.push("claude-desktop");
-  if (resolveCodexHomes({}).some((d) => existsSync5(d))) detected.push("codex");
-  if (existsSync5(join6(home, ".cursor")) || existsSync5(join6(cwd, ".cursor"))) detected.push("cursor");
-  if (existsSync5(join6(home, ".gemini"))) detected.push("antigravity");
-  return detected;
-}
-
 // src/commands/hook.ts
 async function readStdin() {
   if (process.stdin.isTTY) return "";
@@ -1851,13 +2153,13 @@ function resolveLane(flagLane, cwd) {
   if (!base) return void 0;
   return applyWorktreeLaneSuffix(base, start);
 }
-var INTENT_FILE = join7(".sechroom", "continuity.json");
+var INTENT_FILE = join9(".sechroom", "continuity.json");
 function resolveIntentPath(start) {
   let dir = start;
   for (; ; ) {
-    const candidate = join7(dir, INTENT_FILE);
-    if (existsSync6(candidate)) return candidate;
-    const parent = dirname4(dir);
+    const candidate = join9(dir, INTENT_FILE);
+    if (existsSync8(candidate)) return candidate;
+    const parent = dirname6(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
@@ -1866,7 +2168,7 @@ function readIntent(start) {
   const path = resolveIntentPath(start);
   if (!path) return void 0;
   try {
-    return JSON.parse(readFileSync4(path, "utf8"));
+    return JSON.parse(readFileSync6(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -1908,14 +2210,14 @@ async function saveSnapshotFromIntent(cmd, cwd, laneFlag, scopeFlag, defaultScop
 }
 function ledgerPath(start) {
   const intent = resolveIntentPath(start);
-  const dir = intent ? dirname4(intent) : join7(start, ".sechroom");
-  return join7(dir, ".checkpoint-state.json");
+  const dir = intent ? dirname6(intent) : join9(start, ".sechroom");
+  return join9(dir, ".checkpoint-state.json");
 }
 function readLedger(start) {
   try {
     const p = ledgerPath(start);
-    if (!existsSync6(p)) return {};
-    return JSON.parse(readFileSync4(p, "utf8"));
+    if (!existsSync8(p)) return {};
+    return JSON.parse(readFileSync6(p, "utf8"));
   } catch {
     return {};
   }
@@ -1962,180 +2264,51 @@ function recordPush(start, intent) {
     } catch {
       mtimeMs = void 0;
     }
-    mkdirSync5(dirname4(p), { recursive: true });
-    const ledger = {
-      lastEpochMs: Date.now(),
-      lastMtimeMs: mtimeMs,
-      lastHash: intentHash(intent)
-    };
-    writeFileSync5(p, JSON.stringify(ledger) + "\n");
-  } catch {
-  }
-}
-function formatContext(bundle, lane) {
-  const s = bundle?.latestSnapshot;
-  if (!s) return null;
-  const lines = [];
-  lines.push(`[sechroom continuity \u2014 resumed lane ${lane}]`);
-  if (s.currentObjective) lines.push(`Objective: ${s.currentObjective}`);
-  if (s.currentState) lines.push(`State: ${s.currentState}`);
-  if (s.lastMeaningfulAction) lines.push(`Last action: ${s.lastMeaningfulAction}`);
-  if (s.nextIntendedAction) lines.push(`Next: ${s.nextIntendedAction}`);
-  if (s.resumeInstruction) lines.push(`Resume: ${s.resumeInstruction}`);
-  const constraints = s.activeConstraints ?? [];
-  if (constraints.length) {
-    lines.push("Active constraints:");
-    for (const c of constraints) lines.push(`  - ${c}`);
-  }
-  const questions = s.openQuestions ?? [];
-  if (questions.length) {
-    lines.push("Open questions:");
-    for (const q of questions) lines.push(`  - ${q}`);
-  }
-  const artifacts = s.relevantArtifactIds ?? [];
-  if (artifacts.length) lines.push(`Relevant artifacts: ${artifacts.join(", ")}`);
-  const marker = [s.id, s.createdAt].filter(Boolean).join(" @ ");
-  if (marker) lines.push(`(snapshot ${marker})`);
-  return lines.join("\n");
-}
-function emitSessionStart(additionalContext) {
-  process.stdout.write(
-    JSON.stringify({
-      hookSpecificOutput: {
-        hookEventName: "SessionStart",
-        additionalContext
-      }
-    }) + "\n"
-  );
-}
-var CLAUDE_HOOK_COMMANDS = {
-  SessionStart: "sechroom hook session-start",
-  PreCompact: "sechroom hook pre-compact",
-  SessionEnd: "sechroom hook session-end"
-};
-var CODEX_HOOK_COMMANDS = {
-  SessionStart: "sechroom hook session-start",
-  Stop: "sechroom hook session-end --debounce-minutes 10"
-};
-function hasHookCommand(config2, event, command) {
-  const groups = config2.hooks?.[event] ?? [];
-  return groups.some((g) => (g.hooks ?? []).some((h) => h.type === "command" && h.command === command));
-}
-function mergeHooks(config2, commands) {
-  config2.hooks ??= {};
-  let added = 0;
-  for (const [event, command] of Object.entries(commands)) {
-    if (hasHookCommand(config2, event, command)) continue;
-    const groups = config2.hooks[event] ??= [];
-    groups.push({ hooks: [{ type: "command", command }] });
-    added += 1;
-  }
-  return added;
-}
-function readJsonConfig2(path) {
-  if (!existsSync6(path)) return {};
-  const raw = readFileSync4(path, "utf8");
-  if (!raw.trim()) return {};
-  return JSON.parse(raw);
-}
-function installHooksJson(path, commands, dryRun) {
-  const existed = existsSync6(path) && readFileSync4(path, "utf8").trim().length > 0;
-  const config2 = readJsonConfig2(path);
-  const added = mergeHooks(config2, commands);
-  if (added === 0 && existed) return { path, status: "current" };
-  if (!dryRun) {
-    mkdirSync5(dirname4(path), { recursive: true });
-    writeFileSync5(path, JSON.stringify(config2, null, 2) + "\n");
-  }
-  return { path, status: existed ? "merged" : "created" };
-}
-function ensureCodexFeaturesHooks(content) {
-  const lines = content.split("\n");
-  const headerIdx = lines.findIndex((l) => l.trim() === "[features]");
-  if (headerIdx === -1) {
-    const base = content.length === 0 || content.endsWith("\n") ? content : content + "\n";
-    return { next: base + "\n[features]\nhooks = true\n", changed: true };
-  }
-  for (let i = headerIdx + 1; i < lines.length; i += 1) {
-    const trimmed = lines[i].trim();
-    if (trimmed.startsWith("[") && trimmed.endsWith("]")) break;
-    const m = lines[i].match(/^(\s*)hooks(\s*)=(\s*)(.*)$/);
-    if (!m) continue;
-    const value = m[4].replace(/\s*#.*$/, "").trim();
-    if (value === "true") return { next: content, changed: false };
-    lines[i] = `${m[1]}hooks${m[2]}=${m[3]}true`;
