@sechroom/cli 2026.6.32 → 2026.6.33

package/dist/index.js

@@ -1775,13 +1775,12 @@ Examples:
 
 // src/commands/checkpoint.ts
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname5, join as join5 } from "path";
+import { dirname as dirname5, join as join6 } from "path";
 
 // src/commands/hook.ts
 import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, statSync as statSync2, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir3 } from "os";
-import { delimiter, dirname as dirname4, join as join4 } from "path";
+import { delimiter, dirname as dirname4, join as join5 } from "path";
 
 // src/sem.ts
 import { basename as basename2, dirname as dirname2, join as join2 } from "path";
@@ -1938,8 +1937,55 @@ function ensureSemIgnored(semPath) {
 
 // src/setup/clients.ts
 import { existsSync as existsSync3 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname3, join as join4 } from "path";
+
+// src/setup/config-dirs.ts
 import { homedir as homedir2 } from "os";
-import { dirname as dirname3, join as join3 } from "path";
+import { join as join3 } from "path";
+function expandTilde(p) {
+  if (p === "~") return homedir2();
+  if (p.startsWith("~/")) return join3(homedir2(), p.slice(2));
+  return p;
+}
+function splitDirs(raw) {
+  if (!raw) return [];
+  return raw.split(",").map((s) => expandTilde(s.trim())).filter(Boolean);
+}
+function resolveScope(flag) {
+  if (flag == null) return "global";
+  if (flag === "global" || flag === "project") return flag;
+  throw new Error(`--scope must be 'global' or 'project' (got '${flag}')`);
+}
+function labelFor(dir) {
+  const h = homedir2();
+  if (dir === h) return "~";
+  return dir.startsWith(h + "/") ? "~" + dir.slice(h.length) : dir;
+}
+function defaultClaudeDir() {
+  return join3(homedir2(), ".claude");
+}
+function defaultCodexHome() {
+  return join3(homedir2(), ".codex");
+}
+function resolveClaudeTargets(opts) {
+  const scope = opts.scope ?? "global";
+  const cwd = opts.cwd ?? process.cwd();
+  if (scope === "project") {
+    return [{ dir: join3(cwd, ".claude"), scope, label: "<project>" }];
+  }
+  const fromFlag = splitDirs(opts.override);
+  const fromEnv = splitDirs(process.env.CLAUDE_CONFIG_DIR);
+  const dirs = fromFlag.length ? fromFlag : fromEnv.length ? fromEnv : [defaultClaudeDir()];
+  return dirs.map((dir) => ({ dir, scope, label: labelFor(dir) }));
+}
+function resolveCodexHomes(opts) {
+  const scope = opts.scope ?? "global";
+  if (scope === "project") return [];
+  const fromFlag = splitDirs(opts.override);
+  const fromEnv = splitDirs(process.env.CODEX_HOME);
+  return fromFlag.length ? fromFlag : fromEnv.length ? fromEnv : [defaultCodexHome()];
+}
 
 // src/setup/operator-surface.ts
 var SectionType = {
@@ -2076,51 +2122,53 @@ async function createOverride(cfg, template, personalWorkspaceId) {
 function claudeDesktopConfigPath(home) {
   switch (process.platform) {
     case "darwin":
-      return join3(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+      return join4(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
     case "win32":
-      return join3(process.env.APPDATA ?? join3(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
+      return join4(process.env.APPDATA ?? join4(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
     default:
-      return join3(home, ".config", "Claude", "claude_desktop_config.json");
+      return join4(home, ".config", "Claude", "claude_desktop_config.json");
   }
 }
-function clientTargets(cwd) {
-  const home = homedir2();
+function clientTargets(cwd, opts = {}) {
+  const home = homedir3();
+  const claudeDir = opts.claudeDir ?? join4(home, ".claude");
+  const codexHome = opts.codexHome ?? join4(home, ".codex");
   return {
     "claude-code": {
       key: "claude-code",
       label: "Claude Code",
-      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join3(cwd, ".mcp.json"), format: "json" },
-      instruction: { surfaceKey: "claude-code", path: join3(cwd, "CLAUDE.md") }
+      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join4(cwd, ".mcp.json"), format: "json" },
+      instruction: { surfaceKey: "claude-code", path: join4(cwd, "CLAUDE.md") }
     },
     "claude-desktop": {
       key: "claude-desktop",
       label: "Claude Desktop",
       mcp: { surfaceKey: "claude-desktop", sectionType: SectionType.McpConfig, path: claudeDesktopConfigPath(home), format: "json" },
-      instruction: { surfaceKey: "claude-desktop", path: join3(home, ".claude", "CLAUDE.md") }
+      instruction: { surfaceKey: "claude-desktop", path: join4(claudeDir, "CLAUDE.md") }
     },
     codex: {
       key: "codex",
       label: "Codex CLI",
-      mcp: { surfaceKey: "chatgpt", sectionType: SectionType.McpConfigToml, path: join3(home, ".codex", "config.toml"), format: "toml" },
-      instruction: { surfaceKey: "chatgpt", path: join3(cwd, "AGENTS.md") }
+      mcp: { surfaceKey: "chatgpt", sectionType: SectionType.McpConfigToml, path: join4(codexHome, "config.toml"), format: "toml" },
+      instruction: { surfaceKey: "chatgpt", path: join4(cwd, "AGENTS.md") }
     },
     cursor: {
       key: "cursor",
       label: "Cursor",
-      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join3(cwd, ".cursor", "mcp.json"), format: "json" },
-      instruction: { surfaceKey: "chatgpt", path: join3(cwd, "AGENTS.md") }
+      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join4(cwd, ".cursor", "mcp.json"), format: "json" },
+      instruction: { surfaceKey: "chatgpt", path: join4(cwd, "AGENTS.md") }
     }
   };
 }
 var ALL_CLIENT_KEYS = ["claude-code", "claude-desktop", "codex", "cursor"];
 var DEFAULT_CLIENT_KEY = "claude-code";
 function detectInstalledClients(cwd) {
-  const home = homedir2();
+  const home = homedir3();
   const detected = [];
-  if (existsSync3(join3(home, ".claude"))) detected.push("claude-code");
+  if (resolveClaudeTargets({}).some((t) => existsSync3(t.dir))) detected.push("claude-code");
   if (existsSync3(dirname3(claudeDesktopConfigPath(home)))) detected.push("claude-desktop");
-  if (existsSync3(join3(home, ".codex"))) detected.push("codex");
-  if (existsSync3(join3(home, ".cursor")) || existsSync3(join3(cwd, ".cursor"))) detected.push("cursor");
+  if (resolveCodexHomes({}).some((d) => existsSync3(d))) detected.push("codex");
+  if (existsSync3(join4(home, ".cursor")) || existsSync3(join4(cwd, ".cursor"))) detected.push("cursor");
   return detected;
 }
 
