@sechroom/cli 2026.6.30-rc.3b1b16ff → 2026.6.32-rc.925b06e7

package/dist/index.js

@@ -21,9 +21,9 @@ var DEFAULT_ACCOUNT = "default";
 var STATE_DIR_NAME = ".sechroom";
 var BASELINE_CONFIG_NAME = ".sechroom.json";
 var OVERRIDE_CONFIG_NAME = join(STATE_DIR_NAME, "config.json");
-var BINDING_FIELDS = ["schemaVersion", "baseUrl", "tenant", "workspaceId", "defaultProjectId"];
+var BINDING_FIELDS = ["schemaVersion", "baseUrl", "tenant", "workspaceId", "defaultProjectId", "workspaces"];
 var DEFAULT_BASE_URL = "https://app.sechroom.ai/api";
-var LOCAL_CONFIG_SCHEMA_VERSION = 2;
+var LOCAL_CONFIG_SCHEMA_VERSION = 3;
 function ensureDir() {
   if (!existsSync(CONFIG_DIR)) mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
 }
@@ -161,12 +161,14 @@ function readLocalConfig() {
     tenant: merged.tenant,
     workspaceId: merged.workspaceId,
     defaultProjectId: merged.defaultProjectId,
+    workspaces: merged.workspaces,
     account: merged.account,
-    path: existsSync(baselinePath) ? baselinePath : overridePath
+    path: existsSync(baselinePath) ? baselinePath : overridePath,
+    home
   };
 }
-function writeLocalConfig(patch) {
-  const home = findConfigHome() ?? process.cwd();
+function writeLocalConfig(patch, opts) {
+  const home = (opts?.here ? process.cwd() : findConfigHome()) ?? process.cwd();
   const baselinePath = join(home, BASELINE_CONFIG_NAME);
   const overridePath = join(home, OVERRIDE_CONFIG_NAME);
   const current = readJsonConfig(baselinePath) ?? {};
@@ -184,6 +186,30 @@ function committedBindingPath(dir) {
   const p = join(dir, BASELINE_CONFIG_NAME);
   return existsSync(p) ? p : void 0;
 }
+function selectWorkspaceBinding(local, explicitName) {
+  const bindings = local.workspaces ?? [];
+  if (explicitName) {
+    const hit = bindings.find((b) => b.name === explicitName);
+    if (!hit)
+      throw new Error(
+        `No workspace binding named "${explicitName}" in ${local.home ?? "this repo"}'s .sechroom.json` + (bindings.length > 0 ? ` (have: ${bindings.map((b) => b.name).join(", ")})` : "") + ". Add one with `sechroom workspace bind`."
+      );
+    return hit;
+  }
+  if (!local.home || bindings.length === 0) return void 0;
+  const rel = process.cwd().startsWith(local.home) ? process.cwd().slice(local.home.length).replace(/^[/\\]/, "") : "";
+  const norm = (p) => p.replace(/\/\*\*$/, "").replace(/[/\\]+$/, "");
+  let best;
+  for (const b of bindings) {
+    for (const raw of b.paths ?? []) {
+      const prefix = norm(raw);
+      if (prefix.length === 0) continue;
+      const matches = rel === prefix || rel.startsWith(prefix + "/");
+      if (matches && (!best || prefix.length > best.len)) best = { binding: b, len: prefix.length };
+    }
+  }
+  return best?.binding;
+}
 function resolveConfig(flags) {
   const local = readLocalConfig();
   const persisted = readPersisted();
@@ -194,8 +220,9 @@ function resolveConfig(flags) {
       "No tenant set. The Sechroom API rejects untenanted requests (HTTP 400). Pass --tenant <id>, set SECHROOM_TENANT, run `sechroom config set tenant <id>`, or `sechroom config set --local tenant <id>` for this directory."