-    return { next: lines.join("\n"), changed: true };
-  }
-  lines.splice(headerIdx + 1, 0, "hooks = true");
-  return { next: lines.join("\n"), changed: true };
-}
-function installCodexFeatureFlag(path, dryRun) {
-  const existed = existsSync6(path);
-  const content = existed ? readFileSync4(path, "utf8") : "";
-  const { next, changed } = ensureCodexFeaturesHooks(content);
-  if (!changed) return { path, status: "current" };
-  if (!dryRun) {
-    mkdirSync5(dirname4(path), { recursive: true });
-    writeFileSync5(path, next);
-  }
-  return { path, status: existed ? "merged" : "created" };
-}
-function resolveSurfaces(surface, cwd) {
-  if (surface === "claude") return ["claude"];
-  if (surface === "codex") return ["codex"];
-  if (surface === "both") return ["claude", "codex"];
-  if (surface) throw new Error(`--surface must be one of claude | codex | both (got '${surface}')`);
-  const surfaces = detectHookSurfaces(cwd);
-  return surfaces.length > 0 ? surfaces : ["claude", "codex"];
-}
-function describe(result, dryRun) {
-  if (result.status === "current") return `  \u2713 ${result.path} (already configured)`;
-  const verb = dryRun ? "would" : result.status === "created" ? "created" : "updated";
-  return `  \u2713 ${result.path} (${dryRun ? `${verb} ${result.status === "created" ? "create" : "update"}` : verb})`;
-}
-var HOOK_SURFACE_LABEL = {
-  claude: "Claude Code",
-  codex: "Codex"
-};
-function installHookSurfaces(surfaces, opts) {
-  const out = [];
-  for (const surface of surfaces) {
-    if (surface === "claude") {
-      const path = join7(opts.claudeDir, "settings.json");
-      out.push({ surface, results: [installHooksJson(path, CLAUDE_HOOK_COMMANDS, opts.dryRun)] });
-    } else {
-      const hooksJson = installHooksJson(join7(opts.codexHome, "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
-      const featureFlag = installCodexFeatureFlag(join7(opts.codexHome, "config.toml"), opts.dryRun);
-      out.push({ surface, results: [hooksJson, featureFlag] });
-    }
+    mkdirSync7(dirname6(p), { recursive: true });
+    const ledger = {
+      lastEpochMs: Date.now(),
+      lastMtimeMs: mtimeMs,
+      lastHash: intentHash(intent)
+    };
+    writeFileSync7(p, JSON.stringify(ledger) + "\n");
+  } catch {
   }
-  return out;
-}
-function detectHookSurfaces(cwd) {
-  const detected = detectInstalledClients(cwd);
-  const surfaces = [];
-  if (detected.includes("claude-code")) surfaces.push("claude");
-  if (detected.includes("codex")) surfaces.push("codex");
-  return surfaces;
 }
-function isSechroomOnPath() {
-  const pathEnv = process.env.PATH ?? "";
-  if (!pathEnv) return false;
-  const names = process.platform === "win32" ? ["sechroom.cmd", "sechroom.exe", "sechroom.bat", "sechroom"] : ["sechroom"];
-  for (const dir of pathEnv.split(delimiter)) {
-    if (!dir) continue;
-    for (const name of names) {
-      if (existsSync6(join7(dir, name))) return true;
-    }
+function formatContext(bundle, lane) {
+  const s = bundle?.latestSnapshot;
+  if (!s) return null;
+  const lines = [];
+  lines.push(`[sechroom continuity \u2014 resumed lane ${lane}]`);
+  if (s.currentObjective) lines.push(`Objective: ${s.currentObjective}`);
+  if (s.currentState) lines.push(`State: ${s.currentState}`);
+  if (s.lastMeaningfulAction) lines.push(`Last action: ${s.lastMeaningfulAction}`);
+  if (s.nextIntendedAction) lines.push(`Next: ${s.nextIntendedAction}`);
+  if (s.resumeInstruction) lines.push(`Resume: ${s.resumeInstruction}`);
+  const constraints = s.activeConstraints ?? [];
+  if (constraints.length) {
+    lines.push("Active constraints:");
+    for (const c of constraints) lines.push(`  - ${c}`);
   }
-  return false;
+  const questions = s.openQuestions ?? [];
+  if (questions.length) {
+    lines.push("Open questions:");
+    for (const q of questions) lines.push(`  - ${q}`);
+  }
+  const artifacts = s.relevantArtifactIds ?? [];
+  if (artifacts.length) lines.push(`Relevant artifacts: ${artifacts.join(", ")}`);
+  const marker = [s.id, s.createdAt].filter(Boolean).join(" @ ");
+  if (marker) lines.push(`(snapshot ${marker})`);
+  return lines.join("\n");
 }
-function warnIfSechroomNotOnPath(write = (s) => void process.stderr.write(s)) {
-  if (isSechroomOnPath()) return false;
-  write(
-    "\n\u26A0  `sechroom` isn't on your PATH. The hooks run a bare `sechroom hook \u2026` command\n   when your agent fires them, so a non-global install (npx / local) will fail at\n   that point. Install globally so the command resolves:\n     npm i -g @sechroom/cli\n"
+function emitSessionStart(additionalContext) {
+  process.stdout.write(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "SessionStart",
+        additionalContext
+      }
+    }) + "\n"
   );
-  return true;
 }
 function registerHook(program2) {
   const hook = program2.command("hook").description("Agent-lifecycle hook adapter (Claude Code / Codex) \u2014 bridges hooks to continuity");
@@ -2344,10 +2517,10 @@ Examples:
       const client = await makeClient(cfg);
       return client.POST("/continuity/snapshots", { body });
     });
-    const path = resolveIntentPath(cwd) ?? join8(cwd, INTENT_FILE);
+    const path = resolveIntentPath(cwd) ?? join10(cwd, INTENT_FILE);
     const fileBody = { ...merged, scope, lastSnapshotId: data.snapshotId };
-    mkdirSync6(dirname5(path), { recursive: true });
-    writeFileSync6(path, JSON.stringify(fileBody, null, 2) + "\n");
+    mkdirSync8(dirname7(path), { recursive: true });
+    writeFileSync8(path, JSON.stringify(fileBody, null, 2) + "\n");
     recordPush(cwd, merged);
     if (json) {
       emit({ snapshotId: data.snapshotId, lane, scope, file: path }, true);
@@ -2360,6 +2533,149 @@ Examples:
   });
 }
 
+// src/commands/close.ts
+import { readFileSync as readFileSync7 } from "fs";
+var VERDICTS = ["pass", "soft-fail", "plan-invalid", "blocked"];
+function registerClose(program2) {
+  program2.command("close").description(
+    "Close a dispatched WorkTask in one call: closeout memo (verdict + correlation) + Reference edge + source status flip. Managed runs stamp the run's matchTags verbatim (SBC-1180)."
