@sechroom/cli 2026.7.14 → 2026.7.15-rc.dc284b75

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync12 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 import { Command } from "commander";
 
 // src/auth.ts
@@ -657,9 +657,14 @@ async function runApi(label, fn) {
   s.succeed();
   return res.data;
 }
-function fail(error) {
+function formatFailureMessage(error) {
   let msg;
-  if (typeof error === "object" && error !== null && "title" in error) {
+  if (error instanceof Error) {
+    msg = error.message || error.name;
+    if (error.cause instanceof Error && error.cause.message) {
+      msg += `: ${error.cause.message}`;
+    }
+  } else if (typeof error === "object" && error !== null && "title" in error) {
     const problem = error;
     msg = String(problem.title);
     if (problem.errors && typeof problem.errors === "object") {
@@ -674,6 +679,10 @@ ${detail.join("\n")}`;
   } else {
     msg = String(error);
   }
+  return msg;
+}
+function fail(error) {
+  const msg = formatFailureMessage(error);
   process.stderr.write(`error: ${msg}
 `);
   process.exit(1);
@@ -1140,7 +1149,10 @@ function resolveReferences(systemRows, personalRows, surface) {
 }
 
 // src/setup/skill-resolution-io.ts
-var AGENT_TARGET = { "claude-code": "claude-agent" };
+var AGENT_TARGET = {
+  "claude-code": "claude-agent",
+  "gpt-codex": "gpt-codex-agent"
+};
 function agentTargetFor(surface) {
   return AGENT_TARGET[surface] ?? `${surface}-agent`;
 }
@@ -1205,12 +1217,58 @@ function writeSkills(dir, skills, surface) {
   if (written.length) recordMaterialisedSkills(dir, DEFAULT_SKILLS_SLUG, written, { surface });
   return written;
 }
+function splitAgentFrontmatter(body) {
+  body = body.replaceAll("\r\n", "\n");
+  if (!body.startsWith("---\n")) return { instructions: body };
+  const end = body.indexOf("\n---\n", 4);
+  if (end < 0) return { instructions: body };
+  const frontmatter = body.slice(4, end);
+  const field = (key) => {
+    const line = frontmatter.split("\n").find((candidate) => candidate.startsWith(`${key}:`));
+    return line?.slice(key.length + 1).trim().replace(/^(["'])(.*)\1$/, "$2");
+  };
+  return { name: field("name"), description: field("description"), instructions: body.slice(end + 5).trimStart() };
+}
+function validateCodexSkills(skills) {
+  for (const skill of skills) {
+    const parsed = splitAgentFrontmatter(skill.body);
+    if (parsed.name !== skill.name || !parsed.description) {
+      throw new Error(
+        `Codex skill '${skill.name}' must begin with YAML frontmatter containing matching name and a description.`
+      );
+    }
+  }
+}
+var WORKER_NAMES = ["substrate-drafter", "substrate-miner", "substrate-verifier"];
+function validateCodexWorkerDependencies(skills, agents) {
+  const available = new Set(agents.map((agent) => agent.name));
+  const missing = WORKER_NAMES.filter(
+    (worker) => skills.some((skill) => skill.body.includes(worker)) && !available.has(worker)
+  );
+  if (missing.length) {
+    throw new Error(`Codex skills reference missing agent template(s): ${missing.join(", ")}.`);
+  }
+}
+function codexAgentToml(agent) {
+  const parsed = splitAgentFrontmatter(agent.body);
+  if (!parsed.description) {
+    throw new Error(`Codex agent '${agent.name}' requires a description in its leading YAML frontmatter.`);
+  }
+  return [
+    `name = ${JSON.stringify(parsed.name || agent.name)}`,
+    `description = ${JSON.stringify(parsed.description)}`,
+    `developer_instructions = ${JSON.stringify(parsed.instructions.trimEnd())}`,
+    ""
+  ].join("\n");
+}
 function writeAgents(dir, agents, surface) {
   if (agents.length) mkdirSync3(dir, { recursive: true });
   const written = [];
   for (const a of agents) {
-    const file = `${a.name}.md`;
-    writeFileSync3(join4(dir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
+    const codex = surface === CLIENT_SURFACE.codex;
+    const file = `${a.name}.${codex ? "toml" : "md"}`;
+    const body = codex ? codexAgentToml(a) : a.body.endsWith("\n") ? a.body : a.body + "\n";
+    writeFileSync3(join4(dir, file), body);
     written.push(file);
   }
   if (written.length) recordMaterialisedSkills(dir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -1239,7 +1297,7 @@ var AGENT_SPEC = {
   dir: agentsDir,
   resolve: resolveAgentSet,
   write: writeAgents,
-  supportsCodex: false
+  supportsCodex: true
 };
 function scopeOf(opts) {
   return opts.local ? "project" : resolveScope(opts.scope);
@@ -1315,6 +1373,10 @@ async function runInstall(spec, cmd, opts) {
   const rows = await fetchTemplateRows(cfg, personalWorkspaceId);
   const results = targets.map((t) => {
     const items = spec.resolve(rows, t.surface);
+    if (t.client === "codex" && spec.kind === "skill") {
+      validateCodexSkills(items);
+      validateCodexWorkerDependencies(items, resolveAgentSet(rows, t.surface));
+    }
     const refs = spec.kind === "skill" ? resolveReferenceSet(rows, t.surface) : [];
     const written = dryRun ? items.map((i) => i.name) : spec.write(t.dir, items, t.surface);
     const refsWritten = dryRun ? refs.map((r) => r.name) : writeReferencesIntoSkillDirs(t.dir, items, refs);
@@ -1440,22 +1502,24 @@ function registerAgents(program2) {
     `
 Examples:
   $ sechroom agents install                 materialise your installed agents to ~/.claude/agents
+	$ sechroom agents install --client codex  materialise native TOML agents to ~/.codex/agents
   $ sechroom agents install --scope project  write them to ./.claude/agents instead
   $ sechroom agents install --claude-config-dir ~/.claude-work   target another instance
   $ sechroom agents list                     what's materialised on disk
   $ sechroom agents clean                    remove the materialised agent files
 
-Agents are resolved from the agent target (target:claude-agent), the dispatchable
-workers your loop skills call (e.g. find-prior-art \u2192 substrate-miner).`
+Agents are resolved from the client's agent target (target:claude-agent or
+target:gpt-codex-agent), the dispatchable workers your loop skills call
+(e.g. find-prior-art \u2192 substrate-miner).`
   );
-  agents.command("install").description("Materialise your installed subagents to disk (the already-installed bundle \u2014 no server install)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--dry-run", "print what would be written; write nothing").option("--json", "machine output").action((opts, cmd) => runInstall(AGENT_SPEC, cmd, opts));
-  agents.command("list").description("List the subagents materialised on disk (per resolved config dir)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").action((opts, cmd) => runList(AGENT_SPEC, cmd, opts));
-  agents.command("clean [slug]").description(`Remove subagent files materialised to disk (default ${DEFAULT_SKILLS_SLUG})`).option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").action((slugArg, opts, cmd) => runClean(AGENT_SPEC, cmd, opts, slugArg));
+  agents.command("install").description("Materialise your installed subagents to disk (the already-installed bundle \u2014 no server install)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--dry-run", "print what would be written; write nothing").option("--client <client>", "claude, codex, or all").option("--json", "machine output").action((opts, cmd) => runInstall(AGENT_SPEC, cmd, opts));
+  agents.command("list").description("List the subagents materialised on disk (per resolved config dir)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").option("--client <client>", "claude, codex, or all").action((opts, cmd) => runList(AGENT_SPEC, cmd, opts));
+  agents.command("clean [slug]").description(`Remove subagent files materialised to disk (default ${DEFAULT_SKILLS_SLUG})`).option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").option("--client <client>", "claude, codex, or all").action((slugArg, opts, cmd) => runClean(AGENT_SPEC, cmd, opts, slugArg));
 }
 
 // src/commands/channel.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname4, join as join7 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname6, join as join9 } from "path";
 import {
   HttpTransportType,
   HubConnectionBuilder
@@ -1463,52 +1527,218 @@ import {
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
+// src/commands/executor.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname5, join as join8 } from "path";
+
+// src/sem.ts
+import { dirname as dirname2, join as join5 } from "path";
+import { appendFileSync, existsSync as existsSync4, mkdirSync as mkdirSync4, readdirSync, readFileSync as readFileSync3, statSync, writeFileSync as writeFileSync4 } from "fs";
+var SEM_FILE = join5(".sechroom", "lane.json");
+var STATE_DIR_NAME2 = ".sechroom";
+function localSemPath(cwd = process.cwd()) {
+  return join5(cwd, SEM_FILE);
+}
+function resolveSemPathForRead(start = process.cwd()) {
+  let dir = start;
+  while (true) {
+    const candidate = join5(dir, SEM_FILE);
+    if (existsSync4(candidate)) return candidate;
+    const parent = dirname2(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function applyWorktreeLaneSuffix(lane, start = process.cwd()) {
+  try {
+    let dir = start;
+    let gitPath;
+    for (; ; ) {
+      const candidate = join5(dir, ".git");
+      if (existsSync4(candidate)) {
+        gitPath = candidate;
+        break;
+      }
+      const parent = dirname2(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+    if (!gitPath || statSync(gitPath).isDirectory()) return lane;
+    const gitFile = readFileSync3(gitPath, "utf8");
+    const common = gitFile.trim().match(/^gitdir:\s*(.+)\/worktrees\/[^/\s]+\s*$/);
+    if (!common) return lane;
+    const worktreesDir = join5(common[1], "worktrees");
+    const siblings = readdirSync(worktreesDir).filter((n) => {
+      try {
+        return statSync(join5(worktreesDir, n)).isDirectory();
+      } catch {
+        return false;
+      }
+    });
+    return laneWithWorktreeSuffix(lane, gitFile, siblings);
+  } catch {
+    return lane;
+  }
+}
+function laneWithWorktreeSuffix(lane, gitFile, siblings) {
+  const m = gitFile.trim().match(/\/worktrees\/([^/\s]+)\s*$/);
+  if (!m) return lane;
+  const idx = [...siblings].sort().indexOf(m[1]);
+  return idx < 0 ? lane : `${lane}-${idx + 2}`;
+}
+function serializeSem(values) {
+  return JSON.stringify(values, null, 2) + "\n";
+}
+function readSem(path) {
+  const p = path ?? resolveSemPathForRead();
+  if (!p || !existsSync4(p)) return void 0;
+  return { path: p, values: parseLaneJson(readFileSync3(p, "utf8")) };
+}
+function readLocalSemValues(cwd = process.cwd()) {
+  const next = join5(cwd, SEM_FILE);
+  if (existsSync4(next)) return readSem(next)?.values ?? {};
+  return {};
+}
+function parseLaneJson(text2) {
+  try {
+    const parsed = JSON.parse(text2);
+    const out = {};
+    for (const [k, v] of Object.entries(parsed)) {
+      if (typeof v === "string") out[k] = v;
+    }
+    return out;
+  } catch {
+    return {};
+  }
+}
+var STATE_DIR_IGNORE = `${STATE_DIR_NAME2}/`;
+function writeSem(values, path = localSemPath()) {
+  mkdirSync4(dirname2(path), { recursive: true });
+  writeFileSync4(path, serializeSem(values));
+  ensureSemIgnored(path);
+  ensureContinuityScaffold(path);
+  return path;
+}
+function ensureStateDirIgnored(cwd = process.cwd()) {
+  ensureSemIgnored(localSemPath(cwd));
+}
+var CONTINUITY_FILE_NAME = "continuity.json";
+var CONTINUITY_SCAFFOLD = JSON.stringify(
+  {
+    _readme: "Agent-maintained continuity intent. Keep these current during the session; `sechroom checkpoint` and the PreCompact hook snapshot from here. The five required fields (objective, state, lastAction, nextAction, resumeInstruction) must all be non-empty for a snapshot to be created.",
+    objective: "",
+    state: "",
+    lastAction: "",
+    nextAction: "",
+    resumeInstruction: "",
+    constraints: [],
+    questions: [],
+    artifacts: [],
+    confidence: null
+  },
+  null,
+  2
+) + "\n";
+function ensureContinuityScaffold(semPath) {
+  try {
+    const target = join5(dirname2(semPath), CONTINUITY_FILE_NAME);
+    if (existsSync4(target)) return;
+    writeFileSync4(target, CONTINUITY_SCAFFOLD);
+  } catch {
+  }
+}
+function ignoresSem(content) {
+  return content.split("\n").some((line) => {
+    const t = line.trim();
+    return t === STATE_DIR_NAME2 || t === STATE_DIR_IGNORE || t === `/${STATE_DIR_NAME2}` || t === `/${STATE_DIR_IGNORE}` || t === `**/${STATE_DIR_NAME2}` || t === `**/${STATE_DIR_IGNORE}`;
+  });
+}
+function inGitRepo(startDir) {
+  let dir = startDir;
+  for (; ; ) {
+    if (existsSync4(join5(dir, ".git"))) return true;
+    const parent = dirname2(dir);
+    if (parent === dir) return false;
+    dir = parent;
+  }
+}
+function resolveGitignoreTarget(startDir) {
+  let dir = startDir;
+  for (; ; ) {
+    const gi = join5(dir, ".gitignore");
+    if (existsSync4(gi)) return { path: gi, exists: true };
+    const parent = dirname2(dir);
+    if (existsSync4(join5(dir, ".git")) || parent === dir) {
+      return { path: join5(startDir, ".gitignore"), exists: false };
+    }
+    dir = parent;
+  }
+}
+function ensureSemIgnored(semPath) {
+  try {
+    const checkoutDir = dirname2(dirname2(semPath));
+    if (!inGitRepo(checkoutDir)) return;
+    const target = resolveGitignoreTarget(checkoutDir);
+    if (target.exists) {
+      const content = readFileSync3(target.path, "utf8");
+      if (ignoresSem(content)) return;
+      const sep = content.length === 0 || content.endsWith("\n") ? "" : "\n";
+      appendFileSync(target.path, `${sep}${STATE_DIR_IGNORE}
+`);
+    } else {
+      writeFileSync4(target.path, `${STATE_DIR_IGNORE}
+`);
+    }
+  } catch {
+  }
+}
+
 // src/commands/hook-install.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
-import { delimiter, dirname as dirname3, join as join6 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
+import { delimiter, dirname as dirname4, join as join7 } from "path";
 
