@sechroom/cli 2026.7.2 → 2026.7.3

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync11 } from "fs";
 import { Command } from "commander";
 
 // src/auth.ts
@@ -1300,12 +1300,228 @@ workers your loop skills call (e.g. find-prior-art \u2192 substrate-miner).`
 }
 
 // src/commands/channel.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname4, join as join7 } from "path";
 import {
   HttpTransportType,
   HubConnectionBuilder
 } from "@microsoft/signalr";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+// src/commands/hook-install.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
+import { delimiter, dirname as dirname3, join as join6 } from "path";
+
+// src/setup/clients.ts
+import { existsSync as existsSync4 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname2, join as join5 } from "path";
+function claudeDesktopConfigPath(home) {
+  switch (process.platform) {
+    case "darwin":
+      return join5(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+    case "win32":
+      return join5(process.env.APPDATA ?? join5(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
+    default:
+      return join5(home, ".config", "Claude", "claude_desktop_config.json");
+  }
+}
+function clientTargets(cwd, opts = {}) {
+  const home = homedir3();
+  const claudeDir = opts.claudeDir ?? join5(home, ".claude");
+  const codexHome = opts.codexHome ?? join5(home, ".codex");
+  return {
+    "claude-code": {
+      key: "claude-code",
+      label: "Claude Code",
+      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join5(cwd, ".mcp.json"), format: "json" },
+      instruction: { surfaceKey: "claude-code", path: join5(cwd, "CLAUDE.md") }
+    },
+    "claude-desktop": {
+      key: "claude-desktop",
+      label: "Claude Desktop",
+      mcp: { surfaceKey: "claude-desktop", sectionType: SectionType.McpConfig, path: claudeDesktopConfigPath(home), format: "json" },
+      instruction: { surfaceKey: "claude-desktop", path: join5(claudeDir, "CLAUDE.md") }
+    },
+    codex: {
+      key: "codex",
+      label: "Codex CLI",
+      mcp: { surfaceKey: "chatgpt", sectionType: SectionType.McpConfigToml, path: join5(codexHome, "config.toml"), format: "toml" },
+      instruction: { surfaceKey: "chatgpt", path: join5(cwd, "AGENTS.md") }
+    },
+    cursor: {
+      key: "cursor",
+      label: "Cursor",
+      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join5(cwd, ".cursor", "mcp.json"), format: "json" },
+      instruction: { surfaceKey: "chatgpt", path: join5(cwd, "AGENTS.md") }
+    },
+    antigravity: {
+      key: "antigravity",
+      label: "Google Antigravity",
+      // FR-sechroom-247 — Antigravity reads MCP from a GLOBAL, home-relative
+      // `~/.gemini/config/mcp_config.json` (not cwd; not affected by
+      // CLAUDE_CONFIG_DIR / CODEX_HOME). The snippet — `serverUrl`-shaped, no
+      // `type` — comes from the `antigravity` server surface, so we don't
+      // hardcode it here. Instructions go in the project `AGENTS.md`
+      // (cross-tool, shared with Codex/Cursor).
+      mcp: { surfaceKey: "antigravity", sectionType: SectionType.McpConfig, path: join5(home, ".gemini", "config", "mcp_config.json"), format: "json" },
+      instruction: { surfaceKey: "antigravity", path: join5(cwd, "AGENTS.md") }
+    }
+  };
+}
+var ALL_CLIENT_KEYS = ["claude-code", "claude-desktop", "codex", "cursor", "antigravity"];
+var DEFAULT_CLIENT_KEY = "claude-code";
+function detectInstalledClients(cwd) {
+  const home = homedir3();
+  const detected = [];
+  if (resolveClaudeTargets({}).some((t) => existsSync4(t.dir))) detected.push("claude-code");
+  if (existsSync4(dirname2(claudeDesktopConfigPath(home)))) detected.push("claude-desktop");
+  if (resolveCodexHomes({}).some((d) => existsSync4(d))) detected.push("codex");
+  if (existsSync4(join5(home, ".cursor")) || existsSync4(join5(cwd, ".cursor"))) detected.push("cursor");
+  if (existsSync4(join5(home, ".gemini"))) detected.push("antigravity");
+  return detected;
+}
+
+// src/commands/hook-install.ts
+var CLAUDE_HOOK_COMMANDS = {
+  SessionStart: "sechroom hook session-start",
+  PreCompact: "sechroom hook pre-compact",
+  SessionEnd: "sechroom hook session-end",
+  // WLP telemetry tap (D-WLP-10) — per-turn executor self-report. No-op (exit 0) unless this
+  // checkout is bound to a decomposition+task via `sechroom telemetry bind`, so it's safe to wire
+  // for every Claude install. Claude-only (it parses a Claude Code transcript).
+  Stop: "sechroom telemetry hook"
+};
+var CODEX_HOOK_COMMANDS = {
+  SessionStart: "sechroom hook session-start",
+  Stop: "sechroom hook session-end --debounce-minutes 10"
+};
+function hasHookCommand(config2, event, command) {
+  const groups = config2.hooks?.[event] ?? [];
+  return groups.some((g) => (g.hooks ?? []).some((h) => h.type === "command" && h.command === command));
+}
+function mergeHooks(config2, commands) {
+  config2.hooks ??= {};
+  let added = 0;
+  for (const [event, command] of Object.entries(commands)) {
+    if (hasHookCommand(config2, event, command)) continue;
+    const groups = config2.hooks[event] ??= [];
+    groups.push({ hooks: [{ type: "command", command }] });
+    added += 1;
+  }
+  return added;
+}
+function readJsonConfig2(path) {
+  if (!existsSync5(path)) return {};
+  const raw = readFileSync3(path, "utf8");
+  if (!raw.trim()) return {};
+  return JSON.parse(raw);
+}
+function installHooksJson(path, commands, dryRun) {
+  const existed = existsSync5(path) && readFileSync3(path, "utf8").trim().length > 0;
+  const config2 = readJsonConfig2(path);
+  const added = mergeHooks(config2, commands);
+  if (added === 0 && existed) return { path, status: "current" };
+  if (!dryRun) {
+    mkdirSync4(dirname3(path), { recursive: true });
+    writeFileSync4(path, JSON.stringify(config2, null, 2) + "\n");
+  }
+  return { path, status: existed ? "merged" : "created" };
+}
+function installClaudeCommands(claudeDir, commands, dryRun) {
+  return installHooksJson(join6(claudeDir, "settings.json"), commands, dryRun);
+}
+function ensureCodexFeaturesHooks(content) {
+  const lines = content.split("\n");
+  const headerIdx = lines.findIndex((l) => l.trim() === "[features]");
+  if (headerIdx === -1) {
