@sechroom/cli 2026.6.5 → 2026.6.6

package/README.md

@@ -100,6 +100,23 @@ sechroom lookup sechroom:mem_XXXX --json # namespaced form also resolves
 sechroom --json memory get mem_XXXX     # agent-friendly
 ```
 
+**Per-directory config.** A project dir can pin its own `tenant` + `baseUrl` in a local `.sechroom.json`, discovered by walking **up** from cwd (nearest wins, so any subdir inherits it). It overrides the global config — precedence: `--flag` > env > directory-local > global > default. `clientId` / auth state stays global.
+
+```bash
+sechroom config set --local tenant  cli-smoke                       # this dir + subdirs
+sechroom config set --local baseUrl https://staging.app.sechroom.ai/api
+sechroom config show                                                # resolved values + which source won
+```
+
+**Smoke testing.** There is a dedicated **`cli-smoke`** tenant on **both staging and prod** for exercising the CLI without touching real tenants — point at staging and use it:
+
+```bash
+sechroom config set --local baseUrl https://staging.app.sechroom.ai/api
+sechroom config set --local tenant  cli-smoke
+sechroom login
+sechroom worklog append --text "cli smoke" --source claude-code-chris
+```
+
 Headless:
 
 ```bash

package/dist/index.js

@@ -11,11 +11,12 @@ import open from "open";
 
 // src/config.ts
 import { homedir } from "os";
-import { join } from "path";
+import { join, dirname } from "path";
 import { mkdirSync, readFileSync, writeFileSync, existsSync } from "fs";
 var CONFIG_DIR = join(homedir(), ".config", "sechroom");
 var CONFIG_FILE = join(CONFIG_DIR, "config.json");
 var TOKEN_FILE = join(CONFIG_DIR, "token.json");
+var LOCAL_CONFIG_NAME = ".sechroom.json";
 var DEFAULT_BASE_URL = "https://app.sechroom.ai/api";
 function ensureDir() {
   if (!existsSync(CONFIG_DIR)) mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
@@ -32,6 +33,13 @@ function writePersisted(patch) {
   const next = { ...readPersisted(), ...patch };
   writeFileSync(CONFIG_FILE, JSON.stringify(next, null, 2), { mode: 384 });
 }
+function readDcrClientId(baseUrl) {
+  return readPersisted().clientIds?.[baseUrl];
+}
+function writeDcrClientId(baseUrl, clientId) {
+  const p = readPersisted();
+  writePersisted({ clientIds: { ...p.clientIds ?? {}, [baseUrl]: clientId } });
+}
 function readToken() {
   const envTok = process.env.SECHROOM_TOKEN;
   if (envTok) return { accessToken: envTok };
@@ -45,17 +53,67 @@ function writeToken(tok) {
   ensureDir();
   writeFileSync(TOKEN_FILE, JSON.stringify(tok, null, 2), { mode: 384 });
 }
+function findLocalConfigPath(start = process.cwd()) {
+  let dir = start;
+  for (; ; ) {
+    const candidate = join(dir, LOCAL_CONFIG_NAME);
+    if (existsSync(candidate)) return candidate;
+    const parent = dirname(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function readLocalConfig() {
+  const path = findLocalConfigPath();
+  if (!path) return {};
+  try {
+    const c = JSON.parse(readFileSync(path, "utf8"));
+    return { baseUrl: c.baseUrl, tenant: c.tenant, path };
+  } catch {
+    return {};
+  }
+}
+function writeLocalConfig(patch) {
+  const path = findLocalConfigPath() ?? join(process.cwd(), LOCAL_CONFIG_NAME);
+  let current = {};
+  try {
+    current = JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+  }
+  writeFileSync(path, JSON.stringify({ ...current, ...patch }, null, 2), { mode: 384 });
+  return path;
+}
 function resolveConfig(flags) {
+  const local = readLocalConfig();
   const persisted = readPersisted();
-  const baseUrl = flags.baseUrl ?? process.env.SECHROOM_BASE_URL ?? persisted.baseUrl ?? DEFAULT_BASE_URL;
-  const tenant = flags.tenant ?? process.env.SECHROOM_TENANT ?? persisted.tenant ?? "";
+  const baseUrl = flags.baseUrl ?? process.env.SECHROOM_BASE_URL ?? local.baseUrl ?? persisted.baseUrl ?? DEFAULT_BASE_URL;
+  const tenant = flags.tenant ?? process.env.SECHROOM_TENANT ?? local.tenant ?? persisted.tenant ?? "";
   if (!tenant) {
     throw new Error(
-      "No tenant set. The Sechroom API rejects untenanted requests (HTTP 400). Pass --tenant <id>, set SECHROOM_TENANT, or run `sechroom config set tenant <id>`."
+      "No tenant set. The Sechroom API rejects untenanted requests (HTTP 400). Pass --tenant <id>, set SECHROOM_TENANT, run `sechroom config set tenant <id>`, or `sechroom config set --local tenant <id>` for this directory."
     );
   }
   return { baseUrl: baseUrl.replace(/\/$/, ""), tenant, clientId: persisted.clientId };
 }
+function describeConfig(flags) {
+  const local = readLocalConfig();
+  const g = readPersisted();
+  const localTag = local.path ? `local (${local.path})` : "local";
+  const pick = (flag, env, l, gl, def) => {
+    if (flag) return { value: flag, source: "flag" };
+    if (env) return { value: env, source: "env" };
+    if (l) return { value: l, source: localTag };
+    if (gl) return { value: gl, source: "global" };
+    if (def) return { value: def, source: "default" };
+    return { value: void 0, source: "unset" };
+  };
+  const baseUrl = pick(flags.baseUrl, process.env.SECHROOM_BASE_URL, local.baseUrl, g.baseUrl, DEFAULT_BASE_URL);
+  return {
+    baseUrl: { value: baseUrl.value, source: baseUrl.source },
+    tenant: pick(flags.tenant, process.env.SECHROOM_TENANT, local.tenant, g.tenant),
+    localPath: local.path
+  };
+}
 
