@sechroom/cli 2026.7.7 → 2026.7.8-rc.4b6e8ecc

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 import { Command } from "commander";
 
 // src/auth.ts
@@ -439,6 +439,9 @@ var quiet = false;
 function setQuiet(q) {
   quiet = q;
 }
+function isQuiet() {
+  return quiet;
+}
 function colorOn() {
   return !quiet && !process.env.NO_COLOR && process.env.FORCE_COLOR !== "0" && Boolean(process.stdout.isTTY);
 }
@@ -615,6 +618,22 @@ function emitAction(summary, data, json) {
   process.stdout.write(`${ok("\u2713")} ${summary}
 `);
 }
+var GOVERNANCE_QUEUED_PROBLEM_TYPE = "https://sechroom.dev/problems/governance-review-queued";
+function isGovernanceQueued(body) {
+  return typeof body === "object" && body !== null && "type" in body && body.type === GOVERNANCE_QUEUED_PROBLEM_TYPE;
+}
+function formatQueuedForApproval(body, json) {
+  if (json) return JSON.stringify(body) + "\n";
+  const b = body ?? {};
+  const detail = typeof b.detail === "string" ? b.detail : void 0;
+  const requestId = typeof b.requestId === "string" ? b.requestId : void 0;
+  const message = detail ?? "This change requires operator approval before it takes effect.";
+  let out = `${warn("\u29D7")} Pending approval \u2014 ${message}
+`;
+  if (requestId) out += `  ${style.dim(`request: ${requestId}`)}
+`;
+  return out;
+}
 async function runApi(label, fn) {
   const s = spinner(label);
   let res;
@@ -624,6 +643,12 @@ async function runApi(label, fn) {
     s.fail();
     fail(err2);
   }
+  const queuedBody = res.data ?? res.error;
+  if (res.response?.status === 202 && isGovernanceQueued(queuedBody)) {
+    s.stop();
+    process.stdout.write(formatQueuedForApproval(queuedBody, isQuiet()));
+    process.exit(0);
+  }
   const httpFailed = res.response !== void 0 && !res.response.ok;
   if (res.error !== void 0 && res.error !== null || httpFailed) {
     s.fail();
@@ -632,8 +657,32 @@ async function runApi(label, fn) {
   s.succeed();
   return res.data;
 }
+function formatFailureMessage(error) {
+  let msg;
+  if (error instanceof Error) {
+    msg = error.message || error.name;
+    if (error.cause instanceof Error && error.cause.message) {
+      msg += `: ${error.cause.message}`;
+    }
+  } else if (typeof error === "object" && error !== null && "title" in error) {
+    const problem = error;
+    msg = String(problem.title);
+    if (problem.errors && typeof problem.errors === "object") {
+      const detail = Object.entries(problem.errors).flatMap(
+        ([field, msgs]) => (Array.isArray(msgs) ? msgs : [msgs]).map((m) => `  ${field}: ${String(m)}`)
+      );
+      if (detail.length > 0) msg += `
+${detail.join("\n")}`;
+    }
+  } else if (typeof error === "object" && error !== null) {
+    msg = JSON.stringify(error);
+  } else {
+    msg = String(error);
+  }
+  return msg;
+}
 function fail(error) {
-  const msg = typeof error === "object" && error !== null && "title" in error ? String(error.title) : typeof error === "object" ? JSON.stringify(error) : String(error);
+  const msg = formatFailureMessage(error);
   process.stderr.write(`error: ${msg}
 `);
   process.exit(1);
@@ -1061,14 +1110,23 @@ function bodyOf(row) {
   const m = row?.item ?? row;
   return m?.text ?? m?.Text ?? "";
 }
+function idOf(row) {
+  const m = row?.item ?? row;
+  return String(m?.id ?? m?.memoryId ?? "unknown");
+}
 function entriesFromRows(rows, surface, source, roleTag, namePrefix) {
   const out = /* @__PURE__ */ new Map();
   for (const row of rows ?? []) {
     const tags = tagsOf(row);
     if (!tags.includes(roleTag)) continue;
-    if (tagValue(tags, "target:") !== surface) continue;
+    if (!tags.includes(`target:${surface}`)) continue;
     const name = tagValue(tags, namePrefix);
     if (!name) continue;
+    if (out.has(name)) {
+      throw new Error(
+        `Ambiguous ${source} ${roleTag} '${name}' for target:${surface}: ${idOf(row)} duplicates another eligible component. Resolve the duplicate before installing.`
+      );
+    }
     out.set(name, { name, body: bodyOf(row), source });
   }
   return out;
@@ -1091,25 +1149,41 @@ function resolveReferences(systemRows, personalRows, surface) {
 }
 
 // src/setup/skill-resolution-io.ts
-var AGENT_TARGET = { "claude-code": "claude-agent" };
+var AGENT_TARGET = {
+  "claude-code": "claude-agent",
+  "gpt-codex": "gpt-codex-agent"
+};
 function agentTargetFor(surface) {
   return AGENT_TARGET[surface] ?? `${surface}-agent`;
 }
 async function fetchFeedRows(cfg, workspaceId) {
-  try {
-    const client = await makeClient(cfg);
-    const feed = await client.GET("/workspaces/{workspaceId}/memories/feed", {
+  const client = await makeClient(cfg);
+  const rows = [];
+  let cursor;
+  do {
+    const { data, error, response } = await client.GET("/workspaces/{workspaceId}/memories/feed", {
       params: {
         path: { workspaceId },
         // cascadeWorkspaces: skills land in an "Operator Skills" SUB-workspace;
         // includeText: the feed omits bodies by default, we need them for SKILL.md.
-        query: { limit: 200, cascadeWorkspaces: true, includeText: true }
+        query: {
+          limit: 200,
+          cascadeWorkspaces: true,
+          includeText: true,
+          ...cursor ? { cursor } : {}
+        }
       }
-    }).then((r) => r.data).catch(() => void 0);
-    return feed?.results ?? feed?.Results ?? [];
-  } catch {
-    return [];
-  }
+    });
+    if (error || !response.ok || !data) {
+      throw new Error(
+        `Could not read operator-skill catalogue from ${workspaceId}: HTTP ${response.status}.`
+      );
+    }
+    const feed = data;
+    rows.push(...feed.results ?? feed.Results ?? []);
+    cursor = feed.nextCursor ?? feed.NextCursor ?? void 0;
+  } while (cursor);
+  return rows;
 }
 async function fetchTemplateRows(cfg, personalWorkspaceId) {
   const [systemRows, personalRows] = await Promise.all([
@@ -1129,7 +1203,10 @@ function resolveReferenceSet(rows, surface) {
 }
 