+  ).requiredOption("--task <id>", "The WorkTask memory id being closed").requiredOption("--verdict <verdict>", `Verdict: ${VERDICTS.join(" | ")}`).requiredOption(
+    "--workspace <wsp>",
+    "Workspace that owns the closeout memo"
+  ).requiredOption("--title <title>", "Closeout title").option(
+    "--file <path>",
+    "Read the closeout body from a file (default: stdin)"
+  ).option(
+    "--decomposition <id>",
+    "Managed-run selector \u2014 the sug_ decomposition the task belongs to. Locates the parked run so its matchTags/verdict contract are read from state, not assembled from args."
+  ).option(
+    "--no-status-flip",
+    "Skip the source status flip (for tasks whose status is managed elsewhere)"
+  ).option("--source <source>", "Source / lane stamp", "cli").addHelpText(
+    "after",
+    `
+Examples:
+  # Managed run \u2014 reads matchTags from run state, stamps them verbatim, un-parks the run:
+  $ echo "Shipped X. Tests green." | sechroom close --task mem_XXXX --decomposition sug_YYYY \\
+      --verdict pass --workspace wsp_ZZZZ --title "w4_build closeout"
+
+  # Bare task:
+  $ sechroom close --task mem_XXXX --verdict pass --workspace wsp_ZZZZ \\
+      --title "done" --file ./closeout.md`
+  ).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const json = cmd.optsWithGlobals().json;
+    const verdict = String(opts.verdict);
+    if (!VERDICTS.includes(verdict))
+      fail(
+        `--verdict must be one of ${VERDICTS.join(" | ")} \u2014 got '${opts.verdict}'`
+      );
+    let bodyText;
+    try {
+      bodyText = opts.file ? readFileSync7(opts.file, "utf8") : readFileSync7(0, "utf8");
+    } catch {
+      fail(
+        opts.file ? `could not read --file ${opts.file}` : "no closeout body \u2014 pass --file <path> or pipe it on stdin"
+      );
+    }
+    if (!bodyText.trim())
+      fail(
+        "closeout body is empty \u2014 pass --file <path> or pipe the body on stdin"
+      );
+    const client = await makeClient(cfg);
+    let matchTags;
+    if (opts.decomposition) {
+      const run = await runApi(
+        "Reading run contract",
+        async () => client.GET("/decompositions/{id}/run", {
+          params: { path: { id: opts.decomposition } }
+        })
+      );
+      const await_ = run.awaitingCompletion;
+      if (!await_ || !Array.isArray(await_.matchTags) || await_.matchTags.length === 0)
+        fail(
+          `decomposition ${opts.decomposition} has no parked run awaiting a completion \u2014 nothing to close (run outcome: ${run.outcome ?? "unknown"}). Idempotent no-op on an already-resumed/terminal run.`
+        );
+      if (run.awaitingTaskId && run.awaitingTaskId !== opts.task)
+        fail(
+          `run ${opts.decomposition} is awaiting task ${run.awaitingTaskId}, not ${opts.task} \u2014 refusing to mis-key the resume.`
+        );
+      matchTags = await_.matchTags;
+    } else {
+      matchTags = [`wlp-task:${opts.task}`];
+    }
+    const tags = [
+      .../* @__PURE__ */ new Set([
+        ...matchTags,
+        `wlp-task:${opts.task}`,
+        `verdict:${verdict}`
+      ])
+    ];
+    const closeout = await runApi(
+      "Creating closeout",
+      async () => client.POST("/memories", {
+        body: {
+          text: bodyText,
+          type: "reference",
+          content: "{}",
+          confidence: 1,
+          source: opts.source,
+          archetype: "Document",
+          title: opts.title,
+          tags,
+          owner: { type: "Workspace", id: opts.workspace }
+        }
+      })
+    );
+    const edge = await runApi(
+      "Wiring Reference edge",
+      async () => client.POST("/memories/{memoryId}/relationships", {
+        params: { path: { memoryId: closeout.id } },
+        body: { toMemoryId: opts.task, type: "Reference" }
+      })
+    );
+    let taskStatus;
+    if (opts.statusFlip !== false) {
+      const current = await runApi(
+        "Reading task tags",
+        async () => client.GET("/memories/{memoryId}", {
+          params: { path: { memoryId: opts.task } }
+        })
+      );
+      const currentTags = current.item?.tags ?? current.tags ?? [];
+      const target = verdict === "blocked" ? "status:blocked" : "status:done";
+      const nextTags = [
+        ...new Set(currentTags.filter((t) => !t.startsWith("status:")))
+      ].concat(target);
+      await runApi(
+        "Flipping task status",
+        async () => client.PATCH("/memories/{memoryId}/metadata", {
+          params: { path: { memoryId: opts.task } },
+          body: {
+            memoryId: opts.task,
+            source: opts.source,
+            tags: nextTags
+          }
+        })
+      );
+      taskStatus = target.slice("status:".length);
+    }
+    const view = resolveViewUrl(cfg.baseUrl, closeout.url);
+    const result = {
+      closeoutId: closeout.id,
+      edgeId: edge.id,
+      taskStatus: taskStatus ?? null,
+      verdict,
+      tags
+    };
+    emitAction(
+      `closed ${style.bold(opts.task)} verdict:${style.bold(verdict)} \u2192 closeout ${style.bold(closeout.id)}${taskStatus ? ` ${style.dim(`(task ${taskStatus})`)}` : ""}${view ? ` ${style.dim("\u2192")} ${view}` : ""}`,
+      result,
+      json
+    );
+  });
+}
+
 // src/commands/continuity.ts
 function registerContinuity(program2) {
   const continuity = program2.command("continuity").description("Continuity snapshots: checkpoint and resume work");
@@ -2520,6 +2836,90 @@ Examples:
   });
 }
 
+// src/commands/decomposition.ts
+function registerDecomposition(program2) {
+  const decomposition = program2.command("decomposition").description(
+    "Drive a WLP decomposition: decompose a brief, then execute / accept / reject"
+  );
+  decomposition.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom decomposition decompose mem_XXXX
+  $ sechroom decomposition execute sug_XXXX
+  $ sechroom decomposition accept sug_XXXX