 // src/setup/clients.ts
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync5 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname2, join as join5 } from "path";
+import { dirname as dirname3, join as join6 } from "path";
 function claudeDesktopConfigPath(home) {
   switch (process.platform) {
     case "darwin":
-      return join5(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+      return join6(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
     case "win32":
-      return join5(process.env.APPDATA ?? join5(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
+      return join6(process.env.APPDATA ?? join6(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
     default:
-      return join5(home, ".config", "Claude", "claude_desktop_config.json");
+      return join6(home, ".config", "Claude", "claude_desktop_config.json");
   }
 }
 function clientTargets(cwd, opts = {}) {
   const home = homedir3();
-  const claudeDir = opts.claudeDir ?? join5(home, ".claude");
-  const codexHome = opts.codexHome ?? join5(home, ".codex");
+  const claudeDir = opts.claudeDir ?? join6(home, ".claude");
+  const codexHome = opts.codexHome ?? join6(home, ".codex");
   return {
     "claude-code": {
       key: "claude-code",
       label: "Claude Code",
-      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join5(cwd, ".mcp.json"), format: "json" },
-      instruction: { surfaceKey: "claude-code", path: join5(cwd, "CLAUDE.md") }
+      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join6(cwd, ".mcp.json"), format: "json" },
+      instruction: { surfaceKey: "claude-code", path: join6(cwd, "CLAUDE.md") }
     },
     "claude-desktop": {
       key: "claude-desktop",
       label: "Claude Desktop",
       mcp: { surfaceKey: "claude-desktop", sectionType: SectionType.McpConfig, path: claudeDesktopConfigPath(home), format: "json" },
-      instruction: { surfaceKey: "claude-desktop", path: join5(claudeDir, "CLAUDE.md") }
+      instruction: { surfaceKey: "claude-desktop", path: join6(claudeDir, "CLAUDE.md") }
     },
     codex: {
       key: "codex",
       label: "Codex CLI",
-      mcp: { surfaceKey: "chatgpt", sectionType: SectionType.McpConfigToml, path: join5(codexHome, "config.toml"), format: "toml" },
-      instruction: { surfaceKey: "chatgpt", path: join5(cwd, "AGENTS.md") }
+      mcp: { surfaceKey: "chatgpt", sectionType: SectionType.McpConfigToml, path: join6(codexHome, "config.toml"), format: "toml" },
+      instruction: { surfaceKey: "chatgpt", path: join6(cwd, "AGENTS.md") }
     },
     cursor: {
       key: "cursor",
       label: "Cursor",
-      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join5(cwd, ".cursor", "mcp.json"), format: "json" },
-      instruction: { surfaceKey: "chatgpt", path: join5(cwd, "AGENTS.md") }
+      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join6(cwd, ".cursor", "mcp.json"), format: "json" },
+      instruction: { surfaceKey: "chatgpt", path: join6(cwd, "AGENTS.md") }
     },
     antigravity: {
       key: "antigravity",
@@ -1519,8 +1749,8 @@ function clientTargets(cwd, opts = {}) {
       // `type` — comes from the `antigravity` server surface, so we don't
       // hardcode it here. Instructions go in the project `AGENTS.md`
       // (cross-tool, shared with Codex/Cursor).
-      mcp: { surfaceKey: "antigravity", sectionType: SectionType.McpConfig, path: join5(home, ".gemini", "config", "mcp_config.json"), format: "json" },
-      instruction: { surfaceKey: "antigravity", path: join5(cwd, "AGENTS.md") }
+      mcp: { surfaceKey: "antigravity", sectionType: SectionType.McpConfig, path: join6(home, ".gemini", "config", "mcp_config.json"), format: "json" },
+      instruction: { surfaceKey: "antigravity", path: join6(cwd, "AGENTS.md") }
     }
   };
 }
@@ -1529,11 +1759,11 @@ var DEFAULT_CLIENT_KEY = "claude-code";
 function detectInstalledClients(cwd) {
   const home = homedir3();
   const detected = [];
-  if (resolveClaudeTargets({}).some((t) => existsSync4(t.dir))) detected.push("claude-code");
-  if (existsSync4(dirname2(claudeDesktopConfigPath(home)))) detected.push("claude-desktop");
-  if (resolveCodexHomes({}).some((d) => existsSync4(d))) detected.push("codex");
-  if (existsSync4(join5(home, ".cursor")) || existsSync4(join5(cwd, ".cursor"))) detected.push("cursor");
-  if (existsSync4(join5(home, ".gemini"))) detected.push("antigravity");
+  if (resolveClaudeTargets({}).some((t) => existsSync5(t.dir))) detected.push("claude-code");
+  if (existsSync5(dirname3(claudeDesktopConfigPath(home)))) detected.push("claude-desktop");
+  if (resolveCodexHomes({}).some((d) => existsSync5(d))) detected.push("codex");
+  if (existsSync5(join6(home, ".cursor")) || existsSync5(join6(cwd, ".cursor"))) detected.push("cursor");
+  if (existsSync5(join6(home, ".gemini"))) detected.push("antigravity");
   return detected;
 }
 
@@ -1576,24 +1806,30 @@ function mergeHooks(config2, commands) {
   return added;
 }
 function readJsonConfig2(path) {
-  if (!existsSync5(path)) return {};
-  const raw = readFileSync3(path, "utf8");
+  if (!existsSync6(path)) return {};
+  const raw = readFileSync4(path, "utf8");
   if (!raw.trim()) return {};
   return JSON.parse(raw);
 }
 function installHooksJson(path, commands, dryRun) {
-  const existed = existsSync5(path) && readFileSync3(path, "utf8").trim().length > 0;
+  const existed = existsSync6(path) && readFileSync4(path, "utf8").trim().length > 0;
   const config2 = readJsonConfig2(path);
   const added = mergeHooks(config2, commands);
   if (added === 0 && existed) return { path, status: "current" };
   if (!dryRun) {
-    mkdirSync4(dirname3(path), { recursive: true });
-    writeFileSync4(path, JSON.stringify(config2, null, 2) + "\n");
+    mkdirSync5(dirname4(path), { recursive: true });
+    writeFileSync5(path, JSON.stringify(config2, null, 2) + "\n");
   }
   return { path, status: existed ? "merged" : "created" };
 }
 function installClaudeCommands(claudeDir, commands, dryRun) {
-  return installHooksJson(join6(claudeDir, "settings.json"), commands, dryRun);
+  return installHooksJson(join7(claudeDir, "settings.json"), commands, dryRun);
+}
+function installCodexCommands(codexHome, commands, dryRun) {
+  return [
+    installHooksJson(join7(codexHome, "hooks.json"), commands, dryRun),
+    installCodexFeatureFlag(join7(codexHome, "config.toml"), dryRun)
+  ];
 }
 function ensureCodexFeaturesHooks(content) {
   const lines = content.split("\n");
@@ -1616,13 +1852,13 @@ function ensureCodexFeaturesHooks(content) {
   return { next: lines.join("\n"), changed: true };
 }
 function installCodexFeatureFlag(path, dryRun) {
-  const existed = existsSync5(path);
-  const content = existed ? readFileSync3(path, "utf8") : "";
+  const existed = existsSync6(path);
+  const content = existed ? readFileSync4(path, "utf8") : "";
   const { next, changed } = ensureCodexFeaturesHooks(content);
   if (!changed) return { path, status: "current" };
   if (!dryRun) {
-    mkdirSync4(dirname3(path), { recursive: true });
-    writeFileSync4(path, next);
+    mkdirSync5(dirname4(path), { recursive: true });
+    writeFileSync5(path, next);
   }
   return { path, status: existed ? "merged" : "created" };
 }
@@ -1647,11 +1883,11 @@ function installHookSurfaces(surfaces, opts) {
   const out = [];
   for (const surface of surfaces) {
     if (surface === "claude") {
-      const path = join6(opts.claudeDir, "settings.json");
+      const path = join7(opts.claudeDir, "settings.json");
       out.push({ surface, results: [installHooksJson(path, CLAUDE_HOOK_COMMANDS, opts.dryRun)] });
     } else {
-      const hooksJson = installHooksJson(join6(opts.codexHome, "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
-      const featureFlag = installCodexFeatureFlag(join6(opts.codexHome, "config.toml"), opts.dryRun);
+      const hooksJson = installHooksJson(join7(opts.codexHome, "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
+      const featureFlag = installCodexFeatureFlag(join7(opts.codexHome, "config.toml"), opts.dryRun);
       out.push({ surface, results: [hooksJson, featureFlag] });
     }
   }
@@ -1671,7 +1907,7 @@ function isSechroomOnPath() {
   for (const dir of pathEnv.split(delimiter)) {
     if (!dir) continue;
     for (const name of names) {
-      if (existsSync5(join6(dir, name))) return true;
+      if (existsSync6(join7(dir, name))) return true;
     }
   }
   return false;
@@ -1684,119 +1920,593 @@ function warnIfSechroomNotOnPath(write = (s) => void process.stderr.write(s)) {
   return true;
 }
 