+    const base = content.length === 0 || content.endsWith("\n") ? content : content + "\n";
+    return { next: base + "\n[features]\nhooks = true\n", changed: true };
+  }
+  for (let i = headerIdx + 1; i < lines.length; i += 1) {
+    const trimmed = lines[i].trim();
+    if (trimmed.startsWith("[") && trimmed.endsWith("]")) break;
+    const m = lines[i].match(/^(\s*)hooks(\s*)=(\s*)(.*)$/);
+    if (!m) continue;
+    const value = m[4].replace(/\s*#.*$/, "").trim();
+    if (value === "true") return { next: content, changed: false };
+    lines[i] = `${m[1]}hooks${m[2]}=${m[3]}true`;
+    return { next: lines.join("\n"), changed: true };
+  }
+  lines.splice(headerIdx + 1, 0, "hooks = true");
+  return { next: lines.join("\n"), changed: true };
+}
+function installCodexFeatureFlag(path, dryRun) {
+  const existed = existsSync5(path);
+  const content = existed ? readFileSync3(path, "utf8") : "";
+  const { next, changed } = ensureCodexFeaturesHooks(content);
+  if (!changed) return { path, status: "current" };
+  if (!dryRun) {
+    mkdirSync4(dirname3(path), { recursive: true });
+    writeFileSync4(path, next);
+  }
+  return { path, status: existed ? "merged" : "created" };
+}
+function resolveSurfaces(surface, cwd) {
+  if (surface === "claude") return ["claude"];
+  if (surface === "codex") return ["codex"];
+  if (surface === "both") return ["claude", "codex"];
+  if (surface) throw new Error(`--surface must be one of claude | codex | both (got '${surface}')`);
+  const surfaces = detectHookSurfaces(cwd);
+  return surfaces.length > 0 ? surfaces : ["claude", "codex"];
+}
+function describe(result, dryRun) {
+  if (result.status === "current") return `  \u2713 ${result.path} (already configured)`;
+  const verb = dryRun ? "would" : result.status === "created" ? "created" : "updated";
+  return `  \u2713 ${result.path} (${dryRun ? `${verb} ${result.status === "created" ? "create" : "update"}` : verb})`;
+}
+var HOOK_SURFACE_LABEL = {
+  claude: "Claude Code",
+  codex: "Codex"
+};
+function installHookSurfaces(surfaces, opts) {
+  const out = [];
+  for (const surface of surfaces) {
+    if (surface === "claude") {
+      const path = join6(opts.claudeDir, "settings.json");
+      out.push({ surface, results: [installHooksJson(path, CLAUDE_HOOK_COMMANDS, opts.dryRun)] });
+    } else {
+      const hooksJson = installHooksJson(join6(opts.codexHome, "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
+      const featureFlag = installCodexFeatureFlag(join6(opts.codexHome, "config.toml"), opts.dryRun);
+      out.push({ surface, results: [hooksJson, featureFlag] });
+    }
+  }
+  return out;
+}
+function detectHookSurfaces(cwd) {
+  const detected = detectInstalledClients(cwd);
+  const surfaces = [];
+  if (detected.includes("claude-code")) surfaces.push("claude");
+  if (detected.includes("codex")) surfaces.push("codex");
+  return surfaces;
+}
+function isSechroomOnPath() {
+  const pathEnv = process.env.PATH ?? "";
+  if (!pathEnv) return false;
+  const names = process.platform === "win32" ? ["sechroom.cmd", "sechroom.exe", "sechroom.bat", "sechroom"] : ["sechroom"];
+  for (const dir of pathEnv.split(delimiter)) {
+    if (!dir) continue;
+    for (const name of names) {
+      if (existsSync5(join6(dir, name))) return true;
+    }
+  }
+  return false;
+}
+function warnIfSechroomNotOnPath(write = (s) => void process.stderr.write(s)) {
+  if (isSechroomOnPath()) return false;
+  write(
+    "\n\u26A0  `sechroom` isn't on your PATH. The hooks run a bare `sechroom hook \u2026` command\n   when your agent fires them, so a non-global install (npx / local) will fail at\n   that point. Install globally so the command resolves:\n     npm i -g @sechroom/cli\n"
+  );
+  return true;
+}
+
+// src/commands/channel.ts
 function registerChannel(program2) {
   const channel = program2.command("channel").description(
     "Receive matched substrate events over the held SignalR push leg (D-WLP-9)"
@@ -1387,6 +1603,52 @@ function registerChannel(program2) {
     );
     await holdOpen(conn);
   });
+  channel.command("install").description(
+    "Wire `sechroom channel mcp` into the project .mcp.json as a Claude Code channel MCP server (idempotent)"
+  ).option("--workspace <wsp...>", "Restrict dispatches to these workspace id(s)").option(
+    "--tag <tag...>",
+    "Tag(s) a dispatch must carry to match (repeatable). Default targets WLP task dispatches.",
+    ["kind:task"]
+  ).option(
+    "--name <name>",
+    "MCP server + subscription name (idempotent per name)",
+    "sechroom-channel"
+  ).option("--dry-run", "Print what would change; write nothing").action((opts) => {
+    const path = join7(process.cwd(), ".mcp.json");
+    const dryRun = Boolean(opts.dryRun);
+    const args = ["channel", "mcp", "--name", opts.name];
+    for (const w of opts.workspace ?? [])
+      args.push("--workspace", w);
+    for (const t of opts.tag ?? []) args.push("--tag", t);
+    const entry = { command: "sechroom", args };
+    const config2 = readMcpConfig(path);
+    config2.mcpServers ??= {};
+    const existing = config2.mcpServers[opts.name];
+    const status = JSON.stringify(existing) === JSON.stringify(entry) ? "current" : existing ? "updated" : "created";
+    if (status !== "current" && !dryRun) {
+      config2.mcpServers[opts.name] = entry;
+      mkdirSync5(dirname4(path), { recursive: true });
+      writeFileSync5(path, JSON.stringify(config2, null, 2) + "\n");
+    }
+    const verb = status === "current" ? "already configured" : dryRun ? `would ${status === "created" ? "create" : "update"}` : status;
+    process.stdout.write(`${style.green("channel")} ${path} (${verb})
+`);
+    process.stdout.write(
+      style.dim(`  server "${opts.name}": sechroom ${args.join(" ")}
+`)
+    );
+    if (status !== "current") {
+      process.stdout.write(
+        style.dim(
+          `
+Load it (Channels research preview) by launching your agent with:
+  claude --dangerously-load-development-channels server:${opts.name}
+`
+        )
+      );
+    }
+    warnIfSechroomNotOnPath();
+  });
   channel.addHelpText(
     "after",
     `
@@ -1395,11 +1657,23 @@ Examples:
   $ sechroom channel connect --tag kind:task --tag status:in-progress
   $ sechroom channel connect --workspace wsp_X --json | jq .
 