+  $ sechroom decomposition reject sug_XXXX --reason "wrong shape"`
+  );
+  decomposition.command("decompose <briefId>").description(
+    "Decompose a governed brief into a candidate Task graph (POST /governed-briefs/{id}/decompose)"
+  ).action(async (briefId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Queueing decomposition", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/governed-briefs/{id}/decompose", {
+        params: { path: { id: briefId } },
+        body: { id: briefId }
+      });
+    });
+    emitAction(
+      `queued decomposition of ${style.bold(briefId)} \u2192 ${style.bold(data.suggestionId)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  decomposition.command("execute <decompositionId>").description(
+    "Execute a decomposition's Task graph (POST /decompositions/{id}/execute)"
+  ).action(async (decompositionId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Executing decomposition", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/decompositions/{id}/execute", {
+        params: { path: { id: decompositionId } },
+        body: {}
+      });
+    });
+    emitAction(
+      `executed ${style.bold(decompositionId)} \u2192 run ${style.bold(data.runRecordId)} (${data.outcome})`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  decomposition.command("accept <decompositionId>").description(
+    "Accept a Pending decomposition \u2014 promote + ratify its Tasks (POST /decompositions/{id}/accept)"
+  ).action(async (decompositionId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Accepting decomposition", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/decompositions/{id}/accept", {
+        params: { path: { id: decompositionId } },
+        body: {}
+      });
+    });
+    emitAction(
+      `accepted decomposition ${style.bold(decompositionId)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  decomposition.command("reject <decompositionId>").description(
+    "Reject a Pending decomposition \u2014 archive its Tasks, bounce the brief (POST /decompositions/{id}/reject)"
+  ).option("--reason <reason>", "Optional free-text rejection reason").action(async (decompositionId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Rejecting decomposition", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/decompositions/{id}/reject", {
+        params: { path: { id: decompositionId } },
+        body: { reasonText: opts.reason ?? null }
+      });
+    });
+    emitAction(
+      `rejected decomposition ${style.bold(decompositionId)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+}
+
 // src/commands/filing.ts
 function registerFiling(program2) {
   const filing = program2.command("filing").description("Review and act on filing suggestions");
@@ -3031,8 +3431,8 @@ Examples:
 
 // src/setup/apply.ts
 import { createHash as createHash3 } from "crypto";
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync7, existsSync as existsSync7 } from "fs";
-import { dirname as dirname6 } from "path";
+import { mkdirSync as mkdirSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync9, existsSync as existsSync9 } from "fs";
+import { dirname as dirname8 } from "path";
 var MARKER_BEGIN = "<!-- @sechroom/cli:begin";
 var MARKER_END = "<!-- @sechroom/cli:end";
 function normalizeBody(s) {
@@ -3085,22 +3485,22 @@ function parseManagedBlock(content, block) {
   return null;
 }
 function ensureDir2(path) {
-  mkdirSync7(dirname6(path), { recursive: true });
+  mkdirSync9(dirname8(path), { recursive: true });
 }
 function readOr(path, fallback) {
   try {
-    return readFileSync5(path, "utf8");
+    return readFileSync8(path, "utf8");
   } catch {
     return fallback;
   }
 }
 function mergeMcpJson(path, snippet, dryRun) {
   const incoming = JSON.parse(snippet);
-  const existed = existsSync7(path);
+  const existed = existsSync9(path);
   let current = {};
   if (existed) {
     try {
-      current = JSON.parse(readFileSync5(path, "utf8"));
+      current = JSON.parse(readFileSync8(path, "utf8"));
     } catch {
       return { kind: "mcp", path, status: "skipped", note: "existing file isn't valid JSON \u2014 left untouched" };
     }
@@ -3108,26 +3508,26 @@ function mergeMcpJson(path, snippet, dryRun) {
   current.mcpServers = { ...current.mcpServers ?? {}, ...incoming.mcpServers ?? {} };
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync7(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
+  writeFileSync9(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function mergeCodexToml(path, snippet, dryRun) {
-  const existed = existsSync7(path);
+  const existed = existsSync9(path);
   let body = readOr(path, "");
   body = body.replace(/(^|\n)\[mcp_servers\.sechroom\][^[]*/, "\n").replace(/\n{3,}/g, "\n\n");
   const trimmed = body.trim();
   const next = (trimmed.length > 0 ? trimmed + "\n\n" : "") + snippet.trim() + "\n";
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync7(path, next, { mode: 384 });
+  writeFileSync9(path, next, { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function writeInstructionBlock(path, write, dryRun) {
-  const existed = existsSync7(path);
+  const existed = existsSync9(path);
   const next = computeBlockFile(readOr(path, ""), write);
   if (dryRun) return { kind: "instruction", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync7(path, next);
+  writeFileSync9(path, next);
   return { kind: "instruction", path, status: existed ? "merged" : "created" };
 }
 function computeBlockFile(current, write) {
@@ -3168,7 +3568,7 @@ function applyBlock(path, write, mode, dryRun) {
     const next = computeBlockFile(current, write);
     if (!dryRun) {
       ensureDir2(proposedPath);
-      writeFileSync7(proposedPath, next);
+      writeFileSync9(proposedPath, next);
     }
     return {
       kind: "instruction",
@@ -3208,7 +3608,10 @@ async function applyClient(cfg, setup, target, opts) {
     if (!section) {
