@sechroom/cli 2026.6.30-rc.3b1b16ff → 2026.6.30

package/dist/index.js

@@ -21,9 +21,9 @@ var DEFAULT_ACCOUNT = "default";
 var STATE_DIR_NAME = ".sechroom";
 var BASELINE_CONFIG_NAME = ".sechroom.json";
 var OVERRIDE_CONFIG_NAME = join(STATE_DIR_NAME, "config.json");
-var BINDING_FIELDS = ["schemaVersion", "baseUrl", "tenant", "workspaceId", "defaultProjectId"];
+var BINDING_FIELDS = ["schemaVersion", "baseUrl", "tenant", "workspaceId", "defaultProjectId", "workspaces"];
 var DEFAULT_BASE_URL = "https://app.sechroom.ai/api";
-var LOCAL_CONFIG_SCHEMA_VERSION = 2;
+var LOCAL_CONFIG_SCHEMA_VERSION = 3;
 function ensureDir() {
   if (!existsSync(CONFIG_DIR)) mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
 }
@@ -161,12 +161,14 @@ function readLocalConfig() {
     tenant: merged.tenant,
     workspaceId: merged.workspaceId,
     defaultProjectId: merged.defaultProjectId,
+    workspaces: merged.workspaces,
     account: merged.account,
-    path: existsSync(baselinePath) ? baselinePath : overridePath
+    path: existsSync(baselinePath) ? baselinePath : overridePath,
+    home
   };
 }
-function writeLocalConfig(patch) {
-  const home = findConfigHome() ?? process.cwd();
+function writeLocalConfig(patch, opts) {
+  const home = (opts?.here ? process.cwd() : findConfigHome()) ?? process.cwd();
   const baselinePath = join(home, BASELINE_CONFIG_NAME);
   const overridePath = join(home, OVERRIDE_CONFIG_NAME);
   const current = readJsonConfig(baselinePath) ?? {};
@@ -184,6 +186,30 @@ function committedBindingPath(dir) {
   const p = join(dir, BASELINE_CONFIG_NAME);
   return existsSync(p) ? p : void 0;
 }
+function selectWorkspaceBinding(local, explicitName) {
+  const bindings = local.workspaces ?? [];
+  if (explicitName) {
+    const hit = bindings.find((b) => b.name === explicitName);
+    if (!hit)
+      throw new Error(
+        `No workspace binding named "${explicitName}" in ${local.home ?? "this repo"}'s .sechroom.json` + (bindings.length > 0 ? ` (have: ${bindings.map((b) => b.name).join(", ")})` : "") + ". Add one with `sechroom workspace bind`."
+      );
+    return hit;
+  }
+  if (!local.home || bindings.length === 0) return void 0;
+  const rel = process.cwd().startsWith(local.home) ? process.cwd().slice(local.home.length).replace(/^[/\\]/, "") : "";
+  const norm = (p) => p.replace(/\/\*\*$/, "").replace(/[/\\]+$/, "");
+  let best;
+  for (const b of bindings) {
+    for (const raw of b.paths ?? []) {
+      const prefix = norm(raw);
+      if (prefix.length === 0) continue;
+      const matches = rel === prefix || rel.startsWith(prefix + "/");
+      if (matches && (!best || prefix.length > best.len)) best = { binding: b, len: prefix.length };
+    }
+  }
+  return best?.binding;
+}
 function resolveConfig(flags) {
   const local = readLocalConfig();
   const persisted = readPersisted();
@@ -194,8 +220,9 @@ function resolveConfig(flags) {
       "No tenant set. The Sechroom API rejects untenanted requests (HTTP 400). Pass --tenant <id>, set SECHROOM_TENANT, run `sechroom config set tenant <id>`, or `sechroom config set --local tenant <id>` for this directory."
     );
   }
-  const workspaceId = process.env.SECHROOM_WORKSPACE ?? local.workspaceId ?? persisted.workspaceId ?? void 0;
-  const defaultProjectId = local.defaultProjectId ?? persisted.defaultProjectId ?? void 0;
+  const binding = selectWorkspaceBinding(local, flags.binding ?? process.env.SECHROOM_BINDING);
+  const workspaceId = process.env.SECHROOM_WORKSPACE ?? binding?.workspaceId ?? local.workspaceId ?? persisted.workspaceId ?? void 0;
+  const defaultProjectId = (binding ? binding.defaultProjectId : void 0) ?? local.defaultProjectId ?? persisted.defaultProjectId ?? void 0;
   const account = resolveAccountAlias(flags.account);
   return { baseUrl: baseUrl.replace(/\/$/, ""), tenant, account, workspaceId, defaultProjectId, clientId: persisted.clientId };
 }
@@ -212,10 +239,17 @@ function describeConfig(flags) {
     return { value: void 0, source: "unset" };
   };
   const baseUrl = pick(flags.baseUrl, process.env.SECHROOM_BASE_URL, local.baseUrl, g.baseUrl, DEFAULT_BASE_URL);
+  let binding;
+  try {
+    binding = selectWorkspaceBinding(local, flags.binding ?? process.env.SECHROOM_BINDING);
+  } catch {
+    binding = void 0;
+  }
+  const workspaceId = process.env.SECHROOM_WORKSPACE ? { value: process.env.SECHROOM_WORKSPACE, source: "env" } : binding ? { value: binding.workspaceId, source: `binding "${binding.name}"${localTag !== "local" ? ` (${local.path})` : ""}` } : pick(void 0, void 0, local.workspaceId, g.workspaceId);
   return {
     baseUrl: { value: baseUrl.value, source: baseUrl.source },
     tenant: pick(flags.tenant, process.env.SECHROOM_TENANT, local.tenant, g.tenant),
-    workspaceId: pick(void 0, process.env.SECHROOM_WORKSPACE, local.workspaceId, g.workspaceId),
+    workspaceId,
     localPath: local.path
   };
 }
@@ -1168,6 +1202,26 @@ Examples:
 // src/commands/workspace.ts
 function registerWorkspace(program2) {
   const workspace = program2.command("workspace").description("Create, browse, and manage workspaces");
+  workspace.command("bind <workspaceId>").description("Bind a workspace to this repo (.sechroom.json). With --name it becomes a NAMED v3 binding (multi-workspace); --paths scopes it to subtrees.").option("--name <name>", "binding name (enables multi-workspace; selectable via --binding / path match)").option("--paths <csv>", "comma-separated directory prefixes (relative to the repo root) this binding covers, e.g. frontend,docs").option("--default-project <id>", "informational default project for this binding").option("--here", "write the binding file at THIS directory even when a parent already carries one").action((workspaceId, opts, cmd) => {
+    const json = cmd.optsWithGlobals().json;
+    if (!opts.name) {
+      const path2 = writeLocalConfig({ workspaceId, ...opts.defaultProject ? { defaultProjectId: opts.defaultProject } : {} }, { here: Boolean(opts.here) });
+      if (json) return emit({ workspaceId, path: path2 }, true);
+      console.log(style.green(`Workspace ${workspaceId} bound (${path2}).`));
+      return;
+    }
+    const local = readLocalConfig();
+    const bindings = (local.workspaces ?? []).filter((b) => b.name !== opts.name);
+    bindings.push({
+      name: opts.name,
+      workspaceId,
+      ...opts.defaultProject ? { defaultProjectId: opts.defaultProject } : {},
+      ...opts.paths ? { paths: String(opts.paths).split(",").map((p) => p.trim()).filter(Boolean) } : {}
+    });
+    const path = writeLocalConfig({ workspaces: bindings }, { here: Boolean(opts.here) });
