@sechroom/cli 2026.7.5 → 2026.7.6-rc.a2828c37

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 import { Command } from "commander";
 
 // src/auth.ts
@@ -439,6 +439,9 @@ var quiet = false;
 function setQuiet(q) {
   quiet = q;
 }
+function isQuiet() {
+  return quiet;
+}
 function colorOn() {
   return !quiet && !process.env.NO_COLOR && process.env.FORCE_COLOR !== "0" && Boolean(process.stdout.isTTY);
 }
@@ -615,6 +618,22 @@ function emitAction(summary, data, json) {
   process.stdout.write(`${ok("\u2713")} ${summary}
 `);
 }
+var GOVERNANCE_QUEUED_PROBLEM_TYPE = "https://sechroom.dev/problems/governance-review-queued";
+function isGovernanceQueued(body) {
+  return typeof body === "object" && body !== null && "type" in body && body.type === GOVERNANCE_QUEUED_PROBLEM_TYPE;
+}
+function formatQueuedForApproval(body, json) {
+  if (json) return JSON.stringify(body) + "\n";
+  const b = body ?? {};
+  const detail = typeof b.detail === "string" ? b.detail : void 0;
+  const requestId = typeof b.requestId === "string" ? b.requestId : void 0;
+  const message = detail ?? "This change requires operator approval before it takes effect.";
+  let out = `${warn("\u29D7")} Pending approval \u2014 ${message}
+`;
+  if (requestId) out += `  ${style.dim(`request: ${requestId}`)}
+`;
+  return out;
+}
 async function runApi(label, fn) {
   const s = spinner(label);
   let res;
@@ -624,6 +643,12 @@ async function runApi(label, fn) {
     s.fail();
     fail(err2);
   }
+  const queuedBody = res.data ?? res.error;
+  if (res.response?.status === 202 && isGovernanceQueued(queuedBody)) {
+    s.stop();
+    process.stdout.write(formatQueuedForApproval(queuedBody, isQuiet()));
+    process.exit(0);
+  }
   const httpFailed = res.response !== void 0 && !res.response.ok;
   if (res.error !== void 0 && res.error !== null || httpFailed) {
     s.fail();
@@ -633,7 +658,22 @@ async function runApi(label, fn) {
   return res.data;
 }
 function fail(error) {
-  const msg = typeof error === "object" && error !== null && "title" in error ? String(error.title) : typeof error === "object" ? JSON.stringify(error) : String(error);
+  let msg;
+  if (typeof error === "object" && error !== null && "title" in error) {
+    const problem = error;
+    msg = String(problem.title);
+    if (problem.errors && typeof problem.errors === "object") {
+      const detail = Object.entries(problem.errors).flatMap(
+        ([field, msgs]) => (Array.isArray(msgs) ? msgs : [msgs]).map((m) => `  ${field}: ${String(m)}`)
+      );
+      if (detail.length > 0) msg += `
+${detail.join("\n")}`;
+    }
+  } else if (typeof error === "object" && error !== null) {
+    msg = JSON.stringify(error);
+  } else {
+    msg = String(error);
+  }
   process.stderr.write(`error: ${msg}
 `);
   process.exit(1);
@@ -1388,10 +1428,15 @@ var CLAUDE_HOOK_COMMANDS = {
   SessionStart: "sechroom hook session-start",
   PreCompact: "sechroom hook pre-compact",
   SessionEnd: "sechroom hook session-end",
-  // WLP telemetry tap (D-WLP-10) — per-turn executor self-report. No-op (exit 0) unless this
-  // checkout is bound to a decomposition+task via `sechroom telemetry bind`, so it's safe to wire
-  // for every Claude install. Claude-only (it parses a Claude Code transcript).
-  Stop: "sechroom telemetry hook"
+  // WLP telemetry tap (D-WLP-10 + FR-352 Tier 1) — per-turn executor self-report. The one
+  // `telemetry hook` verb dispatches on hook_event_name: Stop/SubagentStop → parsed (token/context) +
+  // terminal (turn end), Notification/PermissionDenied → approval. No-op (exit 0) unless this checkout
+  // is bound via `sechroom telemetry bind`, so it's safe to wire for every Claude install; an event a
+  // given Claude Code version doesn't know is inert (never fires). Claude-only.
