@sechroom/cli 2026.7.11 → 2026.7.13

package/dist/index.js

@@ -1403,10 +1403,15 @@ var CLAUDE_HOOK_COMMANDS = {
   SessionStart: "sechroom hook session-start",
   PreCompact: "sechroom hook pre-compact",
   SessionEnd: "sechroom hook session-end",
-  // WLP telemetry tap (D-WLP-10) — per-turn executor self-report. No-op (exit 0) unless this
-  // checkout is bound to a decomposition+task via `sechroom telemetry bind`, so it's safe to wire
-  // for every Claude install. Claude-only (it parses a Claude Code transcript).
-  Stop: "sechroom telemetry hook"
+  // WLP telemetry tap (D-WLP-10 + FR-352 Tier 1) — per-turn executor self-report. The one
+  // `telemetry hook` verb dispatches on hook_event_name: Stop/SubagentStop → parsed (token/context) +
+  // terminal (turn end), Notification/PermissionDenied → approval. No-op (exit 0) unless this checkout
+  // is bound via `sechroom telemetry bind`, so it's safe to wire for every Claude install; an event a
+  // given Claude Code version doesn't know is inert (never fires). Claude-only.
+  Stop: "sechroom telemetry hook",
+  SubagentStop: "sechroom telemetry hook",
+  Notification: "sechroom telemetry hook",
+  PermissionDenied: "sechroom telemetry hook"
 };
 var CODEX_HOOK_COMMANDS = {
   SessionStart: "sechroom hook session-start",
@@ -2566,6 +2571,9 @@ function registerClose(program2) {
   ).option(
     "--no-status-flip",
     "Skip the status flip on a BARE task. (Managed runs never flip here \u2014 the run engine reflects the verdict onto the task on resume.)"
+  ).option(
+    "--to-version <n>",
+    "Pin the Reference edge at this task version \u2014 the DISPATCHED version the executor worked against (D-continuity-2). Default: the task's current version (status flips are metadata edits that don't bump the version, so current == dispatched in the normal case; pass this when the task's content changed between dispatch and close)."
   ).option("--source <source>", "Source / lane stamp", "cli").addHelpText(
     "after",
     `
@@ -2599,6 +2607,7 @@ Examples:
       );
     const client = await makeClient(cfg);
     let matchTags;
+    let dispatchedVersion;
     if (opts.decomposition) {
       const run = await runApi(
         "Reading run contract",
@@ -2616,6 +2625,8 @@ Examples:
           `run ${opts.decomposition} is awaiting task ${run.awaitingTaskId}, not ${opts.task} \u2014 refusing to mis-key the resume.`
         );
       matchTags = await_.matchTags;
+      if (typeof await_.dispatchedTaskVersion === "number")
+        dispatchedVersion = await_.dispatchedTaskVersion;
     } else {
       matchTags = [`wlp-task:${opts.task}`];
     }
@@ -2642,11 +2653,34 @@ Examples:
         }
       })
     );
+    let toVersion;
+    if (opts.toVersion !== void 0) {
+      toVersion = Number(opts.toVersion);
+      if (!Number.isInteger(toVersion) || toVersion < 1)
+        fail(
+          `--to-version must be an integer >= 1 \u2014 got '${opts.toVersion}'`
+        );
+    } else if (dispatchedVersion !== void 0) {
+      toVersion = dispatchedVersion;
+    } else {
+      const task = await runApi(
+        "Reading task version",
+        async () => client.GET("/memories/{memoryId}", {
+          params: { path: { memoryId: opts.task } }
+        })
+      );
+      const v = task?.item?.currentVersion ?? task?.currentVersion;
+      if (typeof v !== "number" || v < 1)
+        fail(
+          `could not read task ${opts.task} version to pin the Reference edge \u2014 pass --to-version <n>`
+        );
+      toVersion = v;
+    }
     const edge = await runApi(
       "Wiring Reference edge",
       async () => client.POST("/memories/{memoryId}/relationships", {
         params: { path: { memoryId: closeout.id } },
-        body: { toMemoryId: opts.task, type: "Reference" }
+        body: { toMemoryId: opts.task, type: "Reference", toVersion }
       })
     );
     let taskStatus;
@@ -2862,6 +2896,7 @@ function registerDecomposition(program2) {
 Examples:
   $ sechroom decomposition decompose mem_XXXX
   $ sechroom decomposition execute sug_XXXX
+  $ sechroom decomposition publish-run sug_XXXX
   $ sechroom decomposition accept sug_XXXX
   $ sechroom decomposition reject sug_XXXX --reason "wrong shape"`
   );
@@ -2899,6 +2934,23 @@ Examples:
       cmd.optsWithGlobals().json
     );
   });
+  decomposition.command("publish-run <decompositionId>").description(
+    "Publish an accepted decomposition's context pack on demand (POST /decompositions/{id}/publish-run)"
+  ).action(async (decompositionId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Publishing context pack", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/decompositions/{id}/publish-run", {
+        params: { path: { id: decompositionId } },
+        body: {}
+      });
+    });
+    emitAction(
+      `published ${style.bold(decompositionId)} \u2192 run ${style.bold(data.runRecordId)} (${data.outcome})`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
   decomposition.command("accept <decompositionId>").description(
     "Accept a Pending decomposition \u2014 promote + ratify its Tasks (POST /decompositions/{id}/accept)"
   ).action(async (decompositionId, _opts, cmd) => {
@@ -5759,7 +5811,7 @@ function registerTelemetry(program2) {
       );
   });
   telemetry.command("hook").description(
-    "Per-turn telemetry self-report for a Claude Code Stop hook (reads stdin; no-op unless bound). Fail-soft."