-  # As a Claude Code channel (research preview, v2.1.80+):
-  #   add to .mcp.json:  { "mcpServers": { "sechroom": { "command": "npx", "args": ["@sechroom/cli", "channel", "mcp"] } } }
-  #   then:  claude --dangerously-load-development-channels server:sechroom`
+  # Wire it as a Claude Code channel MCP server (research preview, v2.1.80+):
+  $ sechroom channel install --workspace wsp_X --tag kind:task --tag status:in-progress
+  #   then:  claude --dangerously-load-development-channels server:sechroom-channel`
   );
 }
+function readMcpConfig(path) {
+  if (!existsSync6(path)) return {};
+  const raw = readFileSync4(path, "utf8");
+  if (!raw.trim()) return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return fail(
+      `Could not parse ${path} as JSON \u2014 fix or remove it before installing the channel.`
+    );
+  }
+}
 function readFilter(opts) {
   const tags = opts.tag ?? [];
   const workspaceScope = opts.workspace ?? [];
@@ -1560,28 +1834,28 @@ Examples:
 }
 
 // src/commands/checkpoint.ts
-import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname6, join as join9 } from "path";
+import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname7, join as join10 } from "path";
 
 // src/commands/hook.ts
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync5, statSync as statSync2, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname5, join as join8 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync6, statSync as statSync2, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname6, join as join9 } from "path";
 
 // src/sem.ts
-import { dirname as dirname2, join as join5 } from "path";
-import { appendFileSync, existsSync as existsSync4, mkdirSync as mkdirSync4, readdirSync, readFileSync as readFileSync3, statSync, writeFileSync as writeFileSync4 } from "fs";
-var SEM_FILE = join5(".sechroom", "lane.json");
+import { dirname as dirname5, join as join8 } from "path";
+import { appendFileSync, existsSync as existsSync7, mkdirSync as mkdirSync6, readdirSync, readFileSync as readFileSync5, statSync, writeFileSync as writeFileSync6 } from "fs";
+var SEM_FILE = join8(".sechroom", "lane.json");
 var STATE_DIR_NAME2 = ".sechroom";
 function localSemPath(cwd = process.cwd()) {
-  return join5(cwd, SEM_FILE);
+  return join8(cwd, SEM_FILE);
 }
 function resolveSemPathForRead(start = process.cwd()) {
   let dir = start;
   while (true) {
-    const candidate = join5(dir, SEM_FILE);
-    if (existsSync4(candidate)) return candidate;
-    const parent = dirname2(dir);
+    const candidate = join8(dir, SEM_FILE);
+    if (existsSync7(candidate)) return candidate;
+    const parent = dirname5(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
@@ -1591,23 +1865,23 @@ function applyWorktreeLaneSuffix(lane, start = process.cwd()) {
     let dir = start;
     let gitPath;
     for (; ; ) {
-      const candidate = join5(dir, ".git");
-      if (existsSync4(candidate)) {
+      const candidate = join8(dir, ".git");
+      if (existsSync7(candidate)) {
         gitPath = candidate;
         break;
       }
-      const parent = dirname2(dir);
+      const parent = dirname5(dir);
       if (parent === dir) break;
       dir = parent;
     }
     if (!gitPath || statSync(gitPath).isDirectory()) return lane;
-    const gitFile = readFileSync3(gitPath, "utf8");
+    const gitFile = readFileSync5(gitPath, "utf8");
     const common = gitFile.trim().match(/^gitdir:\s*(.+)\/worktrees\/[^/\s]+\s*$/);
     if (!common) return lane;
-    const worktreesDir = join5(common[1], "worktrees");
+    const worktreesDir = join8(common[1], "worktrees");
     const siblings = readdirSync(worktreesDir).filter((n) => {
       try {
-        return statSync(join5(worktreesDir, n)).isDirectory();
+        return statSync(join8(worktreesDir, n)).isDirectory();
       } catch {
         return false;
       }
@@ -1628,12 +1902,12 @@ function serializeSem(values) {
 }
 function readSem(path) {
   const p = path ?? resolveSemPathForRead();
-  if (!p || !existsSync4(p)) return void 0;
-  return { path: p, values: parseLaneJson(readFileSync3(p, "utf8")) };
+  if (!p || !existsSync7(p)) return void 0;
+  return { path: p, values: parseLaneJson(readFileSync5(p, "utf8")) };
 }
 function readLocalSemValues(cwd = process.cwd()) {
-  const next = join5(cwd, SEM_FILE);
-  if (existsSync4(next)) return readSem(next)?.values ?? {};
+  const next = join8(cwd, SEM_FILE);
+  if (existsSync7(next)) return readSem(next)?.values ?? {};
   return {};
 }
 function parseLaneJson(text2) {
@@ -1650,8 +1924,8 @@ function parseLaneJson(text2) {
 }
 var STATE_DIR_IGNORE = `${STATE_DIR_NAME2}/`;
 function writeSem(values, path = localSemPath()) {
-  mkdirSync4(dirname2(path), { recursive: true });
-  writeFileSync4(path, serializeSem(values));
+  mkdirSync6(dirname5(path), { recursive: true });
+  writeFileSync6(path, serializeSem(values));
   ensureSemIgnored(path);
   ensureContinuityScaffold(path);
   return path;
@@ -1678,9 +1952,9 @@ var CONTINUITY_SCAFFOLD = JSON.stringify(
 ) + "\n";
 function ensureContinuityScaffold(semPath) {
   try {
-    const target = join5(dirname2(semPath), CONTINUITY_FILE_NAME);
-    if (existsSync4(target)) return;
-    writeFileSync4(target, CONTINUITY_SCAFFOLD);
+    const target = join8(dirname5(semPath), CONTINUITY_FILE_NAME);
+    if (existsSync7(target)) return;
+    writeFileSync6(target, CONTINUITY_SCAFFOLD);
   } catch {
   }
 }
@@ -1693,8 +1967,8 @@ function ignoresSem(content) {
 function inGitRepo(startDir) {
   let dir = startDir;
   for (; ; ) {
-    if (existsSync4(join5(dir, ".git"))) return true;
-    const parent = dirname2(dir);
+    if (existsSync7(join8(dir, ".git"))) return true;
+    const parent = dirname5(dir);
     if (parent === dir) return false;
     dir = parent;
   }
@@ -1702,246 +1976,34 @@ function inGitRepo(startDir) {
 function resolveGitignoreTarget(startDir) {
   let dir = startDir;
   for (; ; ) {
-    const gi = join5(dir, ".gitignore");
-    if (existsSync4(gi)) return { path: gi, exists: true };
-    const parent = dirname2(dir);
-    if (existsSync4(join5(dir, ".git")) || parent === dir) {
-      return { path: join5(startDir, ".gitignore"), exists: false };
+    const gi = join8(dir, ".gitignore");
+    if (existsSync7(gi)) return { path: gi, exists: true };
+    const parent = dirname5(dir);
+    if (existsSync7(join8(dir, ".git")) || parent === dir) {
+      return { path: join8(startDir, ".gitignore"), exists: false };
     }
     dir = parent;
   }
 }
 function ensureSemIgnored(semPath) {
   try {
-    const checkoutDir = dirname2(dirname2(semPath));
+    const checkoutDir = dirname5(dirname5(semPath));
     if (!inGitRepo(checkoutDir)) return;
     const target = resolveGitignoreTarget(checkoutDir);
     if (target.exists) {
-      const content = readFileSync3(target.path, "utf8");
+      const content = readFileSync5(target.path, "utf8");
       if (ignoresSem(content)) return;
       const sep = content.length === 0 || content.endsWith("\n") ? "" : "\n";
       appendFileSync(target.path, `${sep}${STATE_DIR_IGNORE}
 `);
     } else {
-      writeFileSync4(target.path, `${STATE_DIR_IGNORE}
+      writeFileSync6(target.path, `${STATE_DIR_IGNORE}
 `);
     }
   } catch {
   }
 }
 