-// src/commands/channel.ts
-function registerChannel(program2) {
-  const channel = program2.command("channel").description(
-    "Receive matched substrate events over the held SignalR push leg (D-WLP-9)"
+// src/commands/executor.ts
+function executorSubscriptionInput(name) {
+  return {
+    name,
+    enabled: true,
+    filter: { tags: ["kind:task"], workspaceScope: [] }
+  };
+}
+function executorRegistrationInput(state, deliverySubscriptionId) {
+  return {
+    relayId: state.relayId,
+    instanceKey: state.instanceKey,
+    laneId: state.laneId ?? state.instanceKey,
+    runtimeKind: parseRuntimeKind(state.runtime),
+    activationMode: "Attached",
+    deliverySubscriptionId,
+    connectorId: state.connectorId,
+    claimedCapabilityKeys: state.capabilityKeys,
+    toolSetRef: null,
+    ttlSeconds: state.ttlSeconds
+  };
+}
+var EXECUTOR_STATE = "executor.json";
+var EXECUTOR_PULSE_COMMAND = "sechroom executor hook-pulse";
+var EXECUTOR_STOP_COMMAND = "sechroom executor hook-stop";
+var CLAUDE_EXECUTOR_HOOKS = {
+  SessionStart: EXECUTOR_PULSE_COMMAND,
+  UserPromptSubmit: EXECUTOR_PULSE_COMMAND,
+  PreToolUse: EXECUTOR_PULSE_COMMAND,
+  Stop: EXECUTOR_PULSE_COMMAND,
+  SessionEnd: EXECUTOR_STOP_COMMAND
+};
+var CODEX_EXECUTOR_HOOKS = {
+  SessionStart: EXECUTOR_PULSE_COMMAND,
+  UserPromptSubmit: EXECUTOR_PULSE_COMMAND,
+  PreToolUse: EXECUTOR_PULSE_COMMAND,
+  Stop: EXECUTOR_PULSE_COMMAND
+};
+function registerExecutor(program2) {
+  const executor = program2.command("executor").description(
+    "Register and operate a local Claude Code/Codex executor advertisement"
   );
-  const withFilterOpts = (c) => c.option(
-    "--name <name>",
-    "Subscription name (idempotent per name)",
-    "wlp-dispatch"
+  executor.command("install").description(
+    "Configure this checkout's harness to advertise itself as a WLP executor"
+  ).option("--connector <id>", "Approved local-session ConnectorDefinition id").option(
+    "--instance-key <key>",
+    "Stable executor identity (defaults to .sechroom/lane.json code-lane)"
   ).option(
-    "--tag <tag...>",
-    "Tag(s) the event must carry to match (repeatable). Default targets WLP task dispatches.",
-    ["kind:task"]
-  ).option("--workspace <wsp...>", "Restrict to these workspace id(s)").option(
-    "--executor-instance <id>",
-    "Join the exact executor-instance SignalR group"
-  );
-  withFilterOpts(
-    channel.command("connect").description(
-      "Register a SignalR subscription and stream matched events to stdout"
-    )
-  ).action(async (opts, cmd) => {
-    const json = Boolean(cmd.optsWithGlobals().json);
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    const filter = readFilter(opts);
-    const sub = await ensureSubscription(cfg, opts.name, filter);
-    const seen = /* @__PURE__ */ new Set();
-    const deliver = makeDeliver(
-      filter,
-      seen,
-      (payload) => process.stdout.write(
-        (typeof payload === "string" ? payload : JSON.stringify(payload)) + "\n"
-      )
-    );
-    const conn = await openConnection(cfg, deliver, opts.executorInstance);
-    await reconcile(cfg, filter, deliver);
-    if (json) {
-      emit(
-        {
-          connected: true,
-          tenant: cfg.tenant,
-          subscriptionId: sub.id ?? opts.name,
-          filter
-        },
-        true
+    "--lane-id <lane>",
+    "Canonical affinity lane (defaults to .sechroom/lane.json code-lane)"
+  ).option("--runtime <kind>", "claude-code | codex").option("--surface <surface>", "claude | codex").option(
+    "--capability <key...>",
+    "Capability operation keys claimed by this instance"
+  ).option(
+    "--relay <id>",
+    "Relay identity shared by sibling instances",
+    "sechroom-cli-local"
+  ).option(
+    "--subscription-name <name>",
+    "SignalR delivery binding name",
+    "executor-dispatch"
+  ).option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 600).option(
+    "--refresh-after <seconds>",
+    "Minimum age before a hook refreshes",
+    parseInteger,
+    40
+  ).option(
+    "-y, --yes",
+    "Non-interactive: accept detected surface and lane defaults",
+    false
+  ).option("--dry-run", "Show hook files without writing", false).action(async (opts, cmd) => {
+    const globals = cmd.optsWithGlobals();
+    const lane = readSem()?.values["code-lane"];
+    const detected = detectHookSurfaces(process.cwd());
+    let surface = opts.surface;
+    let instanceKey = opts.instanceKey;
+    let runtime = opts.runtime;
+    let laneId = opts.laneId;
+    let connector = opts.connector;
+    let capabilities = opts.capability;
+    const surfaceDefault = detected.length === 1 ? detected[0] : lane?.includes("codex") ? "codex" : "claude";
+    if (!opts.yes && canPrompt()) {
+      surface = await promptText(
+        "Harness surface (claude or codex)?",
+        surface ?? surfaceDefault
       );
-    } else {
-      process.stderr.write(
-        style.green("channel connected") + style.dim(
-          ` \u2014 tenant ${cfg.tenant}, sub ${sub.id ?? opts.name}, tags [${filter.tags.join(", ")}]
-`
-        ) + style.dim("streaming matched events to stdout; Ctrl-C to stop.\n")
+      instanceKey = await promptText(
+        "Executor instance key?",
+        instanceKey ?? lane ?? ""
       );
+      laneId = await promptText(
+        "Executor affinity lane?",
+        laneId ?? lane ?? ""
+      );
+      runtime = await promptText(
+        "Runtime (claude-code or codex)?",
+        runtime ?? (surface === "codex" ? "codex" : "claude-code")
+      );
+      connector = await promptText(
+        "Approved local-session connector id?",
+        connector ?? ""
+      );
+      const capabilityText = await promptText(
+        "Capability keys (comma-separated; blank for none)?",
+        capabilities?.join(",") ?? ""
+      );
+      capabilities = capabilityText.split(",").map((x) => x.trim()).filter(Boolean);
     }
-    await holdOpen(conn);
-  });
-  withFilterOpts(
-    channel.command("mcp").description(
-      "Run as a Claude Code channel (local-stdio MCP server) \u2014 push matched events into the session"
-    )
-  ).action(async (opts, cmd) => {
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    const filter = readFilter(opts);
-    const mcp = new Server(
-      { name: "sechroom", version: "0.1.0" },
-      {
-        capabilities: { experimental: { "claude/channel": {} } },
-        instructions: 'Matched Sechroom substrate events arrive as <channel source="sechroom"> tags. A WLP dispatch (kind:task \u2192 status:in-progress) means a task is runnable now: load the memory id from the event, do the work, then write a closeout memory tagged wlp-decomposition:{id} + wlp-task:{taskId} + verdict:{pass|soft-fail|plan-invalid|blocked}.'
-      }
-    );
-    await mcp.connect(new StdioServerTransport());
-    await ensureSubscription(cfg, opts.name, filter);
-    const seen = /* @__PURE__ */ new Set();
-    const deliver = makeDeliver(filter, seen, (payload) => {
-      const { content, meta } = summarizeEvent(payload);
-      void mcp.notification({
-        method: "notifications/claude/channel",
-        params: { content, meta }
-      }).catch(
-        (e) => process.stderr.write(err(`channel push failed: ${String(e)}
-`))
+    surface ??= surfaceDefault;
+    instanceKey ??= lane;
+    laneId ??= lane;
+    runtime ??= surface === "codex" ? "codex" : "claude-code";
+    if (!connector)
+      fail(
+        "executor install requires --connector (or an interactive connector id)"
       );
-    });
-    const conn = await openConnection(cfg, deliver, opts.executorInstance);
-    await reconcile(cfg, filter, deliver);
+    if (!instanceKey)
+      fail(
+        "no instance key resolved; pass --instance-key or pin .sechroom/lane.json code-lane"
+      );
+    if (!opts.yes && !canPrompt())
+      fail("non-interactive executor install requires --yes");
+    parseRuntimeKind(runtime);
+    if (!["claude", "codex"].includes(surface))
+      fail("surface must be claude or codex");
+    if (opts.refreshAfter >= opts.ttl)
+      fail("refresh-after must be shorter than the TTL");
+    const sem = readSem();
+    const checkout = sem ? dirname5(dirname5(sem.path)) : process.cwd();
+    const statePath = join8(checkout, ".sechroom", EXECUTOR_STATE);
+    const state = {
+      schemaVersion: 1,
+      instanceKey,
+      laneId,
+      runtime: runtime.toLowerCase() === "codex" ? "codex" : "claude-code",
+      connectorId: connector,
+      capabilityKeys: capabilities ?? [],
+      relayId: opts.relay,
+      subscriptionName: opts.subscriptionName,
+      ttlSeconds: opts.ttl,
+      refreshAfterSeconds: opts.refreshAfter
+    };
+    if (!opts.dryRun) {
+      mkdirSync6(dirname5(statePath), { recursive: true });
+      writeFileSync6(statePath, JSON.stringify(state, null, 2) + "\n");
+      ensureStateDirIgnored(checkout);
+    }
+    const configuredClaudeDirs = globals.claudeConfigDir || process.env.CLAUDE_CONFIG_DIR ? resolveClaudeTargets({ override: globals.claudeConfigDir }).map(
+      (target) => target.dir
+    ) : [join8(checkout, ".claude")];
+    const configuredCodexHomes = globals.codexHome || process.env.CODEX_HOME ? resolveCodexHomes({ override: globals.codexHome }) : [join8(checkout, ".codex")];
+    const hookTargets = surface === "claude" ? configuredClaudeDirs : configuredCodexHomes;
+    for (const target of hookTargets) {
+      const results = surface === "claude" ? [
+        installClaudeCommands(
+          target,
+          CLAUDE_EXECUTOR_HOOKS,
+          opts.dryRun
+        )
+      ] : installCodexCommands(target, CODEX_EXECUTOR_HOOKS, opts.dryRun);
+      for (const result of results)
+        process.stderr.write(describe(result, opts.dryRun) + "\n");
+    }
+    warnIfSechroomNotOnPath();
     process.stderr.write(
-      style.dim(
-        `sechroom channel (mcp) \u2014 tenant ${cfg.tenant}, tags [${filter.tags.join(", ")}]
-`
-      )
+      style.green("executor harness configured") + style.dim(` \u2014 ${instanceKey}
+`)
     );
-    await holdOpen(conn);
   });
-  channel.command("install").description(
-    "Wire `sechroom channel mcp` into the project .mcp.json as a Claude Code channel MCP server (idempotent)"
+  executor.command("hook-pulse").description("Hook adapter: register or refresh this checkout's executor").action(async (_opts, cmd) => {
+    await drainStdin();
+    const located = readExecutorState();
+    if (!located) return;
+    const { state, path } = located;
+    const age = state.lastRefreshAt ? Date.now() - Date.parse(state.lastRefreshAt) : Number.POSITIVE_INFINITY;
+    if (state.instanceId && age < state.refreshAfterSeconds * 1e3) return;
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    try {
+      await ensureExecutorInstance(cfg, { state, path });
+    } catch {
+    }
+  });
+  executor.command("hook-stop").description("Hook adapter: deregister this checkout's executor").action(async (_opts, cmd) => {
+    await drainStdin();
+    const located = readExecutorState();
+    if (!located?.state.instanceId) return;
+    try {
+      await api(
+        resolveConfig(cmd.optsWithGlobals()),
+        `/me/executor-instances/${encodeURIComponent(located.state.instanceId)}`,
+        { method: "DELETE", body: JSON.stringify({}) }
+      );
+      delete located.state.instanceId;
+      delete located.state.lastRefreshAt;
+      writeFileSync6(
+        located.path,
+        JSON.stringify(located.state, null, 2) + "\n"
+      );
+    } catch {
+    }
+  });
+  executor.command("submit-connector").description(
+    "Submit a local-session connector definition for governed approval"
+  ).requiredOption("--slug <slug>", "Unique connector definition slug").requiredOption("--display-name <name>", "Human-readable connector name").requiredOption("--transport <kind>", "push | pull").option("--profile <profile...>", "Advertised runtime profiles", [
+    "base",
+    "dotnet-10"
+  ]).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await api(cfg, "/connectors/definitions", {
+      method: "POST",
+      body: JSON.stringify({
+        slug: opts.slug,
+        displayName: opts.displayName,
+        runtimeProfiles: opts.profile,
+        connectorKind: "ExecutionRuntime",
+        providerKind: "local-session",
+        dispatchTransport: parseTransport(opts.transport)
+      })
+    });
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+    if (!cmd.optsWithGlobals().json) {
+      process.stderr.write(
+        style.dim(
+          "approve this connector definition before registering executors\n"
+        )
+      );
+    }
+  });
+  executor.command("register").description(
+    "Create/reuse a SignalR binding and register this local executor instance"
+  ).requiredOption(
+    "--instance-key <key>",
+    "Stable key for this concrete session/lane"
+  ).requiredOption(
+    "--connector <id>",
+    "Approved local-session ConnectorDefinition id"
+  ).option("--runtime <kind>", "claude-code | codex", "claude-code").option(
+    "--lane-id <lane>",
+    "Canonical affinity lane (defaults to instance key)"
+  ).option(
+    "--relay <id>",
+    "Relay identity shared by sibling instances",
+    "sechroom-cli-local"
+  ).option(
+    "--subscription-name <name>",
+    "SignalR delivery binding name",
+    "executor-dispatch"
+  ).option(
+    "--capability <key...>",
+    "Capability operation keys claimed by this instance"
+  ).option("--tool-set-ref <ref>", "Optional governed tool-set reference").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const subscription = await api(
