@sechroom/cli 2026.6.30 → 2026.6.31

package/dist/index.js

@@ -1773,8 +1773,13 @@ Examples:
   });
 }
 
+// src/commands/checkpoint.ts
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname5, join as join5 } from "path";
+
 // src/commands/hook.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, statSync as statSync2, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir3 } from "os";
 import { delimiter, dirname as dirname4, join as join4 } from "path";
 
@@ -1947,15 +1952,25 @@ var SectionType = {
    *  carried a workspaceId and that workspace has agent-setup-bundle memories. */
   WorkspaceConventions: "workspace-conventions"
 };
-async function fetchSetup(cfg) {
+async function fetchSetup(cfg, namespaceSlug) {
   const client = await makeClient(cfg);
+  const query = {};
+  if (cfg.workspaceId) query.workspaceId = cfg.workspaceId;
+  if (namespaceSlug) query.namespaceSlug = namespaceSlug;
+  const hasQuery = query.workspaceId !== void 0 || query.namespaceSlug !== void 0;
   const { data, error } = await client.GET(
     "/operator-surface/setup",
-    cfg.workspaceId ? { params: { query: { workspaceId: cfg.workspaceId } } } : {}
+    hasQuery ? { params: { query } } : {}
   );
   if (error) throw new Error(`GET /operator-surface/setup failed: ${JSON.stringify(error)}`);
   return data;
 }
+async function listNamespaces(cfg) {
+  const client = await makeClient(cfg);
+  const { data } = await client.GET("/mcp-aggregator/namespaces", {});
+  const rows = data ?? [];
+  return rows.filter((r) => typeof r.slug === "string").map((r) => ({ slug: r.slug, displayName: r.displayName ?? r.slug }));
+}
 function findSurface(setup, surfaceKey) {
   return setup.surfaces.find((s) => s.surfaceKey === surfaceKey);
 }
@@ -2026,12 +2041,14 @@ async function resolveWorkspaceConventions(cfg, section) {
     if (parseTagArtifactId(artifact.id)) continue;
     const mem = await fetchMemoryFields(cfg, artifact.id);
     if (typeof mem?.text === "string" && mem.text.trim().length > 0) {
-      parts.push(mem.text.trim());
-      refs.push(`${artifact.id}@v${mem.version ?? 1}`);
+      const ref = `${artifact.id}@v${mem.version ?? 1}`;
+      parts.push(`<!-- @sechroom/cli:section source=${ref} -->
+${mem.text.trim()}`);
+      refs.push(ref);
     }
   }
   if (parts.length === 0) return null;
-  return { body: parts.join("\n\n---\n\n"), refs };
+  return { body: parts.join("\n\n"), refs };
 }
 async function createOverride(cfg, template, personalWorkspaceId) {
   const client = await makeClient(cfg);
@@ -2156,6 +2173,102 @@ function hasRequiredIntent(i) {
     i.objective?.trim() && i.state?.trim() && i.lastAction?.trim() && i.nextAction?.trim() && i.resumeInstruction?.trim()
   );
 }
+async function saveSnapshotFromIntent(cmd, cwd, laneFlag, scopeFlag, defaultScope, opts) {
+  const lane = resolveLane(laneFlag, cwd);
+  if (!lane) return false;
+  const intent = readIntent(cwd);
+  if (!intent || !hasRequiredIntent(intent)) return false;
+  if (opts?.skipIfUnchanged && unchangedSinceLastPush(cwd, intent)) return false;
+  const cfg = resolveConfig(cmd.optsWithGlobals());
+  const client = await makeClient(cfg);
+  await client.POST("/continuity/snapshots", {
+    body: {
+      laneId: lane,
+      scope: scopeFlag ?? intent.scope ?? defaultScope,
+      currentObjective: intent.objective,
+      currentState: intent.state,
+      lastMeaningfulAction: intent.lastAction,
+      nextIntendedAction: intent.nextAction,
+      resumeInstruction: intent.resumeInstruction,
+      activeConstraints: intent.constraints ?? null,
+      openQuestions: intent.questions ?? null,
+      surfaceMarkers: intent.surfaceMarkers ?? null,
+      relevantArtifactIds: intent.artifacts ?? null,
+      confidence: intent.confidence ?? null,
+      // Frequent triggers (compaction, session-end) land within the FR-051 4h
+      // window; Acknowledge lets the checkpoint persist on the lane.
+      concurrentSessionPolicy: "Acknowledge"
+    }
+  });
+  recordPush(cwd, intent);
+  return true;
+}
+function ledgerPath(start) {
+  const intent = resolveIntentPath(start);
+  const dir = intent ? dirname4(intent) : join4(start, ".sechroom");
+  return join4(dir, ".checkpoint-state.json");
+}
+function readLedger(start) {
+  try {
+    const p = ledgerPath(start);
+    if (!existsSync4(p)) return {};
+    return JSON.parse(readFileSync3(p, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function intentHash(i) {
+  const canonical = JSON.stringify({
+    objective: i.objective ?? "",
+    state: i.state ?? "",
+    lastAction: i.lastAction ?? "",
+    nextAction: i.nextAction ?? "",
+    resumeInstruction: i.resumeInstruction ?? "",
+    scope: i.scope ?? "",
+    constraints: i.constraints ?? [],
+    questions: i.questions ?? [],
+    surfaceMarkers: i.surfaceMarkers ?? [],
+    artifacts: i.artifacts ?? [],
+    confidence: i.confidence ?? null
+  });
+  return createHash2("sha256").update(canonical, "utf8").digest("hex");
+}
+function recentlyCheckpointed(start, minutes) {
+  const { lastEpochMs } = readLedger(start);
+  return typeof lastEpochMs === "number" && Date.now() - lastEpochMs < minutes * 6e4;
+}
+function unchangedSinceLastPush(start, intent) {
+  const ledger = readLedger(start);
+  if (ledger.lastHash == null) return false;
+  const path = resolveIntentPath(start);
+  if (path && ledger.lastMtimeMs != null) {
+    try {
+      if (statSync2(path).mtimeMs <= ledger.lastMtimeMs) return true;
+    } catch {
+    }
+  }
+  return intentHash(intent) === ledger.lastHash;
+}
+function recordPush(start, intent) {
+  try {
+    const p = ledgerPath(start);
+    const path = resolveIntentPath(start);
+    let mtimeMs;
+    try {
+      if (path) mtimeMs = statSync2(path).mtimeMs;
+    } catch {
+      mtimeMs = void 0;
+    }
+    mkdirSync3(dirname4(p), { recursive: true });
+    const ledger = {
+      lastEpochMs: Date.now(),
+      lastMtimeMs: mtimeMs,
+      lastHash: intentHash(intent)
+    };
+    writeFileSync3(p, JSON.stringify(ledger) + "\n");
+  } catch {
+  }
+}
 function formatContext(bundle, lane) {
   const s = bundle?.latestSnapshot;
   if (!s) return null;
@@ -2192,20 +2305,23 @@ function emitSessionStart(additionalContext) {
     }) + "\n"
   );
 }
-var HOOK_COMMANDS = {
+var CLAUDE_HOOK_COMMANDS = {
   SessionStart: "sechroom hook session-start",
-  PreCompact: "sechroom hook pre-compact"
+  PreCompact: "sechroom hook pre-compact",
+  SessionEnd: "sechroom hook session-end"
+};
+var CODEX_HOOK_COMMANDS = {
+  SessionStart: "sechroom hook session-start",
+  Stop: "sechroom hook session-end --debounce-minutes 10"
 };
-var HOOK_EVENTS = ["SessionStart", "PreCompact"];
 function hasHookCommand(config2, event, command) {
   const groups = config2.hooks?.[event] ?? [];
   return groups.some((g) => (g.hooks ?? []).some((h) => h.type === "command" && h.command === command));
 }
-function mergeHooks(config2) {
+function mergeHooks(config2, commands) {
   config2.hooks ??= {};
   let added = 0;
-  for (const event of HOOK_EVENTS) {
-    const command = HOOK_COMMANDS[event];
+  for (const [event, command] of Object.entries(commands)) {
     if (hasHookCommand(config2, event, command)) continue;
     const groups = config2.hooks[event] ??= [];
     groups.push({ hooks: [{ type: "command", command }] });
@@ -2219,10 +2335,10 @@ function readJsonConfig2(path) {
   if (!raw.trim()) return {};
   return JSON.parse(raw);
 }
-function installHooksJson(path, dryRun) {
+function installHooksJson(path, commands, dryRun) {
   const existed = existsSync4(path) && readFileSync3(path, "utf8").trim().length > 0;
   const config2 = readJsonConfig2(path);
-  const added = mergeHooks(config2);
+  const added = mergeHooks(config2, commands);
   if (added === 0 && existed) return { path, status: "current" };
   if (!dryRun) {
     mkdirSync3(dirname4(path), { recursive: true });
@@ -2283,9 +2399,9 @@ function installHookSurfaces(surfaces, opts) {
   for (const surface of surfaces) {
     if (surface === "claude") {
       const path = opts.local ? join4(opts.cwd, ".claude", "settings.json") : join4(opts.home, ".claude", "settings.json");
-      out.push({ surface, results: [installHooksJson(path, opts.dryRun)] });
+      out.push({ surface, results: [installHooksJson(path, CLAUDE_HOOK_COMMANDS, opts.dryRun)] });
     } else {
-      const hooksJson = installHooksJson(join4(opts.home, ".codex", "hooks.json"), opts.dryRun);
+      const hooksJson = installHooksJson(join4(opts.home, ".codex", "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
       const featureFlag = installCodexFeatureFlag(join4(opts.home, ".codex", "config.toml"), opts.dryRun);
       out.push({ surface, results: [hooksJson, featureFlag] });
     }
@@ -2365,31 +2481,23 @@ Fail-soft: no lane / no auth / no-or-partial intent file / API error -> exit 0,
       const raw = await readStdin();
       const input = parseHookInput(raw);
       const cwd = input.cwd ?? process.cwd();
-      const lane = resolveLane(opts.lane, input.cwd);
-      if (!lane) return process.exit(0);
-      const intent = readIntent(cwd);
-      if (!intent || !hasRequiredIntent(intent)) return process.exit(0);
-      const cfg = resolveConfig(cmd.optsWithGlobals());
-      const client = await makeClient(cfg);
-      await client.POST("/continuity/snapshots", {
-        body: {
-          laneId: lane,
-          scope: opts.scope ?? intent.scope ?? "compaction",
-          currentObjective: intent.objective,
-          currentState: intent.state,
-          lastMeaningfulAction: intent.lastAction,
-          nextIntendedAction: intent.nextAction,
-          resumeInstruction: intent.resumeInstruction,
-          activeConstraints: intent.constraints ?? null,
-          openQuestions: intent.questions ?? null,
-          surfaceMarkers: intent.surfaceMarkers ?? null,
-          relevantArtifactIds: intent.artifacts ?? null,
-          confidence: intent.confidence ?? null,
-          // Compaction is infrequent, so the FR-051 clobber guard doesn't bite;
-          // Acknowledge lets a within-window checkpoint land on the lane.
-          concurrentSessionPolicy: "Acknowledge"
-        }
-      });
+      await saveSnapshotFromIntent(cmd, cwd, opts.lane, opts.scope, "compaction", { skipIfUnchanged: true });
+      return process.exit(0);
+    } catch {
+      return process.exit(0);
+    }
+  });
+  hook.command("session-end").description("Save a continuity snapshot from the intent file on a SessionEnd (Claude) / Stop (Codex) hook").option("--lane <laneId>", "Override the resolved lane (else SECHROOM_LANE, else ./.sem code-lane)").option("--scope <scope>", "Snapshot scope (else the intent file's `scope`, else 'session-end')").option("--surface <surface>", "Target surface: claude | codex (lifecycle-only on both)", "claude").option(
+    "--debounce-minutes <n>",
+    "skip if a hook checkpoint ran within this many minutes \u2014 for high-frequency triggers like Codex Stop (Claude SessionEnd passes none)"
+  ).action(async (opts, cmd) => {
+    try {
+      const raw = await readStdin();
+      const input = parseHookInput(raw);
+      const cwd = input.cwd ?? process.cwd();
+      const debounce = opts.debounceMinutes != null ? Number(opts.debounceMinutes) : 0;
+      if (debounce > 0 && recentlyCheckpointed(cwd, debounce)) return process.exit(0);
+      await saveSnapshotFromIntent(cmd, cwd, opts.lane, opts.scope, "session-end", { skipIfUnchanged: true });
       return process.exit(0);
     } catch {
       return process.exit(0);
@@ -2434,6 +2542,101 @@ Fail-soft: no lane / no auth / no-or-partial intent file / API error -> exit 0,
   });
 }
 
