@sechroom/cli 2026.8.1 → 2026.8.2

package/dist/index.js

@@ -4366,9 +4366,19 @@ import { dirname as dirname5, join as join7 } from "path";
 function claudeDesktopConfigPath(home) {
   switch (process.platform) {
     case "darwin":
-      return join7(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+      return join7(
+        home,
+        "Library",
+        "Application Support",
+        "Claude",
+        "claude_desktop_config.json"
+      );
     case "win32":
-      return join7(process.env.APPDATA ?? join7(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
+      return join7(
+        process.env.APPDATA ?? join7(home, "AppData", "Roaming"),
+        "Claude",
+        "claude_desktop_config.json"
+      );
     default:
       return join7(home, ".config", "Claude", "claude_desktop_config.json");
   }
@@ -4376,30 +4386,53 @@ function claudeDesktopConfigPath(home) {
 function clientTargets(cwd, opts = {}) {
   const home = homedir3();
   const claudeDir = opts.claudeDir ?? join7(home, ".claude");
-  const codexHome = opts.codexHome ?? join7(home, ".codex");
+  const codexHome = opts.codexHome === void 0 ? join7(home, ".codex") : opts.codexHome;
   return {
     "claude-code": {
       key: "claude-code",
       label: "Claude Code",
-      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join7(cwd, ".mcp.json"), format: "json" },
+      mcp: {
+        surfaceKey: "claude-code",
+        sectionType: SectionType.McpConfig,
+        path: join7(cwd, ".mcp.json"),
+        format: "json"
+      },
       instruction: { surfaceKey: "claude-code", path: join7(cwd, "CLAUDE.md") }
     },
     "claude-desktop": {
       key: "claude-desktop",
       label: "Claude Desktop",
-      mcp: { surfaceKey: "claude-desktop", sectionType: SectionType.McpConfig, path: claudeDesktopConfigPath(home), format: "json" },
-      instruction: { surfaceKey: "claude-desktop", path: join7(claudeDir, "CLAUDE.md") }
+      mcp: {
+        surfaceKey: "claude-desktop",
+        sectionType: SectionType.McpConfig,
+        path: claudeDesktopConfigPath(home),
+        format: "json"
+      },
+      instruction: {
+        surfaceKey: "claude-desktop",
+        path: join7(claudeDir, "CLAUDE.md")
+      }
     },
     codex: {
       key: "codex",
       label: "Codex CLI",
-      mcp: { surfaceKey: "chatgpt", sectionType: SectionType.McpConfigToml, path: join7(codexHome, "config.toml"), format: "toml" },
+      mcp: codexHome ? {
+        surfaceKey: "chatgpt",
+        sectionType: SectionType.McpConfigToml,
+        path: join7(codexHome, "config.toml"),
+        format: "toml"
+      } : null,
       instruction: { surfaceKey: "chatgpt", path: join7(cwd, "AGENTS.md") }
     },
     cursor: {
       key: "cursor",
       label: "Cursor",
-      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join7(cwd, ".cursor", "mcp.json"), format: "json" },
+      mcp: {
+        surfaceKey: "claude-code",
+        sectionType: SectionType.McpConfig,
+        path: join7(cwd, ".cursor", "mcp.json"),
+        format: "json"
+      },
       instruction: { surfaceKey: "chatgpt", path: join7(cwd, "AGENTS.md") }
     },
     antigravity: {
@@ -4411,20 +4444,34 @@ function clientTargets(cwd, opts = {}) {
       // `type` — comes from the `antigravity` server surface, so we don't
       // hardcode it here. Instructions go in the project `AGENTS.md`
       // (cross-tool, shared with Codex/Cursor).
-      mcp: { surfaceKey: "antigravity", sectionType: SectionType.McpConfig, path: join7(home, ".gemini", "config", "mcp_config.json"), format: "json" },
+      mcp: {
+        surfaceKey: "antigravity",
+        sectionType: SectionType.McpConfig,
+        path: join7(home, ".gemini", "config", "mcp_config.json"),
+        format: "json"
+      },
       instruction: { surfaceKey: "antigravity", path: join7(cwd, "AGENTS.md") }
     }
   };
 }
-var ALL_CLIENT_KEYS = ["claude-code", "claude-desktop", "codex", "cursor", "antigravity"];
+var ALL_CLIENT_KEYS = [
+  "claude-code",
+  "claude-desktop",
+  "codex",
+  "cursor",
+  "antigravity"
+];
 var DEFAULT_CLIENT_KEY = "claude-code";
 function detectInstalledClients(cwd) {
   const home = homedir3();
   const detected = [];
-  if (resolveClaudeTargets({}).some((t) => existsSync5(t.dir))) detected.push("claude-code");
-  if (existsSync5(dirname5(claudeDesktopConfigPath(home)))) detected.push("claude-desktop");
+  if (resolveClaudeTargets({}).some((t) => existsSync5(t.dir)))
+    detected.push("claude-code");
+  if (existsSync5(dirname5(claudeDesktopConfigPath(home))))
+    detected.push("claude-desktop");
   if (resolveCodexHomes({}).some((d) => existsSync5(d))) detected.push("codex");
-  if (existsSync5(join7(home, ".cursor")) || existsSync5(join7(cwd, ".cursor"))) detected.push("cursor");
+  if (existsSync5(join7(home, ".cursor")) || existsSync5(join7(cwd, ".cursor")))
+    detected.push("cursor");
   if (existsSync5(join7(home, ".gemini"))) detected.push("antigravity");
   return detected;
 }
@@ -8975,7 +9022,7 @@ function herdrRequest(socketPath, method, params, timeoutMs = 1e4) {
   });
 }
 function herdrStream(socketPath, subscriptions, onEvent, options = {}) {
-  const { signal, onWarning, subscribeTimeoutMs = 1e4 } = options;
+  const { signal, onWarning, onReady, subscribeTimeoutMs = 1e4 } = options;
   return new Promise((resolvePromise, rejectPromise) => {
     if (signal?.aborted) {
       resolvePromise();
@@ -9017,6 +9064,7 @@ function herdrStream(socketPath, subscriptions, onEvent, options = {}) {
         if (!acked) {
           acked = true;
           clearTimeout(ackTimer);
+          onReady?.();
         }
         const classified = classifyStreamLine(line, id);
         if (classified.kind === "ack") continue;
@@ -9191,9 +9239,12 @@ function indexAgents(agents) {
   return new Map(agents.map((agent) => [agent.pane_id, agent]));
 }
 function buildWatchSubscriptions(agents) {
-  return agents.flatMap((agent) => [
-    { type: "pane.agent_status_changed", pane_id: agent.pane_id },
-    { type: "pane.exited", pane_id: agent.pane_id }
+  return buildPaneSubscriptions(agents.map((agent) => agent.pane_id));
+}
+function buildPaneSubscriptions(paneIds) {
+  return [...new Set(paneIds)].flatMap((pane_id) => [
+    { type: "pane.agent_status_changed", pane_id },
+    { type: "pane.exited", pane_id }
   ]);
 }
 function normalizeWatchEvent(raw) {
@@ -9385,6 +9436,7 @@ async function runWait(ports, targets, options) {
   const remaining = new Set(targetIds);
   let seed = /* @__PURE__ */ new Map();
   let attempt = 0;