+    "Per-turn telemetry self-report for Claude Code hooks \u2014 Stop/SubagentStop \u2192 parsed + terminal, Notification/PermissionDenied \u2192 approval (reads stdin; no-op unless bound). Fail-soft."
   ).action(async (_opts, cmd) => {
     try {
       const raw = await readStdin2();
@@ -5768,21 +5820,10 @@ function registerTelemetry(program2) {
       const binding = findBinding(cwd);
       if (!binding) return process.exit(0);
       const usage = input.transcript_path ? parseTranscript(input.transcript_path) : null;
-      if (!usage) return process.exit(0);
+      const events = buildHookEvents(input, usage, binding.taskId);
+      if (events.length === 0) return process.exit(0);
       const cfg = resolveConfig(cmd.optsWithGlobals());
-      await postTelemetry(cfg, binding.decompositionId, [
-        {
-          taskId: binding.taskId,
-          kind: "Parsed",
-          tokensIn: usage.tokensIn,
-          tokensOut: usage.tokensOut,
-          contextUsed: usage.contextUsed,
-          contextWindow: usage.contextWindow,
-          text: null,
-          approvalState: null,
-          verdict: null
-        }
-      ]);
+      await postTelemetry(cfg, binding.decompositionId, events);
       return process.exit(0);
     } catch {
       return process.exit(0);
@@ -5810,7 +5851,12 @@ function registerTelemetry(program2) {
       scope,
       cwd
     });
-    const commands = { Stop: "sechroom telemetry hook" };
+    const commands = {
+      Stop: "sechroom telemetry hook",
+      SubagentStop: "sechroom telemetry hook",
+      Notification: "sechroom telemetry hook",
+      PermissionDenied: "sechroom telemetry hook"
+    };
     try {
       const multi = targets.length > 1;
       const results = targets.map((t) => {
@@ -5911,6 +5957,55 @@ function windowFor(model, contextUsed = 0) {
   if (m.includes("[1m]") || m.includes("-1m")) return 1e6;
   return contextUsed > 2e5 ? 1e6 : 2e5;
 }
+function buildHookEvents(input, usage, taskId) {
+  const events = [];
+  const base = (kind, over) => ({
+    taskId,
+    kind,
+    tokensIn: null,
+    tokensOut: null,
+    contextUsed: null,
+    contextWindow: null,
+    text: null,
+    approvalState: null,
+    verdict: null,
+    ...over
+  });
+  if (usage) {
+    events.push(
+      base("Parsed", {
+        tokensIn: usage.tokensIn,
+        tokensOut: usage.tokensOut,
+        contextUsed: usage.contextUsed,
+        contextWindow: usage.contextWindow
+      })
+    );
+  }
+  switch (input.hook_event_name) {
+    case "PermissionDenied":
+      events.push(
+        base("Approval", {
+          approvalState: "denied",
+          text: input.tool_name ?? input.message ?? null
+        })
+      );
+      break;
+    case "Notification":
+      if (isPermissionNotification(input))
+        events.push(base("Approval", { text: input.message ?? null }));
+      break;
+    case "Stop":
+    case "SubagentStop":
+      events.push(base("Terminal", { text: input.last_assistant_message ?? null }));
+      break;
+  }
+  return events;
+}
+function isPermissionNotification(input) {
+  const t = (input.notification_type ?? input.type ?? "").toLowerCase();
+  if (t) return t.includes("permission");
+  return (input.message ?? "").toLowerCase().includes("permission");
+}
 async function readStdin2() {
   if (process.stdin.isTTY) return "";
   const chunks = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.7.11",
+  "version": "2026.7.13",
   "description": "Sechroom CLI — a thin, generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.",
   "type": "module",
   "license": "UNLICENSED",
@@ -36,7 +36,8 @@
     "openapi-typescript": "^7.4.0",
     "tsup": "^8.3.0",
     "tsx": "^4.19.0",
-    "typescript": "^5.6.0"
+    "typescript": "^5.6.0",
+    "typescript-7": "npm:typescript@^7.0.2"
   },
   "scripts": {
     "gen": "openapi-typescript \"${SECHROOM_OPENAPI_URL:-https://app.sechroom.ai/api/openapi/v1.json}\" -o src/generated/api.d.ts",