+// src/commands/checkpoint.ts
+function registerCheckpoint(program2) {
+  program2.command("checkpoint").description(
+    "Checkpoint working state: create a continuity snapshot (server-validated) AND sync ./.sechroom/continuity.json in one step"
+  ).option("--lane <laneId>", "Lane id (else SECHROOM_LANE, else ./.sem code-lane)").option("--scope <scope>", "Snapshot scope (else the file's scope, else 'session')").option("--objective <text>", "Current objective").option("--state <text>", "Current state").option("--last-action <text>", "Last meaningful action").option("--next-action <text>", "Next intended action").option("--resume-instruction <text>", "Resume instruction").option("--constraint <text...>", "Active constraints (repeatable)").option("--question <text...>", "Open questions (repeatable)").option("--surface-marker <text...>", "Surface markers (repeatable)").option("--artifact <id...>", "Relevant artifact ids (repeatable)").option("--confidence <n>", "Confidence 0..1").option("--dry-run", "validate + print the snapshot payload without creating it or writing the file", false).addHelpText(
+    "after",
+    `
+File-first: reads ./.sechroom/continuity.json (kept current as you work) as the base; any flag
+overrides that field. The snapshot is created FIRST (server-validated), then the local file is
+written/normalized with the returned snapshotId. Lane: --lane > SECHROOM_LANE > ./.sem code-lane.
+
+Examples:
+  $ sechroom checkpoint                          snapshot from ./.sechroom/continuity.json, then sync it
+  $ sechroom checkpoint --next-action "..."      override one field, keep the rest from the file
+  $ sechroom checkpoint --lane claude-code-chris --objective "..." --state "..." \\
+      --last-action "..." --next-action "..." --resume-instruction "..."`
+  ).action(async (opts, cmd) => {
+    const cwd = process.cwd();
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const json = Boolean(cmd.optsWithGlobals().json);
+    const base = readIntent(cwd) ?? {};
+    const merged = {
+      objective: opts.objective ?? base.objective,
+      state: opts.state ?? base.state,
+      lastAction: opts.lastAction ?? base.lastAction,
+      nextAction: opts.nextAction ?? base.nextAction,
+      resumeInstruction: opts.resumeInstruction ?? base.resumeInstruction,
+      scope: opts.scope ?? base.scope,
+      constraints: opts.constraint ?? base.constraints,
+      questions: opts.question ?? base.questions,
+      surfaceMarkers: opts.surfaceMarker ?? base.surfaceMarkers,
+      artifacts: opts.artifact ?? base.artifacts,
+      confidence: opts.confidence != null ? Number(opts.confidence) : base.confidence
+    };
+    const lane = resolveLane(opts.lane, cwd);
+    if (!lane) {
+      fail(
+        "no lane resolved \u2014 pass --lane, set SECHROOM_LANE, or pin one in ./.sem (code-lane). See `sechroom lane`."
+      );
+    }
+    const required = [
+      ["objective", "--objective"],
+      ["state", "--state"],
+      ["lastAction", "--last-action"],
+      ["nextAction", "--next-action"],
+      ["resumeInstruction", "--resume-instruction"]
+    ];
+    const missing = required.filter(([k]) => !String(merged[k] ?? "").trim()).map(([, flag]) => flag);
+    if (missing.length > 0) {
+      fail(
+        `missing required field(s): ${missing.join(", ")} \u2014 supply via flag or in ./.sechroom/continuity.json`
+      );
+    }
+    const scope = merged.scope ?? "session";
+    const body = {
+      laneId: lane,
+      scope,
+      currentObjective: merged.objective,
+      currentState: merged.state,
+      lastMeaningfulAction: merged.lastAction,
+      nextIntendedAction: merged.nextAction,
+      resumeInstruction: merged.resumeInstruction,
+      activeConstraints: merged.constraints ?? null,
+      openQuestions: merged.questions ?? null,
+      surfaceMarkers: merged.surfaceMarkers ?? null,
+      relevantArtifactIds: merged.artifacts ?? null,
+      confidence: merged.confidence ?? null,
+      // Explicit checkpoints are often within the FR-051 4h window; Acknowledge
+      // lets one land on the lane (matches `hook pre-compact`).
+      concurrentSessionPolicy: "Acknowledge"
+    };
+    if (opts.dryRun) {
+      emit({ dryRun: true, lane, scope, wouldCreate: body }, json);
+      return;
+    }
+    const data = await runApi("Creating snapshot", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/continuity/snapshots", { body });
+    });
+    const path = resolveIntentPath(cwd) ?? join5(cwd, INTENT_FILE);
+    const fileBody = { ...merged, scope, lastSnapshotId: data.snapshotId };
+    mkdirSync4(dirname5(path), { recursive: true });
+    writeFileSync4(path, JSON.stringify(fileBody, null, 2) + "\n");
+    recordPush(cwd, merged);
+    if (json) {
+      emit({ snapshotId: data.snapshotId, lane, scope, file: path }, true);
+      return;
+    }
+    process.stdout.write(
+      `${style.bold("\u2713")} checkpoint ${style.bold(data.snapshotId)} ${style.dim(`(lane ${lane}, scope ${scope})`)} \u2014 synced ${path}
+`
+    );
+  });
+}
+
 // src/commands/account.ts
 function registerId(program2) {
   const id = program2.command("id").description("Allocate human-authored id sequences (FR-*, D-*)");
@@ -2650,16 +2853,16 @@ Examples:
 }
 