+    if (json) return emit({ binding: opts.name, workspaceId, paths: opts.paths ?? null, path }, true);
+    console.log(style.green(`Binding "${opts.name}" \u2192 ${workspaceId} saved (${path}).`));
+  });
   workspace.addHelpText(
     "after",
     `
@@ -1726,7 +1780,7 @@ import { delimiter, dirname as dirname4, join as join4 } from "path";
 
 // src/sem.ts
 import { basename as basename2, dirname as dirname2, join as join2 } from "path";
-import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync2, statSync, writeFileSync as writeFileSync2 } from "fs";
 var SEM_FILE = join2(".sechroom", "lane.json");
 var LEGACY_SEM_FILE = ".sem";
 var STATE_DIR_NAME2 = ".sechroom";
@@ -1745,6 +1799,43 @@ function resolveSemPathForRead(start = process.cwd()) {
     dir = parent;
   }
 }
+function applyWorktreeLaneSuffix(lane, start = process.cwd()) {
+  try {
+    let dir = start;
+    let gitPath;
+    for (; ; ) {
+      const candidate = join2(dir, ".git");
+      if (existsSync2(candidate)) {
+        gitPath = candidate;
+        break;
+      }
+      const parent = dirname2(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+    if (!gitPath || statSync(gitPath).isDirectory()) return lane;
+    const gitFile = readFileSync2(gitPath, "utf8");
+    const common = gitFile.trim().match(/^gitdir:\s*(.+)\/worktrees\/[^/\s]+\s*$/);
+    if (!common) return lane;
+    const worktreesDir = join2(common[1], "worktrees");
+    const siblings = readdirSync(worktreesDir).filter((n) => {
+      try {
+        return statSync(join2(worktreesDir, n)).isDirectory();
+      } catch {
+        return false;
+      }
+    });
+    return laneWithWorktreeSuffix(lane, gitFile, siblings);
+  } catch {
+    return lane;
+  }
+}
+function laneWithWorktreeSuffix(lane, gitFile, siblings) {
+  const m = gitFile.trim().match(/\/worktrees\/([^/\s]+)\s*$/);
+  if (!m) return lane;
+  const idx = [...siblings].sort().indexOf(m[1]);
+  return idx < 0 ? lane : `${lane}-${idx + 2}`;
+}
 function parseSem(text) {
   const out = {};
   for (const raw of text.split("\n")) {
@@ -2036,8 +2127,9 @@ function resolveLane(flagLane, cwd) {
   const env = process.env.SECHROOM_LANE;
   if (env) return env;
   const start = cwd ?? process.cwd();
-  const sem = readSem(resolveSemPathForRead(start));
-  return sem?.values["code-lane"];
+  const base = readSem(resolveSemPathForRead(start))?.values["code-lane"];
+  if (!base) return void 0;
+  return applyWorktreeLaneSuffix(base, start);
 }
 var INTENT_FILE = join4(".sechroom", "continuity.json");
 function resolveIntentPath(start) {
@@ -2805,9 +2897,8 @@ auto-resumes where you left off and checkpoints working state before compacting.
 }
 
 // src/setup/skills-offer.ts
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join5 } from "path";
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "fs";
+import { join as join6 } from "path";
 
 // src/setup/lane-pin.ts
 var CODE_LANE_PREFIX_BY_CLIENT = {
@@ -2889,57 +2980,157 @@ I can pin this checkout's lane so operator skills + the continuity hook resolve
   writePin(code || void 0, design || void 0);
 }
 
-// src/setup/skills-offer.ts
-var ROLE_TAG = "sechroom:role:skill-template";
+// src/setup/skill-resolution.ts
+var SYSTEM_WORKSPACE_ID = "wsp_system";
+var SKILL_ROLE_TAG = "sechroom:role:skill-template";
+var SKILL_NAME_PREFIX = "skill:";
+var AGENT_ROLE_TAG = "sechroom:role:agent-template";
+var AGENT_NAME_PREFIX = "agent:";
+function tagsOf(row) {
+  const m = row?.item ?? row;
+  return m?.tags ?? m?.Tags ?? [];
+}
 function tagValue(tags, prefix) {
   return tags.find((t) => t.startsWith(prefix))?.slice(prefix.length);
 }
-async function maybeOfferSkills(cfg, personalWorkspaceId, opts) {
-  if (!personalWorkspaceId || opts.dryRun) return;
-  const surface = opts.surface ?? "claude-code";
-  let rows = [];
+function bodyOf(row) {
+  const m = row?.item ?? row;
+  return m?.text ?? m?.Text ?? "";
+}
+function entriesFromRows(rows, surface, source, roleTag, namePrefix) {
+  const out = /* @__PURE__ */ new Map();
+  for (const row of rows ?? []) {
+    const tags = tagsOf(row);
+    if (!tags.includes(roleTag)) continue;
+    if (tagValue(tags, "target:") !== surface) continue;
+    const name = tagValue(tags, namePrefix);
+    if (!name) continue;
+    out.set(name, { name, body: bodyOf(row), source });
+  }
+  return out;
+}
+function resolveByRole(systemRows, personalRows, surface, roleTag, namePrefix) {
+  const merged = entriesFromRows(systemRows, surface, "system", roleTag, namePrefix);
+  for (const [name, item] of entriesFromRows(personalRows, surface, "personal", roleTag, namePrefix)) {
+    merged.set(name, item);
+  }
+  return [...merged.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+function resolveSkills(systemRows, personalRows, surface) {
+  return resolveByRole(systemRows, personalRows, surface, SKILL_ROLE_TAG, SKILL_NAME_PREFIX);
+}
+function resolveAgents(systemRows, personalRows, surface) {
+  return resolveByRole(systemRows, personalRows, surface, AGENT_ROLE_TAG, AGENT_NAME_PREFIX);
+}
+
+// src/setup/skills-lock.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join5 } from "path";
+var SKILLS_LOCK = ".sechroom-skills.json";
+var DEFAULT_SKILLS_SLUG = "operator-skills";
+function skillsDir(global) {
+  return global ? join5(homedir5(), ".claude", "skills") : join5(process.cwd(), ".claude", "skills");
+}
+function agentsDir(global) {
+  return global ? join5(homedir5(), ".claude", "agents") : join5(process.cwd(), ".claude", "agents");
+}
+function readSkillsLock(dir) {
+  const lockPath = join5(dir, SKILLS_LOCK);
+  if (!existsSync6(lockPath)) return {};
+  try {
+    return JSON.parse(readFileSync5(lockPath, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function writeSkillsLock(dir, lock) {
+  mkdirSync5(dir, { recursive: true });
+  writeFileSync5(join5(dir, SKILLS_LOCK), JSON.stringify(lock, null, 2) + "\n");
+}
+function recordMaterialisedSkills(dir, slug, skills, meta = {}) {
+  const lock = readSkillsLock(dir);
+  lock[slug] = { surface: meta.surface, skills: [...skills].sort() };
+  writeSkillsLock(dir, lock);
+}
+
+// src/setup/skills-offer.ts
+async function fetchFeedRows(cfg, workspaceId) {
   try {
     const client = await makeClient(cfg);
     const feed = await client.GET("/workspaces/{workspaceId}/memories/feed", {
       params: {
-        path: { workspaceId: personalWorkspaceId },
+        path: { workspaceId },
+        // cascadeWorkspaces: skills land in an "Operator Skills" SUB-workspace;
+        // includeText: the feed omits bodies by default, we need them for SKILL.md.