+      cfg,
+      "/me/delivery-subscriptions/signalr",
+      {
+        method: "POST",
+        body: JSON.stringify({
+          name: opts.subscriptionName,
+          enabled: true,
+          // Exact executor fanout ignores this generic filter; the fixed tag only
+          // satisfies the legacy SignalR subscription shape.
+          filter: { tags: ["kind:task"], workspaceScope: [] }
+        })
+      }
+    );
+    const data = await api(
+      cfg,
+      "/me/executor-instances",
+      {
+        method: "POST",
+        body: JSON.stringify({
+          relayId: opts.relay,
+          instanceKey: opts.instanceKey,
+          laneId: opts.laneId ?? opts.instanceKey,
+          runtimeKind: parseRuntimeKind(opts.runtime),
+          activationMode: "Attached",
+          deliverySubscriptionId: subscription.id,
+          connectorId: opts.connector,
+          claimedCapabilityKeys: opts.capability ?? [],
+          toolSetRef: opts.toolSetRef ?? null,
+          ttlSeconds: opts.ttl
+        })
+      }
+    );
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+    if (!cmd.optsWithGlobals().json)
+      process.stderr.write(
+        style.dim(`refresh with: sechroom executor heartbeat ${data.id}
+`)
+      );
+  });
+  executor.command("refresh <id>").description("Refresh one advertisement lease once").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).action(async (id, opts, cmd) => {
+    const data = await refreshExecutorInstance(
+      resolveConfig(cmd.optsWithGlobals()),
+      id,
+      opts.ttl
+    );
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+  });
+  executor.command("heartbeat <id>").description("Keep an advertisement alive until interrupted").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).option("--interval <seconds>", "Refresh interval", parseInteger, 40).action(async (id, opts, cmd) => {
+    if (opts.interval >= opts.ttl)
+      fail("heartbeat interval must be shorter than the TTL");
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    await refreshExecutorInstance(cfg, id, opts.ttl);
+    process.stderr.write(
+      style.green("executor heartbeat active") + style.dim(` \u2014 ${id}
+`)
+    );
+    await holdHeartbeat(async () => {
+      await refreshExecutorInstance(cfg, id, opts.ttl);
+    }, opts.interval * 1e3);
+  });
+  executor.command("offers <id>").description("List live dispatch offers addressed to this exact instance").action(async (id, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await api(
+      cfg,
+      `/me/executor-instances/${encodeURIComponent(id)}/dispatch-offers`
+    );
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+  });
+  executor.command("deregister <id>").description("Stop advertising this executor instance").action(async (id, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await api(
+      cfg,
+      `/me/executor-instances/${encodeURIComponent(id)}`,
+      {
+        method: "DELETE",
+        body: JSON.stringify({})
+      }
+    );
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+  });
+}
+function parseRuntimeKind(value) {
+  switch (value.trim().toLowerCase()) {
+    case "claude":
+    case "claude-code":
+      return "ClaudeCode";
+    case "codex":
+      return "Codex";
+    default:
+      return fail("runtime must be claude-code or codex");
+  }
+}
+function parseTransport(value) {
+  switch (value.trim().toLowerCase()) {
+    case "push":
+      return "Push";
+    case "pull":
+      return "Pull";
+    default:
+      return fail("transport must be push or pull");
+  }
+}
+async function refreshExecutorInstance(cfg, id, ttlSeconds) {
+  return api(
+    cfg,
+    `/me/executor-instances/${encodeURIComponent(id)}/refresh`,
+    {
+      method: "POST",
+      body: JSON.stringify({ ttlSeconds })
+    }
+  );
+}
+async function registerInstance(cfg, state) {
+  const subscription = await api(
+    cfg,
+    "/me/delivery-subscriptions/signalr",
+    {
+      method: "POST",
+      body: JSON.stringify(executorSubscriptionInput(state.subscriptionName))
+    }
+  );
+  return api(cfg, "/me/executor-instances", {
+    method: "POST",
+    body: JSON.stringify(executorRegistrationInput(state, subscription.id))
+  });
+}
+async function ensureExecutorInstance(cfg, located) {
+  const { state, path } = located;
+  state.laneId ??= state.instanceKey;
+  const data = await registerInstance(cfg, state);
+  state.instanceId = data.id;
+  state.lastRefreshAt = (/* @__PURE__ */ new Date()).toISOString();
+  writeFileSync6(path, JSON.stringify(state, null, 2) + "\n");
+  return data;
+}
+function readExecutorState(start = process.cwd()) {
+  const semPath = resolveSemPathForRead(start);
+  const sem = semPath ? readSem(semPath) : void 0;
+  const path = join8(
+    sem ? dirname5(sem.path) : join8(start, ".sechroom"),
+    EXECUTOR_STATE
+  );
+  if (!existsSync7(path)) return void 0;
+  return {
+    state: JSON.parse(readFileSync5(path, "utf8")),
+    path
+  };
+}
+async function drainStdin() {
+  if (process.stdin.isTTY) return;
+  for await (const _chunk of process.stdin) {
+  }
+}
+async function api(cfg, path, init) {
+  const token = await requireToken(cfg);
+  const response = await fetch(`${cfg.baseUrl}${path}`, {
+    ...init,
+    headers: {
+      authorization: `Bearer ${token}`,
+      tenant: cfg.tenant,
+      "content-type": "application/json",
+      "x-sechroom-surface": "cli"
+    }
+  });
+  if (!response.ok)
+    fail(
+      `${init?.method ?? "GET"} ${path} failed (${response.status}): ${await response.text()}`
+    );
+  return response.json();
+}
+function parseInteger(value) {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isFinite(parsed)) fail(`expected an integer, got '${value}'`);
+  return parsed;
+}
+function holdHeartbeat(tick, intervalMs) {
+  return new Promise((resolve3, reject) => {
+    const timer = setInterval(() => void tick().catch(reject), intervalMs);
+    const stop = () => {
+      clearInterval(timer);
+      resolve3();
+    };
+    process.once("SIGINT", stop);
+    process.once("SIGTERM", stop);
+  });
+}
+
+// src/commands/channel.ts
+function registerChannel(program2) {
+  const channel = program2.command("channel").description(
+    "Receive matched substrate events over the held SignalR push leg (D-WLP-9)"
+  );
+  const withFilterOpts = (c) => c.option(
+    "--name <name>",
+    "Deprecated: ignored; the installed executor selects its delivery subscription"
+  ).option(
+    "--tag <tag...>",
+    "Deprecated: executor eligibility comes from the installed capability advertisement"
   ).option(
     "--workspace <wsp...>",
-    "Restrict dispatches to these workspace id(s)"
+    "Deprecated: workspace authority is resolved by the server"
+  ).option(
+    "--executor-instance <id>",
+    "Deprecated: the instance is read from .sechroom/executor.json"
+  );
+  withFilterOpts(
+    channel.command("connect").description(
+      "Register a SignalR subscription and stream matched events to stdout"
+    )
+  ).action(async (opts, cmd) => {
+    const json = Boolean(cmd.optsWithGlobals().json);
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    warnLegacyChannelOptions(opts);
+    const located = requireExecutorState();
+    const instance = await ensureExecutorInstance(cfg, located);
+    const deliver = (payload) => process.stdout.write(
+      (typeof payload === "string" ? payload : JSON.stringify(payload)) + "\n"
+    );
+    const drain = createClaimDrain(cfg, instance.id, deliver);
+    const conn = await openConnection(
+      cfg,
+      () => {
+        void drain().catch(
+          (e) => process.stderr.write(err(`channel claim failed: ${String(e)}
+`))
+        );
+      },
+      instance.id
+    );
+    await drain();
+    const stopReconciliation = startOfferReconciliation(drain);
+    const stopHeartbeat = startExecutorHeartbeat(
+      () => refreshExecutorInstance(cfg, instance.id, located.state.ttlSeconds),
+      located.state.refreshAfterSeconds * 1e3
+    );
+    if (json) {
+      emit(
+        {
+          connected: true,
+          tenant: cfg.tenant,
+          executorInstanceId: instance.id,
+          instanceKey: located.state.instanceKey,
+          laneId: located.state.laneId
+        },
+        true
+      );
+    } else {
+      process.stderr.write(
+        style.green("channel connected") + style.dim(
+          ` \u2014 tenant ${cfg.tenant}, executor ${located.state.instanceKey}
+`
+        ) + style.dim("streaming matched events to stdout; Ctrl-C to stop.\n")
+      );
+    }
+    try {
+      await holdOpen(conn);
+    } finally {
+      stopReconciliation();
+      stopHeartbeat();
+    }
+  });
+  withFilterOpts(
+    channel.command("mcp").description(
+      "Run as a Claude Code channel (local-stdio MCP server) \u2014 push matched events into the session"
+    )
+  ).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    warnLegacyChannelOptions(opts);
+    const located = requireExecutorState();
+    const instance = await ensureExecutorInstance(cfg, located);
+    const mcp = new Server(
+      { name: "sechroom", version: "0.1.0" },
+      {
+        capabilities: { experimental: { "claude/channel": {} } },
+        instructions: 'Matched Sechroom substrate events arrive as <channel source="sechroom"> tags. A WLP dispatch delivered here has already been atomically claimed for this executor. Load the memory id from the event and retain the lease and claim token for holder-bound completion.'
+      }
+    );
+    await mcp.connect(new StdioServerTransport());
+    const deliver = (payload) => {
+      const { content, meta } = summarizeEvent(payload);
+      void mcp.notification({
+        method: "notifications/claude/channel",
+        params: { content, meta }
+      }).catch(
+        (e) => process.stderr.write(err(`channel push failed: ${String(e)}
+`))
+      );
+    };
+    const drain = createClaimDrain(cfg, instance.id, deliver);
+    const conn = await openConnection(
+      cfg,
+      () => {
+        void drain().catch(
+          (e) => process.stderr.write(err(`channel claim failed: ${String(e)}
+`))
+        );
+      },
+      instance.id
+    );
+    await drain();
+    const stopReconciliation = startOfferReconciliation(drain);
+    const stopHeartbeat = startExecutorHeartbeat(
+      () => refreshExecutorInstance(cfg, instance.id, located.state.ttlSeconds),
+      located.state.refreshAfterSeconds * 1e3
+    );
+    process.stderr.write(
+      style.dim(
+        `sechroom channel (mcp) \u2014 tenant ${cfg.tenant}, executor ${located.state.instanceKey}
+`
+      )
+    );
+    try {
+      await holdOpen(conn);
+    } finally {
+      stopReconciliation();
+      stopHeartbeat();
+    }
+  });
+  channel.command("install").description(
+    "Wire `sechroom channel mcp` into the project .mcp.json as a Claude Code channel MCP server (idempotent)"
+  ).option(
+    "--workspace <wsp...>",
+    "Deprecated: accepted only to migrate an existing managed entry"
   ).option(
     "--tag <tag...>",
-    "Tag(s) a dispatch must carry to match (repeatable). Default targets WLP task dispatches.",
-    ["kind:task"]
+    "Deprecated: accepted only to migrate an existing managed entry"
   ).option(
     "--name <name>",
     "MCP server + subscription name (idempotent per name)",
     "sechroom-channel"
   ).option("--dry-run", "Print what would change; write nothing").action((opts) => {
-    const path = join7(process.cwd(), ".mcp.json");
+    const path = join9(process.cwd(), ".mcp.json");
     const dryRun = Boolean(opts.dryRun);
-    const args = ["channel", "mcp", "--name", opts.name];
-    for (const w of opts.workspace ?? [])
-      args.push("--workspace", w);
-    for (const t of opts.tag ?? []) args.push("--tag", t);
+    const args = ["channel", "mcp"];
     const entry = { command: "sechroom", args };
     const config2 = readMcpConfig(path);
     config2.mcpServers ??= {};
@@ -1804,8 +2514,8 @@ function registerChannel(program2) {
     const status = JSON.stringify(existing) === JSON.stringify(entry) ? "current" : existing ? "updated" : "created";
     if (status !== "current" && !dryRun) {
       config2.mcpServers[opts.name] = entry;
-      mkdirSync5(dirname4(path), { recursive: true });
-      writeFileSync5(path, JSON.stringify(config2, null, 2) + "\n");
+      mkdirSync7(dirname6(path), { recursive: true });
+      writeFileSync7(path, JSON.stringify(config2, null, 2) + "\n");
     }
     const verb = status === "current" ? "already configured" : dryRun ? `would ${status === "created" ? "create" : "update"}` : status;
     process.stdout.write(`${style.green("channel")} ${path} (${verb})
@@ -1825,23 +2535,124 @@ Load it (Channels research preview) by launching your agent with:
       );
     }
     warnIfSechroomNotOnPath();
+    if ((opts.workspace?.length ?? 0) > 0 || (opts.tag?.length ?? 0) > 0)
+      process.stderr.write(
+        style.dim(
+          "channel: --workspace/--tag are retired; the managed entry now uses the installed executor advertisement.\n"
+        )
+      );
   });
   channel.addHelpText(
     "after",
     `
 Examples:
-  $ sechroom channel connect                         stream WLP task dispatches to stdout
-  $ sechroom channel connect --tag kind:task --tag status:in-progress
-  $ sechroom channel connect --workspace wsp_X --json | jq .
+  $ sechroom executor install                        configure capability + lane advertisement
+  $ sechroom channel connect                         claim WLP dispatches and stream them to stdout
 
