@sechroom/cli 2026.6.7 → 2026.6.9

package/README.md

@@ -132,6 +132,28 @@ export SECHROOM_TENANT=ocd
 sechroom --json memory search "rate limiting" 
 ```
 
+## Command surface (MCP parity)
+
+The CLI mirrors the sechroom MCP tool surface — every command is a thin wrapper over the same HTTP endpoint the matching MCP tool shims, so enforcement (`[TenantPermission]`) is identical. Run `sechroom <group> --help` for the subcommands + examples.
+
+| Group | Covers |
+|---|---|
+| `memory` | create / get / search · edit-text(+batch) · archive / restore / move · versions / revert · list-archived · owners / tags / types · sum-tokens · similar · by-url |
+| `relationship` | create / list / delete · suggest · `suggestion` get / accept / reject / defer |
+| `workspace` | create / list / get · rename / describe / move · archive / restore · feed |
+| `project` | create / list / get · rename / describe / move · status · victory-conditions · archive / restore |
+| `filing` | suggestions / get · preview · accept / reject / defer / edit-and-accept |
+| `continuity` | snapshot-create / -get · snapshots · resume-me / resume-lane · changed-since · load-set · grant / revoke-grant |
+| `id` | next / peek (FR-_/D-_ sequence allocation) |
+| `account` | profile / set-profile · feed · reviews / review-get / review-accept · lookup-batch |
+| `chat` | messages · replies · stop-tracking (Slack / Discord, via `--surface`) |
+| `worklog` · `lookup` | append · resolve any id |
+
+Notes on deliberate gaps (API-rooted, not CLI):
+- **No `memory delete`** — the API exposes no hard DELETE; `memory archive` is the soft-delete path.
+- **No `chat send`** — the unified `/chat/*` surface has no POST send endpoint yet, so the Slack/Discord *send* tools can't be wrapped. Reading works today; `send` lands once the route is added to the spec.
+- **`memory revert`** needs `--text` + `--content` — the revert endpoint doesn't reconstruct a version's body from its number; pull them from `memory versions` / `memory get` first.
+
 ## Onboarding (`init` / `setup`)
 
 `sechroom init` wires a project for sechroom by rendering the server's
@@ -196,7 +218,14 @@ src/
   config.ts           base-url / tenant / token resolution + persistence
   generated/api.d.ts  typed client — `pnpm run gen`; real types committed (hermetic)
   commands/
-    memory.ts         create / get / search
+    memory.ts         create / get / search / edit / archive / move / versions / …
+    relationships.ts  relationships + relationship-suggestions
+    workspace.ts      workspace CRUD + feed
+    project.ts        project CRUD + status / victory-conditions
+    filing.ts         filing-suggestion review (accept / reject / defer / edit-and-accept)
+    continuity.ts     snapshots + resume / grant
+    account.ts        id next/peek + profile / feed / reviews / lookup-batch
+    chat.ts           read Slack / Discord messages + replies
     worklog.ts        append
     lookup.ts         resolve any id (mem_…/unprefixed/sechroom:<id>) -> kind/title/url
     setup.ts          init + setup mcp/agent-files

package/dist/index.js

@@ -393,6 +393,46 @@ async function promptSelect(question, choices, def) {
     rl.close();
   }
 }
+async function promptMultiSelect(question, choices, preselected = []) {
+  if (choices.length === 0) return [];
+  const pre = (v) => preselected.includes(v);
+  const preValues = () => choices.filter((c) => pre(c.value)).map((c) => c.value);
+  if (!canPrompt()) return preValues();
+  const { createInterface } = await import("readline");
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    process.stderr.write(
+      `${style.bold(question)} ${style.dim("(numbers or 'all', comma-separated; Enter keeps \u25C9)")}
+`
+    );
+    choices.forEach((c, i) => {
+      const box = pre(c.value) ? style.cyan("\u25C9") : "\u25CB";
+      const hint = c.hint ? ` ${style.dim(`\u2014 ${c.hint}`)}` : "";
+      process.stderr.write(`  ${box} ${style.bold(String(i + 1))}. ${c.label}${hint}
+`);
+    });
+    const answer = await new Promise((resolve) => {
+      rl.question(`Select ${style.dim("[Enter = \u25C9]")} `, resolve);
+    });
+    const trimmed = answer.trim().toLowerCase();
+    if (!trimmed) return preValues();
+    if (trimmed === "all") return choices.map((c) => c.value);
+    const picks = [];
+    for (const tok of trimmed.split(",").map((t) => t.trim()).filter(Boolean)) {
+      const n = Number(tok);
+      if (Number.isInteger(n) && n >= 1 && n <= choices.length) {
+        picks.push(choices[n - 1].value);
+        continue;
+      }
+      const byLabel = choices.find((c) => c.label.toLowerCase().startsWith(tok));
+      if (byLabel) picks.push(byLabel.value);
+    }
+    const uniq = [...new Set(picks)];
+    return uniq.length > 0 ? uniq : preValues();
+  } finally {
+    rl.close();
+  }
+}
 async function withSpinner(text, fn) {
   const s = spinner(text);
   try {
@@ -470,7 +510,13 @@ Examples:
   $ sechroom memory create --text "filed note" --owner-type Workspace --owner-id wsp_XXXX
   $ sechroom memory search "rate limiting" --limit 5 --tag kind:decision
   $ sechroom memory search "auth flow" --workspace wsp_XXXX --json
-  $ sechroom memory get mem_XXXX --json`
+  $ sechroom memory get mem_XXXX --json
+  $ sechroom memory edit-text mem_XXXX --old "teh" --new "the" --replace-all
+  $ sechroom memory edit-text-batch mem_XXXX --edit "foo=>bar" --edit "baz=>qux"
+  $ sechroom memory move mem_XXXX --owner-type Workspace --owner-id wsp_XXXX
+  $ sechroom memory archive mem_XXXX
+  $ sechroom memory list-archived --workspace wsp_XXXX --json
+  $ sechroom memory tags --json`
   );
   memory.command("create").description("Create a memory (POST /memories)").requiredOption("--text <text>", "Memory body text").option("--type <type>", "Memory type", "reference").option("--title <title>", "Optional title").option("--tag <tag...>", "Tags (repeatable)").option("--owner-type <ownerType>", "Workspace | Project | Unfiled", "Unfiled").option("--owner-id <ownerId>", "Owner id (required for Workspace/Project)").option("--source <source>", "Source / lane stamp", "cli").option("--confidence <n>", "Confidence 0..1", "1.0").action(async (opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
@@ -523,6 +569,201 @@ Examples:
     });
     emit(data, cmd.optsWithGlobals().json);
   });
+  memory.command("edit-text <memoryId>").description("Find/replace one substring (POST /memories/{memoryId}/edit-text)").requiredOption("--old <text>", "Text to find").requiredOption("--new <text>", "Replacement text").option("--replace-all", "Replace every occurrence (default: first only)", false).option("--regenerate-filing", "Re-run filing after the edit", false).option("--source <source>", "Source / lane stamp", "cli").action(async (memoryId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Editing memory text", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/memories/{memoryId}/edit-text", {
+        params: { path: { memoryId } },
+        body: {
+          memoryId,
+          oldText: opts.old,
+          newText: opts.new,
+          replaceAll: Boolean(opts.replaceAll),
+          regenerateFiling: Boolean(opts.regenerateFiling),
+          source: opts.source
+        }
+      });
+    });
+    emitAction(`edited ${style.bold(memoryId)} \u2192 v${style.bold(String(data.version))}`, data, cmd.optsWithGlobals().json);
+  });
+  memory.command("edit-text-batch <memoryId>").description("Apply many find/replace edits (POST /memories/{memoryId}/edit-text-batch)").requiredOption("--edit <old=>new...>", "Edit as 'old=>new' (repeatable)").option("--replace-all", "Apply replaceAll to every edit", false).option("--regenerate-filing", "Re-run filing after the edits", false).option("--source <source>", "Source / lane stamp", "cli").action(async (memoryId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const replaceAll = Boolean(opts.replaceAll);