     );
   }
-  const workspaceId = process.env.SECHROOM_WORKSPACE ?? local.workspaceId ?? persisted.workspaceId ?? void 0;
-  const defaultProjectId = local.defaultProjectId ?? persisted.defaultProjectId ?? void 0;
+  const binding = selectWorkspaceBinding(local, flags.binding ?? process.env.SECHROOM_BINDING);
+  const workspaceId = process.env.SECHROOM_WORKSPACE ?? binding?.workspaceId ?? local.workspaceId ?? persisted.workspaceId ?? void 0;
+  const defaultProjectId = (binding ? binding.defaultProjectId : void 0) ?? local.defaultProjectId ?? persisted.defaultProjectId ?? void 0;
   const account = resolveAccountAlias(flags.account);
   return { baseUrl: baseUrl.replace(/\/$/, ""), tenant, account, workspaceId, defaultProjectId, clientId: persisted.clientId };
 }
@@ -212,10 +239,17 @@ function describeConfig(flags) {
     return { value: void 0, source: "unset" };
   };
   const baseUrl = pick(flags.baseUrl, process.env.SECHROOM_BASE_URL, local.baseUrl, g.baseUrl, DEFAULT_BASE_URL);
+  let binding;
+  try {
+    binding = selectWorkspaceBinding(local, flags.binding ?? process.env.SECHROOM_BINDING);
+  } catch {
+    binding = void 0;
+  }
+  const workspaceId = process.env.SECHROOM_WORKSPACE ? { value: process.env.SECHROOM_WORKSPACE, source: "env" } : binding ? { value: binding.workspaceId, source: `binding "${binding.name}"${localTag !== "local" ? ` (${local.path})` : ""}` } : pick(void 0, void 0, local.workspaceId, g.workspaceId);
   return {
     baseUrl: { value: baseUrl.value, source: baseUrl.source },
     tenant: pick(flags.tenant, process.env.SECHROOM_TENANT, local.tenant, g.tenant),
-    workspaceId: pick(void 0, process.env.SECHROOM_WORKSPACE, local.workspaceId, g.workspaceId),
+    workspaceId,
     localPath: local.path
   };
 }
@@ -1168,6 +1202,26 @@ Examples:
 // src/commands/workspace.ts
 function registerWorkspace(program2) {
   const workspace = program2.command("workspace").description("Create, browse, and manage workspaces");
+  workspace.command("bind <workspaceId>").description("Bind a workspace to this repo (.sechroom.json). With --name it becomes a NAMED v3 binding (multi-workspace); --paths scopes it to subtrees.").option("--name <name>", "binding name (enables multi-workspace; selectable via --binding / path match)").option("--paths <csv>", "comma-separated directory prefixes (relative to the repo root) this binding covers, e.g. frontend,docs").option("--default-project <id>", "informational default project for this binding").option("--here", "write the binding file at THIS directory even when a parent already carries one").action((workspaceId, opts, cmd) => {
+    const json = cmd.optsWithGlobals().json;
+    if (!opts.name) {
+      const path2 = writeLocalConfig({ workspaceId, ...opts.defaultProject ? { defaultProjectId: opts.defaultProject } : {} }, { here: Boolean(opts.here) });
+      if (json) return emit({ workspaceId, path: path2 }, true);
+      console.log(style.green(`Workspace ${workspaceId} bound (${path2}).`));
+      return;
+    }
+    const local = readLocalConfig();
+    const bindings = (local.workspaces ?? []).filter((b) => b.name !== opts.name);
+    bindings.push({
+      name: opts.name,
+      workspaceId,
+      ...opts.defaultProject ? { defaultProjectId: opts.defaultProject } : {},
+      ...opts.paths ? { paths: String(opts.paths).split(",").map((p) => p.trim()).filter(Boolean) } : {}
+    });
+    const path = writeLocalConfig({ workspaces: bindings }, { here: Boolean(opts.here) });
+    if (json) return emit({ binding: opts.name, workspaceId, paths: opts.paths ?? null, path }, true);
+    console.log(style.green(`Binding "${opts.name}" \u2192 ${workspaceId} saved (${path}).`));
+  });
   workspace.addHelpText(
     "after",
     `
@@ -3382,7 +3436,7 @@ async function ensureTenant(baseUrl, g, opts) {
   if (opts.persist !== false) {
     const patch = { baseUrl, tenant, ...workspaceId ? { workspaceId } : {} };
     if (storeLocal) {
-      const path = writeLocalConfig(patch);
+      const path = writeLocalConfig(patch, { here: Boolean(opts.here) });
       if (!opts.json) process.stderr.write(`${ok("\u2713")} config saved to ${path} (directory-local)
 `);
     } else {
@@ -3552,7 +3606,7 @@ async function runRecurse(cfg, g, opts) {
   summarizeFanout(results, { dryRun });
 }
 function registerOnboard(program2) {