 // src/setup/materialise.ts
-var CLIENT_SURFACE = "claude-code";
+var CLIENT_SURFACE = {
+  claude: "claude-code",
+  codex: "gpt-codex"
+};
 function writeSkills(dir, skills, surface) {
   const written = [];
   for (const s of skills) {
@@ -1140,12 +1217,58 @@ function writeSkills(dir, skills, surface) {
   if (written.length) recordMaterialisedSkills(dir, DEFAULT_SKILLS_SLUG, written, { surface });
   return written;
 }
+function splitAgentFrontmatter(body) {
+  body = body.replaceAll("\r\n", "\n");
+  if (!body.startsWith("---\n")) return { instructions: body };
+  const end = body.indexOf("\n---\n", 4);
+  if (end < 0) return { instructions: body };
+  const frontmatter = body.slice(4, end);
+  const field = (key) => {
+    const line = frontmatter.split("\n").find((candidate) => candidate.startsWith(`${key}:`));
+    return line?.slice(key.length + 1).trim().replace(/^(["'])(.*)\1$/, "$2");
+  };
+  return { name: field("name"), description: field("description"), instructions: body.slice(end + 5).trimStart() };
+}
+function validateCodexSkills(skills) {
+  for (const skill of skills) {
+    const parsed = splitAgentFrontmatter(skill.body);
+    if (parsed.name !== skill.name || !parsed.description) {
+      throw new Error(
+        `Codex skill '${skill.name}' must begin with YAML frontmatter containing matching name and a description.`
+      );
+    }
+  }
+}
+var WORKER_NAMES = ["substrate-drafter", "substrate-miner", "substrate-verifier"];
+function validateCodexWorkerDependencies(skills, agents) {
+  const available = new Set(agents.map((agent) => agent.name));
+  const missing = WORKER_NAMES.filter(
+    (worker) => skills.some((skill) => skill.body.includes(worker)) && !available.has(worker)
+  );
+  if (missing.length) {
+    throw new Error(`Codex skills reference missing agent template(s): ${missing.join(", ")}.`);
+  }
+}
+function codexAgentToml(agent) {
+  const parsed = splitAgentFrontmatter(agent.body);
+  if (!parsed.description) {
+    throw new Error(`Codex agent '${agent.name}' requires a description in its leading YAML frontmatter.`);
+  }
+  return [
+    `name = ${JSON.stringify(parsed.name || agent.name)}`,
+    `description = ${JSON.stringify(parsed.description)}`,
+    `developer_instructions = ${JSON.stringify(parsed.instructions.trimEnd())}`,
+    ""
+  ].join("\n");
+}
 function writeAgents(dir, agents, surface) {
   if (agents.length) mkdirSync3(dir, { recursive: true });
   const written = [];
   for (const a of agents) {
-    const file = `${a.name}.md`;
-    writeFileSync3(join4(dir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
+    const codex = surface === CLIENT_SURFACE.codex;
+    const file = `${a.name}.${codex ? "toml" : "md"}`;
+    const body = codex ? codexAgentToml(a) : a.body.endsWith("\n") ? a.body : a.body + "\n";
+    writeFileSync3(join4(dir, file), body);
     written.push(file);
   }
   if (written.length) recordMaterialisedSkills(dir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -1162,11 +1285,71 @@ function writeReferencesIntoSkillDirs(dir, skills, refs) {
   }
   return refs.map((r) => r.name);
 }
-var SKILL_SPEC = { kind: "skill", dir: skillsDir, resolve: resolveSkillSet, write: writeSkills };
-var AGENT_SPEC = { kind: "agent", dir: agentsDir, resolve: resolveAgentSet, write: writeAgents };
+var SKILL_SPEC = {
+  kind: "skill",
+  dir: skillsDir,
+  resolve: resolveSkillSet,
+  write: writeSkills,
+  supportsCodex: true
+};
+var AGENT_SPEC = {
+  kind: "agent",
+  dir: agentsDir,
+  resolve: resolveAgentSet,
+  write: writeAgents,
+  supportsCodex: true
+};
 function scopeOf(opts) {
   return opts.local ? "project" : resolveScope(opts.scope);
 }
+function parseClient(value) {
+  if (value == null) return void 0;
+  if (value === "claude" || value === "codex" || value === "all") return value;
+  throw new Error(`--client must be 'claude', 'codex', or 'all' (got '${value}')`);
+}
+function clientSelection(spec, g, raw) {
+  if (!spec.supportsCodex) return "claude";
+  const explicit = parseClient(raw);
+  if (explicit) return explicit;
+  const claudeConfigured = Boolean(g.claudeConfigDir || process.env.CLAUDE_CONFIG_DIR);
+  const codexConfigured = Boolean(g.codexHome || process.env.CODEX_HOME);
+  if (claudeConfigured || codexConfigured) {
+    if (claudeConfigured && codexConfigured) return "all";
+    return codexConfigured ? "codex" : "claude";
+  }
+  const claudeDetected = resolveClaudeTargets({})[0]?.dir;
+  const codexDetected = resolveCodexHomes({})[0];
+  const hasClaude = Boolean(claudeDetected && existsSync3(claudeDetected));
+  const hasCodex = Boolean(codexDetected && existsSync3(codexDetected));
+  if (hasClaude && hasCodex) return "all";
+  if (hasCodex) return "codex";
+  return "claude";
+}
+function targetsFor(spec, g, scope, selection) {
+  const clients = selection === "all" ? ["claude", "codex"] : [selection];
+  if (scope === "project" && clients.includes("codex")) {
+    throw new Error("Codex skills have no supported project scope; use --scope global or --client claude.");
+  }
+  const targets = [];
+  for (const client of clients) {
+    if (client === "claude") {
+      targets.push(...resolveClaudeTargets({ override: g.claudeConfigDir, scope, cwd: process.cwd() }).map((target) => ({
+        client,
+        surface: CLIENT_SURFACE[client],
+        dir: spec.dir(target.dir),
+        label: target.label
+      })));
+      continue;
+    }
+    targets.push(...resolveCodexHomes({ override: g.codexHome, scope }).map((home) => ({
+      client,
+      surface: CLIENT_SURFACE[client],
+      dir: spec.dir(home),
+      label: home
+    })));
+  }
+  return targets;
+}
 async function runInstall(spec, cmd, opts) {
   const g = cmd.optsWithGlobals();
   let scope;
@@ -1178,31 +1361,52 @@ async function runInstall(spec, cmd, opts) {
   const cfg = resolveConfig(g);
   const dryRun = Boolean(opts.dryRun);
   const json = Boolean(g.json || opts.json);
-  const targets = resolveClaudeTargets({ override: g.claudeConfigDir, scope, cwd: process.cwd() });
+  let selection;
+  let targets;
+  try {
+    selection = clientSelection(spec, g, opts.client);
+    targets = targetsFor(spec, g, scope, selection);
+  } catch (err2) {
+    return fail(err2.message);
+  }
   const personalWorkspaceId = await getPersonalWorkspaceId(cfg);
   const rows = await fetchTemplateRows(cfg, personalWorkspaceId);
-  const items = spec.resolve(rows, CLIENT_SURFACE);
-  const refs = spec.kind === "skill" ? resolveReferenceSet(rows, CLIENT_SURFACE) : [];
   const results = targets.map((t) => {
-    const dir = spec.dir(t.dir);
-    const written = dryRun ? items.map((i) => i.name) : spec.write(dir, items, CLIENT_SURFACE);
-    const refsWritten = dryRun ? refs.map((r) => r.name) : writeReferencesIntoSkillDirs(dir, items, refs);
-    return { dir, label: t.label, written, refsWritten };
+    const items = spec.resolve(rows, t.surface);
+    if (t.client === "codex" && spec.kind === "skill") {
+      validateCodexSkills(items);
+      validateCodexWorkerDependencies(items, resolveAgentSet(rows, t.surface));
+    }
+    const refs = spec.kind === "skill" ? resolveReferenceSet(rows, t.surface) : [];
+    const written = dryRun ? items.map((i) => i.name) : spec.write(t.dir, items, t.surface);
+    const refsWritten = dryRun ? refs.map((r) => r.name) : writeReferencesIntoSkillDirs(t.dir, items, refs);
+    return {
+      client: t.client,
+      surface: t.surface,
+      dir: t.dir,
+      label: t.label,
+      available: items.length,
+      references: refs.length,
+      items: items.map(({ name, source }) => ({ name, source })),
+      referenceItems: refs.map(({ name, source }) => ({ name, source })),
+      written,
+      refsWritten
+    };
   });
-  if (json) return emit({ kind: spec.kind, dryRun, available: items.length, references: refs.length, targets: results }, true);
-  if (items.length === 0) {
+  if (json) return emit({ kind: spec.kind, client: selection, dryRun, targets: results }, true);
+  if (results.every((r) => r.available === 0)) {
     console.log(style.dim(`No ${spec.kind}s available to install \u2014 is the bundle installed for your account?`));
     return;
   }
   for (const r of results) {
     console.log(
-      `${dryRun ? "" : style.green("\u2713 ")}${dryRun ? "would write" : "wrote"} ${r.written.length} ${spec.kind}(s) ${style.dim("\u2192")} ${r.dir}`
+      `${dryRun ? "" : style.green("\u2713 ")}${dryRun ? "would write" : "wrote"} ${r.written.length} ${spec.kind}(s) for ${r.client} ${style.dim("\u2192")} ${r.dir}`
     );
     if (r.refsWritten.length)
       console.log(
         `${dryRun ? "" : style.green("\u2713 ")}${dryRun ? "would write" : "wrote"} ${r.refsWritten.length} reference(s) into each skill ${style.dim("\u2192")} ${r.dir}/<skill>/references`
       );
-    if (dryRun) for (const i of items) console.log(`    ${i.name} ${style.dim(`[${i.source}]`)}`);
+    if (dryRun) for (const i of r.items) console.log(`    ${i.name} ${style.dim(`[${i.source}]`)}`);
   }
 }
 function runList(spec, cmd, opts) {
@@ -1214,16 +1418,22 @@ function runList(spec, cmd, opts) {
     return fail(err2.message);
   }
   const json = Boolean(g.json || opts.json);
-  const targets = resolveClaudeTargets({ override: g.claudeConfigDir, scope, cwd: process.cwd() });
+  let selection;
+  let targets;
+  try {
+    selection = clientSelection(spec, g, opts.client);
+    targets = targetsFor(spec, g, scope, selection);
+  } catch (err2) {
+    return fail(err2.message);
+  }
   const out = targets.map((t) => {
-    const dir = spec.dir(t.dir);
-    const lock = readSkillsLock(dir);
+    const lock = readSkillsLock(t.dir);
     const entries = Object.entries(lock).flatMap(
-      ([slug, e]) => (e.skills ?? []).map((name) => ({ slug, name, present: existsSync3(join4(dir, name)) }))
+      ([slug, e]) => (e.skills ?? []).map((name) => ({ slug, name, present: existsSync3(join4(t.dir, name)) }))
     );
-    return { dir, label: t.label, entries };
+    return { client: t.client, surface: t.surface, dir: t.dir, label: t.label, entries };
   });
-  if (json) return emit({ kind: spec.kind, targets: out }, true);
+  if (json) return emit({ kind: spec.kind, client: selection, targets: out }, true);
   let any = false;
   for (const t of out) {
     if (t.entries.length === 0) continue;
@@ -1246,33 +1456,39 @@ function runClean(spec, cmd, opts, slugArg) {
     return fail(err2.message);
   }
   const json = Boolean(g.json || opts.json);
-  const targets = resolveClaudeTargets({ override: g.claudeConfigDir, scope, cwd: process.cwd() });
+  let selection;
+  let targets;
+  try {
+    selection = clientSelection(spec, g, opts.client);
+    targets = targetsFor(spec, g, scope, selection);
+  } catch (err2) {
+    return fail(err2.message);
+  }
   const cleaned = [];
   const missing = [];
   for (const t of targets) {
-    const dir = spec.dir(t.dir);
-    const lock = readSkillsLock(dir);
+    const lock = readSkillsLock(t.dir);
     const entry = lock[slug];
     if (!entry) {
-      missing.push(join4(dir, SKILLS_LOCK));
+      missing.push(join4(t.dir, SKILLS_LOCK));
       continue;
     }
     const removed = [];
     for (const name of entry.skills) {
-      const p = join4(dir, name);
+      const p = join4(t.dir, name);
       if (existsSync3(p)) {
         rmSync2(p, { recursive: true, force: true });
         removed.push(name);
       }
     }
     delete lock[slug];
-    writeSkillsLock(dir, lock);
-    cleaned.push({ dir, removed });
+    writeSkillsLock(t.dir, lock);
+    cleaned.push({ client: t.client, surface: t.surface, dir: t.dir, removed });
   }
   if (cleaned.length === 0) {
     return fail(`No materialised ${spec.kind}s recorded for '${slug}' in ${missing.join(", ")}.`);
   }
-  if (json) return emit({ kind: spec.kind, slug, cleaned, missing }, true);
+  if (json) return emit({ kind: spec.kind, client: selection, slug, cleaned, missing }, true);
   for (const c of cleaned) {
     console.log(style.green(`Removed ${c.removed.length} ${spec.kind}(s) for ${slug} from ${c.dir}`));
   }
@@ -1286,17 +1502,19 @@ function registerAgents(program2) {
     `
 Examples:
   $ sechroom agents install                 materialise your installed agents to ~/.claude/agents
+	$ sechroom agents install --client codex  materialise native TOML agents to ~/.codex/agents
   $ sechroom agents install --scope project  write them to ./.claude/agents instead
   $ sechroom agents install --claude-config-dir ~/.claude-work   target another instance
   $ sechroom agents list                     what's materialised on disk
   $ sechroom agents clean                    remove the materialised agent files
 