 // src/auth.ts
 var SCOPES = "openid email profile";
@@ -72,26 +130,26 @@ async function discover(baseUrl) {
   if (!res.ok) throw new Error(`AS discovery failed (${res.status}) at ${baseUrl}`);
   return await res.json();
 }
-async function ensureClientId(meta) {
-  const cached = readPersisted().clientId;
-  if (cached) return cached;
-  if (!meta.registration_endpoint) {
-    throw new Error(
-      "Server advertises no registration_endpoint and no client_id is cached. Pre-register a client and run `sechroom config set clientId <id>`."
-    );
+async function ensureClientId(meta, baseUrl) {
+  if (meta.registration_endpoint) {
+    const res = await fetch(meta.registration_endpoint, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        client_name: "sechroom-cli",
+        redirect_uris: CANDIDATE_PORTS.map(redirectUriFor)
+      })
+    });
+    if (!res.ok) throw new Error(`Dynamic client registration failed (${res.status}): ${await res.text()}`);
+    const reg = await res.json();
+    writeDcrClientId(baseUrl, reg.client_id);
+    return reg.client_id;
   }
-  const res = await fetch(meta.registration_endpoint, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({
-      client_name: "sechroom-cli",
-      redirect_uris: CANDIDATE_PORTS.map(redirectUriFor)
-    })
-  });
-  if (!res.ok) throw new Error(`Dynamic client registration failed (${res.status}): ${await res.text()}`);
-  const reg = await res.json();
-  writePersisted({ clientId: reg.client_id });
-  return reg.client_id;
+  const fallback = readPersisted().clientId ?? readDcrClientId(baseUrl);
+  if (fallback) return fallback;
+  throw new Error(
+    "Server advertises no registration_endpoint and no client_id is configured. Pre-register a client and run `sechroom config set clientId <id>`."
+  );
 }
 function startLoopback(state) {
   return new Promise((resolveOuter, rejectOuter) => {
@@ -162,7 +220,7 @@ function persistTokenResponse(json) {
 }
 async function login(cfg) {
   const meta = await discover(cfg.baseUrl);
-  const clientId = await ensureClientId(meta);
+  const clientId = await ensureClientId(meta, cfg.baseUrl);
   const state = b64url(randomBytes(16));
   const verifier = b64url(randomBytes(32));
   const challenge = b64url(createHash("sha256").update(verifier).digest());
@@ -436,7 +494,7 @@ function registerLookup(program2) {
 
 // src/setup/apply.ts
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2 } from "fs";
-import { dirname } from "path";
+import { dirname as dirname2 } from "path";
 