   # Wire it as a Claude Code channel MCP server (research preview, v2.1.80+):
-  $ sechroom channel install --workspace wsp_X --tag kind:task --tag status:in-progress
+  $ sechroom channel install                          migrate/install the exact-instance channel
   #   then:  claude --dangerously-load-development-channels server:sechroom-channel`
   );
 }
+function requireExecutorState() {
+  const located = readExecutorState();
+  if (!located)
+    return fail(
+      "channel requires an installed executor advertisement; run `sechroom executor install` first."
+    );
+  return located;
+}
+function warnLegacyChannelOptions(opts) {
+  if (!opts.name && (opts.workspace?.length ?? 0) === 0 && (opts.tag?.length ?? 0) === 0 && !opts.executorInstance)
+    return;
+  process.stderr.write(
+    style.dim(
+      "channel: --name, --workspace, --tag, and --executor-instance are retired; delivery, eligibility, and identity come from the installed executor advertisement.\n"
+    )
+  );
+}
+function createClaimDrain(cfg, executorInstanceId, deliver, dependencies = {}) {
+  let active2;
+  const state = {};
+  return () => {
+    active2 ??= drainClaims(cfg, executorInstanceId, deliver, {
+      ...dependencies,
+      state
+    }).finally(() => {
+      active2 = void 0;
+    });
+    return active2;
+  };
+}
+function startOfferReconciliation(drain, intervalMilliseconds = 5e3, dependencies = {}) {
+  const schedule = dependencies.setInterval ?? setInterval;
+  const cancel = dependencies.clearInterval ?? clearInterval;
+  const onError = dependencies.onError ?? ((error) => process.stderr.write(err(`channel claim failed: ${String(error)}
+`)));
+  const timer = schedule(() => {
+    void drain().catch(onError);
+  }, intervalMilliseconds);
+  return () => cancel(timer);
+}
+function startExecutorHeartbeat(refresh, intervalMilliseconds, dependencies = {}) {
+  const schedule = dependencies.setInterval ?? setInterval;
+  const cancel = dependencies.clearInterval ?? clearInterval;
+  const onError = dependencies.onError ?? ((error) => process.stderr.write(err(`channel heartbeat failed: ${String(error)}
+`)));
+  const timer = schedule(() => {
+    void refresh().catch(onError);
+  }, intervalMilliseconds);
+  return () => cancel(timer);
+}
+async function drainClaims(cfg, executorInstanceId, deliver, dependencies = {}) {
+  const request = dependencies.request ?? api;
+  const sleep = dependencies.sleep ?? ((milliseconds) => new Promise((resolve3) => setTimeout(resolve3, milliseconds)));
+  const idempotencyKey = dependencies.idempotencyKey ?? ((offer) => `channel:${offer.generationId}`);
+  const state = dependencies.state ?? {};
+  for (; ; ) {
+    if (state.pendingIdempotencyKey) {
+      const replay = await request(
+        cfg,
+        `/me/executor-instances/${encodeURIComponent(executorInstanceId)}/dispatch-offers/claim-next`,
+        {
+          method: "POST",
+          body: JSON.stringify({ idempotencyKey: state.pendingIdempotencyKey })
+        }
+      );
+      state.pendingIdempotencyKey = void 0;
+      if (replay.outcome === "Claimed" || replay.outcome === "AlreadyHeld") {
+        deliver(replay);
+        continue;
+      }
+      return;
+    }
+    const offers = await request(
+      cfg,
+      `/me/executor-instances/${encodeURIComponent(executorInstanceId)}/dispatch-offers`
+    );
+    const offer = offers[0];
+    if (!offer) return;
+    if (offer.suggestedClaimDelayMs > 0)
+      await sleep(offer.suggestedClaimDelayMs);
+    state.pendingIdempotencyKey = idempotencyKey(offer);
+    const claim = await request(
+      cfg,
+      `/me/executor-instances/${encodeURIComponent(executorInstanceId)}/dispatch-offers/claim-next`,
+      {
+        method: "POST",
+        body: JSON.stringify({ idempotencyKey: state.pendingIdempotencyKey })
+      }
+    );
+    state.pendingIdempotencyKey = void 0;
+    if (claim.outcome === "NoOffer") return;
+    if (claim.outcome === "Claimed" || claim.outcome === "AlreadyHeld")
+      deliver(claim);
+    else return;
+  }
+}
 function readMcpConfig(path) {
-  if (!existsSync6(path)) return {};
-  const raw = readFileSync4(path, "utf8");
+  if (!existsSync8(path)) return {};
+  const raw = readFileSync6(path, "utf8");
   if (!raw.trim()) return {};
   try {
     return JSON.parse(raw);
@@ -1851,33 +2662,6 @@ function readMcpConfig(path) {
     );
   }
 }
-function readFilter(opts) {
-  const tags = opts.tag ?? [];
-  const workspaceScope = opts.workspace ?? [];
-  if (tags.length === 0 && workspaceScope.length === 0)
-    fail(
-      "A channel subscription needs at least one --tag or --workspace (an empty filter receives nothing)."
-    );
-  return { tags, workspaceScope };
-}
-async function ensureSubscription(cfg, name, filter) {
-  const token = await requireToken(cfg);
-  const resp = await fetch(`${cfg.baseUrl}/me/delivery-subscriptions/signalr`, {
-    method: "POST",
-    headers: {
-      authorization: `Bearer ${token}`,
-      tenant: cfg.tenant,
-      "content-type": "application/json",
-      "x-sechroom-surface": "cli"
-    },
-    body: JSON.stringify({ name, enabled: true, filter })
-  });
-  if (!resp.ok)
-    fail(
-      `Could not register the SignalR subscription (HTTP ${resp.status}): ${await resp.text()}`
-    );
-  return await resp.json();
-}
 async function openConnection(cfg, onEvent, executorInstanceId) {
   const query = executorInstanceId ? `?executorInstanceId=${encodeURIComponent(executorInstanceId)}` : "";
   const conn = new HubConnectionBuilder().withUrl(`${cfg.baseUrl}/notifications/${cfg.tenant}${query}`, {
@@ -1914,7 +2698,8 @@ function parseEvent(payload) {
     }
   }
   const obj = data ?? {};
-  const inner = obj.data ?? obj;
+  const envelope = obj.data ?? obj;
+  const inner = envelope.offer ?? envelope;
   const rawTags = inner.tags ?? inner.Tags;
   return {
     eventType: str(inner.eventType ?? inner.EventType ?? obj.type) || "substrate.event",
@@ -1923,113 +2708,6 @@ function parseEvent(payload) {
     tags: Array.isArray(rawTags) ? rawTags.filter((t) => typeof t === "string") : void 0
   };
 }
-function shouldDeliver(payload, filter) {
-  const { workspaceId, tags } = parseEvent(payload);
-  if (filter.workspaceScope.length > 0 && (!workspaceId || !filter.workspaceScope.includes(workspaceId)))
-    return false;
-  if (filter.tags.length > 0) {
-    if (!tags) return false;
-    return facetedTagMatch(tags, filter.tags);
-  }
-  return true;
-}
-function makeDeliver(filter, seen, forward) {
-  return (payload) => {
-    if (!shouldDeliver(payload, filter)) return;
-    const { memoryId } = parseEvent(payload);
-    if (memoryId) {
-      if (seen.has(memoryId)) return;
-      seen.add(memoryId);
-    }
-    forward(payload);
-  };
-}
-async function reconcile(cfg, filter, deliver) {
-  if (filter.workspaceScope.length === 0) {
-    process.stderr.write(
-      style.dim(
-        "channel: no --workspace to reconcile against; live feed only (a dropped dispatch won't be recovered).\n"
-      )
-    );
-    return;
-  }
-  if (filter.tags.length === 0) return;
-  let token;
-  try {
-    token = await requireToken(cfg);
-  } catch {
-    return;
-  }
-  const qs = `filterTags=${encodeURIComponent(filter.tags.join(","))}&limit=100`;
-  let recovered = 0;
-  for (const ws of filter.workspaceScope) {
-    try {
-      const resp = await fetch(
-        `${cfg.baseUrl}/workspaces/${encodeURIComponent(ws)}/memories/feed?${qs}`,
-        {
-          headers: {
-            authorization: `Bearer ${token}`,
-            tenant: cfg.tenant,
-            "x-sechroom-surface": "cli"
-          }
-        }
-      );
-      if (!resp.ok) {
-        process.stderr.write(
-          err(
-            `channel: reconcile query for ${ws} failed (HTTP ${resp.status})
-`
-          )
-        );
-        continue;
-      }
-      const data = await resp.json();
-      for (const m of data.results ?? []) {
-        if (!m.id) continue;
-        deliver({
-          eventType: "reconcile",
-          memoryId: m.id,
-          workspaceId: ws,
-          tags: m.tags ?? []
-        });
-        recovered++;
-      }
-    } catch (e) {
-      process.stderr.write(
-        err(`channel: reconcile error for ${ws}: ${String(e)}
-`)
-      );
-    }
-  }
-  if (recovered > 0)
-    process.stderr.write(
-      style.dim(
-        `channel: reconciled ${recovered} already-queued event(s) on connect.
-`
-      )
-    );
-}
-function facetedTagMatch(eventTags, filterTags) {
-  const have = new Set(eventTags);
-  const groups = /* @__PURE__ */ new Map();
-  for (const f of filterTags) {
-    const ns = f.endsWith(":*") ? f.slice(0, -2) : namespaceOf(f);
-    const group = groups.get(ns) ?? [];
-    group.push(f);
-    groups.set(ns, group);
-  }
-  for (const [ns, group] of groups) {
-    const ok2 = group.some(
-      (f) => f.endsWith(":*") ? eventTags.some((t) => namespaceOf(t) === ns) : have.has(f)
-    );
-    if (!ok2) return false;
-  }
-  return true;
-}
-function namespaceOf(tag) {
-  const i = tag.indexOf(":");
-  return i >= 0 ? tag.slice(0, i) : tag;
-}
 function summarizeEvent(payload) {
   const { eventType, memoryId, workspaceId } = parseEvent(payload);
   const content = memoryId ? `${eventType}: ${memoryId}${workspaceId ? ` (workspace ${workspaceId})` : ""}` : typeof payload === "string" ? payload : JSON.stringify(payload);
@@ -2037,6 +2715,10 @@ function summarizeEvent(payload) {
   if (eventType) meta.event_type = eventType;
   if (memoryId) meta.memory_id = memoryId;
   if (workspaceId) meta.workspace_id = workspaceId;
+  const claim = payload ?? {};
+  if (claim.outcome) meta.claim_outcome = claim.outcome;
+  if (claim.lease?.id) meta.lease_id = claim.lease.id;
+  if (claim.claimToken) meta.claim_token = claim.claimToken;
   return { content, meta };
 }
 function str(v) {
@@ -2066,237 +2748,73 @@ Examples:
       return client.POST("/chat/channel-messages/{surface}", {
         params: { path: { surface: String(surface) } },
         body: {
-          channelId,
-          text: text2,
-          guildId: opts.guild ?? null,
-          attachedMemoryId: opts.memory ?? null,
-          trackReplies: opts.track,
-          parentMessage: opts.parent ?? null,
-          source: opts.source,
-          as: opts.as
-        }
-      });
-    });
-    if (!data.ok) {
-      if (json) {
-        emit(data, true);
-      } else {
-        process.stderr.write(
-          `${err("\u2717")} send failed: ${data.upstreamError ?? "error"}${data.errorDescription ? ` \u2014 ${data.errorDescription}` : ""}
-`
-        );
-      }
-      process.exit(1);
-    }
-    const idPart = data.persistedId ? ` ${style.dim(`(${data.persistedId})`)}` : "";
-    emitAction(`sent to ${surface} ${style.bold(channelId)}${idPart}`, data, json);
-  });
-  chat.command("messages").description("List recent channel messages (GET /chat/channel-messages/{surface})").action(async (_opts, cmd) => {
-    const { surface, ...globals } = cmd.optsWithGlobals();
-    const cfg = resolveConfig(globals);
-    const data = await runApi("Fetching messages", async () => {
-      const client = await makeClient(cfg);
-      return client.GET("/chat/channel-messages/{surface}", {
-        params: { path: { surface: String(surface) } }
-      });
-    });
-    emit(data, cmd.optsWithGlobals().json);
-  });
-  chat.command("replies <messageId>").description("List thread replies for a message (GET /chat/channel-messages/by-id/{id}/replies)").action(async (messageId, _opts, cmd) => {
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Fetching replies", async () => {
-      const client = await makeClient(cfg);
-      return client.GET("/chat/channel-messages/by-id/{id}/replies", {
-        params: { path: { id: messageId } }
-      });
-    });
-    emit(data, cmd.optsWithGlobals().json);
-  });
-  chat.command("stop-tracking <messageId>").description("Stop watching a message for replies (POST .../by-id/{id}/stop-tracking-replies)").action(async (messageId, _opts, cmd) => {
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Stopping reply tracking", async () => {
-      const client = await makeClient(cfg);
-      return client.POST("/chat/channel-messages/by-id/{id}/stop-tracking-replies", {
-        params: { path: { id: messageId } },
-        body: {}
-      });
-    });
-    emitAction(`stopped tracking replies on ${style.bold(messageId)}`, data, cmd.optsWithGlobals().json);
-  });
-}
-
-// src/commands/checkpoint.ts
-import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname7, join as join10 } from "path";
-
-// src/commands/hook.ts
-import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync6, statSync as statSync2, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname6, join as join9 } from "path";
-
-// src/sem.ts
-import { dirname as dirname5, join as join8 } from "path";
-import { appendFileSync, existsSync as existsSync7, mkdirSync as mkdirSync6, readdirSync, readFileSync as readFileSync5, statSync, writeFileSync as writeFileSync6 } from "fs";
-var SEM_FILE = join8(".sechroom", "lane.json");
-var STATE_DIR_NAME2 = ".sechroom";
-function localSemPath(cwd = process.cwd()) {
-  return join8(cwd, SEM_FILE);
-}
-function resolveSemPathForRead(start = process.cwd()) {
-  let dir = start;
-  while (true) {
-    const candidate = join8(dir, SEM_FILE);
-    if (existsSync7(candidate)) return candidate;
-    const parent = dirname5(dir);
-    if (parent === dir) return void 0;
-    dir = parent;
-  }
-}
-function applyWorktreeLaneSuffix(lane, start = process.cwd()) {
-  try {
-    let dir = start;
-    let gitPath;
-    for (; ; ) {
-      const candidate = join8(dir, ".git");
-      if (existsSync7(candidate)) {
-        gitPath = candidate;
-        break;
-      }
-      const parent = dirname5(dir);
-      if (parent === dir) break;
-      dir = parent;
-    }
-    if (!gitPath || statSync(gitPath).isDirectory()) return lane;
-    const gitFile = readFileSync5(gitPath, "utf8");
-    const common = gitFile.trim().match(/^gitdir:\s*(.+)\/worktrees\/[^/\s]+\s*$/);
-    if (!common) return lane;
-    const worktreesDir = join8(common[1], "worktrees");
-    const siblings = readdirSync(worktreesDir).filter((n) => {
-      try {
-        return statSync(join8(worktreesDir, n)).isDirectory();
-      } catch {
-        return false;
-      }
-    });
-    return laneWithWorktreeSuffix(lane, gitFile, siblings);
-  } catch {
-    return lane;
-  }
-}
-function laneWithWorktreeSuffix(lane, gitFile, siblings) {
-  const m = gitFile.trim().match(/\/worktrees\/([^/\s]+)\s*$/);
-  if (!m) return lane;
-  const idx = [...siblings].sort().indexOf(m[1]);
-  return idx < 0 ? lane : `${lane}-${idx + 2}`;
-}
-function serializeSem(values) {
-  return JSON.stringify(values, null, 2) + "\n";
-}
-function readSem(path) {
-  const p = path ?? resolveSemPathForRead();
-  if (!p || !existsSync7(p)) return void 0;
-  return { path: p, values: parseLaneJson(readFileSync5(p, "utf8")) };
-}
-function readLocalSemValues(cwd = process.cwd()) {
-  const next = join8(cwd, SEM_FILE);
-  if (existsSync7(next)) return readSem(next)?.values ?? {};
-  return {};
-}
-function parseLaneJson(text2) {
-  try {
-    const parsed = JSON.parse(text2);
-    const out = {};
-    for (const [k, v] of Object.entries(parsed)) {
-      if (typeof v === "string") out[k] = v;
-    }
-    return out;
-  } catch {
-    return {};
-  }
-}
-var STATE_DIR_IGNORE = `${STATE_DIR_NAME2}/`;
-function writeSem(values, path = localSemPath()) {
-  mkdirSync6(dirname5(path), { recursive: true });
-  writeFileSync6(path, serializeSem(values));
-  ensureSemIgnored(path);
-  ensureContinuityScaffold(path);
-  return path;
-}
-function ensureStateDirIgnored(cwd = process.cwd()) {
-  ensureSemIgnored(localSemPath(cwd));
-}
-var CONTINUITY_FILE_NAME = "continuity.json";
-var CONTINUITY_SCAFFOLD = JSON.stringify(
-  {
-    _readme: "Agent-maintained continuity intent. Keep these current during the session; `sechroom checkpoint` and the PreCompact hook snapshot from here. The five required fields (objective, state, lastAction, nextAction, resumeInstruction) must all be non-empty for a snapshot to be created.",
-    objective: "",
-    state: "",
-    lastAction: "",
-    nextAction: "",
-    resumeInstruction: "",
-    constraints: [],
-    questions: [],
-    artifacts: [],
-    confidence: null
-  },
-  null,
-  2
-) + "\n";
-function ensureContinuityScaffold(semPath) {
-  try {
-    const target = join8(dirname5(semPath), CONTINUITY_FILE_NAME);
-    if (existsSync7(target)) return;
-    writeFileSync6(target, CONTINUITY_SCAFFOLD);
-  } catch {
-  }
-}
-function ignoresSem(content) {
-  return content.split("\n").some((line) => {
-    const t = line.trim();
-    return t === STATE_DIR_NAME2 || t === STATE_DIR_IGNORE || t === `/${STATE_DIR_NAME2}` || t === `/${STATE_DIR_IGNORE}` || t === `**/${STATE_DIR_NAME2}` || t === `**/${STATE_DIR_IGNORE}`;
-  });
-}
-function inGitRepo(startDir) {
-  let dir = startDir;
-  for (; ; ) {
-    if (existsSync7(join8(dir, ".git"))) return true;
-    const parent = dirname5(dir);
-    if (parent === dir) return false;
-    dir = parent;
-  }
-}
-function resolveGitignoreTarget(startDir) {
-  let dir = startDir;
-  for (; ; ) {
-    const gi = join8(dir, ".gitignore");
-    if (existsSync7(gi)) return { path: gi, exists: true };
-    const parent = dirname5(dir);
-    if (existsSync7(join8(dir, ".git")) || parent === dir) {
-      return { path: join8(startDir, ".gitignore"), exists: false };
-    }
-    dir = parent;
-  }
-}
-function ensureSemIgnored(semPath) {
-  try {
-    const checkoutDir = dirname5(dirname5(semPath));
-    if (!inGitRepo(checkoutDir)) return;
-    const target = resolveGitignoreTarget(checkoutDir);
-    if (target.exists) {
-      const content = readFileSync5(target.path, "utf8");
-      if (ignoresSem(content)) return;
-      const sep = content.length === 0 || content.endsWith("\n") ? "" : "\n";
-      appendFileSync(target.path, `${sep}${STATE_DIR_IGNORE}
-`);
-    } else {
-      writeFileSync6(target.path, `${STATE_DIR_IGNORE}
-`);
+          channelId,
+          text: text2,
+          guildId: opts.guild ?? null,
+          attachedMemoryId: opts.memory ?? null,
+          trackReplies: opts.track,
+          parentMessage: opts.parent ?? null,
+          source: opts.source,
+          as: opts.as
+        }
+      });
+    });
+    if (!data.ok) {
+      if (json) {
+        emit(data, true);
+      } else {
+        process.stderr.write(
+          `${err("\u2717")} send failed: ${data.upstreamError ?? "error"}${data.errorDescription ? ` \u2014 ${data.errorDescription}` : ""}
+`
+        );
+      }
+      process.exit(1);
     }
-  } catch {
-  }
+    const idPart = data.persistedId ? ` ${style.dim(`(${data.persistedId})`)}` : "";
+    emitAction(`sent to ${surface} ${style.bold(channelId)}${idPart}`, data, json);
+  });
+  chat.command("messages").description("List recent channel messages (GET /chat/channel-messages/{surface})").action(async (_opts, cmd) => {
+    const { surface, ...globals } = cmd.optsWithGlobals();
+    const cfg = resolveConfig(globals);
+    const data = await runApi("Fetching messages", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/chat/channel-messages/{surface}", {
+        params: { path: { surface: String(surface) } }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  chat.command("replies <messageId>").description("List thread replies for a message (GET /chat/channel-messages/by-id/{id}/replies)").action(async (messageId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Fetching replies", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/chat/channel-messages/by-id/{id}/replies", {
+        params: { path: { id: messageId } }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  chat.command("stop-tracking <messageId>").description("Stop watching a message for replies (POST .../by-id/{id}/stop-tracking-replies)").action(async (messageId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Stopping reply tracking", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/chat/channel-messages/by-id/{id}/stop-tracking-replies", {
+        params: { path: { id: messageId } },
+        body: {}
+      });
+    });
+    emitAction(`stopped tracking replies on ${style.bold(messageId)}`, data, cmd.optsWithGlobals().json);
+  });
 }
 