@@ -2148,11 +2196,11 @@ function resolveLane(flagLane, cwd) {
   if (!base) return void 0;
   return applyWorktreeLaneSuffix(base, start);
 }
-var INTENT_FILE = join4(".sechroom", "continuity.json");
+var INTENT_FILE = join5(".sechroom", "continuity.json");
 function resolveIntentPath(start) {
   let dir = start;
   for (; ; ) {
-    const candidate = join4(dir, INTENT_FILE);
+    const candidate = join5(dir, INTENT_FILE);
     if (existsSync4(candidate)) return candidate;
     const parent = dirname4(dir);
     if (parent === dir) return void 0;
@@ -2205,8 +2253,8 @@ async function saveSnapshotFromIntent(cmd, cwd, laneFlag, scopeFlag, defaultScop
 }
 function ledgerPath(start) {
   const intent = resolveIntentPath(start);
-  const dir = intent ? dirname4(intent) : join4(start, ".sechroom");
-  return join4(dir, ".checkpoint-state.json");
+  const dir = intent ? dirname4(intent) : join5(start, ".sechroom");
+  return join5(dir, ".checkpoint-state.json");
 }
 function readLedger(start) {
   try {
@@ -2398,11 +2446,11 @@ function installHookSurfaces(surfaces, opts) {
   const out = [];
   for (const surface of surfaces) {
     if (surface === "claude") {
-      const path = opts.local ? join4(opts.cwd, ".claude", "settings.json") : join4(opts.home, ".claude", "settings.json");
+      const path = join5(opts.claudeDir, "settings.json");
       out.push({ surface, results: [installHooksJson(path, CLAUDE_HOOK_COMMANDS, opts.dryRun)] });
     } else {
-      const hooksJson = installHooksJson(join4(opts.home, ".codex", "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
-      const featureFlag = installCodexFeatureFlag(join4(opts.home, ".codex", "config.toml"), opts.dryRun);
+      const hooksJson = installHooksJson(join5(opts.codexHome, "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
+      const featureFlag = installCodexFeatureFlag(join5(opts.codexHome, "config.toml"), opts.dryRun);
       out.push({ surface, results: [hooksJson, featureFlag] });
     }
   }
@@ -2422,7 +2470,7 @@ function isSechroomOnPath() {
   for (const dir of pathEnv.split(delimiter)) {
     if (!dir) continue;
     for (const name of names) {
-      if (existsSync4(join4(dir, name))) return true;
+      if (existsSync4(join5(dir, name))) return true;
     }
   }
   return false;
@@ -2503,22 +2551,40 @@ Fail-soft: no lane / no auth / no-or-partial intent file / API error -> exit 0,
       return process.exit(0);
     }
   });
-  hook.command("install").description("Wire the session-start + pre-compact hooks into Claude Code and/or Codex config").option("--surface <surface>", "Target surface: claude | codex | both (default: auto-detect installed surfaces)").option("--local", "Claude Code only: write <cwd>/.claude/settings.json instead of ~/.claude/settings.json").option("--dry-run", "Print what would change; write nothing").action((opts) => {
+  hook.command("install").description("Wire the session-start + pre-compact hooks into Claude Code and/or Codex config").option("--surface <surface>", "Target surface: claude | codex | both (default: auto-detect installed surfaces)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--dry-run", "Print what would change; write nothing").action((opts, cmd) => {
+    const g = cmd.optsWithGlobals();
     const dryRun = Boolean(opts.dryRun);
     const cwd = process.cwd();
+    let scope;
     let surfaces;
     try {
+      scope = opts.local ? "project" : resolveScope(opts.scope);
       surfaces = resolveSurfaces(opts.surface, cwd);
     } catch (err2) {
       process.stderr.write(`${err2.message}
 `);
       return process.exit(2);
     }
+    const claudeTargets = surfaces.includes("claude") ? resolveClaudeTargets({ override: g.claudeConfigDir, scope, cwd }) : [];
+    const codexHomes = surfaces.includes("codex") ? resolveCodexHomes({ override: g.codexHome, scope }) : [];
     const results = [];
     try {
-      const installed = installHookSurfaces(surfaces, { dryRun, local: opts.local, cwd, home: homedir3() });
-      for (const { surface, results: surfaceResults } of installed) {
-        process.stdout.write(`${HOOK_SURFACE_LABEL[surface]}:
+      const multiClaude = claudeTargets.length > 1;
+      for (const t of claudeTargets) {
+        const surfaceResults = installHookSurfaces(["claude"], { dryRun, claudeDir: t.dir, codexHome: "" })[0].results;
+        process.stdout.write(`${HOOK_SURFACE_LABEL.claude}${multiClaude ? ` (${t.label})` : ""}:
+`);
+        for (const r of surfaceResults) {
+          results.push(r);
+          process.stdout.write(describe(r, dryRun) + "\n");
+        }
+      }
+      if (surfaces.includes("codex") && codexHomes.length === 0) {
+        process.stdout.write("Codex has no project scope \u2014 skipped (use --scope global for Codex).\n");
+      }
+      for (const codexHome of codexHomes) {
+        const surfaceResults = installHookSurfaces(["codex"], { dryRun, claudeDir: "", codexHome })[0].results;
+        process.stdout.write(`${HOOK_SURFACE_LABEL.codex}:
 `);
         for (const r of surfaceResults) {
           results.push(r);
@@ -2621,7 +2687,7 @@ Examples:
       const client = await makeClient(cfg);
       return client.POST("/continuity/snapshots", { body });
     });
-    const path = resolveIntentPath(cwd) ?? join5(cwd, INTENT_FILE);
+    const path = resolveIntentPath(cwd) ?? join6(cwd, INTENT_FILE);
     const fileBody = { ...merged, scope, lastSnapshotId: data.snapshotId };
     mkdirSync4(dirname5(path), { recursive: true });
     writeFileSync4(path, JSON.stringify(fileBody, null, 2) + "\n");
@@ -3062,12 +3128,14 @@ async function applyClient(cfg, setup, target, opts) {
 }
 