+  Stop: "sechroom telemetry hook",
+  SubagentStop: "sechroom telemetry hook",
+  Notification: "sechroom telemetry hook",
+  PermissionDenied: "sechroom telemetry hook"
 };
 var CODEX_HOOK_COMMANDS = {
   SessionStart: "sechroom hook session-start",
@@ -1544,11 +1589,16 @@ function registerChannel(program2) {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const filter = readFilter(opts);
     const sub = await ensureSubscription(cfg, opts.name, filter);
-    const conn = await openConnection(cfg, (payload) => {
-      process.stdout.write(
+    const seen = /* @__PURE__ */ new Set();
+    const deliver = makeDeliver(
+      filter,
+      seen,
+      (payload) => process.stdout.write(
         (typeof payload === "string" ? payload : JSON.stringify(payload)) + "\n"
-      );
-    });
+      )
+    );
+    const conn = await openConnection(cfg, deliver);
+    await reconcile(cfg, filter, deliver);
     if (json) {
       emit(
         {
@@ -1585,7 +1635,8 @@ function registerChannel(program2) {
     );
     await mcp.connect(new StdioServerTransport());
     await ensureSubscription(cfg, opts.name, filter);
-    const conn = await openConnection(cfg, (payload) => {
+    const seen = /* @__PURE__ */ new Set();
+    const deliver = makeDeliver(filter, seen, (payload) => {
       const { content, meta } = summarizeEvent(payload);
       void mcp.notification({
         method: "notifications/claude/channel",
@@ -1595,6 +1646,8 @@ function registerChannel(program2) {
 `))
       );
     });
+    const conn = await openConnection(cfg, deliver);
+    await reconcile(cfg, filter, deliver);
     process.stderr.write(
       style.dim(
         `sechroom channel (mcp) \u2014 tenant ${cfg.tenant}, tags [${filter.tags.join(", ")}]
@@ -1605,7 +1658,10 @@ function registerChannel(program2) {
   });
   channel.command("install").description(
     "Wire `sechroom channel mcp` into the project .mcp.json as a Claude Code channel MCP server (idempotent)"
-  ).option("--workspace <wsp...>", "Restrict dispatches to these workspace id(s)").option(
+  ).option(
+    "--workspace <wsp...>",
+    "Restrict dispatches to these workspace id(s)"
+  ).option(
     "--tag <tag...>",
     "Tag(s) a dispatch must carry to match (repeatable). Default targets WLP task dispatches.",
     ["kind:task"]
@@ -1726,20 +1782,134 @@ function holdOpen(conn) {
     process.on("SIGTERM", stop);
   });
 }
-function summarizeEvent(payload) {
+function parseEvent(payload) {
   let data = payload;
   if (typeof payload === "string") {
     try {
       data = JSON.parse(payload);
     } catch {
-      return { content: payload, meta: {} };
+      return { eventType: "", memoryId: "", workspaceId: "", tags: void 0 };
     }
   }
   const obj = data ?? {};
   const inner = obj.data ?? obj;
-  const eventType = str(inner.eventType ?? inner.EventType ?? obj.type) || "substrate.event";
-  const memoryId = str(inner.memoryId ?? inner.MemoryId);
-  const workspaceId = str(inner.workspaceId ?? inner.WorkspaceId);
+  const rawTags = inner.tags ?? inner.Tags;
+  return {
+    eventType: str(inner.eventType ?? inner.EventType ?? obj.type) || "substrate.event",
+    memoryId: str(inner.memoryId ?? inner.MemoryId),
+    workspaceId: str(inner.workspaceId ?? inner.WorkspaceId),
+    tags: Array.isArray(rawTags) ? rawTags.filter((t) => typeof t === "string") : void 0
+  };
+}
+function shouldDeliver(payload, filter) {
+  const { workspaceId, tags } = parseEvent(payload);
+  if (filter.workspaceScope.length > 0 && (!workspaceId || !filter.workspaceScope.includes(workspaceId)))
+    return false;
+  if (filter.tags.length > 0) {
+    if (!tags) return false;
+    return facetedTagMatch(tags, filter.tags);
+  }
+  return true;
+}
+function makeDeliver(filter, seen, forward) {
+  return (payload) => {
+    if (!shouldDeliver(payload, filter)) return;
+    const { memoryId } = parseEvent(payload);
+    if (memoryId) {
+      if (seen.has(memoryId)) return;
+      seen.add(memoryId);
+    }
+    forward(payload);
+  };
+}
+async function reconcile(cfg, filter, deliver) {
+  if (filter.workspaceScope.length === 0) {
+    process.stderr.write(
+      style.dim(
