@sechroom/cli 2026.7.1 → 2026.7.2-rc.61703375

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 import { Command } from "commander";
 
 // src/auth.ts
@@ -1300,12 +1300,228 @@ workers your loop skills call (e.g. find-prior-art \u2192 substrate-miner).`
 }
 
 // src/commands/channel.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname4, join as join7 } from "path";
 import {
   HttpTransportType,
   HubConnectionBuilder
 } from "@microsoft/signalr";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+// src/commands/hook-install.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
+import { delimiter, dirname as dirname3, join as join6 } from "path";
+
+// src/setup/clients.ts
+import { existsSync as existsSync4 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname2, join as join5 } from "path";
+function claudeDesktopConfigPath(home) {
+  switch (process.platform) {
+    case "darwin":
+      return join5(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+    case "win32":
+      return join5(process.env.APPDATA ?? join5(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
+    default:
+      return join5(home, ".config", "Claude", "claude_desktop_config.json");
+  }
+}
+function clientTargets(cwd, opts = {}) {
+  const home = homedir3();
+  const claudeDir = opts.claudeDir ?? join5(home, ".claude");
+  const codexHome = opts.codexHome ?? join5(home, ".codex");
+  return {
+    "claude-code": {
+      key: "claude-code",
+      label: "Claude Code",
+      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join5(cwd, ".mcp.json"), format: "json" },
+      instruction: { surfaceKey: "claude-code", path: join5(cwd, "CLAUDE.md") }
+    },
+    "claude-desktop": {
+      key: "claude-desktop",
+      label: "Claude Desktop",
+      mcp: { surfaceKey: "claude-desktop", sectionType: SectionType.McpConfig, path: claudeDesktopConfigPath(home), format: "json" },
+      instruction: { surfaceKey: "claude-desktop", path: join5(claudeDir, "CLAUDE.md") }
+    },
+    codex: {
+      key: "codex",
+      label: "Codex CLI",
+      mcp: { surfaceKey: "chatgpt", sectionType: SectionType.McpConfigToml, path: join5(codexHome, "config.toml"), format: "toml" },
+      instruction: { surfaceKey: "chatgpt", path: join5(cwd, "AGENTS.md") }
+    },
+    cursor: {
+      key: "cursor",
+      label: "Cursor",
+      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join5(cwd, ".cursor", "mcp.json"), format: "json" },
+      instruction: { surfaceKey: "chatgpt", path: join5(cwd, "AGENTS.md") }
+    },
+    antigravity: {
+      key: "antigravity",
+      label: "Google Antigravity",
+      // FR-sechroom-247 — Antigravity reads MCP from a GLOBAL, home-relative
+      // `~/.gemini/config/mcp_config.json` (not cwd; not affected by
+      // CLAUDE_CONFIG_DIR / CODEX_HOME). The snippet — `serverUrl`-shaped, no
+      // `type` — comes from the `antigravity` server surface, so we don't
+      // hardcode it here. Instructions go in the project `AGENTS.md`
+      // (cross-tool, shared with Codex/Cursor).
+      mcp: { surfaceKey: "antigravity", sectionType: SectionType.McpConfig, path: join5(home, ".gemini", "config", "mcp_config.json"), format: "json" },
+      instruction: { surfaceKey: "antigravity", path: join5(cwd, "AGENTS.md") }
+    }
+  };
+}
+var ALL_CLIENT_KEYS = ["claude-code", "claude-desktop", "codex", "cursor", "antigravity"];
+var DEFAULT_CLIENT_KEY = "claude-code";
+function detectInstalledClients(cwd) {
+  const home = homedir3();
+  const detected = [];
+  if (resolveClaudeTargets({}).some((t) => existsSync4(t.dir))) detected.push("claude-code");
+  if (existsSync4(dirname2(claudeDesktopConfigPath(home)))) detected.push("claude-desktop");
+  if (resolveCodexHomes({}).some((d) => existsSync4(d))) detected.push("codex");
+  if (existsSync4(join5(home, ".cursor")) || existsSync4(join5(cwd, ".cursor"))) detected.push("cursor");
+  if (existsSync4(join5(home, ".gemini"))) detected.push("antigravity");
+  return detected;
+}
+
+// src/commands/hook-install.ts
+var CLAUDE_HOOK_COMMANDS = {
+  SessionStart: "sechroom hook session-start",
+  PreCompact: "sechroom hook pre-compact",
+  SessionEnd: "sechroom hook session-end",
+  // WLP telemetry tap (D-WLP-10) — per-turn executor self-report. No-op (exit 0) unless this
+  // checkout is bound to a decomposition+task via `sechroom telemetry bind`, so it's safe to wire
+  // for every Claude install. Claude-only (it parses a Claude Code transcript).
+  Stop: "sechroom telemetry hook"
+};
+var CODEX_HOOK_COMMANDS = {
+  SessionStart: "sechroom hook session-start",
+  Stop: "sechroom hook session-end --debounce-minutes 10"
+};
+function hasHookCommand(config2, event, command) {
+  const groups = config2.hooks?.[event] ?? [];
+  return groups.some((g) => (g.hooks ?? []).some((h) => h.type === "command" && h.command === command));
+}
+function mergeHooks(config2, commands) {
+  config2.hooks ??= {};
+  let added = 0;
+  for (const [event, command] of Object.entries(commands)) {
+    if (hasHookCommand(config2, event, command)) continue;
+    const groups = config2.hooks[event] ??= [];
+    groups.push({ hooks: [{ type: "command", command }] });
+    added += 1;
+  }
+  return added;
+}
+function readJsonConfig2(path) {
+  if (!existsSync5(path)) return {};
+  const raw = readFileSync3(path, "utf8");
+  if (!raw.trim()) return {};
+  return JSON.parse(raw);
+}
+function installHooksJson(path, commands, dryRun) {
+  const existed = existsSync5(path) && readFileSync3(path, "utf8").trim().length > 0;
+  const config2 = readJsonConfig2(path);
+  const added = mergeHooks(config2, commands);
+  if (added === 0 && existed) return { path, status: "current" };
+  if (!dryRun) {
+    mkdirSync4(dirname3(path), { recursive: true });
+    writeFileSync4(path, JSON.stringify(config2, null, 2) + "\n");
+  }
+  return { path, status: existed ? "merged" : "created" };
+}
+function installClaudeCommands(claudeDir, commands, dryRun) {
+  return installHooksJson(join6(claudeDir, "settings.json"), commands, dryRun);
+}
+function ensureCodexFeaturesHooks(content) {
+  const lines = content.split("\n");
+  const headerIdx = lines.findIndex((l) => l.trim() === "[features]");
+  if (headerIdx === -1) {
+    const base = content.length === 0 || content.endsWith("\n") ? content : content + "\n";
+    return { next: base + "\n[features]\nhooks = true\n", changed: true };
+  }
+  for (let i = headerIdx + 1; i < lines.length; i += 1) {
+    const trimmed = lines[i].trim();
+    if (trimmed.startsWith("[") && trimmed.endsWith("]")) break;
+    const m = lines[i].match(/^(\s*)hooks(\s*)=(\s*)(.*)$/);
+    if (!m) continue;
+    const value = m[4].replace(/\s*#.*$/, "").trim();
+    if (value === "true") return { next: content, changed: false };
+    lines[i] = `${m[1]}hooks${m[2]}=${m[3]}true`;
+    return { next: lines.join("\n"), changed: true };
+  }
+  lines.splice(headerIdx + 1, 0, "hooks = true");
+  return { next: lines.join("\n"), changed: true };
+}
+function installCodexFeatureFlag(path, dryRun) {
+  const existed = existsSync5(path);
+  const content = existed ? readFileSync3(path, "utf8") : "";
+  const { next, changed } = ensureCodexFeaturesHooks(content);
+  if (!changed) return { path, status: "current" };
+  if (!dryRun) {
+    mkdirSync4(dirname3(path), { recursive: true });
+    writeFileSync4(path, next);
+  }
+  return { path, status: existed ? "merged" : "created" };
+}
+function resolveSurfaces(surface, cwd) {
+  if (surface === "claude") return ["claude"];
+  if (surface === "codex") return ["codex"];
+  if (surface === "both") return ["claude", "codex"];
+  if (surface) throw new Error(`--surface must be one of claude | codex | both (got '${surface}')`);
+  const surfaces = detectHookSurfaces(cwd);
+  return surfaces.length > 0 ? surfaces : ["claude", "codex"];
+}
+function describe(result, dryRun) {
+  if (result.status === "current") return `  \u2713 ${result.path} (already configured)`;
+  const verb = dryRun ? "would" : result.status === "created" ? "created" : "updated";
+  return `  \u2713 ${result.path} (${dryRun ? `${verb} ${result.status === "created" ? "create" : "update"}` : verb})`;
+}
+var HOOK_SURFACE_LABEL = {
+  claude: "Claude Code",
+  codex: "Codex"
+};
+function installHookSurfaces(surfaces, opts) {
+  const out = [];
+  for (const surface of surfaces) {
+    if (surface === "claude") {
+      const path = join6(opts.claudeDir, "settings.json");
+      out.push({ surface, results: [installHooksJson(path, CLAUDE_HOOK_COMMANDS, opts.dryRun)] });
+    } else {
+      const hooksJson = installHooksJson(join6(opts.codexHome, "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
+      const featureFlag = installCodexFeatureFlag(join6(opts.codexHome, "config.toml"), opts.dryRun);
+      out.push({ surface, results: [hooksJson, featureFlag] });
+    }
+  }
+  return out;
+}
+function detectHookSurfaces(cwd) {
+  const detected = detectInstalledClients(cwd);
+  const surfaces = [];
+  if (detected.includes("claude-code")) surfaces.push("claude");
+  if (detected.includes("codex")) surfaces.push("codex");
+  return surfaces;
+}
+function isSechroomOnPath() {
+  const pathEnv = process.env.PATH ?? "";
+  if (!pathEnv) return false;
+  const names = process.platform === "win32" ? ["sechroom.cmd", "sechroom.exe", "sechroom.bat", "sechroom"] : ["sechroom"];
+  for (const dir of pathEnv.split(delimiter)) {
+    if (!dir) continue;
+    for (const name of names) {
+      if (existsSync5(join6(dir, name))) return true;
+    }
+  }
+  return false;
+}
+function warnIfSechroomNotOnPath(write = (s) => void process.stderr.write(s)) {
+  if (isSechroomOnPath()) return false;
+  write(
+    "\n\u26A0  `sechroom` isn't on your PATH. The hooks run a bare `sechroom hook \u2026` command\n   when your agent fires them, so a non-global install (npx / local) will fail at\n   that point. Install globally so the command resolves:\n     npm i -g @sechroom/cli\n"
+  );
+  return true;
+}
+
+// src/commands/channel.ts
 function registerChannel(program2) {
   const channel = program2.command("channel").description(
     "Receive matched substrate events over the held SignalR push leg (D-WLP-9)"
@@ -1328,11 +1544,16 @@ function registerChannel(program2) {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const filter = readFilter(opts);
     const sub = await ensureSubscription(cfg, opts.name, filter);
-    const conn = await openConnection(cfg, (payload) => {
-      process.stdout.write(
+    const seen = /* @__PURE__ */ new Set();
+    const deliver = makeDeliver(
+      filter,
+      seen,
+      (payload) => process.stdout.write(
         (typeof payload === "string" ? payload : JSON.stringify(payload)) + "\n"
-      );
-    });
+      )
+    );
+    const conn = await openConnection(cfg, deliver);
+    await reconcile(cfg, filter, deliver);
     if (json) {
       emit(
         {
@@ -1369,7 +1590,8 @@ function registerChannel(program2) {
     );
     await mcp.connect(new StdioServerTransport());
     await ensureSubscription(cfg, opts.name, filter);
-    const conn = await openConnection(cfg, (payload) => {
+    const seen = /* @__PURE__ */ new Set();
+    const deliver = makeDeliver(filter, seen, (payload) => {
       const { content, meta } = summarizeEvent(payload);
       void mcp.notification({
         method: "notifications/claude/channel",
@@ -1379,6 +1601,8 @@ function registerChannel(program2) {
 `))
       );
     });
+    const conn = await openConnection(cfg, deliver);
+    await reconcile(cfg, filter, deliver);
     process.stderr.write(
       style.dim(
         `sechroom channel (mcp) \u2014 tenant ${cfg.tenant}, tags [${filter.tags.join(", ")}]
@@ -1387,6 +1611,55 @@ function registerChannel(program2) {
     );
     await holdOpen(conn);
   });
+  channel.command("install").description(
+    "Wire `sechroom channel mcp` into the project .mcp.json as a Claude Code channel MCP server (idempotent)"
+  ).option(
+    "--workspace <wsp...>",
+    "Restrict dispatches to these workspace id(s)"
+  ).option(
+    "--tag <tag...>",
+    "Tag(s) a dispatch must carry to match (repeatable). Default targets WLP task dispatches.",
+    ["kind:task"]
+  ).option(
+    "--name <name>",
+    "MCP server + subscription name (idempotent per name)",
+    "sechroom-channel"
+  ).option("--dry-run", "Print what would change; write nothing").action((opts) => {
+    const path = join7(process.cwd(), ".mcp.json");
+    const dryRun = Boolean(opts.dryRun);
+    const args = ["channel", "mcp", "--name", opts.name];
+    for (const w of opts.workspace ?? [])
+      args.push("--workspace", w);
+    for (const t of opts.tag ?? []) args.push("--tag", t);
+    const entry = { command: "sechroom", args };
+    const config2 = readMcpConfig(path);
+    config2.mcpServers ??= {};
+    const existing = config2.mcpServers[opts.name];
+    const status = JSON.stringify(existing) === JSON.stringify(entry) ? "current" : existing ? "updated" : "created";
+    if (status !== "current" && !dryRun) {
+      config2.mcpServers[opts.name] = entry;
+      mkdirSync5(dirname4(path), { recursive: true });
+      writeFileSync5(path, JSON.stringify(config2, null, 2) + "\n");
+    }
+    const verb = status === "current" ? "already configured" : dryRun ? `would ${status === "created" ? "create" : "update"}` : status;
+    process.stdout.write(`${style.green("channel")} ${path} (${verb})
+`);
+    process.stdout.write(
+      style.dim(`  server "${opts.name}": sechroom ${args.join(" ")}
+`)
+    );
+    if (status !== "current") {
+      process.stdout.write(
+        style.dim(
+          `
+Load it (Channels research preview) by launching your agent with:
+  claude --dangerously-load-development-channels server:${opts.name}
+`
+        )
+      );
+    }
+    warnIfSechroomNotOnPath();
+  });
   channel.addHelpText(
     "after",
     `
@@ -1395,11 +1668,23 @@ Examples:
   $ sechroom channel connect --tag kind:task --tag status:in-progress
   $ sechroom channel connect --workspace wsp_X --json | jq .
 