 // src/setup/hooks-offer.ts
-import { homedir as homedir4 } from "os";
 async function maybeOfferHooks(opts) {
   if (opts.dryRun) return;
   const cwd = opts.cwd ?? process.cwd();
+  const scope = opts.scope ?? "global";
   const surfaces = detectHookSurfaces(cwd);
   if (surfaces.length === 0) return;
+  const claudeTargets = surfaces.includes("claude") ? resolveClaudeTargets({ override: opts.claudeConfigDir, scope, cwd }) : [];
+  const codexHomes = surfaces.includes("codex") ? resolveCodexHomes({ override: opts.codexHome, scope }) : [];
   const names = surfaces.map((s) => HOOK_SURFACE_LABEL[s]).join(" + ");
   process.stderr.write(
     `
@@ -3078,15 +3146,28 @@ auto-resumes where you left off and checkpoints working state before compacting.
   const install = opts.yes ? true : canPrompt() ? await promptYesNo(`Install the continuity hooks for ${names}?`) : false;
   if (!install) return;
   try {
-    const installed = installHookSurfaces(surfaces, { dryRun: false, cwd, home: homedir4() });
     let changed = false;
-    for (const { surface, results } of installed) {
+    const emit2 = (surface, results, label) => {
       for (const r of results) {
         if (r.status !== "current") changed = true;
         const verb = r.status === "current" ? "already configured" : r.status === "created" ? "created" : "updated";
-        process.stderr.write(`${style.green("\u2713")} ${HOOK_SURFACE_LABEL[surface]}: ${r.path} (${verb})
+        const tag = label ? ` ${style.dim(`(${label})`)}` : "";
+        process.stderr.write(`${style.green("\u2713")} ${HOOK_SURFACE_LABEL[surface]}${tag}: ${r.path} (${verb})
 `);
       }
+    };
+    const multiClaude = claudeTargets.length > 1;
+    for (const t of claudeTargets) {
+      const results = installHookSurfaces(["claude"], { dryRun: false, claudeDir: t.dir, codexHome: "" })[0].results;
+      emit2("claude", results, multiClaude ? t.label : void 0);
+    }
+    if (surfaces.includes("codex") && codexHomes.length === 0) {
+      process.stderr.write(`${style.dim("Codex has no project scope \u2014 skipped (use --scope global for Codex).")}
+`);
+    }
+    for (const codexHome of codexHomes) {
+      const results = installHookSurfaces(["codex"], { dryRun: false, claudeDir: "", codexHome })[0].results;
+      emit2("codex", results);
     }
     if (changed) {
       process.stderr.write(`${style.dim("Restart (or reload) your agent for the hooks to take effect.")}
@@ -3101,7 +3182,7 @@ auto-resumes where you left off and checkpoints working state before compacting.
 