 // src/setup/apply.ts
-import { createHash as createHash2 } from "crypto";
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync5 } from "fs";
-import { dirname as dirname5 } from "path";
+import { createHash as createHash3 } from "crypto";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync5, existsSync as existsSync5 } from "fs";
+import { dirname as dirname6 } from "path";
 var MARKER_BEGIN = "<!-- @sechroom/cli:begin";
 var MARKER_END = "<!-- @sechroom/cli:end";
 function normalizeBody(s) {
   return s.replace(/\r\n/g, "\n").trim();
 }
 function bodySha256(body) {
-  return createHash2("sha256").update(normalizeBody(body), "utf8").digest("hex");
+  return createHash3("sha256").update(normalizeBody(body), "utf8").digest("hex");
 }
 function renderBlock(write) {
   const body = normalizeBody(write.body);
@@ -2705,7 +2908,7 @@ function parseManagedBlock(content, block) {
   return null;
 }
 function ensureDir2(path) {
-  mkdirSync4(dirname5(path), { recursive: true });
+  mkdirSync5(dirname6(path), { recursive: true });
 }
 function readOr(path, fallback) {
   try {
@@ -2728,7 +2931,7 @@ function mergeMcpJson(path, snippet, dryRun) {
   current.mcpServers = { ...current.mcpServers ?? {}, ...incoming.mcpServers ?? {} };
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync4(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
+  writeFileSync5(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function mergeCodexToml(path, snippet, dryRun) {
@@ -2739,7 +2942,7 @@ function mergeCodexToml(path, snippet, dryRun) {
   const next = (trimmed.length > 0 ? trimmed + "\n\n" : "") + snippet.trim() + "\n";
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync4(path, next, { mode: 384 });
+  writeFileSync5(path, next, { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function writeInstructionBlock(path, write, dryRun) {
@@ -2747,7 +2950,7 @@ function writeInstructionBlock(path, write, dryRun) {
   const next = computeBlockFile(readOr(path, ""), write);
   if (dryRun) return { kind: "instruction", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync4(path, next);
+  writeFileSync5(path, next);
   return { kind: "instruction", path, status: existed ? "merged" : "created" };
 }
 function computeBlockFile(current, write) {
@@ -2788,7 +2991,7 @@ function applyBlock(path, write, mode, dryRun) {
     const next = computeBlockFile(current, write);
     if (!dryRun) {
       ensureDir2(proposedPath);
-      writeFileSync4(proposedPath, next);
+      writeFileSync5(proposedPath, next);
     }
     return {
       kind: "instruction",
@@ -2897,8 +3100,8 @@ auto-resumes where you left off and checkpoints working state before compacting.
 }
 
 // src/setup/skills-offer.ts
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "fs";
-import { join as join6 } from "path";
+import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "fs";
+import { join as join7 } from "path";
 
 // src/setup/lane-pin.ts
 var CODE_LANE_PREFIX_BY_CLIENT = {
@@ -3024,19 +3227,19 @@ function resolveAgents(systemRows, personalRows, surface) {
 }
 
