@sechroom/cli 2026.6.32-rc.925b06e7 → 2026.6.32

package/dist/index.js

@@ -1773,14 +1773,19 @@ Examples:
   });
 }
 
+// src/commands/checkpoint.ts
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname5, join as join5 } from "path";
+
 // src/commands/hook.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, statSync as statSync2, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir3 } from "os";
 import { delimiter, dirname as dirname4, join as join4 } from "path";
 
 // src/sem.ts
 import { basename as basename2, dirname as dirname2, join as join2 } from "path";
-import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync2, statSync, writeFileSync as writeFileSync2 } from "fs";
 var SEM_FILE = join2(".sechroom", "lane.json");
 var LEGACY_SEM_FILE = ".sem";
 var STATE_DIR_NAME2 = ".sechroom";
@@ -1799,6 +1804,43 @@ function resolveSemPathForRead(start = process.cwd()) {
     dir = parent;
   }
 }
+function applyWorktreeLaneSuffix(lane, start = process.cwd()) {
+  try {
+    let dir = start;
+    let gitPath;
+    for (; ; ) {
+      const candidate = join2(dir, ".git");
+      if (existsSync2(candidate)) {
+        gitPath = candidate;
+        break;
+      }
+      const parent = dirname2(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+    if (!gitPath || statSync(gitPath).isDirectory()) return lane;
+    const gitFile = readFileSync2(gitPath, "utf8");
+    const common = gitFile.trim().match(/^gitdir:\s*(.+)\/worktrees\/[^/\s]+\s*$/);
+    if (!common) return lane;
+    const worktreesDir = join2(common[1], "worktrees");
+    const siblings = readdirSync(worktreesDir).filter((n) => {
+      try {
+        return statSync(join2(worktreesDir, n)).isDirectory();
+      } catch {
+        return false;
+      }
+    });
+    return laneWithWorktreeSuffix(lane, gitFile, siblings);
+  } catch {
+    return lane;
+  }
+}
+function laneWithWorktreeSuffix(lane, gitFile, siblings) {
+  const m = gitFile.trim().match(/\/worktrees\/([^/\s]+)\s*$/);
+  if (!m) return lane;
+  const idx = [...siblings].sort().indexOf(m[1]);
+  return idx < 0 ? lane : `${lane}-${idx + 2}`;
+}
 function parseSem(text) {
   const out = {};
   for (const raw of text.split("\n")) {
@@ -1910,15 +1952,25 @@ var SectionType = {
    *  carried a workspaceId and that workspace has agent-setup-bundle memories. */
   WorkspaceConventions: "workspace-conventions"
 };
-async function fetchSetup(cfg) {
+async function fetchSetup(cfg, namespaceSlug) {
   const client = await makeClient(cfg);
+  const query = {};
+  if (cfg.workspaceId) query.workspaceId = cfg.workspaceId;
+  if (namespaceSlug) query.namespaceSlug = namespaceSlug;
+  const hasQuery = query.workspaceId !== void 0 || query.namespaceSlug !== void 0;
   const { data, error } = await client.GET(
     "/operator-surface/setup",
-    cfg.workspaceId ? { params: { query: { workspaceId: cfg.workspaceId } } } : {}
+    hasQuery ? { params: { query } } : {}
   );
   if (error) throw new Error(`GET /operator-surface/setup failed: ${JSON.stringify(error)}`);
   return data;
 }
+async function listNamespaces(cfg) {
+  const client = await makeClient(cfg);
+  const { data } = await client.GET("/mcp-aggregator/namespaces", {});
+  const rows = data ?? [];
+  return rows.filter((r) => typeof r.slug === "string").map((r) => ({ slug: r.slug, displayName: r.displayName ?? r.slug }));
+}
 function findSurface(setup, surfaceKey) {
   return setup.surfaces.find((s) => s.surfaceKey === surfaceKey);
 }
@@ -1989,12 +2041,14 @@ async function resolveWorkspaceConventions(cfg, section) {
     if (parseTagArtifactId(artifact.id)) continue;
     const mem = await fetchMemoryFields(cfg, artifact.id);
     if (typeof mem?.text === "string" && mem.text.trim().length > 0) {
-      parts.push(mem.text.trim());
-      refs.push(`${artifact.id}@v${mem.version ?? 1}`);
+      const ref = `${artifact.id}@v${mem.version ?? 1}`;
+      parts.push(`<!-- @sechroom/cli:section source=${ref} -->
+${mem.text.trim()}`);
+      refs.push(ref);
     }
   }
   if (parts.length === 0) return null;
-  return { body: parts.join("\n\n---\n\n"), refs };
+  return { body: parts.join("\n\n"), refs };
 }
 async function createOverride(cfg, template, personalWorkspaceId) {
   const client = await makeClient(cfg);
@@ -2090,8 +2144,9 @@ function resolveLane(flagLane, cwd) {
   const env = process.env.SECHROOM_LANE;
   if (env) return env;
   const start = cwd ?? process.cwd();
-  const sem = readSem(resolveSemPathForRead(start));
-  return sem?.values["code-lane"];
+  const base = readSem(resolveSemPathForRead(start))?.values["code-lane"];
+  if (!base) return void 0;
+  return applyWorktreeLaneSuffix(base, start);
 }
 var INTENT_FILE = join4(".sechroom", "continuity.json");
 function resolveIntentPath(start) {
@@ -2118,6 +2173,102 @@ function hasRequiredIntent(i) {
     i.objective?.trim() && i.state?.trim() && i.lastAction?.trim() && i.nextAction?.trim() && i.resumeInstruction?.trim()
   );
 }
+async function saveSnapshotFromIntent(cmd, cwd, laneFlag, scopeFlag, defaultScope, opts) {
+  const lane = resolveLane(laneFlag, cwd);
+  if (!lane) return false;
+  const intent = readIntent(cwd);
+  if (!intent || !hasRequiredIntent(intent)) return false;
+  if (opts?.skipIfUnchanged && unchangedSinceLastPush(cwd, intent)) return false;
+  const cfg = resolveConfig(cmd.optsWithGlobals());
+  const client = await makeClient(cfg);
+  await client.POST("/continuity/snapshots", {
+    body: {
+      laneId: lane,
+      scope: scopeFlag ?? intent.scope ?? defaultScope,
+      currentObjective: intent.objective,
+      currentState: intent.state,
+      lastMeaningfulAction: intent.lastAction,
+      nextIntendedAction: intent.nextAction,
+      resumeInstruction: intent.resumeInstruction,
+      activeConstraints: intent.constraints ?? null,
+      openQuestions: intent.questions ?? null,
+      surfaceMarkers: intent.surfaceMarkers ?? null,
+      relevantArtifactIds: intent.artifacts ?? null,
+      confidence: intent.confidence ?? null,
+      // Frequent triggers (compaction, session-end) land within the FR-051 4h
+      // window; Acknowledge lets the checkpoint persist on the lane.
+      concurrentSessionPolicy: "Acknowledge"
+    }
+  });
+  recordPush(cwd, intent);
+  return true;
+}
+function ledgerPath(start) {
+  const intent = resolveIntentPath(start);
+  const dir = intent ? dirname4(intent) : join4(start, ".sechroom");
+  return join4(dir, ".checkpoint-state.json");
+}
+function readLedger(start) {
+  try {
+    const p = ledgerPath(start);
+    if (!existsSync4(p)) return {};
+    return JSON.parse(readFileSync3(p, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function intentHash(i) {
+  const canonical = JSON.stringify({
+    objective: i.objective ?? "",
+    state: i.state ?? "",
+    lastAction: i.lastAction ?? "",
+    nextAction: i.nextAction ?? "",
+    resumeInstruction: i.resumeInstruction ?? "",
+    scope: i.scope ?? "",
+    constraints: i.constraints ?? [],
+    questions: i.questions ?? [],
+    surfaceMarkers: i.surfaceMarkers ?? [],
+    artifacts: i.artifacts ?? [],
+    confidence: i.confidence ?? null
+  });
+  return createHash2("sha256").update(canonical, "utf8").digest("hex");
+}
+function recentlyCheckpointed(start, minutes) {
+  const { lastEpochMs } = readLedger(start);
+  return typeof lastEpochMs === "number" && Date.now() - lastEpochMs < minutes * 6e4;
+}
+function unchangedSinceLastPush(start, intent) {
+  const ledger = readLedger(start);
+  if (ledger.lastHash == null) return false;
+  const path = resolveIntentPath(start);
+  if (path && ledger.lastMtimeMs != null) {
+    try {
+      if (statSync2(path).mtimeMs <= ledger.lastMtimeMs) return true;
+    } catch {
+    }
+  }
+  return intentHash(intent) === ledger.lastHash;
+}
+function recordPush(start, intent) {
+  try {
+    const p = ledgerPath(start);
+    const path = resolveIntentPath(start);
+    let mtimeMs;
+    try {
+      if (path) mtimeMs = statSync2(path).mtimeMs;
+    } catch {
+      mtimeMs = void 0;
+    }
+    mkdirSync3(dirname4(p), { recursive: true });
+    const ledger = {
+      lastEpochMs: Date.now(),
+      lastMtimeMs: mtimeMs,
+      lastHash: intentHash(intent)
+    };
+    writeFileSync3(p, JSON.stringify(ledger) + "\n");
+  } catch {
+  }
+}
 function formatContext(bundle, lane) {
   const s = bundle?.latestSnapshot;
   if (!s) return null;
@@ -2154,20 +2305,23 @@ function emitSessionStart(additionalContext) {
     }) + "\n"
   );
 }
-var HOOK_COMMANDS = {
+var CLAUDE_HOOK_COMMANDS = {
+  SessionStart: "sechroom hook session-start",
+  PreCompact: "sechroom hook pre-compact",
+  SessionEnd: "sechroom hook session-end"
+};
+var CODEX_HOOK_COMMANDS = {
   SessionStart: "sechroom hook session-start",
-  PreCompact: "sechroom hook pre-compact"
+  Stop: "sechroom hook session-end --debounce-minutes 10"
 };
-var HOOK_EVENTS = ["SessionStart", "PreCompact"];
 function hasHookCommand(config2, event, command) {
   const groups = config2.hooks?.[event] ?? [];
   return groups.some((g) => (g.hooks ?? []).some((h) => h.type === "command" && h.command === command));
 }
-function mergeHooks(config2) {
+function mergeHooks(config2, commands) {
   config2.hooks ??= {};
   let added = 0;
-  for (const event of HOOK_EVENTS) {
-    const command = HOOK_COMMANDS[event];
+  for (const [event, command] of Object.entries(commands)) {
     if (hasHookCommand(config2, event, command)) continue;
     const groups = config2.hooks[event] ??= [];
     groups.push({ hooks: [{ type: "command", command }] });
@@ -2181,10 +2335,10 @@ function readJsonConfig2(path) {
   if (!raw.trim()) return {};
   return JSON.parse(raw);
 }
-function installHooksJson(path, dryRun) {
+function installHooksJson(path, commands, dryRun) {
   const existed = existsSync4(path) && readFileSync3(path, "utf8").trim().length > 0;
   const config2 = readJsonConfig2(path);
-  const added = mergeHooks(config2);
+  const added = mergeHooks(config2, commands);
   if (added === 0 && existed) return { path, status: "current" };
   if (!dryRun) {
     mkdirSync3(dirname4(path), { recursive: true });
@@ -2245,9 +2399,9 @@ function installHookSurfaces(surfaces, opts) {
   for (const surface of surfaces) {
     if (surface === "claude") {
       const path = opts.local ? join4(opts.cwd, ".claude", "settings.json") : join4(opts.home, ".claude", "settings.json");
-      out.push({ surface, results: [installHooksJson(path, opts.dryRun)] });
+      out.push({ surface, results: [installHooksJson(path, CLAUDE_HOOK_COMMANDS, opts.dryRun)] });
     } else {
-      const hooksJson = installHooksJson(join4(opts.home, ".codex", "hooks.json"), opts.dryRun);
+      const hooksJson = installHooksJson(join4(opts.home, ".codex", "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
       const featureFlag = installCodexFeatureFlag(join4(opts.home, ".codex", "config.toml"), opts.dryRun);
       out.push({ surface, results: [hooksJson, featureFlag] });
     }
@@ -2327,31 +2481,23 @@ Fail-soft: no lane / no auth / no-or-partial intent file / API error -> exit 0,
       const raw = await readStdin();
       const input = parseHookInput(raw);
       const cwd = input.cwd ?? process.cwd();
-      const lane = resolveLane(opts.lane, input.cwd);
-      if (!lane) return process.exit(0);
-      const intent = readIntent(cwd);
-      if (!intent || !hasRequiredIntent(intent)) return process.exit(0);
-      const cfg = resolveConfig(cmd.optsWithGlobals());
-      const client = await makeClient(cfg);
-      await client.POST("/continuity/snapshots", {
-        body: {
-          laneId: lane,
-          scope: opts.scope ?? intent.scope ?? "compaction",
-          currentObjective: intent.objective,
-          currentState: intent.state,
-          lastMeaningfulAction: intent.lastAction,
-          nextIntendedAction: intent.nextAction,
-          resumeInstruction: intent.resumeInstruction,
-          activeConstraints: intent.constraints ?? null,
-          openQuestions: intent.questions ?? null,
-          surfaceMarkers: intent.surfaceMarkers ?? null,
-          relevantArtifactIds: intent.artifacts ?? null,
-          confidence: intent.confidence ?? null,
-          // Compaction is infrequent, so the FR-051 clobber guard doesn't bite;
-          // Acknowledge lets a within-window checkpoint land on the lane.
-          concurrentSessionPolicy: "Acknowledge"
-        }
-      });
+      await saveSnapshotFromIntent(cmd, cwd, opts.lane, opts.scope, "compaction", { skipIfUnchanged: true });
+      return process.exit(0);
+    } catch {
+      return process.exit(0);
+    }
+  });
+  hook.command("session-end").description("Save a continuity snapshot from the intent file on a SessionEnd (Claude) / Stop (Codex) hook").option("--lane <laneId>", "Override the resolved lane (else SECHROOM_LANE, else ./.sem code-lane)").option("--scope <scope>", "Snapshot scope (else the intent file's `scope`, else 'session-end')").option("--surface <surface>", "Target surface: claude | codex (lifecycle-only on both)", "claude").option(
+    "--debounce-minutes <n>",
+    "skip if a hook checkpoint ran within this many minutes \u2014 for high-frequency triggers like Codex Stop (Claude SessionEnd passes none)"
+  ).action(async (opts, cmd) => {
+    try {
+      const raw = await readStdin();
+      const input = parseHookInput(raw);
+      const cwd = input.cwd ?? process.cwd();
+      const debounce = opts.debounceMinutes != null ? Number(opts.debounceMinutes) : 0;
+      if (debounce > 0 && recentlyCheckpointed(cwd, debounce)) return process.exit(0);
+      await saveSnapshotFromIntent(cmd, cwd, opts.lane, opts.scope, "session-end", { skipIfUnchanged: true });
       return process.exit(0);
     } catch {
       return process.exit(0);
@@ -2396,6 +2542,101 @@ Fail-soft: no lane / no auth / no-or-partial intent file / API error -> exit 0,
   });
 }
 