-// src/commands/hook-install.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
-import { delimiter, dirname as dirname4, join as join7 } from "path";
-
-// src/setup/clients.ts
-import { existsSync as existsSync5 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname3, join as join6 } from "path";
-function claudeDesktopConfigPath(home) {
-  switch (process.platform) {
-    case "darwin":
-      return join6(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
-    case "win32":
-      return join6(process.env.APPDATA ?? join6(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
-    default:
-      return join6(home, ".config", "Claude", "claude_desktop_config.json");
-  }
-}
-function clientTargets(cwd, opts = {}) {
-  const home = homedir3();
-  const claudeDir = opts.claudeDir ?? join6(home, ".claude");
-  const codexHome = opts.codexHome ?? join6(home, ".codex");
-  return {
-    "claude-code": {
-      key: "claude-code",
-      label: "Claude Code",
-      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join6(cwd, ".mcp.json"), format: "json" },
-      instruction: { surfaceKey: "claude-code", path: join6(cwd, "CLAUDE.md") }
-    },
-    "claude-desktop": {
-      key: "claude-desktop",
-      label: "Claude Desktop",
-      mcp: { surfaceKey: "claude-desktop", sectionType: SectionType.McpConfig, path: claudeDesktopConfigPath(home), format: "json" },
-      instruction: { surfaceKey: "claude-desktop", path: join6(claudeDir, "CLAUDE.md") }
-    },
-    codex: {
-      key: "codex",
-      label: "Codex CLI",
-      mcp: { surfaceKey: "chatgpt", sectionType: SectionType.McpConfigToml, path: join6(codexHome, "config.toml"), format: "toml" },
-      instruction: { surfaceKey: "chatgpt", path: join6(cwd, "AGENTS.md") }
-    },
-    cursor: {
-      key: "cursor",
-      label: "Cursor",
-      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join6(cwd, ".cursor", "mcp.json"), format: "json" },
-      instruction: { surfaceKey: "chatgpt", path: join6(cwd, "AGENTS.md") }
-    },
-    antigravity: {
-      key: "antigravity",
-      label: "Google Antigravity",
-      // FR-sechroom-247 — Antigravity reads MCP from a GLOBAL, home-relative
-      // `~/.gemini/config/mcp_config.json` (not cwd; not affected by
-      // CLAUDE_CONFIG_DIR / CODEX_HOME). The snippet — `serverUrl`-shaped, no
-      // `type` — comes from the `antigravity` server surface, so we don't
-      // hardcode it here. Instructions go in the project `AGENTS.md`
-      // (cross-tool, shared with Codex/Cursor).
-      mcp: { surfaceKey: "antigravity", sectionType: SectionType.McpConfig, path: join6(home, ".gemini", "config", "mcp_config.json"), format: "json" },
-      instruction: { surfaceKey: "antigravity", path: join6(cwd, "AGENTS.md") }
-    }
-  };
-}
-var ALL_CLIENT_KEYS = ["claude-code", "claude-desktop", "codex", "cursor", "antigravity"];
-var DEFAULT_CLIENT_KEY = "claude-code";
-function detectInstalledClients(cwd) {
-  const home = homedir3();
-  const detected = [];
-  if (resolveClaudeTargets({}).some((t) => existsSync5(t.dir))) detected.push("claude-code");
-  if (existsSync5(dirname3(claudeDesktopConfigPath(home)))) detected.push("claude-desktop");
-  if (resolveCodexHomes({}).some((d) => existsSync5(d))) detected.push("codex");
-  if (existsSync5(join6(home, ".cursor")) || existsSync5(join6(cwd, ".cursor"))) detected.push("cursor");
-  if (existsSync5(join6(home, ".gemini"))) detected.push("antigravity");
-  return detected;
-}
-
-// src/commands/hook-install.ts
-var CLAUDE_HOOK_COMMANDS = {
-  SessionStart: "sechroom hook session-start",
-  PreCompact: "sechroom hook pre-compact",
-  SessionEnd: "sechroom hook session-end",
-  // WLP telemetry tap (D-WLP-10) — per-turn executor self-report. No-op (exit 0) unless this
-  // checkout is bound to a decomposition+task via `sechroom telemetry bind`, so it's safe to wire
-  // for every Claude install. Claude-only (it parses a Claude Code transcript).
-  Stop: "sechroom telemetry hook"
-};
-var CODEX_HOOK_COMMANDS = {
-  SessionStart: "sechroom hook session-start",
-  Stop: "sechroom hook session-end --debounce-minutes 10"
-};
-function hasHookCommand(config2, event, command) {
-  const groups = config2.hooks?.[event] ?? [];
-  return groups.some((g) => (g.hooks ?? []).some((h) => h.type === "command" && h.command === command));
-}
-function mergeHooks(config2, commands) {
-  config2.hooks ??= {};
-  let added = 0;
-  for (const [event, command] of Object.entries(commands)) {
-    if (hasHookCommand(config2, event, command)) continue;
-    const groups = config2.hooks[event] ??= [];
-    groups.push({ hooks: [{ type: "command", command }] });
-    added += 1;
-  }
-  return added;
-}
-function readJsonConfig2(path) {
-  if (!existsSync6(path)) return {};
-  const raw = readFileSync4(path, "utf8");
-  if (!raw.trim()) return {};
-  return JSON.parse(raw);
-}
-function installHooksJson(path, commands, dryRun) {
-  const existed = existsSync6(path) && readFileSync4(path, "utf8").trim().length > 0;
-  const config2 = readJsonConfig2(path);
-  const added = mergeHooks(config2, commands);
-  if (added === 0 && existed) return { path, status: "current" };
-  if (!dryRun) {
-    mkdirSync5(dirname4(path), { recursive: true });
-    writeFileSync5(path, JSON.stringify(config2, null, 2) + "\n");
-  }
-  return { path, status: existed ? "merged" : "created" };
-}
-function installClaudeCommands(claudeDir, commands, dryRun) {
-  return installHooksJson(join7(claudeDir, "settings.json"), commands, dryRun);
-}
-function ensureCodexFeaturesHooks(content) {
-  const lines = content.split("\n");
-  const headerIdx = lines.findIndex((l) => l.trim() === "[features]");
-  if (headerIdx === -1) {
-    const base = content.length === 0 || content.endsWith("\n") ? content : content + "\n";
-    return { next: base + "\n[features]\nhooks = true\n", changed: true };
-  }
-  for (let i = headerIdx + 1; i < lines.length; i += 1) {
-    const trimmed = lines[i].trim();
-    if (trimmed.startsWith("[") && trimmed.endsWith("]")) break;
-    const m = lines[i].match(/^(\s*)hooks(\s*)=(\s*)(.*)$/);
-    if (!m) continue;
-    const value = m[4].replace(/\s*#.*$/, "").trim();