         query: { limit: 200, cascadeWorkspaces: true, includeText: true }
       }
     }).then((r) => r.data).catch(() => void 0);
-    rows = feed?.results ?? feed?.Results ?? [];
+    return feed?.results ?? feed?.Results ?? [];
   } catch {
-    return;
+    return [];
   }
-  const skills = rows.map((r) => r.item ?? r).filter((m) => {
-    const tags = m.tags ?? m.Tags ?? [];
-    return tags.includes(ROLE_TAG) && tagValue(tags, "target:") === surface;
-  });
-  if (skills.length === 0) return;
-  const byName = /* @__PURE__ */ new Map();
-  for (const m of skills) {
-    const name = tagValue(m.tags ?? m.Tags ?? [], "skill:");
-    if (name) byName.set(name, m);
+}
+async function maybeOfferSkills(cfg, personalWorkspaceId, opts) {
+  const surface = opts.surface ?? "claude-code";
+  const [systemRows, personalRows] = await Promise.all([
+    fetchFeedRows(cfg, SYSTEM_WORKSPACE_ID),
+    personalWorkspaceId ? fetchFeedRows(cfg, personalWorkspaceId) : Promise.resolve([])
+  ]);
+  const skills = resolveSkills(systemRows, personalRows, surface);
+  const agents = resolveAgents(systemRows, personalRows, surface);
+  if (skills.length === 0 && agents.length === 0) return;
+  const sDir = skillsDir(true);
+  const aDir = agentsDir(true);
+  if (opts.dryRun) {
+    const lines = (label, items) => items.length === 0 ? "" : `
+Would materialise ${style.bold(String(items.length))} ${label} for ${surface}:
+` + items.map((s) => `  ${s.name} ${style.dim(`[${s.source}]`)}`).join("\n") + "\n";
+    process.stderr.write(lines("operator skill(s)", skills) + lines("agent(s)", agents));
+    return;
   }
-  const names = [...byName.keys()].sort();
-  if (names.length === 0) return;
-  process.stderr.write(
-    `
-Found ${style.bold(String(names.length))} operator skill(s) installed in your workspace: ${names.join(", ")}.
-`
-  );
-  const dir = join5(homedir5(), ".claude", "skills");
-  const materialise = opts.yes ? true : canPrompt() ? await promptYesNo(`Write them to ${dir}/ so ${surface} can use them?`) : false;
+  const summary = [
+    skills.length > 0 ? `${style.bold(String(skills.length))} skill(s)` : "",
+    agents.length > 0 ? `${style.bold(String(agents.length))} agent(s)` : ""
+  ].filter(Boolean).join(" + ");
+  process.stderr.write(`
+Found ${summary} available to you for ${surface}.
+`);
+  if (skills.length > 0) process.stderr.write(`  skills: ${skills.map((s) => s.name).join(", ")}
+`);
+  if (agents.length > 0) process.stderr.write(`  agents: ${agents.map((a) => a.name).join(", ")}
+`);
+  const dest = [skills.length > 0 ? `${sDir}/` : "", agents.length > 0 ? `${aDir}/` : ""].filter(Boolean).join(" + ");
+  const materialise = opts.yes ? true : canPrompt() ? await promptYesNo(`Write them to ${dest} so ${surface} can use them?`) : false;
   if (!materialise) return;
-  const written = [];
-  for (const [name, m] of byName) {
-    const body = m.text ?? m.Text ?? "";
-    mkdirSync5(join5(dir, name), { recursive: true });
-    writeFileSync5(join5(dir, name, "SKILL.md"), body.endsWith("\n") ? body : body + "\n");
-    written.push(name);
+  if (skills.length > 0) {
+    const written = [];
+    for (const s of skills) {
+      mkdirSync6(join6(sDir, s.name), { recursive: true });
+      writeFileSync6(join6(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
+      written.push(s.name);
+    }
+    recordMaterialisedSkills(sDir, DEFAULT_SKILLS_SLUG, written, { surface });
+    process.stderr.write(`${style.green("\u2713")} wrote ${written.length} skill(s) to ${sDir}
+`);
   }
-  process.stderr.write(`${style.green("\u2713")} wrote ${written.length} skill(s) to ${dir}
+  if (agents.length > 0) {
+    mkdirSync6(aDir, { recursive: true });
+    const written = [];
+    for (const a of agents) {
+      const file = `${a.name}.md`;
+      writeFileSync6(join6(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
+      written.push(file);
+    }
+    recordMaterialisedSkills(aDir, DEFAULT_SKILLS_SLUG, written, { surface });
+    process.stderr.write(`${style.green("\u2713")} wrote ${written.length} agent(s) to ${aDir}
 `);
-  await ensureLanePin(cfg, { yes: opts.yes, dryRun: opts.dryRun, clients: [surface] });
+  }
+  await ensureLanePin(cfg, {
+    yes: opts.yes,
+    dryRun: opts.dryRun,
+    clients: [surface]
+  });
 }
 
 // src/commands/setup.ts
@@ -3090,13 +3281,13 @@ async function runClients(clients, cmd, opts) {
 }
 
 // src/commands/onboard.ts
-import { existsSync as existsSync7 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync8 } from "fs";
+import { basename as basename3, join as join8 } from "path";
 
 // src/commands/fanout.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync5, readdirSync, statSync } from "fs";
-import { isAbsolute, join as join6, resolve } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
+import { isAbsolute, join as join7, resolve } from "path";
 var ICON = {
   refresh: "\u21BB",
   bind: "+",
@@ -3109,28 +3300,28 @@ function resolveChildDir(path, root) {
 function discoverChildren(root) {
   let names;
   try {
-    names = readdirSync(root);
+    names = readdirSync2(root);
   } catch {
     return [];
   }
   const out = [];
   for (const name of names.sort()) {
     if (name.startsWith(".") || name === "node_modules") continue;
-    const dir = join6(root, name);
+    const dir = join7(root, name);
     try {
-      if (!statSync(dir).isDirectory()) continue;
+      if (!statSync2(dir).isDirectory()) continue;
     } catch {
       continue;
     }
-    if (existsSync6(join6(dir, ".git")) || committedBindingPath(dir)) out.push(name);
+    if (existsSync7(join7(dir, ".git")) || committedBindingPath(dir)) out.push(name);
   }
   return out;
 }
 function readManifest(path) {
-  if (!existsSync6(path)) return null;
+  if (!existsSync7(path)) return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync5(path, "utf8"));
+    parsed = JSON.parse(readFileSync6(path, "utf8"));
   } catch (err2) {
     throw new Error(`couldn't parse ${path}: ${err2 instanceof Error ? err2.message : String(err2)}`);
   }
@@ -3268,7 +3459,39 @@ async function warnIfProjectStray(client, projectId, workspaceId, json) {
     );
   }
 }
-async function pickWorkspace(client, promptLabel = "Bind this directory to a workspace:") {
+async function fetchPersonalWorkspaceId(client) {