 // src/setup/skills-offer.ts
 import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "fs";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 
 // src/setup/lane-pin.ts
 var CODE_LANE_PREFIX_BY_CLIENT = {
@@ -3228,18 +3309,17 @@ function resolveAgents(systemRows, personalRows, surface) {
 
 // src/setup/skills-lock.ts
 import { existsSync as existsSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 var SKILLS_LOCK = ".sechroom-skills.json";
 var DEFAULT_SKILLS_SLUG = "operator-skills";
-function skillsDir(global) {
-  return global ? join6(homedir5(), ".claude", "skills") : join6(process.cwd(), ".claude", "skills");
+function skillsDir(configDir) {
+  return join7(configDir, "skills");
 }
-function agentsDir(global) {
-  return global ? join6(homedir5(), ".claude", "agents") : join6(process.cwd(), ".claude", "agents");
+function agentsDir(configDir) {
+  return join7(configDir, "agents");
 }
 function readSkillsLock(dir) {
-  const lockPath = join6(dir, SKILLS_LOCK);
+  const lockPath = join7(dir, SKILLS_LOCK);
   if (!existsSync6(lockPath)) return {};
   try {
     return JSON.parse(readFileSync5(lockPath, "utf8"));
@@ -3249,7 +3329,7 @@ function readSkillsLock(dir) {
 }
 function writeSkillsLock(dir, lock) {
   mkdirSync6(dir, { recursive: true });
-  writeFileSync6(join6(dir, SKILLS_LOCK), JSON.stringify(lock, null, 2) + "\n");
+  writeFileSync6(join7(dir, SKILLS_LOCK), JSON.stringify(lock, null, 2) + "\n");
 }
 function recordMaterialisedSkills(dir, slug, skills, meta = {}) {
   const lock = readSkillsLock(dir);
@@ -3276,6 +3356,7 @@ async function fetchFeedRows(cfg, workspaceId) {
 }
 async function maybeOfferSkills(cfg, personalWorkspaceId, opts) {
   const surface = opts.surface ?? "claude-code";
+  const configDir = opts.configDir ?? resolveClaudeTargets({})[0].dir;
   const [systemRows, personalRows] = await Promise.all([
     fetchFeedRows(cfg, SYSTEM_WORKSPACE_ID),
     personalWorkspaceId ? fetchFeedRows(cfg, personalWorkspaceId) : Promise.resolve([])
@@ -3283,8 +3364,8 @@ async function maybeOfferSkills(cfg, personalWorkspaceId, opts) {
   const skills = resolveSkills(systemRows, personalRows, surface);
   const agents = resolveAgents(systemRows, personalRows, surface);
   if (skills.length === 0 && agents.length === 0) return;
-  const sDir = skillsDir(true);
-  const aDir = agentsDir(true);
+  const sDir = skillsDir(configDir);
+  const aDir = agentsDir(configDir);
   if (opts.dryRun) {
     const lines = (label, items) => items.length === 0 ? "" : `
 Would materialise ${style.bold(String(items.length))} ${label} for ${surface}:
@@ -3309,8 +3390,8 @@ Found ${summary} available to you for ${surface}.
   if (skills.length > 0) {
     const written = [];
     for (const s of skills) {
-      mkdirSync7(join7(sDir, s.name), { recursive: true });
-      writeFileSync7(join7(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
+      mkdirSync7(join8(sDir, s.name), { recursive: true });
+      writeFileSync7(join8(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
       written.push(s.name);
     }
     recordMaterialisedSkills(sDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -3322,7 +3403,7 @@ Found ${summary} available to you for ${surface}.
     const written = [];
     for (const a of agents) {
       const file = `${a.name}.md`;
-      writeFileSync7(join7(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
+      writeFileSync7(join8(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
       written.push(file);
     }
     recordMaterialisedSkills(aDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -3448,7 +3529,7 @@ async function resolveNamespaceChoice(cfg, flag) {
   return picked === GLOBAL_NAMESPACE ? null : picked;
 }
 function registerInit(program2) {
-  program2.command("init").description("Wire this project for sechroom: write MCP config + agent instruction files from the server's setup descriptors").option("--client <list...>", `clients to wire \u2014 space- or comma-separated (${ALL_CLIENT_KEYS.join(", ")}) or 'all'`, DEFAULT_CLIENT_KEY).option("--dry-run", "print what would be written without writing", false).option("--mcp-only", "only write MCP config (skip agent files)", false).option("--agent-files-only", "only write agent instruction files (skip MCP config)", false).option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--namespace <slug>", "MCP namespace for the connection URL (interactive picker if omitted on a TTY; defaults to tenant-global)").option("--refresh", "refresh out-of-date agent-file blocks in place (local edits preserved to .proposed)", false).option("--force", "rewrite agent-file managed blocks, overwriting local edits inside the markers", false).option("--check", "report whether agent files would change and exit (0 = current, 1 = stale/drift/absent); writes nothing", false).addHelpText(
+  program2.command("init").description("Wire this project for sechroom: write MCP config + agent instruction files from the server's setup descriptors").option("--client <list...>", `clients to wire \u2014 space- or comma-separated (${ALL_CLIENT_KEYS.join(", ")}) or 'all'`, DEFAULT_CLIENT_KEY).option("--scope <scope>", "install skills/agents/hooks 'global' (config dir / CLAUDE_CONFIG_DIR) or 'project' (<cwd>/.claude) \u2014 default global", "global").option("--dry-run", "print what would be written without writing", false).option("--mcp-only", "only write MCP config (skip agent files)", false).option("--agent-files-only", "only write agent instruction files (skip MCP config)", false).option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--namespace <slug>", "MCP namespace for the connection URL (interactive picker if omitted on a TTY; defaults to tenant-global)").option("--refresh", "refresh out-of-date agent-file blocks in place (local edits preserved to .proposed)", false).option("--force", "rewrite agent-file managed blocks, overwriting local edits inside the markers", false).option("--check", "report whether agent files would change and exit (0 = current, 1 = stale/drift/absent); writes nothing", false).addHelpText(
     "after",
     `
 Examples:
@@ -3466,9 +3547,18 @@ Examples:
       "Fetching setup descriptors",
       () => fetchSetup(cfg, namespaceSlug ?? void 0)
     );
-    const targets = clientTargets(process.cwd());
+    const g = cmd.optsWithGlobals();
+    let scope;
+    try {
+      scope = resolveScope(opts.scope);
+    } catch (err2) {
+      return fail(err2.message);
+    }
+    const claudeTargets = resolveClaudeTargets({ override: g.claudeConfigDir, scope, cwd: process.cwd() });
+    const codexHomes = resolveCodexHomes({ override: g.codexHome, scope });
+    const targets = clientTargets(process.cwd(), { claudeDir: claudeTargets[0]?.dir, codexHome: codexHomes[0] });
     const keys = resolveClientKeys(opts.client);
-    const json = cmd.optsWithGlobals().json;
+    const json = g.json;
     const personalWorkspaceId = await getPersonalWorkspaceId(cfg);
     if (!opts.dryRun && !opts.mcpOnly && !check) {
       await maybeOfferCopies(cfg, setup, targets, keys, personalWorkspaceId, copyChoice(opts));
@@ -3488,10 +3578,12 @@ Examples:
     }
     summarizeEval(result, mode, Boolean(json), Boolean(opts.dryRun));
     if (!json && !opts.dryRun && !opts.mcpOnly) {
-      await maybeOfferSkills(cfg, personalWorkspaceId, { yes: false, dryRun: Boolean(opts.dryRun), surface: "claude-code" });
+      for (const t of claudeTargets) {
+        await maybeOfferSkills(cfg, personalWorkspaceId, { yes: false, dryRun: Boolean(opts.dryRun), surface: "claude-code", configDir: t.dir });
+      }
     }
     if (!json && !opts.dryRun && !opts.mcpOnly) {
-      await maybeOfferHooks({ yes: false, dryRun: Boolean(opts.dryRun), cwd: process.cwd() });
+      await maybeOfferHooks({ yes: false, dryRun: Boolean(opts.dryRun), cwd: process.cwd(), scope, claudeConfigDir: g.claudeConfigDir, codexHome: g.codexHome });
     }
     if (json) {
       emit({ dryRun: Boolean(opts.dryRun), clients: result }, true);
@@ -3587,10 +3679,13 @@ ${body}
   });
 }
 async function runClients(clients, cmd, opts) {
-  const cfg = resolveConfig(cmd.optsWithGlobals());
+  const g = cmd.optsWithGlobals();
+  const cfg = resolveConfig(g);
   const mode = opts.mode ?? "apply";
   const check = mode === "check";
-  const targets = clientTargets(process.cwd());
+  const claudeDir = resolveClaudeTargets({ override: g.claudeConfigDir })[0]?.dir;
+  const codexHome = resolveCodexHomes({ override: g.codexHome })[0];
+  const targets = clientTargets(process.cwd(), { claudeDir, codexHome });
   const keys = resolveClientKeys(clients.join(","));
   const namespaceSlug = opts.mcp ? await resolveNamespaceChoice(cfg, opts.namespace) : null;
   const setupData = await withSpinner(
@@ -3601,7 +3696,7 @@ async function runClients(clients, cmd, opts) {
   if (opts.agentFiles && !opts.dryRun && !check) {
     await maybeOfferCopies(cfg, setupData, targets, keys, personalWorkspaceId, copyChoice(opts));
   }
-  const json = cmd.optsWithGlobals().json;
+  const json = g.json;
   const result = [];
   for (const key of keys) {
     const target = targets[key];
@@ -3692,12 +3787,12 @@ Wired to namespace '${slug}'. Restart your AI client (or reload MCP) to pick it
 