-Agents are resolved from the agent target (target:claude-agent), the dispatchable
-workers your loop skills call (e.g. find-prior-art \u2192 substrate-miner).`
+Agents are resolved from the client's agent target (target:claude-agent or
+target:gpt-codex-agent), the dispatchable workers your loop skills call
+(e.g. find-prior-art \u2192 substrate-miner).`
   );
-  agents.command("install").description("Materialise your installed subagents to disk (the already-installed bundle \u2014 no server install)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--dry-run", "print what would be written; write nothing").option("--json", "machine output").action((opts, cmd) => runInstall(AGENT_SPEC, cmd, opts));
-  agents.command("list").description("List the subagents materialised on disk (per resolved config dir)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").action((opts, cmd) => runList(AGENT_SPEC, cmd, opts));
-  agents.command("clean [slug]").description(`Remove subagent files materialised to disk (default ${DEFAULT_SKILLS_SLUG})`).option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").action((slugArg, opts, cmd) => runClean(AGENT_SPEC, cmd, opts, slugArg));
+  agents.command("install").description("Materialise your installed subagents to disk (the already-installed bundle \u2014 no server install)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--dry-run", "print what would be written; write nothing").option("--client <client>", "claude, codex, or all").option("--json", "machine output").action((opts, cmd) => runInstall(AGENT_SPEC, cmd, opts));
+  agents.command("list").description("List the subagents materialised on disk (per resolved config dir)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").option("--client <client>", "claude, codex, or all").action((opts, cmd) => runList(AGENT_SPEC, cmd, opts));
+  agents.command("clean [slug]").description(`Remove subagent files materialised to disk (default ${DEFAULT_SKILLS_SLUG})`).option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").option("--client <client>", "claude, codex, or all").action((slugArg, opts, cmd) => runClean(AGENT_SPEC, cmd, opts, slugArg));
 }
 
 // src/commands/channel.ts
@@ -1388,15 +1606,24 @@ var CLAUDE_HOOK_COMMANDS = {
   SessionStart: "sechroom hook session-start",
   PreCompact: "sechroom hook pre-compact",
   SessionEnd: "sechroom hook session-end",
-  // WLP telemetry tap (D-WLP-10) — per-turn executor self-report. No-op (exit 0) unless this
-  // checkout is bound to a decomposition+task via `sechroom telemetry bind`, so it's safe to wire
-  // for every Claude install. Claude-only (it parses a Claude Code transcript).
-  Stop: "sechroom telemetry hook"
+  // WLP telemetry tap (D-WLP-10 + FR-352 Tier 1) — per-turn executor self-report. The one
+  // `telemetry hook` verb dispatches on hook_event_name: Stop/SubagentStop → parsed (token/context) +
+  // terminal (turn end), Notification/PermissionDenied → approval. No-op (exit 0) unless this checkout
+  // is bound via `sechroom telemetry bind`, so it's safe to wire for every Claude install; an event a
+  // given Claude Code version doesn't know is inert (never fires). Claude-only.
+  Stop: "sechroom telemetry hook",
+  SubagentStop: "sechroom telemetry hook",
+  Notification: "sechroom telemetry hook",
+  PermissionDenied: "sechroom telemetry hook"
 };
 var CODEX_HOOK_COMMANDS = {
   SessionStart: "sechroom hook session-start",
+  PreCompact: "sechroom hook pre-compact",
   Stop: "sechroom hook session-end --debounce-minutes 10"
 };
+function hookCommandsForSurface(surface) {
+  return surface === "claude" ? CLAUDE_HOOK_COMMANDS : CODEX_HOOK_COMMANDS;
+}
 function hasHookCommand(config2, event, command) {
   const groups = config2.hooks?.[event] ?? [];
   return groups.some((g) => (g.hooks ?? []).some((h) => h.type === "command" && h.command === command));
@@ -1432,6 +1659,12 @@ function installHooksJson(path, commands, dryRun) {
 function installClaudeCommands(claudeDir, commands, dryRun) {
   return installHooksJson(join6(claudeDir, "settings.json"), commands, dryRun);
 }
+function installCodexCommands(codexHome, commands, dryRun) {
+  return [
+    installHooksJson(join6(codexHome, "hooks.json"), commands, dryRun),
+    installCodexFeatureFlag(join6(codexHome, "config.toml"), dryRun)
+  ];
+}
 function ensureCodexFeaturesHooks(content) {
   const lines = content.split("\n");
   const headerIdx = lines.findIndex((l) => l.trim() === "[features]");
@@ -1534,7 +1767,10 @@ function registerChannel(program2) {
     "--tag <tag...>",
     "Tag(s) the event must carry to match (repeatable). Default targets WLP task dispatches.",
     ["kind:task"]
-  ).option("--workspace <wsp...>", "Restrict to these workspace id(s)");
+  ).option("--workspace <wsp...>", "Restrict to these workspace id(s)").option(
+    "--executor-instance <id>",
+    "Join the exact executor-instance SignalR group"
+  );
   withFilterOpts(
     channel.command("connect").description(
       "Register a SignalR subscription and stream matched events to stdout"
@@ -1552,7 +1788,7 @@ function registerChannel(program2) {
         (typeof payload === "string" ? payload : JSON.stringify(payload)) + "\n"
       )
     );
-    const conn = await openConnection(cfg, deliver);
+    const conn = await openConnection(cfg, deliver, opts.executorInstance);
     await reconcile(cfg, filter, deliver);
     if (json) {
       emit(
@@ -1601,7 +1837,7 @@ function registerChannel(program2) {
 `))
       );
     });
-    const conn = await openConnection(cfg, deliver);
+    const conn = await openConnection(cfg, deliver, opts.executorInstance);
     await reconcile(cfg, filter, deliver);
     process.stderr.write(
       style.dim(
@@ -1712,8 +1948,9 @@ async function ensureSubscription(cfg, name, filter) {
     );
   return await resp.json();
 }
-async function openConnection(cfg, onEvent) {
-  const conn = new HubConnectionBuilder().withUrl(`${cfg.baseUrl}/notifications/${cfg.tenant}`, {
+async function openConnection(cfg, onEvent, executorInstanceId) {
+  const query = executorInstanceId ? `?executorInstanceId=${encodeURIComponent(executorInstanceId)}` : "";
+  const conn = new HubConnectionBuilder().withUrl(`${cfg.baseUrl}/notifications/${cfg.tenant}${query}`, {
     transport: HttpTransportType.LongPolling,
     accessTokenFactory: () => requireToken(cfg)
   }).withAutomaticReconnect().build();
@@ -2416,6 +2653,12 @@ Fail-soft: no lane / no auth / no-or-partial intent file / API error -> exit 0,
         const surfaceResults = installHookSurfaces(["codex"], { dryRun, claudeDir: "", codexHome })[0].results;
         process.stdout.write(`${HOOK_SURFACE_LABEL.codex}:
 `);
+        if (dryRun) {
+          for (const [event, command] of Object.entries(hookCommandsForSurface("codex"))) {
+            process.stdout.write(`  ${event}: ${command}
+`);
+          }
+        }
         for (const r of surfaceResults) {
           results.push(r);
           process.stdout.write(describe(r, dryRun) + "\n");
@@ -2533,6 +2776,178 @@ Examples:
   });
 }
 