+    const edits = opts.edit.map((spec) => {
+      const idx = spec.indexOf("=>");
+      if (idx < 0) {
+        process.stderr.write(`error: --edit must be 'old=>new', got: ${spec}
+`);
+        process.exit(1);
+      }
+      return { oldText: spec.slice(0, idx), newText: spec.slice(idx + 2), replaceAll };
+    });
+    const data = await runApi("Applying batch edits", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/memories/{memoryId}/edit-text-batch", {
+        params: { path: { memoryId } },
+        body: {
+          memoryId,
+          edits,
+          regenerateFiling: Boolean(opts.regenerateFiling),
+          source: opts.source
+        }
+      });
+    });
+    emitAction(
+      `applied ${style.bold(String(data.editsApplied))} edit(s) \u2192 v${style.bold(String(data.version))}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  memory.command("archive <memoryId>").description("Archive a memory (POST /memories/{memoryId}/archive)").option("--source <source>", "Source / lane stamp", "cli").action(async (memoryId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Archiving memory", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/memories/{memoryId}/archive", {
+        params: { path: { memoryId } },
+        body: { source: opts.source }
+      });
+    });
+    emitAction(`archived ${style.bold(memoryId)}`, data, cmd.optsWithGlobals().json);
+  });
+  memory.command("restore <memoryId>").description("Restore an archived memory (POST /memories/{memoryId}/restore)").option("--source <source>", "Source / lane stamp", "cli").action(async (memoryId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Restoring memory", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/memories/{memoryId}/restore", {
+        params: { path: { memoryId } },
+        body: { source: opts.source }
+      });
+    });
+    emitAction(`restored ${style.bold(memoryId)}`, data, cmd.optsWithGlobals().json);
+  });
+  memory.command("move <memoryId>").description("Move a memory to a new owner (POST /memories/{memoryId}/move)").requiredOption("--owner-type <ownerType>", "Unfiled | Workspace | Project | Candidate").option("--owner-id <ownerId>", "Owner id (required unless Unfiled)").option("--source <source>", "Source / lane stamp", "cli").action(async (memoryId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Moving memory", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/memories/{memoryId}/move", {
+        params: { path: { memoryId } },
+        body: {
+          to: {
+            type: opts.ownerType,
+            id: String(opts.ownerId ?? "")
+          },
+          source: opts.source
+        }
+      });
+    });
+    emitAction(`moved ${style.bold(memoryId)} \u2192 ${opts.ownerType}`, data, cmd.optsWithGlobals().json);
+  });
+  memory.command("list-archived").description("List archived memories (GET /memories/archived)").option("--workspace <workspaceId>", "Scope to a workspace").option("--project <projectId>", "Scope to a project").option("--page <n>", "Page number").option("--page-size <n>", "Page size").action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Listing archived memories", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/memories/archived", {
+        params: {
+          query: {
+            ...opts.workspace ? { workspaceId: opts.workspace } : {},
+            ...opts.project ? { projectId: opts.project } : {},
+            ...opts.page ? { page: Number(opts.page) } : {},
+            ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
+          }
+        }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  memory.command("versions <memoryId>").description("List a memory's versions (GET /memories/{memoryId}/versions)").action(async (memoryId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Fetching versions", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/memories/{memoryId}/versions", { params: { path: { memoryId } } });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  memory.command("revert <memoryId>").description("Revert a memory to an earlier version (POST /memories/{memoryId}/revert)").requiredOption("--from-version <n>", "Version to revert from").requiredOption("--text <text>", "Reverted text (the target version's text)").requiredOption("--content <content>", "Reverted content JSON (the target version's content)").option("--source <source>", "Source / lane stamp", "cli").action(async (memoryId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Reverting memory", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/memories/{memoryId}/revert", {
+        params: { path: { memoryId } },
+        body: {
+          fromVersion: Number(opts.fromVersion),
+          revertedContent: opts.content,
+          revertedText: opts.text,
+          source: opts.source
+        }
+      });
+    });
+    emitAction(`reverted ${style.bold(memoryId)} from v${opts.fromVersion}`, data, cmd.optsWithGlobals().json);
+  });
+  memory.command("owners").description("List owners with memory counts (GET /memories/owners)").option("--include-archived", "Include archived memories in counts", false).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Fetching owners", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/memories/owners", {
+        params: { query: { includeArchived: Boolean(opts.includeArchived) } }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  memory.command("tags").description("List tags with memory counts (GET /memories/tags)").option("--include-archived", "Include archived memories in counts", false).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Fetching tags", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/memories/tags", {
+        params: { query: { includeArchived: Boolean(opts.includeArchived) } }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  memory.command("types").description("List types with memory counts (GET /memories/types)").option("--include-archived", "Include archived memories in counts", false).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Fetching types", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/memories/types", {
+        params: { query: { includeArchived: Boolean(opts.includeArchived) } }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  memory.command("sum-tokens").description("Sum token counts across memories (POST /memories/sum-tokens)").option("--id <memoryId...>", "Memory id(s) to sum (repeatable)").option("--snapshot <snapshotId>", "Sum a continuity snapshot's load set").action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Summing tokens", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/memories/sum-tokens", {
+        body: {
+          ids: opts.id ?? null,
+          snapshotId: opts.snapshot ?? null
+        }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  memory.command("similar <memoryId>").description("Find similar memories (GET /memories/{memoryId}/similar)").option("--limit <n>", "Max results").option("--threshold <n>", "Minimum similarity threshold").action(async (memoryId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Finding similar memories", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/memories/{memoryId}/similar", {
+        params: {
+          path: { memoryId },
+          query: {
+            ...opts.limit ? { limit: Number(opts.limit) } : {},
+            ...opts.threshold ? { threshold: Number(opts.threshold) } : {}
+          }