 // src/setup/skills-lock.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 var SKILLS_LOCK = ".sechroom-skills.json";
 var DEFAULT_SKILLS_SLUG = "operator-skills";
 function skillsDir(global) {
-  return global ? join5(homedir5(), ".claude", "skills") : join5(process.cwd(), ".claude", "skills");
+  return global ? join6(homedir5(), ".claude", "skills") : join6(process.cwd(), ".claude", "skills");
 }
 function agentsDir(global) {
-  return global ? join5(homedir5(), ".claude", "agents") : join5(process.cwd(), ".claude", "agents");
+  return global ? join6(homedir5(), ".claude", "agents") : join6(process.cwd(), ".claude", "agents");
 }
 function readSkillsLock(dir) {
-  const lockPath = join5(dir, SKILLS_LOCK);
+  const lockPath = join6(dir, SKILLS_LOCK);
   if (!existsSync6(lockPath)) return {};
   try {
     return JSON.parse(readFileSync5(lockPath, "utf8"));
@@ -3045,8 +3248,8 @@ function readSkillsLock(dir) {
   }
 }
 function writeSkillsLock(dir, lock) {
-  mkdirSync5(dir, { recursive: true });
-  writeFileSync5(join5(dir, SKILLS_LOCK), JSON.stringify(lock, null, 2) + "\n");
+  mkdirSync6(dir, { recursive: true });
+  writeFileSync6(join6(dir, SKILLS_LOCK), JSON.stringify(lock, null, 2) + "\n");
 }
 function recordMaterialisedSkills(dir, slug, skills, meta = {}) {
   const lock = readSkillsLock(dir);
@@ -3106,8 +3309,8 @@ Found ${summary} available to you for ${surface}.
   if (skills.length > 0) {
     const written = [];
     for (const s of skills) {
-      mkdirSync6(join6(sDir, s.name), { recursive: true });
-      writeFileSync6(join6(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
+      mkdirSync7(join7(sDir, s.name), { recursive: true });
+      writeFileSync7(join7(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
       written.push(s.name);
     }
     recordMaterialisedSkills(sDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -3115,11 +3318,11 @@ Found ${summary} available to you for ${surface}.
 `);
   }
   if (agents.length > 0) {
-    mkdirSync6(aDir, { recursive: true });
+    mkdirSync7(aDir, { recursive: true });
     const written = [];
     for (const a of agents) {
       const file = `${a.name}.md`;
-      writeFileSync6(join6(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
+      writeFileSync7(join7(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
       written.push(file);
     }
     recordMaterialisedSkills(aDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -3187,8 +3390,65 @@ ${client.label} (${client.key}):
 `);
   }
 }
+function resolveEvalMode(opts) {
+  return opts.check ? "check" : opts.force ? "force" : "apply";
+}
+function summarizeEval(result, mode, json, dryRun) {
+  const counts = { current: 0, stale: 0, drift: 0, absent: 0 };
+  for (const { actions } of result) for (const a of actions) if (a.eval) counts[a.eval]++;
+  const wouldChange = counts.stale + counts.drift + counts.absent;
+  if (mode === "check") {
+    if (!json) {
+      if (wouldChange === 0) {
+        process.stdout.write("\u2713 all instruction blocks are up to date.\n");
+      } else {
+        const bits = [];
+        if (counts.stale) bits.push(`${counts.stale} out of date`);
+        if (counts.drift) bits.push(`${counts.drift} with local edits`);
+        if (counts.absent) bits.push(`${counts.absent} not yet written`);
+        process.stderr.write(
+          `\u26A0 ${wouldChange} instruction block(s) would change: ${bits.join(", ")}. Re-run with ${style.cyan("--refresh")}.
+`
+        );
+      }
+    }
+    process.exit(wouldChange === 0 ? 0 : 1);
+  }
+  if (json) return;
+  if (!dryRun && counts.stale) {
+    process.stderr.write(`\u21BB refreshed ${counts.stale} section(s) the server had moved
+`);
+  }
+  if (!dryRun && counts.drift) {
+    process.stderr.write(
+      mode === "force" ? `\u26A0 overwrote ${counts.drift} section(s) that had local edits (--force)
+` : `\u26A0 ${counts.drift} section(s) have local edits \u2014 wrote a .proposed file alongside (original untouched). Review + merge, or re-run with ${style.cyan("--force")}.
+`
+    );
+  }
+}
+var GLOBAL_NAMESPACE = "__global__";
+async function resolveNamespaceChoice(cfg, flag) {
+  if (flag) return flag;
+  if (!canPrompt()) return null;
+  const namespaces = await listNamespaces(cfg);
+  if (namespaces.length === 0) return null;
+  const picked = await promptSelect(
+    "Which namespace should this connection use?",
+    [
+      { label: "Global (whole tenant)", value: GLOBAL_NAMESPACE },
+      ...namespaces.map((n) => ({
+        label: n.displayName,
+        value: n.slug,
+        hint: n.slug
+      }))
+    ],
+    GLOBAL_NAMESPACE
+  );
+  return picked === GLOBAL_NAMESPACE ? null : picked;
+}
 function registerInit(program2) {
-  program2.command("init").description("Wire this project for sechroom: write MCP config + agent instruction files from the server's setup descriptors").option("--client <list>", `comma-separated clients (${ALL_CLIENT_KEYS.join(", ")}) or 'all'`, DEFAULT_CLIENT_KEY).option("--dry-run", "print what would be written without writing", false).option("--mcp-only", "only write MCP config (skip agent files)", false).option("--agent-files-only", "only write agent instruction files (skip MCP config)", false).option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").addHelpText(
+  program2.command("init").description("Wire this project for sechroom: write MCP config + agent instruction files from the server's setup descriptors").option("--client <list>", `comma-separated clients (${ALL_CLIENT_KEYS.join(", ")}) or 'all'`, DEFAULT_CLIENT_KEY).option("--dry-run", "print what would be written without writing", false).option("--mcp-only", "only write MCP config (skip agent files)", false).option("--agent-files-only", "only write agent instruction files (skip MCP config)", false).option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--namespace <slug>", "MCP namespace for the connection URL (interactive picker if omitted on a TTY; defaults to tenant-global)").option("--refresh", "refresh out-of-date agent-file blocks in place (local edits preserved to .proposed)", false).option("--force", "rewrite agent-file managed blocks, overwriting local edits inside the markers", false).option("--check", "report whether agent files would change and exit (0 = current, 1 = stale/drift/absent); writes nothing", false).addHelpText(
     "after",
     `
 Examples:
@@ -3199,12 +3459,18 @@ Examples:
   $ sechroom init --dry-run --json      preview the writes, change nothing`
   ).action(async (opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const setup = await withSpinner("Fetching setup descriptors", () => fetchSetup(cfg));
+    const mode = resolveEvalMode(opts);
+    const check = mode === "check";
+    const namespaceSlug = await resolveNamespaceChoice(cfg, opts.namespace);
+    const setup = await withSpinner(
+      "Fetching setup descriptors",
+      () => fetchSetup(cfg, namespaceSlug ?? void 0)
+    );
     const targets = clientTargets(process.cwd());
     const keys = resolveClientKeys(opts.client);
     const json = cmd.optsWithGlobals().json;
     const personalWorkspaceId = await getPersonalWorkspaceId(cfg);
-    if (!opts.dryRun && !opts.mcpOnly) {
+    if (!opts.dryRun && !opts.mcpOnly && !check) {
       await maybeOfferCopies(cfg, setup, targets, keys, personalWorkspaceId, copyChoice(opts));
     }
     const result = [];
@@ -3214,11 +3480,13 @@ Examples:
         dryRun: Boolean(opts.dryRun),
         mcp: !opts.agentFilesOnly,
         agentFiles: !opts.mcpOnly,
-        personalWorkspaceId
+        personalWorkspaceId,
+        mode
       });
       result.push({ client: key, actions });
-      if (!json) printActions(target, actions);
+      if (!json && !check) printActions(target, actions);
     }
+    summarizeEval(result, mode, Boolean(json), Boolean(opts.dryRun));
     if (!json && !opts.dryRun && !opts.mcpOnly) {
       await maybeOfferSkills(cfg, personalWorkspaceId, { yes: false, dryRun: Boolean(opts.dryRun), surface: "claude-code" });
     }
@@ -3244,20 +3512,93 @@ Next \u2014 verify: ${verify.description}
 }
 function registerSetup(program2) {