 // src/setup/operator-surface.ts
 var SectionType = {
@@ -538,7 +596,7 @@ async function createOverride(cfg, template, personalWorkspaceId) {
 var BLOCK_BEGIN = "<!-- @sechroom/cli:begin (managed \u2014 re-run `sechroom setup agent-files` to refresh) -->";
 var BLOCK_END = "<!-- @sechroom/cli:end -->";
 function ensureDir2(path) {
-  mkdirSync2(dirname(path), { recursive: true });
+  mkdirSync2(dirname2(path), { recursive: true });
 }
 function readOr(path, fallback) {
   try {
@@ -634,7 +692,7 @@ async function applyClient(cfg, setup, target, opts) {
 // src/setup/clients.ts
 import { existsSync as existsSync3 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join2 } from "path";
+import { dirname as dirname3, join as join2 } from "path";
 function claudeDesktopConfigPath(home) {
   switch (process.platform) {
     case "darwin":
@@ -680,7 +738,7 @@ function detectInstalledClients(cwd) {
   const home = homedir2();
   const detected = [];
   if (existsSync3(join2(home, ".claude"))) detected.push("claude-code");
-  if (existsSync3(dirname2(claudeDesktopConfigPath(home)))) detected.push("claude-desktop");
+  if (existsSync3(dirname3(claudeDesktopConfigPath(home)))) detected.push("claude-desktop");
   if (existsSync3(join2(home, ".codex"))) detected.push("codex");
   if (existsSync3(join2(home, ".cursor")) || existsSync3(join2(cwd, ".cursor"))) detected.push("cursor");
   return detected;
@@ -958,7 +1016,18 @@ program.command("login").description("Sign in via browser (OAuth auth-code + PKC
   await login({ baseUrl: baseUrl.replace(/\/$/, ""), tenant: g.tenant ?? "" });
 });
 var config = program.command("config").description("Manage persisted CLI config");
-config.command("set <key> <value>").description("Set baseUrl | tenant | clientId").action((key, value) => {
+config.command("set <key> <value>").description("Set baseUrl | tenant | clientId (clientId is global-only)").option("--local", "Write to the directory-local .sechroom.json (nearest up the tree, else cwd) instead of the global config").action((key, value, opts) => {
+  if (opts.local) {
+    if (!["baseUrl", "tenant"].includes(key)) {
+      process.stderr.write(`--local supports only: baseUrl | tenant (clientId is global)
+`);
+      process.exit(1);
+    }
+    const path = writeLocalConfig({ [key]: value });
+    process.stdout.write(`set ${key} (local: ${path})
+`);
+    return;
+  }
   if (!["baseUrl", "tenant", "clientId"].includes(key)) {
     process.stderr.write(`unknown key: ${key} (expected baseUrl | tenant | clientId)
 `);
@@ -968,8 +1037,27 @@ config.command("set <key> <value>").description("Set baseUrl | tenant | clientId
   process.stdout.write(`set ${key}
 `);
 });
-config.command("show").description("Print persisted config").action(() => {
-  process.stdout.write(JSON.stringify(readPersisted(), null, 2) + "\n");
+config.command("show").description("Print resolved config + sources (flag > env > local > global > default)").action((_opts, cmd) => {
+  const g = cmd.optsWithGlobals();
+  const d = describeConfig({ baseUrl: g.baseUrl, tenant: g.tenant });
+  if (g.json) {
+    process.stdout.write(
+      JSON.stringify({
+        resolved: { baseUrl: d.baseUrl, tenant: d.tenant },
+        global: readPersisted(),
+        local: readLocalConfig()
+      }) + "\n"
+    );
+    return;
+  }
+  process.stdout.write(
+    `baseUrl: ${d.baseUrl.value}  [${d.baseUrl.source}]
+tenant:  ${d.tenant.value ?? "(unset)"}  [${d.tenant.source}]
+
+global: ${JSON.stringify(readPersisted())}
+local:  ${d.localPath ?? "(none)"} ${JSON.stringify(readLocalConfig())}
+`
+  );
 });
 registerMemory(program);
 registerWorklog(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.6.5",
+  "version": "2026.6.6",
   "description": "Sechroom CLI — a thin, generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.",
   "type": "module",
   "license": "UNLICENSED",