+  try {
+    const { data } = await client.GET("/me/personal-workspace", {});
+    return data?.workspaceId ?? null;
+  } catch {
+    return null;
+  }
+}
+function nameTokens(s) {
+  return s.toLowerCase().split(/[^a-z0-9]+/).filter((t) => t.length >= 2);
+}
+function personalSubtreeIds(personalId, all) {
+  const childrenOf = /* @__PURE__ */ new Map();
+  for (const w of all) {
+    if (!w.parentId) continue;
+    (childrenOf.get(w.parentId) ?? childrenOf.set(w.parentId, []).get(w.parentId)).push(w);
+  }
+  const ids = /* @__PURE__ */ new Set([personalId]);
+  const queue = [personalId];
+  while (queue.length > 0) {
+    const id = queue.shift();
+    for (const child of childrenOf.get(id) ?? []) {
+      if (!ids.has(child.id)) {
+        ids.add(child.id);
+        queue.push(child.id);
+      }
+    }
+  }
+  return ids;
+}
+async function pickWorkspace(client, opts = {}) {
+  const promptLabel = opts.promptLabel ?? "Bind this directory to a workspace:";
+  const dirName = opts.dirName ?? basename3(process.cwd());
   const all = await withSpinner("Listing your workspaces", () => fetchWorkspaces(client));
   if (all.length === 0) {
     process.stderr.write(`no workspaces found \u2014 skipping workspace binding (you can set it later with \`sechroom config set --local workspaceId <id>\`)
@@ -3276,22 +3499,34 @@ async function pickWorkspace(client, promptLabel = "Bind this directory to a wor
     return void 0;
   }
   const byId = new Map(all.map((w) => [w.id, w]));
-  let pool = all;
-  if (all.length > 12) {
-    const q = (await promptText(`Filter ${all.length} workspaces (substring, Enter to list all)?`, "")).trim().toLowerCase();
+  const personalId = await fetchPersonalWorkspaceId(client);
+  const excluded = personalId ? personalSubtreeIds(personalId, all) : /* @__PURE__ */ new Set();
+  let candidates = all.filter((w) => !excluded.has(w.id));
+  if (candidates.length === 0) candidates = all;
+  const dirToks = new Set(nameTokens(dirName));
+  const isMatch = (w) => nameTokens(w.name).some((t) => dirToks.has(t));
+  const suggestions = candidates.filter(isMatch);
+  let pool = candidates;
+  if (candidates.length > 12 && suggestions.length === 0) {
+    const q = (await promptText(`Filter ${candidates.length} workspaces (substring, Enter to list all)?`, "")).trim().toLowerCase();
     if (q) {
-      const hits = all.filter((w) => `${w.name} ${workspacePath(w, byId)}`.toLowerCase().includes(q));
+      const hits = candidates.filter((w) => `${w.name} ${workspacePath(w, byId)}`.toLowerCase().includes(q));
       if (hits.length > 0) pool = hits;
       else process.stderr.write(`no match for "${q}" \u2014 listing all
 `);
     }
   }
   const SKIP = "__skip__";
+  const byPath = (a, b) => workspacePath(a, byId).localeCompare(workspacePath(b, byId));
+  const matched = pool.filter(isMatch).sort(byPath);
+  const rest = pool.filter((w) => !isMatch(w)).sort(byPath);
   const choices = [
-    ...pool.slice().sort((a, b) => workspacePath(a, byId).localeCompare(workspacePath(b, byId))).map((w) => ({ label: workspacePath(w, byId), value: w.id, hint: w.id })),
+    ...matched.map((w) => ({ label: workspacePath(w, byId), value: w.id, hint: style.dim(`matches "${dirName}"`) })),
+    ...rest.map((w) => ({ label: workspacePath(w, byId), value: w.id, hint: w.id })),
     { label: style.dim("skip \u2014 don't bind a workspace"), value: SKIP, hint: void 0 }
   ];
-  const chosen = await promptSelect(promptLabel, choices, SKIP);
+  const defaultValue = matched.length === 1 ? matched[0].id : SKIP;
+  const chosen = await promptSelect(promptLabel, choices, defaultValue);
   if (chosen === SKIP) return void 0;
   const picked = byId.get(chosen);
   const collisions = all.filter((w) => w.id !== picked.id && namesCollide(w.name, picked.name));
@@ -3318,7 +3553,7 @@ async function resolveWorkspaceBinding(client, existing, opts) {
   }
   if (existing) return existing;
   if (!canPrompt() || opts.yes) return void 0;
-  return pickWorkspace(client);
+  return pickWorkspace(client, { dirName: basename3(process.cwd()) });
 }
 async function ensureTenant(baseUrl, g, opts) {
   const persisted = readPersisted();
@@ -3382,7 +3617,7 @@ async function ensureTenant(baseUrl, g, opts) {
   if (opts.persist !== false) {
     const patch = { baseUrl, tenant, ...workspaceId ? { workspaceId } : {} };
     if (storeLocal) {
-      const path = writeLocalConfig(patch);
+      const path = writeLocalConfig(patch, { here: Boolean(opts.here) });
       if (!opts.json) process.stderr.write(`${ok("\u2713")} config saved to ${path} (directory-local)
 `);
     } else {
@@ -3451,10 +3686,10 @@ async function chooseClients(clientFlag, yes, cwd) {
 }
 async function planRecurseChild(entry, root, client, opts) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync7(dir)) {
+  if (!existsSync8(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
-  if (existsSync7(join7(dir, ".sechroom.json"))) {
+  if (existsSync8(join8(dir, ".sechroom.json"))) {
     return {
       label: entry.path,
       dir,
@@ -3481,7 +3716,10 @@ async function planRecurseChild(entry, root, client, opts) {
   process.stderr.write(`
 ${style.bold(entry.path)} ${style.dim("is not bound yet.")}
 `);
-  const ws = await pickWorkspace(client, `Bind ${style.cyan(entry.path)} to a workspace:`);
+  const ws = await pickWorkspace(client, {
+    promptLabel: `Bind ${style.cyan(entry.path)} to a workspace:`,
+    dirName: basename3(entry.path)
+  });
   if (!ws) {
     return { label: entry.path, dir, disposition: "skip-unbound", argv: [], reason: "unbound \u2014 no workspace chosen (skipped)" };
   }
@@ -3524,7 +3762,7 @@ This fan-out will pin the same lane in every repo:
 async function runRecurse(cfg, g, opts) {
   const { yes, dryRun, json } = opts;
   const root = process.cwd();
-  const manifestPath = join7(root, ".sechroom", "repos.json");
+  const manifestPath = join8(root, ".sechroom", "repos.json");
   const fromManifest = readManifest(manifestPath);
   const entries = fromManifest ?? discoverChildren(root).map((path) => ({ path }));
   const sourceLabel = fromManifest ? `manifest ${manifestPath}` : `auto-discovered under ${root}`;
@@ -3552,7 +3790,7 @@ async function runRecurse(cfg, g, opts) {
   summarizeFanout(results, { dryRun });
 }