   const setup = program2.command("setup").description("Granular onboarding steps (init runs these together)");
-  setup.command("mcp <clients...>").description(`Write only the MCP config for one or more clients (${ALL_CLIENT_KEYS.join(", ")}, or 'all')`).option("--dry-run", "print what would be written without writing", false).addHelpText("after", "\nExamples:\n  $ sechroom setup mcp codex\n  $ sechroom setup mcp claude-code codex\n  $ sechroom setup mcp all").action(async (clients, opts, cmd) => {
-    await runClients(clients, cmd, { dryRun: Boolean(opts.dryRun), mcp: true, agentFiles: false });
+  setup.command("mcp <clients...>").description(`Write only the MCP config for one or more clients (${ALL_CLIENT_KEYS.join(", ")}, or 'all')`).option("--dry-run", "print what would be written without writing", false).option("--namespace <slug>", "MCP namespace for the connection URL (interactive picker if omitted on a TTY; defaults to tenant-global)").addHelpText("after", "\nExamples:\n  $ sechroom setup mcp codex\n  $ sechroom setup mcp claude-code codex\n  $ sechroom setup mcp all").action(async (clients, opts, cmd) => {
+    await runClients(clients, cmd, { dryRun: Boolean(opts.dryRun), mcp: true, agentFiles: false, namespace: opts.namespace });
   });
-  setup.command("agent-files <clients...>").description(`Write only the agent instruction file(s) for one or more clients (${ALL_CLIENT_KEYS.join(", ")}, or 'all')`).option("--dry-run", "print what would be written without writing", false).option("--copy", "make a personal copy you can edit (default: prompt on a TTY, else skip)").addHelpText("after", "\nExamples:\n  $ sechroom setup agent-files claude-code        CLAUDE.md\n  $ sechroom setup agent-files claude-code codex  CLAUDE.md + AGENTS.md in one run\n  $ sechroom setup agent-files all").action(async (clients, opts, cmd) => {
-    await runClients(clients, cmd, { dryRun: Boolean(opts.dryRun), mcp: false, agentFiles: true, copy: opts.copy });
+  setup.command("agent-files <clients...>").description(`Write only the agent instruction file(s) for one or more clients (${ALL_CLIENT_KEYS.join(", ")}, or 'all')`).option("--dry-run", "print what would be written without writing", false).option("--copy", "make a personal copy you can edit (default: prompt on a TTY, else skip)").option("--refresh", "refresh out-of-date blocks in place (local edits preserved to .proposed)", false).option("--force", "rewrite managed blocks, overwriting local edits inside the markers", false).option("--check", "report whether anything would change and exit (0 = current, 1 = stale/drift/absent); writes nothing", false).addHelpText("after", "\nExamples:\n  $ sechroom setup agent-files claude-code        CLAUDE.md\n  $ sechroom setup agent-files claude-code codex  CLAUDE.md + AGENTS.md in one run\n  $ sechroom setup agent-files all --check        CI gate: nonzero exit if out of date\n  $ sechroom setup agent-files claude-code --force   overwrite local edits in the managed block").action(async (clients, opts, cmd) => {
+    await runClients(clients, cmd, { dryRun: Boolean(opts.dryRun), mcp: false, agentFiles: true, copy: opts.copy, mode: resolveEvalMode(opts) });
+  });
+  setup.command("new-convention <title...>").description("Scaffold a workspace-conventions section: author a correctly-tagged memo (header as first body line) + regen the agent files").option("--kind <kind>", "reference | standard (orders the section; reference first)", "reference").option("--workspace <id>", "workspace to author in (default: the bound workspace)").option("--body <markdown>", "section body (default: a TODO scaffold to edit later)").option("--no-regen", "skip the agent-files regen after authoring").option("--dry-run", "print what would be authored; write nothing", false).addHelpText(
+    "after",
+    `
+The memo carries the two conventions a workspace-conventions section needs (FR-sechroom-236):
+the \`agent-setup-bundle\` tag + the \`# Header\` as the FIRST body line. It's authored in the
+BOUND workspace (so the regen, which sources conventions from there, picks it up). Edit it later
+in the app or via \`sechroom memory edit-text\`.
+
+Examples:
+  $ sechroom setup new-convention "Deploy runbook"
+  $ sechroom setup new-convention "Backend testing" --kind standard --body "- run dotnet test ..."
+  $ sechroom setup new-convention "Draft section" --no-regen   author only, regen later`
+  ).action(async (titleParts, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const json = Boolean(cmd.optsWithGlobals().json);
+    const title = titleParts.join(" ").trim();
+    if (!title) fail('a section title is required, e.g. `sechroom setup new-convention "Deploy runbook"`.');
+    const workspaceId = opts.workspace ?? cfg.workspaceId;
+    if (!workspaceId)
+      fail("no workspace \u2014 pass --workspace <id> or bind one (`sechroom config set --local workspaceId <id>`).");
+    const kind = String(opts.kind).toLowerCase() === "standard" ? "standard" : "reference";
+    const body = typeof opts.body === "string" && opts.body.trim().length > 0 ? opts.body.trim() : "_TODO: write this section, then edit the memo and re-run the regen._";
+    const text = `# ${title}
+
+${body}
+`;
+    const tags = ["agent-setup-bundle", "scope:sechroom", `kind:${kind}`, "archetype:document"];
+    if (opts.dryRun) {
+      emit({ dryRun: true, workspaceId, title, kind, tags, text }, json);
+      return;
+    }
+    const data = await runApi("Authoring convention memo", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/memories", {
+        body: {
+          text,
+          type: kind,
+          content: "{}",
+          confidence: 1,
+          source: "cli-new-convention",
+          archetype: "Document",
+          title,
+          tags,
+          owner: { type: "Workspace", id: workspaceId }
+        }
+      });
+    });
+    if (!json) {
+      const view = resolveViewUrl(cfg.baseUrl, data.url);
+      process.stdout.write(
+        `\u2713 authored convention ${style.bold(data.id)} ${style.dim(`"${title}"`)}${view ? ` ${style.dim("\u2192")} ${view}` : ""}
+`
+      );
+    }
+    if (opts.regen === false) {
+      if (json) emit({ id: data.id, workspaceId, regen: false }, true);
+      else process.stdout.write("Skipped regen (--no-regen). Run `sechroom setup agent-files all` to apply.\n");
+      return;
+    }
+    await runClients(["claude-code", "codex"], cmd, {
+      dryRun: false,
+      mcp: false,
+      agentFiles: true,
+      copy: false,
+      mode: "apply"
+    });
   });
 }
 async function runClients(clients, cmd, opts) {
   const cfg = resolveConfig(cmd.optsWithGlobals());
+  const mode = opts.mode ?? "apply";
+  const check = mode === "check";
   const targets = clientTargets(process.cwd());
   const keys = resolveClientKeys(clients.join(","));
-  const setupData = await withSpinner("Fetching setup descriptors", () => fetchSetup(cfg));
+  const namespaceSlug = opts.mcp ? await resolveNamespaceChoice(cfg, opts.namespace) : null;
+  const setupData = await withSpinner(
+    "Fetching setup descriptors",
+    () => fetchSetup(cfg, namespaceSlug ?? void 0)
+  );
   const personalWorkspaceId = await getPersonalWorkspaceId(cfg);
-  if (opts.agentFiles && !opts.dryRun) {
+  if (opts.agentFiles && !opts.dryRun && !check) {
     await maybeOfferCopies(cfg, setupData, targets, keys, personalWorkspaceId, copyChoice(opts));
   }
   const json = cmd.optsWithGlobals().json;
@@ -3268,11 +3609,13 @@ async function runClients(clients, cmd, opts) {
       dryRun: opts.dryRun,
       mcp: opts.mcp,
       agentFiles: opts.agentFiles,
-      personalWorkspaceId
+      personalWorkspaceId,
+      mode
     });
     result.push({ client: key, actions });
-    if (!json) printActions(target, actions);
+    if (!json && !check) printActions(target, actions);
   }
+  summarizeEval(result, mode, Boolean(json), opts.dryRun);
   if (json) {
     emit({ dryRun: opts.dryRun, clients: result }, true);
     return;
@@ -3280,14 +3623,81 @@ async function runClients(clients, cmd, opts) {
   process.stdout.write(opts.dryRun ? "\n(dry run \u2014 nothing written)\n" : "\nDone.\n");
 }
 
