@sechroom/cli 2026.7.31 → 2026.7.32

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync15 } from "fs";
+import { readFileSync as readFileSync18 } from "fs";
 import { Command } from "commander";
 
 // src/auth.ts
@@ -104,8 +104,8 @@ function setDefaultAccount(alias) {
   file.default = alias;
   writeAccountsFile(file);
 }
-function resolveAccountAlias(flagAccount) {
-  return flagAccount ?? process.env.SECHROOM_ACCOUNT ?? readLocalConfig().account ?? readAccountsFile().default ?? DEFAULT_ACCOUNT;
+function resolveAccountAlias(flagAccount, start = process.cwd()) {
+  return flagAccount ?? process.env.SECHROOM_ACCOUNT ?? readLocalConfig(start).account ?? readAccountsFile().default ?? DEFAULT_ACCOUNT;
 }
 function writeLocalAccount(alias) {
   const home = findConfigHome() ?? process.cwd();
@@ -149,8 +149,8 @@ function findConfigHome(start = process.cwd()) {
     dir = parent;
   }
 }
-function readLocalConfig() {
-  const home = findConfigHome();
+function readLocalConfig(start = process.cwd()) {
+  const home = findConfigHome(start);
   if (!home) return {};
   const baselinePath = join(home, BASELINE_CONFIG_NAME);
   const overridePath = join(home, OVERRIDE_CONFIG_NAME);
@@ -186,7 +186,7 @@ function committedBindingPath(dir) {
   const p = join(dir, BASELINE_CONFIG_NAME);
   return existsSync(p) ? p : void 0;
 }
-function selectWorkspaceBinding(local, explicitName) {
+function selectWorkspaceBinding(local, explicitName, start = process.cwd()) {
   const bindings = local.workspaces ?? [];
   if (explicitName) {
     const hit = bindings.find((b) => b.name === explicitName);
@@ -197,7 +197,7 @@ function selectWorkspaceBinding(local, explicitName) {
     return hit;
   }
   if (!local.home || bindings.length === 0) return void 0;
-  const rel = process.cwd().startsWith(local.home) ? process.cwd().slice(local.home.length).replace(/^[/\\]/, "") : "";
+  const rel = start.startsWith(local.home) ? start.slice(local.home.length).replace(/^[/\\]/, "") : "";
   const norm = (p) => p.replace(/\/\*\*$/, "").replace(/[/\\]+$/, "");
   let best;
   for (const b of bindings) {
@@ -210,8 +210,8 @@ function selectWorkspaceBinding(local, explicitName) {
   }
   return best?.binding;
 }
-function resolveConfig(flags) {
-  const local = readLocalConfig();
+function resolveConfig(flags, start = process.cwd()) {
+  const local = readLocalConfig(start);
   const persisted = readPersisted();
   const baseUrl = flags.baseUrl ?? process.env.SECHROOM_BASE_URL ?? local.baseUrl ?? persisted.baseUrl ?? DEFAULT_BASE_URL;
   const tenant = flags.tenant ?? process.env.SECHROOM_TENANT ?? local.tenant ?? persisted.tenant ?? "";
@@ -220,10 +220,10 @@ function resolveConfig(flags) {
       "No tenant set. The Sechroom API rejects untenanted requests (HTTP 400). Pass --tenant <id>, set SECHROOM_TENANT, run `sechroom config set tenant <id>`, or `sechroom config set --local tenant <id>` for this directory."
     );
   }
-  const binding = selectWorkspaceBinding(local, flags.binding ?? process.env.SECHROOM_BINDING);
+  const binding = selectWorkspaceBinding(local, flags.binding ?? process.env.SECHROOM_BINDING, start);
   const workspaceId = process.env.SECHROOM_WORKSPACE ?? binding?.workspaceId ?? local.workspaceId ?? persisted.workspaceId ?? void 0;
   const defaultProjectId = (binding ? binding.defaultProjectId : void 0) ?? local.defaultProjectId ?? persisted.defaultProjectId ?? void 0;
-  const account = resolveAccountAlias(flags.account);
+  const account = resolveAccountAlias(flags.account, start);
   return { baseUrl: baseUrl.replace(/\/$/, ""), tenant, account, workspaceId, defaultProjectId, clientId: persisted.clientId };
 }
 function describeConfig(flags) {
@@ -2141,7 +2141,7 @@ var SUCCESS = /* @__PURE__ */ new Set(["Claimed", "AlreadyHeld"]);
 var CONTENTION_STATUSES = /* @__PURE__ */ new Set([409, 410]);
 async function claimNextTask(deps) {
   const { request, executorInstanceId } = deps;
-  const sleep = deps.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
+  const sleep = deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   const idempotencyKey = deps.idempotencyKey ?? ((offer) => `executor-run:${offer.generationId}`);
   const tokenVersion = deps.tokenVersion ?? 1;
   const log = deps.log ?? (() => {
@@ -2471,12 +2471,12 @@ var CodexAppServer = class {
       ))
         fileChangeCount += 1;
     };
-    const terminal = new Promise((resolve6) => {
+    const terminal = new Promise((resolve8) => {
       this.onServerRequest = (msg) => {
         const method = msg.method ?? "";
         if (terminalMethod(method)) {
           this.respond(msg.id, {});
-          resolve6("completed");
+          resolve8("completed");
           return;
         }
         if (method === "item/tool/call") {
@@ -2663,14 +2663,14 @@ var CodexAppServer = class {
     if (!child || this.exited)
       return Promise.reject(new Error("codex app-server is not running"));
     const id = this.nextId++;
-    return new Promise((resolve6, reject) => {
+    return new Promise((resolve8, reject) => {
       let timer;
       const clearTimer = () => {
         if (timer) clearTimeout(timer);
       };
       const resolvePending = (value) => {
         clearTimer();
-        resolve6(value);
+        resolve8(value);
       };
       const rejectPending = (error) => {
         clearTimer();
@@ -2736,10 +2736,10 @@ var CodexAppServer = class {
     if (parsed) this.options.onRateLimits?.(parsed);
   }
   exitAsResult() {
-    return new Promise((resolve6) => {
+    return new Promise((resolve8) => {
       this.child?.once(
         "exit",
-        (code) => resolve6(`app-server exited (${code ?? "signal"})`)
+        (code) => resolve8(`app-server exited (${code ?? "signal"})`)
       );
     });
   }
@@ -2765,7 +2765,7 @@ function terminalMethod(method) {
 }
 function timeout(ms) {
   return new Promise(
-    (resolve6) => setTimeout(() => resolve6("timeout"), ms).unref?.()
+    (resolve8) => setTimeout(() => resolve8("timeout"), ms).unref?.()
   );
 }
 function dynamicToolDefinitions() {
@@ -2805,12 +2805,12 @@ function dynamicToolDefinitions() {
 // src/executor-run/delivery.ts
 import { execFile as execFile2 } from "child_process";
 function createGitRunner(rootDir) {
-  return (bin, args) => new Promise((resolve6) => {
+  return (bin, args) => new Promise((resolve8) => {
     execFile2(
       bin,
       bin === "git" ? ["-C", rootDir, ...args] : args,
       { cwd: rootDir, maxBuffer: 10 * 1024 * 1024 },
-      (error, stdout, stderr) => resolve6({
+      (error, stdout, stderr) => resolve8({
         ok: !error,
         stdout: String(stdout),
         stderr: String(stderr)
@@ -5231,8 +5231,8 @@ function registerExecutorRunCommand(executor) {
     await appServer.start();
     log(`codex app-server up (${String(opts.codexBin)})`);
     let signalCapacityTerminal;
-    const capacityTerminal = new Promise((resolve6) => {
-      signalCapacityTerminal = resolve6;
+    const capacityTerminal = new Promise((resolve8) => {
+      signalCapacityTerminal = resolve8;
     });
     let stopCapacityCapture = () => {
     };
@@ -5252,8 +5252,8 @@ function registerExecutorRunCommand(executor) {
     process.once("SIGTERM", requestStop);
     let wake = () => {
     };
-    const wakeSignal = () => new Promise((resolve6) => {
-      wake = resolve6;
+    const wakeSignal = () => new Promise((resolve8) => {
+      wake = resolve8;
     });
     let connStop = async () => {
     };
@@ -5372,8 +5372,8 @@ function registerExecutorRunCommand(executor) {
       ),
       log,
       waitForWake: (ms) => Promise.race([
-        new Promise((resolve6) => {
-          setTimeout(resolve6, ms).unref?.();
+        new Promise((resolve8) => {
+          setTimeout(resolve8, ms).unref?.();
         }),
         wakeSignal()
       ])
@@ -6185,11 +6185,11 @@ function parseInteger(value) {
   return parsed;
 }
 function holdHeartbeat(tick, intervalMs) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve8, reject) => {
     const timer = setInterval(() => void tick().catch(reject), intervalMs);
     const stop = () => {
       clearInterval(timer);
-      resolve6();
+      resolve8();
     };
     process.once("SIGINT", stop);
     process.once("SIGTERM", stop);
@@ -6442,7 +6442,7 @@ function startExecutorHeartbeat(refresh, intervalMilliseconds, dependencies = {}
 }
 async function drainClaims(cfg, executorInstanceId, deliver, dependencies = {}) {
   const request = dependencies.request ?? api;
-  const sleep = dependencies.sleep ?? ((milliseconds) => new Promise((resolve6) => setTimeout(resolve6, milliseconds)));
+  const sleep = dependencies.sleep ?? ((milliseconds) => new Promise((resolve8) => setTimeout(resolve8, milliseconds)));
   const idempotencyKey = dependencies.idempotencyKey ?? ((offer) => `channel:${offer.generationId}`);
   const state = dependencies.state ?? {};
   for (; ; ) {
@@ -6516,9 +6516,9 @@ async function openConnection(cfg, onEvent, executorInstanceId) {
   return conn;
 }
 function holdOpen(conn) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve8) => {
     const stop = () => {
-      void conn.stop().finally(resolve6);
+      void conn.stop().finally(resolve8);
     };
     process.on("SIGINT", stop);
     process.on("SIGTERM", stop);
@@ -6644,13 +6644,224 @@ Examples:
 }
 
 // src/commands/checkpoint.ts
-import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync11 } from "fs";
-import { dirname as dirname11, join as join14 } from "path";
+import { mkdirSync as mkdirSync14, writeFileSync as writeFileSync13 } from "fs";
+import { dirname as dirname13, join as join15 } from "path";
 