+  const subscriptions = buildPaneSubscriptions(targetIds);
   const settle = (agent, paneId, status) => {
     if (!remaining.has(paneId)) return;
     const record = {
@@ -9403,67 +9455,124 @@ async function runWait(ports, targets, options) {
   try {
     while (!controller.signal.aborted) {
       try {
-        const listed = await raceAbort(
-          ports.request("agent.list", {})
-        );
-        if (listed === aborted) break;
-        const current = listed.agents ?? [];
-        const fresh = indexAgents(current);
-        for (const paneId of [...remaining]) {
-          const currentAgent = fresh.get(paneId);
-          if (currentAgent === void 0) {
-            settle(seed.get(paneId), paneId, "exited");
-            continue;
-          }
-          const status = currentAgent.agent_status?.trim().toLowerCase();
-          if (status !== void 0 && statuses.has(status)) {
-            settle(currentAgent, paneId, currentAgent.agent_status ?? status);
-          }
-        }
-        seed = fresh;
-        if (completed || remaining.size === 0) return;
-        const subscriptions = buildWatchSubscriptions(
-          current.filter((agent) => remaining.has(agent.pane_id))
-        );
         let carriedTraffic = false;
         let relistNeeded = false;
+        let reconciled = false;
+        const bufferedEvents = [];
         const startedAt = now();
         const cycle = new AbortController();
         const stopCycle = () => cycle.abort();
         controller.signal.addEventListener("abort", stopCycle, { once: true });
+        let streamReady = false;
+        let streamFailed = false;
+        let streamFailure;
+        let resolveReady;
+        let rejectReady;
+        const ready = new Promise((resolve9, reject) => {
+          resolveReady = resolve9;
+          rejectReady = reject;
+        });
+        const handleEvent = (event) => {
+          if (!remaining.has(event.paneId)) return;
+          const known = seed.get(event.paneId);
+          if (event.type === "pane.exited") {
+            settle(known, event.paneId, "exited");
+            return;
+          }
+          const status = event.to?.trim().toLowerCase();
+          if (known && event.to) known.agent_status = event.to;
+          if (status !== void 0 && statuses.has(status)) {
+            settle(known, event.paneId, event.to ?? status);
+          }
+        };
+        let streamFinished;
         try {
-          const streamed = await raceAbort(
-            ports.stream(
-              subscriptions,
-              (raw) => {
-                carriedTraffic = true;
-                const event = normalizeWatchEvent(raw);
-                if (event === null || needsRelistFallback(event)) {
-                  relistNeeded = true;
-                  cycle.abort();
-                  return;
-                }
-                if (!remaining.has(event.paneId)) return;
-                const known = seed.get(event.paneId);
-                if (event.type === "pane.exited") {
-                  settle(known, event.paneId, "exited");
-                  return;
-                }
-                const status = event.to?.trim().toLowerCase();
-                if (known && event.to) known.agent_status = event.to;
-                if (status !== void 0 && statuses.has(status)) {
-                  settle(known, event.paneId, event.to ?? status);
-                }
+          const stream = ports.stream(
+            subscriptions,
+            (raw) => {
+              carriedTraffic = true;
+              if (!streamReady) {
+                streamReady = true;
+                resolveReady();
+              }
+              const event = normalizeWatchEvent(raw);
+              if (event === null || needsRelistFallback(event)) {
+                relistNeeded = true;
+                cycle.abort();
+                return;
+              }
+              if (!reconciled) {
+                bufferedEvents.push(event);
+                return;
+              }
+              handleEvent(event);
+            },
+            {
+              signal: cycle.signal,
+              onReady: () => {
+                streamReady = true;
+                resolveReady();
               },
-              {
-                signal: cycle.signal,
-                onWarning: (message) => warn2(`herdr wait: ${message}`)
+              onWarning: (message) => warn2(`herdr wait: ${message}`)
+            }
+          );
+          streamFinished = stream.then(
+            () => {
+              if (!streamReady) {
+                rejectReady(
+                  new Error("Herdr subscription closed before it was ready")
+                );
               }
-            )
+            },
+            (error) => {
+              streamFailed = true;
+              streamFailure = error;
+              if (!streamReady) rejectReady(error);
+            }
+          );
+        } catch (error) {
+          streamFailed = true;
+          streamFailure = error;
+          rejectReady(error);
+          streamFinished = Promise.resolve();
+        }
+        try {
+          const readyResult = await raceAbort(ready);
+          if (readyResult === aborted) break;
+          const listed = await raceAbort(
+            ports.request("agent.list", {})
           );
+          if (listed === aborted) break;
+          const current = listed.agents ?? [];
+          const fresh = indexAgents(current);
+          for (const paneId of [...remaining]) {
+            const currentAgent = fresh.get(paneId);
+            if (currentAgent === void 0) {
+              settle(seed.get(paneId), paneId, "exited");
+            }
+          }
+          seed = fresh;
+          reconciled = true;
+          for (const paneId of [...remaining]) {
+            const currentAgent = fresh.get(paneId);
+            if (currentAgent === void 0) continue;
+            for (const event of bufferedEvents) {
+              if (event.paneId === paneId) handleEvent(event);
+            }
+            if (!remaining.has(paneId)) continue;
+            const status = currentAgent.agent_status?.trim().toLowerCase();
+            if (status !== void 0 && statuses.has(status)) {
+              settle(currentAgent, paneId, currentAgent.agent_status ?? status);
+            }
+          }
+          if (completed || remaining.size === 0) return;
+          if (relistNeeded) continue;
+          const streamed = await raceAbort(streamFinished);
           if (streamed === aborted) break;
+          if (streamFailed) throw streamFailure;