       actions.push({ kind: "instruction", path: target.instruction.path, status: "skipped", note: `no instruction-file section on surface '${target.instruction.surfaceKey}'` });
     } else {
-      const resolved = await resolveInstruction(cfg, section, opts.personalWorkspaceId);
+      const resolved = await withSpinner(
+        `Resolving ${target.label} agent instructions`,
+        () => resolveInstruction(cfg, section, opts.personalWorkspaceId)
+      );
       if (!resolved) {
         actions.push({ kind: "instruction", path: target.instruction.path, status: "skipped", note: "no role template found in this tenant \u2014 install the SEM Starter bundle, then re-run `sechroom setup agent-files`" });
       } else {
@@ -3223,7 +3626,10 @@ async function applyClient(cfg, setup, target, opts) {
     }
     const conventionsSection = findSection(surface, SectionType.WorkspaceConventions);
     if (conventionsSection) {
-      const conventions = await resolveWorkspaceConventions(cfg, conventionsSection);
+      const conventions = await withSpinner(
+        `Composing ${target.label} workspace conventions`,
+        () => resolveWorkspaceConventions(cfg, conventionsSection)
+      );
       if (conventions) {
         const action = applyBlock(
           target.instruction.path,
@@ -3292,8 +3698,8 @@ auto-resumes where you left off and checkpoints working state before compacting.
 }
 
 // src/setup/skills-offer.ts
-import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "fs";
-import { join as join9 } from "path";
+import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
+import { join as join11 } from "path";
 
 // src/setup/lane-pin.ts
 var CODE_LANE_PREFIX_BY_CLIENT = {
@@ -3409,8 +3815,8 @@ Found ${summary} available to you for ${surface}.
   if (skills.length > 0) {
     const written = [];
     for (const s of skills) {
-      mkdirSync8(join9(sDir, s.name), { recursive: true });
-      writeFileSync8(join9(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
+      mkdirSync10(join11(sDir, s.name), { recursive: true });
+      writeFileSync10(join11(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
       written.push(s.name);
     }
     recordMaterialisedSkills(sDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -3418,11 +3824,11 @@ Found ${summary} available to you for ${surface}.
 `);
   }
   if (agents.length > 0) {
-    mkdirSync8(aDir, { recursive: true });
+    mkdirSync10(aDir, { recursive: true });
     const written = [];
     for (const a of agents) {
       const file = `${a.name}.md`;
-      writeFileSync8(join9(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
+      writeFileSync10(join11(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
       written.push(file);
     }
     recordMaterialisedSkills(aDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -3651,20 +4057,20 @@ Examples:
       fail("no workspace \u2014 pass --workspace <id> or bind one (`sechroom config set --local workspaceId <id>`).");
     const kind = String(opts.kind).toLowerCase() === "standard" ? "standard" : "reference";
     const body = typeof opts.body === "string" && opts.body.trim().length > 0 ? opts.body.trim() : "_TODO: write this section, then edit the memo and re-run the regen._";
-    const text = `# ${title}
+    const text2 = `# ${title}
 
 ${body}
 `;
     const tags = ["agent-setup-bundle", "scope:sechroom", `kind:${kind}`, "archetype:document"];
     if (opts.dryRun) {
-      emit({ dryRun: true, workspaceId, title, kind, tags, text }, json);
+      emit({ dryRun: true, workspaceId, title, kind, tags, text: text2 }, json);
       return;
     }
     const data = await runApi("Authoring convention memo", async () => {
       const client = await makeClient(cfg);
       return client.POST("/memories", {
         body: {
-          text,
+          text: text2,
           type: kind,
           content: "{}",
           confidence: 1,
@@ -3805,13 +4211,13 @@ Wired to namespace '${slug}'. Restart your AI client (or reload MCP) to pick it
 }
 
 // src/commands/onboard.ts
-import { existsSync as existsSync9 } from "fs";
-import { basename as basename2, join as join11 } from "path";
+import { existsSync as existsSync11 } from "fs";
+import { basename as basename2, join as join13 } from "path";
 
 // src/commands/fanout.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
-import { isAbsolute, join as join10, resolve } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync9, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
+import { isAbsolute, join as join12, resolve } from "path";
 var ICON = {
   refresh: "\u21BB",
   bind: "+",
@@ -3831,21 +4237,21 @@ function discoverChildren(root) {
   const out = [];
   for (const name of names.sort()) {
     if (name.startsWith(".") || name === "node_modules") continue;
-    const dir = join10(root, name);
+    const dir = join12(root, name);
     try {
       if (!statSync3(dir).isDirectory()) continue;
     } catch {
       continue;
     }
-    if (existsSync8(join10(dir, ".git")) || committedBindingPath(dir)) out.push(name);
+    if (existsSync10(join12(dir, ".git")) || committedBindingPath(dir)) out.push(name);
   }
   return out;
 }
 function readManifest(path) {
-  if (!existsSync8(path)) return null;
+  if (!existsSync10(path)) return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync6(path, "utf8"));
+    parsed = JSON.parse(readFileSync9(path, "utf8"));
   } catch (err2) {
     throw new Error(`couldn't parse ${path}: ${err2 instanceof Error ? err2.message : String(err2)}`);
   }
@@ -4029,28 +4435,17 @@ async function pickWorkspace(client, opts = {}) {
   if (candidates.length === 0) candidates = all;
   const dirToks = new Set(nameTokens(dirName));
   const isMatch = (w) => nameTokens(w.name).some((t) => dirToks.has(t));
-  const suggestions = candidates.filter(isMatch);
-  let pool = candidates;