-  # As a Claude Code channel (research preview, v2.1.80+):
-  #   add to .mcp.json:  { "mcpServers": { "sechroom": { "command": "npx", "args": ["@sechroom/cli", "channel", "mcp"] } } }
-  #   then:  claude --dangerously-load-development-channels server:sechroom`
+  # Wire it as a Claude Code channel MCP server (research preview, v2.1.80+):
+  $ sechroom channel install --workspace wsp_X --tag kind:task --tag status:in-progress
+  #   then:  claude --dangerously-load-development-channels server:sechroom-channel`
   );
 }
+function readMcpConfig(path) {
+  if (!existsSync6(path)) return {};
+  const raw = readFileSync4(path, "utf8");
+  if (!raw.trim()) return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return fail(
+      `Could not parse ${path} as JSON \u2014 fix or remove it before installing the channel.`
+    );
+  }
+}
 function readFilter(opts) {
   const tags = opts.tag ?? [];
   const workspaceScope = opts.workspace ?? [];
@@ -1452,20 +1737,134 @@ function holdOpen(conn) {
     process.on("SIGTERM", stop);
   });
 }
-function summarizeEvent(payload) {
+function parseEvent(payload) {
   let data = payload;
   if (typeof payload === "string") {
     try {
       data = JSON.parse(payload);
     } catch {
-      return { content: payload, meta: {} };
+      return { eventType: "", memoryId: "", workspaceId: "", tags: void 0 };
     }
   }
   const obj = data ?? {};
   const inner = obj.data ?? obj;
-  const eventType = str(inner.eventType ?? inner.EventType ?? obj.type) || "substrate.event";
-  const memoryId = str(inner.memoryId ?? inner.MemoryId);
-  const workspaceId = str(inner.workspaceId ?? inner.WorkspaceId);
+  const rawTags = inner.tags ?? inner.Tags;
+  return {
+    eventType: str(inner.eventType ?? inner.EventType ?? obj.type) || "substrate.event",
+    memoryId: str(inner.memoryId ?? inner.MemoryId),
+    workspaceId: str(inner.workspaceId ?? inner.WorkspaceId),
+    tags: Array.isArray(rawTags) ? rawTags.filter((t) => typeof t === "string") : void 0
+  };
+}
+function shouldDeliver(payload, filter) {
+  const { workspaceId, tags } = parseEvent(payload);
+  if (filter.workspaceScope.length > 0 && (!workspaceId || !filter.workspaceScope.includes(workspaceId)))
+    return false;
+  if (filter.tags.length > 0) {
+    if (!tags) return false;
+    return facetedTagMatch(tags, filter.tags);
+  }
+  return true;
+}
+function makeDeliver(filter, seen, forward) {
+  return (payload) => {
+    if (!shouldDeliver(payload, filter)) return;
+    const { memoryId } = parseEvent(payload);
+    if (memoryId) {
+      if (seen.has(memoryId)) return;
+      seen.add(memoryId);
+    }
+    forward(payload);
+  };
+}
+async function reconcile(cfg, filter, deliver) {
+  if (filter.workspaceScope.length === 0) {
+    process.stderr.write(
+      style.dim(
+        "channel: no --workspace to reconcile against; live feed only (a dropped dispatch won't be recovered).\n"
+      )
+    );
+    return;
+  }
+  if (filter.tags.length === 0) return;
+  let token;
+  try {
+    token = await requireToken(cfg);
+  } catch {
+    return;
+  }
+  const qs = `filterTags=${encodeURIComponent(filter.tags.join(","))}&limit=100`;
+  let recovered = 0;
+  for (const ws of filter.workspaceScope) {
+    try {
+      const resp = await fetch(
+        `${cfg.baseUrl}/workspaces/${encodeURIComponent(ws)}/memories/feed?${qs}`,
+        {
+          headers: {
+            authorization: `Bearer ${token}`,
+            tenant: cfg.tenant,
+            "x-sechroom-surface": "cli"
+          }
+        }
+      );
+      if (!resp.ok) {
+        process.stderr.write(
+          err(
+            `channel: reconcile query for ${ws} failed (HTTP ${resp.status})
+`
+          )
+        );
+        continue;
+      }
+      const data = await resp.json();
+      for (const m of data.results ?? []) {
+        if (!m.id) continue;
+        deliver({
+          eventType: "reconcile",
+          memoryId: m.id,
+          workspaceId: ws,
+          tags: m.tags ?? []
+        });
+        recovered++;
+      }
+    } catch (e) {
+      process.stderr.write(
+        err(`channel: reconcile error for ${ws}: ${String(e)}
+`)
+      );
+    }
+  }
+  if (recovered > 0)
+    process.stderr.write(
+      style.dim(
+        `channel: reconciled ${recovered} already-queued event(s) on connect.
+`
+      )
+    );
+}
+function facetedTagMatch(eventTags, filterTags) {
+  const have = new Set(eventTags);
+  const groups = /* @__PURE__ */ new Map();
+  for (const f of filterTags) {
+    const ns = f.endsWith(":*") ? f.slice(0, -2) : namespaceOf(f);
+    const group = groups.get(ns) ?? [];
+    group.push(f);
+    groups.set(ns, group);
+  }
+  for (const [ns, group] of groups) {
+    const ok2 = group.some(
+      (f) => f.endsWith(":*") ? eventTags.some((t) => namespaceOf(t) === ns) : have.has(f)
+    );
+    if (!ok2) return false;
+  }
+  return true;
+}
+function namespaceOf(tag) {
+  const i = tag.indexOf(":");
+  return i >= 0 ? tag.slice(0, i) : tag;
+}
+function summarizeEvent(payload) {
+  const { eventType, memoryId, workspaceId } = parseEvent(payload);
   const content = memoryId ? `${eventType}: ${memoryId}${workspaceId ? ` (workspace ${workspaceId})` : ""}` : typeof payload === "string" ? payload : JSON.stringify(payload);
   const meta = {};
   if (eventType) meta.event_type = eventType;
@@ -1560,28 +1959,28 @@ Examples:
 }
 