         } finally {
           controller.signal.removeEventListener("abort", stopCycle);
+          cycle.abort();
         }
         if (completed) return;
         if (relistNeeded) continue;
@@ -10055,6 +10164,41 @@ function resolveCreateBody(textOpt, fileOpt) {
   );
   return { text: text2, defaultTitle };
 }
+async function fetchAllMemoryRelationships(cfg, memoryId) {
+  const pages = [];
+  let page = 1;
+  while (true) {
+    const current = await runApi(
+      `Fetching relationships (page ${page})`,
+      async () => {
+        const client = await makeClient(cfg);
+        return client.GET("/memories/{memoryId}/relationships", {
+          params: { path: { memoryId }, query: { page } }
+        });
+      }
+    );
+    pages.push(current);
+    const hasNextPage = current.hasNextPage ?? (current.pageCount !== void 0 ? current.page < current.pageCount : current.page * current.pageSize < current.count);
+    if (!hasNextPage) break;
+    page = current.page + 1;
+  }
+  const first = pages[0];
+  if (!first || pages.length === 1) return first;
+  const items = pages.flatMap((current) => current.items);
+  return {
+    ...first,
+    items,
+    page: 1,
+    pageSize: items.length,
+    pageCount: 1,
+    hasPreviousPage: false,
+    hasNextPage: false,
+    isFirstPage: true,
+    isLastPage: true,
+    firstItemOnPage: 1,
+    lastItemOnPage: items.length
+  };
+}
 function registerMemory(program2) {
   const memory = program2.command("memory").description("Create, read, and search memories");
   memory.addHelpText(
@@ -10309,7 +10453,16 @@ ${plan.rows.map(
       false
     );
   });
-  memory.command("get <memoryId>").description("Fetch a memory by id (GET /memories/{memoryId})").action(async (memoryId, _opts, cmd) => {
+  const get = memory.command("get <memoryId>").description("Fetch a memory by id (GET /memories/{memoryId})").option(
+    "--with-relationships",
+    "Include the memory's relationships in the response",
+    false
+  ).addHelpText(
+    "after",
+    `
+Note: CLI memory get omits relationships by default; MCP get_memory includes them. Use --with-relationships to read all relationship pages, or relationship list <memoryId> to inspect edges.`
+  );
+  get.action(async (memoryId, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Fetching memory", async () => {
       const client = await makeClient(cfg);
@@ -10317,6 +10470,11 @@ ${plan.rows.map(
         params: { path: { memoryId } }
       });
     });
+    if (opts.withRelationships) {
+      const relationships = await fetchAllMemoryRelationships(cfg, memoryId);
+      emit({ ...data, relationships }, cmd.optsWithGlobals().json);
+      return;
+    }
     emit(data, cmd.optsWithGlobals().json);
   });
   memory.command("search <query>").description(
@@ -10664,8 +10822,18 @@ ${plan.rows.map(
 }
 
 // src/setup/apply.ts
-import { createHash as createHash5 } from "crypto";
-import { mkdirSync as mkdirSync16, readFileSync as readFileSync16, writeFileSync as writeFileSync15, existsSync as existsSync13 } from "fs";
+import { createHash as createHash5, randomUUID as randomUUID3 } from "crypto";
+import {
+  chmodSync as chmodSync2,
+  copyFileSync,
+  existsSync as existsSync13,
+  mkdirSync as mkdirSync16,
+  readFileSync as readFileSync16,
+  renameSync as renameSync4,
+  rmSync as rmSync7,
+  statSync as statSync5,
+  writeFileSync as writeFileSync15
+} from "fs";
 import { dirname as dirname15 } from "path";
 var MARKER_BEGIN = "<!-- @sechroom/cli:begin";
 var MARKER_END = "<!-- @sechroom/cli:end";
@@ -10711,11 +10879,17 @@ function parseManagedBlock(content, block) {
   const keyed = content.match(keyedBlockRe(block));
   if (keyed) {
     const attrs = parseAttrs(keyed[0].slice(0, keyed[0].indexOf("\n")));
-    return { block, source: attrs.source ?? null, sha256: attrs.sha256 ?? null, body: innerBody(keyed[0]) };
+    return {
+      block,
+      source: attrs.source ?? null,
+      sha256: attrs.sha256 ?? null,
+      body: innerBody(keyed[0])
+    };
   }
   if (block === "role-template") {
     const legacy = content.match(legacyBlockRe());
-    if (legacy) return { block, source: null, sha256: null, body: innerBody(legacy[0]) };
+    if (legacy)
+      return { block, source: null, sha256: null, body: innerBody(legacy[0]) };
   }
   return null;
 }
@@ -10737,33 +10911,446 @@ function mergeMcpJson(path, snippet, dryRun) {
     try {
       current = JSON.parse(readFileSync16(path, "utf8"));
     } catch {
-      return { kind: "mcp", path, status: "skipped", note: "existing file isn't valid JSON \u2014 left untouched" };
+      return {
+        kind: "mcp",
+        path,
+        status: "skipped",
+        note: "existing file isn't valid JSON \u2014 left untouched"
+      };
     }
   }
-  current.mcpServers = { ...current.mcpServers ?? {}, ...incoming.mcpServers ?? {} };
+  current.mcpServers = {
+    ...current.mcpServers ?? {},
+    ...incoming.mcpServers ?? {}
+  };
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
   writeFileSync15(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
-function mergeCodexToml(path, snippet, dryRun) {
+var CODEX_MCP_TABLE = "mcp_servers.sechroom";
+function decodeTomlBasicString(value) {
+  let decoded = "";
+  for (let i = 0; i < value.length; i += 1) {
+    const char = value[i];
+    if (char !== "\\") {
+      decoded += char;
+      continue;
+    }
+    const escaped = value[++i];
+    if (escaped === void 0) throw new Error("unterminated TOML escape");
+    const simple = {
+      b: "\b",
+      f: "\f",
+      n: "\n",
+      r: "\r",
+      t: "	",
+      '"': '"',
+      "\\": "\\"
+    };
+    if (escaped in simple) {
+      decoded += simple[escaped];
+      continue;
+    }
+    const digits = escaped === "u" ? 4 : escaped === "U" ? 8 : 0;
+    if (digits === 0) throw new Error(`invalid TOML escape '\\\\${escaped}'`);
+    const code = value.slice(i + 1, i + 1 + digits);
+    if (!new RegExp(`^[0-9a-fA-F]{${digits}}$`).test(code))
+      throw new Error(`invalid TOML Unicode escape '\\\\${escaped}${code}'`);
+    decoded += String.fromCodePoint(Number.parseInt(code, 16));
+    i += digits;
+  }
+  return decoded;
+}
+function normalizeTomlKey(raw) {
+  const segments = [];
+  let i = 0;
+  while (i < raw.length) {
+    while (/\s/.test(raw[i] ?? "")) i += 1;
+    if (i >= raw.length) break;
+    const quote = raw[i];
+    let segment;
+    if (quote === '"' || quote === "'") {
+      i += 1;
+      const start = i;
+      let escaped = false;
+      while (i < raw.length) {
+        const char = raw[i];