 // src/commands/hook.ts
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync10, mkdirSync as mkdirSync11, readFileSync as readFileSync9, statSync as statSync2, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname10, join as join13 } from "path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync13, readFileSync as readFileSync10, statSync as statSync2, writeFileSync as writeFileSync12 } from "fs";
+import { dirname as dirname12, join as join14 } from "path";
+
+// src/commands/lane-commit-hook.ts
+import { execFileSync } from "child_process";
+import {
+  chmodSync,
+  existsSync as existsSync10,
+  mkdirSync as mkdirSync11,
+  readFileSync as readFileSync9,
+  renameSync,
+  unlinkSync,
+  writeFileSync as writeFileSync10
+} from "fs";
+import { basename as basename2, dirname as dirname10, isAbsolute, resolve as resolve4 } from "path";
+var BEGIN = "# sechroom:begin lane-trailer";
+var END = "# sechroom:end lane-trailer";
+var INCUMBENT_SUFFIX = ".sechroom-incumbent";
+var HOOK_NAME = "commit-msg";
+var LEGACY_HOOK_NAME = "prepare-commit-msg";
+var MANAGED_BLOCK = `${BEGIN}
+if command -v sechroom >/dev/null 2>&1; then
+  sechroom hook commit-msg "$1"
+fi
+${END}`;
+function resolveCheckoutLane(start) {
+  const pin = readSem(resolveSemPathForRead(start))?.values["code-lane"];
+  return pin ? applyWorktreeLaneSuffix(pin, start) : void 0;
+}
+function appendLaneTrailer(messagePath, lane) {
+  const original = readFileSync9(messagePath, "utf8").replace(/\r\n/g, "\n");
+  const lines = original.split("\n");
+  const scissorsIndex = lines.findIndex(
+    (line) => /^#\s*-+\s*>8\s*-+\s*$/.test(line)
+  );
+  const editableLines = scissorsIndex < 0 ? lines : lines.slice(0, scissorsIndex);
+  const scissorsLines = scissorsIndex < 0 ? [] : lines.slice(scissorsIndex);
+  const editable = editableLines.join("\n").trimEnd();
+  const finalParagraphStart = editable.lastIndexOf("\n\n") + 2;
+  const body = editable.slice(0, finalParagraphStart);
+  const finalParagraph = editable.slice(finalParagraphStart).split("\n").filter((line) => !/^Lane:\s.*$/.test(line)).join("\n");
+  const withoutPriorLane = `${body}${finalParagraph}`.trimEnd();
+  const hasMessage = withoutPriorLane.split("\n").some((line) => line.trim() !== "" && !line.trimStart().startsWith("#"));
+  if (!hasMessage) return;
+  const withTrailer = `${withoutPriorLane}
+
+Lane: ${lane}
+`;
+  const next = scissorsLines.length > 0 ? `${withTrailer}
+${scissorsLines.join("\n").replace(/^\n+/, "")}` : withTrailer;
+  writeFileSync10(messagePath, next.endsWith("\n") ? next : `${next}
+`, "utf8");
+}
+function isShellHook(current) {
+  const shebang = current.match(/^#!([^\n\r]*)/)?.[1];
+  if (!shebang) return true;
+  return /(?:^|[/\s])(?:sh|bash|dash|ksh|zsh)(?:\s|$)/.test(shebang);
+}
+function insertManagedBlock(current) {
+  const blockPattern = managedBlockPattern();
+  if (blockPattern.test(current)) return current.replace(blockPattern, MANAGED_BLOCK);
+  const shebang = current.match(/^#![^\n]*(?:\n|$)/)?.[0];
+  if (shebang) return `${shebang}${MANAGED_BLOCK}
+${current.slice(shebang.length)}`;
+  return `#!/bin/sh
+${MANAGED_BLOCK}
+${current}`;
+}
+function managedBlockPattern() {
+  return new RegExp(
+    `${BEGIN.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}[\\s\\S]*?${END.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`
+  );
+}
+function chainWrapper(incumbentName) {
+  return `#!/bin/sh
+${MANAGED_BLOCK}
+hook_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+exec "$hook_dir/${incumbentName}" "$@"
+`;
+}
+function nextIncumbentPath(path) {
+  const base = `${path}${INCUMBENT_SUFFIX}`;
+  if (!existsSync10(base)) return base;
+  for (let index = 2; ; index++) {
+    const candidate = `${base}.${index}`;
+    if (!existsSync10(candidate)) return candidate;
+  }
+}
+function resolveHookPath(root, hookName) {
+  const gitPath = execFileSync(
+    "git",
+    ["-C", root, "rev-parse", "--git-path", `hooks/${hookName}`],
+    {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }
+  ).trim();
+  return isAbsolute(gitPath) ? gitPath : resolve4(root, gitPath);
+}
+function removeLegacyPrepareCommitMsgLeg(root) {
+  const path = resolveHookPath(root, LEGACY_HOOK_NAME);
+  if (!existsSync10(path)) return;
+  const current = readFileSync9(path, "utf8");
+  const pattern = managedBlockPattern();
+  if (!pattern.test(current)) return;
+  const next = current.replace(pattern, "").replace(/\n{3,}/g, "\n\n").trimEnd();
+  if (!next || next === "#!/bin/sh") {
+    unlinkSync(path);
+    return;
+  }
+  writeFileSync10(path, `${next}
+`, "utf8");
+  chmodSync(path, 493);
+}
+function installLaneCommitHook(start) {
+  try {
+    const root = execFileSync("git", ["-C", start, "rev-parse", "--show-toplevel"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    removeLegacyPrepareCommitMsgLeg(root);
+    const path = resolveHookPath(root, HOOK_NAME);
+    const current = existsSync10(path) ? readFileSync9(path, "utf8") : "";
+    let next;
+    if (current && !isShellHook(current)) {
+      const incumbentPath = nextIncumbentPath(path);
+      renameSync(path, incumbentPath);
+      chmodSync(incumbentPath, 493);
+      next = chainWrapper(basename2(incumbentPath));
+    } else {
+      next = insertManagedBlock(current);
+    }
+    if (next !== current) {
+      mkdirSync11(dirname10(path), { recursive: true });
+      writeFileSync10(path, next.endsWith("\n") ? next : `${next}
+`, "utf8");
+    }
+    chmodSync(path, 493);
+    return path;
+  } catch {
+    return void 0;
+  }
+}
+
+// src/commands/session-context.ts
+import { randomUUID } from "crypto";
+import { mkdirSync as mkdirSync12, renameSync as renameSync2, rmSync as rmSync5, writeFileSync as writeFileSync11 } from "fs";
+import { dirname as dirname11, join as join13 } from "path";
+var DYNAMIC_AGENT_CONTEXT_FILE = join13(".sechroom", "CLAUDE.md");
+function checkoutRoot(start) {
+  const semPath = resolveSemPathForRead(start);
+  return semPath ? dirname11(dirname11(semPath)) : start;
+}
+function renderSessionContext(result, lane) {
+  if (result.status === "hold") {
+    return [
+      "# Sechroom dynamic agent context \u2014 HOLD",
+      "",
+      `Lane: ${lane}`,
+      result.workspaceId ? `Workspace: ${result.workspaceId}` : null,
+      "",
+      result.reason?.trim() || "Session context resolution held without a reason.",
+      "",
+      "Do not use a previously materialized context file for this session.",
+      ""
+    ].filter((line) => line !== null).join("\n");
+  }
+  const lines = [
+    "# Sechroom dynamic agent context",
+    "",
+    `<!-- sechroom-context lane=${JSON.stringify(lane)} workspace=${JSON.stringify(result.workspaceId ?? "")} -->`,
+    ""
+  ];
+  for (const member of result.members) {
+    lines.push(
+      `<!-- sechroom-context-member key=${JSON.stringify(member.key)} layer=${JSON.stringify(member.layer)} bundle=${JSON.stringify(`${member.bundleSlug}@${member.bundleVersion}`)} component=${JSON.stringify(member.componentSlug)} id=${JSON.stringify(member.sourceId)} sourceVersion=${member.sourceVersion} -->`
+    );
+    if (member.heading?.trim()) lines.push(member.heading.trim(), "");
+    else if (member.title?.trim()) lines.push(`## ${member.title.trim()}`, "");
+    lines.push(member.body.trimEnd(), "");
+  }
+  return lines.join("\n");
+}
+function writeSessionContext(start, lane, result) {
+  const path = join13(checkoutRoot(start), DYNAMIC_AGENT_CONTEXT_FILE);
+  const context = renderSessionContext(result, lane);
+  mkdirSync12(dirname11(path), { recursive: true });
+  const temporaryPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync11(temporaryPath, context.endsWith("\n") ? context : `${context}
+`, "utf8");
+    renameSync2(temporaryPath, path);
+  } catch (error) {
+    rmSync5(temporaryPath, { force: true });
+    throw error;
+  }
+  return { status: result.status, path, context };
+}
+async function materializeSessionContext(client, cfg, lane, start) {
+  const { data, error, response } = await client.POST("/session-context/resolve", {
+    body: {
+      laneId: lane,
+      workspaceId: cfg.workspaceId ?? null
+    }
+  });
+  if (!data) {
+    const detail = error ? JSON.stringify(error) : `HTTP ${response?.status ?? "unknown"}`;
+    throw new Error(`session context resolution failed: ${detail}`);
+  }
+  return writeSessionContext(start, lane, data);
+}
+
+// src/commands/hook.ts
 async function readStdin2() {
   if (process.stdin.isTTY) return "";
   const chunks = [];
@@ -6674,13 +6885,13 @@ function resolveLane(flagLane, cwd) {
   if (!base) return void 0;
   return applyWorktreeLaneSuffix(base, start);
 }
-var INTENT_FILE = join13(".sechroom", "continuity.json");
+var INTENT_FILE = join14(".sechroom", "continuity.json");
 function resolveIntentPath(start) {
   let dir = start;
   for (; ; ) {
-    const candidate = join13(dir, INTENT_FILE);
-    if (existsSync10(candidate)) return candidate;
-    const parent = dirname10(dir);
+    const candidate = join14(dir, INTENT_FILE);
+    if (existsSync11(candidate)) return candidate;
+    const parent = dirname12(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
@@ -6689,7 +6900,7 @@ function readIntent(start) {
   const path = resolveIntentPath(start);
   if (!path) return void 0;
   try {
-    return JSON.parse(readFileSync9(path, "utf8"));
+    return JSON.parse(readFileSync10(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -6731,14 +6942,14 @@ async function saveSnapshotFromIntent(cmd, cwd, laneFlag, scopeFlag, defaultScop
 }
 function ledgerPath(start) {
   const intent = resolveIntentPath(start);
-  const dir = intent ? dirname10(intent) : join13(start, ".sechroom");
-  return join13(dir, ".checkpoint-state.json");
+  const dir = intent ? dirname12(intent) : join14(start, ".sechroom");
+  return join14(dir, ".checkpoint-state.json");
 }
 function readLedger(start) {
   try {
     const p = ledgerPath(start);
-    if (!existsSync10(p)) return {};
-    return JSON.parse(readFileSync9(p, "utf8"));
+    if (!existsSync11(p)) return {};
+    return JSON.parse(readFileSync10(p, "utf8"));
   } catch {
     return {};
   }
@@ -6785,13 +6996,13 @@ function recordPush(start, intent) {
     } catch {
       mtimeMs = void 0;
     }
-    mkdirSync11(dirname10(p), { recursive: true });
+    mkdirSync13(dirname12(p), { recursive: true });
     const ledger = {
       lastEpochMs: Date.now(),
       lastMtimeMs: mtimeMs,
       lastHash: intentHash(intent)
     };
-    writeFileSync10(p, JSON.stringify(ledger) + "\n");
+    writeFileSync12(p, JSON.stringify(ledger) + "\n");
   } catch {
   }
 }
@@ -6847,29 +7058,59 @@ Examples:
   $ sechroom hook install --local --dry-run      preview the project .claude/settings.json
 