+        }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  memory.command("by-url <url>").description("Resolve a memory by its canonical URL (GET /memories/by-url)").action(async (url, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Resolving memory by URL", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/memories/by-url", { params: { query: { url } } });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
 }
 
 // src/commands/worklog.ts
@@ -579,6 +820,889 @@ Examples:
   });
 }
 
+// src/commands/relationships.ts
+function registerRelationships(program2) {
+  const relationship = program2.command("relationship").description("Create, list, and manage memory relationships + suggestions");
+  relationship.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom relationship create mem_FROM mem_TO --type Reference
+  $ sechroom relationship list mem_XXXX --direction Outbound --json
+  $ sechroom relationship delete rel_XXXX
+  $ sechroom relationship suggest mem_XXXX --limit 5
+  $ sechroom relationship suggestions --status Pending --memory mem_XXXX
+  $ sechroom relationship suggestion accept rsg_XXXX`
+  );
+  relationship.command("create <fromMemoryId> <toMemoryId>").description("Create a relationship (POST /memories/{memoryId}/relationships)").option("--type <type>", "Relationship type (Reference, Related, Parent, Child, Follows, \u2026)", "Reference").action(async (fromMemoryId, toMemoryId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Creating relationship", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/memories/{memoryId}/relationships", {
+        params: { path: { memoryId: fromMemoryId } },
+        body: {
+          toMemoryId,
+          type: opts.type
+        }
+      });
+    });
+    const inversePart = data.inverseId ? ` ${style.dim(`(inverse ${data.inverseId})`)}` : "";
+    const urlPart = data.url ? ` ${style.dim("\u2192")} ${publicUrl(data.url)}` : "";
+    emitAction(
+      `created relationship ${style.bold(data.id)} ${style.dim(`${fromMemoryId} \u2192 ${toMemoryId}`)}${inversePart}${urlPart}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  relationship.command("list <memoryId>").description("List a memory's relationships (GET /memories/{memoryId}/relationships)").option("--direction <direction>", "Both | Outbound | Inbound").option("--include-deleted", "Include deleted relationships", false).option("--page <n>", "Page number").option("--page-size <n>", "Page size").action(async (memoryId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Listing relationships", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/memories/{memoryId}/relationships", {
+        params: {
+          path: { memoryId },
+          query: {
+            ...opts.direction ? { direction: opts.direction } : {},
+            ...opts.includeDeleted ? { includeDeleted: true } : {},
+            ...opts.page ? { page: Number(opts.page) } : {},
+            ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
+          }
+        }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  relationship.command("delete <id>").description("Delete a relationship (DELETE /relationships/{id})").action(async (id, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Deleting relationship", async () => {
+      const client = await makeClient(cfg);
+      return client.DELETE("/relationships/{id}", {
+        params: { path: { id } },
+        body: {}
+      });
+    });
+    emitAction(`deleted relationship ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+  });
+  relationship.command("suggest <memoryId>").description("Generate relationship suggestions for a memory (POST /memories/{memoryId}/suggest-relationships)").option("--limit <n>", "Max suggestions to generate").action(async (memoryId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Suggesting relationships", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/memories/{memoryId}/suggest-relationships", {
+        params: { path: { memoryId } },
+        body: {
+          limit: opts.limit ? Number(opts.limit) : null
+        }
+      });
+    });
+    emitAction(
+      `suggested ${style.bold(String(data.suggested))} for ${memoryId} ${style.dim(`(considered ${data.considered}, suppressed ${data.suppressed})`)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  relationship.command("suggestions").description("List relationship suggestions (GET /relationship-suggestions)").option("--memory <memoryId>", "Filter to a memory").option(
+    "--status <status>",
+    "Pending | Accepted | EditedAndAccepted | Rejected | Superseded | Deferred | Invalidated"
+  ).option("--page <n>", "Page number").option("--page-size <n>", "Page size").action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Listing suggestions", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/relationship-suggestions", {
+        params: {
+          query: {
+            ...opts.memory ? { memoryId: opts.memory } : {},
+            ...opts.status ? {
+              status: opts.status
+            } : {},
+            ...opts.page ? { page: Number(opts.page) } : {},
+            ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
+          }
+        }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  const suggestion = relationship.command("suggestion").description("Inspect and decide on a single relationship suggestion");
+  suggestion.command("get <id>").description("Fetch a suggestion by id (GET /relationship-suggestions/{id})").action(async (id, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Fetching suggestion", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/relationship-suggestions/{id}", { params: { path: { id } } });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  suggestion.command("accept <id>").description("Accept a suggestion (POST /relationship-suggestions/{id}/accept)").action(async (id, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Accepting suggestion", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/relationship-suggestions/{id}/accept", {
+        params: { path: { id } },
+        body: {}
+      });
+    });
+    emitAction(`accepted suggestion ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+  });
+  suggestion.command("reject <id>").description("Reject a suggestion (POST /relationship-suggestions/{id}/reject)").option("--reason <reason>", "Why it's being rejected").option("--reason-code <code>", "Structured reason code").action(async (id, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Rejecting suggestion", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/relationship-suggestions/{id}/reject", {
+        params: { path: { id } },
+        body: {
+          reason: opts.reason ?? null,
+          ...opts.reasonCode ? { reasonCode: opts.reasonCode } : {}
+        }
+      });
+    });
+    emitAction(`rejected suggestion ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+  });
+  suggestion.command("defer <id>").description("Defer a suggestion (POST /relationship-suggestions/{id}/defer)").option("--until <iso>", "Defer until this ISO date-time (omit to defer indefinitely)").action(async (id, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Deferring suggestion", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/relationship-suggestions/{id}/defer", {
+        params: { path: { id } },
+        body: {
+          until: opts.until ?? null
+        }
+      });
+    });
+    emitAction(`deferred suggestion ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+  });
+}
+
+// src/commands/workspace.ts
+function registerWorkspace(program2) {
+  const workspace = program2.command("workspace").description("Create, browse, and manage workspaces");
+  workspace.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom workspace create --name "My Workspace" --parent wsp_XXXX