+        if (quote === '"' && escaped) {
+          escaped = false;
+          i += 1;
+          continue;
+        }
+        if (quote === '"' && char === "\\") {
+          escaped = true;
+          i += 1;
+          continue;
+        }
+        if (char === quote) break;
+        i += 1;
+      }
+      if (raw[i] !== quote) throw new Error(`unterminated TOML key '${raw}'`);
+      const encoded = raw.slice(start, i);
+      segment = quote === '"' ? decodeTomlBasicString(encoded) : encoded;
+      i += 1;
+    } else {
+      const start = i;
+      while (i < raw.length && /[A-Za-z0-9_-]/.test(raw[i])) i += 1;
+      segment = raw.slice(start, i);
+      if (!segment) throw new Error(`invalid TOML key '${raw.trim()}'`);
+    }
+    segments.push(segment);
+    while (/\s/.test(raw[i] ?? "")) i += 1;
+    if (i >= raw.length) break;
+    if (raw[i] !== ".") throw new Error(`invalid TOML key '${raw.trim()}'`);
+    i += 1;
+  }
+  if (segments.length === 0) throw new Error("empty TOML key");
+  return segments;
+}
+function sameTomlKey(left, right) {
+  return left.length === right.length && left.every((segment, index) => segment === right[index]);
+}
+function isTomlKeyPrefix(prefix, candidate) {
+  return prefix.length < candidate.length && prefix.every((segment, index) => segment === candidate[index]);
+}
+function tomlKeyLabel(key) {
+  return key.join(".");
+}
+function stripTomlComment(line) {
+  let quote = null;
+  let escaped = false;
+  for (let i = 0; i < line.length; i += 1) {
+    const rest = line.slice(i);
+    const char = line[i];
+    if (quote === "multiline-basic") {
+      if (rest.startsWith('"""') && !escaped) {
+        escaped = false;
+        quote = null;
+        i += 2;
+        continue;
+      }
+      if (escaped) escaped = false;
+      else if (char === "\\") escaped = true;
+      continue;
+    }
+    if (quote === "multiline-literal") {
+      if (rest.startsWith("'''")) {
+        i += 2;
+        quote = null;
+      }
+      continue;
+    }
+    if (quote === "basic") {
+      if (escaped) escaped = false;
+      else if (char === "\\") escaped = true;
+      else if (char === '"') quote = null;
+      continue;
+    }
+    if (quote === "literal") {
+      if (char === "'") quote = null;
+      continue;
+    }
+    if (rest.startsWith('"""')) {
+      quote = "multiline-basic";
+      i += 2;
+    } else if (rest.startsWith("'''")) {
+      quote = "multiline-literal";
+      i += 2;
+    } else if (char === '"') quote = "basic";
+    else if (char === "'") quote = "literal";
+    else if (char === "#") return line.slice(0, i);
+  }
+  return line;
+}
+function scanTomlValue(value, state) {
+  for (let i = 0; i < value.length; i += 1) {
+    const rest = value.slice(i);
+    const char = value[i];
+    if (state.quote === "multiline-basic") {
+      if (rest.startsWith('"""') && !state.escaped) {
+        state.quote = null;
+        i += 2;
+        continue;
+      }
+      if (state.escaped) state.escaped = false;
+      else if (char === "\\") state.escaped = true;
+      continue;
+    }
+    if (state.quote === "multiline-literal") {
+      if (rest.startsWith("'''")) {
+        state.quote = null;
+        i += 2;
+      }
+      continue;
+    }
+    if (state.quote === "basic") {
+      if (state.escaped) state.escaped = false;
+      else if (char === "\\") state.escaped = true;
+      else if (char === '"') state.quote = null;
+      continue;
+    }
+    if (state.quote === "literal") {
+      if (char === "'") state.quote = null;
+      continue;
+    }
+    if (char === "#") break;
+    if (rest.startsWith('"""')) {
+      state.quote = "multiline-basic";
+      i += 2;
+    } else if (rest.startsWith("'''")) {
+      state.quote = "multiline-literal";
+      i += 2;
+    } else if (char === '"') state.quote = "basic";
+    else if (char === "'") state.quote = "literal";
+    else if (char === "[" || char === "{") state.containers.push(char);
+    else if (char === "]" || char === "}") {
+      const expected = char === "]" ? "[" : "{";
+      if (state.containers.pop() !== expected)
+        throw new Error(`unbalanced TOML delimiter '${char}'`);
+    }
+  }
+}
+function parseTomlHeader(rawLine) {
+  const line = stripTomlComment(rawLine).trim();
+  const array = line.startsWith("[[") && line.endsWith("]]");
+  const table = !array && line.startsWith("[") && line.endsWith("]");
+  if (!array && !table) return null;
+  const prefix = array ? 2 : 1;
+  const suffix = array ? 2 : 1;
+  const rawName = line.slice(prefix, line.length - suffix).trim();
+  if (!rawName) throw new Error("empty TOML table name");
+  return { name: normalizeTomlKey(rawName), array };
+}
+function findTomlEquals(line) {
+  let quote = null;
+  let escaped = false;
+  for (let i = 0; i < line.length; i += 1) {
+    const char = line[i];
+    if (quote === "basic") {
+      if (escaped) escaped = false;
+      else if (char === "\\") escaped = true;
+      else if (char === '"') quote = null;
+      continue;
+    }
+    if (quote === "literal") {
+      if (char === "'") quote = null;
+      continue;
+    }
+    if (char === '"') quote = "basic";
+    else if (char === "'") quote = "literal";
+    else if (char === "=") return i;
+  }
+  return -1;
+}
+function arrayTableContext(name, arrays) {
+  let best = null;
+  for (let i = arrays.length - 1; i >= 0; i -= 1) {
+    const candidate = arrays[i];
+    if (isTomlKeyPrefix(candidate.key, name)) {
+      if (!best || candidate.key.length > best.key.length) best = candidate;
+    }
+  }
+  return best;
+}
+function tomlTableIdentity(key, context) {
+  return `${context?.identity ?? "root"}:${JSON.stringify(key)}`;
+}
+function isTomlScalar(value) {
+  const decimal = "[+-]?(?:0|[1-9](?:_?[0-9])*)(?:\\.[0-9](?:_?[0-9])*)?(?:[eE][+-]?[0-9](?:_?[0-9])*)?";
+  const number = new RegExp(
+    `^(?:${decimal}|[+-]?0x[0-9A-Fa-f](?:_?[0-9A-Fa-f])*|[+-]?0o[0-7](?:_?[0-7])*|[+-]?0b[01](?:_?[01])*|[+-]?(?:inf|nan))$`
+  );
+  const datetime = /^(?:[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]+)?|[0-9]{4}-[0-9]{2}-[0-9]{2}(?:(?:[Tt ]|[Tt])[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]+)?(?:Z|[+-][0-9]{2}:[0-9]{2})?)?)$/;
+  return number.test(value) || datetime.test(value) || /^(?:true|false)$/.test(value);
+}
+function validateTomlValueShape(value) {
+  const token = stripTomlComment(value).trim();
+  if (!token) throw new Error("empty TOML value");
+  if (token.startsWith('"') || token.startsWith("'")) {
+    const quote = token[0];
+    if (quote && token.endsWith(quote)) return;
+  }