-  if (candidates.length > 12 && suggestions.length === 0) {
-    const q = (await promptText(`Filter ${candidates.length} workspaces (substring, Enter to list all)?`, "")).trim().toLowerCase();
-    if (q) {
-      const hits = candidates.filter((w) => `${w.name} ${workspacePath(w, byId)}`.toLowerCase().includes(q));
-      if (hits.length > 0) pool = hits;
-      else process.stderr.write(`no match for "${q}" \u2014 listing all
-`);
-    }
-  }
   const SKIP = "__skip__";
   const byPath = (a, b) => workspacePath(a, byId).localeCompare(workspacePath(b, byId));
-  const matched = pool.filter(isMatch).sort(byPath);
-  const rest = pool.filter((w) => !isMatch(w)).sort(byPath);
+  const matched = candidates.filter(isMatch).sort(byPath);
+  const rest = candidates.filter((w) => !isMatch(w)).sort(byPath);
   const choices = [
     ...matched.map((w) => ({ label: workspacePath(w, byId), value: w.id, hint: style.dim(`matches "${dirName}"`) })),
     ...rest.map((w) => ({ label: workspacePath(w, byId), value: w.id, hint: w.id })),
     { label: style.dim("skip \u2014 don't bind a workspace"), value: SKIP, hint: void 0 }
   ];
   const defaultValue = matched.length === 1 ? matched[0].id : SKIP;
-  const chosen = await promptSelect(promptLabel, choices, defaultValue);
+  const chosen = candidates.length > 12 ? await promptAutocomplete(promptLabel, choices, defaultValue) : await promptSelect(promptLabel, choices, defaultValue);
   if (chosen === SKIP) return void 0;
   const picked = byId.get(chosen);
   const collisions = all.filter((w) => w.id !== picked.id && namesCollide(w.name, picked.name));
@@ -4222,10 +4617,10 @@ async function chooseScope(scopeFlag, yes) {
 }
 async function planRecurseChild(entry, root, client, opts) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync9(dir)) {
+  if (!existsSync11(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
-  if (existsSync9(join11(dir, ".sechroom.json"))) {
+  if (existsSync11(join13(dir, ".sechroom.json"))) {
     return {
       label: entry.path,
       dir,
@@ -4298,7 +4693,7 @@ This fan-out will pin the same lane in every repo:
 async function runRecurse(cfg, g, opts) {
   const { yes, dryRun, json } = opts;
   const root = process.cwd();
-  const manifestPath = join11(root, ".sechroom", "repos.json");
+  const manifestPath = join13(root, ".sechroom", "repos.json");
   const fromManifest = readManifest(manifestPath);
   const entries = fromManifest ?? discoverChildren(root).map((path) => ({ path }));
   const sourceLabel = fromManifest ? `manifest ${manifestPath}` : `auto-discovered under ${root}`;
@@ -4810,23 +5205,23 @@ Examples:
 
 // src/commands/reset.ts
 import { homedir as homedir4 } from "os";
-import { join as join12 } from "path";
-import { existsSync as existsSync10, readFileSync as readFileSync7, rmSync as rmSync3 } from "fs";
+import { join as join14 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync10, rmSync as rmSync3 } from "fs";
 var SKILLS_LOCK2 = ".sechroom-skills.json";
-var localSkillsDir = () => join12(process.cwd(), ".claude", "skills");
-var globalSkillsDir = () => join12(homedir4(), ".claude", "skills");
-var localAgentsDir = () => join12(process.cwd(), ".claude", "agents");
-var globalAgentsDir = () => join12(homedir4(), ".claude", "agents");
+var localSkillsDir = () => join14(process.cwd(), ".claude", "skills");
+var globalSkillsDir = () => join14(homedir4(), ".claude", "skills");
+var localAgentsDir = () => join14(process.cwd(), ".claude", "agents");
+var globalAgentsDir = () => join14(homedir4(), ".claude", "agents");
 function removeMaterialisedSkills(dir) {
   const removed = [];
-  const lockPath = join12(dir, SKILLS_LOCK2);
-  if (!existsSync10(lockPath)) return removed;
+  const lockPath = join14(dir, SKILLS_LOCK2);
+  if (!existsSync12(lockPath)) return removed;
   try {
-    const lock = JSON.parse(readFileSync7(lockPath, "utf8"));
+    const lock = JSON.parse(readFileSync10(lockPath, "utf8"));
     for (const entry of Object.values(lock)) {
       for (const name of entry.skills ?? []) {
-        const p = join12(dir, name);
-        if (existsSync10(p)) {
+        const p = join14(dir, name);
+        if (existsSync12(p)) {
           rmSync3(p, { recursive: true, force: true });
           removed.push(p);
         }
@@ -4871,18 +5266,18 @@ function registerReset(program2) {
       }
     }
     const removed = [];
-    const stateDir = join12(process.cwd(), ".sechroom");
-    if (existsSync10(stateDir)) {
+    const stateDir = join14(process.cwd(), ".sechroom");
+    if (existsSync12(stateDir)) {
       rmSync3(stateDir, { recursive: true, force: true });
       removed.push(stateDir);
     }
-    const legacyCfg = join12(process.cwd(), ".sechroom.json");
-    if (existsSync10(legacyCfg)) {
+    const legacyCfg = join14(process.cwd(), ".sechroom.json");
+    if (existsSync12(legacyCfg)) {
       rmSync3(legacyCfg, { force: true });
       removed.push(legacyCfg);
     }
-    const legacySem = join12(process.cwd(), ".sem");
-    if (existsSync10(legacySem)) {
+    const legacySem = join14(process.cwd(), ".sem");
+    if (existsSync12(legacySem)) {
       rmSync3(legacySem, { force: true });
       removed.push(legacySem);
     }
@@ -4908,8 +5303,8 @@ function registerReset(program2) {
 }
 
 // src/commands/skills.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync9, statSync as statSync4, writeFileSync as writeFileSync9 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync11, statSync as statSync4, writeFileSync as writeFileSync11 } from "fs";
+import { join as join15 } from "path";
 function filenameFromDisposition(header) {
   if (!header) return void 0;
   const m = /filename\*?=(?:UTF-8'')?"?([^";]+)"?/i.exec(header);
@@ -4917,11 +5312,11 @@ function filenameFromDisposition(header) {
 }
 function resolveOutputPath(output, serverFilename) {
   const filename = serverFilename || "skills.zip";
-  if (!output) return join13(process.cwd(), filename);