 // src/commands/checkpoint.ts
-import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname6, join as join9 } from "path";
+import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname7, join as join10 } from "path";
 
 // src/commands/hook.ts
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync5, statSync as statSync2, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname5, join as join8 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync6, statSync as statSync2, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname6, join as join9 } from "path";
 
 // src/sem.ts
-import { dirname as dirname2, join as join5 } from "path";
-import { appendFileSync, existsSync as existsSync4, mkdirSync as mkdirSync4, readdirSync, readFileSync as readFileSync3, statSync, writeFileSync as writeFileSync4 } from "fs";
-var SEM_FILE = join5(".sechroom", "lane.json");
+import { dirname as dirname5, join as join8 } from "path";
+import { appendFileSync, existsSync as existsSync7, mkdirSync as mkdirSync6, readdirSync, readFileSync as readFileSync5, statSync, writeFileSync as writeFileSync6 } from "fs";
+var SEM_FILE = join8(".sechroom", "lane.json");
 var STATE_DIR_NAME2 = ".sechroom";
 function localSemPath(cwd = process.cwd()) {
-  return join5(cwd, SEM_FILE);
+  return join8(cwd, SEM_FILE);
 }
 function resolveSemPathForRead(start = process.cwd()) {
   let dir = start;
   while (true) {
-    const candidate = join5(dir, SEM_FILE);
-    if (existsSync4(candidate)) return candidate;
-    const parent = dirname2(dir);
+    const candidate = join8(dir, SEM_FILE);
+    if (existsSync7(candidate)) return candidate;
+    const parent = dirname5(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
@@ -1591,23 +1990,23 @@ function applyWorktreeLaneSuffix(lane, start = process.cwd()) {
     let dir = start;
     let gitPath;
     for (; ; ) {
-      const candidate = join5(dir, ".git");
-      if (existsSync4(candidate)) {
+      const candidate = join8(dir, ".git");
+      if (existsSync7(candidate)) {
         gitPath = candidate;
         break;
       }
-      const parent = dirname2(dir);
+      const parent = dirname5(dir);
       if (parent === dir) break;
       dir = parent;
     }
     if (!gitPath || statSync(gitPath).isDirectory()) return lane;
-    const gitFile = readFileSync3(gitPath, "utf8");
+    const gitFile = readFileSync5(gitPath, "utf8");
     const common = gitFile.trim().match(/^gitdir:\s*(.+)\/worktrees\/[^/\s]+\s*$/);
     if (!common) return lane;
-    const worktreesDir = join5(common[1], "worktrees");
+    const worktreesDir = join8(common[1], "worktrees");
     const siblings = readdirSync(worktreesDir).filter((n) => {
       try {
-        return statSync(join5(worktreesDir, n)).isDirectory();
+        return statSync(join8(worktreesDir, n)).isDirectory();
       } catch {
         return false;
       }
@@ -1619,327 +2018,115 @@ function applyWorktreeLaneSuffix(lane, start = process.cwd()) {
 }
 function laneWithWorktreeSuffix(lane, gitFile, siblings) {
   const m = gitFile.trim().match(/\/worktrees\/([^/\s]+)\s*$/);
-  if (!m) return lane;
-  const idx = [...siblings].sort().indexOf(m[1]);
-  return idx < 0 ? lane : `${lane}-${idx + 2}`;
-}
-function serializeSem(values) {
-  return JSON.stringify(values, null, 2) + "\n";
-}
-function readSem(path) {
-  const p = path ?? resolveSemPathForRead();
-  if (!p || !existsSync4(p)) return void 0;
-  return { path: p, values: parseLaneJson(readFileSync3(p, "utf8")) };
-}
-function readLocalSemValues(cwd = process.cwd()) {
-  const next = join5(cwd, SEM_FILE);
-  if (existsSync4(next)) return readSem(next)?.values ?? {};
-  return {};
-}
-function parseLaneJson(text2) {
-  try {
-    const parsed = JSON.parse(text2);
-    const out = {};
-    for (const [k, v] of Object.entries(parsed)) {
-      if (typeof v === "string") out[k] = v;
-    }
-    return out;
-  } catch {
-    return {};
-  }
-}
-var STATE_DIR_IGNORE = `${STATE_DIR_NAME2}/`;
-function writeSem(values, path = localSemPath()) {
-  mkdirSync4(dirname2(path), { recursive: true });
-  writeFileSync4(path, serializeSem(values));
-  ensureSemIgnored(path);
-  ensureContinuityScaffold(path);
-  return path;
-}
-function ensureStateDirIgnored(cwd = process.cwd()) {
-  ensureSemIgnored(localSemPath(cwd));
-}
-var CONTINUITY_FILE_NAME = "continuity.json";
-var CONTINUITY_SCAFFOLD = JSON.stringify(
-  {
-    _readme: "Agent-maintained continuity intent. Keep these current during the session; `sechroom checkpoint` and the PreCompact hook snapshot from here. The five required fields (objective, state, lastAction, nextAction, resumeInstruction) must all be non-empty for a snapshot to be created.",
-    objective: "",
-    state: "",
-    lastAction: "",
-    nextAction: "",
-    resumeInstruction: "",
-    constraints: [],
-    questions: [],
-    artifacts: [],
-    confidence: null
-  },
-  null,
-  2
-) + "\n";
-function ensureContinuityScaffold(semPath) {
-  try {
-    const target = join5(dirname2(semPath), CONTINUITY_FILE_NAME);
-    if (existsSync4(target)) return;
-    writeFileSync4(target, CONTINUITY_SCAFFOLD);
-  } catch {
-  }
-}
-function ignoresSem(content) {
-  return content.split("\n").some((line) => {
-    const t = line.trim();
-    return t === STATE_DIR_NAME2 || t === STATE_DIR_IGNORE || t === `/${STATE_DIR_NAME2}` || t === `/${STATE_DIR_IGNORE}` || t === `**/${STATE_DIR_NAME2}` || t === `**/${STATE_DIR_IGNORE}`;
-  });
-}
-function inGitRepo(startDir) {
-  let dir = startDir;
-  for (; ; ) {
-    if (existsSync4(join5(dir, ".git"))) return true;
-    const parent = dirname2(dir);
-    if (parent === dir) return false;
-    dir = parent;
-  }
-}
-function resolveGitignoreTarget(startDir) {
-  let dir = startDir;
-  for (; ; ) {
-    const gi = join5(dir, ".gitignore");
-    if (existsSync4(gi)) return { path: gi, exists: true };
-    const parent = dirname2(dir);
-    if (existsSync4(join5(dir, ".git")) || parent === dir) {
-      return { path: join5(startDir, ".gitignore"), exists: false };
-    }
-    dir = parent;
-  }
-}
-function ensureSemIgnored(semPath) {
-  try {
-    const checkoutDir = dirname2(dirname2(semPath));
-    if (!inGitRepo(checkoutDir)) return;
-    const target = resolveGitignoreTarget(checkoutDir);
-    if (target.exists) {
-      const content = readFileSync3(target.path, "utf8");
-      if (ignoresSem(content)) return;
-      const sep = content.length === 0 || content.endsWith("\n") ? "" : "\n";
-      appendFileSync(target.path, `${sep}${STATE_DIR_IGNORE}
-`);
-    } else {
-      writeFileSync4(target.path, `${STATE_DIR_IGNORE}
-`);
-    }
-  } catch {
-  }
-}
-
-// src/commands/hook-install.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
-import { delimiter, dirname as dirname4, join as join7 } from "path";
-
-// src/setup/clients.ts
-import { existsSync as existsSync5 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname3, join as join6 } from "path";
-function claudeDesktopConfigPath(home) {
-  switch (process.platform) {
-    case "darwin":
-      return join6(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
-    case "win32":
-      return join6(process.env.APPDATA ?? join6(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
-    default:
-      return join6(home, ".config", "Claude", "claude_desktop_config.json");
-  }
-}
-function clientTargets(cwd, opts = {}) {
-  const home = homedir3();
-  const claudeDir = opts.claudeDir ?? join6(home, ".claude");
-  const codexHome = opts.codexHome ?? join6(home, ".codex");
-  return {
-    "claude-code": {
-      key: "claude-code",
-      label: "Claude Code",
-      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join6(cwd, ".mcp.json"), format: "json" },
-      instruction: { surfaceKey: "claude-code", path: join6(cwd, "CLAUDE.md") }
-    },
-    "claude-desktop": {
-      key: "claude-desktop",
-      label: "Claude Desktop",
-      mcp: { surfaceKey: "claude-desktop", sectionType: SectionType.McpConfig, path: claudeDesktopConfigPath(home), format: "json" },
-      instruction: { surfaceKey: "claude-desktop", path: join6(claudeDir, "CLAUDE.md") }
-    },
-    codex: {
-      key: "codex",
-      label: "Codex CLI",
-      mcp: { surfaceKey: "chatgpt", sectionType: SectionType.McpConfigToml, path: join6(codexHome, "config.toml"), format: "toml" },
-      instruction: { surfaceKey: "chatgpt", path: join6(cwd, "AGENTS.md") }
-    },
-    cursor: {
-      key: "cursor",
-      label: "Cursor",
-      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join6(cwd, ".cursor", "mcp.json"), format: "json" },
-      instruction: { surfaceKey: "chatgpt", path: join6(cwd, "AGENTS.md") }
-    },
-    antigravity: {
-      key: "antigravity",
-      label: "Google Antigravity",
-      // FR-sechroom-247 — Antigravity reads MCP from a GLOBAL, home-relative
-      // `~/.gemini/config/mcp_config.json` (not cwd; not affected by
-      // CLAUDE_CONFIG_DIR / CODEX_HOME). The snippet — `serverUrl`-shaped, no
-      // `type` — comes from the `antigravity` server surface, so we don't
-      // hardcode it here. Instructions go in the project `AGENTS.md`
-      // (cross-tool, shared with Codex/Cursor).
-      mcp: { surfaceKey: "antigravity", sectionType: SectionType.McpConfig, path: join6(home, ".gemini", "config", "mcp_config.json"), format: "json" },
-      instruction: { surfaceKey: "antigravity", path: join6(cwd, "AGENTS.md") }
-    }
-  };
-}
-var ALL_CLIENT_KEYS = ["claude-code", "claude-desktop", "codex", "cursor", "antigravity"];
-var DEFAULT_CLIENT_KEY = "claude-code";
-function detectInstalledClients(cwd) {
-  const home = homedir3();
-  const detected = [];
-  if (resolveClaudeTargets({}).some((t) => existsSync5(t.dir))) detected.push("claude-code");
-  if (existsSync5(dirname3(claudeDesktopConfigPath(home)))) detected.push("claude-desktop");