 function registerOnboard(program2) {
-  program2.command("onboard").description("Guided first-run setup: configure, sign in, set timezone, detect clients, and wire this project").option("--recurse", "orchestration-root mode: onboard every child repo under this dir (auto-discovered, or from ./.sechroom/repos.json) \u2014 refreshes bound repos, prompts a workspace per new one", false).option("--lane <id>", "set the code-lane (substrate source identity) explicitly instead of inferring it; with --recurse it's used for every child repo").option("--design-lane <id>", "set the design-lane explicitly (substrate-authoring identity); with --recurse applies to every child").option("--client <list>", `comma-separated clients (${ALL_CLIENT_KEYS.join(", ")}) or 'all' (default: auto-detected)`).option("--local", "save the binding (tenant + base URL + workspace) to a committed .sechroom.json in this repo instead of the global config", false).option("--workspace <id>", "bind this directory to a workspace (skips the interactive workspace pick)").option("--cli-only", "configure the CLI only \u2014 don't wire any AI client (no MCP config, no agent files)", false).option("--no-mcp", "skip the MCP server config (.mcp.json etc.); still write the agent instruction files").option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--dry-run", "walk through without writing files or changing the profile", false).option("--refresh", "re-fetch descriptors and refresh any out-of-date managed blocks (local edits preserved to .proposed)", false).option("--force", "rewrite every managed block, overwriting local edits inside the markers (content outside untouched)", false).option("--check", "report whether anything would change and exit (0 = all current, 1 = stale/drift/absent); writes nothing", false).option("-y, --yes", "non-interactive: accept defaults (system timezone, detected clients, global config, full wire)", false).addHelpText(
+  program2.command("onboard").description("Guided first-run setup: configure, sign in, set timezone, detect clients, and wire this project").option("--recurse", "orchestration-root mode: onboard every child repo under this dir (auto-discovered, or from ./.sechroom/repos.json) \u2014 refreshes bound repos, prompts a workspace per new one", false).option("--lane <id>", "set the code-lane (substrate source identity) explicitly instead of inferring it; with --recurse it's used for every child repo").option("--design-lane <id>", "set the design-lane explicitly (substrate-authoring identity); with --recurse applies to every child").option("--client <list>", `comma-separated clients (${ALL_CLIENT_KEYS.join(", ")}) or 'all' (default: auto-detected)`).option("--local", "save the binding (tenant + base URL + workspace) to a committed .sechroom.json in this repo instead of the global config", false).option("--here", "with --local: write the binding at THIS directory even when a parent already carries one \u2014 binds a subtree (e.g. a monorepo's frontend/) to its own workspace", false).option("--workspace <id>", "bind this directory to a workspace (skips the interactive workspace pick)").option("--cli-only", "configure the CLI only \u2014 don't wire any AI client (no MCP config, no agent files)", false).option("--no-mcp", "skip the MCP server config (.mcp.json etc.); still write the agent instruction files").option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--dry-run", "walk through without writing files or changing the profile", false).option("--refresh", "re-fetch descriptors and refresh any out-of-date managed blocks (local edits preserved to .proposed)", false).option("--force", "rewrite every managed block, overwriting local edits inside the markers (content outside untouched)", false).option("--check", "report whether anything would change and exit (0 = all current, 1 = stale/drift/absent); writes nothing", false).option("-y, --yes", "non-interactive: accept defaults (system timezone, detected clients, global config, full wire)", false).addHelpText(
     "after",
     `
 Examples:
@@ -3708,14 +3946,21 @@ async function chooseWire(opts, yes) {
   return opts.mcp === false ? "agent-only" : "full";
 }
 var FALLBACK_AGENT_PROMPT = "Resume my sechroom continuity, summarise what I was last working on, then suggest the next step.";
+function printNextStepBlock(heading, lines) {
+  const rule = style.dim("\u2500".repeat(52));
+  process.stdout.write(
+    `
+${rule}
+${style.bold(heading)}
+
+` + lines.map((l) => `  ${l}`).join("\n") + `
+${rule}
+`
+  );
+}
 async function printStarterPrompt(mode, cfg) {
   if (mode === "cli") {
-    process.stdout.write(
-      `
-${style.bold("Next:")} pick up where you left off \u2014
-  ${style.cyan("sechroom continuity resume-me")}
-`
-    );
+    printNextStepBlock("Next \u2014 pick up where you left off:", [style.cyan("sechroom continuity resume-me")]);
     return;
   }
   let primary = FALLBACK_AGENT_PROMPT;
@@ -3727,21 +3972,16 @@ ${style.bold("Next:")} pick up where you left off \u2014
     } catch {
     }
   }
-  process.stdout.write(
-    `
-${style.bold("Next:")} paste this into your AI agent to get going \u2014
-  ${style.cyan(`"${primary}"`)}
-`
-  );
+  printNextStepBlock("Next \u2014 paste this into your AI agent to get going:", [style.cyan(`"${primary}"`)]);
 }
 
 // src/commands/sweep.ts
-import { existsSync as existsSync8 } from "fs";
-import { dirname as dirname6, join as join8, resolve as resolve2 } from "path";
-var DEFAULT_MANIFEST = join8(".sechroom", "repos.json");
+import { existsSync as existsSync9 } from "fs";
+import { dirname as dirname6, join as join9, resolve as resolve2 } from "path";
+var DEFAULT_MANIFEST = join9(".sechroom", "repos.json");
 function planEntry(entry, root) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync8(dir)) {
+  if (!existsSync9(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
   if (committedBindingPath(dir)) {
@@ -3835,106 +4075,78 @@ Examples:
 }
 
 // src/commands/skills.ts
-import { homedir as homedir6 } from "os";
-import { join as join9 } from "path";
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, rmSync as rmSync2, existsSync as existsSync9, readFileSync as readFileSync6 } from "fs";
-var DEFAULT_SLUG = "operator-skills";
-var ROLE_TAGS = ["sechroom:role:skill-template", "role:skill-template"];