+  if (token.startsWith("[") && token.endsWith("]")) return;
+  if (token.startsWith("{") && token.endsWith("}")) return;
+  if (isTomlScalar(token)) return;
+  throw new Error(`invalid TOML value '${token}'`);
+}
+function validateToml(content) {
+  const tables = /* @__PURE__ */ new Set();
+  const keys = /* @__PURE__ */ new Set();
+  const arrayInstances = [];
+  let currentTable = { identity: "root" };
+  let valueState = {
+    containers: [],
+    quote: null,
+    escaped: false
+  };
+  for (const rawLine of content.replace(/\r\n/g, "\n").split("\n")) {
+    if (valueState.quote || valueState.containers.length > 0) {
+      scanTomlValue(rawLine, valueState);
+      continue;
+    }
+    const line = stripTomlComment(rawLine).trim();
+    if (!line) continue;
+    const header = parseTomlHeader(rawLine);
+    if (header) {
+      if (header.array) {
+        const context = arrayTableContext(header.name, arrayInstances);
+        const parentIdentity = context?.identity ?? null;
+        const previous = [...arrayInstances].reverse().find(
+          (candidate) => sameTomlKey(candidate.key, header.name) && candidate.parentIdentity === parentIdentity
+        );
+        const count = (previous?.count ?? 0) + 1;
+        const instance = {
+          key: header.name,
+          parentIdentity,
+          identity: `${parentIdentity ?? "root"}:${JSON.stringify(header.name)}#${count}`,
+          count
+        };
+        arrayInstances.push(instance);
+        currentTable = { identity: instance.identity };
+      } else {
+        const context = arrayTableContext(header.name, arrayInstances);
+        currentTable = {
+          identity: tomlTableIdentity(header.name, context)
+        };
+        if (tables.has(currentTable.identity))
+          throw new Error(
+            `duplicate TOML table '${tomlKeyLabel(header.name)}'`
+          );
+        tables.add(currentTable.identity);
+      }
+      continue;
+    }
+    const equals = findTomlEquals(line);
+    if (equals <= 0) throw new Error(`invalid TOML line '${rawLine}'`);
+    const key = normalizeTomlKey(line.slice(0, equals).trim());
+    const value = line.slice(equals + 1).trim();
+    if (!value || value.startsWith("#"))
+      throw new Error(`empty TOML value for '${tomlKeyLabel(key)}'`);
+    const fullKey = `${currentTable.identity}\0${JSON.stringify(key)}`;
+    if (keys.has(fullKey))
+      throw new Error(`duplicate TOML key '${tomlKeyLabel(key)}'`);
+    keys.add(fullKey);
+    scanTomlValue(line.slice(equals + 1), valueState);
+    if (valueState.quote === "basic" || valueState.quote === "literal")
+      throw new Error("unterminated TOML string");
+    if (!valueState.quote && valueState.containers.length === 0)
+      validateTomlValueShape(value);
+  }
+  if (valueState.quote) throw new Error("unterminated TOML string");
+  if (valueState.containers.length > 0)
+    throw new Error("unbalanced TOML value");
+}
+function isTomlTableHeader(line) {
+  try {
+    return parseTomlHeader(line) !== null;
+  } catch {
+    return false;
+  }
+}
+function replaceTomlTable(content, tableName, replacement) {
+  const target = normalizeTomlKey(tableName);
+  const lines = content.replace(/\r\n/g, "\n").split("\n");
+  const replacementLines = replacement.trim().split("\n");
+  const kept = [];
+  let i = 0;
+  while (i < lines.length) {
+    const header = parseTomlHeader(lines[i]);
+    if (header && (sameTomlKey(header.name, target) || isTomlKeyPrefix(target, header.name))) {
+      i += 1;
+      while (i < lines.length && !isTomlTableHeader(lines[i])) i += 1;
+      continue;
+    }
+    kept.push(lines[i]);
+    i += 1;
+  }
+  const base = kept.join("\n").trim();
+  return `${base.length > 0 ? `${base}
+
+` : ""}${replacementLines.join("\n")}
+`;
+}
+var defaultTomlFileOperations = {
+  copyFileSync,
+  renameSync: renameSync4
+};
+function writeTomlAtomic(path, content, fileOperations = {}) {
+  ensureDir2(path);
+  const operations = { ...defaultTomlFileOperations, ...fileOperations };
+  const temporary = `${path}.sechroom-${process.pid}-${randomUUID3()}.tmp`;
+  const backup = `${path}.bak`;
+  const backupTemporary = `${backup}.sechroom-${process.pid}-${randomUUID3()}.tmp`;
+  const mode = existsSync13(path) ? statSync5(path).mode & 4095 : 384;
+  try {
+    writeFileSync15(temporary, content, { mode });
+    chmodSync2(temporary, mode);
+    validateToml(readFileSync16(temporary, "utf8"));
+    if (existsSync13(path) && !existsSync13(backup)) {
+      operations.copyFileSync(path, backupTemporary);
+      chmodSync2(backupTemporary, mode);
+      validateToml(readFileSync16(backupTemporary, "utf8"));
+      operations.renameSync(backupTemporary, backup);
+    }
+    operations.renameSync(temporary, path);
+  } finally {
+    rmSync7(temporary, { force: true });
+    rmSync7(backupTemporary, { force: true });
+  }
+}
+function mergeCodexToml(path, snippet, dryRun, fileOperations = {}) {
   const existed = existsSync13(path);
-  let body = readOr(path, "");
-  body = body.replace(/(^|\n)\[mcp_servers\.sechroom\][^[]*/, "\n").replace(/\n{3,}/g, "\n\n");
-  const trimmed = body.trim();
-  const next = (trimmed.length > 0 ? trimmed + "\n\n" : "") + snippet.trim() + "\n";
+  const body = readOr(path, "");
+  try {
+    validateToml(body);
+  } catch (error) {
+    return {
+      kind: "mcp",
+      path,
+      status: "skipped",
+      note: `existing TOML is invalid \u2014 left untouched (${error.message})`
+    };
+  }
+  const next = replaceTomlTable(body, CODEX_MCP_TABLE, snippet);
+  try {
+    validateToml(next);
+  } catch (error) {
+    return {
+      kind: "mcp",
+      path,
+      status: "skipped",
+      note: `generated TOML is invalid \u2014 left untouched (${error.message})`
+    };
+  }
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
-  ensureDir2(path);
-  writeFileSync15(path, next, { mode: 384 });
+  if (next === body)
+    return { kind: "mcp", path, status: existed ? "current" : "created" };
+  try {
+    writeTomlAtomic(path, next, fileOperations);
+  } catch (error) {
+    return {
+      kind: "mcp",
+      path,
+      status: "skipped",
+      note: `could not replace TOML \u2014 left untouched (${error.message})`
+    };
+  }
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function writeInstructionBlock(path, write, dryRun) {
   const existed = existsSync13(path);
   const next = computeBlockFile(readOr(path, ""), write);
-  if (dryRun) return { kind: "instruction", path, status: "dry-run", block: write.block };
+  if (dryRun)