-  if (resolveCodexHomes({}).some((d) => existsSync5(d))) detected.push("codex");
-  if (existsSync5(join6(home, ".cursor")) || existsSync5(join6(cwd, ".cursor"))) detected.push("cursor");
-  if (existsSync5(join6(home, ".gemini"))) detected.push("antigravity");
-  return detected;
-}
-
-// src/commands/hook-install.ts
-var CLAUDE_HOOK_COMMANDS = {
-  SessionStart: "sechroom hook session-start",
-  PreCompact: "sechroom hook pre-compact",
-  SessionEnd: "sechroom hook session-end",
-  // WLP telemetry tap (D-WLP-10) — per-turn executor self-report. No-op (exit 0) unless this
-  // checkout is bound to a decomposition+task via `sechroom telemetry bind`, so it's safe to wire
-  // for every Claude install. Claude-only (it parses a Claude Code transcript).
-  Stop: "sechroom telemetry hook"
-};
-var CODEX_HOOK_COMMANDS = {
-  SessionStart: "sechroom hook session-start",
-  Stop: "sechroom hook session-end --debounce-minutes 10"
-};
-function hasHookCommand(config2, event, command) {
-  const groups = config2.hooks?.[event] ?? [];
-  return groups.some((g) => (g.hooks ?? []).some((h) => h.type === "command" && h.command === command));
-}
-function mergeHooks(config2, commands) {
-  config2.hooks ??= {};
-  let added = 0;
-  for (const [event, command] of Object.entries(commands)) {
-    if (hasHookCommand(config2, event, command)) continue;
-    const groups = config2.hooks[event] ??= [];
-    groups.push({ hooks: [{ type: "command", command }] });
-    added += 1;
-  }
-  return added;
+  if (!m) return lane;
+  const idx = [...siblings].sort().indexOf(m[1]);
+  return idx < 0 ? lane : `${lane}-${idx + 2}`;
 }
-function readJsonConfig2(path) {
-  if (!existsSync6(path)) return {};
-  const raw = readFileSync4(path, "utf8");
-  if (!raw.trim()) return {};
-  return JSON.parse(raw);
+function serializeSem(values) {
+  return JSON.stringify(values, null, 2) + "\n";
 }
-function installHooksJson(path, commands, dryRun) {
-  const existed = existsSync6(path) && readFileSync4(path, "utf8").trim().length > 0;
-  const config2 = readJsonConfig2(path);
-  const added = mergeHooks(config2, commands);
-  if (added === 0 && existed) return { path, status: "current" };
-  if (!dryRun) {
-    mkdirSync5(dirname4(path), { recursive: true });
-    writeFileSync5(path, JSON.stringify(config2, null, 2) + "\n");
-  }
-  return { path, status: existed ? "merged" : "created" };
+function readSem(path) {
+  const p = path ?? resolveSemPathForRead();
+  if (!p || !existsSync7(p)) return void 0;
+  return { path: p, values: parseLaneJson(readFileSync5(p, "utf8")) };
 }
-function installClaudeCommands(claudeDir, commands, dryRun) {
-  return installHooksJson(join7(claudeDir, "settings.json"), commands, dryRun);
+function readLocalSemValues(cwd = process.cwd()) {
+  const next = join8(cwd, SEM_FILE);
+  if (existsSync7(next)) return readSem(next)?.values ?? {};
+  return {};
 }
-function ensureCodexFeaturesHooks(content) {
-  const lines = content.split("\n");
-  const headerIdx = lines.findIndex((l) => l.trim() === "[features]");
-  if (headerIdx === -1) {
-    const base = content.length === 0 || content.endsWith("\n") ? content : content + "\n";
-    return { next: base + "\n[features]\nhooks = true\n", changed: true };
-  }
-  for (let i = headerIdx + 1; i < lines.length; i += 1) {
-    const trimmed = lines[i].trim();
-    if (trimmed.startsWith("[") && trimmed.endsWith("]")) break;
-    const m = lines[i].match(/^(\s*)hooks(\s*)=(\s*)(.*)$/);
-    if (!m) continue;
-    const value = m[4].replace(/\s*#.*$/, "").trim();
-    if (value === "true") return { next: content, changed: false };
-    lines[i] = `${m[1]}hooks${m[2]}=${m[3]}true`;
-    return { next: lines.join("\n"), changed: true };
+function parseLaneJson(text2) {
+  try {
+    const parsed = JSON.parse(text2);
+    const out = {};
+    for (const [k, v] of Object.entries(parsed)) {
+      if (typeof v === "string") out[k] = v;
+    }
+    return out;
+  } catch {
+    return {};
   }
-  lines.splice(headerIdx + 1, 0, "hooks = true");
-  return { next: lines.join("\n"), changed: true };
 }
-function installCodexFeatureFlag(path, dryRun) {
-  const existed = existsSync6(path);
-  const content = existed ? readFileSync4(path, "utf8") : "";
-  const { next, changed } = ensureCodexFeaturesHooks(content);
-  if (!changed) return { path, status: "current" };
-  if (!dryRun) {
-    mkdirSync5(dirname4(path), { recursive: true });
-    writeFileSync5(path, next);
+var STATE_DIR_IGNORE = `${STATE_DIR_NAME2}/`;
+function writeSem(values, path = localSemPath()) {
+  mkdirSync6(dirname5(path), { recursive: true });
+  writeFileSync6(path, serializeSem(values));
+  ensureSemIgnored(path);
+  ensureContinuityScaffold(path);
+  return path;
+}
+function ensureStateDirIgnored(cwd = process.cwd()) {
+  ensureSemIgnored(localSemPath(cwd));
+}
+var CONTINUITY_FILE_NAME = "continuity.json";
+var CONTINUITY_SCAFFOLD = JSON.stringify(
+  {
+    _readme: "Agent-maintained continuity intent. Keep these current during the session; `sechroom checkpoint` and the PreCompact hook snapshot from here. The five required fields (objective, state, lastAction, nextAction, resumeInstruction) must all be non-empty for a snapshot to be created.",
+    objective: "",
+    state: "",
+    lastAction: "",
+    nextAction: "",
+    resumeInstruction: "",
+    constraints: [],
+    questions: [],
+    artifacts: [],
+    confidence: null
+  },
+  null,
+  2
+) + "\n";
+function ensureContinuityScaffold(semPath) {
+  try {
+    const target = join8(dirname5(semPath), CONTINUITY_FILE_NAME);
+    if (existsSync7(target)) return;
+    writeFileSync6(target, CONTINUITY_SCAFFOLD);
+  } catch {
   }
-  return { path, status: existed ? "merged" : "created" };
 }
-function resolveSurfaces(surface, cwd) {
-  if (surface === "claude") return ["claude"];
-  if (surface === "codex") return ["codex"];
-  if (surface === "both") return ["claude", "codex"];
-  if (surface) throw new Error(`--surface must be one of claude | codex | both (got '${surface}')`);
-  const surfaces = detectHookSurfaces(cwd);
-  return surfaces.length > 0 ? surfaces : ["claude", "codex"];
+function ignoresSem(content) {
+  return content.split("\n").some((line) => {
+    const t = line.trim();
+    return t === STATE_DIR_NAME2 || t === STATE_DIR_IGNORE || t === `/${STATE_DIR_NAME2}` || t === `/${STATE_DIR_IGNORE}` || t === `**/${STATE_DIR_NAME2}` || t === `**/${STATE_DIR_IGNORE}`;
+  });
 }
-function describe(result, dryRun) {
-  if (result.status === "current") return `  \u2713 ${result.path} (already configured)`;
-  const verb = dryRun ? "would" : result.status === "created" ? "created" : "updated";
-  return `  \u2713 ${result.path} (${dryRun ? `${verb} ${result.status === "created" ? "create" : "update"}` : verb})`;
+function inGitRepo(startDir) {
+  let dir = startDir;
+  for (; ; ) {
+    if (existsSync7(join8(dir, ".git"))) return true;
+    const parent = dirname5(dir);
+    if (parent === dir) return false;
+    dir = parent;
+  }
 }
-var HOOK_SURFACE_LABEL = {
-  claude: "Claude Code",
-  codex: "Codex"
-};
-function installHookSurfaces(surfaces, opts) {
-  const out = [];
-  for (const surface of surfaces) {
-    if (surface === "claude") {
-      const path = join7(opts.claudeDir, "settings.json");
-      out.push({ surface, results: [installHooksJson(path, CLAUDE_HOOK_COMMANDS, opts.dryRun)] });
-    } else {
-      const hooksJson = installHooksJson(join7(opts.codexHome, "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
-      const featureFlag = installCodexFeatureFlag(join7(opts.codexHome, "config.toml"), opts.dryRun);
-      out.push({ surface, results: [hooksJson, featureFlag] });
+function resolveGitignoreTarget(startDir) {
+  let dir = startDir;
+  for (; ; ) {
+    const gi = join8(dir, ".gitignore");
+    if (existsSync7(gi)) return { path: gi, exists: true };
+    const parent = dirname5(dir);
+    if (existsSync7(join8(dir, ".git")) || parent === dir) {
+      return { path: join8(startDir, ".gitignore"), exists: false };
     }
+    dir = parent;
   }
-  return out;
-}
-function detectHookSurfaces(cwd) {
-  const detected = detectInstalledClients(cwd);
-  const surfaces = [];
-  if (detected.includes("claude-code")) surfaces.push("claude");
-  if (detected.includes("codex")) surfaces.push("codex");
-  return surfaces;
 }
-function isSechroomOnPath() {
-  const pathEnv = process.env.PATH ?? "";
-  if (!pathEnv) return false;
-  const names = process.platform === "win32" ? ["sechroom.cmd", "sechroom.exe", "sechroom.bat", "sechroom"] : ["sechroom"];
-  for (const dir of pathEnv.split(delimiter)) {
-    if (!dir) continue;
-    for (const name of names) {
-      if (existsSync6(join7(dir, name))) return true;
+function ensureSemIgnored(semPath) {
+  try {
+    const checkoutDir = dirname5(dirname5(semPath));
+    if (!inGitRepo(checkoutDir)) return;
+    const target = resolveGitignoreTarget(checkoutDir);
+    if (target.exists) {
+      const content = readFileSync5(target.path, "utf8");
+      if (ignoresSem(content)) return;
+      const sep = content.length === 0 || content.endsWith("\n") ? "" : "\n";
+      appendFileSync(target.path, `${sep}${STATE_DIR_IGNORE}
+`);
+    } else {
+      writeFileSync6(target.path, `${STATE_DIR_IGNORE}
+`);
     }
+  } catch {
   }
-  return false;
-}
-function warnIfSechroomNotOnPath(write = (s) => void process.stderr.write(s)) {
-  if (isSechroomOnPath()) return false;
-  write(
-    "\n\u26A0  `sechroom` isn't on your PATH. The hooks run a bare `sechroom hook \u2026` command\n   when your agent fires them, so a non-global install (npx / local) will fail at\n   that point. Install globally so the command resolves:\n     npm i -g @sechroom/cli\n"
-  );
-  return true;
 }
 