 Lane source (high -> low): --lane  >  SECHROOM_LANE  >  ./.sechroom/lane.json code-lane (D-binding-5).
-Fail-soft: no lane / no auth / no-or-partial intent file / API error -> exit 0, never blocks.`
+Fail-soft: failures exit 0 and never block; session-context refresh failures render an explicit HOLD.`
   );
-  hook.command("session-start").description("Resume the checkout's lane and emit continuity context for a SessionStart hook").option("--lane <laneId>", "Override the resolved lane (else SECHROOM_LANE, else ./.sechroom/lane.json code-lane)").option("--surface <surface>", "Target surface: claude | codex (output is identical for session-start)", "claude").option("--max-artifacts <n>", "Cap artifacts in the resume bundle").action(async (opts, cmd) => {
+  hook.command("session-start").description("Materialize dynamic agent context, install commit attribution, and resume continuity").option("--lane <laneId>", "Override the resolved lane (else SECHROOM_LANE, else ./.sechroom/lane.json code-lane)").option("--surface <surface>", "Target surface: claude | codex (output is identical for session-start)", "claude").option("--max-artifacts <n>", "Cap artifacts in the resume bundle").action(async (opts, cmd) => {
     try {
       const raw = await readStdin2();
       const input = parseHookInput2(raw);
-      const lane = resolveLane(opts.lane, input.cwd);
+      const cwd = input.cwd ?? process.cwd();
+      const lane = resolveLane(opts.lane, cwd);
       if (!lane) return process.exit(0);
-      const semPath = resolveSemPathForRead(input.cwd ?? process.cwd());
+      installLaneCommitHook(cwd);
+      const semPath = resolveSemPathForRead(cwd);
       if (semPath) ensureContinuityScaffold(semPath);
-      const cfg = resolveConfig(cmd.optsWithGlobals());
-      const client = await makeClient(cfg);
-      const { data } = await client.POST("/continuity/resume/lane", {
-        body: {
-          laneId: lane,
-          workspaceId: null,
-          maxArtifacts: opts.maxArtifacts != null ? Number(opts.maxArtifacts) : null,
-          includeLookingAtMyself: null,
-          changedSince: null
-        }
+      let dynamic = writeSessionContext(cwd, lane, {
+        status: "hold",
+        workspaceId: null,
+        reason: "SESSION_CONTEXT_UNAVAILABLE: the session-start hook could not refresh the pinned context (transport or authentication failure).",
+        members: []
       });
-      const context = formatContext(data, lane);
-      if (context) emitSessionStart(context);
+      let continuity = null;
+      try {
+        const cfg = resolveConfig(cmd.optsWithGlobals(), cwd);
+        const client = await makeClient(cfg);
+        try {
+          dynamic = await materializeSessionContext(client, cfg, lane, cwd);
+        } catch {
+        }
+        try {
+          const { data } = await client.POST("/continuity/resume/lane", {
+            body: {
+              laneId: lane,
+              workspaceId: null,
+              maxArtifacts: opts.maxArtifacts != null ? Number(opts.maxArtifacts) : null,
+              includeLookingAtMyself: null,
+              changedSince: null
+            }
+          });
+          continuity = formatContext(data, lane);
+        } catch {
+        }
+      } catch {
+      }
+      const contexts = [dynamic.context];
+      if (continuity) contexts.push(continuity);
+      if (contexts.length) emitSessionStart(contexts.join("\n\n"));
+      return process.exit(0);
+    } catch {
+      return process.exit(0);
+    }
+  });
+  hook.command("commit-msg <messagePath>").description("Append the checkout lane to a final Git commit message (installed helper)").action((messagePath) => {
+    try {
+      const lane = resolveCheckoutLane(process.cwd());
+      if (lane) appendLaneTrailer(messagePath, lane);
       return process.exit(0);
     } catch {
       return process.exit(0);
@@ -7044,10 +7285,10 @@ Examples:
       const client = await makeClient(cfg);
       return client.POST("/continuity/snapshots", { body });
     });
-    const path = resolveIntentPath(cwd) ?? join14(cwd, INTENT_FILE);
+    const path = resolveIntentPath(cwd) ?? join15(cwd, INTENT_FILE);
     const fileBody = { ...merged, scope, lastSnapshotId: data.snapshotId };
-    mkdirSync12(dirname11(path), { recursive: true });
-    writeFileSync11(path, JSON.stringify(fileBody, null, 2) + "\n");
+    mkdirSync14(dirname13(path), { recursive: true });
+    writeFileSync13(path, JSON.stringify(fileBody, null, 2) + "\n");
     recordPush(cwd, merged);
     if (json) {
       emit({ snapshotId: data.snapshotId, lane, scope, file: path }, true);
@@ -7061,7 +7302,7 @@ Examples:
 }
 
 // src/commands/close.ts
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync11 } from "fs";
 var VERDICTS = ["pass", "soft-fail", "plan-invalid", "blocked"];
 function registerClose(program2) {
   program2.command("close").description(
@@ -7102,7 +7343,7 @@ Examples:
       );
     let bodyText;
     try {
-      bodyText = opts.file ? readFileSync10(opts.file, "utf8") : readFileSync10(0, "utf8");
+      bodyText = opts.file ? readFileSync11(opts.file, "utf8") : readFileSync11(0, "utf8");
     } catch {
       fail(
         opts.file ? `could not read --file ${opts.file}` : "no closeout body \u2014 pass --file <path> or pipe it on stdin"
@@ -7791,6 +8032,764 @@ Examples:
   });
 }
 