+// src/commands/checkpoint.ts
+function registerCheckpoint(program2) {
+  program2.command("checkpoint").description(
+    "Checkpoint working state: create a continuity snapshot (server-validated) AND sync ./.sechroom/continuity.json in one step"
+  ).option("--lane <laneId>", "Lane id (else SECHROOM_LANE, else ./.sem code-lane)").option("--scope <scope>", "Snapshot scope (else the file's scope, else 'session')").option("--objective <text>", "Current objective").option("--state <text>", "Current state").option("--last-action <text>", "Last meaningful action").option("--next-action <text>", "Next intended action").option("--resume-instruction <text>", "Resume instruction").option("--constraint <text...>", "Active constraints (repeatable)").option("--question <text...>", "Open questions (repeatable)").option("--surface-marker <text...>", "Surface markers (repeatable)").option("--artifact <id...>", "Relevant artifact ids (repeatable)").option("--confidence <n>", "Confidence 0..1").option("--dry-run", "validate + print the snapshot payload without creating it or writing the file", false).addHelpText(
+    "after",
+    `
+File-first: reads ./.sechroom/continuity.json (kept current as you work) as the base; any flag
+overrides that field. The snapshot is created FIRST (server-validated), then the local file is
+written/normalized with the returned snapshotId. Lane: --lane > SECHROOM_LANE > ./.sem code-lane.
+
+Examples:
+  $ sechroom checkpoint                          snapshot from ./.sechroom/continuity.json, then sync it
+  $ sechroom checkpoint --next-action "..."      override one field, keep the rest from the file
+  $ sechroom checkpoint --lane claude-code-chris --objective "..." --state "..." \\
+      --last-action "..." --next-action "..." --resume-instruction "..."`
+  ).action(async (opts, cmd) => {
+    const cwd = process.cwd();
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const json = Boolean(cmd.optsWithGlobals().json);
+    const base = readIntent(cwd) ?? {};
+    const merged = {
+      objective: opts.objective ?? base.objective,
+      state: opts.state ?? base.state,
+      lastAction: opts.lastAction ?? base.lastAction,
+      nextAction: opts.nextAction ?? base.nextAction,
+      resumeInstruction: opts.resumeInstruction ?? base.resumeInstruction,
+      scope: opts.scope ?? base.scope,
+      constraints: opts.constraint ?? base.constraints,
+      questions: opts.question ?? base.questions,
+      surfaceMarkers: opts.surfaceMarker ?? base.surfaceMarkers,
+      artifacts: opts.artifact ?? base.artifacts,
+      confidence: opts.confidence != null ? Number(opts.confidence) : base.confidence
+    };
+    const lane = resolveLane(opts.lane, cwd);
+    if (!lane) {
+      fail(
+        "no lane resolved \u2014 pass --lane, set SECHROOM_LANE, or pin one in ./.sem (code-lane). See `sechroom lane`."
+      );
+    }
+    const required = [
+      ["objective", "--objective"],
+      ["state", "--state"],
+      ["lastAction", "--last-action"],
+      ["nextAction", "--next-action"],
+      ["resumeInstruction", "--resume-instruction"]
+    ];
+    const missing = required.filter(([k]) => !String(merged[k] ?? "").trim()).map(([, flag]) => flag);
+    if (missing.length > 0) {
+      fail(
+        `missing required field(s): ${missing.join(", ")} \u2014 supply via flag or in ./.sechroom/continuity.json`
+      );
+    }
+    const scope = merged.scope ?? "session";
+    const body = {
+      laneId: lane,
+      scope,
+      currentObjective: merged.objective,
+      currentState: merged.state,
+      lastMeaningfulAction: merged.lastAction,
+      nextIntendedAction: merged.nextAction,
+      resumeInstruction: merged.resumeInstruction,
+      activeConstraints: merged.constraints ?? null,
+      openQuestions: merged.questions ?? null,
+      surfaceMarkers: merged.surfaceMarkers ?? null,
+      relevantArtifactIds: merged.artifacts ?? null,
+      confidence: merged.confidence ?? null,
+      // Explicit checkpoints are often within the FR-051 4h window; Acknowledge
+      // lets one land on the lane (matches `hook pre-compact`).
+      concurrentSessionPolicy: "Acknowledge"
+    };
+    if (opts.dryRun) {
+      emit({ dryRun: true, lane, scope, wouldCreate: body }, json);
+      return;
+    }
+    const data = await runApi("Creating snapshot", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/continuity/snapshots", { body });
+    });
+    const path = resolveIntentPath(cwd) ?? join5(cwd, INTENT_FILE);
+    const fileBody = { ...merged, scope, lastSnapshotId: data.snapshotId };
+    mkdirSync4(dirname5(path), { recursive: true });
+    writeFileSync4(path, JSON.stringify(fileBody, null, 2) + "\n");
+    recordPush(cwd, merged);
+    if (json) {
+      emit({ snapshotId: data.snapshotId, lane, scope, file: path }, true);
+      return;
+    }
+    process.stdout.write(
+      `${style.bold("\u2713")} checkpoint ${style.bold(data.snapshotId)} ${style.dim(`(lane ${lane}, scope ${scope})`)} \u2014 synced ${path}
+`
+    );
+  });
+}
+
 // src/commands/account.ts
 function registerId(program2) {
   const id = program2.command("id").description("Allocate human-authored id sequences (FR-*, D-*)");
@@ -2612,16 +2853,16 @@ Examples:
 }
 