+// src/commands/close.ts
+import { readFileSync as readFileSync7 } from "fs";
+var VERDICTS = ["pass", "soft-fail", "plan-invalid", "blocked"];
+function registerClose(program2) {
+  program2.command("close").description(
+    "Close a dispatched WorkTask in one call: closeout memo (verdict + correlation) + Reference edge + source status flip. Managed runs stamp the run's matchTags verbatim (SBC-1180)."
+  ).requiredOption("--task <id>", "The WorkTask memory id being closed").requiredOption("--verdict <verdict>", `Verdict: ${VERDICTS.join(" | ")}`).requiredOption(
+    "--workspace <wsp>",
+    "Workspace that owns the closeout memo"
+  ).requiredOption("--title <title>", "Closeout title").option(
+    "--file <path>",
+    "Read the closeout body from a file (default: stdin)"
+  ).option(
+    "--decomposition <id>",
+    "Managed-run selector \u2014 the sug_ decomposition the task belongs to. Locates the parked run so its matchTags/verdict contract are read from state, not assembled from args."
+  ).option(
+    "--no-status-flip",
+    "Skip the status flip on a BARE task. (Managed runs never flip here \u2014 the run engine reflects the verdict onto the task on resume.)"
+  ).option(
+    "--to-version <n>",
+    "Pin the Reference edge at this task version \u2014 the DISPATCHED version the executor worked against (D-continuity-2). Default: the task's current version (status flips are metadata edits that don't bump the version, so current == dispatched in the normal case; pass this when the task's content changed between dispatch and close)."
+  ).option("--source <source>", "Source / lane stamp", "cli").addHelpText(
+    "after",
+    `
+Examples:
+  # Managed run \u2014 reads matchTags from run state, stamps them verbatim, un-parks the run:
+  $ echo "Shipped X. Tests green." | sechroom close --task mem_XXXX --decomposition sug_YYYY \\
+      --verdict pass --workspace wsp_ZZZZ --title "w4_build closeout"
+
+  # Bare task:
+  $ sechroom close --task mem_XXXX --verdict pass --workspace wsp_ZZZZ \\
+      --title "done" --file ./closeout.md`
+  ).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const json = cmd.optsWithGlobals().json;
+    const verdict = String(opts.verdict);
+    if (!VERDICTS.includes(verdict))
+      fail(
+        `--verdict must be one of ${VERDICTS.join(" | ")} \u2014 got '${opts.verdict}'`
+      );
+    let bodyText;
+    try {
+      bodyText = opts.file ? readFileSync7(opts.file, "utf8") : readFileSync7(0, "utf8");
+    } catch {
+      fail(
+        opts.file ? `could not read --file ${opts.file}` : "no closeout body \u2014 pass --file <path> or pipe it on stdin"
+      );
+    }
+    if (!bodyText.trim())
+      fail(
+        "closeout body is empty \u2014 pass --file <path> or pipe the body on stdin"
+      );
+    const client = await makeClient(cfg);
+    let matchTags;
+    let dispatchedVersion;
+    if (opts.decomposition) {
+      const run = await runApi(
+        "Reading run contract",
+        async () => client.GET("/decompositions/{id}/run", {
+          params: { path: { id: opts.decomposition } }
+        })
+      );
+      const await_ = run.awaitingCompletion;
+      if (!await_ || !Array.isArray(await_.matchTags) || await_.matchTags.length === 0)
+        fail(
+          `decomposition ${opts.decomposition} has no parked run awaiting a completion \u2014 nothing to close (run outcome: ${run.outcome ?? "unknown"}). Idempotent no-op on an already-resumed/terminal run.`
+        );
+      if (run.awaitingTaskId && run.awaitingTaskId !== opts.task)
+        fail(
+          `run ${opts.decomposition} is awaiting task ${run.awaitingTaskId}, not ${opts.task} \u2014 refusing to mis-key the resume.`
+        );
+      matchTags = await_.matchTags;
+      if (typeof await_.dispatchedTaskVersion === "number")
+        dispatchedVersion = await_.dispatchedTaskVersion;
+    } else {
+      matchTags = [`wlp-task:${opts.task}`];
+    }
+    const tags = [
+      .../* @__PURE__ */ new Set([
+        ...matchTags,
+        `wlp-task:${opts.task}`,
+        `verdict:${verdict}`
+      ])
+    ];
+    const closeout = await runApi(
+      "Creating closeout",
+      async () => client.POST("/memories", {
+        body: {
+          text: bodyText,
+          type: "reference",
+          content: "{}",
+          confidence: 1,
+          source: opts.source,
+          archetype: "Document",
+          title: opts.title,
+          tags,
+          owner: { type: "Workspace", id: opts.workspace }
+        }
+      })
+    );
+    let toVersion;
+    if (opts.toVersion !== void 0) {
+      toVersion = Number(opts.toVersion);
+      if (!Number.isInteger(toVersion) || toVersion < 1)
+        fail(
+          `--to-version must be an integer >= 1 \u2014 got '${opts.toVersion}'`
+        );
+    } else if (dispatchedVersion !== void 0) {
+      toVersion = dispatchedVersion;
+    } else {
+      const task = await runApi(
+        "Reading task version",
+        async () => client.GET("/memories/{memoryId}", {
+          params: { path: { memoryId: opts.task } }
+        })
+      );
+      const v = task?.item?.currentVersion ?? task?.currentVersion;
+      if (typeof v !== "number" || v < 1)
+        fail(
+          `could not read task ${opts.task} version to pin the Reference edge \u2014 pass --to-version <n>`
+        );
+      toVersion = v;
+    }
+    const edge = await runApi(
+      "Wiring Reference edge",
+      async () => client.POST("/memories/{memoryId}/relationships", {
+        params: { path: { memoryId: closeout.id } },
+        body: { toMemoryId: opts.task, type: "Reference", toVersion }
+      })
+    );
+    let taskStatus;
+    if (opts.statusFlip !== false && !opts.decomposition) {
+      const current = await runApi(
+        "Reading task tags",
+        async () => client.GET("/memories/{memoryId}", {
+          params: { path: { memoryId: opts.task } }
+        })
+      );
+      const currentTags = current?.item?.tags ?? current?.tags ?? [];
+      const target = verdict === "blocked" ? "status:blocked" : "status:done";
+      const nextTags = [
+        ...new Set(currentTags.filter((t) => !t.startsWith("status:")))
+      ].concat(target);
+      await runApi(
+        "Flipping task status",
+        async () => client.PATCH("/memories/{memoryId}/metadata", {
+          params: { path: { memoryId: opts.task } },
+          body: {
+            memoryId: opts.task,
+            source: opts.source,
+            tags: nextTags
+          }
+        })
+      );
+      taskStatus = target.slice("status:".length);
+    }
+    const view = resolveViewUrl(cfg.baseUrl, closeout.url);
+    const result = {
+      closeoutId: closeout.id,
+      edgeId: edge.id,
+      taskStatus: taskStatus ?? null,
+      verdict,
+      tags
+    };
+    emitAction(
+      `closed ${style.bold(opts.task)} verdict:${style.bold(verdict)} \u2192 closeout ${style.bold(closeout.id)}${taskStatus ? ` ${style.dim(`(task ${taskStatus})`)}` : ""}${view ? ` ${style.dim("\u2192")} ${view}` : ""}`,
+      result,
+      json
+    );
+  });
+}
+
 // src/commands/continuity.ts
 function registerContinuity(program2) {
   const continuity = program2.command("continuity").description("Continuity snapshots: checkpoint and resume work");
@@ -2693,6 +3108,442 @@ Examples:
   });
 }
 