+        "channel: no --workspace to reconcile against; live feed only (a dropped dispatch won't be recovered).\n"
+      )
+    );
+    return;
+  }
+  if (filter.tags.length === 0) return;
+  let token;
+  try {
+    token = await requireToken(cfg);
+  } catch {
+    return;
+  }
+  const qs = `filterTags=${encodeURIComponent(filter.tags.join(","))}&limit=100`;
+  let recovered = 0;
+  for (const ws of filter.workspaceScope) {
+    try {
+      const resp = await fetch(
+        `${cfg.baseUrl}/workspaces/${encodeURIComponent(ws)}/memories/feed?${qs}`,
+        {
+          headers: {
+            authorization: `Bearer ${token}`,
+            tenant: cfg.tenant,
+            "x-sechroom-surface": "cli"
+          }
+        }
+      );
+      if (!resp.ok) {
+        process.stderr.write(
+          err(
+            `channel: reconcile query for ${ws} failed (HTTP ${resp.status})
+`
+          )
+        );
+        continue;
+      }
+      const data = await resp.json();
+      for (const m of data.results ?? []) {
+        if (!m.id) continue;
+        deliver({
+          eventType: "reconcile",
+          memoryId: m.id,
+          workspaceId: ws,
+          tags: m.tags ?? []
+        });
+        recovered++;
+      }
+    } catch (e) {
+      process.stderr.write(
+        err(`channel: reconcile error for ${ws}: ${String(e)}
+`)
+      );
+    }
+  }
+  if (recovered > 0)
+    process.stderr.write(
+      style.dim(
+        `channel: reconciled ${recovered} already-queued event(s) on connect.
+`
+      )
+    );
+}
+function facetedTagMatch(eventTags, filterTags) {
+  const have = new Set(eventTags);
+  const groups = /* @__PURE__ */ new Map();
+  for (const f of filterTags) {
+    const ns = f.endsWith(":*") ? f.slice(0, -2) : namespaceOf(f);
+    const group = groups.get(ns) ?? [];
+    group.push(f);
+    groups.set(ns, group);
+  }
+  for (const [ns, group] of groups) {
+    const ok2 = group.some(
+      (f) => f.endsWith(":*") ? eventTags.some((t) => namespaceOf(t) === ns) : have.has(f)
+    );
+    if (!ok2) return false;
+  }
+  return true;
+}
+function namespaceOf(tag) {
+  const i = tag.indexOf(":");
+  return i >= 0 ? tag.slice(0, i) : tag;
+}
+function summarizeEvent(payload) {
+  const { eventType, memoryId, workspaceId } = parseEvent(payload);
   const content = memoryId ? `${eventType}: ${memoryId}${workspaceId ? ` (workspace ${workspaceId})` : ""}` : typeof payload === "string" ? payload : JSON.stringify(payload);
   const meta = {};
   if (eventType) meta.event_type = eventType;
@@ -2408,6 +2578,178 @@ Examples:
   });
 }
 
+// src/commands/close.ts
+import { readFileSync as readFileSync7 } from "fs";
+var VERDICTS = ["pass", "soft-fail", "plan-invalid", "blocked"];
+function registerClose(program2) {
+  program2.command("close").description(
+    "Close a dispatched WorkTask in one call: closeout memo (verdict + correlation) + Reference edge + source status flip. Managed runs stamp the run's matchTags verbatim (SBC-1180)."
+  ).requiredOption("--task <id>", "The WorkTask memory id being closed").requiredOption("--verdict <verdict>", `Verdict: ${VERDICTS.join(" | ")}`).requiredOption(
+    "--workspace <wsp>",
+    "Workspace that owns the closeout memo"
+  ).requiredOption("--title <title>", "Closeout title").option(
+    "--file <path>",
+    "Read the closeout body from a file (default: stdin)"
+  ).option(
+    "--decomposition <id>",
+    "Managed-run selector \u2014 the sug_ decomposition the task belongs to. Locates the parked run so its matchTags/verdict contract are read from state, not assembled from args."
+  ).option(
+    "--no-status-flip",
+    "Skip the status flip on a BARE task. (Managed runs never flip here \u2014 the run engine reflects the verdict onto the task on resume.)"
+  ).option(
+    "--to-version <n>",
+    "Pin the Reference edge at this task version \u2014 the DISPATCHED version the executor worked against (D-continuity-2). Default: the task's current version (status flips are metadata edits that don't bump the version, so current == dispatched in the normal case; pass this when the task's content changed between dispatch and close)."