 // src/setup/apply.ts
-import { createHash as createHash2 } from "crypto";
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync5 } from "fs";
-import { dirname as dirname5 } from "path";
+import { createHash as createHash3 } from "crypto";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync5, existsSync as existsSync5 } from "fs";
+import { dirname as dirname6 } from "path";
 var MARKER_BEGIN = "<!-- @sechroom/cli:begin";
 var MARKER_END = "<!-- @sechroom/cli:end";
 function normalizeBody(s) {
   return s.replace(/\r\n/g, "\n").trim();
 }
 function bodySha256(body) {
-  return createHash2("sha256").update(normalizeBody(body), "utf8").digest("hex");
+  return createHash3("sha256").update(normalizeBody(body), "utf8").digest("hex");
 }
 function renderBlock(write) {
   const body = normalizeBody(write.body);
@@ -2667,7 +2908,7 @@ function parseManagedBlock(content, block) {
   return null;
 }
 function ensureDir2(path) {
-  mkdirSync4(dirname5(path), { recursive: true });
+  mkdirSync5(dirname6(path), { recursive: true });
 }
 function readOr(path, fallback) {
   try {
@@ -2690,7 +2931,7 @@ function mergeMcpJson(path, snippet, dryRun) {
   current.mcpServers = { ...current.mcpServers ?? {}, ...incoming.mcpServers ?? {} };
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync4(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
+  writeFileSync5(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function mergeCodexToml(path, snippet, dryRun) {
@@ -2701,7 +2942,7 @@ function mergeCodexToml(path, snippet, dryRun) {
   const next = (trimmed.length > 0 ? trimmed + "\n\n" : "") + snippet.trim() + "\n";
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync4(path, next, { mode: 384 });
+  writeFileSync5(path, next, { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function writeInstructionBlock(path, write, dryRun) {
@@ -2709,7 +2950,7 @@ function writeInstructionBlock(path, write, dryRun) {
   const next = computeBlockFile(readOr(path, ""), write);
   if (dryRun) return { kind: "instruction", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync4(path, next);
+  writeFileSync5(path, next);
   return { kind: "instruction", path, status: existed ? "merged" : "created" };
 }
 function computeBlockFile(current, write) {
@@ -2750,7 +2991,7 @@ function applyBlock(path, write, mode, dryRun) {
     const next = computeBlockFile(current, write);
     if (!dryRun) {
       ensureDir2(proposedPath);
-      writeFileSync4(proposedPath, next);
+      writeFileSync5(proposedPath, next);
     }
     return {
       kind: "instruction",
@@ -2859,9 +3100,8 @@ auto-resumes where you left off and checkpoints working state before compacting.
 }
 
 // src/setup/skills-offer.ts
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join5 } from "path";
+import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "fs";
+import { join as join7 } from "path";
 
 // src/setup/lane-pin.ts
 var CODE_LANE_PREFIX_BY_CLIENT = {
@@ -2943,57 +3183,157 @@ I can pin this checkout's lane so operator skills + the continuity hook resolve
   writePin(code || void 0, design || void 0);
 }
 
-// src/setup/skills-offer.ts
-var ROLE_TAG = "sechroom:role:skill-template";
+// src/setup/skill-resolution.ts
+var SYSTEM_WORKSPACE_ID = "wsp_system";
+var SKILL_ROLE_TAG = "sechroom:role:skill-template";
+var SKILL_NAME_PREFIX = "skill:";
+var AGENT_ROLE_TAG = "sechroom:role:agent-template";
+var AGENT_NAME_PREFIX = "agent:";
+function tagsOf(row) {
+  const m = row?.item ?? row;
+  return m?.tags ?? m?.Tags ?? [];
+}
 function tagValue(tags, prefix) {
   return tags.find((t) => t.startsWith(prefix))?.slice(prefix.length);
 }
-async function maybeOfferSkills(cfg, personalWorkspaceId, opts) {
-  if (!personalWorkspaceId || opts.dryRun) return;
-  const surface = opts.surface ?? "claude-code";
-  let rows = [];
+function bodyOf(row) {
+  const m = row?.item ?? row;
+  return m?.text ?? m?.Text ?? "";
+}
+function entriesFromRows(rows, surface, source, roleTag, namePrefix) {
+  const out = /* @__PURE__ */ new Map();
+  for (const row of rows ?? []) {
+    const tags = tagsOf(row);
+    if (!tags.includes(roleTag)) continue;
+    if (tagValue(tags, "target:") !== surface) continue;
+    const name = tagValue(tags, namePrefix);
+    if (!name) continue;
+    out.set(name, { name, body: bodyOf(row), source });
+  }
+  return out;
+}
+function resolveByRole(systemRows, personalRows, surface, roleTag, namePrefix) {
+  const merged = entriesFromRows(systemRows, surface, "system", roleTag, namePrefix);
+  for (const [name, item] of entriesFromRows(personalRows, surface, "personal", roleTag, namePrefix)) {
+    merged.set(name, item);
+  }
+  return [...merged.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+function resolveSkills(systemRows, personalRows, surface) {
+  return resolveByRole(systemRows, personalRows, surface, SKILL_ROLE_TAG, SKILL_NAME_PREFIX);
+}
+function resolveAgents(systemRows, personalRows, surface) {
+  return resolveByRole(systemRows, personalRows, surface, AGENT_ROLE_TAG, AGENT_NAME_PREFIX);
+}
+
+// src/setup/skills-lock.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join6 } from "path";
+var SKILLS_LOCK = ".sechroom-skills.json";
+var DEFAULT_SKILLS_SLUG = "operator-skills";
+function skillsDir(global) {
+  return global ? join6(homedir5(), ".claude", "skills") : join6(process.cwd(), ".claude", "skills");
+}
+function agentsDir(global) {
+  return global ? join6(homedir5(), ".claude", "agents") : join6(process.cwd(), ".claude", "agents");
+}
+function readSkillsLock(dir) {
+  const lockPath = join6(dir, SKILLS_LOCK);
+  if (!existsSync6(lockPath)) return {};
+  try {
+    return JSON.parse(readFileSync5(lockPath, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function writeSkillsLock(dir, lock) {
+  mkdirSync6(dir, { recursive: true });
+  writeFileSync6(join6(dir, SKILLS_LOCK), JSON.stringify(lock, null, 2) + "\n");
+}
+function recordMaterialisedSkills(dir, slug, skills, meta = {}) {
+  const lock = readSkillsLock(dir);
+  lock[slug] = { surface: meta.surface, skills: [...skills].sort() };
+  writeSkillsLock(dir, lock);
+}
+
+// src/setup/skills-offer.ts
+async function fetchFeedRows(cfg, workspaceId) {
   try {
     const client = await makeClient(cfg);
     const feed = await client.GET("/workspaces/{workspaceId}/memories/feed", {
       params: {
-        path: { workspaceId: personalWorkspaceId },
+        path: { workspaceId },
+        // cascadeWorkspaces: skills land in an "Operator Skills" SUB-workspace;
+        // includeText: the feed omits bodies by default, we need them for SKILL.md.
         query: { limit: 200, cascadeWorkspaces: true, includeText: true }
       }
     }).then((r) => r.data).catch(() => void 0);
-    rows = feed?.results ?? feed?.Results ?? [];
+    return feed?.results ?? feed?.Results ?? [];
   } catch {
-    return;
+    return [];
   }
-  const skills = rows.map((r) => r.item ?? r).filter((m) => {
-    const tags = m.tags ?? m.Tags ?? [];
-    return tags.includes(ROLE_TAG) && tagValue(tags, "target:") === surface;
-  });
-  if (skills.length === 0) return;
-  const byName = /* @__PURE__ */ new Map();
-  for (const m of skills) {
-    const name = tagValue(m.tags ?? m.Tags ?? [], "skill:");
-    if (name) byName.set(name, m);
+}
+async function maybeOfferSkills(cfg, personalWorkspaceId, opts) {
+  const surface = opts.surface ?? "claude-code";
+  const [systemRows, personalRows] = await Promise.all([
+    fetchFeedRows(cfg, SYSTEM_WORKSPACE_ID),
+    personalWorkspaceId ? fetchFeedRows(cfg, personalWorkspaceId) : Promise.resolve([])
+  ]);
+  const skills = resolveSkills(systemRows, personalRows, surface);
+  const agents = resolveAgents(systemRows, personalRows, surface);
+  if (skills.length === 0 && agents.length === 0) return;
+  const sDir = skillsDir(true);
+  const aDir = agentsDir(true);
+  if (opts.dryRun) {
+    const lines = (label, items) => items.length === 0 ? "" : `
+Would materialise ${style.bold(String(items.length))} ${label} for ${surface}:
+` + items.map((s) => `  ${s.name} ${style.dim(`[${s.source}]`)}`).join("\n") + "\n";
+    process.stderr.write(lines("operator skill(s)", skills) + lines("agent(s)", agents));
+    return;
   }
-  const names = [...byName.keys()].sort();
-  if (names.length === 0) return;
-  process.stderr.write(
-    `
-Found ${style.bold(String(names.length))} operator skill(s) installed in your workspace: ${names.join(", ")}.
-`
-  );
-  const dir = join5(homedir5(), ".claude", "skills");
-  const materialise = opts.yes ? true : canPrompt() ? await promptYesNo(`Write them to ${dir}/ so ${surface} can use them?`) : false;
+  const summary = [
+    skills.length > 0 ? `${style.bold(String(skills.length))} skill(s)` : "",
+    agents.length > 0 ? `${style.bold(String(agents.length))} agent(s)` : ""
+  ].filter(Boolean).join(" + ");
+  process.stderr.write(`
+Found ${summary} available to you for ${surface}.
+`);
+  if (skills.length > 0) process.stderr.write(`  skills: ${skills.map((s) => s.name).join(", ")}
+`);
+  if (agents.length > 0) process.stderr.write(`  agents: ${agents.map((a) => a.name).join(", ")}
+`);
+  const dest = [skills.length > 0 ? `${sDir}/` : "", agents.length > 0 ? `${aDir}/` : ""].filter(Boolean).join(" + ");
+  const materialise = opts.yes ? true : canPrompt() ? await promptYesNo(`Write them to ${dest} so ${surface} can use them?`) : false;
   if (!materialise) return;
-  const written = [];
-  for (const [name, m] of byName) {
-    const body = m.text ?? m.Text ?? "";
-    mkdirSync5(join5(dir, name), { recursive: true });
-    writeFileSync5(join5(dir, name, "SKILL.md"), body.endsWith("\n") ? body : body + "\n");
-    written.push(name);
+  if (skills.length > 0) {
+    const written = [];
+    for (const s of skills) {
+      mkdirSync7(join7(sDir, s.name), { recursive: true });
+      writeFileSync7(join7(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
+      written.push(s.name);
+    }
+    recordMaterialisedSkills(sDir, DEFAULT_SKILLS_SLUG, written, { surface });
+    process.stderr.write(`${style.green("\u2713")} wrote ${written.length} skill(s) to ${sDir}
+`);
   }
-  process.stderr.write(`${style.green("\u2713")} wrote ${written.length} skill(s) to ${dir}
+  if (agents.length > 0) {
+    mkdirSync7(aDir, { recursive: true });
+    const written = [];
+    for (const a of agents) {
+      const file = `${a.name}.md`;
+      writeFileSync7(join7(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
+      written.push(file);
+    }
+    recordMaterialisedSkills(aDir, DEFAULT_SKILLS_SLUG, written, { surface });
+    process.stderr.write(`${style.green("\u2713")} wrote ${written.length} agent(s) to ${aDir}
 `);
-  await ensureLanePin(cfg, { yes: opts.yes, dryRun: opts.dryRun, clients: [surface] });
+  }
+  await ensureLanePin(cfg, {
+    yes: opts.yes,
+    dryRun: opts.dryRun,
+    clients: [surface]
+  });
 }
 