 // src/commands/hook.ts
@@ -1966,13 +2153,13 @@ function resolveLane(flagLane, cwd) {
   if (!base) return void 0;
   return applyWorktreeLaneSuffix(base, start);
 }
-var INTENT_FILE = join8(".sechroom", "continuity.json");
+var INTENT_FILE = join9(".sechroom", "continuity.json");
 function resolveIntentPath(start) {
   let dir = start;
   for (; ; ) {
-    const candidate = join8(dir, INTENT_FILE);
-    if (existsSync7(candidate)) return candidate;
-    const parent = dirname5(dir);
+    const candidate = join9(dir, INTENT_FILE);
+    if (existsSync8(candidate)) return candidate;
+    const parent = dirname6(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
@@ -1981,7 +2168,7 @@ function readIntent(start) {
   const path = resolveIntentPath(start);
   if (!path) return void 0;
   try {
-    return JSON.parse(readFileSync5(path, "utf8"));
+    return JSON.parse(readFileSync6(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -2023,14 +2210,14 @@ async function saveSnapshotFromIntent(cmd, cwd, laneFlag, scopeFlag, defaultScop
 }
 function ledgerPath(start) {
   const intent = resolveIntentPath(start);
-  const dir = intent ? dirname5(intent) : join8(start, ".sechroom");
-  return join8(dir, ".checkpoint-state.json");
+  const dir = intent ? dirname6(intent) : join9(start, ".sechroom");
+  return join9(dir, ".checkpoint-state.json");
 }
 function readLedger(start) {
   try {
     const p = ledgerPath(start);
-    if (!existsSync7(p)) return {};
-    return JSON.parse(readFileSync5(p, "utf8"));
+    if (!existsSync8(p)) return {};
+    return JSON.parse(readFileSync6(p, "utf8"));
   } catch {
     return {};
   }
@@ -2077,13 +2264,13 @@ function recordPush(start, intent) {
     } catch {
       mtimeMs = void 0;
     }
-    mkdirSync6(dirname5(p), { recursive: true });
+    mkdirSync7(dirname6(p), { recursive: true });
     const ledger = {
       lastEpochMs: Date.now(),
       lastMtimeMs: mtimeMs,
       lastHash: intentHash(intent)
     };
-    writeFileSync6(p, JSON.stringify(ledger) + "\n");
+    writeFileSync7(p, JSON.stringify(ledger) + "\n");
   } catch {
   }
 }
@@ -2330,10 +2517,10 @@ Examples:
       const client = await makeClient(cfg);
       return client.POST("/continuity/snapshots", { body });
     });
-    const path = resolveIntentPath(cwd) ?? join9(cwd, INTENT_FILE);
+    const path = resolveIntentPath(cwd) ?? join10(cwd, INTENT_FILE);
     const fileBody = { ...merged, scope, lastSnapshotId: data.snapshotId };
-    mkdirSync7(dirname6(path), { recursive: true });
-    writeFileSync7(path, JSON.stringify(fileBody, null, 2) + "\n");
+    mkdirSync8(dirname7(path), { recursive: true });
+    writeFileSync8(path, JSON.stringify(fileBody, null, 2) + "\n");
     recordPush(cwd, merged);
     if (json) {
       emit({ snapshotId: data.snapshotId, lane, scope, file: path }, true);
@@ -2346,6 +2533,149 @@ Examples:
   });
 }
 