-  program2.command("onboard").description("Guided first-run setup: configure, sign in, set timezone, detect clients, and wire this project").option("--recurse", "orchestration-root mode: onboard every child repo under this dir (auto-discovered, or from ./.sechroom/repos.json) \u2014 refreshes bound repos, prompts a workspace per new one", false).option("--lane <id>", "set the code-lane (substrate source identity) explicitly instead of inferring it; with --recurse it's used for every child repo").option("--design-lane <id>", "set the design-lane explicitly (substrate-authoring identity); with --recurse applies to every child").option("--client <list>", `comma-separated clients (${ALL_CLIENT_KEYS.join(", ")}) or 'all' (default: auto-detected)`).option("--local", "save the binding (tenant + base URL + workspace) to a committed .sechroom.json in this repo instead of the global config", false).option("--workspace <id>", "bind this directory to a workspace (skips the interactive workspace pick)").option("--cli-only", "configure the CLI only \u2014 don't wire any AI client (no MCP config, no agent files)", false).option("--no-mcp", "skip the MCP server config (.mcp.json etc.); still write the agent instruction files").option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--dry-run", "walk through without writing files or changing the profile", false).option("--refresh", "re-fetch descriptors and refresh any out-of-date managed blocks (local edits preserved to .proposed)", false).option("--force", "rewrite every managed block, overwriting local edits inside the markers (content outside untouched)", false).option("--check", "report whether anything would change and exit (0 = all current, 1 = stale/drift/absent); writes nothing", false).option("-y, --yes", "non-interactive: accept defaults (system timezone, detected clients, global config, full wire)", false).addHelpText(
+  program2.command("onboard").description("Guided first-run setup: configure, sign in, set timezone, detect clients, and wire this project").option("--recurse", "orchestration-root mode: onboard every child repo under this dir (auto-discovered, or from ./.sechroom/repos.json) \u2014 refreshes bound repos, prompts a workspace per new one", false).option("--lane <id>", "set the code-lane (substrate source identity) explicitly instead of inferring it; with --recurse it's used for every child repo").option("--design-lane <id>", "set the design-lane explicitly (substrate-authoring identity); with --recurse applies to every child").option("--client <list>", `comma-separated clients (${ALL_CLIENT_KEYS.join(", ")}) or 'all' (default: auto-detected)`).option("--local", "save the binding (tenant + base URL + workspace) to a committed .sechroom.json in this repo instead of the global config", false).option("--here", "with --local: write the binding at THIS directory even when a parent already carries one \u2014 binds a subtree (e.g. a monorepo's frontend/) to its own workspace", false).option("--workspace <id>", "bind this directory to a workspace (skips the interactive workspace pick)").option("--cli-only", "configure the CLI only \u2014 don't wire any AI client (no MCP config, no agent files)", false).option("--no-mcp", "skip the MCP server config (.mcp.json etc.); still write the agent instruction files").option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--dry-run", "walk through without writing files or changing the profile", false).option("--refresh", "re-fetch descriptors and refresh any out-of-date managed blocks (local edits preserved to .proposed)", false).option("--force", "rewrite every managed block, overwriting local edits inside the markers (content outside untouched)", false).option("--check", "report whether anything would change and exit (0 = all current, 1 = stale/drift/absent); writes nothing", false).option("-y, --yes", "non-interactive: accept defaults (system timezone, detected clients, global config, full wire)", false).addHelpText(
     "after",
     `
 Examples:
@@ -4159,7 +4213,7 @@ function resolveVersion() {
   }
 }
 var program = new Command();
-program.name("sechroom").description("Sechroom CLI \u2014 thin generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.").version(resolveVersion()).option("--base-url <url>", "API base URL (overrides config / SECHROOM_BASE_URL)").option("--tenant <tenant>", "Tenant id (required by the API; overrides config / SECHROOM_TENANT)").option("--json", "Emit compact JSON (for scripts and agents)", false);
+program.name("sechroom").description("Sechroom CLI \u2014 thin generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.").version(resolveVersion()).option("--base-url <url>", "API base URL (overrides config / SECHROOM_BASE_URL)").option("--tenant <tenant>", "Tenant id (required by the API; overrides config / SECHROOM_TENANT)").option("--binding <name>", "Named workspace binding from .sechroom.json `workspaces` (overrides path auto-selection / SECHROOM_BINDING)").option("--json", "Emit compact JSON (for scripts and agents)", false);
 program.addHelpText(
   "after",
   `
@@ -4233,7 +4287,7 @@ config.command("set <key> <value>").description("Set baseUrl | tenant | workspac
 });
 config.command("show").description("Print resolved config + sources (flag > env > local > global > default)").action((_opts, cmd) => {
   const g = cmd.optsWithGlobals();
-  const d = describeConfig({ baseUrl: g.baseUrl, tenant: g.tenant });
+  const d = describeConfig({ baseUrl: g.baseUrl, tenant: g.tenant, binding: g.binding });
   if (g.json) {
     process.stdout.write(
       JSON.stringify({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.6.30-rc.3b1b16ff",
+  "version": "2026.6.32-rc.925b06e7",
   "description": "Sechroom CLI — a thin, generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.",
   "type": "module",
   "license": "UNLICENSED",