+  $ sechroom workspace list --include-archived --json
+  $ sechroom workspace get wsp_XXXX --json
+  $ sechroom workspace rename wsp_XXXX --name "Renamed"
+  $ sechroom workspace move wsp_XXXX --parent wsp_YYYY
+  $ sechroom workspace feed wsp_XXXX --limit 20 --cascade`
+  );
+  workspace.command("create").description("Create a workspace (POST /workspaces)").requiredOption("--name <name>", "Workspace name").option("--description <description>", "Optional description").option("--parent <parentId>", "Parent workspace id (omit for a top-level workspace)").action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Creating workspace", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/workspaces", {
+        body: {
+          name: opts.name,
+          description: opts.description ?? null,
+          parentId: opts.parent ?? null
+        }
+      });
+    });
+    const urlPart = data.url ? ` ${style.dim("\u2192")} ${publicUrl(data.url)}` : "";
+    emitAction(
+      `created workspace ${style.bold(data.id)} ${style.dim(`"${opts.name}"`)}${urlPart}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  workspace.command("list").description("List the caller's workspaces (GET /workspaces)").option("--include-archived", "Include archived workspaces", false).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Listing workspaces", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/workspaces", {
+        params: { query: { includeArchived: Boolean(opts.includeArchived) } }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  workspace.command("get <workspaceId>").description("Fetch a workspace by id (GET /workspaces/{workspaceId})").action(async (workspaceId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Fetching workspace", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/workspaces/{workspaceId}", { params: { path: { workspaceId } } });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  workspace.command("rename <workspaceId>").description("Rename a workspace (PUT /workspaces/{workspaceId}/rename)").requiredOption("--name <name>", "New workspace name").action(async (workspaceId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Renaming workspace", async () => {
+      const client = await makeClient(cfg);
+      return client.PUT("/workspaces/{workspaceId}/rename", {
+        params: { path: { workspaceId } },
+        body: { newName: opts.name }
+      });
+    });
+    emitAction(
+      `renamed workspace ${style.bold(workspaceId)} ${style.dim(`\u2192 "${opts.name}"`)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  workspace.command("describe <workspaceId>").description("Set a workspace description (PUT /workspaces/{workspaceId}/description)").requiredOption("--description <description>", "New description").action(async (workspaceId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Updating description", async () => {
+      const client = await makeClient(cfg);
+      return client.PUT("/workspaces/{workspaceId}/description", {
+        params: { path: { workspaceId } },
+        body: { newDescription: opts.description }
+      });
+    });
+    emitAction(
+      `updated description for workspace ${style.bold(workspaceId)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  workspace.command("move <workspaceId>").description("Move a workspace under a new parent (POST /workspaces/{workspaceId}/move)").option("--parent <parentId>", "New parent workspace id (omit to move to top level)").action(async (workspaceId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Moving workspace", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/workspaces/{workspaceId}/move", {
+        params: { path: { workspaceId } },
+        body: { newParentId: opts.parent ?? null }
+      });
+    });
+    const target = opts.parent ? `under ${style.bold(opts.parent)}` : "to top level";
+    emitAction(
+      `moved workspace ${style.bold(workspaceId)} ${style.dim(target)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  workspace.command("archive <workspaceId>").description("Archive a workspace (POST /workspaces/{workspaceId}/archive)").action(async (workspaceId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Archiving workspace", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/workspaces/{workspaceId}/archive", {
+        params: { path: { workspaceId } },
+        body: {}
+      });
+    });
+    emitAction(`archived workspace ${style.bold(workspaceId)}`, data, cmd.optsWithGlobals().json);
+  });
+  workspace.command("restore <workspaceId>").description("Restore an archived workspace (POST /workspaces/{workspaceId}/restore)").action(async (workspaceId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Restoring workspace", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/workspaces/{workspaceId}/restore", {
+        params: { path: { workspaceId } },
+        body: {}
+      });
+    });
+    emitAction(`restored workspace ${style.bold(workspaceId)}`, data, cmd.optsWithGlobals().json);
+  });
+  workspace.command("feed <workspaceId>").description("List a workspace's memory feed (GET /workspaces/{workspaceId}/memories/feed)").option("--limit <n>", "Max results", "20").option("--cursor <cursor>", "Paging cursor from a prior page").option("--cascade", "Cascade into descendant workspaces", false).option("--include-projects", "Include the workspace's projects", false).option("--include-archived", "Include archived memories", false).option("--query <query>", "Filter the feed by text").option("--tag <tag>", "Filter tags (comma-separated)").action(async (workspaceId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Fetching feed", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/workspaces/{workspaceId}/memories/feed", {
+        params: {
+          path: { workspaceId },
+          query: {
+            limit: Number(opts.limit),
+            cascadeWorkspaces: Boolean(opts.cascade),
+            includeProjects: Boolean(opts.includeProjects),
+            includeArchived: Boolean(opts.includeArchived),
+            ...opts.cursor ? { cursor: opts.cursor } : {},
+            ...opts.query ? { query: opts.query } : {},
+            ...opts.tag ? { filterTags: opts.tag } : {}
+          }
+        }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+}
+
+// src/commands/project.ts
+function registerProject(program2) {
+  const project = program2.command("project").description("Create, browse, and manage projects");
+  project.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom project create --workspace wsp_XXXX --name "Onboarding" --slug onboarding
+  $ sechroom project list --workspace wsp_XXXX --status Active
+  $ sechroom project get prj_XXXX --json
+  $ sechroom project rename prj_XXXX --name "New Name" --slug new-name
+  $ sechroom project status prj_XXXX --status Completed`
+  );
+  project.command("create").description("Create a project (POST /projects)").requiredOption("--workspace <workspaceId>", "Owning workspace id").requiredOption("--name <name>", "Project name").requiredOption("--slug <slug>", "URL slug").option("--description <description>", "Optional description").option("--parent <parentProjectId>", "Optional parent project id").action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Creating project", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/projects", {
+        body: {
+          workspaceId: opts.workspace,
+          name: opts.name,
+          slug: opts.slug,
+          description: opts.description ?? null,
+          parentProjectId: opts.parent ?? null
+        }
+      });
+    });
+    const urlPart = data.url ? ` ${style.dim("\u2192")} ${publicUrl(data.url)}` : "";
+    emitAction(`created project ${style.bold(data.id)}${urlPart}`, data, cmd.optsWithGlobals().json);