+// src/commands/close.ts
+import { readFileSync as readFileSync7 } from "fs";
+var VERDICTS = ["pass", "soft-fail", "plan-invalid", "blocked"];
+function registerClose(program2) {
+  program2.command("close").description(
+    "Close a dispatched WorkTask in one call: closeout memo (verdict + correlation) + Reference edge + source status flip. Managed runs stamp the run's matchTags verbatim (SBC-1180)."
+  ).requiredOption("--task <id>", "The WorkTask memory id being closed").requiredOption("--verdict <verdict>", `Verdict: ${VERDICTS.join(" | ")}`).requiredOption(
+    "--workspace <wsp>",
+    "Workspace that owns the closeout memo"
+  ).requiredOption("--title <title>", "Closeout title").option(
+    "--file <path>",
+    "Read the closeout body from a file (default: stdin)"
+  ).option(
+    "--decomposition <id>",
+    "Managed-run selector \u2014 the sug_ decomposition the task belongs to. Locates the parked run so its matchTags/verdict contract are read from state, not assembled from args."
+  ).option(
+    "--no-status-flip",
+    "Skip the status flip on a BARE task. (Managed runs never flip here \u2014 the run engine reflects the verdict onto the task on resume.)"
+  ).option("--source <source>", "Source / lane stamp", "cli").addHelpText(
+    "after",
+    `
+Examples:
+  # Managed run \u2014 reads matchTags from run state, stamps them verbatim, un-parks the run:
+  $ echo "Shipped X. Tests green." | sechroom close --task mem_XXXX --decomposition sug_YYYY \\
+      --verdict pass --workspace wsp_ZZZZ --title "w4_build closeout"
+
+  # Bare task:
+  $ sechroom close --task mem_XXXX --verdict pass --workspace wsp_ZZZZ \\
+      --title "done" --file ./closeout.md`
+  ).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const json = cmd.optsWithGlobals().json;
+    const verdict = String(opts.verdict);
+    if (!VERDICTS.includes(verdict))
+      fail(
+        `--verdict must be one of ${VERDICTS.join(" | ")} \u2014 got '${opts.verdict}'`
+      );
+    let bodyText;
+    try {
+      bodyText = opts.file ? readFileSync7(opts.file, "utf8") : readFileSync7(0, "utf8");
+    } catch {
+      fail(
+        opts.file ? `could not read --file ${opts.file}` : "no closeout body \u2014 pass --file <path> or pipe it on stdin"
+      );
+    }
+    if (!bodyText.trim())
+      fail(
+        "closeout body is empty \u2014 pass --file <path> or pipe the body on stdin"
+      );
+    const client = await makeClient(cfg);
+    let matchTags;
+    if (opts.decomposition) {
+      const run = await runApi(
+        "Reading run contract",
+        async () => client.GET("/decompositions/{id}/run", {
+          params: { path: { id: opts.decomposition } }
+        })
+      );
+      const await_ = run.awaitingCompletion;
+      if (!await_ || !Array.isArray(await_.matchTags) || await_.matchTags.length === 0)
+        fail(
+          `decomposition ${opts.decomposition} has no parked run awaiting a completion \u2014 nothing to close (run outcome: ${run.outcome ?? "unknown"}). Idempotent no-op on an already-resumed/terminal run.`
+        );
+      if (run.awaitingTaskId && run.awaitingTaskId !== opts.task)
+        fail(
+          `run ${opts.decomposition} is awaiting task ${run.awaitingTaskId}, not ${opts.task} \u2014 refusing to mis-key the resume.`
+        );
+      matchTags = await_.matchTags;
+    } else {
+      matchTags = [`wlp-task:${opts.task}`];
+    }
+    const tags = [
+      .../* @__PURE__ */ new Set([
+        ...matchTags,
+        `wlp-task:${opts.task}`,
+        `verdict:${verdict}`
+      ])
+    ];
+    const closeout = await runApi(
+      "Creating closeout",
+      async () => client.POST("/memories", {
+        body: {
+          text: bodyText,
+          type: "reference",
+          content: "{}",
+          confidence: 1,
+          source: opts.source,
+          archetype: "Document",
+          title: opts.title,
+          tags,
+          owner: { type: "Workspace", id: opts.workspace }
+        }
+      })
+    );
+    const edge = await runApi(
+      "Wiring Reference edge",
+      async () => client.POST("/memories/{memoryId}/relationships", {
+        params: { path: { memoryId: closeout.id } },
+        body: { toMemoryId: opts.task, type: "Reference" }
+      })
+    );
+    let taskStatus;
+    if (opts.statusFlip !== false && !opts.decomposition) {
+      const current = await runApi(
+        "Reading task tags",
+        async () => client.GET("/memories/{memoryId}", {
+          params: { path: { memoryId: opts.task } }
+        })
+      );
+      const currentTags = current?.item?.tags ?? current?.tags ?? [];
+      const target = verdict === "blocked" ? "status:blocked" : "status:done";
+      const nextTags = [
+        ...new Set(currentTags.filter((t) => !t.startsWith("status:")))
+      ].concat(target);
+      await runApi(
+        "Flipping task status",
+        async () => client.PATCH("/memories/{memoryId}/metadata", {
+          params: { path: { memoryId: opts.task } },
+          body: {
+            memoryId: opts.task,
+            source: opts.source,
+            tags: nextTags
+          }
+        })
+      );
+      taskStatus = target.slice("status:".length);
+    }
+    const view = resolveViewUrl(cfg.baseUrl, closeout.url);
+    const result = {
+      closeoutId: closeout.id,
+      edgeId: edge.id,
+      taskStatus: taskStatus ?? null,
+      verdict,
+      tags
+    };
+    emitAction(
+      `closed ${style.bold(opts.task)} verdict:${style.bold(verdict)} \u2192 closeout ${style.bold(closeout.id)}${taskStatus ? ` ${style.dim(`(task ${taskStatus})`)}` : ""}${view ? ` ${style.dim("\u2192")} ${view}` : ""}`,
+      result,
+      json
+    );
+  });
+}
+
 // src/commands/continuity.ts
 function registerContinuity(program2) {
   const continuity = program2.command("continuity").description("Continuity snapshots: checkpoint and resume work");
@@ -2506,6 +2836,90 @@ Examples:
   });
 }
 
+// src/commands/decomposition.ts
+function registerDecomposition(program2) {
+  const decomposition = program2.command("decomposition").description(
+    "Drive a WLP decomposition: decompose a brief, then execute / accept / reject"
+  );
+  decomposition.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom decomposition decompose mem_XXXX
+  $ sechroom decomposition execute sug_XXXX
+  $ sechroom decomposition accept sug_XXXX
+  $ sechroom decomposition reject sug_XXXX --reason "wrong shape"`
+  );
+  decomposition.command("decompose <briefId>").description(
+    "Decompose a work brief into a candidate Task graph (POST /work-briefs/{id}/decompose)"
+  ).action(async (briefId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Queueing decomposition", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/work-briefs/{id}/decompose", {
+        params: { path: { id: briefId } },
+        body: { id: briefId }
+      });
+    });
+    emitAction(
+      `queued decomposition of ${style.bold(briefId)} \u2192 ${style.bold(data.suggestionId)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  decomposition.command("execute <decompositionId>").description(
+    "Execute a decomposition's Task graph (POST /decompositions/{id}/execute)"
+  ).action(async (decompositionId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Executing decomposition", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/decompositions/{id}/execute", {
+        params: { path: { id: decompositionId } },
+        body: {}
+      });
+    });
+    emitAction(
+      `executed ${style.bold(decompositionId)} \u2192 run ${style.bold(data.runRecordId)} (${data.outcome})`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  decomposition.command("accept <decompositionId>").description(
+    "Accept a Pending decomposition \u2014 promote + ratify its Tasks (POST /decompositions/{id}/accept)"
+  ).action(async (decompositionId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Accepting decomposition", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/decompositions/{id}/accept", {
+        params: { path: { id: decompositionId } },
+        body: {}
+      });
+    });
+    emitAction(
+      `accepted decomposition ${style.bold(decompositionId)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  decomposition.command("reject <decompositionId>").description(
+    "Reject a Pending decomposition \u2014 archive its Tasks, bounce the brief (POST /decompositions/{id}/reject)"
+  ).option("--reason <reason>", "Optional free-text rejection reason").action(async (decompositionId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Rejecting decomposition", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/decompositions/{id}/reject", {
+        params: { path: { id: decompositionId } },
+        body: { reasonText: opts.reason ?? null }
+      });
+    });
+    emitAction(
+      `rejected decomposition ${style.bold(decompositionId)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+}
+
 // src/commands/filing.ts
 function registerFiling(program2) {
   const filing = program2.command("filing").description("Review and act on filing suggestions");
@@ -3017,8 +3431,8 @@ Examples:
 