-    if (value === "true") return { next: content, changed: false };
-    lines[i] = `${m[1]}hooks${m[2]}=${m[3]}true`;
-    return { next: lines.join("\n"), changed: true };
-  }
-  lines.splice(headerIdx + 1, 0, "hooks = true");
-  return { next: lines.join("\n"), changed: true };
-}
-function installCodexFeatureFlag(path, dryRun) {
-  const existed = existsSync6(path);
-  const content = existed ? readFileSync4(path, "utf8") : "";
-  const { next, changed } = ensureCodexFeaturesHooks(content);
-  if (!changed) return { path, status: "current" };
-  if (!dryRun) {
-    mkdirSync5(dirname4(path), { recursive: true });
-    writeFileSync5(path, next);
-  }
-  return { path, status: existed ? "merged" : "created" };
-}
-function resolveSurfaces(surface, cwd) {
-  if (surface === "claude") return ["claude"];
-  if (surface === "codex") return ["codex"];
-  if (surface === "both") return ["claude", "codex"];
-  if (surface) throw new Error(`--surface must be one of claude | codex | both (got '${surface}')`);
-  const surfaces = detectHookSurfaces(cwd);
-  return surfaces.length > 0 ? surfaces : ["claude", "codex"];
-}
-function describe(result, dryRun) {
-  if (result.status === "current") return `  \u2713 ${result.path} (already configured)`;
-  const verb = dryRun ? "would" : result.status === "created" ? "created" : "updated";
-  return `  \u2713 ${result.path} (${dryRun ? `${verb} ${result.status === "created" ? "create" : "update"}` : verb})`;
-}
-var HOOK_SURFACE_LABEL = {
-  claude: "Claude Code",
-  codex: "Codex"
-};
-function installHookSurfaces(surfaces, opts) {
-  const out = [];
-  for (const surface of surfaces) {
-    if (surface === "claude") {
-      const path = join7(opts.claudeDir, "settings.json");
-      out.push({ surface, results: [installHooksJson(path, CLAUDE_HOOK_COMMANDS, opts.dryRun)] });
-    } else {
-      const hooksJson = installHooksJson(join7(opts.codexHome, "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
-      const featureFlag = installCodexFeatureFlag(join7(opts.codexHome, "config.toml"), opts.dryRun);
-      out.push({ surface, results: [hooksJson, featureFlag] });
-    }
-  }
-  return out;
-}
-function detectHookSurfaces(cwd) {
-  const detected = detectInstalledClients(cwd);
-  const surfaces = [];
-  if (detected.includes("claude-code")) surfaces.push("claude");
-  if (detected.includes("codex")) surfaces.push("codex");
-  return surfaces;
-}
-function isSechroomOnPath() {
-  const pathEnv = process.env.PATH ?? "";
-  if (!pathEnv) return false;
-  const names = process.platform === "win32" ? ["sechroom.cmd", "sechroom.exe", "sechroom.bat", "sechroom"] : ["sechroom"];
-  for (const dir of pathEnv.split(delimiter)) {
-    if (!dir) continue;
-    for (const name of names) {
-      if (existsSync6(join7(dir, name))) return true;
-    }
-  }
-  return false;
-}
-function warnIfSechroomNotOnPath(write = (s) => void process.stderr.write(s)) {
-  if (isSechroomOnPath()) return false;
-  write(
-    "\n\u26A0  `sechroom` isn't on your PATH. The hooks run a bare `sechroom hook \u2026` command\n   when your agent fires them, so a non-global install (npx / local) will fail at\n   that point. Install globally so the command resolves:\n     npm i -g @sechroom/cli\n"
-  );
-  return true;
-}
-
 // src/commands/hook.ts
 async function readStdin() {
   if (process.stdin.isTTY) return "";
@@ -1966,13 +2028,13 @@ function resolveLane(flagLane, cwd) {
   if (!base) return void 0;
   return applyWorktreeLaneSuffix(base, start);
 }
-var INTENT_FILE = join8(".sechroom", "continuity.json");
+var INTENT_FILE = join9(".sechroom", "continuity.json");
 function resolveIntentPath(start) {
   let dir = start;
   for (; ; ) {
-    const candidate = join8(dir, INTENT_FILE);
-    if (existsSync7(candidate)) return candidate;
-    const parent = dirname5(dir);
+    const candidate = join9(dir, INTENT_FILE);
+    if (existsSync8(candidate)) return candidate;
+    const parent = dirname6(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
@@ -1981,7 +2043,7 @@ function readIntent(start) {
   const path = resolveIntentPath(start);
   if (!path) return void 0;
   try {
-    return JSON.parse(readFileSync5(path, "utf8"));
+    return JSON.parse(readFileSync6(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -2023,14 +2085,14 @@ async function saveSnapshotFromIntent(cmd, cwd, laneFlag, scopeFlag, defaultScop
 }
 function ledgerPath(start) {
   const intent = resolveIntentPath(start);
-  const dir = intent ? dirname5(intent) : join8(start, ".sechroom");
-  return join8(dir, ".checkpoint-state.json");
+  const dir = intent ? dirname6(intent) : join9(start, ".sechroom");
+  return join9(dir, ".checkpoint-state.json");
 }
 function readLedger(start) {
   try {
     const p = ledgerPath(start);
-    if (!existsSync7(p)) return {};
-    return JSON.parse(readFileSync5(p, "utf8"));
+    if (!existsSync8(p)) return {};
+    return JSON.parse(readFileSync6(p, "utf8"));
   } catch {
     return {};
   }
@@ -2077,13 +2139,13 @@ function recordPush(start, intent) {
     } catch {
       mtimeMs = void 0;
     }
-    mkdirSync6(dirname5(p), { recursive: true });
+    mkdirSync7(dirname6(p), { recursive: true });
     const ledger = {
       lastEpochMs: Date.now(),
       lastMtimeMs: mtimeMs,
       lastHash: intentHash(intent)
     };
-    writeFileSync6(p, JSON.stringify(ledger) + "\n");
+    writeFileSync7(p, JSON.stringify(ledger) + "\n");
   } catch {
   }
 }
@@ -2330,10 +2392,10 @@ Examples:
       const client = await makeClient(cfg);
       return client.POST("/continuity/snapshots", { body });
     });
-    const path = resolveIntentPath(cwd) ?? join9(cwd, INTENT_FILE);
+    const path = resolveIntentPath(cwd) ?? join10(cwd, INTENT_FILE);
     const fileBody = { ...merged, scope, lastSnapshotId: data.snapshotId };
-    mkdirSync7(dirname6(path), { recursive: true });
-    writeFileSync7(path, JSON.stringify(fileBody, null, 2) + "\n");
+    mkdirSync8(dirname7(path), { recursive: true });
+    writeFileSync8(path, JSON.stringify(fileBody, null, 2) + "\n");
     recordPush(cwd, merged);
     if (json) {
       emit({ snapshotId: data.snapshotId, lane, scope, file: path }, true);
@@ -3017,8 +3079,8 @@ Examples:
 