+// src/commands/checkpoint.ts
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname8, join as join11 } from "path";
+
 // src/commands/hook.ts
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync7, statSync as statSync2, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname7, join as join10 } from "path";
 async function readStdin() {
   if (process.stdin.isTTY) return "";
   const chunks = [];
@@ -2320,13 +2838,13 @@ function resolveLane(flagLane, cwd) {
   if (!base) return void 0;
   return applyWorktreeLaneSuffix(base, start);
 }
-var INTENT_FILE = join9(".sechroom", "continuity.json");
+var INTENT_FILE = join10(".sechroom", "continuity.json");
 function resolveIntentPath(start) {
   let dir = start;
   for (; ; ) {
-    const candidate = join9(dir, INTENT_FILE);
-    if (existsSync8(candidate)) return candidate;
-    const parent = dirname6(dir);
+    const candidate = join10(dir, INTENT_FILE);
+    if (existsSync9(candidate)) return candidate;
+    const parent = dirname7(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
@@ -2335,7 +2853,7 @@ function readIntent(start) {
   const path = resolveIntentPath(start);
   if (!path) return void 0;
   try {
-    return JSON.parse(readFileSync6(path, "utf8"));
+    return JSON.parse(readFileSync7(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -2377,14 +2895,14 @@ async function saveSnapshotFromIntent(cmd, cwd, laneFlag, scopeFlag, defaultScop
 }
 function ledgerPath(start) {
   const intent = resolveIntentPath(start);
-  const dir = intent ? dirname6(intent) : join9(start, ".sechroom");
-  return join9(dir, ".checkpoint-state.json");
+  const dir = intent ? dirname7(intent) : join10(start, ".sechroom");
+  return join10(dir, ".checkpoint-state.json");
 }
 function readLedger(start) {
   try {
     const p = ledgerPath(start);
-    if (!existsSync8(p)) return {};
-    return JSON.parse(readFileSync6(p, "utf8"));
+    if (!existsSync9(p)) return {};
+    return JSON.parse(readFileSync7(p, "utf8"));
   } catch {
     return {};
   }
@@ -2431,13 +2949,13 @@ function recordPush(start, intent) {
     } catch {
       mtimeMs = void 0;
     }
-    mkdirSync7(dirname6(p), { recursive: true });
+    mkdirSync8(dirname7(p), { recursive: true });
     const ledger = {
       lastEpochMs: Date.now(),
       lastMtimeMs: mtimeMs,
       lastHash: intentHash(intent)
     };
-    writeFileSync7(p, JSON.stringify(ledger) + "\n");
+    writeFileSync8(p, JSON.stringify(ledger) + "\n");
   } catch {
   }
 }
@@ -2690,10 +3208,10 @@ Examples:
       const client = await makeClient(cfg);
       return client.POST("/continuity/snapshots", { body });
     });
-    const path = resolveIntentPath(cwd) ?? join10(cwd, INTENT_FILE);
+    const path = resolveIntentPath(cwd) ?? join11(cwd, INTENT_FILE);
     const fileBody = { ...merged, scope, lastSnapshotId: data.snapshotId };
-    mkdirSync8(dirname7(path), { recursive: true });
-    writeFileSync8(path, JSON.stringify(fileBody, null, 2) + "\n");
+    mkdirSync9(dirname8(path), { recursive: true });
+    writeFileSync9(path, JSON.stringify(fileBody, null, 2) + "\n");
     recordPush(cwd, merged);
     if (json) {
       emit({ snapshotId: data.snapshotId, lane, scope, file: path }, true);
@@ -2707,7 +3225,7 @@ Examples:
 }
 