+  ).option("--source <source>", "Source / lane stamp", "cli").addHelpText(
+    "after",
+    `
+Examples:
+  # Managed run \u2014 reads matchTags from run state, stamps them verbatim, un-parks the run:
+  $ echo "Shipped X. Tests green." | sechroom close --task mem_XXXX --decomposition sug_YYYY \\
+      --verdict pass --workspace wsp_ZZZZ --title "w4_build closeout"
+
+  # Bare task:
+  $ sechroom close --task mem_XXXX --verdict pass --workspace wsp_ZZZZ \\
+      --title "done" --file ./closeout.md`
+  ).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const json = cmd.optsWithGlobals().json;
+    const verdict = String(opts.verdict);
+    if (!VERDICTS.includes(verdict))
+      fail(
+        `--verdict must be one of ${VERDICTS.join(" | ")} \u2014 got '${opts.verdict}'`
+      );
+    let bodyText;
+    try {
+      bodyText = opts.file ? readFileSync7(opts.file, "utf8") : readFileSync7(0, "utf8");
+    } catch {
+      fail(
+        opts.file ? `could not read --file ${opts.file}` : "no closeout body \u2014 pass --file <path> or pipe it on stdin"
+      );
+    }
+    if (!bodyText.trim())
+      fail(
+        "closeout body is empty \u2014 pass --file <path> or pipe the body on stdin"
+      );
+    const client = await makeClient(cfg);
+    let matchTags;
+    let dispatchedVersion;
+    if (opts.decomposition) {
+      const run = await runApi(
+        "Reading run contract",
+        async () => client.GET("/decompositions/{id}/run", {
+          params: { path: { id: opts.decomposition } }
+        })
+      );
+      const await_ = run.awaitingCompletion;
+      if (!await_ || !Array.isArray(await_.matchTags) || await_.matchTags.length === 0)
+        fail(
+          `decomposition ${opts.decomposition} has no parked run awaiting a completion \u2014 nothing to close (run outcome: ${run.outcome ?? "unknown"}). Idempotent no-op on an already-resumed/terminal run.`
+        );
+      if (run.awaitingTaskId && run.awaitingTaskId !== opts.task)
+        fail(
+          `run ${opts.decomposition} is awaiting task ${run.awaitingTaskId}, not ${opts.task} \u2014 refusing to mis-key the resume.`
+        );
+      matchTags = await_.matchTags;
+      if (typeof await_.dispatchedTaskVersion === "number")
+        dispatchedVersion = await_.dispatchedTaskVersion;
+    } else {
+      matchTags = [`wlp-task:${opts.task}`];
+    }
+    const tags = [
+      .../* @__PURE__ */ new Set([
+        ...matchTags,
+        `wlp-task:${opts.task}`,
+        `verdict:${verdict}`
+      ])
+    ];
+    const closeout = await runApi(
+      "Creating closeout",
+      async () => client.POST("/memories", {
+        body: {
+          text: bodyText,
+          type: "reference",
+          content: "{}",
+          confidence: 1,
+          source: opts.source,
+          archetype: "Document",
+          title: opts.title,
+          tags,
+          owner: { type: "Workspace", id: opts.workspace }
+        }
+      })
+    );
+    let toVersion;
+    if (opts.toVersion !== void 0) {
+      toVersion = Number(opts.toVersion);
+      if (!Number.isInteger(toVersion) || toVersion < 1)
+        fail(
+          `--to-version must be an integer >= 1 \u2014 got '${opts.toVersion}'`
+        );
+    } else if (dispatchedVersion !== void 0) {
+      toVersion = dispatchedVersion;
+    } else {
+      const task = await runApi(
+        "Reading task version",
+        async () => client.GET("/memories/{memoryId}", {
+          params: { path: { memoryId: opts.task } }
+        })
+      );
+      const v = task?.item?.currentVersion ?? task?.currentVersion;
+      if (typeof v !== "number" || v < 1)
+        fail(
+          `could not read task ${opts.task} version to pin the Reference edge \u2014 pass --to-version <n>`
+        );
+      toVersion = v;
+    }
+    const edge = await runApi(
+      "Wiring Reference edge",
+      async () => client.POST("/memories/{memoryId}/relationships", {
+        params: { path: { memoryId: closeout.id } },
+        body: { toMemoryId: opts.task, type: "Reference", toVersion }
+      })
+    );
+    let taskStatus;
+    if (opts.statusFlip !== false && !opts.decomposition) {
+      const current = await runApi(
+        "Reading task tags",
+        async () => client.GET("/memories/{memoryId}", {