+// src/commands/decomposition.ts
+function registerDecomposition(program2) {
+  const decomposition = program2.command("decomposition").description(
+    "Drive a WLP decomposition: decompose a brief, then execute / accept / reject"
+  );
+  decomposition.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom decomposition decompose mem_XXXX
+  $ sechroom decomposition execute sug_XXXX
+  $ sechroom decomposition publish-run sug_XXXX
+  $ sechroom decomposition accept sug_XXXX
+  $ sechroom decomposition reject sug_XXXX --reason "wrong shape"`
+  );
+  decomposition.command("decompose <briefId>").description(
+    "Decompose a work brief into a candidate Task graph (POST /work-briefs/{id}/decompose)"
+  ).action(async (briefId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Queueing decomposition", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/work-briefs/{id}/decompose", {
+        params: { path: { id: briefId } },
+        body: { id: briefId }
+      });
+    });
+    emitAction(
+      `queued decomposition of ${style.bold(briefId)} \u2192 ${style.bold(data.suggestionId)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  decomposition.command("execute <decompositionId>").description(
+    "Execute a decomposition's Task graph (POST /decompositions/{id}/execute)"
+  ).action(async (decompositionId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Executing decomposition", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/decompositions/{id}/execute", {
+        params: { path: { id: decompositionId } },
+        body: {}
+      });
+    });
+    emitAction(
+      `executed ${style.bold(decompositionId)} \u2192 run ${style.bold(data.runRecordId)} (${data.outcome})`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  decomposition.command("publish-run <decompositionId>").description(
+    "Publish an accepted decomposition's context pack on demand (POST /decompositions/{id}/publish-run)"
+  ).action(async (decompositionId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Publishing context pack", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/decompositions/{id}/publish-run", {
+        params: { path: { id: decompositionId } },
+        body: {}
+      });
+    });
+    emitAction(
+      `published ${style.bold(decompositionId)} \u2192 run ${style.bold(data.runRecordId)} (${data.outcome})`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  decomposition.command("accept <decompositionId>").description(
+    "Accept a Pending decomposition \u2014 promote + ratify its Tasks (POST /decompositions/{id}/accept)"
+  ).action(async (decompositionId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Accepting decomposition", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/decompositions/{id}/accept", {
+        params: { path: { id: decompositionId } },
+        body: {}
+      });
+    });
+    emitAction(
+      `accepted decomposition ${style.bold(decompositionId)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  decomposition.command("reject <decompositionId>").description(
+    "Reject a Pending decomposition \u2014 archive its Tasks, bounce the brief (POST /decompositions/{id}/reject)"
+  ).option("--reason <reason>", "Optional free-text rejection reason").action(async (decompositionId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Rejecting decomposition", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/decompositions/{id}/reject", {
+        params: { path: { id: decompositionId } },
+        body: { reasonText: opts.reason ?? null }
+      });
+    });
+    emitAction(
+      `rejected decomposition ${style.bold(decompositionId)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+}
+
+// src/commands/executor.ts
+import { dirname as dirname8, join as join11 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync9 } from "fs";
+var EXECUTOR_STATE = "executor.json";
+var EXECUTOR_PULSE_COMMAND = "sechroom executor hook-pulse";
+var EXECUTOR_STOP_COMMAND = "sechroom executor hook-stop";
+var CLAUDE_EXECUTOR_HOOKS = {
+  SessionStart: EXECUTOR_PULSE_COMMAND,
+  UserPromptSubmit: EXECUTOR_PULSE_COMMAND,
+  PreToolUse: EXECUTOR_PULSE_COMMAND,
+  Stop: EXECUTOR_PULSE_COMMAND,
+  SessionEnd: EXECUTOR_STOP_COMMAND
+};
+var CODEX_EXECUTOR_HOOKS = {
+  SessionStart: EXECUTOR_PULSE_COMMAND,
+  UserPromptSubmit: EXECUTOR_PULSE_COMMAND,
+  PreToolUse: EXECUTOR_PULSE_COMMAND,
+  Stop: EXECUTOR_PULSE_COMMAND
+};
+function registerExecutor(program2) {
+  const executor = program2.command("executor").description(
+    "Register and operate a local Claude Code/Codex executor advertisement"
+  );
+  executor.command("install").description("Configure this checkout's harness to advertise itself as a WLP executor").option("--connector <id>", "Approved local-session ConnectorDefinition id").option("--instance-key <key>", "Stable executor identity (defaults to .sechroom/lane.json code-lane)").option("--runtime <kind>", "claude-code | codex").option("--surface <surface>", "claude | codex").option("--capability <key...>", "Capability operation keys claimed by this instance").option("--relay <id>", "Relay identity shared by sibling instances", "sechroom-cli-local").option("--subscription-name <name>", "SignalR delivery binding name", "executor-dispatch").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 600).option("--refresh-after <seconds>", "Minimum age before a hook refreshes", parseInteger, 40).option("-y, --yes", "Non-interactive: accept detected surface and lane defaults", false).option("--dry-run", "Show hook files without writing", false).action(async (opts, cmd) => {
+    const globals = cmd.optsWithGlobals();
+    const lane = readSem()?.values["code-lane"];
+    const detected = detectHookSurfaces(process.cwd());
+    let surface = opts.surface;
+    let instanceKey = opts.instanceKey;
+    let runtime = opts.runtime;
+    let connector = opts.connector;
+    let capabilities = opts.capability;
+    const surfaceDefault = detected.length === 1 ? detected[0] : lane?.includes("codex") ? "codex" : "claude";
+    if (!opts.yes && canPrompt()) {
+      surface = await promptText("Harness surface (claude or codex)?", surface ?? surfaceDefault);
+      instanceKey = await promptText("Executor instance key?", instanceKey ?? lane ?? "");
+      runtime = await promptText("Runtime (claude-code or codex)?", runtime ?? (surface === "codex" ? "codex" : "claude-code"));
+      connector = await promptText("Approved local-session connector id?", connector ?? "");
+      const capabilityText = await promptText("Capability keys (comma-separated; blank for none)?", capabilities?.join(",") ?? "");
+      capabilities = capabilityText.split(",").map((x) => x.trim()).filter(Boolean);
+    }
+    surface ??= surfaceDefault;
+    instanceKey ??= lane;
+    runtime ??= surface === "codex" ? "codex" : "claude-code";
+    if (!connector) fail("executor install requires --connector (or an interactive connector id)");
+    if (!instanceKey) fail("no instance key resolved; pass --instance-key or pin .sechroom/lane.json code-lane");
+    if (!opts.yes && !canPrompt()) fail("non-interactive executor install requires --yes");
+    parseRuntimeKind(runtime);
+    if (!["claude", "codex"].includes(surface)) fail("surface must be claude or codex");
+    if (opts.refreshAfter >= opts.ttl) fail("refresh-after must be shorter than the TTL");
+    const sem = readSem();
+    const checkout = sem ? dirname8(dirname8(sem.path)) : process.cwd();
+    const statePath = join11(checkout, ".sechroom", EXECUTOR_STATE);
+    const state = {
+      schemaVersion: 1,
+      instanceKey,
+      runtime: runtime.toLowerCase() === "codex" ? "codex" : "claude-code",
+      connectorId: connector,
+      capabilityKeys: capabilities ?? [],
+      relayId: opts.relay,
+      subscriptionName: opts.subscriptionName,
+      ttlSeconds: opts.ttl,
+      refreshAfterSeconds: opts.refreshAfter
+    };
+    if (!opts.dryRun) {
+      mkdirSync9(dirname8(statePath), { recursive: true });
+      writeFileSync9(statePath, JSON.stringify(state, null, 2) + "\n");
+      ensureStateDirIgnored(checkout);
+    }
+    const configuredClaudeDirs = globals.claudeConfigDir || process.env.CLAUDE_CONFIG_DIR ? resolveClaudeTargets({ override: globals.claudeConfigDir }).map((target) => target.dir) : [join11(checkout, ".claude")];
+    const configuredCodexHomes = globals.codexHome || process.env.CODEX_HOME ? resolveCodexHomes({ override: globals.codexHome }) : [join11(checkout, ".codex")];
+    const hookTargets = surface === "claude" ? configuredClaudeDirs : configuredCodexHomes;
+    for (const target of hookTargets) {
+      const results = surface === "claude" ? [installClaudeCommands(target, CLAUDE_EXECUTOR_HOOKS, opts.dryRun)] : installCodexCommands(target, CODEX_EXECUTOR_HOOKS, opts.dryRun);
+      for (const result of results) process.stderr.write(describe(result, opts.dryRun) + "\n");
+    }
+    warnIfSechroomNotOnPath();
+    process.stderr.write(style.green("executor harness configured") + style.dim(` \u2014 ${instanceKey}
+`));
+  });
+  executor.command("hook-pulse").description("Hook adapter: register or refresh this checkout's executor").action(async (_opts, cmd) => {
+    await drainStdin();
+    const located = readExecutorState();
+    if (!located) return;
+    const { state, path } = located;
+    const age = state.lastRefreshAt ? Date.now() - Date.parse(state.lastRefreshAt) : Number.POSITIVE_INFINITY;
+    if (state.instanceId && age < state.refreshAfterSeconds * 1e3) return;
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    try {
+      let data;
+      if (state.instanceId) {
+        try {
+          data = await refresh(cfg, state.instanceId, state.ttlSeconds);
+        } catch {
+          data = await registerInstance(cfg, state);
+        }
+      } else {
+        data = await registerInstance(cfg, state);
+      }
+      state.instanceId = data.id;
+      state.lastRefreshAt = (/* @__PURE__ */ new Date()).toISOString();
+      writeFileSync9(path, JSON.stringify(state, null, 2) + "\n");
+    } catch {
+    }
+  });
+  executor.command("hook-stop").description("Hook adapter: deregister this checkout's executor").action(async (_opts, cmd) => {
+    await drainStdin();
+    const located = readExecutorState();
+    if (!located?.state.instanceId) return;
+    try {
+      await api(resolveConfig(cmd.optsWithGlobals()), `/me/executor-instances/${encodeURIComponent(located.state.instanceId)}`, { method: "DELETE", body: JSON.stringify({}) });
+      delete located.state.instanceId;
+      delete located.state.lastRefreshAt;
+      writeFileSync9(located.path, JSON.stringify(located.state, null, 2) + "\n");
+    } catch {
+    }
+  });
+  executor.command("submit-connector").description(
+    "Submit a local-session connector definition for governed approval"
+  ).requiredOption("--slug <slug>", "Unique connector definition slug").requiredOption("--display-name <name>", "Human-readable connector name").requiredOption("--transport <kind>", "push | pull").option("--profile <profile...>", "Advertised runtime profiles", [
+    "base",
+    "dotnet-10"
+  ]).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await api(cfg, "/connectors/definitions", {
+      method: "POST",
+      body: JSON.stringify({
+        slug: opts.slug,
+        displayName: opts.displayName,
+        runtimeProfiles: opts.profile,
+        connectorKind: "ExecutionRuntime",
+        providerKind: "local-session",
+        dispatchTransport: parseTransport(opts.transport)
+      })
+    });
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+    if (!cmd.optsWithGlobals().json) {
+      process.stderr.write(
+        style.dim(
+          "approve this connector definition before registering executors\n"
+        )
+      );
+    }
+  });
+  executor.command("register").description(
+    "Create/reuse a SignalR binding and register this local executor instance"
+  ).requiredOption(
+    "--instance-key <key>",
+    "Stable key for this concrete session/lane"
+  ).requiredOption(
+    "--connector <id>",
+    "Approved local-session ConnectorDefinition id"
+  ).option("--runtime <kind>", "claude-code | codex", "claude-code").option(
+    "--relay <id>",
+    "Relay identity shared by sibling instances",
+    "sechroom-cli-local"
+  ).option(
+    "--subscription-name <name>",
+    "SignalR delivery binding name",
+    "executor-dispatch"
+  ).option(
+    "--capability <key...>",
+    "Capability operation keys claimed by this instance"
+  ).option("--tool-set-ref <ref>", "Optional governed tool-set reference").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    if (!cfg.workspaceId)
+      fail("executor register requires a configured workspaceId");
+    const subscription = await api(
+      cfg,
+      "/me/delivery-subscriptions/signalr",
+      {
+        method: "POST",
+        body: JSON.stringify({
+          name: opts.subscriptionName,
+          enabled: true,
+          filter: { tags: ["kind:task"], workspaceScope: [cfg.workspaceId] }
+        })
+      }
+    );
+    const data = await api(
+      cfg,
+      "/me/executor-instances",
+      {
+        method: "POST",
+        body: JSON.stringify({
+          relayId: opts.relay,
+          instanceKey: opts.instanceKey,
+          runtimeKind: parseRuntimeKind(opts.runtime),
+          activationMode: "Attached",
+          deliverySubscriptionId: subscription.id,
+          connectorId: opts.connector,
+          claimedCapabilityKeys: opts.capability ?? [],
+          toolSetRef: opts.toolSetRef ?? null,
+          ttlSeconds: opts.ttl
+        })
+      }
+    );
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+    if (!cmd.optsWithGlobals().json)
+      process.stderr.write(
+        style.dim(`refresh with: sechroom executor heartbeat ${data.id}
+`)
+      );
+  });
+  executor.command("refresh <id>").description("Refresh one advertisement lease once").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).action(async (id, opts, cmd) => {
+    const data = await refresh(
+      resolveConfig(cmd.optsWithGlobals()),
+      id,
+      opts.ttl
+    );
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+  });
+  executor.command("heartbeat <id>").description("Keep an advertisement alive until interrupted").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).option("--interval <seconds>", "Refresh interval", parseInteger, 40).action(async (id, opts, cmd) => {
+    if (opts.interval >= opts.ttl)
+      fail("heartbeat interval must be shorter than the TTL");
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    await refresh(cfg, id, opts.ttl);
+    process.stderr.write(
+      style.green("executor heartbeat active") + style.dim(` \u2014 ${id}
+`)
+    );
+    await holdHeartbeat(async () => {
+      await refresh(cfg, id, opts.ttl);
+    }, opts.interval * 1e3);
+  });
+  executor.command("offers <id>").description("List live dispatch offers addressed to this exact instance").action(async (id, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await api(
+      cfg,
+      `/me/executor-instances/${encodeURIComponent(id)}/dispatch-offers`
+    );
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+  });
+  executor.command("deregister <id>").description("Stop advertising this executor instance").action(async (id, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await api(
+      cfg,
+      `/me/executor-instances/${encodeURIComponent(id)}`,
+      {
+        method: "DELETE",
+        body: JSON.stringify({})
+      }
+    );
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+  });
+}
+function parseRuntimeKind(value) {
+  switch (value.trim().toLowerCase()) {
+    case "claude":
+    case "claude-code":
+      return "ClaudeCode";
+    case "codex":
+      return "Codex";
+    default:
+      return fail("runtime must be claude-code or codex");
+  }
+}
+function parseTransport(value) {
+  switch (value.trim().toLowerCase()) {
+    case "push":
+      return "Push";
+    case "pull":
+      return "Pull";
+    default:
+      return fail("transport must be push or pull");
+  }
+}
+async function refresh(cfg, id, ttlSeconds) {
+  return api(
+    cfg,
+    `/me/executor-instances/${encodeURIComponent(id)}/refresh`,
+    {
+      method: "POST",
+      body: JSON.stringify({ ttlSeconds })
+    }
+  );
+}
+async function registerInstance(cfg, state) {
+  if (!cfg.workspaceId) fail("executor registration requires a configured workspaceId");
+  const subscription = await api(cfg, "/me/delivery-subscriptions/signalr", {
+    method: "POST",
+    body: JSON.stringify({ name: state.subscriptionName, enabled: true, filter: { tags: ["kind:task"], workspaceScope: [cfg.workspaceId] } })
+  });
+  return api(cfg, "/me/executor-instances", {
+    method: "POST",
+    body: JSON.stringify({ relayId: state.relayId, instanceKey: state.instanceKey, runtimeKind: parseRuntimeKind(state.runtime), activationMode: "Attached", deliverySubscriptionId: subscription.id, connectorId: state.connectorId, claimedCapabilityKeys: state.capabilityKeys, toolSetRef: null, ttlSeconds: state.ttlSeconds })
+  });
+}
+function readExecutorState(start = process.cwd()) {
+  const semPath = resolveSemPathForRead(start);
+  const sem = semPath ? readSem(semPath) : void 0;
+  const path = join11(sem ? dirname8(sem.path) : join11(start, ".sechroom"), EXECUTOR_STATE);
+  if (!existsSync9(path)) return void 0;
+  return { state: JSON.parse(readFileSync8(path, "utf8")), path };
+}
+async function drainStdin() {
+  if (process.stdin.isTTY) return;
+  for await (const _chunk of process.stdin) {
+  }
+}
+async function api(cfg, path, init) {
+  const token = await requireToken(cfg);
+  const response = await fetch(`${cfg.baseUrl}${path}`, {
+    ...init,
+    headers: {
+      authorization: `Bearer ${token}`,
+      tenant: cfg.tenant,
+      "content-type": "application/json",
+      "x-sechroom-surface": "cli"
+    }
+  });
+  if (!response.ok)
+    fail(
+      `${init?.method ?? "GET"} ${path} failed (${response.status}): ${await response.text()}`
+    );
+  return response.json();
+}
+function parseInteger(value) {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isFinite(parsed)) fail(`expected an integer, got '${value}'`);
+  return parsed;
+}
+function holdHeartbeat(tick, intervalMs) {
+  return new Promise((resolve3, reject) => {
+    const timer = setInterval(() => void tick().catch(reject), intervalMs);
+    const stop = () => {
+      clearInterval(timer);
+      resolve3();
+    };
+    process.once("SIGINT", stop);
+    process.once("SIGTERM", stop);
+  });
+}
+
 // src/commands/filing.ts
 function registerFiling(program2) {
   const filing = program2.command("filing").description("Review and act on filing suggestions");
@@ -3204,8 +4055,8 @@ Examples:
 