+    return { kind: "instruction", path, status: "dry-run", block: write.block };
   ensureDir2(path);
   writeFileSync15(path, next);
-  return { kind: "instruction", path, status: existed ? "merged" : "created", block: write.block };
+  return {
+    kind: "instruction",
+    path,
+    status: existed ? "merged" : "created",
+    block: write.block
+  };
 }
 function computeBlockFile(current, write) {
   const rendered = renderBlock(write);
@@ -10812,7 +11399,13 @@ function applyBlock(path, write, mode, dryRun) {
     };
   }
   if (state === "current") {
-    return { kind: "instruction", path, status: "current", eval: "current", block: write.block };
+    return {
+      kind: "instruction",
+      path,
+      status: "current",
+      eval: "current",
+      block: write.block
+    };
   }
   if (state === "drift" && mode !== "force") {
     const proposedPath = `${path}.proposed`;
@@ -10847,7 +11440,12 @@ async function applyClient(cfg, setup, target, opts) {
     const section = findSection(surface, target.mcp.sectionType);
     const snippet = sectionSnippet(section);
     if (!snippet) {
-      actions.push({ kind: "mcp", path: target.mcp.path, status: "skipped", note: `no ${target.mcp.sectionType} section on surface '${target.mcp.surfaceKey}'` });
+      actions.push({
+        kind: "mcp",
+        path: target.mcp.path,
+        status: "skipped",
+        note: `no ${target.mcp.sectionType} section on surface '${target.mcp.surfaceKey}'`
+      });
     } else {
       actions.push(
         target.mcp.format === "toml" ? mergeCodexToml(target.mcp.path, snippet, dryRun) : mergeMcpJson(target.mcp.path, snippet, dryRun)
@@ -10858,25 +11456,44 @@ async function applyClient(cfg, setup, target, opts) {
     const surface = findSurface(setup, target.instruction.surfaceKey);
     const section = findSection(surface, SectionType.InstructionFile);
     if (!section) {
-      actions.push({ kind: "instruction", path: target.instruction.path, status: "skipped", note: `no instruction-file section on surface '${target.instruction.surfaceKey}'` });
+      actions.push({
+        kind: "instruction",
+        path: target.instruction.path,
+        status: "skipped",
+        note: `no instruction-file section on surface '${target.instruction.surfaceKey}'`
+      });
     } else {
       const resolved = await withSpinner(
         `Resolving ${target.label} agent instructions`,
         () => resolveInstruction(cfg, section, opts.personalWorkspaceId)
       );
       if (!resolved) {
-        actions.push({ kind: "instruction", path: target.instruction.path, status: "skipped", note: "no role template found in this tenant \u2014 install the SEM Starter bundle, then re-run `sechroom setup agent-files`" });
+        actions.push({
+          kind: "instruction",
+          path: target.instruction.path,
+          status: "skipped",
+          note: "no role template found in this tenant \u2014 install the SEM Starter bundle, then re-run `sechroom setup agent-files`"
+        });
       } else {
         const action = applyBlock(
           target.instruction.path,
-          { block: "role-template", body: resolved.body, source: resolved.sourceRef },
+          {
+            block: "role-template",
+            body: resolved.body,
+            source: resolved.sourceRef
+          },
           mode,
           opts.dryRun
         );
-        actions.push(resolved.source === "override" && action.status !== "current" ? { ...action, note: action.note ?? "your personal copy" } : action);
+        actions.push(
+          resolved.source === "override" && action.status !== "current" ? { ...action, note: action.note ?? "your personal copy" } : action
+        );
       }
     }
-    const conventionsSection = findSection(surface, SectionType.WorkspaceConventions);
+    const conventionsSection = findSection(
+      surface,
+      SectionType.WorkspaceConventions
+    );
     if (conventionsSection) {
       const conventions = await withSpinner(
         `Composing ${target.label} workspace conventions`,
@@ -10885,11 +11502,20 @@ async function applyClient(cfg, setup, target, opts) {
       if (conventions) {
         const action = applyBlock(
           target.instruction.path,
-          { block: "workspace-conventions", body: conventions.body, source: `workspace:${cfg.workspaceId ?? ""}` },
+          {
+            block: "workspace-conventions",
+            body: conventions.body,
+            source: `workspace:${cfg.workspaceId ?? ""}`
+          },
           mode,
           opts.dryRun
         );
-        actions.push(action.status === "current" ? action : { ...action, note: action.note ?? `workspace conventions (${conventions.refs.length})` });
+        actions.push(
+          action.status === "current" ? action : {
+            ...action,
+            note: action.note ?? `workspace conventions (${conventions.refs.length})`
+          }
+        );
       }
     }
   }
@@ -11107,7 +11733,12 @@ function buildConventionDraft(title, rawKind, rawBody) {
 
 ${body}
 `,
-    tags: ["agent-setup-bundle", "scope:sechroom", `kind:${kind}`, "archetype:document"]
+    tags: [
+      "agent-setup-bundle",
+      "scope:sechroom",
+      `kind:${kind}`,
+      "archetype:document"
+    ]
   };
 }
 function copyChoice(opts) {
@@ -11120,9 +11751,16 @@ async function maybeOfferCopies(cfg, setup, targets, keys, personalWorkspaceId,
     const instr = targets[key]?.instruction;
     if (!instr || seen.has(instr.surfaceKey)) continue;
     seen.add(instr.surfaceKey);
-    const section = findSection(findSurface(setup, instr.surfaceKey), SectionType.InstructionFile);
+    const section = findSection(
+      findSurface(setup, instr.surfaceKey),
+      SectionType.InstructionFile
+    );
     if (!section) continue;
-    const resolved = await resolveInstruction(cfg, section, personalWorkspaceId);
+    const resolved = await resolveInstruction(
+      cfg,
+      section,
+      personalWorkspaceId
+    );
     if (!resolved || resolved.source === "override") continue;
     let make = choice === "yes";
     if (choice === "ask") {
@@ -11137,8 +11775,10 @@ version, the shared template stays clean, and you can discard back anytime.
     }
     if (make) {
       await createOverride(cfg, resolved, personalWorkspaceId);
-      process.stderr.write(`\u2713 personal copy created for ${instr.surfaceKey} \u2014 edit it on the Agent setup page or via the API.
-`);
+      process.stderr.write(
+        `\u2713 personal copy created for ${instr.surfaceKey} \u2014 edit it on the Agent setup page or via the API.