+          params: { path: { memoryId: opts.task } }
+        })
+      );
+      const currentTags = current?.item?.tags ?? current?.tags ?? [];
+      const target = verdict === "blocked" ? "status:blocked" : "status:done";
+      const nextTags = [
+        ...new Set(currentTags.filter((t) => !t.startsWith("status:")))
+      ].concat(target);
+      await runApi(
+        "Flipping task status",
+        async () => client.PATCH("/memories/{memoryId}/metadata", {
+          params: { path: { memoryId: opts.task } },
+          body: {
+            memoryId: opts.task,
+            source: opts.source,
+            tags: nextTags
+          }
+        })
+      );
+      taskStatus = target.slice("status:".length);
+    }
+    const view = resolveViewUrl(cfg.baseUrl, closeout.url);
+    const result = {
+      closeoutId: closeout.id,
+      edgeId: edge.id,
+      taskStatus: taskStatus ?? null,
+      verdict,
+      tags
+    };
+    emitAction(
+      `closed ${style.bold(opts.task)} verdict:${style.bold(verdict)} \u2192 closeout ${style.bold(closeout.id)}${taskStatus ? ` ${style.dim(`(task ${taskStatus})`)}` : ""}${view ? ` ${style.dim("\u2192")} ${view}` : ""}`,
+      result,
+      json
+    );
+  });
+}
+
 // src/commands/continuity.ts
 function registerContinuity(program2) {
   const continuity = program2.command("continuity").description("Continuity snapshots: checkpoint and resume work");
@@ -2568,6 +2910,108 @@ Examples:
   });
 }
 
+// src/commands/decomposition.ts
+function registerDecomposition(program2) {
+  const decomposition = program2.command("decomposition").description(
+    "Drive a WLP decomposition: decompose a brief, then execute / accept / reject"
+  );
+  decomposition.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom decomposition decompose mem_XXXX
+  $ sechroom decomposition execute sug_XXXX
+  $ sechroom decomposition publish-run sug_XXXX
+  $ sechroom decomposition accept sug_XXXX
+  $ sechroom decomposition reject sug_XXXX --reason "wrong shape"`
+  );
+  decomposition.command("decompose <briefId>").description(
+    "Decompose a work brief into a candidate Task graph (POST /work-briefs/{id}/decompose)"
+  ).action(async (briefId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Queueing decomposition", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/work-briefs/{id}/decompose", {
+        params: { path: { id: briefId } },
+        body: { id: briefId }
+      });
+    });
+    emitAction(
+      `queued decomposition of ${style.bold(briefId)} \u2192 ${style.bold(data.suggestionId)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  decomposition.command("execute <decompositionId>").description(
+    "Execute a decomposition's Task graph (POST /decompositions/{id}/execute)"
+  ).action(async (decompositionId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Executing decomposition", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/decompositions/{id}/execute", {
+        params: { path: { id: decompositionId } },
+        body: {}
+      });
+    });
+    emitAction(
+      `executed ${style.bold(decompositionId)} \u2192 run ${style.bold(data.runRecordId)} (${data.outcome})`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  decomposition.command("publish-run <decompositionId>").description(
+    "Publish an accepted decomposition's context pack on demand (POST /decompositions/{id}/publish-run)"
+  ).action(async (decompositionId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Publishing context pack", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/decompositions/{id}/publish-run", {
+        params: { path: { id: decompositionId } },
+        body: {}
+      });
+    });
+    emitAction(
+      `published ${style.bold(decompositionId)} \u2192 run ${style.bold(data.runRecordId)} (${data.outcome})`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  decomposition.command("accept <decompositionId>").description(
+    "Accept a Pending decomposition \u2014 promote + ratify its Tasks (POST /decompositions/{id}/accept)"
+  ).action(async (decompositionId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Accepting decomposition", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/decompositions/{id}/accept", {
+        params: { path: { id: decompositionId } },