+// src/commands/herdr.ts
+import { readFileSync as readFileSync12 } from "fs";
+import { basename as basename3 } from "path";
+
+// src/herdr/client.ts
+import { createConnection as createConnection2 } from "net";
+import { homedir as homedir5 } from "os";
+import { join as join16 } from "path";
+var DEFAULT_HERDR_SOCKET_RELATIVE = ".config/herdr/herdr.sock";
+var HerdrUnreachableError = class extends Error {
+  constructor(socketPath, reason) {
+    super(`no Herdr socket at ${socketPath} (${reason}) \u2014 is Herdr running?`);
+    this.socketPath = socketPath;
+    this.reason = reason;
+    this.name = "HerdrUnreachableError";
+  }
+  socketPath;
+  reason;
+};
+var HerdrRpcError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "HerdrRpcError";
+  }
+  code;
+};
+function resolveSocketPath(flag, env = process.env, home = homedir5()) {
+  const fromFlag = flag?.trim();
+  if (fromFlag) return fromFlag;
+  const fromEnv = env.HERDR_SOCKET?.trim();
+  if (fromEnv) return fromEnv;
+  return join16(home, DEFAULT_HERDR_SOCKET_RELATIVE);
+}
+function expandTarget(target) {
+  const trimmed = target.trim();
+  if (trimmed.length === 0) {
+    throw new Error(
+      "target is required (e.g. w6:p1, or w6 for its first pane)"
+    );
+  }
+  return trimmed.includes(":") ? trimmed : `${trimmed}:p1`;
+}
+var requestCounter = 0;
+function nextRequestId() {
+  requestCounter += 1;
+  return `sechroom-${process.pid}-${requestCounter}`;
+}
+function encodeRequest(id, method, params) {
+  return `${JSON.stringify({ id, method, params })}
+`;
+}
+function createLineReader() {
+  let buffer = "";
+  return (chunk) => {
+    buffer += chunk;
+    const lines = [];
+    for (; ; ) {
+      const nl = buffer.indexOf("\n");
+      if (nl === -1) break;
+      const line = buffer.slice(0, nl).trim();
+      buffer = buffer.slice(nl + 1);
+      if (line.length > 0) lines.push(line);
+    }
+    return lines;
+  };
+}
+function truncateForError(line) {
+  return line.length > 200 ? `${line.slice(0, 200)}\u2026` : line;
+}
+function parseResponse(line) {
+  let parsed;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    throw new Error(`malformed Herdr response: ${truncateForError(line)}`);
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new Error(`malformed Herdr response: ${truncateForError(line)}`);
+  }
+  const obj = parsed;
+  if (obj.error) {
+    throw new HerdrRpcError(
+      obj.error.message ?? "Herdr returned an error with no message",
+      obj.error.code
+    );
+  }
+  if (!("result" in obj)) {
+    throw new Error(
+      `Herdr response carried neither result nor error: ${truncateForError(line)}`
+    );
+  }
+  return obj.result;
+}
+function classifyStreamLine(line, requestId) {
+  let parsed;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    return { kind: "malformed", line };
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return { kind: "malformed", line };
+  }
+  const obj = parsed;
+  if (obj.error) {
+    return {
+      kind: "error",
+      message: obj.error.message ?? "Herdr returned an error with no message",
+      code: obj.error.code
+    };
+  }
+  if (obj.id === requestId && "result" in obj) return { kind: "ack" };
+  return { kind: "event", payload: parsed };
+}
+function toTransportError(socketPath, error) {
+  const code = error.code;
+  if (code === "ENOENT" || code === "ECONNREFUSED" || code === "EACCES") {
+    return new HerdrUnreachableError(socketPath, code);
+  }
+  return error;
+}
+function herdrRequest(socketPath, method, params, timeoutMs = 1e4) {
+  return new Promise((resolvePromise, rejectPromise) => {
+    const id = nextRequestId();
+    const readLines = createLineReader();
+    let settled = false;
+    let timer;
+    const socket = createConnection2(socketPath);
+    const finish = (fn) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      fn();
+    };
+    timer = setTimeout(
+      () => finish(
+        () => rejectPromise(
+          new Error(
+            `Herdr request '${method}' timed out after ${timeoutMs}ms (socket ${socketPath})`
+          )
+        )
+      ),
+      timeoutMs
+    );
+    timer.unref?.();
+    socket.setEncoding("utf8");
+    socket.on("connect", () => {
+      socket.write(encodeRequest(id, method, params));
+    });
+    socket.on("data", (chunk) => {
+      const [line] = readLines(chunk);
+      if (line === void 0) return;
+      try {
+        const result = parseResponse(line);
+        finish(() => resolvePromise(result));
+      } catch (error) {
+        finish(() => rejectPromise(error));
+      }
+    });
+    socket.on("error", (error) => {
+      finish(() => rejectPromise(toTransportError(socketPath, error)));
+    });
+    socket.on("close", () => {
+      finish(
+        () => rejectPromise(
+          new HerdrUnreachableError(
+            socketPath,
+            "connection closed before a response"
+          )
+        )
+      );
+    });
+  });
+}
+function herdrStream(socketPath, subscriptions, onEvent, options = {}) {
+  const { signal, onWarning, subscribeTimeoutMs = 1e4 } = options;
+  return new Promise((resolvePromise, rejectPromise) => {
+    if (signal?.aborted) {
+      resolvePromise();
+      return;
+    }
+    const id = nextRequestId();
+    const readLines = createLineReader();
+    let settled = false;
+    let acked = false;
+    const socket = createConnection2(socketPath);
+    const ackTimer = setTimeout(() => {
+      if (!acked) {
+        finish(
+          () => rejectPromise(
+            new Error(
+              `Herdr did not acknowledge events.subscribe within ${subscribeTimeoutMs}ms (socket ${socketPath})`
+            )
+          )
+        );
+      }
+    }, subscribeTimeoutMs);
+    ackTimer.unref?.();
+    const onAbort = () => finish(() => resolvePromise());
+    const finish = (fn) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(ackTimer);
+      signal?.removeEventListener("abort", onAbort);
+      socket.destroy();
+      fn();
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    socket.setEncoding("utf8");
+    socket.on("connect", () => {
+      socket.write(encodeRequest(id, "events.subscribe", { subscriptions }));
+    });
+    socket.on("data", (chunk) => {
+      for (const line of readLines(chunk)) {
+        if (!acked) {
+          acked = true;
+          clearTimeout(ackTimer);
+        }
+        const classified = classifyStreamLine(line, id);
+        if (classified.kind === "ack") continue;
+        if (classified.kind === "error") {
+          finish(
+            () => rejectPromise(
+              new HerdrRpcError(classified.message, classified.code)
+            )
+          );
+          return;
+        }
+        if (classified.kind === "malformed") {
+          onWarning?.(
+            `ignoring malformed Herdr event line: ${truncateForError(classified.line)}`
+          );
+          continue;
+        }
+        try {
+          onEvent(classified.payload);
+        } catch (error) {
+          finish(
+            () => rejectPromise(
+              error instanceof Error ? error : new Error(String(error))
+            )
+          );
+          return;
+        }
+      }
+    });
+    socket.on("error", (error) => {
+      finish(() => rejectPromise(toTransportError(socketPath, error)));
+    });
+    socket.on("close", () => finish(() => resolvePromise()));
+  });
+}
+function abortableSleep(milliseconds, signal) {
+  return new Promise((resolve8) => {
+    if (signal?.aborted) {
+      resolve8();
+      return;
+    }
+    let timer;
+    const onAbort = () => {
+      clearTimeout(timer);
+      resolve8();
+    };
+    timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve8();
+    }, milliseconds);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function createHerdrPorts(socketPath) {
+  return {
+    socketPath,
+    request: (method, params) => herdrRequest(socketPath, method, params),
+    stream: (subscriptions, onEvent, options) => herdrStream(socketPath, subscriptions, onEvent, options),
+    sleep: (milliseconds, signal) => abortableSleep(milliseconds, signal)
+  };
+}
+
+// src/commands/herdr.ts
+var HERDR_READ_SOURCES = [
+  "visible",
+  "recent",
+  "recent_unwrapped",
+  "detection"
+];
+var DEFAULT_READ_LINES = 40;
+var DEFAULT_READ_SOURCE = "recent";
+var TITLE_WIDTH = 48;
+var STREAM_HEALTHY_MS = 3e4;
+var WAIT_FOR_PANES_MAX_MS = 5e3;
+var ATTENTION_STATUSES = {
+  blocked: "BLOCKED",
+  waiting: "WAITING",
+  needs_input: "NEEDS-INPUT"
+};
+function displayStatus(status) {
+  return ATTENTION_STATUSES[status.trim().toLowerCase()] ?? status;
+}
+function isAttentionStatus(status) {
+  return status !== void 0 && status.trim().toLowerCase() in ATTENTION_STATUSES;
+}
+function agentLabel(agent, paneId) {
+  return agent?.name?.trim() || agent?.agent?.trim() || agent?.pane_id || paneId || "?";
+}
+function cwdBasename(cwd) {
+  const trimmed = cwd?.trim();
+  if (!trimmed) return "?";
+  return basename3(trimmed.replace(/\/+$/, "")) || trimmed;
+}
+function agentTitle(agent) {
+  return agent?.terminal_title_stripped?.trim() || agent?.terminal_title?.trim() || "";
+}
+function truncate(value, width) {
+  return value.length > width ? `${value.slice(0, width - 1)}\u2026` : value;
+}
+function describeAgent(agent, paneId) {
+  const title = agentTitle(agent);
+  const head = `${agentLabel(agent, paneId)}@${cwdBasename(agent?.cwd)}`;
+  return title ? `${head} [${truncate(title, TITLE_WIDTH)}]` : head;
+}
+function renderAgentTable(agents) {
+  if (agents.length === 0) return ["(no agents)"];
+  const rows = agents.map((agent) => ({
+    name: agentLabel(agent),
+    status: displayStatus(agent.agent_status ?? "?"),
+    cwd: cwdBasename(agent.cwd),
+    // Guarded like every other cell: a row missing its pane must not take the
+    // whole table down with `undefined.length` in the column-width pass.
+    pane: agent.pane_id ?? "?",
+    title: truncate(agentTitle(agent), TITLE_WIDTH)
+  }));
+  const header = {
+    name: "agent",
+    status: "status",
+    cwd: "cwd",
+    pane: "pane",
+    title: "title"
+  };
+  const width = (key) => Math.max(header[key].length, ...rows.map((row) => row[key].length));
+  const widths = {
+    name: width("name"),
+    status: width("status"),
+    cwd: width("cwd"),
+    pane: width("pane")
+  };
+  const line = (row) => `${row.name.padEnd(widths.name)}  ${row.status.padEnd(widths.status)}  ${row.cwd.padEnd(widths.cwd)}  ${row.pane.padEnd(widths.pane)}  ${row.title}`.trimEnd();
+  return [line(header), ...rows.map(line)];
+}
+function parseLines(value, fallback = DEFAULT_READ_LINES) {
+  if (value === void 0) return fallback;
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new Error(`--lines expects a positive integer (got '${value}')`);
+  }
+  return parsed;
+}
+function parseSource(value, fallback = DEFAULT_READ_SOURCE) {
+  if (value === void 0) return fallback;
+  const trimmed = value.trim();
+  const match = HERDR_READ_SOURCES.find((source) => source === trimmed);
+  if (match === void 0) {
+    throw new Error(
+      `--source expects one of ${HERDR_READ_SOURCES.join(" | ")} (got '${value}')`
+    );
+  }
+  return match;
+}
+function resolveSendText(textArgs, useStdin, readStdin5 = () => readFileSync12(0, "utf8")) {
+  if (useStdin) {
+    if (textArgs.length > 0) {
+      throw new Error(
+        "--stdin reads the prompt from stdin \u2014 don't also pass text arguments"
+      );
+    }
+    const text2 = readStdin5().replace(/\n+$/, "");
+    if (text2.trim().length === 0)
+      throw new Error("stdin was empty \u2014 nothing to send");
+    return text2;
+  }
+  const joined = textArgs.join(" ").trim();
+  if (joined.length === 0) {
+    throw new Error("prompt text is required (or pass --stdin)");
+  }
+  return joined;
+}
+function indexAgents(agents) {
+  return new Map(agents.map((agent) => [agent.pane_id, agent]));
+}
+function buildWatchSubscriptions(agents) {
+  return agents.flatMap((agent) => [
+    { type: "pane.agent_status_changed", pane_id: agent.pane_id },
+    { type: "pane.exited", pane_id: agent.pane_id }
+  ]);
+}
+function normalizeWatchEvent(raw) {
+  if (typeof raw !== "object" || raw === null) return null;
+  const outer = raw;
+  const nested = ["event", "params", "data", "payload"].map((key) => outer[key]).find((value) => typeof value === "object" && value !== null);
+  const readFrom = (source, keys) => {
+    for (const key of keys) {
+      const value = source?.[key];
+      if (typeof value === "string" && value.trim().length > 0) {
+        return value.trim();
+      }
+    }
+    return void 0;
+  };
+  const pick = (...keys) => {
+    for (const key of keys) {
+      for (const source of [nested, outer]) {
+        const value = readFrom(source, [key]);
+        if (value !== void 0) return value;
+      }
+    }
+    return void 0;
+  };
+  const type = readFrom(outer, ["type", "event_type", "event"]) ?? readFrom(nested, ["type", "event_type"]);
+  const paneId = pick("pane_id", "paneId", "target");
+  if (!type || !paneId) return null;
+  return {
+    type,
+    paneId,
+    from: pick("old_status", "from_status", "previous_status", "from", "old"),
+    to: pick("new_status", "to_status", "agent_status", "status", "to", "new")
+  };
+}
+function needsRelistFallback(event) {
+  if (event === null) return true;
+  if (event.type === "pane.exited") return false;
+  return event.to === void 0;
+}
+function diffAgentStatuses(previous, current) {
+  const events = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const agent of current) {
+    const paneId = agent.pane_id;
+    if (!paneId) continue;
+    seen.add(paneId);
+    const to = agent.agent_status ?? void 0;
+    const before = previous.get(paneId);
+    if (before === void 0) {
+      events.push({ type: "pane.appeared", paneId, to });
+      continue;
+    }
+    const from = before.agent_status ?? void 0;
+    if (from !== to) {
+      events.push({ type: "pane.agent_status_changed", paneId, from, to });
+    }
+  }
+  for (const paneId of previous.keys()) {
+    if (!seen.has(paneId)) events.push({ type: "pane.exited", paneId });
+  }
+  return events;
+}
+function formatWatchEvent(event, agents) {
+  const head = describeAgent(agents.get(event.paneId), event.paneId);
+  if (event.type === "pane.exited") return `${head}: exited`;
+  if (event.type === "pane.appeared") {
+    return `${head}: appeared \u2014 ${displayStatus(event.to ?? "?")}`;
+  }
+  return `${head}: ${displayStatus(event.from ?? "?")} -> ${displayStatus(event.to ?? "?")}`;
+}
+function watchEventJson(event, agents) {
+  const agent = agents.get(event.paneId);
+  return {
+    type: event.type,
+    paneId: event.paneId,
+    name: agentLabel(agent, event.paneId),
+    cwd: agent?.cwd ?? null,
+    title: agentTitle(agent) || null,
+    from: event.from ?? null,
+    to: event.to ?? null
+  };
+}
+function watchBackoffMs(attempt, maxMs = 15e3, baseMs = 500) {
+  return Math.min(baseMs * 2 ** Math.max(0, attempt), maxMs);
+}
+async function runList2(ports, json) {
+  const { agents } = await ports.request("agent.list", {});
+  if (json) {
+    emit({ agents: agents ?? [] }, true);
+    return;
+  }
+  for (const line of renderAgentTable(agents ?? [])) {
+    process.stdout.write(`${line}
+`);
+  }
+}
+async function runRead(ports, target, options, json) {
+  const result = await ports.request("agent.read", {
+    target: expandTarget(target),
+    source: parseSource(options.source),
+    lines: parseLines(options.lines)
+  });
+  if (json) {
+    emit(result, true);
+    return;
+  }
+  const text2 = result.read?.text ?? "";
+  process.stdout.write(text2.endsWith("\n") || text2 === "" ? text2 : `${text2}
+`);
+}
+async function runSend(ports, target, text2, json) {
+  const paneId = expandTarget(target);
+  const result = await ports.request("agent.prompt", {
+    target: paneId,
+    text: text2
+  });
+  const agent = result.agent;
+  emitAction(
+    `sent to ${describeAgent(agent, paneId)} \u2014 ${displayStatus(agent?.agent_status ?? "?")}`,
+    result,
+    json
+  );
+}
+async function runWatch(ports, options) {
+  const write = options.write ?? ((line) => process.stdout.write(`${line}
+`));
+  const warn2 = options.warn ?? ((line) => process.stderr.write(`${line}
+`));
+  const now = options.now ?? Date.now;
+  const { json, signal } = options;
+  let attempt = 0;
+  let waitingForPanes = false;
+  let seed = /* @__PURE__ */ new Map();
+  const render = (event, agents) => {
+    if (json) {
+      write(JSON.stringify(watchEventJson(event, agents)));
+      return;
+    }
+    const line = formatWatchEvent(event, agents);
+    write(isAttentionStatus(event.to) ? warn(line) : line);
+  };
+  let relisting = false;
+  let relistQueued = false;
+  const relistAndDiff = async () => {
+    if (relisting) {
+      relistQueued = true;
+      return;
+    }
+    relisting = true;
+    try {
+      do {
+        relistQueued = false;
+        const { agents } = await ports.request(
+          "agent.list",
+          {}
+        );
+        const current = agents ?? [];
+        const transitions = diffAgentStatuses(seed, current);
+        const fresh = indexAgents(current);
+        const labels = new Map([...seed, ...fresh]);
+        seed = fresh;
+        for (const transition of transitions) render(transition, labels);
+      } while (relistQueued && !signal?.aborted);
+    } finally {
+      relisting = false;
+    }
+  };
+  while (!signal?.aborted) {
+    try {
+      const { agents } = await ports.request("agent.list", {});
+      const current = agents ?? [];
+      seed = indexAgents(current);
+      const subscriptions = buildWatchSubscriptions(current);
+      if (subscriptions.length === 0) {
+        if (!waitingForPanes) {
+          waitingForPanes = true;
+          warn2(
+            style.dim(
+              `no panes on ${ports.socketPath} \u2014 waiting for one to appear`
+            )
+          );
+        }
+      } else {
+        if (waitingForPanes) {
+          waitingForPanes = false;
+          attempt = 0;
+        }
+        if (!json) {
+          warn2(
+            style.dim(
+              `watching ${seed.size} pane(s) on ${ports.socketPath} \u2014 Ctrl-C to stop`
+            )
+          );
+        }
+        let carriedTraffic = false;
+        let warnedDegraded = false;
+        const startedAt = now();
+        await ports.stream(
+          subscriptions,
+          (raw) => {
+            carriedTraffic = true;
+            const event = normalizeWatchEvent(raw);
+            if (event === null || needsRelistFallback(event)) {
+              if (!warnedDegraded) {
+                warnedDegraded = true;
+                warn2(
+                  `herdr watch: unreadable event payload \u2014 deriving transitions from agent.list instead`
+                );
+              }
+              void relistAndDiff().catch(
+                (error) => warn2(
+                  `herdr watch: agent.list fallback failed: ${formatFailureMessage(error)}`
+                )
+              );
+              return;
+            }
+            render(event, seed);
+            const known = seed.get(event.paneId);
+            if (known && event.to) known.agent_status = event.to;
+          },
+          {
+            signal,
+            onWarning: (message) => {
+              if (!json) warn2(style.dim(message));
+            }
+          }
+        );
+        if (carriedTraffic || now() - startedAt >= STREAM_HEALTHY_MS) {
+          attempt = 0;
+        }
+      }
+    } catch (error) {
+      if (signal?.aborted) return;
+      waitingForPanes = false;
+      warn2(`herdr watch: ${formatFailureMessage(error)}`);
+    }
+    if (signal?.aborted) return;
+    const delay = watchBackoffMs(
+      attempt,
+      waitingForPanes ? WAIT_FOR_PANES_MAX_MS : void 0
+    );
+    attempt += 1;
+    if (!json && !waitingForPanes) {
+      warn2(style.dim(`reconnecting in ${delay / 1e3}s\u2026`));
+    }
+    await ports.sleep(delay, signal);
+  }
+}
+function exitCleanlyOnBrokenPipe(stream, exit = (code) => process.exit(code), report = (line) => process.stderr.write(line)) {
+  stream.on("error", (error) => {
+    if (error.code === "EPIPE" || error.code === "ERR_STREAM_DESTROYED") {
+      exit(0);
+      return;
+    }
+    report(`error: ${formatFailureMessage(error)}
+`);
+    exit(1);
+  });
+}
+function registerHerdr(program2) {
+  const herdr = program2.command("herdr").description(
+    "Drive local Herdr agents (herdr.dev) over its Unix-socket API \u2014 list, read, send, watch"
+  );
+  herdr.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom herdr list                         every pane Herdr is tracking, with status
+  $ sechroom herdr list --json                  machine output
+  $ sechroom herdr read w6                      last 40 lines of w6:p1 (bare workspace -> :p1)
+  $ sechroom herdr read w6:p1 --lines 200       more scrollback
+  $ sechroom herdr read w6:p1 --source visible  only what's on screen
+  $ sechroom herdr send w6 "run the tests and report back"
+  $ cat brief.md | sechroom herdr send w6:p1 --stdin      long dispatch from stdin
+  $ sechroom herdr watch                        live status transitions; Ctrl-C to stop
+  $ sechroom herdr watch --json | jq .           one JSON object per event
+
+Socket: --socket <path>, else $HERDR_SOCKET, else ~/.config/herdr/herdr.sock.
+Read sources: ${HERDR_READ_SOURCES.join(" | ")}.
+
+watch event types: pane.agent_status_changed, pane.exited, and pane.appeared \u2014
+the last is SYNTHESIZED by this CLI (Herdr does not push it) when a transition
+is re-derived from agent.list and a pane is present that wasn't before.
+
+Tool use only: this talks to a running Herdr over its local socket. Herdr is
+AGPL \u2014 no Herdr code is vendored here.`
+  );
+  const withSocket = (command) => command.option(
+    "--socket <path>",
+    "Herdr socket path (default: $HERDR_SOCKET, else ~/.config/herdr/herdr.sock)"
+  );
+  const portsFor = (opts) => createHerdrPorts(resolveSocketPath(opts.socket));
+  withSocket(
+    herdr.command("list").description(
+      "List the agents Herdr is tracking (name, status, cwd, pane)"
+    )
+  ).action(async (opts, cmd) => {
+    exitCleanlyOnBrokenPipe(process.stdout);
+    try {
+      await runList2(portsFor(opts), Boolean(cmd.optsWithGlobals().json));
+    } catch (error) {
+      fail(error);
+    }
+  });
+  withSocket(
+    herdr.command("read <target>").description(
+      `Print a pane's text (default ${DEFAULT_READ_LINES} lines, source ${DEFAULT_READ_SOURCE})`
+    ).option("--lines <n>", `Lines to read (default ${DEFAULT_READ_LINES})`).option(
+      "--source <source>",
+      `One of ${HERDR_READ_SOURCES.join(" | ")} (default ${DEFAULT_READ_SOURCE})`
+    )
+  ).action(async (target, opts, cmd) => {
+    exitCleanlyOnBrokenPipe(process.stdout);
+    try {
+      await runRead(
+        portsFor(opts),
+        target,
+        opts,
+        Boolean(cmd.optsWithGlobals().json)
+      );
+    } catch (error) {
+      fail(error);
+    }
+  });
+  withSocket(
+    herdr.command("send <target> [text...]").description("Type a prompt into a pane and press enter").option("--stdin", "Read the prompt body from stdin instead of arguments")
+  ).action(async (target, textArgs, opts, cmd) => {
+    try {
+      const text2 = resolveSendText(textArgs ?? [], Boolean(opts.stdin));
+      await runSend(
+        portsFor(opts),
+        target,
+        text2,
+        Boolean(cmd.optsWithGlobals().json)
+      );
+    } catch (error) {
+      fail(error);
+    }
+  });
+  withSocket(
+    herdr.command("watch").description(
+      "Stream agent status transitions live (reconnects on drop; Ctrl-C to stop)"
+    )
+  ).action(async (opts, cmd) => {
+    exitCleanlyOnBrokenPipe(process.stdout);
+    const controller = new AbortController();
+    const onSignal = () => controller.abort();
+    process.once("SIGINT", onSignal);
+    process.once("SIGTERM", onSignal);
+    try {
+      await runWatch(portsFor(opts), {
+        json: Boolean(cmd.optsWithGlobals().json),
+        signal: controller.signal
+      });
+    } catch (error) {
+      fail(error);
+    } finally {
+      process.off("SIGINT", onSignal);
+      process.off("SIGTERM", onSignal);
+    }
+  });
+}
+
 // src/commands/lane.ts
 var LANE_KEYS = ["code-lane", "design-lane"];
 function showLane(json) {
@@ -7874,20 +8873,211 @@ Examples:
 }
 