 // src/commands/close.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 var VERDICTS = ["pass", "soft-fail", "plan-invalid", "blocked"];
 function registerClose(program2) {
   program2.command("close").description(
@@ -2748,7 +3266,7 @@ Examples:
       );
     let bodyText;
     try {
-      bodyText = opts.file ? readFileSync7(opts.file, "utf8") : readFileSync7(0, "utf8");
+      bodyText = opts.file ? readFileSync8(opts.file, "utf8") : readFileSync8(0, "utf8");
     } catch {
       fail(
         opts.file ? `could not read --file ${opts.file}` : "no closeout body \u2014 pass --file <path> or pipe it on stdin"
@@ -3140,205 +3658,6 @@ Examples:
   });
 }
 
-// src/commands/executor.ts
-function registerExecutor(program2) {
-  const executor = program2.command("executor").description(
-    "Register and operate a local Claude Code/Codex executor advertisement"
-  );
-  executor.command("submit-connector").description(
-    "Submit a local-session connector definition for governed approval"
-  ).requiredOption("--slug <slug>", "Unique connector definition slug").requiredOption("--display-name <name>", "Human-readable connector name").requiredOption("--transport <kind>", "push | pull").option("--profile <profile...>", "Advertised runtime profiles", [
-    "base",
-    "dotnet-10"
-  ]).action(async (opts, cmd) => {
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await api(cfg, "/connectors/definitions", {
-      method: "POST",
-      body: JSON.stringify({
-        slug: opts.slug,
-        displayName: opts.displayName,
-        runtimeProfiles: opts.profile,
-        connectorKind: "ExecutionRuntime",
-        providerKind: "local-session",
-        dispatchTransport: parseTransport(opts.transport)
-      })
-    });
-    emit(data, Boolean(cmd.optsWithGlobals().json));
-    if (!cmd.optsWithGlobals().json) {
-      process.stderr.write(
-        style.dim(
-          "approve this connector definition before registering executors\n"
-        )
-      );
-    }
-  });
-  executor.command("register").description(
-    "Create/reuse a SignalR binding and register this local executor instance"
-  ).requiredOption(
-    "--instance-key <key>",
-    "Stable key for this concrete session/lane"
-  ).requiredOption(
-    "--connector <id>",
-    "Approved local-session ConnectorDefinition id"
-  ).option("--runtime <kind>", "claude-code | codex", "claude-code").option(
-    "--relay <id>",
-    "Relay identity shared by sibling instances",
-    "sechroom-cli-local"
-  ).option(
-    "--subscription-name <name>",
-    "SignalR delivery binding name",
-    "executor-dispatch"
-  ).option(
-    "--capability <key...>",
-    "Capability operation keys claimed by this instance"
-  ).option("--tool-set-ref <ref>", "Optional governed tool-set reference").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).action(async (opts, cmd) => {
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    if (!cfg.workspaceId)
-      fail("executor register requires a configured workspaceId");
-    const subscription = await api(
-      cfg,
-      "/me/delivery-subscriptions/signalr",
-      {
-        method: "POST",
-        body: JSON.stringify({
-          name: opts.subscriptionName,
-          enabled: true,
-          filter: { tags: ["kind:task"], workspaceScope: [cfg.workspaceId] }
-        })
-      }
-    );
-    const data = await api(
-      cfg,
-      "/me/executor-instances",
-      {
-        method: "POST",
-        body: JSON.stringify({
-          relayId: opts.relay,
-          instanceKey: opts.instanceKey,
-          runtimeKind: parseRuntimeKind(opts.runtime),
-          activationMode: "Attached",
-          deliverySubscriptionId: subscription.id,
-          connectorId: opts.connector,
-          claimedCapabilityKeys: opts.capability ?? [],
-          toolSetRef: opts.toolSetRef ?? null,
-          ttlSeconds: opts.ttl
-        })
-      }
-    );
-    emit(data, Boolean(cmd.optsWithGlobals().json));
-    if (!cmd.optsWithGlobals().json)
-      process.stderr.write(
-        style.dim(`refresh with: sechroom executor heartbeat ${data.id}
-`)
-      );
-  });
-  executor.command("refresh <id>").description("Refresh one advertisement lease once").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).action(async (id, opts, cmd) => {
-    const data = await refresh(
-      resolveConfig(cmd.optsWithGlobals()),
-      id,
-      opts.ttl
-    );
-    emit(data, Boolean(cmd.optsWithGlobals().json));
-  });
-  executor.command("heartbeat <id>").description("Keep an advertisement alive until interrupted").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).option("--interval <seconds>", "Refresh interval", parseInteger, 40).action(async (id, opts, cmd) => {
-    if (opts.interval >= opts.ttl)
-      fail("heartbeat interval must be shorter than the TTL");
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    await refresh(cfg, id, opts.ttl);
-    process.stderr.write(
-      style.green("executor heartbeat active") + style.dim(` \u2014 ${id}
-`)
-    );
-    await holdHeartbeat(async () => {
-      await refresh(cfg, id, opts.ttl);
-    }, opts.interval * 1e3);
-  });
-  executor.command("offers <id>").description("List live dispatch offers addressed to this exact instance").action(async (id, _opts, cmd) => {
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await api(
-      cfg,
-      `/me/executor-instances/${encodeURIComponent(id)}/dispatch-offers`
-    );
-    emit(data, Boolean(cmd.optsWithGlobals().json));
-  });
-  executor.command("deregister <id>").description("Stop advertising this executor instance").action(async (id, _opts, cmd) => {
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await api(
-      cfg,
-      `/me/executor-instances/${encodeURIComponent(id)}`,
-      {
-        method: "DELETE",
-        body: JSON.stringify({})
-      }
-    );
-    emit(data, Boolean(cmd.optsWithGlobals().json));
-  });
-}
-function parseRuntimeKind(value) {
-  switch (value.trim().toLowerCase()) {
-    case "claude":
-    case "claude-code":
-      return "ClaudeCode";
-    case "codex":
-      return "Codex";
-    default:
-      return fail("runtime must be claude-code or codex");
-  }
-}
-function parseTransport(value) {
-  switch (value.trim().toLowerCase()) {
-    case "push":
-      return "Push";
-    case "pull":
-      return "Pull";
-    default:
-      return fail("transport must be push or pull");
-  }
-}
-async function refresh(cfg, id, ttlSeconds) {
-  return api(
-    cfg,
-    `/me/executor-instances/${encodeURIComponent(id)}/refresh`,
-    {
-      method: "POST",
-      body: JSON.stringify({ ttlSeconds })
-    }
-  );
-}
-async function api(cfg, path, init) {
-  const token = await requireToken(cfg);
-  const response = await fetch(`${cfg.baseUrl}${path}`, {
-    ...init,
-    headers: {
-      authorization: `Bearer ${token}`,
-      tenant: cfg.tenant,
-      "content-type": "application/json",
-      "x-sechroom-surface": "cli"
-    }
-  });
-  if (!response.ok)
-    fail(
-      `${init?.method ?? "GET"} ${path} failed (${response.status}): ${await response.text()}`
-    );
-  return response.json();
-}
-function parseInteger(value) {
-  const parsed = Number.parseInt(value, 10);
-  if (!Number.isFinite(parsed)) fail(`expected an integer, got '${value}'`);
-  return parsed;
-}
-function holdHeartbeat(tick, intervalMs) {
-  return new Promise((resolve3, reject) => {
-    const timer = setInterval(() => void tick().catch(reject), intervalMs);
-    const stop = () => {
-      clearInterval(timer);
-      resolve3();
-    };
-    process.once("SIGINT", stop);
-    process.once("SIGTERM", stop);
-  });
-}
-
 // src/commands/filing.ts
 function registerFiling(program2) {
   const filing = program2.command("filing").description("Review and act on filing suggestions");
@@ -3850,8 +4169,8 @@ Examples:
 
 // src/setup/apply.ts
 import { createHash as createHash3 } from "crypto";
-import { mkdirSync as mkdirSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync9, existsSync as existsSync9 } from "fs";
-import { dirname as dirname8 } from "path";
+import { mkdirSync as mkdirSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync10, existsSync as existsSync10 } from "fs";
+import { dirname as dirname9 } from "path";
 var MARKER_BEGIN = "<!-- @sechroom/cli:begin";
 var MARKER_END = "<!-- @sechroom/cli:end";
 function normalizeBody(s) {
@@ -3904,22 +4223,22 @@ function parseManagedBlock(content, block) {
   return null;
 }
 function ensureDir2(path) {
-  mkdirSync9(dirname8(path), { recursive: true });
+  mkdirSync10(dirname9(path), { recursive: true });
 }
 function readOr(path, fallback) {
   try {
-    return readFileSync8(path, "utf8");
+    return readFileSync9(path, "utf8");
   } catch {
     return fallback;
   }
 }
 function mergeMcpJson(path, snippet, dryRun) {
   const incoming = JSON.parse(snippet);
-  const existed = existsSync9(path);
+  const existed = existsSync10(path);
   let current = {};
   if (existed) {
     try {
-      current = JSON.parse(readFileSync8(path, "utf8"));
+      current = JSON.parse(readFileSync9(path, "utf8"));
     } catch {
       return { kind: "mcp", path, status: "skipped", note: "existing file isn't valid JSON \u2014 left untouched" };
     }
@@ -3927,26 +4246,26 @@ function mergeMcpJson(path, snippet, dryRun) {
   current.mcpServers = { ...current.mcpServers ?? {}, ...incoming.mcpServers ?? {} };
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync9(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
+  writeFileSync10(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function mergeCodexToml(path, snippet, dryRun) {
-  const existed = existsSync9(path);
+  const existed = existsSync10(path);
   let body = readOr(path, "");
   body = body.replace(/(^|\n)\[mcp_servers\.sechroom\][^[]*/, "\n").replace(/\n{3,}/g, "\n\n");
   const trimmed = body.trim();
   const next = (trimmed.length > 0 ? trimmed + "\n\n" : "") + snippet.trim() + "\n";
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync9(path, next, { mode: 384 });
+  writeFileSync10(path, next, { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function writeInstructionBlock(path, write, dryRun) {
-  const existed = existsSync9(path);
+  const existed = existsSync10(path);
   const next = computeBlockFile(readOr(path, ""), write);
   if (dryRun) return { kind: "instruction", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync9(path, next);
+  writeFileSync10(path, next);
   return { kind: "instruction", path, status: existed ? "merged" : "created" };
 }
 function computeBlockFile(current, write) {
@@ -3987,7 +4306,7 @@ function applyBlock(path, write, mode, dryRun) {
     const next = computeBlockFile(current, write);
     if (!dryRun) {
       ensureDir2(proposedPath);
-      writeFileSync9(proposedPath, next);
+      writeFileSync10(proposedPath, next);
     }
     return {
       kind: "instruction",
@@ -4117,8 +4436,8 @@ auto-resumes where you left off and checkpoints working state before compacting.
 }
 
 // src/setup/skills-offer.ts
-import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
-import { join as join11 } from "path";
+import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
+import { join as join12 } from "path";
 