 // src/commands/setup.ts
@@ -3031,14 +3371,14 @@ version, the shared template stays clean, and you can discard back anytime.
 }
 function resolveClientKeys(raw) {
   const targets = clientTargets(process.cwd());
-  if (raw === "all") return [...ALL_CLIENT_KEYS];
-  const keys = raw.split(",").map((k) => k.trim()).filter(Boolean);
-  for (const k of keys) {
+  const tokens = (Array.isArray(raw) ? raw : [raw]).flatMap((t) => t.split(",")).map((k) => k.trim()).filter(Boolean);
+  if (tokens.includes("all")) return [...ALL_CLIENT_KEYS];
+  for (const k of tokens) {
     if (!targets[k]) {
       fail(`unknown client '${k}'. Known: ${ALL_CLIENT_KEYS.join(", ")}, or 'all'.`);
     }
   }
-  return keys;
+  return [...new Set(tokens)];
 }
 function printActions(client, actions) {
   process.stdout.write(`
@@ -3050,24 +3390,87 @@ ${client.label} (${client.key}):
 `);
   }
 }
+function resolveEvalMode(opts) {
+  return opts.check ? "check" : opts.force ? "force" : "apply";
+}
+function summarizeEval(result, mode, json, dryRun) {
+  const counts = { current: 0, stale: 0, drift: 0, absent: 0 };
+  for (const { actions } of result) for (const a of actions) if (a.eval) counts[a.eval]++;
+  const wouldChange = counts.stale + counts.drift + counts.absent;
+  if (mode === "check") {
+    if (!json) {
+      if (wouldChange === 0) {
+        process.stdout.write("\u2713 all instruction blocks are up to date.\n");
+      } else {
+        const bits = [];
+        if (counts.stale) bits.push(`${counts.stale} out of date`);
+        if (counts.drift) bits.push(`${counts.drift} with local edits`);
+        if (counts.absent) bits.push(`${counts.absent} not yet written`);
+        process.stderr.write(
+          `\u26A0 ${wouldChange} instruction block(s) would change: ${bits.join(", ")}. Re-run with ${style.cyan("--refresh")}.
+`
+        );
+      }
+    }
+    process.exit(wouldChange === 0 ? 0 : 1);
+  }
+  if (json) return;
+  if (!dryRun && counts.stale) {
+    process.stderr.write(`\u21BB refreshed ${counts.stale} section(s) the server had moved
+`);
+  }
+  if (!dryRun && counts.drift) {
+    process.stderr.write(
+      mode === "force" ? `\u26A0 overwrote ${counts.drift} section(s) that had local edits (--force)
+` : `\u26A0 ${counts.drift} section(s) have local edits \u2014 wrote a .proposed file alongside (original untouched). Review + merge, or re-run with ${style.cyan("--force")}.
+`
+    );
+  }
+}
+var GLOBAL_NAMESPACE = "__global__";
+async function resolveNamespaceChoice(cfg, flag) {
+  if (flag) return flag;
+  if (!canPrompt()) return null;
+  const namespaces = await listNamespaces(cfg);
+  if (namespaces.length === 0) return null;
+  const picked = await promptSelect(
+    "Which namespace should this connection use?",
+    [
+      { label: "Global (whole tenant)", value: GLOBAL_NAMESPACE },
+      ...namespaces.map((n) => ({
+        label: n.displayName,
+        value: n.slug,
+        hint: n.slug
+      }))
+    ],
+    GLOBAL_NAMESPACE
+  );
+  return picked === GLOBAL_NAMESPACE ? null : picked;
+}
 function registerInit(program2) {
-  program2.command("init").description("Wire this project for sechroom: write MCP config + agent instruction files from the server's setup descriptors").option("--client <list>", `comma-separated clients (${ALL_CLIENT_KEYS.join(", ")}) or 'all'`, DEFAULT_CLIENT_KEY).option("--dry-run", "print what would be written without writing", false).option("--mcp-only", "only write MCP config (skip agent files)", false).option("--agent-files-only", "only write agent instruction files (skip MCP config)", false).option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").addHelpText(
+  program2.command("init").description("Wire this project for sechroom: write MCP config + agent instruction files from the server's setup descriptors").option("--client <list...>", `clients to wire \u2014 space- or comma-separated (${ALL_CLIENT_KEYS.join(", ")}) or 'all'`, DEFAULT_CLIENT_KEY).option("--dry-run", "print what would be written without writing", false).option("--mcp-only", "only write MCP config (skip agent files)", false).option("--agent-files-only", "only write agent instruction files (skip MCP config)", false).option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--namespace <slug>", "MCP namespace for the connection URL (interactive picker if omitted on a TTY; defaults to tenant-global)").option("--refresh", "refresh out-of-date agent-file blocks in place (local edits preserved to .proposed)", false).option("--force", "rewrite agent-file managed blocks, overwriting local edits inside the markers", false).option("--check", "report whether agent files would change and exit (0 = current, 1 = stale/drift/absent); writes nothing", false).addHelpText(
     "after",
     `
 Examples:
   $ sechroom init                       Claude Code (default): ./.mcp.json + ./CLAUDE.md
   $ sechroom init --client all          claude-code, claude-desktop, codex, cursor
-  $ sechroom init --client codex,cursor
+  $ sechroom init --client codex cursor   space-separated (comma also works)
   $ sechroom init --mcp-only            just the MCP config (skip agent files)
   $ sechroom init --dry-run --json      preview the writes, change nothing`
   ).action(async (opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const setup = await withSpinner("Fetching setup descriptors", () => fetchSetup(cfg));
+    const mode = resolveEvalMode(opts);
+    const check = mode === "check";
+    const namespaceSlug = await resolveNamespaceChoice(cfg, opts.namespace);
+    const setup = await withSpinner(
+      "Fetching setup descriptors",
+      () => fetchSetup(cfg, namespaceSlug ?? void 0)
+    );
     const targets = clientTargets(process.cwd());
     const keys = resolveClientKeys(opts.client);
     const json = cmd.optsWithGlobals().json;
     const personalWorkspaceId = await getPersonalWorkspaceId(cfg);
-    if (!opts.dryRun && !opts.mcpOnly) {
+    if (!opts.dryRun && !opts.mcpOnly && !check) {
       await maybeOfferCopies(cfg, setup, targets, keys, personalWorkspaceId, copyChoice(opts));
     }
     const result = [];
@@ -3077,11 +3480,13 @@ Examples:
         dryRun: Boolean(opts.dryRun),
         mcp: !opts.agentFilesOnly,
         agentFiles: !opts.mcpOnly,
-        personalWorkspaceId
+        personalWorkspaceId,
+        mode
       });
       result.push({ client: key, actions });
-      if (!json) printActions(target, actions);
+      if (!json && !check) printActions(target, actions);
     }
+    summarizeEval(result, mode, Boolean(json), Boolean(opts.dryRun));
     if (!json && !opts.dryRun && !opts.mcpOnly) {
       await maybeOfferSkills(cfg, personalWorkspaceId, { yes: false, dryRun: Boolean(opts.dryRun), surface: "claude-code" });
     }
@@ -3107,20 +3512,93 @@ Next \u2014 verify: ${verify.description}
 }
 function registerSetup(program2) {
   const setup = program2.command("setup").description("Granular onboarding steps (init runs these together)");
-  setup.command("mcp <clients...>").description(`Write only the MCP config for one or more clients (${ALL_CLIENT_KEYS.join(", ")}, or 'all')`).option("--dry-run", "print what would be written without writing", false).addHelpText("after", "\nExamples:\n  $ sechroom setup mcp codex\n  $ sechroom setup mcp claude-code codex\n  $ sechroom setup mcp all").action(async (clients, opts, cmd) => {
-    await runClients(clients, cmd, { dryRun: Boolean(opts.dryRun), mcp: true, agentFiles: false });
+  setup.command("mcp <clients...>").description(`Write only the MCP config for one or more clients (${ALL_CLIENT_KEYS.join(", ")}, or 'all')`).option("--dry-run", "print what would be written without writing", false).option("--namespace <slug>", "MCP namespace for the connection URL (interactive picker if omitted on a TTY; defaults to tenant-global)").addHelpText("after", "\nExamples:\n  $ sechroom setup mcp codex\n  $ sechroom setup mcp claude-code codex\n  $ sechroom setup mcp all").action(async (clients, opts, cmd) => {
+    await runClients(clients, cmd, { dryRun: Boolean(opts.dryRun), mcp: true, agentFiles: false, namespace: opts.namespace });
   });
-  setup.command("agent-files <clients...>").description(`Write only the agent instruction file(s) for one or more clients (${ALL_CLIENT_KEYS.join(", ")}, or 'all')`).option("--dry-run", "print what would be written without writing", false).option("--copy", "make a personal copy you can edit (default: prompt on a TTY, else skip)").addHelpText("after", "\nExamples:\n  $ sechroom setup agent-files claude-code        CLAUDE.md\n  $ sechroom setup agent-files claude-code codex  CLAUDE.md + AGENTS.md in one run\n  $ sechroom setup agent-files all").action(async (clients, opts, cmd) => {
-    await runClients(clients, cmd, { dryRun: Boolean(opts.dryRun), mcp: false, agentFiles: true, copy: opts.copy });
+  setup.command("agent-files <clients...>").description(`Write only the agent instruction file(s) for one or more clients (${ALL_CLIENT_KEYS.join(", ")}, or 'all')`).option("--dry-run", "print what would be written without writing", false).option("--copy", "make a personal copy you can edit (default: prompt on a TTY, else skip)").option("--refresh", "refresh out-of-date blocks in place (local edits preserved to .proposed)", false).option("--force", "rewrite managed blocks, overwriting local edits inside the markers", false).option("--check", "report whether anything would change and exit (0 = current, 1 = stale/drift/absent); writes nothing", false).addHelpText("after", "\nExamples:\n  $ sechroom setup agent-files claude-code        CLAUDE.md\n  $ sechroom setup agent-files claude-code codex  CLAUDE.md + AGENTS.md in one run\n  $ sechroom setup agent-files all --check        CI gate: nonzero exit if out of date\n  $ sechroom setup agent-files claude-code --force   overwrite local edits in the managed block").action(async (clients, opts, cmd) => {
+    await runClients(clients, cmd, { dryRun: Boolean(opts.dryRun), mcp: false, agentFiles: true, copy: opts.copy, mode: resolveEvalMode(opts) });
+  });
+  setup.command("new-convention <title...>").description("Scaffold a workspace-conventions section: author a correctly-tagged memo (header as first body line) + regen the agent files").option("--kind <kind>", "reference | standard (orders the section; reference first)", "reference").option("--workspace <id>", "workspace to author in (default: the bound workspace)").option("--body <markdown>", "section body (default: a TODO scaffold to edit later)").option("--no-regen", "skip the agent-files regen after authoring").option("--dry-run", "print what would be authored; write nothing", false).addHelpText(
+    "after",
+    `
+The memo carries the two conventions a workspace-conventions section needs (FR-sechroom-236):
+the \`agent-setup-bundle\` tag + the \`# Header\` as the FIRST body line. It's authored in the
+BOUND workspace (so the regen, which sources conventions from there, picks it up). Edit it later
+in the app or via \`sechroom memory edit-text\`.
+
+Examples:
+  $ sechroom setup new-convention "Deploy runbook"
+  $ sechroom setup new-convention "Backend testing" --kind standard --body "- run dotnet test ..."
+  $ sechroom setup new-convention "Draft section" --no-regen   author only, regen later`
+  ).action(async (titleParts, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const json = Boolean(cmd.optsWithGlobals().json);
+    const title = titleParts.join(" ").trim();
+    if (!title) fail('a section title is required, e.g. `sechroom setup new-convention "Deploy runbook"`.');
+    const workspaceId = opts.workspace ?? cfg.workspaceId;
+    if (!workspaceId)
+      fail("no workspace \u2014 pass --workspace <id> or bind one (`sechroom config set --local workspaceId <id>`).");
+    const kind = String(opts.kind).toLowerCase() === "standard" ? "standard" : "reference";
+    const body = typeof opts.body === "string" && opts.body.trim().length > 0 ? opts.body.trim() : "_TODO: write this section, then edit the memo and re-run the regen._";
+    const text = `# ${title}
+
+${body}
+`;
+    const tags = ["agent-setup-bundle", "scope:sechroom", `kind:${kind}`, "archetype:document"];
+    if (opts.dryRun) {
+      emit({ dryRun: true, workspaceId, title, kind, tags, text }, json);
+      return;
+    }
+    const data = await runApi("Authoring convention memo", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/memories", {
+        body: {
+          text,
+          type: kind,
+          content: "{}",
+          confidence: 1,
+          source: "cli-new-convention",
+          archetype: "Document",
+          title,
+          tags,
+          owner: { type: "Workspace", id: workspaceId }
+        }
+      });
+    });
+    if (!json) {
+      const view = resolveViewUrl(cfg.baseUrl, data.url);
+      process.stdout.write(
+        `\u2713 authored convention ${style.bold(data.id)} ${style.dim(`"${title}"`)}${view ? ` ${style.dim("\u2192")} ${view}` : ""}
+`
+      );
+    }
+    if (opts.regen === false) {
+      if (json) emit({ id: data.id, workspaceId, regen: false }, true);
+      else process.stdout.write("Skipped regen (--no-regen). Run `sechroom setup agent-files all` to apply.\n");
+      return;
+    }
+    await runClients(["claude-code", "codex"], cmd, {
+      dryRun: false,
+      mcp: false,
+      agentFiles: true,
+      copy: false,
+      mode: "apply"
+    });
   });
 }
 async function runClients(clients, cmd, opts) {
   const cfg = resolveConfig(cmd.optsWithGlobals());
+  const mode = opts.mode ?? "apply";
+  const check = mode === "check";
   const targets = clientTargets(process.cwd());
   const keys = resolveClientKeys(clients.join(","));
-  const setupData = await withSpinner("Fetching setup descriptors", () => fetchSetup(cfg));
+  const namespaceSlug = opts.mcp ? await resolveNamespaceChoice(cfg, opts.namespace) : null;
+  const setupData = await withSpinner(
+    "Fetching setup descriptors",
+    () => fetchSetup(cfg, namespaceSlug ?? void 0)
+  );
   const personalWorkspaceId = await getPersonalWorkspaceId(cfg);
-  if (opts.agentFiles && !opts.dryRun) {
+  if (opts.agentFiles && !opts.dryRun && !check) {
     await maybeOfferCopies(cfg, setupData, targets, keys, personalWorkspaceId, copyChoice(opts));
   }
   const json = cmd.optsWithGlobals().json;
@@ -3131,11 +3609,13 @@ async function runClients(clients, cmd, opts) {
       dryRun: opts.dryRun,
       mcp: opts.mcp,
       agentFiles: opts.agentFiles,
-      personalWorkspaceId
+      personalWorkspaceId,
+      mode
     });
     result.push({ client: key, actions });
-    if (!json) printActions(target, actions);
+    if (!json && !check) printActions(target, actions);
   }
+  summarizeEval(result, mode, Boolean(json), opts.dryRun);
   if (json) {
     emit({ dryRun: opts.dryRun, clients: result }, true);
     return;
@@ -3143,14 +3623,81 @@ async function runClients(clients, cmd, opts) {
   process.stdout.write(opts.dryRun ? "\n(dry run \u2014 nothing written)\n" : "\nDone.\n");
 }
 