 // src/commands/memory.ts
-import { readFileSync as readFileSync11 } from "fs";
-import { basename as basename2 } from "path";
+import { readFileSync as readFileSync14 } from "fs";
+
+// src/commands/memory-import.ts
+import { readdirSync as readdirSync2, readFileSync as readFileSync13, realpathSync, statSync as statSync3 } from "fs";
+import { basename as basename4, join as join17, resolve as resolve5 } from "path";
+var MARKDOWN_RE = /\.(md|markdown)$/i;
+function isMarkdownPath(path) {
+  return MARKDOWN_RE.test(path);
+}
+function defaultTitleForFile(text2, path) {
+  const heading = text2.match(/^#\s+(.+?)\s*$/m)?.[1];
+  if (heading) return heading;
+  return path == null ? null : basename4(path).replace(/\.(md|markdown|txt)$/i, "");
+}
+function collectImportFiles(inputs, opts = {}) {
+  const files = [];
+  const skipped = [];
+  const missing = [];
+  const seen = /* @__PURE__ */ new Set();
+  const addFile = (path) => {
+    let key;
+    try {
+      key = realpathSync(path);
+    } catch {
+      key = resolve5(path);
+    }
+    if (seen.has(key)) return;
+    seen.add(key);
+    files.push(path);
+  };
+  const walk = (dir) => {
+    const entries = readdirSync2(dir, { withFileTypes: true }).sort(
+      (a, b) => a.name.localeCompare(b.name)
+    );
+    for (const entry of entries) {
+      if (entry.name.startsWith(".")) continue;
+      const child = join17(dir, entry.name);
+      let isDirectory = entry.isDirectory();
+      let isFile = entry.isFile();
+      if (entry.isSymbolicLink()) {
+        let target;
+        try {
+          target = statSync3(child);
+        } catch {
+          skipped.push({ path: child, reason: "broken symlink" });
+          continue;
+        }
+        if (target.isDirectory()) {
+          skipped.push({
+            path: child,
+            reason: "symlinked directory \u2014 not followed"
+          });
+          continue;
+        }
+        isDirectory = false;
+        isFile = target.isFile();
+      }
+      if (isDirectory) {
+        if (opts.recursive) walk(child);
+        else
+          skipped.push({
+            path: child,
+            reason: "subdirectory \u2014 pass --recursive"
+          });
+        continue;
+      }
+      if (!isFile) {
+        skipped.push({ path: child, reason: "not a regular file" });
+        continue;
+      }
+      if (!isMarkdownPath(entry.name)) {
+        skipped.push({ path: child, reason: "not markdown" });
+        continue;
+      }
+      addFile(child);
+    }
+  };
+  for (const input of inputs) {
+    let isDirectory;
+    try {
+      isDirectory = statSync3(input).isDirectory();
+    } catch {
+      missing.push(input);
+      continue;
+    }
+    if (isDirectory) walk(input);
+    else addFile(input);
+  }
+  return { files, skipped, missing };
+}
+function buildImportPlan(collected) {
+  const rows = [];
+  const skipped = [...collected.skipped];
+  for (const path of collected.files) {
+    let text2;
+    try {
+      text2 = readFileSync13(path, "utf8");
+    } catch (error) {
+      throw new Error(
+        `couldn't read ${path}: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+    if (text2.trim().length === 0) {
+      skipped.push({ path, reason: "empty file" });
+      continue;
+    }
+    rows.push({ path, title: defaultTitleForFile(text2, path), text: text2 });
+  }
+  return { rows, skipped };
+}
+function classifyWorkspaceArg(value) {
+  const trimmed = value.trim();
+  return trimmed.startsWith("wsp_") ? { kind: "id", id: trimmed } : { kind: "name", name: trimmed };
+}
+function matchWorkspacesByName(rows, name) {
+  const target = name.trim().toLowerCase();
+  return rows.filter((row) => row.name.trim().toLowerCase() === target);
+}
+async function resolveImportWorkspace(arg, opts, ports) {
+  const unresolved = { created: false, wouldCreate: false };
+  if (!arg) return { id: null, name: null, ...unresolved };
+  const classified = classifyWorkspaceArg(arg);
+  if (classified.kind === "id") {
+    return { id: classified.id, name: null, ...unresolved };
+  }
+  const name = classified.name;
+  const matches = matchWorkspacesByName(await ports.listWorkspaces(), name);
+  if (matches.length > 1) {
+    const candidates = matches.map((match) => `${match.id} ("${match.name}")`).join(", ");
+    throw new Error(
+      `Workspace name "${name}" is ambiguous \u2014 ${matches.length} matches: ${candidates}. Pass --workspace <wsp_id>.`
+    );
+  }
+  if (matches.length === 1) {
+    const match = matches[0];
+    return { id: match.id, name: match.name, ...unresolved };
+  }
+  if (!opts.createWorkspace) {
+    throw new Error(
+      `No workspace named "${name}". Pass --create-workspace to create it, or --workspace <wsp_id>.`
+    );
+  }
+  if (opts.dryRun) {
+    return { id: null, name, created: false, wouldCreate: true };
+  }
+  const created = await ports.createWorkspace(name);
+  return { id: created.id, name, created: true, wouldCreate: false };
+}
+async function executeImport(rows, options, ports, onCreated) {
+  const created = [];
+  for (const row of rows) {
+    const ref = await ports.createMemory({
+      text: row.text,
+      title: row.title,
+      type: options.type,
+      tags: options.tags,
+      source: options.source,
+      confidence: options.confidence,
+      workspaceId: options.workspaceId
+    });
+    const entry = {
+      path: row.path,
+      id: ref.id,
+      title: row.title,
+      url: ref.url ?? null
+    };
+    created.push(entry);
+    onCreated?.(entry);
+  }
+  return created;
+}
+async function unwrapApi(call) {
+  const res = await call;
+  const queued = res.data ?? res.error;
+  if (res.response?.status === 202 && isGovernanceQueued(queued)) {
+    throw new Error(
+      "the write is queued for operator approval \u2014 import stopped."
+    );
+  }
+  const httpFailed = res.response !== void 0 && !res.response.ok;
+  if (res.error !== void 0 && res.error !== null || httpFailed) {
+    throw new Error(
+      formatFailureMessage(
+        res.error ?? (res.response ? `HTTP ${res.response.status} ${res.response.statusText}`.trim() : "request failed")
+      )
+    );
+  }
+  return res.data;
+}
+
+// src/commands/memory.ts
 function resolveCreateBody(textOpt, fileOpt) {
   if (textOpt == null === (fileOpt == null)) {
     fail("Provide exactly one of --text or --file.");
   }
   if (textOpt != null) return { text: textOpt, defaultTitle: null };
   const fromStdin = fileOpt === "-";
-  const text2 = fromStdin ? readFileSync11(0, "utf8") : readFileSync11(String(fileOpt), "utf8");
+  const text2 = fromStdin ? readFileSync14(0, "utf8") : readFileSync14(String(fileOpt), "utf8");
   if (text2.trim().length === 0) {
     fail(fromStdin ? "Stdin was empty." : `File is empty: ${fileOpt}`);
   }
-  const heading = text2.match(/^#\s+(.+?)\s*$/m)?.[1];
-  const defaultTitle = heading ?? (fromStdin ? null : basename2(String(fileOpt)).replace(/\.(md|markdown|txt)$/i, ""));
+  const defaultTitle = defaultTitleForFile(
+    text2,
+    fromStdin ? null : String(fileOpt)
+  );
   return { text: text2, defaultTitle };
 }
 function registerMemory(program2) {
@@ -7900,6 +9090,8 @@ Examples:
   $ sechroom memory create --text "filed note" --owner-type Workspace --owner-id wsp_XXXX
   $ sechroom memory create --file docs/conventions.md --owner-type Workspace --owner-id wsp_XXXX
   $ cat NOTES.md | sechroom memory create --file - --tag kind:reference
+  $ sechroom memory import docs/ --workspace "Team Notes" --create-workspace --tag kind:reference
+  $ sechroom memory import notes/*.md --workspace wsp_XXXX --dry-run
   $ sechroom memory search "rate limiting" --limit 5 --tag kind:decision
   $ sechroom memory search "auth flow" --workspace wsp_XXXX --json
   $ sechroom memory get mem_XXXX --json
@@ -7953,6 +9145,195 @@ Examples:
       cmd.optsWithGlobals().json
     );
   });
+  memory.command("import <paths...>").description(
+    "Bulk-import files as memories (POST /memories per file); a directory contributes its *.md"
+  ).option(
+    "--workspace <nameOrId>",
+    "Target workspace: a wsp_ id, or a name (case-insensitive exact match). Omit to import Unfiled."
+  ).option(
+    "--create-workspace",
+    "Create the --workspace when its name matches nothing",
+    false
+  ).option("--recursive", "Walk subdirectories of a given directory", false).option("--type <type>", "Memory type", "reference").option("--tag <tag...>", "Tags applied to every memory (repeatable)").option("--source <source>", "Source / lane stamp", "cli").option("--confidence <n>", "Confidence 0..1", "1.0").option("--dry-run", "Resolve and print the plan; write nothing", false).action(async (paths, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const json = Boolean(cmd.optsWithGlobals().json);
+    const dryRun = Boolean(opts.dryRun);
+    if (opts.createWorkspace && !opts.workspace) {
+      fail("--create-workspace needs --workspace <name>.");
+    }
+    const collected = collectImportFiles(paths, {
+      recursive: Boolean(opts.recursive)
+    });
+    if (collected.missing.length > 0) {
+      fail(`no such file or directory: ${collected.missing.join(", ")}`);
+    }
+    const plan = (() => {
+      try {
+        return buildImportPlan(collected);
+      } catch (error) {
+        return fail(error);
+      }
+    })();
+    if (plan.rows.length === 0) {
+      fail(
+        `nothing to import from ${paths.join(", ")} \u2014 a directory contributes *.md / *.markdown (add --recursive for subdirectories), and empty files are skipped.`
+      );
+    }
+    let cached;
+    const client = async () => cached ??= await makeClient(cfg);
+    const ports = {
+      listWorkspaces: async () => {
+        const data = await unwrapApi(
+          (await client()).GET("/workspaces", {
+            params: { query: { includeArchived: false } }
+          })
+        );
+        const items = data ?? [];
+        return items.map((row) => row.item ?? row).filter((w) => Boolean(w?.id && w?.name));
+      },
+      createWorkspace: async (name) => unwrapApi(
+        (await client()).POST("/workspaces", {
+          body: { name, description: null, parentId: null }
+        })
+      ),
+      createMemory: async (input) => unwrapApi(
+        (await client()).POST("/memories", {
+          body: {
+            text: input.text,
+            type: input.type,
+            content: "{}",
+            confidence: input.confidence,
+            source: input.source,
+            archetype: "Document",
+            title: input.title,
+            tags: input.tags,
+            owner: input.workspaceId ? { type: "Workspace", id: input.workspaceId } : null
+          }
+        })
+      )
+    };
+    const workspace = await resolveImportWorkspace(
+      opts.workspace,
+      { createWorkspace: Boolean(opts.createWorkspace), dryRun },
+      ports
+    ).catch((error) => fail(error));
+    const destination = workspace.id ? `${style.bold(workspace.id)}${workspace.name ? ` ${style.dim(`"${workspace.name}"`)}` : ""}${workspace.created ? " (created)" : ""}` : workspace.wouldCreate ? `${style.dim(`"${workspace.name}"`)} (would create)` : "Unfiled";
+    const skippedLines = plan.skipped.map(
+      (s) => `  ${style.dim("skipped")} ${s.path} ${style.dim(`(${s.reason})`)}`
+    );
+    if (dryRun) {
+      if (json) {
+        return emit(
+          {
+            dryRun: true,
+            workspace: {
+              id: workspace.id,
+              name: workspace.name,
+              created: false,
+              wouldCreate: workspace.wouldCreate
+            },
+            plan: plan.rows.map((row) => ({
+              path: row.path,
+              title: row.title,
+              chars: row.text.length
+            })),
+            skipped: plan.skipped
+          },
+          true
+        );
+      }
+      process.stdout.write(
+        `${style.dim("dry run \u2014 nothing written")}
+${plan.rows.map(
+          (row) => `  ${row.path} ${style.dim("\u2192")} "${row.title}" ${style.dim("\u2192")} ${destination}`
+        ).join("\n")}
+`
+      );
+      if (skippedLines.length > 0) {
+        process.stdout.write(`${skippedLines.join("\n")}
+`);
+      }
+      process.stdout.write(
+        `${plan.rows.length} memor${plan.rows.length === 1 ? "y" : "ies"} would be created.
+`
+      );
+      return;
+    }
+    const created = [];
+    try {
+      await executeImport(
+        plan.rows,
+        {
+          workspaceId: workspace.id,
+          type: opts.type,
+          tags: opts.tag ?? null,
+          source: opts.source,
+          confidence: Number(opts.confidence)
+        },
+        ports,
+        (entry) => {
+          created.push(entry);
+          if (json) return;
+          const view = resolveViewUrl(cfg.baseUrl, entry.url);
+          process.stdout.write(
+            `${ok("\u2713")} ${style.bold(entry.id)} ${style.dim("\u2190")} ${entry.path}${view ? ` ${style.dim("\u2192")} ${view}` : ""}
+`
+          );
+        }
+      );
+    } catch (error) {
+      if (json) {
+        emit(
+          {
+            dryRun: false,
+            ok: false,
+            workspace: {
+              id: workspace.id,
+              name: workspace.name,
+              created: workspace.created
+            },
+            created,
+            createdCount: created.length,
+            skipped: plan.skipped,
+            remaining: plan.rows.length - created.length
+          },
+          true
+        );
+      } else {
+        process.stderr.write(
+          `${created.length} of ${plan.rows.length} memor${plan.rows.length === 1 ? "y" : "ies"} created before the failure.
+`
+        );
+      }
+      fail(error);
+    }
+    if (json) {
+      return emit(
+        {
+          dryRun: false,
+          ok: true,
+          workspace: {
+            id: workspace.id,
+            name: workspace.name,
+            created: workspace.created
+          },
+          created,
+          createdCount: created.length,
+          skipped: plan.skipped
+        },
+        true
+      );
+    }
+    if (skippedLines.length > 0) {
+      process.stdout.write(`${skippedLines.join("\n")}
+`);
+    }
+    emitAction(
+      `imported ${style.bold(String(created.length))} memor${created.length === 1 ? "y" : "ies"} into ${destination}`,
+      created,
+      false
+    );
+  });
   memory.command("get <memoryId>").description("Fetch a memory by id (GET /memories/{memoryId})").action(async (memoryId, _opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Fetching memory", async () => {
@@ -8309,8 +9690,8 @@ Examples:
 