 // src/commands/onboard.ts
 import { existsSync as existsSync8 } from "fs";
-import { basename as basename3, join as join9 } from "path";
+import { basename as basename3, join as join10 } from "path";
 
 // src/commands/fanout.ts
 import { spawnSync } from "child_process";
 import { existsSync as existsSync7, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
-import { isAbsolute, join as join8, resolve } from "path";
+import { isAbsolute, join as join9, resolve } from "path";
 var ICON = {
   refresh: "\u21BB",
   bind: "+",
@@ -3717,13 +3812,13 @@ function discoverChildren(root) {
   const out = [];
   for (const name of names.sort()) {
     if (name.startsWith(".") || name === "node_modules") continue;
-    const dir = join8(root, name);
+    const dir = join9(root, name);
     try {
       if (!statSync3(dir).isDirectory()) continue;
     } catch {
       continue;
     }
-    if (existsSync7(join8(dir, ".git")) || committedBindingPath(dir)) out.push(name);
+    if (existsSync7(join9(dir, ".git")) || committedBindingPath(dir)) out.push(name);
   }
   return out;
 }
@@ -4094,12 +4189,24 @@ async function chooseClients(clientFlag, yes, cwd) {
   );
   return picks.length > 0 ? picks : preselected;
 }
+async function chooseScope(scopeFlag, yes) {
+  if (scopeFlag != null) return resolveScope(scopeFlag);
+  if (!canPrompt() || yes) return "global";
+  return promptSelect(
+    "Install skills, agents, and hooks globally or just for this project?",
+    [
+      { label: "Globally", value: "global", hint: "~/.claude (or CLAUDE_CONFIG_DIR) \u2014 all projects" },
+      { label: "This project", value: "project", hint: "<repo>/.claude" }
+    ],
+    "global"
+  );
+}
 async function planRecurseChild(entry, root, client, opts) {
   const dir = resolveChildDir(entry.path, root);
   if (!existsSync8(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
-  if (existsSync8(join9(dir, ".sechroom.json"))) {
+  if (existsSync8(join10(dir, ".sechroom.json"))) {
     return {
       label: entry.path,
       dir,
@@ -4172,7 +4279,7 @@ This fan-out will pin the same lane in every repo:
 async function runRecurse(cfg, g, opts) {
   const { yes, dryRun, json } = opts;
   const root = process.cwd();
-  const manifestPath = join9(root, ".sechroom", "repos.json");
+  const manifestPath = join10(root, ".sechroom", "repos.json");
   const fromManifest = readManifest(manifestPath);
   const entries = fromManifest ?? discoverChildren(root).map((path) => ({ path }));
   const sourceLabel = fromManifest ? `manifest ${manifestPath}` : `auto-discovered under ${root}`;
@@ -4200,7 +4307,7 @@ async function runRecurse(cfg, g, opts) {
   summarizeFanout(results, { dryRun });
 }
 function registerOnboard(program2) {
-  program2.command("onboard").description("Guided first-run setup: configure, sign in, set timezone, detect clients, and wire this project").option("--recurse", "orchestration-root mode: onboard every child repo under this dir (auto-discovered, or from ./.sechroom/repos.json) \u2014 refreshes bound repos, prompts a workspace per new one", false).option("--lane <id>", "set the code-lane (substrate source identity) explicitly instead of inferring it; with --recurse it's used for every child repo").option("--design-lane <id>", "set the design-lane explicitly (substrate-authoring identity); with --recurse applies to every child").option("--client <list...>", `clients to wire \u2014 space- or comma-separated (${ALL_CLIENT_KEYS.join(", ")}) or 'all' (default: auto-detected)`).option("--local", "save the binding (tenant + base URL + workspace) to a committed .sechroom.json in this repo instead of the global config", false).option("--here", "with --local: write the binding at THIS directory even when a parent already carries one \u2014 binds a subtree (e.g. a monorepo's frontend/) to its own workspace", false).option("--workspace <id>", "bind this directory to a workspace (skips the interactive workspace pick)").option("--cli-only", "configure the CLI only \u2014 don't wire any AI client (no MCP config, no agent files)", false).option("--no-mcp", "skip the MCP server config (.mcp.json etc.); still write the agent instruction files").option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--dry-run", "walk through without writing files or changing the profile", false).option("--refresh", "re-fetch descriptors and refresh any out-of-date managed blocks (local edits preserved to .proposed)", false).option("--force", "rewrite every managed block, overwriting local edits inside the markers (content outside untouched)", false).option("--check", "report whether anything would change and exit (0 = all current, 1 = stale/drift/absent); writes nothing", false).option("-y, --yes", "non-interactive: accept defaults (system timezone, detected clients, global config, full wire)", false).addHelpText(