+`
+      );
     }
   }
 }
@@ -11148,7 +11788,9 @@ function resolveClientKeys(raw) {
   if (tokens.includes("all")) return [...ALL_CLIENT_KEYS];
   for (const k of tokens) {
     if (!targets[k]) {
-      fail(`unknown client '${k}'. Known: ${ALL_CLIENT_KEYS.join(", ")}, or 'all'.`);
+      fail(
+        `unknown client '${k}'. Known: ${ALL_CLIENT_KEYS.join(", ")}, or 'all'.`
+      );
     }
   }
   return [...new Set(tokens)];
@@ -11159,8 +11801,10 @@ ${client.label} (${client.key}):
 `);
   for (const a of actions) {
     const tag = a.status === "skipped" ? "skip" : a.status;
-    process.stdout.write(`  [${tag}] ${a.kind}: ${a.path}${a.note ? ` \u2014 ${a.note}` : ""}
-`);
+    process.stdout.write(
+      `  [${tag}] ${a.kind}: ${a.path}${a.note ? ` \u2014 ${a.note}` : ""}
+`
+    );
   }
 }
 function resolveEvalMode(opts) {
@@ -11234,8 +11878,10 @@ function summarizeEval(result, mode, json, dryRun) {
   const { eval: counts } = buildCheckReport(result);
   if (json) return;
   if (!dryRun && counts.stale) {
-    process.stderr.write(`\u21BB refreshed ${counts.stale} section(s) the server had moved
-`);
+    process.stderr.write(
+      `\u21BB refreshed ${counts.stale} section(s) the server had moved
+`
+    );
   }
   if (!dryRun && counts.drift) {
     process.stderr.write(
@@ -11266,7 +11912,39 @@ async function resolveNamespaceChoice(cfg, flag) {
   return picked === GLOBAL_NAMESPACE ? null : picked;
 }
 function registerInit(program2) {
-  program2.command("init").description("Wire this project for sechroom: write MCP config + agent instruction files from the server's setup descriptors").option("--client <list...>", `clients to wire \u2014 space- or comma-separated (${ALL_CLIENT_KEYS.join(", ")}) or 'all'`, DEFAULT_CLIENT_KEY).option("--scope <scope>", "install skills/agents/hooks 'global' (config dir / CLAUDE_CONFIG_DIR) or 'project' (<cwd>/.claude) \u2014 default global", "global").option("--dry-run", "print what would be written without writing", false).option("--mcp-only", "only write MCP config (skip agent files)", false).option("--agent-files-only", "only write agent instruction files (skip MCP config)", false).option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--namespace <slug>", "MCP namespace for the connection URL (interactive picker if omitted on a TTY; defaults to tenant-global)").option("--refresh", "refresh out-of-date agent-file blocks in place (local edits preserved to .proposed)", false).option("--force", "rewrite agent-file managed blocks, overwriting local edits inside the markers", false).option("--check", "report whether agent files would change and exit (0 = current/stub, 1 = stale/drift/absent); writes nothing", false).addHelpText(
+  program2.command("init").description(
+    "Wire this project for sechroom: write MCP config + agent instruction files from the server's setup descriptors"
+  ).option(
+    "--client <list...>",
+    `clients to wire \u2014 space- or comma-separated (${ALL_CLIENT_KEYS.join(", ")}) or 'all'`,
+    DEFAULT_CLIENT_KEY
+  ).option(
+    "--scope <scope>",
+    "install skills/agents/hooks 'global' (config dir / CLAUDE_CONFIG_DIR) or 'project' (<cwd>/.claude) \u2014 default global",
+    "global"
+  ).option("--dry-run", "print what would be written without writing", false).option("--mcp-only", "only write MCP config (skip agent files)", false).option(
+    "--agent-files-only",
+    "only write agent instruction files (skip MCP config)",
+    false
+  ).option(
+    "--copy",
+    "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)"
+  ).option(
+    "--namespace <slug>",
+    "MCP namespace for the connection URL (interactive picker if omitted on a TTY; defaults to tenant-global)"
+  ).option(
+    "--refresh",
+    "refresh out-of-date agent-file blocks in place (local edits preserved to .proposed)",
+    false
+  ).option(
+    "--force",
+    "rewrite agent-file managed blocks, overwriting local edits inside the markers",
+    false
+  ).option(
+    "--check",
+    "report whether agent files would change and exit (0 = current/stub, 1 = stale/drift/absent); writes nothing",
+    false
+  ).addHelpText(
     "after",
     `
 Examples:
@@ -11281,7 +11959,9 @@ Examples:
     const mode = resolveEvalMode(opts);
     const check = mode === "check";
     if (check && opts.mcpOnly) {
-      fail("--check inspects agent files and cannot be combined with --mcp-only.");
+      fail(
+        "--check inspects agent files and cannot be combined with --mcp-only."
+      );
     }
     const namespaceSlug = await resolveNamespaceChoice(cfg, opts.namespace);
     const setup = await withSpinner(
@@ -11295,14 +11975,28 @@ Examples:
     } catch (err2) {
       return fail(err2.message);
     }
-    const claudeTargets = resolveClaudeTargets({ override: g.claudeConfigDir, scope, cwd: process.cwd() });
+    const claudeTargets = resolveClaudeTargets({
+      override: g.claudeConfigDir,
+      scope,
+      cwd: process.cwd()
+    });
     const codexHomes = resolveCodexHomes({ override: g.codexHome, scope });
-    const targets = clientTargets(process.cwd(), { claudeDir: claudeTargets[0]?.dir, codexHome: codexHomes[0] });
+    const targets = clientTargets(process.cwd(), {
+      claudeDir: claudeTargets[0]?.dir,
+      codexHome: codexHomes[0] ?? null
+    });
     const keys = resolveClientKeys(opts.client);
     const json = g.json;
     const personalWorkspaceId = await getPersonalWorkspaceId(cfg);
     if (!opts.dryRun && !opts.mcpOnly && !check) {
-      await maybeOfferCopies(cfg, setup, targets, keys, personalWorkspaceId, copyChoice(opts));
+      await maybeOfferCopies(
+        cfg,
+        setup,
+        targets,
+        keys,
+        personalWorkspaceId,
+        copyChoice(opts)
+      );
     }
     const result = [];
     for (const key of keys) {
@@ -11320,18 +12014,33 @@ Examples:
     summarizeEval(result, mode, Boolean(json), Boolean(opts.dryRun));
     if (!json && !opts.dryRun && !opts.mcpOnly && !check) {
       for (const t of claudeTargets) {
-        await maybeOfferSkills(cfg, personalWorkspaceId, { yes: false, dryRun: Boolean(opts.dryRun), surface: "claude-code", configDir: t.dir });
+        await maybeOfferSkills(cfg, personalWorkspaceId, {
+          yes: false,
+          dryRun: Boolean(opts.dryRun),
+          surface: "claude-code",
+          configDir: t.dir
+        });
       }
     }
     if (!json && !opts.dryRun && !opts.mcpOnly && !check) {
-      await maybeOfferHooks({ yes: false, dryRun: Boolean(opts.dryRun), cwd: process.cwd(), scope, claudeConfigDir: g.claudeConfigDir, codexHome: g.codexHome });
+      await maybeOfferHooks({
+        yes: false,
+        dryRun: Boolean(opts.dryRun),
+        cwd: process.cwd(),
+        scope,
+        claudeConfigDir: g.claudeConfigDir,
+        codexHome: g.codexHome
+      });
     }
     if (json) {
       emit({ dryRun: Boolean(opts.dryRun), clients: result }, true);
       return;
     }
     const first = targets[keys[0]];
-    const surface = findSurface(setup, first.mcp?.surfaceKey ?? first.instruction?.surfaceKey ?? "");
+    const surface = findSurface(
+      setup,
+      first.mcp?.surfaceKey ?? first.instruction?.surfaceKey ?? ""
+    );
     const verify = findSection(surface, SectionType.Verify);
     if (verify?.description) {
       process.stdout.write(`
@@ -11345,13 +12054,64 @@ Next \u2014 verify: ${verify.description}
 }
 function registerSetup(program2, deps = {}) {
   const setup = program2.command("setup").description("Granular onboarding steps (init runs these together)");