 // src/setup/apply.ts
 import { createHash as createHash3 } from "crypto";
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync8, existsSync as existsSync8 } from "fs";
-import { dirname as dirname7 } from "path";
+import { mkdirSync as mkdirSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync9, existsSync as existsSync9 } from "fs";
+import { dirname as dirname8 } from "path";
 var MARKER_BEGIN = "<!-- @sechroom/cli:begin";
 var MARKER_END = "<!-- @sechroom/cli:end";
 function normalizeBody(s) {
@@ -3071,22 +3485,22 @@ function parseManagedBlock(content, block) {
   return null;
 }
 function ensureDir2(path) {
-  mkdirSync8(dirname7(path), { recursive: true });
+  mkdirSync9(dirname8(path), { recursive: true });
 }
 function readOr(path, fallback) {
   try {
-    return readFileSync6(path, "utf8");
+    return readFileSync8(path, "utf8");
   } catch {
     return fallback;
   }
 }
 function mergeMcpJson(path, snippet, dryRun) {
   const incoming = JSON.parse(snippet);
-  const existed = existsSync8(path);
+  const existed = existsSync9(path);
   let current = {};
   if (existed) {
     try {
-      current = JSON.parse(readFileSync6(path, "utf8"));
+      current = JSON.parse(readFileSync8(path, "utf8"));
     } catch {
       return { kind: "mcp", path, status: "skipped", note: "existing file isn't valid JSON \u2014 left untouched" };
     }
@@ -3094,26 +3508,26 @@ function mergeMcpJson(path, snippet, dryRun) {
   current.mcpServers = { ...current.mcpServers ?? {}, ...incoming.mcpServers ?? {} };
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync8(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
+  writeFileSync9(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function mergeCodexToml(path, snippet, dryRun) {
-  const existed = existsSync8(path);
+  const existed = existsSync9(path);
   let body = readOr(path, "");
   body = body.replace(/(^|\n)\[mcp_servers\.sechroom\][^[]*/, "\n").replace(/\n{3,}/g, "\n\n");
   const trimmed = body.trim();
   const next = (trimmed.length > 0 ? trimmed + "\n\n" : "") + snippet.trim() + "\n";
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync8(path, next, { mode: 384 });
+  writeFileSync9(path, next, { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function writeInstructionBlock(path, write, dryRun) {
-  const existed = existsSync8(path);
+  const existed = existsSync9(path);
   const next = computeBlockFile(readOr(path, ""), write);
   if (dryRun) return { kind: "instruction", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync8(path, next);
+  writeFileSync9(path, next);
   return { kind: "instruction", path, status: existed ? "merged" : "created" };
 }
 function computeBlockFile(current, write) {
@@ -3154,7 +3568,7 @@ function applyBlock(path, write, mode, dryRun) {
     const next = computeBlockFile(current, write);
     if (!dryRun) {
       ensureDir2(proposedPath);
-      writeFileSync8(proposedPath, next);
+      writeFileSync9(proposedPath, next);
     }
     return {
       kind: "instruction",
@@ -3194,7 +3608,10 @@ async function applyClient(cfg, setup, target, opts) {
     if (!section) {
       actions.push({ kind: "instruction", path: target.instruction.path, status: "skipped", note: `no instruction-file section on surface '${target.instruction.surfaceKey}'` });
     } else {
-      const resolved = await resolveInstruction(cfg, section, opts.personalWorkspaceId);
+      const resolved = await withSpinner(
+        `Resolving ${target.label} agent instructions`,
+        () => resolveInstruction(cfg, section, opts.personalWorkspaceId)
+      );
       if (!resolved) {
         actions.push({ kind: "instruction", path: target.instruction.path, status: "skipped", note: "no role template found in this tenant \u2014 install the SEM Starter bundle, then re-run `sechroom setup agent-files`" });
       } else {
@@ -3209,7 +3626,10 @@ async function applyClient(cfg, setup, target, opts) {
     }
     const conventionsSection = findSection(surface, SectionType.WorkspaceConventions);
     if (conventionsSection) {
-      const conventions = await resolveWorkspaceConventions(cfg, conventionsSection);
+      const conventions = await withSpinner(
+        `Composing ${target.label} workspace conventions`,
+        () => resolveWorkspaceConventions(cfg, conventionsSection)
+      );
       if (conventions) {
         const action = applyBlock(
           target.instruction.path,
@@ -3278,8 +3698,8 @@ auto-resumes where you left off and checkpoints working state before compacting.
 }
 
 // src/setup/skills-offer.ts
-import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "fs";
-import { join as join10 } from "path";
+import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
+import { join as join11 } from "path";
 
 // src/setup/lane-pin.ts
 var CODE_LANE_PREFIX_BY_CLIENT = {
@@ -3395,8 +3815,8 @@ Found ${summary} available to you for ${surface}.
   if (skills.length > 0) {
     const written = [];
     for (const s of skills) {
-      mkdirSync9(join10(sDir, s.name), { recursive: true });
-      writeFileSync9(join10(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
+      mkdirSync10(join11(sDir, s.name), { recursive: true });
+      writeFileSync10(join11(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
       written.push(s.name);
     }
     recordMaterialisedSkills(sDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -3404,11 +3824,11 @@ Found ${summary} available to you for ${surface}.
 `);
   }
   if (agents.length > 0) {
-    mkdirSync9(aDir, { recursive: true });
+    mkdirSync10(aDir, { recursive: true });
     const written = [];
     for (const a of agents) {
       const file = `${a.name}.md`;
-      writeFileSync9(join10(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
+      writeFileSync10(join11(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
       written.push(file);
     }
     recordMaterialisedSkills(aDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -3791,13 +4211,13 @@ Wired to namespace '${slug}'. Restart your AI client (or reload MCP) to pick it
 }
 
 // src/commands/onboard.ts
-import { existsSync as existsSync10 } from "fs";
-import { basename as basename2, join as join12 } from "path";
+import { existsSync as existsSync11 } from "fs";
+import { basename as basename2, join as join13 } from "path";
 
 // src/commands/fanout.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync9, readFileSync as readFileSync7, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
-import { isAbsolute, join as join11, resolve } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync9, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
+import { isAbsolute, join as join12, resolve } from "path";
 var ICON = {
   refresh: "\u21BB",
   bind: "+",
@@ -3817,21 +4237,21 @@ function discoverChildren(root) {
   const out = [];
   for (const name of names.sort()) {
     if (name.startsWith(".") || name === "node_modules") continue;
-    const dir = join11(root, name);
+    const dir = join12(root, name);
     try {
       if (!statSync3(dir).isDirectory()) continue;
     } catch {
       continue;
     }
-    if (existsSync9(join11(dir, ".git")) || committedBindingPath(dir)) out.push(name);
+    if (existsSync10(join12(dir, ".git")) || committedBindingPath(dir)) out.push(name);
   }
   return out;
 }
 function readManifest(path) {
-  if (!existsSync9(path)) return null;
+  if (!existsSync10(path)) return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync7(path, "utf8"));
+    parsed = JSON.parse(readFileSync9(path, "utf8"));
   } catch (err2) {
     throw new Error(`couldn't parse ${path}: ${err2 instanceof Error ? err2.message : String(err2)}`);
   }
@@ -4197,10 +4617,10 @@ async function chooseScope(scopeFlag, yes) {
 }
 async function planRecurseChild(entry, root, client, opts) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync10(dir)) {
+  if (!existsSync11(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
-  if (existsSync10(join12(dir, ".sechroom.json"))) {
+  if (existsSync11(join13(dir, ".sechroom.json"))) {
     return {
       label: entry.path,
       dir,
@@ -4273,7 +4693,7 @@ This fan-out will pin the same lane in every repo:
 async function runRecurse(cfg, g, opts) {
   const { yes, dryRun, json } = opts;
   const root = process.cwd();
-  const manifestPath = join12(root, ".sechroom", "repos.json");
+  const manifestPath = join13(root, ".sechroom", "repos.json");
   const fromManifest = readManifest(manifestPath);
   const entries = fromManifest ?? discoverChildren(root).map((path) => ({ path }));
   const sourceLabel = fromManifest ? `manifest ${manifestPath}` : `auto-discovered under ${root}`;
@@ -4785,23 +5205,23 @@ Examples:
 