+  program2.command("onboard").description("Guided first-run setup: configure, sign in, set timezone, detect clients, and wire this project").option("--recurse", "orchestration-root mode: onboard every child repo under this dir (auto-discovered, or from ./.sechroom/repos.json) \u2014 refreshes bound repos, prompts a workspace per new one", false).option("--lane <id>", "set the code-lane (substrate source identity) explicitly instead of inferring it; with --recurse it's used for every child repo").option("--design-lane <id>", "set the design-lane explicitly (substrate-authoring identity); with --recurse applies to every child").option("--client <list...>", `clients to wire \u2014 space- or comma-separated (${ALL_CLIENT_KEYS.join(", ")}) or 'all' (default: auto-detected)`).option("--scope <scope>", "install skills/agents/hooks 'global' (config dir / CLAUDE_CONFIG_DIR) or 'project' (<cwd>/.claude) \u2014 default: prompt, else global").option("--local", "save the binding (tenant + base URL + workspace) to a committed .sechroom.json in this repo instead of the global config", false).option("--here", "with --local: write the binding at THIS directory even when a parent already carries one \u2014 binds a subtree (e.g. a monorepo's frontend/) to its own workspace", false).option("--workspace <id>", "bind this directory to a workspace (skips the interactive workspace pick)").option("--cli-only", "configure the CLI only \u2014 don't wire any AI client (no MCP config, no agent files)", false).option("--no-mcp", "skip the MCP server config (.mcp.json etc.); still write the agent instruction files").option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--dry-run", "walk through without writing files or changing the profile", false).option("--refresh", "re-fetch descriptors and refresh any out-of-date managed blocks (local edits preserved to .proposed)", false).option("--force", "rewrite every managed block, overwriting local edits inside the markers (content outside untouched)", false).option("--check", "report whether anything would change and exit (0 = all current, 1 = stale/drift/absent); writes nothing", false).option("-y, --yes", "non-interactive: accept defaults (system timezone, detected clients, global config, full wire)", false).addHelpText(
     "after",
     `
 Examples:
@@ -4243,6 +4350,13 @@ Examples:
       process.stderr.write(line);
     }
     const wire = await chooseWire(opts, yes);
+    const scope = await chooseScope(opts.scope, yes);
+    const claudeTargets = resolveClaudeTargets({ override: g.claudeConfigDir, scope, cwd: process.cwd() });
+    const codexHomes = resolveCodexHomes({ override: g.codexHome, scope });
+    if (scope === "project" && g.claudeConfigDir && !json) {
+      process.stderr.write(`${style.dim("(--claude-config-dir is ignored for --scope project \u2014 project files are repo-relative)")}
+`);
+    }
     if (wire === "cli-only") {
       if (json) {
         emit({ dryRun, baseUrl: cfg.baseUrl, tenant: cfg.tenant, workspaceId: cfg.workspaceId ?? null, timezone: tz, wire, clients: [] }, true);
@@ -4250,7 +4364,7 @@ Examples:
       }
       if (!dryRun) {
         await ensureLanePin(cfg, { yes, dryRun, clients: detectInstalledClients(process.cwd()) });
-        await maybeOfferHooks({ yes, dryRun, cwd: process.cwd() });
+        await maybeOfferHooks({ yes, dryRun, cwd: process.cwd(), scope, claudeConfigDir: g.claudeConfigDir, codexHome: g.codexHome });
       }
       process.stdout.write(
         `
@@ -4263,7 +4377,7 @@ Try: ${style.cyan('sechroom memory search "..."')}  or  ${style.cyan("sechroom -
     }
     const keys = await chooseClients(opts.client, yes, process.cwd());
     const setup = await withSpinner("Fetching setup descriptors", () => fetchSetup(cfg));
-    const targets = clientTargets(process.cwd());
+    const targets = clientTargets(process.cwd(), { claudeDir: claudeTargets[0]?.dir, codexHome: codexHomes[0] });
     const personalWorkspaceId = await getPersonalWorkspaceId(cfg);
     if (!dryRun && !check) {
       await maybeOfferCopies(cfg, setup, targets, keys, personalWorkspaceId, copyChoice(opts));
@@ -4307,10 +4421,12 @@ Try: ${style.cyan('sechroom memory search "..."')}  or  ${style.cyan("sechroom -
       await ensureLanePin(cfg, { yes, dryRun, clients: keys });
     }
     if (!json && !dryRun) {
-      await maybeOfferSkills(cfg, personalWorkspaceId, { yes, dryRun, surface: "claude-code" });
+      for (const t of claudeTargets) {
+        await maybeOfferSkills(cfg, personalWorkspaceId, { yes, dryRun, surface: "claude-code", configDir: t.dir });
+      }
     }
     if (!json && !dryRun) {
-      await maybeOfferHooks({ yes, dryRun, cwd: process.cwd() });
+      await maybeOfferHooks({ yes, dryRun, cwd: process.cwd(), scope, claudeConfigDir: g.claudeConfigDir, codexHome: g.codexHome });
     }
     if (json) {
       emit({ dryRun, baseUrl: cfg.baseUrl, tenant: cfg.tenant, workspaceId: cfg.workspaceId ?? null, timezone: tz, wire, eval: evalCounts, clients: result }, true);
@@ -4387,8 +4503,8 @@ async function printStarterPrompt(mode, cfg) {
 