+// src/commands/namespace.ts
+function registerNamespace(program2) {
+  const namespace = program2.command("namespace").description("Browse, inspect, and wire up MCP namespaces");
+  namespace.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom namespace list
+  $ sechroom namespace show eng
+  $ sechroom namespace use eng                 wire Claude Code to the 'eng' namespace
+  $ sechroom namespace use eng --client all`
+  );
+  namespace.command("list").description("List the namespaces you can reach (GET /mcp-aggregator/namespaces)").action(async (_opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Listing namespaces", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/mcp-aggregator/namespaces", {});
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  namespace.command("show <slug>").description("Show a namespace's details (GET /mcp-aggregator/namespaces/{slug}). For the tool list it exposes, point an OpenAPI client at /t/{tenant}/namespaces/{slug}/api/openapi.json.").action(async (slug, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Fetching namespace", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/mcp-aggregator/namespaces/{slug}", {
+        params: { path: { slug } }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  namespace.command("use <slug>").description("Wire an AI client's MCP config to this namespace's URL").option(
+    "--client <list>",
+    `comma-separated clients (${ALL_CLIENT_KEYS.join(", ")}) or 'all'`,
+    DEFAULT_CLIENT_KEY
+  ).option("--dry-run", "print what would be written without writing", false).action(async (slug, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const setup = await withSpinner(
+      "Fetching setup descriptors",
+      () => fetchSetup(cfg, slug)
+    );
+    const targets = clientTargets(process.cwd());
+    const keys = resolveClientKeys(opts.client);
+    const json = cmd.optsWithGlobals().json;
+    const result = [];
+    for (const key of keys) {
+      const target = targets[key];
+      const actions = await applyClient(cfg, setup, target, {
+        dryRun: Boolean(opts.dryRun),
+        mcp: true,
+        agentFiles: false,
+        personalWorkspaceId: null
+      });
+      result.push({ client: key, actions });
+      if (!json) printActions(target, actions);
+    }
+    if (json) {
+      emit({ namespace: slug, dryRun: Boolean(opts.dryRun), clients: result }, true);
+      return;
+    }
+    process.stdout.write(
+      opts.dryRun ? "\n(dry run \u2014 nothing written)\n" : `
+Wired to namespace '${slug}'. Restart your AI client (or reload MCP) to pick it up.
+`
+    );
+  });
+}
+
 // src/commands/onboard.ts
-import { existsSync as existsSync7 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync8 } from "fs";
+import { basename as basename3, join as join9 } from "path";
 