 // src/setup/apply.ts
 import { createHash as createHash3 } from "crypto";
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync8, existsSync as existsSync8 } from "fs";
-import { dirname as dirname7 } from "path";
+import { mkdirSync as mkdirSync9, readFileSync as readFileSync7, writeFileSync as writeFileSync9, existsSync as existsSync9 } from "fs";
+import { dirname as dirname8 } from "path";
 var MARKER_BEGIN = "<!-- @sechroom/cli:begin";
 var MARKER_END = "<!-- @sechroom/cli:end";
 function normalizeBody(s) {
@@ -3071,22 +3133,22 @@ function parseManagedBlock(content, block) {
   return null;
 }
 function ensureDir2(path) {
-  mkdirSync8(dirname7(path), { recursive: true });
+  mkdirSync9(dirname8(path), { recursive: true });
 }
 function readOr(path, fallback) {
   try {
-    return readFileSync6(path, "utf8");
+    return readFileSync7(path, "utf8");
   } catch {
     return fallback;
   }
 }
 function mergeMcpJson(path, snippet, dryRun) {
   const incoming = JSON.parse(snippet);
-  const existed = existsSync8(path);
+  const existed = existsSync9(path);
   let current = {};
   if (existed) {
     try {
-      current = JSON.parse(readFileSync6(path, "utf8"));
+      current = JSON.parse(readFileSync7(path, "utf8"));
     } catch {
       return { kind: "mcp", path, status: "skipped", note: "existing file isn't valid JSON \u2014 left untouched" };
     }
@@ -3094,26 +3156,26 @@ function mergeMcpJson(path, snippet, dryRun) {
   current.mcpServers = { ...current.mcpServers ?? {}, ...incoming.mcpServers ?? {} };
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync8(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
+  writeFileSync9(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function mergeCodexToml(path, snippet, dryRun) {
-  const existed = existsSync8(path);
+  const existed = existsSync9(path);
   let body = readOr(path, "");
   body = body.replace(/(^|\n)\[mcp_servers\.sechroom\][^[]*/, "\n").replace(/\n{3,}/g, "\n\n");
   const trimmed = body.trim();
   const next = (trimmed.length > 0 ? trimmed + "\n\n" : "") + snippet.trim() + "\n";
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync8(path, next, { mode: 384 });
+  writeFileSync9(path, next, { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function writeInstructionBlock(path, write, dryRun) {
-  const existed = existsSync8(path);
+  const existed = existsSync9(path);
   const next = computeBlockFile(readOr(path, ""), write);
   if (dryRun) return { kind: "instruction", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync8(path, next);
+  writeFileSync9(path, next);
   return { kind: "instruction", path, status: existed ? "merged" : "created" };
 }
 function computeBlockFile(current, write) {
@@ -3154,7 +3216,7 @@ function applyBlock(path, write, mode, dryRun) {
     const next = computeBlockFile(current, write);
     if (!dryRun) {
       ensureDir2(proposedPath);
-      writeFileSync8(proposedPath, next);
+      writeFileSync9(proposedPath, next);
     }
     return {
       kind: "instruction",
@@ -3284,8 +3346,8 @@ auto-resumes where you left off and checkpoints working state before compacting.
 }
 