+// src/commands/namespace.ts
+function registerNamespace(program2) {
+  const namespace = program2.command("namespace").description("Browse, inspect, and wire up MCP namespaces");
+  namespace.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom namespace list
+  $ sechroom namespace show eng
+  $ sechroom namespace use eng                 wire Claude Code to the 'eng' namespace
+  $ sechroom namespace use eng --client all`
+  );
+  namespace.command("list").description("List the namespaces you can reach (GET /mcp-aggregator/namespaces)").action(async (_opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Listing namespaces", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/mcp-aggregator/namespaces", {});
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  namespace.command("show <slug>").description("Show a namespace's details (GET /mcp-aggregator/namespaces/{slug}). For the tool list it exposes, point an OpenAPI client at /t/{tenant}/namespaces/{slug}/api/openapi.json.").action(async (slug, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Fetching namespace", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/mcp-aggregator/namespaces/{slug}", {
+        params: { path: { slug } }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  namespace.command("use <slug>").description("Wire an AI client's MCP config to this namespace's URL").option(
+    "--client <list>",
+    `comma-separated clients (${ALL_CLIENT_KEYS.join(", ")}) or 'all'`,
+    DEFAULT_CLIENT_KEY
+  ).option("--dry-run", "print what would be written without writing", false).action(async (slug, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const setup = await withSpinner(
+      "Fetching setup descriptors",
+      () => fetchSetup(cfg, slug)
+    );
+    const targets = clientTargets(process.cwd());
+    const keys = resolveClientKeys(opts.client);
+    const json = cmd.optsWithGlobals().json;
+    const result = [];
+    for (const key of keys) {
+      const target = targets[key];
+      const actions = await applyClient(cfg, setup, target, {
+        dryRun: Boolean(opts.dryRun),
+        mcp: true,
+        agentFiles: false,
+        personalWorkspaceId: null
+      });
+      result.push({ client: key, actions });
+      if (!json) printActions(target, actions);
+    }
+    if (json) {
+      emit({ namespace: slug, dryRun: Boolean(opts.dryRun), clients: result }, true);
+      return;
+    }
+    process.stdout.write(
+      opts.dryRun ? "\n(dry run \u2014 nothing written)\n" : `
+Wired to namespace '${slug}'. Restart your AI client (or reload MCP) to pick it up.
+`
+    );
+  });
+}
+
 // src/commands/onboard.ts
 import { existsSync as existsSync8 } from "fs";
-import { basename as basename3, join as join8 } from "path";
+import { basename as basename3, join as join9 } from "path";
 