-  const looksLikeDir = output.endsWith("/") || existsSync11(output) && statSync4(output).isDirectory();
+  if (!output) return join15(process.cwd(), filename);
+  const looksLikeDir = output.endsWith("/") || existsSync13(output) && statSync4(output).isDirectory();
   if (looksLikeDir) {
-    mkdirSync9(output, { recursive: true });
-    return join13(output, filename);
+    mkdirSync11(output, { recursive: true });
+    return join15(output, filename);
   }
   return output;
 }
@@ -4952,7 +5347,7 @@ async function downloadZip(label, call, output) {
   const buf = Buffer.from(res.data);
   const filename = filenameFromDisposition(res.response.headers.get("content-disposition")) ?? "skills.zip";
   const path = resolveOutputPath(output, filename);
-  writeFileSync9(path, buf);
+  writeFileSync11(path, buf);
   return { path, bytes: buf.length, filename };
 }
 function registerSkills(program2) {
@@ -5120,12 +5515,12 @@ Examples:
 }
 
 // src/commands/sweep.ts
-import { existsSync as existsSync12 } from "fs";
-import { dirname as dirname7, join as join14, resolve as resolve2 } from "path";
-var DEFAULT_MANIFEST = join14(".sechroom", "repos.json");
+import { existsSync as existsSync14 } from "fs";
+import { dirname as dirname9, join as join16, resolve as resolve2 } from "path";
+var DEFAULT_MANIFEST = join16(".sechroom", "repos.json");
 function planEntry(entry, root) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync12(dir)) {
+  if (!existsSync14(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
   if (committedBindingPath(dir)) {
@@ -5201,7 +5596,7 @@ Examples:
 `);
       return;
     }
-    const root = dirname7(dirname7(manifestPath));
+    const root = dirname9(dirname9(manifestPath));
     const plans = repos.map((entry) => planEntry(entry, root));
     if (!json) {
       process.stderr.write(
@@ -5219,6 +5614,14 @@ Examples:
 }
 
 // src/commands/telemetry.ts
+import {
+  existsSync as existsSync15,
+  mkdirSync as mkdirSync12,
+  readFileSync as readFileSync11,
+  rmSync as rmSync4,
+  writeFileSync as writeFileSync12
+} from "fs";
+import { dirname as dirname10, join as join17 } from "path";
 function registerTelemetry(program2) {
   const telemetry = program2.command("telemetry").description(
     "Emit WLP run telemetry (an executor leg's progress events) into a decomposition run"
@@ -5253,10 +5656,9 @@ function registerTelemetry(program2) {
   ).action(async (opts, cmd) => {
     const json = Boolean(cmd.optsWithGlobals().json);
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const kind = normalizeKind(opts.kind);
     const event = {
       taskId: opts.task,
-      kind,
+      kind: normalizeKind(opts.kind),
       tokensIn: opts.tokensIn ?? null,
       tokensOut: opts.tokensOut ?? null,
       contextUsed: opts.contextUsed ?? null,
@@ -5265,36 +5667,227 @@ function registerTelemetry(program2) {
       approvalState: opts.approval ?? null,
       verdict: opts.verdict ?? null
     };
-    const token = await requireToken(cfg);
-    const resp = await fetch(
-      `${cfg.baseUrl}/decompositions/${encodeURIComponent(opts.decomposition)}/run/telemetry`,
-      {
-        method: "POST",
-        headers: {
-          authorization: `Bearer ${token}`,
-          tenant: cfg.tenant,
-          "content-type": "application/json",
-          "x-sechroom-surface": "cli"
-        },
-        body: JSON.stringify({ events: [event] })
-      }
-    );
-    if (!resp.ok)
-      fail(
-        `Telemetry emit failed (HTTP ${resp.status}): ${await resp.text()}`
-      );
-    const body = await resp.json();
+    let body;
+    try {
+      body = await postTelemetry(cfg, opts.decomposition, [event]);
+    } catch (e) {
+      return fail(`Telemetry emit failed: ${e.message}`);
+    }
     if (json) {
       emit(body, true);
     } else {
       process.stderr.write(
         style.green("telemetry emitted") + style.dim(
-          ` \u2014 ${kind} for task ${opts.task}; run now carries ${body.eventCount} event${body.eventCount === 1 ? "" : "s"}
+          ` \u2014 ${event.kind} for task ${opts.task}; run now carries ${body.eventCount} event${body.eventCount === 1 ? "" : "s"}
+`
+        )
+      );
+    }
+  });
+  telemetry.command("bind").description(
+    "Bind this checkout to a decomposition+task so the Stop hook auto-emits per-turn telemetry"
+  ).requiredOption(
+    "--decomposition <id>",
+    "Decomposition id this session executes"
+  ).requiredOption("--task <id>", "Task id this session executes").action((opts, cmd) => {
+    const json = Boolean(cmd.optsWithGlobals().json);
+    const dir = join17(process.cwd(), ".sechroom");
+    mkdirSync12(dir, { recursive: true });
+    const path = join17(dir, BINDING_FILE);
+    const binding = {
+      decompositionId: opts.decomposition,
+      taskId: opts.task
+    };
+    writeFileSync12(path, JSON.stringify(binding, null, 2) + "\n");
+    ensureStateDirIgnored(process.cwd());
+    if (json) {
+      emit({ bound: true, ...binding, path }, true);
+    } else {
+      process.stdout.write(
+        style.green("telemetry bound") + style.dim(
+          ` \u2014 decomposition ${binding.decompositionId}, task ${binding.taskId} (${path})
 `
         )
       );
     }
   });
+  telemetry.command("unbind").description("Clear this checkout's telemetry binding").action((_opts, cmd) => {
+    const json = Boolean(cmd.optsWithGlobals().json);
+    const path = join17(process.cwd(), ".sechroom", BINDING_FILE);
+    const existed = existsSync15(path);
+    if (existed) rmSync4(path);
+    if (json) emit({ unbound: existed, path }, true);
+    else
+      process.stdout.write(
+        existed ? "telemetry binding cleared\n" : "no telemetry binding to clear\n"
+      );
+  });
+  telemetry.command("hook").description(
+    "Per-turn telemetry self-report for a Claude Code Stop hook (reads stdin; no-op unless bound). Fail-soft."