-var LOCK = ".sechroom-skills.json";
-function skillsDir(global) {
-  return global ? join9(homedir6(), ".claude", "skills") : join9(process.cwd(), ".claude", "skills");
-}
-function tagValue2(tags, prefix) {
-  return (tags ?? []).find((t) => t.startsWith(prefix))?.slice(prefix.length);
-}
-function hasAny(tags, candidates) {
-  return (tags ?? []).some((t) => candidates.includes(t));
+import { join as join10 } from "path";
+import { existsSync as existsSync10, rmSync as rmSync2 } from "fs";
+
+// src/commands/lane.ts
+var LANE_KEYS = ["code-lane", "design-lane"];
+function showLane(json) {
+  const found = readSem();
+  if (!found) {
+    if (json) return emit({ path: null, values: {} }, true);
+    return console.log(
+      style.dim(`No ./.sechroom/lane.json pin in this checkout. Run 'sechroom lane set'.`)
+    );
+  }
+  const resolved = { ...found.values };
+  let suffixed = false;
+  for (const k of LANE_KEYS) {
+    const v = found.values[k];
+    if (!v) continue;
+    resolved[k] = applyWorktreeLaneSuffix(v);
+    if (resolved[k] !== v) suffixed = true;
+  }
+  if (json) return emit({ path: found.path, values: resolved, worktreeSuffixApplied: suffixed }, true);
+  console.log(style.dim(`from ${found.path}`));
+  Object.entries(resolved).forEach(([k, v]) => console.log("  " + style.bold(k) + " = " + v));
+  if (suffixed) console.log(style.dim("  (worktree -N suffix applied \u2014 non-primary git worktree)"));
+}
+function setLane(opts) {
+  if (!opts.codeLane && !opts.designLane) fail("Provide --code-lane and/or --design-lane.");
+  const target = localSemPath();
+  const values = readLocalSemValues();
+  if (opts.codeLane) values["code-lane"] = opts.codeLane;
+  if (opts.designLane) values["design-lane"] = opts.designLane;
+  writeSem(values, target);
+  if (opts.json) return emit({ path: target, values }, true);
+  console.log(style.green(`Wrote lane pin \u2192 ${target} ${style.dim("(git-ignored)")}`));
+  Object.entries(values).forEach(([k, v]) => console.log("  " + style.dim(k) + " = " + v));
+}
+function registerLane(program2) {
+  const lane = program2.command("lane").description("Show this checkout's continuity lane pin (worktree-aware -N suffix applied)").option("--json", "machine output").action((opts, cmd) => showLane(Boolean(opts.json) || Boolean(cmd.optsWithGlobals().json)));
+  lane.command("set").description("Write this checkout's lane pin to ./.sechroom/lane.json").option("--code-lane <id>", "code-surface lane id (e.g. claude-code-chris)").option("--design-lane <id>", "design / substrate-authoring lane id (e.g. claude-design-chris)").option("--json", "machine output").action(
+    (opts, cmd) => setLane({
+      codeLane: opts.codeLane,
+      designLane: opts.designLane,
+      json: Boolean(opts.json) || Boolean(cmd.optsWithGlobals().json)
+    })
+  );
+  lane.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom lane                                              show the resolved lane(s)
+  $ sechroom lane set --code-lane claude-code-chris --design-lane claude-design-chris
+
+In a non-primary git worktree the ratified concurrent-session -N suffix is auto-applied (SBC-1094).
+(Aliases: 'sechroom skills lane' / 'skills set-lane' \u2014 kept for back-compat.)`
+  );
 }
+
+// src/commands/skills.ts
 function registerSkills(program2) {
-  const skills = program2.command("skills").description("Install + manage operator skills from a bundle");
+  const skills = program2.command("skills").description("Manage operator skills (materialised by `onboard`)");
   skills.addHelpText(
     "after",
     `
 Examples:
-  $ sechroom skills install --code-lane claude-code-chris --design-lane claude-design-chris
-  $ sechroom skills install operator-skills --surface claude-code --local
   $ sechroom skills list
   $ sechroom skills set-lane --code-lane claude-code-chris --design-lane claude-design-chris
   $ sechroom skills lane
-  $ sechroom skills clean`
+  $ sechroom skills clean
+
+To install/refresh skills, run 'sechroom onboard' (it offers to materialise them).`
   );
-  skills.command("install [slug]").description(`Install a skills bundle (default ${DEFAULT_SLUG}) into your personal workspace + write SKILL.md files`).option("--version <v>", "bundle version (default: latest published in the catalogue)").option("--instance <name>", "install as a named, separate instance (install the same bundle more than once)").option("--code-lane <id>", "identity.code-lane binding (e.g. claude-code-chris)").option("--design-lane <id>", "identity.design-lane binding (e.g. claude-design-chris)").option("--surface <s>", "skill target surface to materialise", "claude-code").option("--local", "write to ./.claude/skills instead of ~/.claude/skills").option("--json", "machine output").action(async (slugArg, opts, cmd) => {
-    const slug = slugArg || DEFAULT_SLUG;
-    const client = await makeClient(resolveConfig(cmd.optsWithGlobals()));
-    const pw = await runApi("resolving personal workspace", () => client.GET("/me/personal-workspace", {}));
-    const personalWsId = pw?.id || pw?.workspaceId || pw?.personalWorkspaceId || pw?.item?.id;
-    if (!personalWsId) fail("Could not resolve your personal workspace.");
-    let version = opts.version;
-    if (!version) {
-      const cat = await runApi("reading the bundle catalogue", () => client.GET("/me/bundles", {}));
-      const item = (cat?.bundles ?? cat?.Bundles ?? []).find((b) => (b.slug ?? b.Slug) === slug);
-      if (!item) fail(`Bundle '${slug}' is not in your self-serve catalogue (must be UserInstallable + Published).`);
-      version = item.latestVersion ?? item.LatestVersion;
-      if (!version) fail(`Bundle '${slug}' has no installable (Published) version.`);
-    }
-    const installOptions = {};
-    if (opts.codeLane) installOptions["identity.code-lane"] = opts.codeLane;
-    if (opts.designLane) installOptions["identity.design-lane"] = opts.designLane;
-    const res = await runApi(
-      `installing ${slug}@${version}${opts.instance ? ` (${opts.instance})` : ""}`,
-      () => client.POST("/me/bundles/{slug}/versions/{version}/install", {
-        params: { path: { slug, version } },
-        // instance: null/absent = the default instance (reinstall updates in
-        // place); a name installs a separate instance.