 // src/setup/apply.ts
 import { createHash as createHash4 } from "crypto";
-import { mkdirSync as mkdirSync13, readFileSync as readFileSync12, writeFileSync as writeFileSync12, existsSync as existsSync11 } from "fs";
-import { dirname as dirname12 } from "path";
+import { mkdirSync as mkdirSync15, readFileSync as readFileSync15, writeFileSync as writeFileSync14, existsSync as existsSync12 } from "fs";
+import { dirname as dirname14 } from "path";
 var MARKER_BEGIN = "<!-- @sechroom/cli:begin";
 var MARKER_END = "<!-- @sechroom/cli:end";
 function normalizeBody(s) {
@@ -8363,22 +9744,22 @@ function parseManagedBlock(content, block) {
   return null;
 }
 function ensureDir2(path) {
-  mkdirSync13(dirname12(path), { recursive: true });
+  mkdirSync15(dirname14(path), { recursive: true });
 }
 function readOr(path, fallback) {
   try {
-    return readFileSync12(path, "utf8");
+    return readFileSync15(path, "utf8");
   } catch {
     return fallback;
   }
 }
 function mergeMcpJson(path, snippet, dryRun) {
   const incoming = JSON.parse(snippet);
-  const existed = existsSync11(path);
+  const existed = existsSync12(path);
   let current = {};
   if (existed) {
     try {
-      current = JSON.parse(readFileSync12(path, "utf8"));
+      current = JSON.parse(readFileSync15(path, "utf8"));
     } catch {
       return { kind: "mcp", path, status: "skipped", note: "existing file isn't valid JSON \u2014 left untouched" };
     }
@@ -8386,26 +9767,26 @@ function mergeMcpJson(path, snippet, dryRun) {
   current.mcpServers = { ...current.mcpServers ?? {}, ...incoming.mcpServers ?? {} };
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync12(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
+  writeFileSync14(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function mergeCodexToml(path, snippet, dryRun) {
-  const existed = existsSync11(path);
+  const existed = existsSync12(path);
   let body = readOr(path, "");
   body = body.replace(/(^|\n)\[mcp_servers\.sechroom\][^[]*/, "\n").replace(/\n{3,}/g, "\n\n");
   const trimmed = body.trim();
   const next = (trimmed.length > 0 ? trimmed + "\n\n" : "") + snippet.trim() + "\n";
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync12(path, next, { mode: 384 });
+  writeFileSync14(path, next, { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function writeInstructionBlock(path, write, dryRun) {
-  const existed = existsSync11(path);
+  const existed = existsSync12(path);
   const next = computeBlockFile(readOr(path, ""), write);
   if (dryRun) return { kind: "instruction", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync12(path, next);
+  writeFileSync14(path, next);
   return { kind: "instruction", path, status: existed ? "merged" : "created" };
 }
 function computeBlockFile(current, write) {
@@ -8446,7 +9827,7 @@ function applyBlock(path, write, mode, dryRun) {
     const next = computeBlockFile(current, write);
     if (!dryRun) {
       ensureDir2(proposedPath);
-      writeFileSync12(proposedPath, next);
+      writeFileSync14(proposedPath, next);
     }
     return {
       kind: "instruction",
@@ -8576,8 +9957,8 @@ auto-resumes where you left off and checkpoints working state before compacting.
 }
 