 // src/commands/sweep.ts
 import { existsSync as existsSync9 } from "fs";
-import { dirname as dirname7, join as join10, resolve as resolve2 } from "path";
-var DEFAULT_MANIFEST = join10(".sechroom", "repos.json");
+import { dirname as dirname7, join as join11, resolve as resolve2 } from "path";
+var DEFAULT_MANIFEST = join11(".sechroom", "repos.json");
 function planEntry(entry, root) {
   const dir = resolveChildDir(entry.path, root);
   if (!existsSync9(dir)) {
@@ -4485,7 +4601,7 @@ Examples:
 }
 
 // src/commands/skills.ts
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 import { existsSync as existsSync10, rmSync as rmSync2 } from "fs";
 
 // src/commands/lane.ts
@@ -4569,24 +4685,45 @@ To install/refresh skills, run 'sechroom onboard' (it offers to materialise them
       console.log(`  ${i.bundleSlug ?? i.BundleSlug}@${i.bundleVersion ?? i.BundleVersion ?? "?"}${tag}`);
     });
   });
-  skills.command("clean [slug]").description(`Remove skill files materialised by onboard (default ${DEFAULT_SKILLS_SLUG})`).option("--local", "clean ./.claude/skills instead of ~/.claude/skills").option("--json", "machine output").action(async (slugArg, opts) => {
+  skills.command("clean [slug]").description(`Remove skill files materialised by onboard (default ${DEFAULT_SKILLS_SLUG})`).option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").action(async (slugArg, opts, cmd) => {
+    const g = cmd.optsWithGlobals();
     const slug = slugArg || DEFAULT_SKILLS_SLUG;
-    const dir = skillsDir(!opts.local);
-    const lock = readSkillsLock(dir);
-    const entry = lock[slug];
-    if (!entry) fail(`No materialised skills recorded for '${slug}' in ${join11(dir, SKILLS_LOCK)}.`);
-    const removed = [];
-    for (const name of entry.skills) {
-      const skillPath = join11(dir, name);
-      if (existsSync10(skillPath)) {
-        rmSync2(skillPath, { recursive: true, force: true });
-        removed.push(name);
+    let scope;
+    try {
+      scope = opts.local ? "project" : resolveScope(opts.scope);
+    } catch (err2) {
+      return fail(err2.message);
+    }
+    const targets = resolveClaudeTargets({ override: g.claudeConfigDir, scope, cwd: process.cwd() });
+    const cleaned = [];
+    const missing = [];
+    for (const t of targets) {
+      const dir = skillsDir(t.dir);
+      const lock = readSkillsLock(dir);
+      const entry = lock[slug];
+      if (!entry) {
+        missing.push(join12(dir, SKILLS_LOCK));
+        continue;
       }
+      const removed = [];
+      for (const name of entry.skills) {
+        const skillPath = join12(dir, name);
+        if (existsSync10(skillPath)) {
+          rmSync2(skillPath, { recursive: true, force: true });
+          removed.push(name);
+        }
+      }
+      delete lock[slug];
+      writeSkillsLock(dir, lock);
+      cleaned.push({ dir, removed });
+    }
+    if (cleaned.length === 0) {
+      return fail(`No materialised skills recorded for '${slug}' in ${missing.join(", ")}.`);
+    }
+    if (opts.json) return emit({ slug, cleaned, missing }, true);
+    for (const { dir, removed } of cleaned) {
+      console.log(style.green(`Removed ${removed.length} skill(s) for ${slug} from ${dir}`));
     }
-    delete lock[slug];
-    writeSkillsLock(dir, lock);
-    if (opts.json) return emit({ slug, removed, dir }, true);
-    console.log(style.green(`Removed ${removed.length} skill(s) for ${slug} from ${dir}`));
   });
   skills.command("set-lane").description("Alias of `sechroom lane set` (kept for back-compat) \u2014 write this checkout's lane pin").option("--code-lane <id>", "code-surface lane id (e.g. claude-code-chris)").option("--design-lane <id>", "design / substrate-authoring lane id (e.g. claude-design-chris)").option("--json", "machine output").action(
     (opts, cmd) => setLane({
@@ -4659,23 +4796,23 @@ To install/refresh skills, run 'sechroom onboard' (it offers to materialise them
 }
 