+  });
+  project.command("list").description("List projects (GET /projects)").option("--workspace <workspaceId>", "Scope to a workspace").option("--status <status>", "Draft | Active | OnHold | Completed | Cancelled").option("--include-archived", "Include archived projects", false).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Listing projects", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/projects", {
+        params: {
+          query: {
+            ...opts.workspace ? { workspaceId: opts.workspace } : {},
+            ...opts.status ? { status: opts.status } : {},
+            ...opts.includeArchived ? { includeArchived: true } : {}
+          }
+        }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  project.command("get <projectId>").description("Fetch a project by id (GET /projects/{projectId})").action(async (projectId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Fetching project", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/projects/{projectId}", { params: { path: { projectId } } });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  project.command("rename <projectId>").description("Rename a project (PUT /projects/{projectId}/rename)").requiredOption("--name <name>", "New project name").requiredOption("--slug <slug>", "New URL slug").action(async (projectId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Renaming project", async () => {
+      const client = await makeClient(cfg);
+      return client.PUT("/projects/{projectId}/rename", {
+        params: { path: { projectId } },
+        body: { newName: opts.name, newSlug: opts.slug }
+      });
+    });
+    emitAction(`renamed project ${style.bold(projectId)} \u2192 ${style.bold(opts.name)}`, data, cmd.optsWithGlobals().json);
+  });
+  project.command("describe <projectId>").description("Set a project's description (PUT /projects/{projectId}/description)").requiredOption("--description <description>", "New description (empty string to clear)").action(async (projectId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Updating description", async () => {
+      const client = await makeClient(cfg);
+      return client.PUT("/projects/{projectId}/description", {
+        params: { path: { projectId } },
+        body: { newDescription: opts.description }
+      });
+    });
+    emitAction(`updated description on project ${style.bold(projectId)}`, data, cmd.optsWithGlobals().json);
+  });
+  project.command("move <projectId>").description("Move a project to another workspace/parent (POST /projects/{projectId}/move)").requiredOption("--workspace <toWorkspaceId>", "Destination workspace id").option("--parent <toParentId>", "Destination parent project id").action(async (projectId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Moving project", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/projects/{projectId}/move", {
+        params: { path: { projectId } },
+        body: { toWorkspaceId: opts.workspace, toParentId: opts.parent ?? null }
+      });
+    });
+    emitAction(`moved project ${style.bold(projectId)} \u2192 ${style.bold(opts.workspace)}`, data, cmd.optsWithGlobals().json);
+  });
+  project.command("status <projectId>").description("Set a project's status (POST /projects/{projectId}/status)").requiredOption("--status <status>", "Draft | Active | OnHold | Completed | Cancelled").action(async (projectId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Setting status", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/projects/{projectId}/status", {
+        params: { path: { projectId } },
+        body: {
+          status: opts.status
+        }
+      });
+    });
+    emitAction(`set project ${style.bold(projectId)} status \u2192 ${style.bold(opts.status)}`, data, cmd.optsWithGlobals().json);
+  });
+  project.command("victory-conditions <projectId>").description("Set a project's victory conditions (PUT /projects/{projectId}/victory-conditions)").requiredOption("--conditions <conditions>", "Victory conditions text (empty string to clear)").action(async (projectId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Updating victory conditions", async () => {
+      const client = await makeClient(cfg);
+      return client.PUT("/projects/{projectId}/victory-conditions", {
+        params: { path: { projectId } },
+        body: { victoryConditions: opts.conditions }
+      });
+    });
+    emitAction(`updated victory conditions on project ${style.bold(projectId)}`, data, cmd.optsWithGlobals().json);
+  });
+  project.command("archive <projectId>").description("Archive a project (POST /projects/{projectId}/archive)").action(async (projectId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Archiving project", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/projects/{projectId}/archive", {
+        params: { path: { projectId } },
+        body: {}
+      });
+    });
+    emitAction(`archived project ${style.bold(projectId)}`, data, cmd.optsWithGlobals().json);
+  });
+  project.command("restore <projectId>").description("Restore an archived project (POST /projects/{projectId}/restore)").action(async (projectId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Restoring project", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/projects/{projectId}/restore", {
+        params: { path: { projectId } },
+        body: {}
+      });
+    });
+    emitAction(`restored project ${style.bold(projectId)}`, data, cmd.optsWithGlobals().json);
+  });
+}
+
+// src/commands/filing.ts
+function registerFiling(program2) {
+  const filing = program2.command("filing").description("Review and act on filing suggestions");
+  filing.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom filing suggestions --status Pending --page-size 20
+  $ sechroom filing get fsg_XXXX --json
+  $ sechroom filing preview --memory-id mem_XXXX
+  $ sechroom filing accept fsg_XXXX
+  $ sechroom filing reject fsg_XXXX --reason "wrong workspace"
+  $ sechroom filing edit-and-accept fsg_XXXX --target-kind Workspace --existing-target-id wsp_XXXX`
+  );
+  filing.command("suggestions").description("List filing suggestions (GET /filing/suggestions)").option("--memory-id <memoryId>", "Filter to a single memory's suggestions").option(
+    "--status <status>",
+    "Generating | Pending | Accepted | Rejected | EditedAndAccepted | Deferred | Invalidated"
+  ).option("--page <n>", "Page number").option("--page-size <n>", "Page size").action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Listing filing suggestions", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/filing/suggestions", {
+        params: {
+          query: {
+            ...opts.memoryId ? { memoryId: opts.memoryId } : {},
+            ...opts.status ? { status: opts.status } : {},
+            ...opts.page ? { page: Number(opts.page) } : {},
+            ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
+          }
+        }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  filing.command("get <id>").description("Fetch a filing suggestion by id (GET /filing/suggestions/{id})").action(async (id, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Fetching filing suggestion", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/filing/suggestions/{id}", { params: { path: { id } } });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  filing.command("preview").description("Preview a filing suggestion for a memory id or ad-hoc shape (POST /filing/suggestions/preview)").option("--memory-id <memoryId>", "Preview filing for an existing memory").option("--text <text>", "Ad-hoc memory body text (instead of --memory-id)").option("--title <title>", "Ad-hoc memory title").option("--tag <tag...>", "Ad-hoc memory tags (repeatable)").option("--type <type>", "Ad-hoc memory type", "reference").option("--scope-workspace <workspaceId>", "Scope the preview to a workspace").action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const memory = opts.text ? {