-        body: { installOptions, instance: opts.instance ?? null }
-      })
-    );
-    const status = String(res?.status ?? res?.Status ?? "");
-    if (status && status.toLowerCase() !== "completed") {
-      fail(`Install did not complete (status=${status}; ${res?.failureReason ?? res?.FailureReason ?? ""}).`);
-    }
-    const feed = await runApi(
-      "materialising skill files",
-      () => client.GET("/workspaces/{workspaceId}/memories/feed", {
-        // cascadeWorkspaces: skills land in an "Operator Skills" SUB-workspace of
-        // the personal workspace, so we recurse from the personal-ws root.
-        // includeText: the feed omits bodies by default; we need them for SKILL.md.
-        params: {
-          path: { workspaceId: personalWsId },
-          query: { limit: 200, cascadeWorkspaces: true, includeText: true }
-        }
-      })
-    );
-    const rows = feed?.results ?? feed?.Results ?? [];
-    const dir = skillsDir(!opts.local);
-    const wantInstance = opts.instance || "default";
-    const written = [];
-    const bundleTagPrefix = `sechroom:bundle:${slug}@`;
-    for (const r of rows) {
-      const m = r.item ?? r;
-      const tags = m.tags ?? m.Tags ?? [];
-      if (!hasAny(tags, ROLE_TAGS)) continue;
-      if (tagValue2(tags, "target:") !== opts.surface) continue;
-      if (!tags.some((t) => t.startsWith(bundleTagPrefix))) continue;
-      if ((tagValue2(tags, "sechroom:skill-instance:") ?? "default") !== wantInstance) continue;
-      const name = tagValue2(tags, "skill:");
-      if (!name) continue;
-      const body = m.text ?? m.Text ?? "";
-      mkdirSync6(join9(dir, name), { recursive: true });
-      writeFileSync6(join9(dir, name, "SKILL.md"), body.endsWith("\n") ? body : body + "\n");
-      written.push(name);
-    }
-    mkdirSync6(dir, { recursive: true });
-    const lockPath = join9(dir, LOCK);
-    const lock = existsSync9(lockPath) ? JSON.parse(readFileSync6(lockPath, "utf8")) : {};
-    lock[slug] = { surface: opts.surface, version, instance: wantInstance, skills: written.sort() };
-    writeFileSync6(lockPath, JSON.stringify(lock, null, 2) + "\n");
-    if (opts.json) return emit({ slug, version, instance: wantInstance, surface: opts.surface, dir, installed: written }, true);
-    const instanceNote = opts.instance ? ` (${opts.instance})` : "";
-    console.log(style.green(`Installed ${slug}@${version}${instanceNote} \u2014 ${written.length} skill(s) \u2192 ${dir}`));
-    written.forEach((n) => console.log("  " + style.dim("\u2022") + " " + n));
-    if (written.length === 0) console.log(style.dim(`  (no '${opts.surface}' skill bodies found; check --surface)`));
-  });
   skills.command("list").description("List your installed bundles (GET /me/bundle-installs)").option("--json", "machine output").action(async (opts, cmd) => {
     const client = await makeClient(resolveConfig(cmd.optsWithGlobals()));
     const data = await runApi("reading your installs", () => client.GET("/me/bundle-installs", {}));
@@ -3947,49 +4159,33 @@ Examples:
       console.log(`  ${i.bundleSlug ?? i.BundleSlug}@${i.bundleVersion ?? i.BundleVersion ?? "?"}${tag}`);
     });
   });
-  skills.command("clean [slug]").description(`Remove materialised skill files written by install (default ${DEFAULT_SLUG})`).option("--local", "clean ./.claude/skills instead of ~/.claude/skills").option("--json", "machine output").action(async (slugArg, opts) => {
-    const slug = slugArg || DEFAULT_SLUG;
+  skills.command("clean [slug]").description(`Remove skill files materialised by onboard (default ${DEFAULT_SKILLS_SLUG})`).option("--local", "clean ./.claude/skills instead of ~/.claude/skills").option("--json", "machine output").action(async (slugArg, opts) => {
+    const slug = slugArg || DEFAULT_SKILLS_SLUG;
     const dir = skillsDir(!opts.local);
-    const lockPath = join9(dir, LOCK);
-    if (!existsSync9(lockPath)) fail(`No skills lockfile at ${lockPath}; nothing to clean.`);
-    const lock = JSON.parse(readFileSync6(lockPath, "utf8"));
+    const lock = readSkillsLock(dir);
     const entry = lock[slug];
-    if (!entry) fail(`No installed record for '${slug}' in ${lockPath}.`);
+    if (!entry) fail(`No materialised skills recorded for '${slug}' in ${join10(dir, SKILLS_LOCK)}.`);
     const removed = [];
     for (const name of entry.skills) {
-      const skillPath = join9(dir, name);
-      if (existsSync9(skillPath)) {
+      const skillPath = join10(dir, name);
+      if (existsSync10(skillPath)) {
         rmSync2(skillPath, { recursive: true, force: true });
         removed.push(name);
       }
     }
     delete lock[slug];
-    writeFileSync6(lockPath, JSON.stringify(lock, null, 2) + "\n");
+    writeSkillsLock(dir, lock);
     if (opts.json) return emit({ slug, removed, dir }, true);
     console.log(style.green(`Removed ${removed.length} skill(s) for ${slug} from ${dir}`));
   });
-  skills.command("set-lane").description("Write this checkout's lane pin to a local ./.sechroom/lane.json file (read at runtime by skills)").option("--code-lane <id>", "code-surface lane id (e.g. claude-code-chris)").option("--design-lane <id>", "design / substrate-authoring lane id (e.g. claude-design-chris)").option("--json", "machine output").action((opts, cmd) => {
-    if (!opts.codeLane && !opts.designLane) fail("Provide --code-lane and/or --design-lane.");
-    const target = localSemPath();
-    const values = readLocalSemValues();
-    if (opts.codeLane) values["code-lane"] = opts.codeLane;
-    if (opts.designLane) values["design-lane"] = opts.designLane;
-    writeSem(values, target);
-    if (cmd.optsWithGlobals().json) return emit({ path: target, values }, true);
-    console.log(style.green(`Wrote lane pin \u2192 ${target} ${style.dim("(git-ignored)")}`));
-    Object.entries(values).forEach(([k, v]) => console.log("  " + style.dim(k) + " = " + v));
-  });
-  skills.command("lane").description("Show the lane pin resolved from ./.sechroom/lane.json (nearest in this checkout; legacy ./.sem honoured)").option("--json", "machine output").action((opts, cmd) => {
-    const json = cmd.optsWithGlobals().json;
-    const found = readSem();
-    if (!found) {
-      if (json) return emit({ path: null, values: {} }, true);
-      return console.log(style.dim(`No ./.sechroom/lane.json pin in this checkout. Run 'sechroom skills set-lane'.`));
-    }
-    if (json) return emit(found, true);
-    console.log(style.dim(`from ${found.path}`));
-    Object.entries(found.values).forEach(([k, v]) => console.log("  " + style.bold(k) + " = " + v));
-  });