 // src/commands/fanout.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync5, readdirSync, statSync } from "fs";
-import { isAbsolute, join as join6, resolve } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
+import { isAbsolute, join as join8, resolve } from "path";
 var ICON = {
   refresh: "\u21BB",
   bind: "+",
@@ -3163,28 +3710,28 @@ function resolveChildDir(path, root) {
 function discoverChildren(root) {
   let names;
   try {
-    names = readdirSync(root);
+    names = readdirSync2(root);
   } catch {
     return [];
   }
   const out = [];
   for (const name of names.sort()) {
     if (name.startsWith(".") || name === "node_modules") continue;
-    const dir = join6(root, name);
+    const dir = join8(root, name);
     try {
-      if (!statSync(dir).isDirectory()) continue;
+      if (!statSync3(dir).isDirectory()) continue;
     } catch {
       continue;
     }
-    if (existsSync6(join6(dir, ".git")) || committedBindingPath(dir)) out.push(name);
+    if (existsSync7(join8(dir, ".git")) || committedBindingPath(dir)) out.push(name);
   }
   return out;
 }
 function readManifest(path) {
-  if (!existsSync6(path)) return null;
+  if (!existsSync7(path)) return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync5(path, "utf8"));
+    parsed = JSON.parse(readFileSync6(path, "utf8"));
   } catch (err2) {
     throw new Error(`couldn't parse ${path}: ${err2 instanceof Error ? err2.message : String(err2)}`);
   }
@@ -3322,7 +3869,39 @@ async function warnIfProjectStray(client, projectId, workspaceId, json) {
     );
   }
 }
-async function pickWorkspace(client, promptLabel = "Bind this directory to a workspace:") {
+async function fetchPersonalWorkspaceId(client) {
+  try {
+    const { data } = await client.GET("/me/personal-workspace", {});
+    return data?.workspaceId ?? null;
+  } catch {
+    return null;
+  }
+}
+function nameTokens(s) {
+  return s.toLowerCase().split(/[^a-z0-9]+/).filter((t) => t.length >= 2);
+}
+function personalSubtreeIds(personalId, all) {
+  const childrenOf = /* @__PURE__ */ new Map();
+  for (const w of all) {
+    if (!w.parentId) continue;
+    (childrenOf.get(w.parentId) ?? childrenOf.set(w.parentId, []).get(w.parentId)).push(w);
+  }
+  const ids = /* @__PURE__ */ new Set([personalId]);
+  const queue = [personalId];
+  while (queue.length > 0) {
+    const id = queue.shift();
+    for (const child of childrenOf.get(id) ?? []) {
+      if (!ids.has(child.id)) {
+        ids.add(child.id);
+        queue.push(child.id);
+      }
+    }
+  }
+  return ids;
+}
+async function pickWorkspace(client, opts = {}) {
+  const promptLabel = opts.promptLabel ?? "Bind this directory to a workspace:";
+  const dirName = opts.dirName ?? basename3(process.cwd());
   const all = await withSpinner("Listing your workspaces", () => fetchWorkspaces(client));
   if (all.length === 0) {
     process.stderr.write(`no workspaces found \u2014 skipping workspace binding (you can set it later with \`sechroom config set --local workspaceId <id>\`)
@@ -3330,22 +3909,34 @@ async function pickWorkspace(client, promptLabel = "Bind this directory to a wor
     return void 0;
   }
   const byId = new Map(all.map((w) => [w.id, w]));
-  let pool = all;
-  if (all.length > 12) {
-    const q = (await promptText(`Filter ${all.length} workspaces (substring, Enter to list all)?`, "")).trim().toLowerCase();
+  const personalId = await fetchPersonalWorkspaceId(client);
+  const excluded = personalId ? personalSubtreeIds(personalId, all) : /* @__PURE__ */ new Set();
+  let candidates = all.filter((w) => !excluded.has(w.id));
+  if (candidates.length === 0) candidates = all;
+  const dirToks = new Set(nameTokens(dirName));
+  const isMatch = (w) => nameTokens(w.name).some((t) => dirToks.has(t));
+  const suggestions = candidates.filter(isMatch);
+  let pool = candidates;
+  if (candidates.length > 12 && suggestions.length === 0) {
+    const q = (await promptText(`Filter ${candidates.length} workspaces (substring, Enter to list all)?`, "")).trim().toLowerCase();
     if (q) {
-      const hits = all.filter((w) => `${w.name} ${workspacePath(w, byId)}`.toLowerCase().includes(q));
+      const hits = candidates.filter((w) => `${w.name} ${workspacePath(w, byId)}`.toLowerCase().includes(q));
       if (hits.length > 0) pool = hits;
       else process.stderr.write(`no match for "${q}" \u2014 listing all
 `);
     }
   }
   const SKIP = "__skip__";
+  const byPath = (a, b) => workspacePath(a, byId).localeCompare(workspacePath(b, byId));
+  const matched = pool.filter(isMatch).sort(byPath);
+  const rest = pool.filter((w) => !isMatch(w)).sort(byPath);
   const choices = [
-    ...pool.slice().sort((a, b) => workspacePath(a, byId).localeCompare(workspacePath(b, byId))).map((w) => ({ label: workspacePath(w, byId), value: w.id, hint: w.id })),
+    ...matched.map((w) => ({ label: workspacePath(w, byId), value: w.id, hint: style.dim(`matches "${dirName}"`) })),
+    ...rest.map((w) => ({ label: workspacePath(w, byId), value: w.id, hint: w.id })),
     { label: style.dim("skip \u2014 don't bind a workspace"), value: SKIP, hint: void 0 }
   ];
-  const chosen = await promptSelect(promptLabel, choices, SKIP);
+  const defaultValue = matched.length === 1 ? matched[0].id : SKIP;
+  const chosen = await promptSelect(promptLabel, choices, defaultValue);
   if (chosen === SKIP) return void 0;
   const picked = byId.get(chosen);
   const collisions = all.filter((w) => w.id !== picked.id && namesCollide(w.name, picked.name));
@@ -3372,7 +3963,7 @@ async function resolveWorkspaceBinding(client, existing, opts) {
   }
   if (existing) return existing;
   if (!canPrompt() || opts.yes) return void 0;
-  return pickWorkspace(client);
+  return pickWorkspace(client, { dirName: basename3(process.cwd()) });
 }
 async function ensureTenant(baseUrl, g, opts) {
   const persisted = readPersisted();
@@ -3488,7 +4079,7 @@ async function ensureTimezone(cfg, opts) {
   return { timezone: tz, action: "set" };
 }
 async function chooseClients(clientFlag, yes, cwd) {
-  if (clientFlag) return resolveClientKeys(clientFlag);
+  if (clientFlag && clientFlag.length > 0) return resolveClientKeys(clientFlag);
   const detected = detectInstalledClients(cwd);
   const preselected = detected.length > 0 ? detected : [DEFAULT_CLIENT_KEY];
   if (!canPrompt() || yes) return preselected;
@@ -3505,10 +4096,10 @@ async function chooseClients(clientFlag, yes, cwd) {
 }
 async function planRecurseChild(entry, root, client, opts) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync7(dir)) {
+  if (!existsSync8(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
-  if (existsSync7(join7(dir, ".sechroom.json"))) {
+  if (existsSync8(join9(dir, ".sechroom.json"))) {
     return {
       label: entry.path,
       dir,
@@ -3535,7 +4126,10 @@ async function planRecurseChild(entry, root, client, opts) {
   process.stderr.write(`
 ${style.bold(entry.path)} ${style.dim("is not bound yet.")}
 `);
-  const ws = await pickWorkspace(client, `Bind ${style.cyan(entry.path)} to a workspace:`);
+  const ws = await pickWorkspace(client, {
+    promptLabel: `Bind ${style.cyan(entry.path)} to a workspace:`,
+    dirName: basename3(entry.path)
+  });
   if (!ws) {
     return { label: entry.path, dir, disposition: "skip-unbound", argv: [], reason: "unbound \u2014 no workspace chosen (skipped)" };
   }
@@ -3578,7 +4172,7 @@ This fan-out will pin the same lane in every repo:
 async function runRecurse(cfg, g, opts) {
   const { yes, dryRun, json } = opts;
   const root = process.cwd();
-  const manifestPath = join7(root, ".sechroom", "repos.json");
+  const manifestPath = join9(root, ".sechroom", "repos.json");
   const fromManifest = readManifest(manifestPath);
   const entries = fromManifest ?? discoverChildren(root).map((path) => ({ path }));
   const sourceLabel = fromManifest ? `manifest ${manifestPath}` : `auto-discovered under ${root}`;
@@ -3606,7 +4200,7 @@ async function runRecurse(cfg, g, opts) {
   summarizeFanout(results, { dryRun });
 }
 function registerOnboard(program2) {
-  program2.command("onboard").description("Guided first-run setup: configure, sign in, set timezone, detect clients, and wire this project").option("--recurse", "orchestration-root mode: onboard every child repo under this dir (auto-discovered, or from ./.sechroom/repos.json) \u2014 refreshes bound repos, prompts a workspace per new one", false).option("--lane <id>", "set the code-lane (substrate source identity) explicitly instead of inferring it; with --recurse it's used for every child repo").option("--design-lane <id>", "set the design-lane explicitly (substrate-authoring identity); with --recurse applies to every child").option("--client <list>", `comma-separated clients (${ALL_CLIENT_KEYS.join(", ")}) or 'all' (default: auto-detected)`).option("--local", "save the binding (tenant + base URL + workspace) to a committed .sechroom.json in this repo instead of the global config", false).option("--here", "with --local: write the binding at THIS directory even when a parent already carries one \u2014 binds a subtree (e.g. a monorepo's frontend/) to its own workspace", false).option("--workspace <id>", "bind this directory to a workspace (skips the interactive workspace pick)").option("--cli-only", "configure the CLI only \u2014 don't wire any AI client (no MCP config, no agent files)", false).option("--no-mcp", "skip the MCP server config (.mcp.json etc.); still write the agent instruction files").option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--dry-run", "walk through without writing files or changing the profile", false).option("--refresh", "re-fetch descriptors and refresh any out-of-date managed blocks (local edits preserved to .proposed)", false).option("--force", "rewrite every managed block, overwriting local edits inside the markers (content outside untouched)", false).option("--check", "report whether anything would change and exit (0 = all current, 1 = stale/drift/absent); writes nothing", false).option("-y, --yes", "non-interactive: accept defaults (system timezone, detected clients, global config, full wire)", false).addHelpText(
+  program2.command("onboard").description("Guided first-run setup: configure, sign in, set timezone, detect clients, and wire this project").option("--recurse", "orchestration-root mode: onboard every child repo under this dir (auto-discovered, or from ./.sechroom/repos.json) \u2014 refreshes bound repos, prompts a workspace per new one", false).option("--lane <id>", "set the code-lane (substrate source identity) explicitly instead of inferring it; with --recurse it's used for every child repo").option("--design-lane <id>", "set the design-lane explicitly (substrate-authoring identity); with --recurse applies to every child").option("--client <list...>", `clients to wire \u2014 space- or comma-separated (${ALL_CLIENT_KEYS.join(", ")}) or 'all' (default: auto-detected)`).option("--local", "save the binding (tenant + base URL + workspace) to a committed .sechroom.json in this repo instead of the global config", false).option("--here", "with --local: write the binding at THIS directory even when a parent already carries one \u2014 binds a subtree (e.g. a monorepo's frontend/) to its own workspace", false).option("--workspace <id>", "bind this directory to a workspace (skips the interactive workspace pick)").option("--cli-only", "configure the CLI only \u2014 don't wire any AI client (no MCP config, no agent files)", false).option("--no-mcp", "skip the MCP server config (.mcp.json etc.); still write the agent instruction files").option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--dry-run", "walk through without writing files or changing the profile", false).option("--refresh", "re-fetch descriptors and refresh any out-of-date managed blocks (local edits preserved to .proposed)", false).option("--force", "rewrite every managed block, overwriting local edits inside the markers (content outside untouched)", false).option("--check", "report whether anything would change and exit (0 = all current, 1 = stale/drift/absent); writes nothing", false).option("-y, --yes", "non-interactive: accept defaults (system timezone, detected clients, global config, full wire)", false).addHelpText(
     "after",
     `
 Examples:
@@ -3762,14 +4356,21 @@ async function chooseWire(opts, yes) {
   return opts.mcp === false ? "agent-only" : "full";
 }
 var FALLBACK_AGENT_PROMPT = "Resume my sechroom continuity, summarise what I was last working on, then suggest the next step.";
+function printNextStepBlock(heading, lines) {
+  const rule = style.dim("\u2500".repeat(52));
+  process.stdout.write(
+    `
+${rule}
+${style.bold(heading)}
+
+` + lines.map((l) => `  ${l}`).join("\n") + `
+${rule}
+`
+  );
+}
 async function printStarterPrompt(mode, cfg) {
   if (mode === "cli") {
-    process.stdout.write(
-      `
-${style.bold("Next:")} pick up where you left off \u2014
-  ${style.cyan("sechroom continuity resume-me")}
-`
-    );
+    printNextStepBlock("Next \u2014 pick up where you left off:", [style.cyan("sechroom continuity resume-me")]);
     return;
   }
   let primary = FALLBACK_AGENT_PROMPT;
@@ -3781,21 +4382,16 @@ ${style.bold("Next:")} pick up where you left off \u2014
     } catch {
     }
   }
-  process.stdout.write(
-    `
-${style.bold("Next:")} paste this into your AI agent to get going \u2014
-  ${style.cyan(`"${primary}"`)}
-`
-  );
+  printNextStepBlock("Next \u2014 paste this into your AI agent to get going:", [style.cyan(`"${primary}"`)]);
 }
 