+        body: {}
+      });
+    });
+    emitAction(
+      `accepted decomposition ${style.bold(decompositionId)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  decomposition.command("reject <decompositionId>").description(
+    "Reject a Pending decomposition \u2014 archive its Tasks, bounce the brief (POST /decompositions/{id}/reject)"
+  ).option("--reason <reason>", "Optional free-text rejection reason").action(async (decompositionId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Rejecting decomposition", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/decompositions/{id}/reject", {
+        params: { path: { id: decompositionId } },
+        body: { reasonText: opts.reason ?? null }
+      });
+    });
+    emitAction(
+      `rejected decomposition ${style.bold(decompositionId)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+}
+
 // src/commands/filing.ts
 function registerFiling(program2) {
   const filing = program2.command("filing").description("Review and act on filing suggestions");
@@ -3079,7 +3523,7 @@ Examples:
 
 // src/setup/apply.ts
 import { createHash as createHash3 } from "crypto";
-import { mkdirSync as mkdirSync9, readFileSync as readFileSync7, writeFileSync as writeFileSync9, existsSync as existsSync9 } from "fs";
+import { mkdirSync as mkdirSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync9, existsSync as existsSync9 } from "fs";
 import { dirname as dirname8 } from "path";
 var MARKER_BEGIN = "<!-- @sechroom/cli:begin";
 var MARKER_END = "<!-- @sechroom/cli:end";
@@ -3137,7 +3581,7 @@ function ensureDir2(path) {
 }
 function readOr(path, fallback) {
   try {
-    return readFileSync7(path, "utf8");
+    return readFileSync8(path, "utf8");
   } catch {
     return fallback;
   }
@@ -3148,7 +3592,7 @@ function mergeMcpJson(path, snippet, dryRun) {
   let current = {};
   if (existed) {
     try {
-      current = JSON.parse(readFileSync7(path, "utf8"));
+      current = JSON.parse(readFileSync8(path, "utf8"));
     } catch {
       return { kind: "mcp", path, status: "skipped", note: "existing file isn't valid JSON \u2014 left untouched" };
     }
@@ -3864,7 +4308,7 @@ import { basename as basename2, join as join13 } from "path";
 
 // src/commands/fanout.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync8, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync9, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
 import { isAbsolute, join as join12, resolve } from "path";
 var ICON = {
   refresh: "\u21BB",
@@ -3899,7 +4343,7 @@ function readManifest(path) {
   if (!existsSync10(path)) return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync8(path, "utf8"));
+    parsed = JSON.parse(readFileSync9(path, "utf8"));
   } catch (err2) {
     throw new Error(`couldn't parse ${path}: ${err2 instanceof Error ? err2.message : String(err2)}`);
   }
@@ -4713,24 +5157,45 @@ Examples:
   $ sechroom relationship suggestions --status Pending --memory mem_XXXX
   $ sechroom relationship suggestion accept rsg_XXXX`
   );
-  relationship.command("create <fromMemoryId> <toMemoryId>").description("Create a relationship (POST /memories/{memoryId}/relationships)").option("--type <type>", "Relationship type (Reference, Related, Parent, Child, Follows, \u2026)", "Reference").action(async (fromMemoryId, toMemoryId, opts, cmd) => {
+  relationship.command("create <fromMemoryId> <toMemoryId>").description("Create a relationship (POST /memories/{memoryId}/relationships)").option("--type <type>", "Relationship type (Reference, Related, Parent, Child, Follows, \u2026)", "Reference").option(
+    "--to-version <number>",
+    "Version of the target memory to pin the edge to (defaults to the target's current version)"
+  ).action(async (fromMemoryId, toMemoryId, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Creating relationship", async () => {
-      const client = await makeClient(cfg);
-      return client.POST("/memories/{memoryId}/relationships", {
+    const client = await makeClient(cfg);
+    let toVersion;
+    if (opts.toVersion !== void 0) {
+      toVersion = Number(opts.toVersion);
+      if (!Number.isInteger(toVersion) || toVersion < 1) {
+        fail(`--to-version must be a positive integer (got '${opts.toVersion}').`);
+      }
+    } else {
+      const target = await runApi(