 // src/commands/reset.ts
-import { homedir as homedir6 } from "os";
-import { join as join12 } from "path";
+import { homedir as homedir4 } from "os";
+import { join as join13 } from "path";
 import { existsSync as existsSync11, readFileSync as readFileSync7, rmSync as rmSync3 } from "fs";
 var SKILLS_LOCK2 = ".sechroom-skills.json";
-var localSkillsDir = () => join12(process.cwd(), ".claude", "skills");
-var globalSkillsDir = () => join12(homedir6(), ".claude", "skills");
-var localAgentsDir = () => join12(process.cwd(), ".claude", "agents");
-var globalAgentsDir = () => join12(homedir6(), ".claude", "agents");
+var localSkillsDir = () => join13(process.cwd(), ".claude", "skills");
+var globalSkillsDir = () => join13(homedir4(), ".claude", "skills");
+var localAgentsDir = () => join13(process.cwd(), ".claude", "agents");
+var globalAgentsDir = () => join13(homedir4(), ".claude", "agents");
 function removeMaterialisedSkills(dir) {
   const removed = [];
-  const lockPath = join12(dir, SKILLS_LOCK2);
+  const lockPath = join13(dir, SKILLS_LOCK2);
   if (!existsSync11(lockPath)) return removed;
   try {
     const lock = JSON.parse(readFileSync7(lockPath, "utf8"));
     for (const entry of Object.values(lock)) {
       for (const name of entry.skills ?? []) {
-        const p = join12(dir, name);
+        const p = join13(dir, name);
         if (existsSync11(p)) {
           rmSync3(p, { recursive: true, force: true });
           removed.push(p);
@@ -4721,17 +4858,17 @@ function registerReset(program2) {
       }
     }
     const removed = [];
-    const stateDir = join12(process.cwd(), ".sechroom");
+    const stateDir = join13(process.cwd(), ".sechroom");
     if (existsSync11(stateDir)) {
       rmSync3(stateDir, { recursive: true, force: true });
       removed.push(stateDir);
     }
-    const legacyCfg = join12(process.cwd(), ".sechroom.json");
+    const legacyCfg = join13(process.cwd(), ".sechroom.json");
     if (existsSync11(legacyCfg)) {
       rmSync3(legacyCfg, { force: true });
       removed.push(legacyCfg);
     }
-    const legacySem = join12(process.cwd(), ".sem");
+    const legacySem = join13(process.cwd(), ".sem");
     if (existsSync11(legacySem)) {
       rmSync3(legacySem, { force: true });
       removed.push(legacySem);
@@ -4769,7 +4906,7 @@ function resolveVersion() {
   }
 }
 var program = new Command();
-program.name("sechroom").description("Sechroom CLI \u2014 thin generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.").version(resolveVersion()).option("--base-url <url>", "API base URL (overrides config / SECHROOM_BASE_URL)").option("--tenant <tenant>", "Tenant id (required by the API; overrides config / SECHROOM_TENANT)").option("--binding <name>", "Named workspace binding from .sechroom.json `workspaces` (overrides path auto-selection / SECHROOM_BINDING)").option("--json", "Emit compact JSON (for scripts and agents)", false);
+program.name("sechroom").description("Sechroom CLI \u2014 thin generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.").version(resolveVersion()).option("--base-url <url>", "API base URL (overrides config / SECHROOM_BASE_URL)").option("--tenant <tenant>", "Tenant id (required by the API; overrides config / SECHROOM_TENANT)").option("--binding <name>", "Named workspace binding from .sechroom.json `workspaces` (overrides path auto-selection / SECHROOM_BINDING)").option("--claude-config-dir <dirs>", "Claude config dir(s), comma-separated (overrides CLAUDE_CONFIG_DIR / ~/.claude)").option("--codex-home <dir>", "Codex home (overrides CODEX_HOME / ~/.codex)").option("--json", "Emit compact JSON (for scripts and agents)", false);
 program.addHelpText(
   "after",
   `

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.6.32",
+  "version": "2026.6.33",
   "description": "Sechroom CLI — a thin, generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.",
   "type": "module",
   "license": "UNLICENSED",