+      text: opts.text,
+      title: opts.title ?? null,
+      tags: opts.tag ?? null,
+      type: opts.type
+    } : null;
+    const data = await runApi("Previewing filing suggestion", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/filing/suggestions/preview", {
+        body: {
+          memoryId: opts.memoryId ?? null,
+          memory,
+          scopeWorkspaceId: opts.scopeWorkspace ?? null
+        }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  filing.command("accept <id>").description("Accept a filing suggestion (POST /filing/suggestions/{id}/accept)").action(async (id, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Accepting filing suggestion", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/filing/suggestions/{id}/accept", { params: { path: { id } }, body: {} });
+    });
+    emitAction(`accepted filing suggestion ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+  });
+  filing.command("reject <id>").description("Reject a filing suggestion (POST /filing/suggestions/{id}/reject)").option("--reason <reason>", "Why the suggestion was rejected").option("--reason-code <code>", "Structured reason code").action(async (id, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Rejecting filing suggestion", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/filing/suggestions/{id}/reject", {
+        params: { path: { id } },
+        body: {
+          reason: opts.reason ?? null,
+          ...opts.reasonCode ? { reasonCode: opts.reasonCode } : {}
+        }
+      });
+    });
+    emitAction(`rejected filing suggestion ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+  });
+  filing.command("defer <id>").description("Defer a filing suggestion (POST /filing/suggestions/{id}/defer)").option("--until <iso>", "Defer until an ISO-8601 timestamp (defaults to indefinite)").action(async (id, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Deferring filing suggestion", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/filing/suggestions/{id}/defer", {
+        params: { path: { id } },
+        body: { until: opts.until ?? null }
+      });
+    });
+    emitAction(`deferred filing suggestion ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+  });
+  filing.command("edit-and-accept <id>").description("Override the target then accept (POST /filing/suggestions/{id}/edit-and-accept)").option("--target-kind <kind>", "Workspace | Project").option("--existing-target-id <id>", "File into an existing workspace/project").option("--new-name <name>", "Create a new target with this name").option("--new-description <text>", "Description for the new target").option("--new-parent-workspace <workspaceId>", "Parent workspace for a new project").option("--memory-id <memoryId...>", "Override the memory set (repeatable)").action(async (id, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Editing and accepting filing suggestion", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/filing/suggestions/{id}/edit-and-accept", {
+        params: { path: { id } },
+        body: {
+          targetKind: opts.targetKind ?? null,
+          existingTargetId: opts.existingTargetId ?? null,
+          newName: opts.newName ?? null,
+          newDescription: opts.newDescription ?? null,
+          newParentWorkspaceId: opts.newParentWorkspace ?? null,
+          overrideMemoryIds: opts.memoryId ?? null
+        }
+      });
+    });
+    emitAction(`edited & accepted filing suggestion ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+  });
+}
+
+// src/commands/continuity.ts
+function registerContinuity(program2) {
+  const continuity = program2.command("continuity").description("Continuity snapshots: checkpoint and resume work");
+  continuity.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom continuity snapshot-create --lane claude-code-chris --scope loop-spec \\
+      --objective "ship slice 9" --state "tests green, PR open" \\
+      --last-action "raised PR #1425" --next-action "watch for merge" \\
+      --resume-instruction "load csn id, resume at step 10"
+  $ sechroom continuity snapshots --scope loop-spec
+  $ sechroom continuity snapshot-get csn_XXXX --json
+  $ sechroom continuity resume-me --max-artifacts 20
+  $ sechroom continuity changed-since --since 2026-06-01T00:00:00Z
+  $ sechroom continuity grant csn_XXXX --grantee usr_XXXX`
+  );
+  continuity.command("snapshot-create").description("Create a continuity snapshot (POST /continuity/snapshots)").requiredOption("--lane <laneId>", "Lane id (e.g. claude-code-chris)").requiredOption("--scope <scope>", "Snapshot scope (e.g. loop-spec)").requiredOption("--objective <text>", "Current objective").requiredOption("--state <text>", "Current state").requiredOption("--last-action <text>", "Last meaningful action").requiredOption("--next-action <text>", "Next intended action").requiredOption("--resume-instruction <text>", "Resume instruction").option("--constraint <text...>", "Active constraints (repeatable)").option("--question <text...>", "Open questions (repeatable)").option("--surface-marker <text...>", "Surface markers (repeatable)").option("--artifact <id...>", "Relevant artifact ids (repeatable)").option("--confidence <n>", "Confidence 0..1").action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Creating snapshot", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/continuity/snapshots", {
+        body: {
+          laneId: opts.lane,
+          scope: opts.scope,
+          currentObjective: opts.objective,
+          currentState: opts.state,
+          lastMeaningfulAction: opts.lastAction,
+          nextIntendedAction: opts.nextAction,
+          resumeInstruction: opts.resumeInstruction,
+          activeConstraints: opts.constraint ?? null,
+          openQuestions: opts.question ?? null,
+          surfaceMarkers: opts.surfaceMarker ?? null,
+          relevantArtifactIds: opts.artifact ?? null,
+          confidence: opts.confidence != null ? Number(opts.confidence) : null
+        }
+      });
+    });
+    emitAction(`created snapshot ${style.bold(data.snapshotId)}`, data, cmd.optsWithGlobals().json);
+  });
+  continuity.command("snapshot-get <id>").description("Fetch a snapshot by id (GET /continuity/snapshots/{id})").action(async (id, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Fetching snapshot", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/continuity/snapshots/{id}", { params: { path: { id } } });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  continuity.command("snapshots").description("List the caller's own snapshots (GET /me/continuity/snapshots)").option("--scope <scope>", "Filter by scope").option("--lane <laneId>", "Filter by lane id").action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Listing snapshots", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/me/continuity/snapshots", {
+        params: {
+          query: {
+            ...opts.scope ? { scope: opts.scope } : {},
+            ...opts.lane ? { laneId: opts.lane } : {}
+          }
+        }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  continuity.command("resume-me").description("Resume the caller's own lane (POST /continuity/resume/me)").option("--workspace <workspaceId>", "Scope to a workspace").option("--max-artifacts <n>", "Cap artifacts in the bundle").option("--changed-since <iso>", "Only include changes since this ISO timestamp").option("--looking-at-myself", "Include the caller's own changes", false).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Resuming", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/continuity/resume/me", {