+        "Resolving target version",
+        async () => client.GET("/memories/{memoryId}", { params: { path: { memoryId: toMemoryId } } })
+      );
+      if (typeof target.item?.currentVersion !== "number") {
+        fail(`Could not resolve the current version of ${toMemoryId}; pass --to-version explicitly.`);
+      }
+      toVersion = target.item.currentVersion;
+    }
+    const data = await runApi(
+      "Creating relationship",
+      async () => client.POST("/memories/{memoryId}/relationships", {
         params: { path: { memoryId: fromMemoryId } },
         body: {
           toMemoryId,
-          type: opts.type
+          type: opts.type,
+          toVersion
         }
-      });
-    });
+      })
+    );
     const inversePart = data.inverseId ? ` ${style.dim(`(inverse ${data.inverseId})`)}` : "";
     const view = resolveViewUrl(cfg.baseUrl, data.url);
     const urlPart = view ? ` ${style.dim("\u2192")} ${view}` : "";
     emitAction(
-      `created relationship ${style.bold(data.id)} ${style.dim(`${fromMemoryId} \u2192 ${toMemoryId}`)}${inversePart}${urlPart}`,
-      data,
+      `created relationship ${style.bold(data.id)} ${style.dim(`${fromMemoryId} \u2192 ${toMemoryId} @v${toVersion}`)}${inversePart}${urlPart}`,
+      { ...data, toVersion },
       cmd.optsWithGlobals().json
     );
   });
@@ -4854,7 +5319,7 @@ Examples:
 // src/commands/reset.ts
 import { homedir as homedir4 } from "os";
 import { join as join14 } from "path";
-import { existsSync as existsSync12, readFileSync as readFileSync9, rmSync as rmSync3 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync10, rmSync as rmSync3 } from "fs";
 var SKILLS_LOCK2 = ".sechroom-skills.json";
 var localSkillsDir = () => join14(process.cwd(), ".claude", "skills");
 var globalSkillsDir = () => join14(homedir4(), ".claude", "skills");
@@ -4865,7 +5330,7 @@ function removeMaterialisedSkills(dir) {
   const lockPath = join14(dir, SKILLS_LOCK2);
   if (!existsSync12(lockPath)) return removed;
   try {
-    const lock = JSON.parse(readFileSync9(lockPath, "utf8"));
+    const lock = JSON.parse(readFileSync10(lockPath, "utf8"));
     for (const entry of Object.values(lock)) {
       for (const name of entry.skills ?? []) {
         const p = join14(dir, name);
@@ -5265,7 +5730,7 @@ Examples:
 import {
   existsSync as existsSync15,
   mkdirSync as mkdirSync12,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync11,
   rmSync as rmSync4,
   writeFileSync as writeFileSync12
 } from "fs";
@@ -5371,7 +5836,7 @@ function registerTelemetry(program2) {
       );
   });
   telemetry.command("hook").description(
-    "Per-turn telemetry self-report for a Claude Code Stop hook (reads stdin; no-op unless bound). Fail-soft."
+    "Per-turn telemetry self-report for Claude Code hooks \u2014 Stop/SubagentStop \u2192 parsed + terminal, Notification/PermissionDenied \u2192 approval (reads stdin; no-op unless bound). Fail-soft."
   ).action(async (_opts, cmd) => {
     try {
       const raw = await readStdin2();
@@ -5380,21 +5845,10 @@ function registerTelemetry(program2) {
       const binding = findBinding(cwd);
       if (!binding) return process.exit(0);
       const usage = input.transcript_path ? parseTranscript(input.transcript_path) : null;
-      if (!usage) return process.exit(0);
+      const events = buildHookEvents(input, usage, binding.taskId);
+      if (events.length === 0) return process.exit(0);
       const cfg = resolveConfig(cmd.optsWithGlobals());
-      await postTelemetry(cfg, binding.decompositionId, [
-        {
-          taskId: binding.taskId,
-          kind: "Parsed",
-          tokensIn: usage.tokensIn,
-          tokensOut: usage.tokensOut,
-          contextUsed: usage.contextUsed,
-          contextWindow: usage.contextWindow,
-          text: null,
-          approvalState: null,
-          verdict: null
-        }
-      ]);
+      await postTelemetry(cfg, binding.decompositionId, events);
       return process.exit(0);
     } catch {
       return process.exit(0);
@@ -5422,7 +5876,12 @@ function registerTelemetry(program2) {
       scope,
       cwd
     });
-    const commands = { Stop: "sechroom telemetry hook" };
+    const commands = {
+      Stop: "sechroom telemetry hook",
+      SubagentStop: "sechroom telemetry hook",