 // src/setup/apply.ts
 import { createHash as createHash3 } from "crypto";
-import { mkdirSync as mkdirSync9, readFileSync as readFileSync7, writeFileSync as writeFileSync9, existsSync as existsSync9 } from "fs";
-import { dirname as dirname8 } from "path";
+import { mkdirSync as mkdirSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync10, existsSync as existsSync10 } from "fs";
+import { dirname as dirname9 } from "path";
 var MARKER_BEGIN = "<!-- @sechroom/cli:begin";
 var MARKER_END = "<!-- @sechroom/cli:end";
 function normalizeBody(s) {
@@ -3258,22 +4109,22 @@ function parseManagedBlock(content, block) {
   return null;
 }
 function ensureDir2(path) {
-  mkdirSync9(dirname8(path), { recursive: true });
+  mkdirSync10(dirname9(path), { recursive: true });
 }
 function readOr(path, fallback) {
   try {
-    return readFileSync7(path, "utf8");
+    return readFileSync9(path, "utf8");
   } catch {
     return fallback;
   }
 }
 function mergeMcpJson(path, snippet, dryRun) {
   const incoming = JSON.parse(snippet);
-  const existed = existsSync9(path);
+  const existed = existsSync10(path);
   let current = {};
   if (existed) {
     try {
-      current = JSON.parse(readFileSync7(path, "utf8"));
+      current = JSON.parse(readFileSync9(path, "utf8"));
     } catch {
       return { kind: "mcp", path, status: "skipped", note: "existing file isn't valid JSON \u2014 left untouched" };
     }
@@ -3281,26 +4132,26 @@ function mergeMcpJson(path, snippet, dryRun) {
   current.mcpServers = { ...current.mcpServers ?? {}, ...incoming.mcpServers ?? {} };
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync9(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
+  writeFileSync10(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function mergeCodexToml(path, snippet, dryRun) {
-  const existed = existsSync9(path);
+  const existed = existsSync10(path);
   let body = readOr(path, "");
   body = body.replace(/(^|\n)\[mcp_servers\.sechroom\][^[]*/, "\n").replace(/\n{3,}/g, "\n\n");
   const trimmed = body.trim();
   const next = (trimmed.length > 0 ? trimmed + "\n\n" : "") + snippet.trim() + "\n";
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync9(path, next, { mode: 384 });
+  writeFileSync10(path, next, { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function writeInstructionBlock(path, write, dryRun) {
-  const existed = existsSync9(path);
+  const existed = existsSync10(path);
   const next = computeBlockFile(readOr(path, ""), write);
   if (dryRun) return { kind: "instruction", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync9(path, next);
+  writeFileSync10(path, next);
   return { kind: "instruction", path, status: existed ? "merged" : "created" };
 }
 function computeBlockFile(current, write) {
@@ -3341,7 +4192,7 @@ function applyBlock(path, write, mode, dryRun) {
     const next = computeBlockFile(current, write);
     if (!dryRun) {
       ensureDir2(proposedPath);
-      writeFileSync9(proposedPath, next);
+      writeFileSync10(proposedPath, next);
     }
     return {
       kind: "instruction",
@@ -3471,8 +4322,8 @@ auto-resumes where you left off and checkpoints working state before compacting.
 }
 
 // src/setup/skills-offer.ts
-import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
-import { join as join11 } from "path";
+import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
+import { join as join12 } from "path";
 
 // src/setup/lane-pin.ts
 var CODE_LANE_PREFIX_BY_CLIENT = {
@@ -3588,8 +4439,8 @@ Found ${summary} available to you for ${surface}.
   if (skills.length > 0) {
     const written = [];
     for (const s of skills) {
-      mkdirSync10(join11(sDir, s.name), { recursive: true });
-      writeFileSync10(join11(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
+      mkdirSync11(join12(sDir, s.name), { recursive: true });
+      writeFileSync11(join12(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
       written.push(s.name);
     }
     recordMaterialisedSkills(sDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -3597,11 +4448,11 @@ Found ${summary} available to you for ${surface}.
 `);
   }
   if (agents.length > 0) {
-    mkdirSync10(aDir, { recursive: true });
+    mkdirSync11(aDir, { recursive: true });
     const written = [];
     for (const a of agents) {
       const file = `${a.name}.md`;
-      writeFileSync10(join11(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
+      writeFileSync11(join12(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
       written.push(file);
     }
     recordMaterialisedSkills(aDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -3984,13 +4835,13 @@ Wired to namespace '${slug}'. Restart your AI client (or reload MCP) to pick it
 }
 
 // src/commands/onboard.ts
-import { existsSync as existsSync11 } from "fs";
-import { basename as basename2, join as join13 } from "path";
+import { existsSync as existsSync12 } from "fs";
+import { basename as basename2, join as join14 } from "path";
 