+        body: {
+          workspaceId: opts.workspace ?? null,
+          maxArtifacts: opts.maxArtifacts != null ? Number(opts.maxArtifacts) : null,
+          includeLookingAtMyself: opts.lookingAtMyself ? true : null,
+          changedSince: opts.changedSince ?? null
+        }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  continuity.command("resume-lane <laneId>").description("Resume a specific lane (POST /continuity/resume/lane)").option("--workspace <workspaceId>", "Scope to a workspace").option("--max-artifacts <n>", "Cap artifacts in the bundle").option("--changed-since <iso>", "Only include changes since this ISO timestamp").option("--looking-at-myself", "Include the caller's own changes", false).action(async (laneId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Resuming lane", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/continuity/resume/lane", {
+        body: {
+          laneId,
+          workspaceId: opts.workspace ?? null,
+          maxArtifacts: opts.maxArtifacts != null ? Number(opts.maxArtifacts) : null,
+          includeLookingAtMyself: opts.lookingAtMyself ? true : null,
+          changedSince: opts.changedSince ?? null
+        }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  continuity.command("changed-since").description("What changed since a timestamp (POST /continuity/changed-since)").requiredOption("--since <iso>", "ISO-8601 timestamp to compare against").option("--looking-at-myself", "Include the caller's own changes", false).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Computing changes", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/continuity/changed-since", {
+        body: {
+          since: opts.since,
+          includeLookingAtMyself: opts.lookingAtMyself ? true : null
+        }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  continuity.command("load-set").description("Derive the active load set (POST /continuity/load-set/derive)").option("--workspace <workspaceId>", "Scope to a workspace").option("--max-artifacts <n>", "Cap artifacts in the load set").option("--looking-at-myself", "Include the caller's own changes", false).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Deriving load set", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/continuity/load-set/derive", {
+        body: {
+          workspaceId: opts.workspace ?? null,
+          maxArtifacts: opts.maxArtifacts != null ? Number(opts.maxArtifacts) : null,
+          includeLookingAtMyself: opts.lookingAtMyself ? true : null
+        }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  continuity.command("grant <snapshotId>").description("Grant another operator read access (POST /continuity/snapshots/{snapshotId}/grants)").requiredOption("--grantee <userId>", "Sechroom user id being granted read access").option("--source <source>", "Permission-set source kind", "TenantRole").option("--source-id <sourceId>", "Permission-set source id (e.g. a tenant role)", "viewer").option("--valid-from <iso>", "Optional ISO-8601 grant start").option("--valid-to <iso>", "Optional ISO-8601 grant expiry").action(async (snapshotId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Minting grant", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/continuity/snapshots/{snapshotId}/grants", {
+        params: { path: { snapshotId } },
+        body: {
+          userId: opts.grantee,
+          kind: "Allow",
+          source: opts.source,
+          sourceId: opts.sourceId,
+          ...opts.validFrom ? { validFrom: opts.validFrom } : {},
+          ...opts.validTo ? { validTo: opts.validTo } : {}
+        }
+      });
+    });
+    emitAction(
+      `granted ${style.bold(data.userId)} read on ${style.bold(snapshotId)} ${style.dim(`(grant ${data.grantId})`)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  continuity.command("revoke-grant <snapshotId> <grantId>").description("Revoke a grant (DELETE /continuity/snapshots/{snapshotId}/grants/{grantId})").action(async (snapshotId, grantId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Revoking grant", async () => {
+      const client = await makeClient(cfg);
+      return client.DELETE("/continuity/snapshots/{snapshotId}/grants/{grantId}", {
+        params: { path: { snapshotId, grantId } },
+        body: {}
+      });
+    });
+    emitAction(
+      `revoked grant ${style.bold(grantId)} on ${style.bold(snapshotId)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+}
+
+// src/commands/account.ts
+function registerId(program2) {
+  const id = program2.command("id").description("Allocate human-authored id sequences (FR-*, D-*)");
+  id.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom id next FR sechroom            allocate the next FR-sechroom-NNN id
+  $ sechroom id next D Backend              allocate the next D-Backend-NNN id
+  $ sechroom id peek FR sechroom            inspect the sequence without consuming
+  $ sechroom id peek FR sechroom --json`
+  );
+  id.command("next <namespaceKind> <scope>").description("Allocate the next id in a sequence (POST /id-registry/allocate)").action(async (namespaceKind, scope, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Allocating id", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/id-registry/allocate", {
+        body: { namespaceKind, scope, clientNonce: null }
+      });
+    });
+    emitAction(`allocated ${style.bold(data.id)} ${style.dim(`(seq ${data.seq})`)}`, data, cmd.optsWithGlobals().json);
+  });
+  id.command("peek <namespaceKind> <scope>").description("Inspect a sequence without consuming (GET /id-registry/state)").action(async (namespaceKind, scope, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Peeking id sequence", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/id-registry/state", {
+        params: { query: { namespaceKind, scope } }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+}
+function registerAccount(program2) {
+  const account = program2.command("account").description("Your profile, feeds, and review queue");
+  account.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom account profile
+  $ sechroom account set-profile --display-name "Chris" --timezone "Europe/London"
+  $ sechroom account feed --limit 20
+  $ sechroom account reviews --status Pending
+  $ sechroom account lookup-batch mem_XXXX wsp_YYYY --json`
+  );
+  account.command("profile").description("Show your resolved profile (GET /me/profile)").action(async (_opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Fetching profile", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/me/profile");
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  account.command("set-profile").description("Update your profile (PUT /me/profile)").option("--display-name <displayName>", "Display name").option("--timezone <timezone>", "IANA timezone (e.g. Europe/London)").option("--bio <bio>", "Short bio").option("--photo-url <photoUrl>", "Avatar / photo URL").action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Updating profile", async () => {
+      const client = await makeClient(cfg);
+      return client.PUT("/me/profile", {
+        body: {
+          displayName: opts.displayName ?? null,
+          timezone: opts.timezone ?? null,
+          bio: opts.bio ?? null,
+          photoUrl: opts.photoUrl ?? null
+        }
+      });
+    });
+    emitAction("updated profile", data, cmd.optsWithGlobals().json);
+  });