 // src/commands/fanout.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
-import { isAbsolute, join as join7, resolve } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
+import { isAbsolute, join as join8, resolve } from "path";
 var ICON = {
   refresh: "\u21BB",
   bind: "+",
@@ -3307,13 +3717,13 @@ function discoverChildren(root) {
   const out = [];
   for (const name of names.sort()) {
     if (name.startsWith(".") || name === "node_modules") continue;
-    const dir = join7(root, name);
+    const dir = join8(root, name);
     try {
-      if (!statSync2(dir).isDirectory()) continue;
+      if (!statSync3(dir).isDirectory()) continue;
     } catch {
       continue;
     }
-    if (existsSync7(join7(dir, ".git")) || committedBindingPath(dir)) out.push(name);
+    if (existsSync7(join8(dir, ".git")) || committedBindingPath(dir)) out.push(name);
   }
   return out;
 }
@@ -3689,7 +4099,7 @@ async function planRecurseChild(entry, root, client, opts) {
   if (!existsSync8(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
-  if (existsSync8(join8(dir, ".sechroom.json"))) {
+  if (existsSync8(join9(dir, ".sechroom.json"))) {
     return {
       label: entry.path,
       dir,
@@ -3762,7 +4172,7 @@ This fan-out will pin the same lane in every repo:
 async function runRecurse(cfg, g, opts) {
   const { yes, dryRun, json } = opts;
   const root = process.cwd();
-  const manifestPath = join8(root, ".sechroom", "repos.json");
+  const manifestPath = join9(root, ".sechroom", "repos.json");
   const fromManifest = readManifest(manifestPath);
   const entries = fromManifest ?? discoverChildren(root).map((path) => ({ path }));
   const sourceLabel = fromManifest ? `manifest ${manifestPath}` : `auto-discovered under ${root}`;
@@ -3977,8 +4387,8 @@ async function printStarterPrompt(mode, cfg) {
 