+  skills.command("set-lane").description("Alias of `sechroom lane set` (kept for back-compat) \u2014 write this checkout's lane pin").option("--code-lane <id>", "code-surface lane id (e.g. claude-code-chris)").option("--design-lane <id>", "design / substrate-authoring lane id (e.g. claude-design-chris)").option("--json", "machine output").action(
+    (opts, cmd) => setLane({
+      codeLane: opts.codeLane,
+      designLane: opts.designLane,
+      json: Boolean(opts.json) || Boolean(cmd.optsWithGlobals().json)
+    })
+  );
+  skills.command("lane").description("Alias of `sechroom lane` (kept for back-compat) \u2014 show this checkout's lane pin").option("--json", "machine output").action((opts, cmd) => showLane(Boolean(opts.json) || Boolean(cmd.optsWithGlobals().json)));
   skills.command("set-workflow").description("Set your per-operator workflow defaults (server-side; follows you across tenants)").option("--default-code-lane <id>", "personal default code lane (e.g. claude-code-chris)").option("--default-design-lane <id>", "personal default design lane (e.g. claude-design-chris)").option("--handover-recipient <id>", "your daily-handover counterparty (e.g. andy)").option("--json", "machine output").action(async (opts, cmd) => {
     if (!opts.defaultCodeLane && !opts.defaultDesignLane && !opts.handoverRecipient)
       fail("Provide at least one of --default-code-lane / --default-design-lane / --handover-recipient.");
@@ -4053,22 +4249,24 @@ Examples:
 }
 
 // src/commands/reset.ts
-import { homedir as homedir7 } from "os";
-import { join as join10 } from "path";
-import { existsSync as existsSync10, readFileSync as readFileSync7, rmSync as rmSync3 } from "fs";
-var SKILLS_LOCK = ".sechroom-skills.json";
-var localSkillsDir = () => join10(process.cwd(), ".claude", "skills");
-var globalSkillsDir = () => join10(homedir7(), ".claude", "skills");
+import { homedir as homedir6 } from "os";
+import { join as join11 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync7, rmSync as rmSync3 } from "fs";
+var SKILLS_LOCK2 = ".sechroom-skills.json";
+var localSkillsDir = () => join11(process.cwd(), ".claude", "skills");
+var globalSkillsDir = () => join11(homedir6(), ".claude", "skills");
+var localAgentsDir = () => join11(process.cwd(), ".claude", "agents");
+var globalAgentsDir = () => join11(homedir6(), ".claude", "agents");
 function removeMaterialisedSkills(dir) {
   const removed = [];
-  const lockPath = join10(dir, SKILLS_LOCK);
-  if (!existsSync10(lockPath)) return removed;
+  const lockPath = join11(dir, SKILLS_LOCK2);
+  if (!existsSync11(lockPath)) return removed;
   try {
     const lock = JSON.parse(readFileSync7(lockPath, "utf8"));
     for (const entry of Object.values(lock)) {
       for (const name of entry.skills ?? []) {
-        const p = join10(dir, name);
-        if (existsSync10(p)) {
+        const p = join11(dir, name);
+        if (existsSync11(p)) {
           rmSync3(p, { recursive: true, force: true });
           removed.push(p);
         }
@@ -4113,28 +4311,30 @@ function registerReset(program2) {
       }
     }
     const removed = [];
-    const stateDir = join10(process.cwd(), ".sechroom");
-    if (existsSync10(stateDir)) {
+    const stateDir = join11(process.cwd(), ".sechroom");
+    if (existsSync11(stateDir)) {
       rmSync3(stateDir, { recursive: true, force: true });
       removed.push(stateDir);
     }
-    const legacyCfg = join10(process.cwd(), ".sechroom.json");
-    if (existsSync10(legacyCfg)) {
+    const legacyCfg = join11(process.cwd(), ".sechroom.json");
+    if (existsSync11(legacyCfg)) {
       rmSync3(legacyCfg, { force: true });
       removed.push(legacyCfg);
     }
-    const legacySem = join10(process.cwd(), ".sem");
-    if (existsSync10(legacySem)) {
+    const legacySem = join11(process.cwd(), ".sem");
+    if (existsSync11(legacySem)) {
       rmSync3(legacySem, { force: true });
       removed.push(legacySem);
     }
     removed.push(...removeMaterialisedSkills(localSkillsDir()));
+    removed.push(...removeMaterialisedSkills(localAgentsDir()));
     if (global) {
       const tok = clearToken();
       if (tok) removed.push(tok);
       const cfg = clearPersisted();
       if (cfg) removed.push(cfg);
       removed.push(...removeMaterialisedSkills(globalSkillsDir()));
+      removed.push(...removeMaterialisedSkills(globalAgentsDir()));
     }
     if (json) return emit({ global, removed }, true);
     if (removed.length === 0) {
@@ -4159,7 +4359,7 @@ function resolveVersion() {
   }
 }
 var program = new Command();
-program.name("sechroom").description("Sechroom CLI \u2014 thin generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.").version(resolveVersion()).option("--base-url <url>", "API base URL (overrides config / SECHROOM_BASE_URL)").option("--tenant <tenant>", "Tenant id (required by the API; overrides config / SECHROOM_TENANT)").option("--json", "Emit compact JSON (for scripts and agents)", false);
+program.name("sechroom").description("Sechroom CLI \u2014 thin generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.").version(resolveVersion()).option("--base-url <url>", "API base URL (overrides config / SECHROOM_BASE_URL)").option("--tenant <tenant>", "Tenant id (required by the API; overrides config / SECHROOM_TENANT)").option("--binding <name>", "Named workspace binding from .sechroom.json `workspaces` (overrides path auto-selection / SECHROOM_BINDING)").option("--json", "Emit compact JSON (for scripts and agents)", false);
 program.addHelpText(
   "after",
   `
@@ -4233,7 +4433,7 @@ config.command("set <key> <value>").description("Set baseUrl | tenant | workspac
 });
 config.command("show").description("Print resolved config + sources (flag > env > local > global > default)").action((_opts, cmd) => {
   const g = cmd.optsWithGlobals();
-  const d = describeConfig({ baseUrl: g.baseUrl, tenant: g.tenant });
+  const d = describeConfig({ baseUrl: g.baseUrl, tenant: g.tenant, binding: g.binding });
   if (g.json) {
     process.stdout.write(
       JSON.stringify({
@@ -4272,6 +4472,7 @@ registerSetup(program);
 registerOnboard(program);
 registerSweep(program);
 registerSkills(program);
+registerLane(program);
 registerReset(program);
 program.parseAsync().catch((err2) => {
   process.stderr.write(`error: ${err2 instanceof Error ? err2.message : String(err2)}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.6.30-rc.3b1b16ff",
+  "version": "2026.6.30",
   "description": "Sechroom CLI — a thin, generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.",
   "type": "module",
   "license": "UNLICENSED",