@sechroom/cli 2026.7.19 → 2026.7.20
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +43 -19
- package/dist/index.js +1144 -1069
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -12,7 +12,7 @@ every command emits clean JSON via `--json`.
|
|
|
12
12
|
`frontend/packages/api-client` and Bruno consume. The CLI generates its
|
|
13
13
|
client from it; there is no hand-maintained request/response surface.
|
|
14
14
|
- **The API is the real surface.** Every MCP tool is a thin shim over a
|
|
15
|
-
Wolverine handler that is
|
|
15
|
+
Wolverine handler that is _also_ a `[WolverinePost]`/`[WolverineGet]` endpoint
|
|
16
16
|
carrying the same `[TenantPermission]`. The permission middleware is HTTP-only,
|
|
17
17
|
so the CLI inherits identical enforcement.
|
|
18
18
|
- **Tenant is mandatory.** `MapWolverineEndpoints` calls `TenantId.AssertExists()`
|
|
@@ -129,27 +129,51 @@ Headless:
|
|
|
129
129
|
```bash
|
|
130
130
|
export SECHROOM_TOKEN="<bearer: a PAT or dev-token JWT>"
|
|
131
131
|
export SECHROOM_TENANT=ocd
|
|
132
|
-
sechroom --json memory search "rate limiting"
|
|
132
|
+
sechroom --json memory search "rate limiting"
|
|
133
133
|
```
|
|
134
134
|
|
|
135
|
+
## Executor channel migration
|
|
136
|
+
|
|
137
|
+
`sechroom channel` now consumes the generic executor advertisement and claims a
|
|
138
|
+
durable exact-instance offer before forwarding work. Configure the checkout once,
|
|
139
|
+
then install the channel entry:
|
|
140
|
+
|
|
141
|
+
```bash
|
|
142
|
+
sechroom executor install --connector <approved-connector-id>
|
|
143
|
+
sechroom channel install
|
|
144
|
+
```
|
|
145
|
+
|
|
146
|
+
The former `channel --workspace ... --tag ...` shape is retired. Those options are
|
|
147
|
+
accepted for one compatibility release and print a deprecation warning, but they
|
|
148
|
+
no longer participate in eligibility or reconnect recovery. Running `channel
|
|
149
|
+
install` rewrites the managed `.mcp.json` entry without them. Workspace authority,
|
|
150
|
+
capabilities, runtime profiles, instance identity, and lane affinity now come from
|
|
151
|
+
the installed executor state plus server-side persona/connector resolution.
|
|
152
|
+
|
|
153
|
+
Reconnect recovery reads durable offers for the exact executor instance; it no
|
|
154
|
+
longer queries a workspace memory feed. Existing unmanaged channel entries should
|
|
155
|
+
remove `--workspace`, `--tag`, and `--executor-instance` after the executor harness
|
|
156
|
+
has been installed.
|
|
157
|
+
|
|
135
158
|
## Command surface (MCP parity)
|
|
136
159
|
|
|
137
160
|
The CLI mirrors the sechroom MCP tool surface — every command is a thin wrapper over the same HTTP endpoint the matching MCP tool shims, so enforcement (`[TenantPermission]`) is identical. Run `sechroom <group> --help` for the subcommands + examples.
|
|
138
161
|
|
|
139
|
-
| Group
|
|
140
|
-
|
|
141
|
-
| `memory`
|
|
142
|
-
| `relationship`
|
|
143
|
-
| `workspace`
|
|
144
|
-
| `project`
|
|
145
|
-
| `filing`
|
|
146
|
-
| `continuity`
|
|
147
|
-
| `id`
|
|
148
|
-
| `account`
|
|
149
|
-
| `chat`
|
|
150
|
-
| `worklog` · `lookup` | append · resolve any id
|
|
162
|
+
| Group | Covers |
|
|
163
|
+
| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
164
|
+
| `memory` | create / get / search · edit-text(+batch) · archive / restore / move · versions / revert · list-archived · owners / tags / types · sum-tokens · similar · by-url |
|
|
165
|
+
| `relationship` | create / list / delete · suggest · `suggestion` get / accept / reject / defer |
|
|
166
|
+
| `workspace` | create / list / get · rename / describe / move · archive / restore · feed |
|
|
167
|
+
| `project` | create / list / get · rename / describe / move · status · victory-conditions · archive / restore |
|
|
168
|
+
| `filing` | suggestions / get · preview · accept / reject / defer / edit-and-accept |
|
|
169
|
+
| `continuity` | snapshot-create / -get · snapshots · resume-me / resume-lane · changed-since · load-set · grant / revoke-grant |
|
|
170
|
+
| `id` | next / peek (FR-_/D-_ sequence allocation) |
|
|
171
|
+
| `account` | profile / set-profile · feed · reviews / review-get / review-accept · lookup-batch |
|
|
172
|
+
| `chat` | send · messages · replies · stop-tracking (Slack / Discord, via `--surface`) |
|
|
173
|
+
| `worklog` · `lookup` | append · resolve any id |
|
|
151
174
|
|
|
152
175
|
Notes on deliberate gaps (API-rooted, not CLI):
|
|
176
|
+
|
|
153
177
|
- **No `memory delete`** — the API exposes no hard DELETE; `memory archive` is the soft-delete path.
|
|
154
178
|
- **`memory revert`** needs `--text` + `--content` — the revert endpoint doesn't reconstruct a version's body from its number; pull them from `memory versions` / `memory get` first.
|
|
155
179
|
|
|
@@ -196,12 +220,12 @@ sechroom onboard --yes # non-interactive: defaults + global config
|
|
|
196
220
|
|
|
197
221
|
Per client → where it writes:
|
|
198
222
|
|
|
199
|
-
| client
|
|
200
|
-
|
|
201
|
-
| `claude-code`
|
|
223
|
+
| client | MCP config | instruction file |
|
|
224
|
+
| ---------------- | -------------------------------------- | --------------------- |
|
|
225
|
+
| `claude-code` | `./.mcp.json` | `./CLAUDE.md` |
|
|
202
226
|
| `claude-desktop` | `claude_desktop_config.json` (OS path) | `~/.claude/CLAUDE.md` |
|
|
203
|
-
| `codex`
|
|
204
|
-
| `cursor`
|
|
227
|
+
| `codex` | `~/.codex/config.toml` | `./AGENTS.md` |
|
|
228
|
+
| `cursor` | `./.cursor/mcp.json` | `./AGENTS.md` |
|
|
205
229
|
|
|
206
230
|
The instruction-file step pulls the role template the SEM Starter bundle ships
|
|
207
231
|
(via the descriptor's tag-query artifact). If that bundle isn't installed in the
|