 // src/setup/lane-pin.ts
 var CODE_LANE_PREFIX_BY_CLIENT = {
@@ -4234,8 +4553,8 @@ Found ${summary} available to you for ${surface}.
   if (skills.length > 0) {
     const written = [];
     for (const s of skills) {
-      mkdirSync10(join11(sDir, s.name), { recursive: true });
-      writeFileSync10(join11(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
+      mkdirSync11(join12(sDir, s.name), { recursive: true });
+      writeFileSync11(join12(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
       written.push(s.name);
     }
     recordMaterialisedSkills(sDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -4243,11 +4562,11 @@ Found ${summary} available to you for ${surface}.
 `);
   }
   if (agents.length > 0) {
-    mkdirSync10(aDir, { recursive: true });
+    mkdirSync11(aDir, { recursive: true });
     const written = [];
     for (const a of agents) {
       const file = `${a.name}.md`;
-      writeFileSync10(join11(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
+      writeFileSync11(join12(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
       written.push(file);
     }
     recordMaterialisedSkills(aDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -4630,13 +4949,13 @@ Wired to namespace '${slug}'. Restart your AI client (or reload MCP) to pick it
 }
 
 // src/commands/onboard.ts
-import { existsSync as existsSync11 } from "fs";
-import { basename as basename2, join as join13 } from "path";
+import { existsSync as existsSync12 } from "fs";
+import { basename as basename2, join as join14 } from "path";
 
 // src/commands/fanout.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync9, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
-import { isAbsolute, join as join12, resolve } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync10, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
+import { isAbsolute, join as join13, resolve } from "path";
 var ICON = {
   refresh: "\u21BB",
   bind: "+",
@@ -4656,21 +4975,21 @@ function discoverChildren(root) {
   const out = [];
   for (const name of names.sort()) {
     if (name.startsWith(".") || name === "node_modules") continue;
-    const dir = join12(root, name);
+    const dir = join13(root, name);
     try {
       if (!statSync3(dir).isDirectory()) continue;
     } catch {
       continue;
     }
-    if (existsSync10(join12(dir, ".git")) || committedBindingPath(dir)) out.push(name);
+    if (existsSync11(join13(dir, ".git")) || committedBindingPath(dir)) out.push(name);
   }
   return out;
 }
 function readManifest(path) {
-  if (!existsSync10(path)) return null;
+  if (!existsSync11(path)) return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync9(path, "utf8"));
+    parsed = JSON.parse(readFileSync10(path, "utf8"));
   } catch (err2) {
     throw new Error(`couldn't parse ${path}: ${err2 instanceof Error ? err2.message : String(err2)}`);
   }
@@ -5036,10 +5355,10 @@ async function chooseScope(scopeFlag, yes) {
 }
 async function planRecurseChild(entry, root, client, opts) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync11(dir)) {
+  if (!existsSync12(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
-  if (existsSync11(join13(dir, ".sechroom.json"))) {
+  if (existsSync12(join14(dir, ".sechroom.json"))) {
     return {
       label: entry.path,
       dir,
@@ -5112,7 +5431,7 @@ This fan-out will pin the same lane in every repo:
 async function runRecurse(cfg, g, opts) {
   const { yes, dryRun, json } = opts;
   const root = process.cwd();
-  const manifestPath = join13(root, ".sechroom", "repos.json");
+  const manifestPath = join14(root, ".sechroom", "repos.json");
   const fromManifest = readManifest(manifestPath);
   const entries = fromManifest ?? discoverChildren(root).map((path) => ({ path }));
   const sourceLabel = fromManifest ? `manifest ${manifestPath}` : `auto-discovered under ${root}`;
@@ -5645,23 +5964,23 @@ Examples:
 
 // src/commands/reset.ts
 import { homedir as homedir4 } from "os";
-import { join as join14 } from "path";
-import { existsSync as existsSync12, readFileSync as readFileSync10, rmSync as rmSync3 } from "fs";
+import { join as join15 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync11, rmSync as rmSync3 } from "fs";
 var SKILLS_LOCK2 = ".sechroom-skills.json";
-var localSkillsDir = () => join14(process.cwd(), ".claude", "skills");
-var globalSkillsDir = () => join14(homedir4(), ".claude", "skills");
-var localAgentsDir = () => join14(process.cwd(), ".claude", "agents");
-var globalAgentsDir = () => join14(homedir4(), ".claude", "agents");
+var localSkillsDir = () => join15(process.cwd(), ".claude", "skills");
+var globalSkillsDir = () => join15(homedir4(), ".claude", "skills");
+var localAgentsDir = () => join15(process.cwd(), ".claude", "agents");
+var globalAgentsDir = () => join15(homedir4(), ".claude", "agents");
 function removeMaterialisedSkills(dir) {
   const removed = [];
-  const lockPath = join14(dir, SKILLS_LOCK2);
-  if (!existsSync12(lockPath)) return removed;
+  const lockPath = join15(dir, SKILLS_LOCK2);
+  if (!existsSync13(lockPath)) return removed;
   try {
-    const lock = JSON.parse(readFileSync10(lockPath, "utf8"));
+    const lock = JSON.parse(readFileSync11(lockPath, "utf8"));
     for (const entry of Object.values(lock)) {
       for (const name of entry.skills ?? []) {
-        const p = join14(dir, name);
-        if (existsSync12(p)) {
+        const p = join15(dir, name);
+        if (existsSync13(p)) {
           rmSync3(p, { recursive: true, force: true });
           removed.push(p);
         }
@@ -5706,18 +6025,18 @@ function registerReset(program2) {
       }
     }
     const removed = [];
-    const stateDir = join14(process.cwd(), ".sechroom");
-    if (existsSync12(stateDir)) {
+    const stateDir = join15(process.cwd(), ".sechroom");
+    if (existsSync13(stateDir)) {
       rmSync3(stateDir, { recursive: true, force: true });
       removed.push(stateDir);
     }
-    const legacyCfg = join14(process.cwd(), ".sechroom.json");
-    if (existsSync12(legacyCfg)) {
+    const legacyCfg = join15(process.cwd(), ".sechroom.json");
+    if (existsSync13(legacyCfg)) {
       rmSync3(legacyCfg, { force: true });
       removed.push(legacyCfg);
     }
-    const legacySem = join14(process.cwd(), ".sem");
-    if (existsSync12(legacySem)) {
+    const legacySem = join15(process.cwd(), ".sem");
+    if (existsSync13(legacySem)) {
       rmSync3(legacySem, { force: true });
       removed.push(legacySem);
     }
@@ -5743,8 +6062,8 @@ function registerReset(program2) {
 }
 
 // src/commands/skills.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync11, statSync as statSync4, writeFileSync as writeFileSync11 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync12, statSync as statSync4, writeFileSync as writeFileSync12 } from "fs";
+import { join as join16 } from "path";
 function filenameFromDisposition(header) {
   if (!header) return void 0;
   const m = /filename\*?=(?:UTF-8'')?"?([^";]+)"?/i.exec(header);
@@ -5752,11 +6071,11 @@ function filenameFromDisposition(header) {
 }
 function resolveOutputPath(output, serverFilename) {
   const filename = serverFilename || "skills.zip";
-  if (!output) return join15(process.cwd(), filename);
-  const looksLikeDir = output.endsWith("/") || existsSync13(output) && statSync4(output).isDirectory();
+  if (!output) return join16(process.cwd(), filename);
+  const looksLikeDir = output.endsWith("/") || existsSync14(output) && statSync4(output).isDirectory();
   if (looksLikeDir) {
-    mkdirSync11(output, { recursive: true });
-    return join15(output, filename);
+    mkdirSync12(output, { recursive: true });
+    return join16(output, filename);
   }
   return output;
 }
@@ -5787,7 +6106,7 @@ async function downloadZip(label, call, output) {
   const buf = Buffer.from(res.data);
   const filename = filenameFromDisposition(res.response.headers.get("content-disposition")) ?? "skills.zip";
   const path = resolveOutputPath(output, filename);
-  writeFileSync11(path, buf);
+  writeFileSync12(path, buf);
   return { path, bytes: buf.length, filename };
 }
 function registerSkills(program2) {
@@ -5961,12 +6280,12 @@ clients select all; an unconfigured machine preserves the legacy Claude default.
 }
 
 // src/commands/sweep.ts
-import { existsSync as existsSync14 } from "fs";
-import { dirname as dirname9, join as join16, resolve as resolve2 } from "path";
-var DEFAULT_MANIFEST = join16(".sechroom", "repos.json");
+import { existsSync as existsSync15 } from "fs";
+import { dirname as dirname10, join as join17, resolve as resolve2 } from "path";
+var DEFAULT_MANIFEST = join17(".sechroom", "repos.json");
 function planEntry(entry, root) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync14(dir)) {
+  if (!existsSync15(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
   if (committedBindingPath(dir)) {
@@ -6042,7 +6361,7 @@ Examples:
 `);
       return;
     }
-    const root = dirname9(dirname9(manifestPath));
+    const root = dirname10(dirname10(manifestPath));
     const plans = repos.map((entry) => planEntry(entry, root));
     if (!json) {
       process.stderr.write(
@@ -6061,13 +6380,13 @@ Examples:
 
 // src/commands/telemetry.ts
 import {
-  existsSync as existsSync15,
-  mkdirSync as mkdirSync12,
-  readFileSync as readFileSync11,
+  existsSync as existsSync16,
+  mkdirSync as mkdirSync13,
+  readFileSync as readFileSync12,
   rmSync as rmSync4,
-  writeFileSync as writeFileSync12
+  writeFileSync as writeFileSync13
 } from "fs";
-import { dirname as dirname10, join as join17 } from "path";
+import { dirname as dirname11, join as join18 } from "path";
 function registerTelemetry(program2) {
   const telemetry = program2.command("telemetry").description(
     "Emit WLP run telemetry (an executor leg's progress events) into a decomposition run"
@@ -6137,14 +6456,14 @@ function registerTelemetry(program2) {
     "Decomposition id this session executes"
   ).requiredOption("--task <id>", "Task id this session executes").action((opts, cmd) => {
     const json = Boolean(cmd.optsWithGlobals().json);
-    const dir = join17(process.cwd(), ".sechroom");
-    mkdirSync12(dir, { recursive: true });
-    const path = join17(dir, BINDING_FILE);
+    const dir = join18(process.cwd(), ".sechroom");
+    mkdirSync13(dir, { recursive: true });
+    const path = join18(dir, BINDING_FILE);
     const binding = {
       decompositionId: opts.decomposition,
       taskId: opts.task
     };
-    writeFileSync12(path, JSON.stringify(binding, null, 2) + "\n");
+    writeFileSync13(path, JSON.stringify(binding, null, 2) + "\n");
     ensureStateDirIgnored(process.cwd());
     if (json) {
       emit({ bound: true, ...binding, path }, true);
@@ -6159,8 +6478,8 @@ function registerTelemetry(program2) {
   });
   telemetry.command("unbind").description("Clear this checkout's telemetry binding").action((_opts, cmd) => {
     const json = Boolean(cmd.optsWithGlobals().json);
-    const path = join17(process.cwd(), ".sechroom", BINDING_FILE);
-    const existed = existsSync15(path);
+    const path = join18(process.cwd(), ".sechroom", BINDING_FILE);
+    const existed = existsSync16(path);
     if (existed) rmSync4(path);
     if (json) emit({ unbound: existed, path }, true);
     else
@@ -6268,11 +6587,11 @@ async function postTelemetry(cfg, decompositionId, events) {
 function findBinding(start) {
   let dir = start;
   for (; ; ) {
-    const path = join17(dir, ".sechroom", BINDING_FILE);
-    if (existsSync15(path)) {
+    const path = join18(dir, ".sechroom", BINDING_FILE);
+    if (existsSync16(path)) {
       try {
         const b = JSON.parse(
-          readFileSync11(path, "utf8")
+          readFileSync12(path, "utf8")
         );
         if (b.decompositionId && b.taskId)
           return { decompositionId: b.decompositionId, taskId: b.taskId };
@@ -6280,18 +6599,18 @@ function findBinding(start) {
       }
       return null;
     }
-    const parent = dirname10(dir);
+    const parent = dirname11(dir);
     if (parent === dir) return null;
     dir = parent;
   }
 }
 function parseTranscript(path) {
-  if (!existsSync15(path)) return null;
+  if (!existsSync16(path)) return null;
   let tokensIn = 0;
   let tokensOut = 0;
   let contextUsed = 0;
   let model = "";
-  for (const line of readFileSync11(path, "utf8").split("\n")) {
+  for (const line of readFileSync12(path, "utf8").split("\n")) {
     if (!line.trim()) continue;
     let obj;
     try {
@@ -6598,7 +6917,7 @@ Examples:
 function resolveVersion() {
   try {
     const pkg = JSON.parse(
-      readFileSync12(new URL("../package.json", import.meta.url), "utf8")
+      readFileSync13(new URL("../package.json", import.meta.url), "utf8")
     );
     return pkg.version ?? "0.0.0";
   } catch {