 // src/setup/skills-offer.ts
-import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "fs";
-import { join as join10 } from "path";
+import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
+import { join as join11 } from "path";
 
 // src/setup/lane-pin.ts
 var CODE_LANE_PREFIX_BY_CLIENT = {
@@ -3401,8 +3463,8 @@ Found ${summary} available to you for ${surface}.
   if (skills.length > 0) {
     const written = [];
     for (const s of skills) {
-      mkdirSync9(join10(sDir, s.name), { recursive: true });
-      writeFileSync9(join10(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
+      mkdirSync10(join11(sDir, s.name), { recursive: true });
+      writeFileSync10(join11(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
       written.push(s.name);
     }
     recordMaterialisedSkills(sDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -3410,11 +3472,11 @@ Found ${summary} available to you for ${surface}.
 `);
   }
   if (agents.length > 0) {
-    mkdirSync9(aDir, { recursive: true });
+    mkdirSync10(aDir, { recursive: true });
     const written = [];
     for (const a of agents) {
       const file = `${a.name}.md`;
-      writeFileSync9(join10(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
+      writeFileSync10(join11(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
       written.push(file);
     }
     recordMaterialisedSkills(aDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -3797,13 +3859,13 @@ Wired to namespace '${slug}'. Restart your AI client (or reload MCP) to pick it
 }
 
 // src/commands/onboard.ts
-import { existsSync as existsSync10 } from "fs";
-import { basename as basename2, join as join12 } from "path";
+import { existsSync as existsSync11 } from "fs";
+import { basename as basename2, join as join13 } from "path";
 
 // src/commands/fanout.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync9, readFileSync as readFileSync7, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
-import { isAbsolute, join as join11, resolve } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync8, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
+import { isAbsolute, join as join12, resolve } from "path";
 var ICON = {
   refresh: "\u21BB",
   bind: "+",
@@ -3823,21 +3885,21 @@ function discoverChildren(root) {
   const out = [];
   for (const name of names.sort()) {
     if (name.startsWith(".") || name === "node_modules") continue;
-    const dir = join11(root, name);
+    const dir = join12(root, name);
     try {
       if (!statSync3(dir).isDirectory()) continue;
     } catch {
       continue;
     }
-    if (existsSync9(join11(dir, ".git")) || committedBindingPath(dir)) out.push(name);
+    if (existsSync10(join12(dir, ".git")) || committedBindingPath(dir)) out.push(name);
   }
   return out;
 }
 function readManifest(path) {
-  if (!existsSync9(path)) return null;
+  if (!existsSync10(path)) return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync7(path, "utf8"));
+    parsed = JSON.parse(readFileSync8(path, "utf8"));
   } catch (err2) {
     throw new Error(`couldn't parse ${path}: ${err2 instanceof Error ? err2.message : String(err2)}`);
   }
@@ -4203,10 +4265,10 @@ async function chooseScope(scopeFlag, yes) {
 }
 async function planRecurseChild(entry, root, client, opts) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync10(dir)) {
+  if (!existsSync11(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
-  if (existsSync10(join12(dir, ".sechroom.json"))) {
+  if (existsSync11(join13(dir, ".sechroom.json"))) {
     return {
       label: entry.path,
       dir,
@@ -4279,7 +4341,7 @@ This fan-out will pin the same lane in every repo:
 async function runRecurse(cfg, g, opts) {
   const { yes, dryRun, json } = opts;
   const root = process.cwd();
-  const manifestPath = join12(root, ".sechroom", "repos.json");
+  const manifestPath = join13(root, ".sechroom", "repos.json");
   const fromManifest = readManifest(manifestPath);
   const entries = fromManifest ?? discoverChildren(root).map((path) => ({ path }));
   const sourceLabel = fromManifest ? `manifest ${manifestPath}` : `auto-discovered under ${root}`;
@@ -4791,23 +4853,23 @@ Examples:
 
 // src/commands/reset.ts
 import { homedir as homedir4 } from "os";
-import { join as join13 } from "path";
-import { existsSync as existsSync11, readFileSync as readFileSync8, rmSync as rmSync3 } from "fs";
+import { join as join14 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync9, rmSync as rmSync3 } from "fs";
 var SKILLS_LOCK2 = ".sechroom-skills.json";
-var localSkillsDir = () => join13(process.cwd(), ".claude", "skills");
-var globalSkillsDir = () => join13(homedir4(), ".claude", "skills");
-var localAgentsDir = () => join13(process.cwd(), ".claude", "agents");
-var globalAgentsDir = () => join13(homedir4(), ".claude", "agents");
+var localSkillsDir = () => join14(process.cwd(), ".claude", "skills");
+var globalSkillsDir = () => join14(homedir4(), ".claude", "skills");
+var localAgentsDir = () => join14(process.cwd(), ".claude", "agents");
+var globalAgentsDir = () => join14(homedir4(), ".claude", "agents");
 function removeMaterialisedSkills(dir) {
   const removed = [];
-  const lockPath = join13(dir, SKILLS_LOCK2);
-  if (!existsSync11(lockPath)) return removed;
+  const lockPath = join14(dir, SKILLS_LOCK2);
+  if (!existsSync12(lockPath)) return removed;
   try {
-    const lock = JSON.parse(readFileSync8(lockPath, "utf8"));
+    const lock = JSON.parse(readFileSync9(lockPath, "utf8"));
     for (const entry of Object.values(lock)) {
       for (const name of entry.skills ?? []) {
-        const p = join13(dir, name);
-        if (existsSync11(p)) {
+        const p = join14(dir, name);
+        if (existsSync12(p)) {
           rmSync3(p, { recursive: true, force: true });
           removed.push(p);
         }
@@ -4852,18 +4914,18 @@ function registerReset(program2) {
       }
     }
     const removed = [];
-    const stateDir = join13(process.cwd(), ".sechroom");
-    if (existsSync11(stateDir)) {
+    const stateDir = join14(process.cwd(), ".sechroom");
+    if (existsSync12(stateDir)) {
       rmSync3(stateDir, { recursive: true, force: true });
       removed.push(stateDir);
     }
-    const legacyCfg = join13(process.cwd(), ".sechroom.json");
-    if (existsSync11(legacyCfg)) {
+    const legacyCfg = join14(process.cwd(), ".sechroom.json");
+    if (existsSync12(legacyCfg)) {
       rmSync3(legacyCfg, { force: true });
       removed.push(legacyCfg);
     }
-    const legacySem = join13(process.cwd(), ".sem");
-    if (existsSync11(legacySem)) {
+    const legacySem = join14(process.cwd(), ".sem");
+    if (existsSync12(legacySem)) {
       rmSync3(legacySem, { force: true });
       removed.push(legacySem);
     }
@@ -4889,8 +4951,8 @@ function registerReset(program2) {
 }
 