+  ).action(async (_opts, cmd) => {
+    try {
+      const raw = await readStdin2();
+      const input = parseHookInput2(raw);
+      const cwd = input.cwd ?? process.cwd();
+      const binding = findBinding(cwd);
+      if (!binding) return process.exit(0);
+      const usage = input.transcript_path ? parseTranscript(input.transcript_path) : null;
+      if (!usage) return process.exit(0);
+      const cfg = resolveConfig(cmd.optsWithGlobals());
+      await postTelemetry(cfg, binding.decompositionId, [
+        {
+          taskId: binding.taskId,
+          kind: "Parsed",
+          tokensIn: usage.tokensIn,
+          tokensOut: usage.tokensOut,
+          contextUsed: usage.contextUsed,
+          contextWindow: usage.contextWindow,
+          text: null,
+          approvalState: null,
+          verdict: null
+        }
+      ]);
+      return process.exit(0);
+    } catch {
+      return process.exit(0);
+    }
+  });
+  telemetry.command("install").description(
+    "Wire the per-turn telemetry Stop hook into Claude Code settings (also folded into `sechroom hook install`)"
+  ).option(
+    "--scope <scope>",
+    "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global"
+  ).option("--local", "alias for --scope project").option("--dry-run", "Print what would change; write nothing").action((opts, cmd) => {
+    const g = cmd.optsWithGlobals();
+    const dryRun = Boolean(opts.dryRun);
+    const cwd = process.cwd();
+    let scope;
+    try {
+      scope = opts.local ? "project" : resolveScope(opts.scope);
+    } catch (err2) {
+      process.stderr.write(`${err2.message}
+`);
+      return process.exit(2);
+    }
+    const targets = resolveClaudeTargets({
+      override: g.claudeConfigDir,
+      scope,
+      cwd
+    });
+    const commands = { Stop: "sechroom telemetry hook" };
+    try {
+      const multi = targets.length > 1;
+      const results = targets.map((t) => {
+        const r = installClaudeCommands(t.dir, commands, dryRun);
+        process.stdout.write(
+          `${HOOK_SURFACE_LABEL.claude}${multi ? ` (${t.label})` : ""}:
+`
+        );
+        process.stdout.write(describe(r, dryRun) + "\n");
+        return r;
+      });
+      if (dryRun) {
+        process.stdout.write("\n(dry run \u2014 no files were written.)\n");
+      } else if (results.every((r) => r.status === "current")) {
+        process.stdout.write("\nAlready up to date \u2014 nothing to change.\n");
+      } else {
+        process.stdout.write(
+          "\nRestart your agent for the hook to take effect, then bind a task with `sechroom telemetry bind`.\n"
+        );
+      }
+    } catch (err2) {
+      process.stderr.write(
+        `telemetry install failed: ${err2.message}
+`
+      );
+      return process.exit(1);
+    }
+    warnIfSechroomNotOnPath();
+    return process.exit(0);
+  });
+}
+var BINDING_FILE = "telemetry.json";
+async function postTelemetry(cfg, decompositionId, events) {
+  const token = await requireToken(cfg);
+  const resp = await fetch(
+    `${cfg.baseUrl}/decompositions/${encodeURIComponent(decompositionId)}/run/telemetry`,
+    {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${token}`,
+        tenant: cfg.tenant,
+        "content-type": "application/json",
+        "x-sechroom-surface": "cli"
+      },
+      body: JSON.stringify({ events })
+    }
+  );
+  if (!resp.ok) throw new Error(`HTTP ${resp.status}: ${await resp.text()}`);
+  return await resp.json();
+}
+function findBinding(start) {
+  let dir = start;
+  for (; ; ) {
+    const path = join17(dir, ".sechroom", BINDING_FILE);
+    if (existsSync15(path)) {
+      try {
+        const b = JSON.parse(
+          readFileSync11(path, "utf8")
+        );
+        if (b.decompositionId && b.taskId)
+          return { decompositionId: b.decompositionId, taskId: b.taskId };
+      } catch {
+      }
+      return null;
+    }
+    const parent = dirname10(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function parseTranscript(path) {
+  if (!existsSync15(path)) return null;
+  let tokensIn = 0;
+  let tokensOut = 0;
+  let contextUsed = 0;
+  let model = "";
+  for (const line of readFileSync11(path, "utf8").split("\n")) {
+    if (!line.trim()) continue;
+    let obj;
+    try {
+      obj = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    const usage = obj.type === "assistant" ? obj.message?.usage : void 0;
+    if (!usage) continue;
+    const input = (usage.input_tokens ?? 0) + (usage.cache_creation_input_tokens ?? 0) + (usage.cache_read_input_tokens ?? 0);
+    tokensIn += input;
+    tokensOut += usage.output_tokens ?? 0;
+    contextUsed = input;
+    if (obj.message?.model) model = obj.message.model;
+  }
+  if (tokensIn === 0 && tokensOut === 0) return null;
+  return { tokensIn, tokensOut, contextUsed, contextWindow: windowFor(model, contextUsed) };
+}
+function windowFor(model, contextUsed = 0) {
+  const m = model.toLowerCase();
+  if (m.includes("[1m]") || m.includes("-1m")) return 1e6;
+  return contextUsed > 2e5 ? 1e6 : 2e5;
+}
+async function readStdin2() {
+  if (process.stdin.isTTY) return "";
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
+function parseHookInput2(raw) {
+  if (!raw.trim()) return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
 }
 var KINDS = {
   raw: "Raw",
@@ -5516,7 +6109,7 @@ Examples:
 function resolveVersion() {
   try {
     const pkg = JSON.parse(
-      readFileSync8(new URL("../package.json", import.meta.url), "utf8")
+      readFileSync12(new URL("../package.json", import.meta.url), "utf8")
     );
     return pkg.version ?? "0.0.0";
   } catch {
@@ -5674,6 +6267,8 @@ registerLookup(program);
 registerRelationships(program);
 registerWorkspace(program);
 registerProject(program);
+registerDecomposition(program);
+registerClose(program);
 registerFiling(program);
 registerContinuity(program);
 registerCheckpoint(program);