 // src/commands/reset.ts
 import { homedir as homedir4 } from "os";
-import { join as join13 } from "path";
-import { existsSync as existsSync11, readFileSync as readFileSync8, rmSync as rmSync3 } from "fs";
+import { join as join14 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync10, rmSync as rmSync3 } from "fs";
 var SKILLS_LOCK2 = ".sechroom-skills.json";
-var localSkillsDir = () => join13(process.cwd(), ".claude", "skills");
-var globalSkillsDir = () => join13(homedir4(), ".claude", "skills");
-var localAgentsDir = () => join13(process.cwd(), ".claude", "agents");
-var globalAgentsDir = () => join13(homedir4(), ".claude", "agents");
+var localSkillsDir = () => join14(process.cwd(), ".claude", "skills");
+var globalSkillsDir = () => join14(homedir4(), ".claude", "skills");
+var localAgentsDir = () => join14(process.cwd(), ".claude", "agents");
+var globalAgentsDir = () => join14(homedir4(), ".claude", "agents");
 function removeMaterialisedSkills(dir) {
   const removed = [];
-  const lockPath = join13(dir, SKILLS_LOCK2);
-  if (!existsSync11(lockPath)) return removed;
+  const lockPath = join14(dir, SKILLS_LOCK2);
+  if (!existsSync12(lockPath)) return removed;
   try {
-    const lock = JSON.parse(readFileSync8(lockPath, "utf8"));
+    const lock = JSON.parse(readFileSync10(lockPath, "utf8"));
     for (const entry of Object.values(lock)) {
       for (const name of entry.skills ?? []) {
-        const p = join13(dir, name);
-        if (existsSync11(p)) {
+        const p = join14(dir, name);
+        if (existsSync12(p)) {
           rmSync3(p, { recursive: true, force: true });
           removed.push(p);
         }
@@ -4846,18 +5266,18 @@ function registerReset(program2) {
       }
     }
     const removed = [];
-    const stateDir = join13(process.cwd(), ".sechroom");
-    if (existsSync11(stateDir)) {
+    const stateDir = join14(process.cwd(), ".sechroom");
+    if (existsSync12(stateDir)) {
       rmSync3(stateDir, { recursive: true, force: true });
       removed.push(stateDir);
     }
-    const legacyCfg = join13(process.cwd(), ".sechroom.json");
-    if (existsSync11(legacyCfg)) {
+    const legacyCfg = join14(process.cwd(), ".sechroom.json");
+    if (existsSync12(legacyCfg)) {
       rmSync3(legacyCfg, { force: true });
       removed.push(legacyCfg);
     }
-    const legacySem = join13(process.cwd(), ".sem");
-    if (existsSync11(legacySem)) {
+    const legacySem = join14(process.cwd(), ".sem");
+    if (existsSync12(legacySem)) {
       rmSync3(legacySem, { force: true });
       removed.push(legacySem);
     }
@@ -4883,8 +5303,8 @@ function registerReset(program2) {
 }
 
 // src/commands/skills.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync10, statSync as statSync4, writeFileSync as writeFileSync10 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync11, statSync as statSync4, writeFileSync as writeFileSync11 } from "fs";
+import { join as join15 } from "path";
 function filenameFromDisposition(header) {
   if (!header) return void 0;
   const m = /filename\*?=(?:UTF-8'')?"?([^";]+)"?/i.exec(header);
@@ -4892,11 +5312,11 @@ function filenameFromDisposition(header) {
 }
 function resolveOutputPath(output, serverFilename) {
   const filename = serverFilename || "skills.zip";
-  if (!output) return join14(process.cwd(), filename);
-  const looksLikeDir = output.endsWith("/") || existsSync12(output) && statSync4(output).isDirectory();
+  if (!output) return join15(process.cwd(), filename);
+  const looksLikeDir = output.endsWith("/") || existsSync13(output) && statSync4(output).isDirectory();
   if (looksLikeDir) {
-    mkdirSync10(output, { recursive: true });
-    return join14(output, filename);
+    mkdirSync11(output, { recursive: true });
+    return join15(output, filename);
   }
   return output;
 }
@@ -4927,7 +5347,7 @@ async function downloadZip(label, call, output) {
   const buf = Buffer.from(res.data);
   const filename = filenameFromDisposition(res.response.headers.get("content-disposition")) ?? "skills.zip";
   const path = resolveOutputPath(output, filename);
-  writeFileSync10(path, buf);
+  writeFileSync11(path, buf);
   return { path, bytes: buf.length, filename };
 }
 function registerSkills(program2) {
@@ -5095,12 +5515,12 @@ Examples:
 }
 
 // src/commands/sweep.ts
-import { existsSync as existsSync13 } from "fs";
-import { dirname as dirname8, join as join15, resolve as resolve2 } from "path";
-var DEFAULT_MANIFEST = join15(".sechroom", "repos.json");
+import { existsSync as existsSync14 } from "fs";
+import { dirname as dirname9, join as join16, resolve as resolve2 } from "path";
+var DEFAULT_MANIFEST = join16(".sechroom", "repos.json");
 function planEntry(entry, root) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync13(dir)) {
+  if (!existsSync14(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
   if (committedBindingPath(dir)) {
@@ -5176,7 +5596,7 @@ Examples:
 `);
       return;
     }
-    const root = dirname8(dirname8(manifestPath));
+    const root = dirname9(dirname9(manifestPath));
     const plans = repos.map((entry) => planEntry(entry, root));
     if (!json) {
       process.stderr.write(
@@ -5195,13 +5615,13 @@ Examples:
 
 // src/commands/telemetry.ts
 import {
-  existsSync as existsSync14,
-  mkdirSync as mkdirSync11,
-  readFileSync as readFileSync9,
+  existsSync as existsSync15,
+  mkdirSync as mkdirSync12,
+  readFileSync as readFileSync11,
   rmSync as rmSync4,
-  writeFileSync as writeFileSync11
+  writeFileSync as writeFileSync12
 } from "fs";
-import { dirname as dirname9, join as join16 } from "path";
+import { dirname as dirname10, join as join17 } from "path";
 function registerTelemetry(program2) {
   const telemetry = program2.command("telemetry").description(
     "Emit WLP run telemetry (an executor leg's progress events) into a decomposition run"
@@ -5271,14 +5691,14 @@ function registerTelemetry(program2) {
     "Decomposition id this session executes"
   ).requiredOption("--task <id>", "Task id this session executes").action((opts, cmd) => {
     const json = Boolean(cmd.optsWithGlobals().json);
-    const dir = join16(process.cwd(), ".sechroom");
-    mkdirSync11(dir, { recursive: true });
-    const path = join16(dir, BINDING_FILE);
+    const dir = join17(process.cwd(), ".sechroom");
+    mkdirSync12(dir, { recursive: true });
+    const path = join17(dir, BINDING_FILE);
     const binding = {
       decompositionId: opts.decomposition,
       taskId: opts.task
     };
-    writeFileSync11(path, JSON.stringify(binding, null, 2) + "\n");
+    writeFileSync12(path, JSON.stringify(binding, null, 2) + "\n");
     ensureStateDirIgnored(process.cwd());
     if (json) {
       emit({ bound: true, ...binding, path }, true);
@@ -5293,8 +5713,8 @@ function registerTelemetry(program2) {
   });
   telemetry.command("unbind").description("Clear this checkout's telemetry binding").action((_opts, cmd) => {
     const json = Boolean(cmd.optsWithGlobals().json);
-    const path = join16(process.cwd(), ".sechroom", BINDING_FILE);
-    const existed = existsSync14(path);
+    const path = join17(process.cwd(), ".sechroom", BINDING_FILE);
+    const existed = existsSync15(path);
     if (existed) rmSync4(path);
     if (json) emit({ unbound: existed, path }, true);
     else
@@ -5408,11 +5828,11 @@ async function postTelemetry(cfg, decompositionId, events) {
 function findBinding(start) {
   let dir = start;
   for (; ; ) {
-    const path = join16(dir, ".sechroom", BINDING_FILE);
-    if (existsSync14(path)) {
+    const path = join17(dir, ".sechroom", BINDING_FILE);
+    if (existsSync15(path)) {
       try {
         const b = JSON.parse(
-          readFileSync9(path, "utf8")
+          readFileSync11(path, "utf8")
         );
         if (b.decompositionId && b.taskId)
           return { decompositionId: b.decompositionId, taskId: b.taskId };
@@ -5420,18 +5840,18 @@ function findBinding(start) {
       }
       return null;
     }
-    const parent = dirname9(dir);
+    const parent = dirname10(dir);
     if (parent === dir) return null;
     dir = parent;
   }
 }
 function parseTranscript(path) {
-  if (!existsSync14(path)) return null;
+  if (!existsSync15(path)) return null;
   let tokensIn = 0;
   let tokensOut = 0;
   let contextUsed = 0;
   let model = "";
-  for (const line of readFileSync9(path, "utf8").split("\n")) {
+  for (const line of readFileSync11(path, "utf8").split("\n")) {
     if (!line.trim()) continue;
     let obj;
     try {
@@ -5448,11 +5868,12 @@ function parseTranscript(path) {
     if (obj.message?.model) model = obj.message.model;
   }
   if (tokensIn === 0 && tokensOut === 0) return null;
-  return { tokensIn, tokensOut, contextUsed, contextWindow: windowFor(model) };
+  return { tokensIn, tokensOut, contextUsed, contextWindow: windowFor(model, contextUsed) };
 }
-function windowFor(model) {
+function windowFor(model, contextUsed = 0) {
   const m = model.toLowerCase();
-  return m.includes("[1m]") || m.includes("-1m") ? 1e6 : 2e5;
+  if (m.includes("[1m]") || m.includes("-1m")) return 1e6;
+  return contextUsed > 2e5 ? 1e6 : 2e5;
 }
 async function readStdin2() {
   if (process.stdin.isTTY) return "";
@@ -5688,7 +6109,7 @@ Examples:
 function resolveVersion() {
   try {
     const pkg = JSON.parse(
-      readFileSync10(new URL("../package.json", import.meta.url), "utf8")
+      readFileSync12(new URL("../package.json", import.meta.url), "utf8")
     );
     return pkg.version ?? "0.0.0";
   } catch {
@@ -5846,6 +6267,8 @@ registerLookup(program);
 registerRelationships(program);
 registerWorkspace(program);
 registerProject(program);
+registerDecomposition(program);
+registerClose(program);
 registerFiling(program);
 registerContinuity(program);
 registerCheckpoint(program);