 // src/commands/sweep.ts
 import { existsSync as existsSync9 } from "fs";
-import { dirname as dirname6, join as join9, resolve as resolve2 } from "path";
-var DEFAULT_MANIFEST = join9(".sechroom", "repos.json");
+import { dirname as dirname7, join as join10, resolve as resolve2 } from "path";
+var DEFAULT_MANIFEST = join10(".sechroom", "repos.json");
 function planEntry(entry, root) {
   const dir = resolveChildDir(entry.path, root);
   if (!existsSync9(dir)) {
@@ -4057,7 +4467,7 @@ Examples:
 `);
       return;
     }
-    const root = dirname6(dirname6(manifestPath));
+    const root = dirname7(dirname7(manifestPath));
     const plans = repos.map((entry) => planEntry(entry, root));
     if (!json) {
       process.stderr.write(
@@ -4075,7 +4485,7 @@ Examples:
 }
 
 // src/commands/skills.ts
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 import { existsSync as existsSync10, rmSync as rmSync2 } from "fs";
 
 // src/commands/lane.ts
@@ -4164,10 +4574,10 @@ To install/refresh skills, run 'sechroom onboard' (it offers to materialise them
     const dir = skillsDir(!opts.local);
     const lock = readSkillsLock(dir);
     const entry = lock[slug];
-    if (!entry) fail(`No materialised skills recorded for '${slug}' in ${join10(dir, SKILLS_LOCK)}.`);
+    if (!entry) fail(`No materialised skills recorded for '${slug}' in ${join11(dir, SKILLS_LOCK)}.`);
     const removed = [];
     for (const name of entry.skills) {
-      const skillPath = join10(dir, name);
+      const skillPath = join11(dir, name);
       if (existsSync10(skillPath)) {
         rmSync2(skillPath, { recursive: true, force: true });
         removed.push(name);
@@ -4250,22 +4660,22 @@ To install/refresh skills, run 'sechroom onboard' (it offers to materialise them
 
 // src/commands/reset.ts
 import { homedir as homedir6 } from "os";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 import { existsSync as existsSync11, readFileSync as readFileSync7, rmSync as rmSync3 } from "fs";
 var SKILLS_LOCK2 = ".sechroom-skills.json";
-var localSkillsDir = () => join11(process.cwd(), ".claude", "skills");
-var globalSkillsDir = () => join11(homedir6(), ".claude", "skills");
-var localAgentsDir = () => join11(process.cwd(), ".claude", "agents");
-var globalAgentsDir = () => join11(homedir6(), ".claude", "agents");
+var localSkillsDir = () => join12(process.cwd(), ".claude", "skills");
+var globalSkillsDir = () => join12(homedir6(), ".claude", "skills");
+var localAgentsDir = () => join12(process.cwd(), ".claude", "agents");
+var globalAgentsDir = () => join12(homedir6(), ".claude", "agents");
 function removeMaterialisedSkills(dir) {
   const removed = [];
-  const lockPath = join11(dir, SKILLS_LOCK2);
+  const lockPath = join12(dir, SKILLS_LOCK2);
   if (!existsSync11(lockPath)) return removed;
   try {
     const lock = JSON.parse(readFileSync7(lockPath, "utf8"));
     for (const entry of Object.values(lock)) {
       for (const name of entry.skills ?? []) {
-        const p = join11(dir, name);
+        const p = join12(dir, name);
         if (existsSync11(p)) {
           rmSync3(p, { recursive: true, force: true });
           removed.push(p);
@@ -4311,17 +4721,17 @@ function registerReset(program2) {
       }
     }
     const removed = [];
-    const stateDir = join11(process.cwd(), ".sechroom");
+    const stateDir = join12(process.cwd(), ".sechroom");
     if (existsSync11(stateDir)) {
       rmSync3(stateDir, { recursive: true, force: true });
       removed.push(stateDir);
     }
-    const legacyCfg = join11(process.cwd(), ".sechroom.json");
+    const legacyCfg = join12(process.cwd(), ".sechroom.json");
     if (existsSync11(legacyCfg)) {
       rmSync3(legacyCfg, { force: true });
       removed.push(legacyCfg);
     }
-    const legacySem = join11(process.cwd(), ".sem");
+    const legacySem = join12(process.cwd(), ".sem");
     if (existsSync11(legacySem)) {
       rmSync3(legacySem, { force: true });
       removed.push(legacySem);
@@ -4463,12 +4873,14 @@ registerWorkspace(program);
 registerProject(program);
 registerFiling(program);
 registerContinuity(program);
+registerCheckpoint(program);
 registerHook(program);
 registerId(program);
 registerAccount(program);
 registerChat(program);
 registerInit(program);
 registerSetup(program);
+registerNamespace(program);
 registerOnboard(program);
 registerSweep(program);
 registerSkills(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.6.30",
+  "version": "2026.6.31",
   "description": "Sechroom CLI — a thin, generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.",
   "type": "module",
   "license": "UNLICENSED",