 // src/commands/sweep.ts
-import { existsSync as existsSync8 } from "fs";
-import { dirname as dirname6, join as join8, resolve as resolve2 } from "path";
-var DEFAULT_MANIFEST = join8(".sechroom", "repos.json");
+import { existsSync as existsSync9 } from "fs";
+import { dirname as dirname7, join as join10, resolve as resolve2 } from "path";
+var DEFAULT_MANIFEST = join10(".sechroom", "repos.json");
 function planEntry(entry, root) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync8(dir)) {
+  if (!existsSync9(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
   if (committedBindingPath(dir)) {
@@ -3871,7 +4467,7 @@ Examples:
 `);
       return;
     }
-    const root = dirname6(dirname6(manifestPath));
+    const root = dirname7(dirname7(manifestPath));
     const plans = repos.map((entry) => planEntry(entry, root));
     if (!json) {
       process.stderr.write(
@@ -3889,106 +4485,78 @@ Examples:
 }
 
 // src/commands/skills.ts
-import { homedir as homedir6 } from "os";
-import { join as join9 } from "path";
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, rmSync as rmSync2, existsSync as existsSync9, readFileSync as readFileSync6 } from "fs";
-var DEFAULT_SLUG = "operator-skills";
-var ROLE_TAGS = ["sechroom:role:skill-template", "role:skill-template"];
-var LOCK = ".sechroom-skills.json";
-function skillsDir(global) {
-  return global ? join9(homedir6(), ".claude", "skills") : join9(process.cwd(), ".claude", "skills");
-}
-function tagValue2(tags, prefix) {
-  return (tags ?? []).find((t) => t.startsWith(prefix))?.slice(prefix.length);
-}
-function hasAny(tags, candidates) {
-  return (tags ?? []).some((t) => candidates.includes(t));
+import { join as join11 } from "path";
+import { existsSync as existsSync10, rmSync as rmSync2 } from "fs";
+
+// src/commands/lane.ts
+var LANE_KEYS = ["code-lane", "design-lane"];
+function showLane(json) {
+  const found = readSem();
+  if (!found) {
+    if (json) return emit({ path: null, values: {} }, true);
+    return console.log(
+      style.dim(`No ./.sechroom/lane.json pin in this checkout. Run 'sechroom lane set'.`)
+    );
+  }
+  const resolved = { ...found.values };
+  let suffixed = false;
+  for (const k of LANE_KEYS) {
+    const v = found.values[k];
+    if (!v) continue;
+    resolved[k] = applyWorktreeLaneSuffix(v);
+    if (resolved[k] !== v) suffixed = true;
+  }
+  if (json) return emit({ path: found.path, values: resolved, worktreeSuffixApplied: suffixed }, true);
+  console.log(style.dim(`from ${found.path}`));
+  Object.entries(resolved).forEach(([k, v]) => console.log("  " + style.bold(k) + " = " + v));
+  if (suffixed) console.log(style.dim("  (worktree -N suffix applied \u2014 non-primary git worktree)"));
+}
+function setLane(opts) {
+  if (!opts.codeLane && !opts.designLane) fail("Provide --code-lane and/or --design-lane.");
+  const target = localSemPath();
+  const values = readLocalSemValues();
+  if (opts.codeLane) values["code-lane"] = opts.codeLane;
+  if (opts.designLane) values["design-lane"] = opts.designLane;
+  writeSem(values, target);
+  if (opts.json) return emit({ path: target, values }, true);
+  console.log(style.green(`Wrote lane pin \u2192 ${target} ${style.dim("(git-ignored)")}`));
+  Object.entries(values).forEach(([k, v]) => console.log("  " + style.dim(k) + " = " + v));
+}
+function registerLane(program2) {
+  const lane = program2.command("lane").description("Show this checkout's continuity lane pin (worktree-aware -N suffix applied)").option("--json", "machine output").action((opts, cmd) => showLane(Boolean(opts.json) || Boolean(cmd.optsWithGlobals().json)));
+  lane.command("set").description("Write this checkout's lane pin to ./.sechroom/lane.json").option("--code-lane <id>", "code-surface lane id (e.g. claude-code-chris)").option("--design-lane <id>", "design / substrate-authoring lane id (e.g. claude-design-chris)").option("--json", "machine output").action(
+    (opts, cmd) => setLane({
+      codeLane: opts.codeLane,
+      designLane: opts.designLane,
+      json: Boolean(opts.json) || Boolean(cmd.optsWithGlobals().json)
+    })
+  );
+  lane.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom lane                                              show the resolved lane(s)
+  $ sechroom lane set --code-lane claude-code-chris --design-lane claude-design-chris
+
+In a non-primary git worktree the ratified concurrent-session -N suffix is auto-applied (SBC-1094).
+(Aliases: 'sechroom skills lane' / 'skills set-lane' \u2014 kept for back-compat.)`
+  );
 }
+
+// src/commands/skills.ts
 function registerSkills(program2) {
-  const skills = program2.command("skills").description("Install + manage operator skills from a bundle");
+  const skills = program2.command("skills").description("Manage operator skills (materialised by `onboard`)");
   skills.addHelpText(
     "after",
     `
 Examples:
-  $ sechroom skills install --code-lane claude-code-chris --design-lane claude-design-chris
-  $ sechroom skills install operator-skills --surface claude-code --local
   $ sechroom skills list
   $ sechroom skills set-lane --code-lane claude-code-chris --design-lane claude-design-chris
   $ sechroom skills lane
-  $ sechroom skills clean`
+  $ sechroom skills clean
+
+To install/refresh skills, run 'sechroom onboard' (it offers to materialise them).`
   );
-  skills.command("install [slug]").description(`Install a skills bundle (default ${DEFAULT_SLUG}) into your personal workspace + write SKILL.md files`).option("--version <v>", "bundle version (default: latest published in the catalogue)").option("--instance <name>", "install as a named, separate instance (install the same bundle more than once)").option("--code-lane <id>", "identity.code-lane binding (e.g. claude-code-chris)").option("--design-lane <id>", "identity.design-lane binding (e.g. claude-design-chris)").option("--surface <s>", "skill target surface to materialise", "claude-code").option("--local", "write to ./.claude/skills instead of ~/.claude/skills").option("--json", "machine output").action(async (slugArg, opts, cmd) => {
-    const slug = slugArg || DEFAULT_SLUG;
-    const client = await makeClient(resolveConfig(cmd.optsWithGlobals()));
-    const pw = await runApi("resolving personal workspace", () => client.GET("/me/personal-workspace", {}));
-    const personalWsId = pw?.id || pw?.workspaceId || pw?.personalWorkspaceId || pw?.item?.id;
-    if (!personalWsId) fail("Could not resolve your personal workspace.");
-    let version = opts.version;
-    if (!version) {
-      const cat = await runApi("reading the bundle catalogue", () => client.GET("/me/bundles", {}));
-      const item = (cat?.bundles ?? cat?.Bundles ?? []).find((b) => (b.slug ?? b.Slug) === slug);
-      if (!item) fail(`Bundle '${slug}' is not in your self-serve catalogue (must be UserInstallable + Published).`);
-      version = item.latestVersion ?? item.LatestVersion;
-      if (!version) fail(`Bundle '${slug}' has no installable (Published) version.`);
-    }
-    const installOptions = {};
-    if (opts.codeLane) installOptions["identity.code-lane"] = opts.codeLane;
-    if (opts.designLane) installOptions["identity.design-lane"] = opts.designLane;
-    const res = await runApi(
-      `installing ${slug}@${version}${opts.instance ? ` (${opts.instance})` : ""}`,
-      () => client.POST("/me/bundles/{slug}/versions/{version}/install", {
-        params: { path: { slug, version } },
-        // instance: null/absent = the default instance (reinstall updates in
-        // place); a name installs a separate instance.
-        body: { installOptions, instance: opts.instance ?? null }
-      })
-    );
-    const status = String(res?.status ?? res?.Status ?? "");
-    if (status && status.toLowerCase() !== "completed") {
-      fail(`Install did not complete (status=${status}; ${res?.failureReason ?? res?.FailureReason ?? ""}).`);
-    }
-    const feed = await runApi(
-      "materialising skill files",
-      () => client.GET("/workspaces/{workspaceId}/memories/feed", {
-        // cascadeWorkspaces: skills land in an "Operator Skills" SUB-workspace of
-        // the personal workspace, so we recurse from the personal-ws root.
-        // includeText: the feed omits bodies by default; we need them for SKILL.md.
-        params: {
-          path: { workspaceId: personalWsId },
-          query: { limit: 200, cascadeWorkspaces: true, includeText: true }
-        }
-      })
-    );
-    const rows = feed?.results ?? feed?.Results ?? [];
-    const dir = skillsDir(!opts.local);
-    const wantInstance = opts.instance || "default";
-    const written = [];
-    const bundleTagPrefix = `sechroom:bundle:${slug}@`;
-    for (const r of rows) {
-      const m = r.item ?? r;
-      const tags = m.tags ?? m.Tags ?? [];
-      if (!hasAny(tags, ROLE_TAGS)) continue;
-      if (tagValue2(tags, "target:") !== opts.surface) continue;
-      if (!tags.some((t) => t.startsWith(bundleTagPrefix))) continue;
-      if ((tagValue2(tags, "sechroom:skill-instance:") ?? "default") !== wantInstance) continue;
-      const name = tagValue2(tags, "skill:");
-      if (!name) continue;
-      const body = m.text ?? m.Text ?? "";
-      mkdirSync6(join9(dir, name), { recursive: true });
-      writeFileSync6(join9(dir, name, "SKILL.md"), body.endsWith("\n") ? body : body + "\n");
-      written.push(name);
-    }
-    mkdirSync6(dir, { recursive: true });
-    const lockPath = join9(dir, LOCK);
-    const lock = existsSync9(lockPath) ? JSON.parse(readFileSync6(lockPath, "utf8")) : {};
-    lock[slug] = { surface: opts.surface, version, instance: wantInstance, skills: written.sort() };
-    writeFileSync6(lockPath, JSON.stringify(lock, null, 2) + "\n");
-    if (opts.json) return emit({ slug, version, instance: wantInstance, surface: opts.surface, dir, installed: written }, true);
-    const instanceNote = opts.instance ? ` (${opts.instance})` : "";
-    console.log(style.green(`Installed ${slug}@${version}${instanceNote} \u2014 ${written.length} skill(s) \u2192 ${dir}`));
-    written.forEach((n) => console.log("  " + style.dim("\u2022") + " " + n));
-    if (written.length === 0) console.log(style.dim(`  (no '${opts.surface}' skill bodies found; check --surface)`));
-  });
   skills.command("list").description("List your installed bundles (GET /me/bundle-installs)").option("--json", "machine output").action(async (opts, cmd) => {
     const client = await makeClient(resolveConfig(cmd.optsWithGlobals()));
     const data = await runApi("reading your installs", () => client.GET("/me/bundle-installs", {}));
@@ -4001,49 +4569,33 @@ Examples:
       console.log(`  ${i.bundleSlug ?? i.BundleSlug}@${i.bundleVersion ?? i.BundleVersion ?? "?"}${tag}`);
     });
   });
-  skills.command("clean [slug]").description(`Remove materialised skill files written by install (default ${DEFAULT_SLUG})`).option("--local", "clean ./.claude/skills instead of ~/.claude/skills").option("--json", "machine output").action(async (slugArg, opts) => {
-    const slug = slugArg || DEFAULT_SLUG;
+  skills.command("clean [slug]").description(`Remove skill files materialised by onboard (default ${DEFAULT_SKILLS_SLUG})`).option("--local", "clean ./.claude/skills instead of ~/.claude/skills").option("--json", "machine output").action(async (slugArg, opts) => {
+    const slug = slugArg || DEFAULT_SKILLS_SLUG;
     const dir = skillsDir(!opts.local);
-    const lockPath = join9(dir, LOCK);
-    if (!existsSync9(lockPath)) fail(`No skills lockfile at ${lockPath}; nothing to clean.`);
-    const lock = JSON.parse(readFileSync6(lockPath, "utf8"));
+    const lock = readSkillsLock(dir);
     const entry = lock[slug];
-    if (!entry) fail(`No installed record for '${slug}' in ${lockPath}.`);
+    if (!entry) fail(`No materialised skills recorded for '${slug}' in ${join11(dir, SKILLS_LOCK)}.`);
     const removed = [];
     for (const name of entry.skills) {
-      const skillPath = join9(dir, name);
-      if (existsSync9(skillPath)) {
+      const skillPath = join11(dir, name);
+      if (existsSync10(skillPath)) {
         rmSync2(skillPath, { recursive: true, force: true });
         removed.push(name);
       }
     }
     delete lock[slug];
-    writeFileSync6(lockPath, JSON.stringify(lock, null, 2) + "\n");
+    writeSkillsLock(dir, lock);
     if (opts.json) return emit({ slug, removed, dir }, true);
     console.log(style.green(`Removed ${removed.length} skill(s) for ${slug} from ${dir}`));
   });
-  skills.command("set-lane").description("Write this checkout's lane pin to a local ./.sechroom/lane.json file (read at runtime by skills)").option("--code-lane <id>", "code-surface lane id (e.g. claude-code-chris)").option("--design-lane <id>", "design / substrate-authoring lane id (e.g. claude-design-chris)").option("--json", "machine output").action((opts, cmd) => {
-    if (!opts.codeLane && !opts.designLane) fail("Provide --code-lane and/or --design-lane.");
-    const target = localSemPath();
-    const values = readLocalSemValues();
-    if (opts.codeLane) values["code-lane"] = opts.codeLane;
-    if (opts.designLane) values["design-lane"] = opts.designLane;
-    writeSem(values, target);
-    if (cmd.optsWithGlobals().json) return emit({ path: target, values }, true);
-    console.log(style.green(`Wrote lane pin \u2192 ${target} ${style.dim("(git-ignored)")}`));
-    Object.entries(values).forEach(([k, v]) => console.log("  " + style.dim(k) + " = " + v));
-  });
-  skills.command("lane").description("Show the lane pin resolved from ./.sechroom/lane.json (nearest in this checkout; legacy ./.sem honoured)").option("--json", "machine output").action((opts, cmd) => {
-    const json = cmd.optsWithGlobals().json;
-    const found = readSem();
-    if (!found) {
-      if (json) return emit({ path: null, values: {} }, true);
-      return console.log(style.dim(`No ./.sechroom/lane.json pin in this checkout. Run 'sechroom skills set-lane'.`));
-    }
-    if (json) return emit(found, true);
-    console.log(style.dim(`from ${found.path}`));
-    Object.entries(found.values).forEach(([k, v]) => console.log("  " + style.bold(k) + " = " + v));
-  });
+  skills.command("set-lane").description("Alias of `sechroom lane set` (kept for back-compat) \u2014 write this checkout's lane pin").option("--code-lane <id>", "code-surface lane id (e.g. claude-code-chris)").option("--design-lane <id>", "design / substrate-authoring lane id (e.g. claude-design-chris)").option("--json", "machine output").action(
+    (opts, cmd) => setLane({
+      codeLane: opts.codeLane,
+      designLane: opts.designLane,
+      json: Boolean(opts.json) || Boolean(cmd.optsWithGlobals().json)
+    })
+  );
+  skills.command("lane").description("Alias of `sechroom lane` (kept for back-compat) \u2014 show this checkout's lane pin").option("--json", "machine output").action((opts, cmd) => showLane(Boolean(opts.json) || Boolean(cmd.optsWithGlobals().json)));
   skills.command("set-workflow").description("Set your per-operator workflow defaults (server-side; follows you across tenants)").option("--default-code-lane <id>", "personal default code lane (e.g. claude-code-chris)").option("--default-design-lane <id>", "personal default design lane (e.g. claude-design-chris)").option("--handover-recipient <id>", "your daily-handover counterparty (e.g. andy)").option("--json", "machine output").action(async (opts, cmd) => {
     if (!opts.defaultCodeLane && !opts.defaultDesignLane && !opts.handoverRecipient)
       fail("Provide at least one of --default-code-lane / --default-design-lane / --handover-recipient.");
@@ -4107,22 +4659,24 @@ Examples:
 }
 