+      Notification: "sechroom telemetry hook",
+      PermissionDenied: "sechroom telemetry hook"
+    };
     try {
       const multi = targets.length > 1;
       const results = targets.map((t) => {
@@ -5480,7 +5939,7 @@ function findBinding(start) {
     if (existsSync15(path)) {
       try {
         const b = JSON.parse(
-          readFileSync10(path, "utf8")
+          readFileSync11(path, "utf8")
         );
         if (b.decompositionId && b.taskId)
           return { decompositionId: b.decompositionId, taskId: b.taskId };
@@ -5499,7 +5958,7 @@ function parseTranscript(path) {
   let tokensOut = 0;
   let contextUsed = 0;
   let model = "";
-  for (const line of readFileSync10(path, "utf8").split("\n")) {
+  for (const line of readFileSync11(path, "utf8").split("\n")) {
     if (!line.trim()) continue;
     let obj;
     try {
@@ -5516,11 +5975,61 @@ function parseTranscript(path) {
     if (obj.message?.model) model = obj.message.model;
   }
   if (tokensIn === 0 && tokensOut === 0) return null;
-  return { tokensIn, tokensOut, contextUsed, contextWindow: windowFor(model) };
+  return { tokensIn, tokensOut, contextUsed, contextWindow: windowFor(model, contextUsed) };
 }
-function windowFor(model) {
+function windowFor(model, contextUsed = 0) {
   const m = model.toLowerCase();
-  return m.includes("[1m]") || m.includes("-1m") ? 1e6 : 2e5;
+  if (m.includes("[1m]") || m.includes("-1m")) return 1e6;
+  return contextUsed > 2e5 ? 1e6 : 2e5;
+}
+function buildHookEvents(input, usage, taskId) {
+  const events = [];
+  const base = (kind, over) => ({
+    taskId,
+    kind,
+    tokensIn: null,
+    tokensOut: null,
+    contextUsed: null,
+    contextWindow: null,
+    text: null,
+    approvalState: null,
+    verdict: null,
+    ...over
+  });
+  if (usage) {
+    events.push(
+      base("Parsed", {
+        tokensIn: usage.tokensIn,
+        tokensOut: usage.tokensOut,
+        contextUsed: usage.contextUsed,
+        contextWindow: usage.contextWindow
+      })
+    );
+  }
+  switch (input.hook_event_name) {
+    case "PermissionDenied":
+      events.push(
+        base("Approval", {
+          approvalState: "denied",
+          text: input.tool_name ?? input.message ?? null
+        })
+      );
+      break;
+    case "Notification":
+      if (isPermissionNotification(input))
+        events.push(base("Approval", { text: input.message ?? null }));
+      break;
+    case "Stop":
+    case "SubagentStop":
+      events.push(base("Terminal", { text: input.last_assistant_message ?? null }));
+      break;
+  }
+  return events;
+}
+function isPermissionNotification(input) {
+  const t = (input.notification_type ?? input.type ?? "").toLowerCase();
+  if (t) return t.includes("permission");
+  return (input.message ?? "").toLowerCase().includes("permission");
 }
 async function readStdin2() {
   if (process.stdin.isTTY) return "";
@@ -5756,7 +6265,7 @@ Examples:
 function resolveVersion() {
   try {
     const pkg = JSON.parse(
-      readFileSync11(new URL("../package.json", import.meta.url), "utf8")
+      readFileSync12(new URL("../package.json", import.meta.url), "utf8")
     );
     return pkg.version ?? "0.0.0";
   } catch {
@@ -5914,6 +6423,8 @@ registerLookup(program);
 registerRelationships(program);
 registerWorkspace(program);
 registerProject(program);
+registerDecomposition(program);
+registerClose(program);
 registerFiling(program);
 registerContinuity(program);
 registerCheckpoint(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.7.5",
+  "version": "2026.7.6-rc.a2828c37",
   "description": "Sechroom CLI — a thin, generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.",
   "type": "module",
   "license": "UNLICENSED",
@@ -36,12 +36,14 @@
     "openapi-typescript": "^7.4.0",
     "tsup": "^8.3.0",
     "tsx": "^4.19.0",
-    "typescript": "^5.6.0"
+    "typescript": "^5.6.0",
+    "typescript-7": "npm:typescript@^7.0.2"
   },
   "scripts": {
     "gen": "openapi-typescript \"${SECHROOM_OPENAPI_URL:-https://app.sechroom.ai/api/openapi/v1.json}\" -o src/generated/api.d.ts",
     "build": "tsup src/index.ts --format esm --target node20 --clean",
     "dev": "tsx src/index.ts",
+    "test": "node --import tsx --test \"src/**/*.test.ts\"",
     "check-types": "tsc --noEmit"
   }
 }