+  account.command("feed").description("Your recent memory feed (GET /me/memories/feed)").option("--limit <n>", "Max results", "20").option("--cursor <cursor>", "Opaque paging cursor").option("--query <query>", "Free-text filter").option("--filter-tags <tags>", "Comma-separated tag filter").option("--include-archived", "Include archived memories", false).option("--include-text", "Include memory body text", false).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Fetching feed", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/me/memories/feed", {
+        params: {
+          query: {
+            limit: Number(opts.limit),
+            includeArchived: Boolean(opts.includeArchived),
+            includeText: Boolean(opts.includeText),
+            ...opts.cursor ? { cursor: opts.cursor } : {},
+            ...opts.query ? { query: opts.query } : {},
+            ...opts.filterTags ? { filterTags: opts.filterTags } : {}
+          }
+        }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  account.command("reviews").description("Your review queue (GET /reviews)").option("--status <status>", "Pending | Resolved | Empty").option("--scope-kind <scopeKind>", "Memory | Project | Workspace").option("--scope-target-id <id>", "Scope target id").option("--limit <n>", "Max results", "20").action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Fetching reviews", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/reviews", {
+        params: {
+          query: {
+            limit: Number(opts.limit),
+            ...opts.status ? { status: opts.status } : {},
+            ...opts.scopeKind ? { scopeKind: opts.scopeKind } : {},
+            ...opts.scopeTargetId ? { scopeTargetId: opts.scopeTargetId } : {}
+          }
+        }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  account.command("review-get <reviewId>").description("Fetch one review bundle (GET /reviews/{reviewId})").action(async (reviewId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Fetching review", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/reviews/{reviewId}", { params: { path: { reviewId } } });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  account.command("review-accept <reviewId>").description("Accept a review bundle (POST /reviews/{reviewId}/accept)").action(async (reviewId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Accepting review", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/reviews/{reviewId}/accept", {
+        params: { path: { reviewId } },
+        body: { decisions: {} }
+      });
+    });
+    emitAction(`accepted review ${style.bold(reviewId)}`, data, cmd.optsWithGlobals().json);
+  });
+  account.command("lookup-batch <ids...>").description("Resolve many ids at once (POST /lookup/batch)").action(async (ids, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi(`Resolving ${ids.length} ids`, async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/lookup/batch", { body: { ids } });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+}
+
+// src/commands/chat.ts
+function registerChat(program2) {
+  const chat = program2.command("chat").description("Read Slack / Discord channel messages + thread replies").option("--surface <surface>", "slack | discord", "slack");
+  chat.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom chat messages --surface slack
+  $ sechroom chat messages --surface discord --json
+  $ sechroom chat replies 1718049600.123456 --surface slack
+  $ sechroom chat replies 1234567890123456789 --surface discord --json
+  $ sechroom chat stop-tracking 1718049600.123456 --surface slack`
+  );
+  chat.command("messages").description("List recent channel messages (GET /chat/channel-messages/{surface})").action(async (_opts, cmd) => {
+    const { surface, ...globals } = cmd.optsWithGlobals();
+    const cfg = resolveConfig(globals);
+    const data = await runApi("Fetching messages", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/chat/channel-messages/{surface}", {
+        params: { path: { surface: String(surface) } }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  chat.command("replies <messageId>").description("List thread replies for a message (GET /chat/channel-messages/by-id/{id}/replies)").action(async (messageId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Fetching replies", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/chat/channel-messages/by-id/{id}/replies", {
+        params: { path: { id: messageId } }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  chat.command("stop-tracking <messageId>").description("Stop watching a message for replies (POST .../by-id/{id}/stop-tracking-replies)").action(async (messageId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Stopping reply tracking", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/chat/channel-messages/by-id/{id}/stop-tracking-replies", {
+        params: { path: { id: messageId } },
+        body: {}
+      });
+    });
+    emitAction(`stopped tracking replies on ${style.bold(messageId)}`, data, cmd.optsWithGlobals().json);
+  });
+}
+
 // src/setup/apply.ts
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2 } from "fs";
 import { dirname as dirname2 } from "path";
@@ -1053,16 +2177,18 @@ async function ensureTimezone(cfg, opts) {
 async function chooseClients(clientFlag, yes, cwd) {
   if (clientFlag) return resolveClientKeys(clientFlag);
   const detected = detectInstalledClients(cwd);
-  const fallback = (detected.length > 0 ? detected : [DEFAULT_CLIENT_KEY]).join(",");
-  if (!canPrompt() || yes) return resolveClientKeys(fallback);
-  process.stderr.write(
-    `
-Available clients: ${ALL_CLIENT_KEYS.join(", ")}
-` + (detected.length > 0 ? `Detected on this machine: ${detected.join(", ")}
-` : "No clients auto-detected.\n")
+  const preselected = detected.length > 0 ? detected : [DEFAULT_CLIENT_KEY];
+  if (!canPrompt() || yes) return preselected;
+  const picks = await promptMultiSelect(
+    "Which AI clients should I wire?",
+    ALL_CLIENT_KEYS.map((k) => ({
+      label: k,
+      value: k,
+      hint: detected.includes(k) ? "detected" : void 0
+    })),
+    preselected
   );
-  const answer = await promptText("Which to wire? (comma-separated, or 'all')", fallback);
-  return resolveClientKeys(answer);
+  return picks.length > 0 ? picks : preselected;
 }
 function registerOnboard(program2) {
   program2.command("onboard").description("Guided first-run setup: configure, sign in, set timezone, detect clients, and wire this project").option("--client <list>", `comma-separated clients (${ALL_CLIENT_KEYS.join(", ")}) or 'all' (default: auto-detected)`).option("--local", "save tenant + base URL to a directory-local .sechroom.json instead of the global config", false).option("--cli-only", "configure the CLI only \u2014 don't wire any AI client (no MCP config, no agent files)", false).option("--no-mcp", "skip the MCP server config (.mcp.json etc.); still write the agent instruction files").option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--dry-run", "walk through without writing files or changing the profile", false).option("-y, --yes", "non-interactive: accept defaults (system timezone, detected clients, global config, full wire)", false).addHelpText(
@@ -1261,6 +2387,14 @@ local:  ${d.localPath ?? "(none)"} ${JSON.stringify(readLocalConfig())}
 registerMemory(program);
 registerWorklog(program);
 registerLookup(program);
+registerRelationships(program);
+registerWorkspace(program);
+registerProject(program);
+registerFiling(program);
+registerContinuity(program);
+registerId(program);
+registerAccount(program);
+registerChat(program);
 registerInit(program);
 registerSetup(program);
 registerOnboard(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.6.7",
+  "version": "2026.6.9",
   "description": "Sechroom CLI — a thin, generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.",
   "type": "module",
   "license": "UNLICENSED",