 // src/commands/reset.ts
-import { homedir as homedir7 } from "os";
-import { join as join10 } from "path";
-import { existsSync as existsSync10, readFileSync as readFileSync7, rmSync as rmSync3 } from "fs";
-var SKILLS_LOCK = ".sechroom-skills.json";
-var localSkillsDir = () => join10(process.cwd(), ".claude", "skills");
-var globalSkillsDir = () => join10(homedir7(), ".claude", "skills");
+import { homedir as homedir6 } from "os";
+import { join as join12 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync7, rmSync as rmSync3 } from "fs";
+var SKILLS_LOCK2 = ".sechroom-skills.json";
+var localSkillsDir = () => join12(process.cwd(), ".claude", "skills");
+var globalSkillsDir = () => join12(homedir6(), ".claude", "skills");
+var localAgentsDir = () => join12(process.cwd(), ".claude", "agents");
+var globalAgentsDir = () => join12(homedir6(), ".claude", "agents");
 function removeMaterialisedSkills(dir) {
   const removed = [];
-  const lockPath = join10(dir, SKILLS_LOCK);
-  if (!existsSync10(lockPath)) return removed;
+  const lockPath = join12(dir, SKILLS_LOCK2);
+  if (!existsSync11(lockPath)) return removed;
   try {
     const lock = JSON.parse(readFileSync7(lockPath, "utf8"));
     for (const entry of Object.values(lock)) {
       for (const name of entry.skills ?? []) {
-        const p = join10(dir, name);
-        if (existsSync10(p)) {
+        const p = join12(dir, name);
+        if (existsSync11(p)) {
           rmSync3(p, { recursive: true, force: true });
           removed.push(p);
         }
@@ -4167,28 +4721,30 @@ function registerReset(program2) {
       }
     }
     const removed = [];
-    const stateDir = join10(process.cwd(), ".sechroom");
-    if (existsSync10(stateDir)) {
+    const stateDir = join12(process.cwd(), ".sechroom");
+    if (existsSync11(stateDir)) {
       rmSync3(stateDir, { recursive: true, force: true });
       removed.push(stateDir);
     }
-    const legacyCfg = join10(process.cwd(), ".sechroom.json");
-    if (existsSync10(legacyCfg)) {
+    const legacyCfg = join12(process.cwd(), ".sechroom.json");
+    if (existsSync11(legacyCfg)) {
       rmSync3(legacyCfg, { force: true });
       removed.push(legacyCfg);
     }
-    const legacySem = join10(process.cwd(), ".sem");
-    if (existsSync10(legacySem)) {
+    const legacySem = join12(process.cwd(), ".sem");
+    if (existsSync11(legacySem)) {
       rmSync3(legacySem, { force: true });
       removed.push(legacySem);
     }
     removed.push(...removeMaterialisedSkills(localSkillsDir()));
+    removed.push(...removeMaterialisedSkills(localAgentsDir()));
     if (global) {
       const tok = clearToken();
       if (tok) removed.push(tok);
       const cfg = clearPersisted();
       if (cfg) removed.push(cfg);
       removed.push(...removeMaterialisedSkills(globalSkillsDir()));
+      removed.push(...removeMaterialisedSkills(globalAgentsDir()));
     }
     if (json) return emit({ global, removed }, true);
     if (removed.length === 0) {
@@ -4317,15 +4873,18 @@ registerWorkspace(program);
 registerProject(program);
 registerFiling(program);
 registerContinuity(program);
+registerCheckpoint(program);
 registerHook(program);
 registerId(program);
 registerAccount(program);
 registerChat(program);
 registerInit(program);
 registerSetup(program);
+registerNamespace(program);
 registerOnboard(program);
 registerSweep(program);
 registerSkills(program);
+registerLane(program);
 registerReset(program);
 program.parseAsync().catch((err2) => {
   process.stderr.write(`error: ${err2 instanceof Error ? err2.message : String(err2)}