 // src/setup/skills-offer.ts
-import { mkdirSync as mkdirSync14, writeFileSync as writeFileSync13 } from "fs";
-import { join as join15 } from "path";
+import { mkdirSync as mkdirSync16, writeFileSync as writeFileSync15 } from "fs";
+import { join as join18 } from "path";
 
 // src/setup/lane-pin.ts
 var CODE_LANE_PREFIX_BY_CLIENT = {
@@ -8693,8 +10074,8 @@ Found ${summary} available to you for ${surface}.
   if (skills.length > 0) {
     const written = [];
     for (const s of skills) {
-      mkdirSync14(join15(sDir, s.name), { recursive: true });
-      writeFileSync13(join15(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
+      mkdirSync16(join18(sDir, s.name), { recursive: true });
+      writeFileSync15(join18(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
       written.push(s.name);
     }
     recordMaterialisedSkills(sDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -8702,11 +10083,11 @@ Found ${summary} available to you for ${surface}.
 `);
   }
   if (agents.length > 0) {
-    mkdirSync14(aDir, { recursive: true });
+    mkdirSync16(aDir, { recursive: true });
     const written = [];
     for (const a of agents) {
       const file = `${a.name}.md`;
-      writeFileSync13(join15(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
+      writeFileSync15(join18(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
       written.push(file);
     }
     recordMaterialisedSkills(aDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -9089,13 +10470,13 @@ Wired to namespace '${slug2}'. Restart your AI client (or reload MCP) to pick it
 }
 
 // src/commands/onboard.ts
-import { existsSync as existsSync13 } from "fs";
-import { basename as basename3, join as join17 } from "path";
+import { existsSync as existsSync14 } from "fs";
+import { basename as basename5, join as join20 } from "path";
 