 // src/commands/fanout.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync8, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
-import { isAbsolute, join as join12, resolve } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync10, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
+import { isAbsolute, join as join13, resolve } from "path";
 var ICON = {
   refresh: "\u21BB",
   bind: "+",
@@ -4010,21 +4861,21 @@ function discoverChildren(root) {
   const out = [];
   for (const name of names.sort()) {
     if (name.startsWith(".") || name === "node_modules") continue;
-    const dir = join12(root, name);
+    const dir = join13(root, name);
     try {
       if (!statSync3(dir).isDirectory()) continue;
     } catch {
       continue;
     }
-    if (existsSync10(join12(dir, ".git")) || committedBindingPath(dir)) out.push(name);
+    if (existsSync11(join13(dir, ".git")) || committedBindingPath(dir)) out.push(name);
   }
   return out;
 }
 function readManifest(path) {
-  if (!existsSync10(path)) return null;
+  if (!existsSync11(path)) return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync8(path, "utf8"));
+    parsed = JSON.parse(readFileSync10(path, "utf8"));
   } catch (err2) {
     throw new Error(`couldn't parse ${path}: ${err2 instanceof Error ? err2.message : String(err2)}`);
   }
@@ -4390,10 +5241,10 @@ async function chooseScope(scopeFlag, yes) {
 }
 async function planRecurseChild(entry, root, client, opts) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync11(dir)) {
+  if (!existsSync12(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
-  if (existsSync11(join13(dir, ".sechroom.json"))) {
+  if (existsSync12(join14(dir, ".sechroom.json"))) {
     return {
       label: entry.path,
       dir,
@@ -4466,7 +5317,7 @@ This fan-out will pin the same lane in every repo:
 async function runRecurse(cfg, g, opts) {
   const { yes, dryRun, json } = opts;
   const root = process.cwd();
-  const manifestPath = join13(root, ".sechroom", "repos.json");
+  const manifestPath = join14(root, ".sechroom", "repos.json");
   const fromManifest = readManifest(manifestPath);
   const entries = fromManifest ?? discoverChildren(root).map((path) => ({ path }));
   const sourceLabel = fromManifest ? `manifest ${manifestPath}` : `auto-discovered under ${root}`;
@@ -4838,24 +5689,45 @@ Examples:
   $ sechroom relationship suggestions --status Pending --memory mem_XXXX
   $ sechroom relationship suggestion accept rsg_XXXX`
   );
-  relationship.command("create <fromMemoryId> <toMemoryId>").description("Create a relationship (POST /memories/{memoryId}/relationships)").option("--type <type>", "Relationship type (Reference, Related, Parent, Child, Follows, \u2026)", "Reference").action(async (fromMemoryId, toMemoryId, opts, cmd) => {
+  relationship.command("create <fromMemoryId> <toMemoryId>").description("Create a relationship (POST /memories/{memoryId}/relationships)").option("--type <type>", "Relationship type (Reference, Related, Parent, Child, Follows, \u2026)", "Reference").option(
+    "--to-version <number>",
+    "Version of the target memory to pin the edge to (defaults to the target's current version)"
+  ).action(async (fromMemoryId, toMemoryId, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Creating relationship", async () => {
-      const client = await makeClient(cfg);
-      return client.POST("/memories/{memoryId}/relationships", {
+    const client = await makeClient(cfg);
+    let toVersion;
+    if (opts.toVersion !== void 0) {
+      toVersion = Number(opts.toVersion);
+      if (!Number.isInteger(toVersion) || toVersion < 1) {
+        fail(`--to-version must be a positive integer (got '${opts.toVersion}').`);
+      }
+    } else {
+      const target = await runApi(
+        "Resolving target version",
+        async () => client.GET("/memories/{memoryId}", { params: { path: { memoryId: toMemoryId } } })
+      );
+      if (typeof target.item?.currentVersion !== "number") {
+        fail(`Could not resolve the current version of ${toMemoryId}; pass --to-version explicitly.`);
+      }
+      toVersion = target.item.currentVersion;
+    }
+    const data = await runApi(
+      "Creating relationship",
+      async () => client.POST("/memories/{memoryId}/relationships", {
         params: { path: { memoryId: fromMemoryId } },
         body: {
           toMemoryId,
-          type: opts.type
+          type: opts.type,
+          toVersion
         }
-      });
-    });
+      })
+    );
     const inversePart = data.inverseId ? ` ${style.dim(`(inverse ${data.inverseId})`)}` : "";
     const view = resolveViewUrl(cfg.baseUrl, data.url);
     const urlPart = view ? ` ${style.dim("\u2192")} ${view}` : "";
     emitAction(
-      `created relationship ${style.bold(data.id)} ${style.dim(`${fromMemoryId} \u2192 ${toMemoryId}`)}${inversePart}${urlPart}`,
-      data,
+      `created relationship ${style.bold(data.id)} ${style.dim(`${fromMemoryId} \u2192 ${toMemoryId} @v${toVersion}`)}${inversePart}${urlPart}`,
+      { ...data, toVersion },
       cmd.optsWithGlobals().json
     );
   });
@@ -4978,23 +5850,23 @@ Examples:
 
 // src/commands/reset.ts
 import { homedir as homedir4 } from "os";
-import { join as join14 } from "path";
-import { existsSync as existsSync12, readFileSync as readFileSync9, rmSync as rmSync3 } from "fs";
+import { join as join15 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync11, rmSync as rmSync3 } from "fs";
 var SKILLS_LOCK2 = ".sechroom-skills.json";
-var localSkillsDir = () => join14(process.cwd(), ".claude", "skills");
-var globalSkillsDir = () => join14(homedir4(), ".claude", "skills");
-var localAgentsDir = () => join14(process.cwd(), ".claude", "agents");
-var globalAgentsDir = () => join14(homedir4(), ".claude", "agents");
+var localSkillsDir = () => join15(process.cwd(), ".claude", "skills");
+var globalSkillsDir = () => join15(homedir4(), ".claude", "skills");
+var localAgentsDir = () => join15(process.cwd(), ".claude", "agents");
+var globalAgentsDir = () => join15(homedir4(), ".claude", "agents");
 function removeMaterialisedSkills(dir) {
   const removed = [];
-  const lockPath = join14(dir, SKILLS_LOCK2);
-  if (!existsSync12(lockPath)) return removed;
+  const lockPath = join15(dir, SKILLS_LOCK2);
+  if (!existsSync13(lockPath)) return removed;
   try {
-    const lock = JSON.parse(readFileSync9(lockPath, "utf8"));
+    const lock = JSON.parse(readFileSync11(lockPath, "utf8"));
     for (const entry of Object.values(lock)) {
       for (const name of entry.skills ?? []) {
-        const p = join14(dir, name);
-        if (existsSync12(p)) {
+        const p = join15(dir, name);
+        if (existsSync13(p)) {
           rmSync3(p, { recursive: true, force: true });
           removed.push(p);
         }
@@ -5039,18 +5911,18 @@ function registerReset(program2) {
       }
     }
     const removed = [];
-    const stateDir = join14(process.cwd(), ".sechroom");
-    if (existsSync12(stateDir)) {
+    const stateDir = join15(process.cwd(), ".sechroom");
+    if (existsSync13(stateDir)) {
       rmSync3(stateDir, { recursive: true, force: true });
       removed.push(stateDir);
     }
-    const legacyCfg = join14(process.cwd(), ".sechroom.json");
-    if (existsSync12(legacyCfg)) {
+    const legacyCfg = join15(process.cwd(), ".sechroom.json");
+    if (existsSync13(legacyCfg)) {
       rmSync3(legacyCfg, { force: true });
       removed.push(legacyCfg);
     }
-    const legacySem = join14(process.cwd(), ".sem");
-    if (existsSync12(legacySem)) {
+    const legacySem = join15(process.cwd(), ".sem");
+    if (existsSync13(legacySem)) {
       rmSync3(legacySem, { force: true });
       removed.push(legacySem);
     }
@@ -5076,8 +5948,8 @@ function registerReset(program2) {
 }
 
 // src/commands/skills.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync11, statSync as statSync4, writeFileSync as writeFileSync11 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync12, statSync as statSync4, writeFileSync as writeFileSync12 } from "fs";
+import { join as join16 } from "path";
 function filenameFromDisposition(header) {
   if (!header) return void 0;
   const m = /filename\*?=(?:UTF-8'')?"?([^";]+)"?/i.exec(header);
@@ -5085,11 +5957,11 @@ function filenameFromDisposition(header) {
 }
 function resolveOutputPath(output, serverFilename) {
   const filename = serverFilename || "skills.zip";
-  if (!output) return join15(process.cwd(), filename);
-  const looksLikeDir = output.endsWith("/") || existsSync13(output) && statSync4(output).isDirectory();
+  if (!output) return join16(process.cwd(), filename);
+  const looksLikeDir = output.endsWith("/") || existsSync14(output) && statSync4(output).isDirectory();
   if (looksLikeDir) {
-    mkdirSync11(output, { recursive: true });
-    return join15(output, filename);
+    mkdirSync12(output, { recursive: true });
+    return join16(output, filename);
   }
   return output;
 }
@@ -5120,7 +5992,7 @@ async function downloadZip(label, call, output) {
   const buf = Buffer.from(res.data);
   const filename = filenameFromDisposition(res.response.headers.get("content-disposition")) ?? "skills.zip";
   const path = resolveOutputPath(output, filename);
-  writeFileSync11(path, buf);
+  writeFileSync12(path, buf);
   return { path, bytes: buf.length, filename };
 }
 function registerSkills(program2) {
@@ -5129,7 +6001,9 @@ function registerSkills(program2) {
     "after",
     `
 Examples:
-  $ sechroom skills install                 materialise your installed skills to ~/.claude/skills
+  $ sechroom skills install --client claude  materialise target:claude-code skills to ~/.claude/skills
+  $ sechroom skills install --client codex   materialise target:gpt-codex skills to ~/.codex/skills
+  $ sechroom skills install --client all     keep both global clients in sync
   $ sechroom skills install --scope project  write them to ./.claude/skills instead
   $ sechroom skills list                     what's materialised on disk
   $ sechroom skills clean                    remove the materialised skill files
@@ -5138,11 +6012,15 @@ Examples:
   $ sechroom skills package --from-source --workspace wsp_abc -o ./dist   zip a draft from source
   $ sechroom skills set-lane --code-lane claude-code-chris --design-lane claude-design-chris
 
+When --client is omitted, configured client flags/environment variables win;
+otherwise existing default client homes are detected. Both configured/detected
+clients select all; an unconfigured machine preserves the legacy Claude default.
+
 `
   );
-  skills.command("install").description("Materialise your installed skills to disk (the already-installed bundle \u2014 no server install)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--dry-run", "print what would be written; write nothing").option("--json", "machine output").action((opts, cmd) => runInstall(SKILL_SPEC, cmd, opts));
-  skills.command("list").description("List the skills materialised on disk (per resolved config dir)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").action((opts, cmd) => runList(SKILL_SPEC, cmd, opts));
-  skills.command("clean [slug]").description(`Remove skill files materialised to disk (default ${DEFAULT_SKILLS_SLUG})`).option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").action((slugArg, opts, cmd) => runClean(SKILL_SPEC, cmd, opts, slugArg));
+  skills.command("install").description("Materialise your installed skills to disk (the already-installed bundle \u2014 no server install)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--client <client>", "claude, codex, or all (default: configured/detected clients)").option("--dry-run", "print what would be written; write nothing").option("--json", "machine output").action((opts, cmd) => runInstall(SKILL_SPEC, cmd, opts));
+  skills.command("list").description("List the skills materialised on disk (per resolved config dir)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--client <client>", "claude, codex, or all (default: configured/detected clients)").option("--json", "machine output").action((opts, cmd) => runList(SKILL_SPEC, cmd, opts));
+  skills.command("clean [slug]").description(`Remove skill files materialised to disk (default ${DEFAULT_SKILLS_SLUG})`).option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--client <client>", "claude, codex, or all (default: configured/detected clients)").option("--json", "machine output").action((slugArg, opts, cmd) => runClean(SKILL_SPEC, cmd, opts, slugArg));
   skills.command("preview").description("Render a workspace's draft bundle from source (no publish/install) and report the components").requiredOption("--workspace <id>", "workspace holding the draft bundle sources (wsp_\u2026)").option("--slug <slug>", "override the derived bundle slug").option("--title <title>", "override the derived bundle title").option("--version <version>", "override the derived bundle version").option("--default-install-parent <path>", "override the derived default install parent").option("--json", "machine output (the full RenderBundlePreviewResponse)").action(async (opts, cmd) => {
     const json = Boolean(opts.json) || Boolean(cmd.optsWithGlobals().json);
     const client = await makeClient(resolveConfig(cmd.optsWithGlobals()));
@@ -5288,12 +6166,12 @@ Examples:
 }
 