 // src/commands/skills.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync10, statSync as statSync4, writeFileSync as writeFileSync10 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync11, statSync as statSync4, writeFileSync as writeFileSync11 } from "fs";
+import { join as join15 } from "path";
 function filenameFromDisposition(header) {
   if (!header) return void 0;
   const m = /filename\*?=(?:UTF-8'')?"?([^";]+)"?/i.exec(header);
@@ -4898,11 +4960,11 @@ function filenameFromDisposition(header) {
 }
 function resolveOutputPath(output, serverFilename) {
   const filename = serverFilename || "skills.zip";
-  if (!output) return join14(process.cwd(), filename);
-  const looksLikeDir = output.endsWith("/") || existsSync12(output) && statSync4(output).isDirectory();
+  if (!output) return join15(process.cwd(), filename);
+  const looksLikeDir = output.endsWith("/") || existsSync13(output) && statSync4(output).isDirectory();
   if (looksLikeDir) {
-    mkdirSync10(output, { recursive: true });
-    return join14(output, filename);
+    mkdirSync11(output, { recursive: true });
+    return join15(output, filename);
   }
   return output;
 }
@@ -4933,7 +4995,7 @@ async function downloadZip(label, call, output) {
   const buf = Buffer.from(res.data);
   const filename = filenameFromDisposition(res.response.headers.get("content-disposition")) ?? "skills.zip";
   const path = resolveOutputPath(output, filename);
-  writeFileSync10(path, buf);
+  writeFileSync11(path, buf);
   return { path, bytes: buf.length, filename };
 }
 function registerSkills(program2) {
@@ -5101,12 +5163,12 @@ Examples:
 }
 
 // src/commands/sweep.ts
-import { existsSync as existsSync13 } from "fs";
-import { dirname as dirname8, join as join15, resolve as resolve2 } from "path";
-var DEFAULT_MANIFEST = join15(".sechroom", "repos.json");
+import { existsSync as existsSync14 } from "fs";
+import { dirname as dirname9, join as join16, resolve as resolve2 } from "path";
+var DEFAULT_MANIFEST = join16(".sechroom", "repos.json");
 function planEntry(entry, root) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync13(dir)) {
+  if (!existsSync14(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
   if (committedBindingPath(dir)) {
@@ -5182,7 +5244,7 @@ Examples:
 `);
       return;
     }
-    const root = dirname8(dirname8(manifestPath));
+    const root = dirname9(dirname9(manifestPath));
     const plans = repos.map((entry) => planEntry(entry, root));
     if (!json) {
       process.stderr.write(
@@ -5201,13 +5263,13 @@ Examples:
 
 // src/commands/telemetry.ts
 import {
-  existsSync as existsSync14,
-  mkdirSync as mkdirSync11,
-  readFileSync as readFileSync9,
+  existsSync as existsSync15,
+  mkdirSync as mkdirSync12,
+  readFileSync as readFileSync10,
   rmSync as rmSync4,
-  writeFileSync as writeFileSync11
+  writeFileSync as writeFileSync12
 } from "fs";
-import { dirname as dirname9, join as join16 } from "path";
+import { dirname as dirname10, join as join17 } from "path";
 function registerTelemetry(program2) {
   const telemetry = program2.command("telemetry").description(
     "Emit WLP run telemetry (an executor leg's progress events) into a decomposition run"
@@ -5277,14 +5339,14 @@ function registerTelemetry(program2) {
     "Decomposition id this session executes"
   ).requiredOption("--task <id>", "Task id this session executes").action((opts, cmd) => {
     const json = Boolean(cmd.optsWithGlobals().json);
-    const dir = join16(process.cwd(), ".sechroom");
-    mkdirSync11(dir, { recursive: true });
-    const path = join16(dir, BINDING_FILE);
+    const dir = join17(process.cwd(), ".sechroom");
+    mkdirSync12(dir, { recursive: true });
+    const path = join17(dir, BINDING_FILE);
     const binding = {
       decompositionId: opts.decomposition,
       taskId: opts.task
     };
-    writeFileSync11(path, JSON.stringify(binding, null, 2) + "\n");
+    writeFileSync12(path, JSON.stringify(binding, null, 2) + "\n");
     ensureStateDirIgnored(process.cwd());
     if (json) {
       emit({ bound: true, ...binding, path }, true);
@@ -5299,8 +5361,8 @@ function registerTelemetry(program2) {
   });
   telemetry.command("unbind").description("Clear this checkout's telemetry binding").action((_opts, cmd) => {
     const json = Boolean(cmd.optsWithGlobals().json);
-    const path = join16(process.cwd(), ".sechroom", BINDING_FILE);
-    const existed = existsSync14(path);
+    const path = join17(process.cwd(), ".sechroom", BINDING_FILE);
+    const existed = existsSync15(path);
     if (existed) rmSync4(path);
     if (json) emit({ unbound: existed, path }, true);
     else
@@ -5414,11 +5476,11 @@ async function postTelemetry(cfg, decompositionId, events) {
 function findBinding(start) {
   let dir = start;
   for (; ; ) {
-    const path = join16(dir, ".sechroom", BINDING_FILE);
-    if (existsSync14(path)) {
+    const path = join17(dir, ".sechroom", BINDING_FILE);
+    if (existsSync15(path)) {
       try {
         const b = JSON.parse(
-          readFileSync9(path, "utf8")
+          readFileSync10(path, "utf8")
         );
         if (b.decompositionId && b.taskId)
           return { decompositionId: b.decompositionId, taskId: b.taskId };
@@ -5426,18 +5488,18 @@ function findBinding(start) {
       }
       return null;
     }
-    const parent = dirname9(dir);
+    const parent = dirname10(dir);
     if (parent === dir) return null;
     dir = parent;
   }
 }
 function parseTranscript(path) {
-  if (!existsSync14(path)) return null;
+  if (!existsSync15(path)) return null;
   let tokensIn = 0;
   let tokensOut = 0;
   let contextUsed = 0;
   let model = "";
-  for (const line of readFileSync9(path, "utf8").split("\n")) {
+  for (const line of readFileSync10(path, "utf8").split("\n")) {
     if (!line.trim()) continue;
     let obj;
     try {
@@ -5694,7 +5756,7 @@ Examples:
 function resolveVersion() {
   try {
     const pkg = JSON.parse(
-      readFileSync10(new URL("../package.json", import.meta.url), "utf8")
+      readFileSync11(new URL("../package.json", import.meta.url), "utf8")
     );
     return pkg.version ?? "0.0.0";
   } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.7.2",
+  "version": "2026.7.3",
   "description": "Sechroom CLI — a thin, generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.",
   "type": "module",
   "license": "UNLICENSED",