 // src/commands/fanout.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync13, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
-import { isAbsolute, join as join16, resolve as resolve4 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync16, readdirSync as readdirSync3, statSync as statSync4 } from "fs";
+import { isAbsolute as isAbsolute2, join as join19, resolve as resolve6 } from "path";
 var ICON = {
   refresh: "\u21BB",
   bind: "+",
@@ -9103,33 +10484,33 @@ var ICON = {
   "skip-unbound": "\u26A0"
 };
 function resolveChildDir(path, root) {
-  return isAbsolute(path) ? path : resolve4(root, path);
+  return isAbsolute2(path) ? path : resolve6(root, path);
 }
 function discoverChildren(root) {
   let names;
   try {
-    names = readdirSync2(root);
+    names = readdirSync3(root);
   } catch {
     return [];
   }
   const out = [];
   for (const name of names.sort()) {
     if (name.startsWith(".") || name === "node_modules") continue;
-    const dir = join16(root, name);
+    const dir = join19(root, name);
     try {
-      if (!statSync3(dir).isDirectory()) continue;
+      if (!statSync4(dir).isDirectory()) continue;
     } catch {
       continue;
     }
-    if (existsSync12(join16(dir, ".git")) || committedBindingPath(dir)) out.push(name);
+    if (existsSync13(join19(dir, ".git")) || committedBindingPath(dir)) out.push(name);
   }
   return out;
 }
 function readManifest(path) {
-  if (!existsSync12(path)) return null;
+  if (!existsSync13(path)) return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync13(path, "utf8"));
+    parsed = JSON.parse(readFileSync16(path, "utf8"));
   } catch (err2) {
     throw new Error(`couldn't parse ${path}: ${err2 instanceof Error ? err2.message : String(err2)}`);
   }
@@ -9299,7 +10680,7 @@ function personalSubtreeIds(personalId, all) {
 }
 async function pickWorkspace(client, opts = {}) {
   const promptLabel = opts.promptLabel ?? "Bind this directory to a workspace:";
-  const dirName = opts.dirName ?? basename3(process.cwd());
+  const dirName = opts.dirName ?? basename5(process.cwd());
   const all = await withSpinner("Listing your workspaces", () => fetchWorkspaces(client));
   if (all.length === 0) {
     process.stderr.write(`no workspaces found \u2014 skipping workspace binding (you can set it later with \`sechroom config set --local workspaceId <id>\`)
@@ -9350,7 +10731,7 @@ async function resolveWorkspaceBinding(client, existing, opts) {
   }
   if (existing) return existing;
   if (!canPrompt() || opts.yes) return void 0;
-  return pickWorkspace(client, { dirName: basename3(process.cwd()) });
+  return pickWorkspace(client, { dirName: basename5(process.cwd()) });
 }
 async function ensureTenant(baseUrl, g, opts) {
   const persisted = readPersisted();
@@ -9495,10 +10876,10 @@ async function chooseScope(scopeFlag, yes) {
 }
 async function planRecurseChild(entry, root, client, opts) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync13(dir)) {
+  if (!existsSync14(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
-  if (existsSync13(join17(dir, ".sechroom.json"))) {
+  if (existsSync14(join20(dir, ".sechroom.json"))) {
     return {
       label: entry.path,
       dir,
@@ -9527,7 +10908,7 @@ ${style.bold(entry.path)} ${style.dim("is not bound yet.")}
 `);
   const ws = await pickWorkspace(client, {
     promptLabel: `Bind ${style.cyan(entry.path)} to a workspace:`,
-    dirName: basename3(entry.path)
+    dirName: basename5(entry.path)
   });
   if (!ws) {
     return { label: entry.path, dir, disposition: "skip-unbound", argv: [], reason: "unbound \u2014 no workspace chosen (skipped)" };
@@ -9571,7 +10952,7 @@ This fan-out will pin the same lane in every repo:
 async function runRecurse(cfg, g, opts) {
   const { yes, dryRun, json } = opts;
   const root = process.cwd();
-  const manifestPath = join17(root, ".sechroom", "repos.json");
+  const manifestPath = join20(root, ".sechroom", "repos.json");
   const fromManifest = readManifest(manifestPath);
   const entries = fromManifest ?? discoverChildren(root).map((path) => ({ path }));
   const sourceLabel = fromManifest ? `manifest ${manifestPath}` : `auto-discovered under ${root}`;
@@ -10103,32 +11484,32 @@ Examples:
 }
 
 // src/commands/reset.ts
-import { homedir as homedir5 } from "os";
-import { join as join18 } from "path";
-import { existsSync as existsSync14, readFileSync as readFileSync14, rmSync as rmSync5 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join21 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync17, rmSync as rmSync6 } from "fs";
 var SKILLS_LOCK2 = ".sechroom-skills.json";
-var localSkillsDir = () => join18(process.cwd(), ".claude", "skills");
-var globalSkillsDir = () => join18(homedir5(), ".claude", "skills");
-var localAgentsDir = () => join18(process.cwd(), ".claude", "agents");
-var globalAgentsDir = () => join18(homedir5(), ".claude", "agents");
+var localSkillsDir = () => join21(process.cwd(), ".claude", "skills");
+var globalSkillsDir = () => join21(homedir6(), ".claude", "skills");
+var localAgentsDir = () => join21(process.cwd(), ".claude", "agents");
+var globalAgentsDir = () => join21(homedir6(), ".claude", "agents");
 function removeMaterialisedSkills(dir) {
   const removed = [];
-  const lockPath = join18(dir, SKILLS_LOCK2);
-  if (!existsSync14(lockPath)) return removed;
+  const lockPath = join21(dir, SKILLS_LOCK2);
+  if (!existsSync15(lockPath)) return removed;
   try {
-    const lock = JSON.parse(readFileSync14(lockPath, "utf8"));
+    const lock = JSON.parse(readFileSync17(lockPath, "utf8"));
     for (const entry of Object.values(lock)) {
       for (const name of entry.skills ?? []) {
-        const p = join18(dir, name);
-        if (existsSync14(p)) {
-          rmSync5(p, { recursive: true, force: true });
+        const p = join21(dir, name);
+        if (existsSync15(p)) {
+          rmSync6(p, { recursive: true, force: true });
           removed.push(p);
         }
       }
     }
   } catch {
   }
-  rmSync5(lockPath, { force: true });
+  rmSync6(lockPath, { force: true });
   removed.push(lockPath);
   return removed;
 }
@@ -10165,19 +11546,19 @@ function registerReset(program2) {
       }
     }
     const removed = [];
-    const stateDir = join18(process.cwd(), ".sechroom");
-    if (existsSync14(stateDir)) {
-      rmSync5(stateDir, { recursive: true, force: true });
+    const stateDir = join21(process.cwd(), ".sechroom");
+    if (existsSync15(stateDir)) {
+      rmSync6(stateDir, { recursive: true, force: true });
       removed.push(stateDir);
     }
-    const legacyCfg = join18(process.cwd(), ".sechroom.json");
-    if (existsSync14(legacyCfg)) {
-      rmSync5(legacyCfg, { force: true });
+    const legacyCfg = join21(process.cwd(), ".sechroom.json");
+    if (existsSync15(legacyCfg)) {
+      rmSync6(legacyCfg, { force: true });
       removed.push(legacyCfg);
     }
-    const legacySem = join18(process.cwd(), ".sem");
-    if (existsSync14(legacySem)) {
-      rmSync5(legacySem, { force: true });
+    const legacySem = join21(process.cwd(), ".sem");
+    if (existsSync15(legacySem)) {
+      rmSync6(legacySem, { force: true });
       removed.push(legacySem);
     }
     removed.push(...removeMaterialisedSkills(localSkillsDir()));
@@ -10202,8 +11583,8 @@ function registerReset(program2) {
 }
 
 // src/commands/skills.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync15, statSync as statSync4, writeFileSync as writeFileSync14 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync17, statSync as statSync5, writeFileSync as writeFileSync16 } from "fs";
+import { join as join22 } from "path";
 function filenameFromDisposition(header) {
   if (!header) return void 0;
   const m = /filename\*?=(?:UTF-8'')?"?([^";]+)"?/i.exec(header);
@@ -10211,11 +11592,11 @@ function filenameFromDisposition(header) {
 }
 function resolveOutputPath(output, serverFilename) {
   const filename = serverFilename || "skills.zip";
-  if (!output) return join19(process.cwd(), filename);
-  const looksLikeDir = output.endsWith("/") || existsSync15(output) && statSync4(output).isDirectory();
+  if (!output) return join22(process.cwd(), filename);
+  const looksLikeDir = output.endsWith("/") || existsSync16(output) && statSync5(output).isDirectory();
   if (looksLikeDir) {
-    mkdirSync15(output, { recursive: true });
-    return join19(output, filename);
+    mkdirSync17(output, { recursive: true });
+    return join22(output, filename);
   }
   return output;
 }
@@ -10246,7 +11627,7 @@ async function downloadZip(label, call, output) {
   const buf = Buffer.from(res.data);
   const filename = filenameFromDisposition(res.response.headers.get("content-disposition")) ?? "skills.zip";
   const path = resolveOutputPath(output, filename);
-  writeFileSync14(path, buf);
+  writeFileSync16(path, buf);
   return { path, bytes: buf.length, filename };
 }
 function registerSkills(program2) {
@@ -10420,12 +11801,12 @@ clients select all; an unconfigured machine preserves the legacy Claude default.
 }
 
 // src/commands/sweep.ts
-import { existsSync as existsSync16 } from "fs";
-import { dirname as dirname13, join as join20, resolve as resolve5 } from "path";
-var DEFAULT_MANIFEST = join20(".sechroom", "repos.json");
+import { existsSync as existsSync17 } from "fs";
+import { dirname as dirname15, join as join23, resolve as resolve7 } from "path";
+var DEFAULT_MANIFEST = join23(".sechroom", "repos.json");
 function planEntry(entry, root) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync16(dir)) {
+  if (!existsSync17(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
   if (committedBindingPath(dir)) {
@@ -10485,7 +11866,7 @@ Examples:
     const g = cmd.optsWithGlobals();
     const json = Boolean(g.json);
     const dryRun = Boolean(opts.dryRun);
-    const manifestPath = resolve5(opts.manifest);
+    const manifestPath = resolve7(opts.manifest);
     let repos;
     try {
       repos = readManifest(manifestPath);
@@ -10501,7 +11882,7 @@ Examples:
 `);
       return;
     }
-    const root = dirname13(dirname13(manifestPath));
+    const root = dirname15(dirname15(manifestPath));
     const plans = repos.map((entry) => planEntry(entry, root));
     if (!json) {
       process.stderr.write(
@@ -10921,7 +12302,7 @@ async function readStdin4() {
 function resolveVersion() {
   try {
     const pkg = JSON.parse(
-      readFileSync15(new URL("../package.json", import.meta.url), "utf8")
+      readFileSync18(new URL("../package.json", import.meta.url), "utf8")
     );
     return pkg.version ?? "0.0.0";
   } catch {
@@ -11101,6 +12482,7 @@ registerAgents(program);
 registerLane(program);
 registerChannel(program);
 registerTelemetry(program);
+registerHerdr(program);
 registerReset(program);
 program.parseAsync().catch((err2) => {
   process.stderr.write(