 // src/commands/sweep.ts
-import { existsSync as existsSync14 } from "fs";
-import { dirname as dirname9, join as join16, resolve as resolve2 } from "path";
-var DEFAULT_MANIFEST = join16(".sechroom", "repos.json");
+import { existsSync as existsSync15 } from "fs";
+import { dirname as dirname10, join as join17, resolve as resolve2 } from "path";
+var DEFAULT_MANIFEST = join17(".sechroom", "repos.json");
 function planEntry(entry, root) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync14(dir)) {
+  if (!existsSync15(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
   if (committedBindingPath(dir)) {
@@ -5369,7 +6247,7 @@ Examples:
 `);
       return;
     }
-    const root = dirname9(dirname9(manifestPath));
+    const root = dirname10(dirname10(manifestPath));
     const plans = repos.map((entry) => planEntry(entry, root));
     if (!json) {
       process.stderr.write(
@@ -5388,13 +6266,13 @@ Examples:
 
 // src/commands/telemetry.ts
 import {
-  existsSync as existsSync15,
-  mkdirSync as mkdirSync12,
-  readFileSync as readFileSync10,
+  existsSync as existsSync16,
+  mkdirSync as mkdirSync13,
+  readFileSync as readFileSync12,
   rmSync as rmSync4,
-  writeFileSync as writeFileSync12
+  writeFileSync as writeFileSync13
 } from "fs";
-import { dirname as dirname10, join as join17 } from "path";
+import { dirname as dirname11, join as join18 } from "path";
 function registerTelemetry(program2) {
   const telemetry = program2.command("telemetry").description(
     "Emit WLP run telemetry (an executor leg's progress events) into a decomposition run"
@@ -5464,14 +6342,14 @@ function registerTelemetry(program2) {
     "Decomposition id this session executes"
   ).requiredOption("--task <id>", "Task id this session executes").action((opts, cmd) => {
     const json = Boolean(cmd.optsWithGlobals().json);
-    const dir = join17(process.cwd(), ".sechroom");
-    mkdirSync12(dir, { recursive: true });
-    const path = join17(dir, BINDING_FILE);
+    const dir = join18(process.cwd(), ".sechroom");
+    mkdirSync13(dir, { recursive: true });
+    const path = join18(dir, BINDING_FILE);
     const binding = {
       decompositionId: opts.decomposition,
       taskId: opts.task
     };
-    writeFileSync12(path, JSON.stringify(binding, null, 2) + "\n");
+    writeFileSync13(path, JSON.stringify(binding, null, 2) + "\n");
     ensureStateDirIgnored(process.cwd());
     if (json) {
       emit({ bound: true, ...binding, path }, true);
@@ -5486,8 +6364,8 @@ function registerTelemetry(program2) {
   });
   telemetry.command("unbind").description("Clear this checkout's telemetry binding").action((_opts, cmd) => {
     const json = Boolean(cmd.optsWithGlobals().json);
-    const path = join17(process.cwd(), ".sechroom", BINDING_FILE);
-    const existed = existsSync15(path);
+    const path = join18(process.cwd(), ".sechroom", BINDING_FILE);
+    const existed = existsSync16(path);
     if (existed) rmSync4(path);
     if (json) emit({ unbound: existed, path }, true);
     else
@@ -5496,7 +6374,7 @@ function registerTelemetry(program2) {
       );
   });
   telemetry.command("hook").description(
-    "Per-turn telemetry self-report for a Claude Code Stop hook (reads stdin; no-op unless bound). Fail-soft."
+    "Per-turn telemetry self-report for Claude Code hooks \u2014 Stop/SubagentStop \u2192 parsed + terminal, Notification/PermissionDenied \u2192 approval (reads stdin; no-op unless bound). Fail-soft."
   ).action(async (_opts, cmd) => {
     try {
       const raw = await readStdin2();
@@ -5505,21 +6383,10 @@ function registerTelemetry(program2) {
       const binding = findBinding(cwd);
       if (!binding) return process.exit(0);
       const usage = input.transcript_path ? parseTranscript(input.transcript_path) : null;
-      if (!usage) return process.exit(0);
+      const events = buildHookEvents(input, usage, binding.taskId);
+      if (events.length === 0) return process.exit(0);
       const cfg = resolveConfig(cmd.optsWithGlobals());
-      await postTelemetry(cfg, binding.decompositionId, [
-        {
-          taskId: binding.taskId,
-          kind: "Parsed",
-          tokensIn: usage.tokensIn,
-          tokensOut: usage.tokensOut,
-          contextUsed: usage.contextUsed,
-          contextWindow: usage.contextWindow,
-          text: null,
-          approvalState: null,
-          verdict: null
-        }
-      ]);
+      await postTelemetry(cfg, binding.decompositionId, events);
       return process.exit(0);
     } catch {
       return process.exit(0);
@@ -5547,7 +6414,12 @@ function registerTelemetry(program2) {
       scope,
       cwd
     });
-    const commands = { Stop: "sechroom telemetry hook" };
+    const commands = {
+      Stop: "sechroom telemetry hook",
+      SubagentStop: "sechroom telemetry hook",
+      Notification: "sechroom telemetry hook",
+      PermissionDenied: "sechroom telemetry hook"
+    };
     try {
       const multi = targets.length > 1;
       const results = targets.map((t) => {
@@ -5601,11 +6473,11 @@ async function postTelemetry(cfg, decompositionId, events) {
 function findBinding(start) {
   let dir = start;
   for (; ; ) {
-    const path = join17(dir, ".sechroom", BINDING_FILE);
-    if (existsSync15(path)) {
+    const path = join18(dir, ".sechroom", BINDING_FILE);
+    if (existsSync16(path)) {
       try {
         const b = JSON.parse(
-          readFileSync10(path, "utf8")
+          readFileSync12(path, "utf8")
         );
         if (b.decompositionId && b.taskId)
           return { decompositionId: b.decompositionId, taskId: b.taskId };
@@ -5613,18 +6485,18 @@ function findBinding(start) {
       }
       return null;
     }
-    const parent = dirname10(dir);
+    const parent = dirname11(dir);
     if (parent === dir) return null;
     dir = parent;
   }
 }
 function parseTranscript(path) {
-  if (!existsSync15(path)) return null;
+  if (!existsSync16(path)) return null;
   let tokensIn = 0;
   let tokensOut = 0;
   let contextUsed = 0;
   let model = "";
-  for (const line of readFileSync10(path, "utf8").split("\n")) {
+  for (const line of readFileSync12(path, "utf8").split("\n")) {
     if (!line.trim()) continue;
     let obj;
     try {
@@ -5641,11 +6513,61 @@ function parseTranscript(path) {
     if (obj.message?.model) model = obj.message.model;
   }
   if (tokensIn === 0 && tokensOut === 0) return null;
-  return { tokensIn, tokensOut, contextUsed, contextWindow: windowFor(model) };
+  return { tokensIn, tokensOut, contextUsed, contextWindow: windowFor(model, contextUsed) };
 }
-function windowFor(model) {
+function windowFor(model, contextUsed = 0) {
   const m = model.toLowerCase();
-  return m.includes("[1m]") || m.includes("-1m") ? 1e6 : 2e5;
+  if (m.includes("[1m]") || m.includes("-1m")) return 1e6;
+  return contextUsed > 2e5 ? 1e6 : 2e5;
+}
+function buildHookEvents(input, usage, taskId) {
+  const events = [];
+  const base = (kind, over) => ({
+    taskId,
+    kind,
+    tokensIn: null,
+    tokensOut: null,
+    contextUsed: null,
+    contextWindow: null,
+    text: null,
+    approvalState: null,
+    verdict: null,
+    ...over
+  });
+  if (usage) {
+    events.push(
+      base("Parsed", {
+        tokensIn: usage.tokensIn,
+        tokensOut: usage.tokensOut,
+        contextUsed: usage.contextUsed,
+        contextWindow: usage.contextWindow
+      })
+    );
+  }
+  switch (input.hook_event_name) {
+    case "PermissionDenied":
+      events.push(
+        base("Approval", {
+          approvalState: "denied",
+          text: input.tool_name ?? input.message ?? null
+        })
+      );
+      break;
+    case "Notification":
+      if (isPermissionNotification(input))
+        events.push(base("Approval", { text: input.message ?? null }));
+      break;
+    case "Stop":
+    case "SubagentStop":
+      events.push(base("Terminal", { text: input.last_assistant_message ?? null }));
+      break;
+  }
+  return events;
+}
+function isPermissionNotification(input) {
+  const t = (input.notification_type ?? input.type ?? "").toLowerCase();
+  if (t) return t.includes("permission");
+  return (input.message ?? "").toLowerCase().includes("permission");
 }
 async function readStdin2() {
   if (process.stdin.isTTY) return "";
@@ -5881,7 +6803,7 @@ Examples:
 function resolveVersion() {
   try {
     const pkg = JSON.parse(
-      readFileSync11(new URL("../package.json", import.meta.url), "utf8")
+      readFileSync13(new URL("../package.json", import.meta.url), "utf8")
     );
     return pkg.version ?? "0.0.0";
   } catch {
@@ -6039,6 +6961,9 @@ registerLookup(program);
 registerRelationships(program);
 registerWorkspace(program);
 registerProject(program);
+registerDecomposition(program);
+registerExecutor(program);
+registerClose(program);
 registerFiling(program);
 registerContinuity(program);
 registerCheckpoint(program);