-  setup.command("mcp <clients...>").description(`Write only the MCP config for one or more clients (${ALL_CLIENT_KEYS.join(", ")}, or 'all')`).option("--dry-run", "print what would be written without writing", false).option("--namespace <slug>", "MCP namespace for the connection URL (interactive picker if omitted on a TTY; defaults to tenant-global)").addHelpText("after", "\nExamples:\n  $ sechroom setup mcp codex\n  $ sechroom setup mcp claude-code codex\n  $ sechroom setup mcp all").action(async (clients, opts, cmd) => {
-    await runClients(clients, cmd, { dryRun: Boolean(opts.dryRun), mcp: true, agentFiles: false, namespace: opts.namespace });
-  });
-  setup.command("agent-files <clients...>").description(`Write only the agent instruction file(s) for one or more clients (${ALL_CLIENT_KEYS.join(", ")}, or 'all')`).option("--dry-run", "print what would be written without writing", false).option("--copy", "make a personal copy you can edit (default: prompt on a TTY, else skip)").option("--refresh", "refresh out-of-date blocks in place (local edits preserved to .proposed)", false).option("--force", "rewrite managed blocks, overwriting local edits inside the markers", false).option("--check", "report whether anything would change and exit (0 = current/stub, 1 = stale/drift/absent); writes nothing", false).addHelpText("after", "\nExamples:\n  $ sechroom setup agent-files claude-code        CLAUDE.md\n  $ sechroom setup agent-files claude-code codex  CLAUDE.md + AGENTS.md in one run\n  $ sechroom setup agent-files all --check        CI gate: nonzero exit if out of date\n  $ sechroom setup agent-files claude-code --force   overwrite local edits in the managed block").action(async (clients, opts, cmd) => {
-    await runClients(clients, cmd, { dryRun: Boolean(opts.dryRun), mcp: false, agentFiles: true, copy: opts.copy, mode: resolveEvalMode(opts) });
+  setup.command("mcp <clients...>").description(
+    `Write only the MCP config for one or more clients (${ALL_CLIENT_KEYS.join(", ")}, or 'all')`
+  ).option("--dry-run", "print what would be written without writing", false).option(
+    "--namespace <slug>",
+    "MCP namespace for the connection URL (interactive picker if omitted on a TTY; defaults to tenant-global)"
+  ).addHelpText(
+    "after",
+    "\nExamples:\n  $ sechroom setup mcp codex\n  $ sechroom setup mcp claude-code codex\n  $ sechroom setup mcp all"
+  ).action(async (clients, opts, cmd) => {
+    await runClients(clients, cmd, {
+      dryRun: Boolean(opts.dryRun),
+      mcp: true,
+      agentFiles: false,
+      namespace: opts.namespace
+    });
+  });
+  setup.command("agent-files <clients...>").description(
+    `Write only the agent instruction file(s) for one or more clients (${ALL_CLIENT_KEYS.join(", ")}, or 'all')`
+  ).option("--dry-run", "print what would be written without writing", false).option(
+    "--copy",
+    "make a personal copy you can edit (default: prompt on a TTY, else skip)"
+  ).option(
+    "--refresh",
+    "refresh out-of-date blocks in place (local edits preserved to .proposed)",
+    false
+  ).option(
+    "--force",
+    "rewrite managed blocks, overwriting local edits inside the markers",
+    false
+  ).option(
+    "--check",
+    "report whether anything would change and exit (0 = current/stub, 1 = stale/drift/absent); writes nothing",
+    false
+  ).addHelpText(
+    "after",
+    "\nExamples:\n  $ sechroom setup agent-files claude-code        CLAUDE.md\n  $ sechroom setup agent-files claude-code codex  CLAUDE.md + AGENTS.md in one run\n  $ sechroom setup agent-files all --check        CI gate: nonzero exit if out of date\n  $ sechroom setup agent-files claude-code --force   overwrite local edits in the managed block"
+  ).action(async (clients, opts, cmd) => {
+    await runClients(clients, cmd, {
+      dryRun: Boolean(opts.dryRun),
+      mcp: false,
+      agentFiles: true,
+      copy: opts.copy,
+      mode: resolveEvalMode(opts)
+    });
   });
-  setup.command("new-convention <title...>").description("Scaffold a workspace-conventions section: author a correctly-tagged memo (header as first body line) + regen the agent files").option("--kind <kind>", "reference | standard (orders the section; reference first)", "reference").option("--workspace <id>", "workspace to author in (default: the bound workspace)").option("--body <markdown>", "section body (default: a TODO scaffold to edit later)").option("--no-regen", "skip the agent-files regen after authoring").option("--dry-run", "print what would be authored; write nothing", false).addHelpText(
+  setup.command("new-convention <title...>").description(
+    "Scaffold a workspace-conventions section: author a correctly-tagged memo (header as first body line) + regen the agent files"
+  ).option(
+    "--kind <kind>",
+    "reference | standard (orders the section; reference first)",
+    "reference"
+  ).option(
+    "--workspace <id>",
+    "workspace to author in (default: the bound workspace)"
+  ).option(
+    "--body <markdown>",
+    "section body (default: a TODO scaffold to edit later)"
+  ).option("--no-regen", "skip the agent-files regen after authoring").option("--dry-run", "print what would be authored; write nothing", false).addHelpText(
     "after",
     `
 The memo carries the two conventions a workspace-conventions section needs (FR-sechroom-236):
@@ -11367,10 +12127,15 @@ Examples:
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const json = Boolean(cmd.optsWithGlobals().json);
     const title = titleParts.join(" ").trim();
-    if (!title) fail('a section title is required, e.g. `sechroom setup new-convention "Deploy runbook"`.');
+    if (!title)
+      fail(
+        'a section title is required, e.g. `sechroom setup new-convention "Deploy runbook"`.'
+      );
     const workspaceId = opts.workspace ?? cfg.workspaceId;
     if (!workspaceId)
-      fail("no workspace \u2014 pass --workspace <id> or bind one (`sechroom config set --local workspaceId <id>`).");
+      fail(
+        "no workspace \u2014 pass --workspace <id> or bind one (`sechroom config set --local workspaceId <id>`)."
+      );
     const draft = buildConventionDraft(title, opts.kind, opts.body);
     if (opts.dryRun) {
       emit(
@@ -11411,7 +12176,10 @@ Examples:
     }
     if (opts.regen === false) {
       if (json) emit({ id: data.id, workspaceId, regen: false }, true);
-      else process.stdout.write("Skipped regen (--no-regen). Run `sechroom setup agent-files all` to apply.\n");
+      else
+        process.stdout.write(
+          "Skipped regen (--no-regen). Run `sechroom setup agent-files all` to apply.\n"
+        );
       return;
     }
     const regenerate = deps.regenerateConvention ?? runClients;
@@ -11440,7 +12208,14 @@ async function runClients(clients, cmd, opts) {
   );
   const personalWorkspaceId = await getPersonalWorkspaceId(cfg);
   if (opts.agentFiles && !opts.dryRun && !check) {
-    await maybeOfferCopies(cfg, setupData, targets, keys, personalWorkspaceId, copyChoice(opts));
+    await maybeOfferCopies(
+      cfg,
+      setupData,
+      targets,
+      keys,
+      personalWorkspaceId,
+      copyChoice(opts)
+    );
   }
   const json = g.json;
   const result = [];
@@ -11461,7 +12236,9 @@ async function runClients(clients, cmd, opts) {
     emit({ dryRun: opts.dryRun, clients: result }, true);
     return;
   }
-  process.stdout.write(opts.dryRun ? "\n(dry run \u2014 nothing written)\n" : "\nDone.\n");
+  process.stdout.write(
+    opts.dryRun ? "\n(dry run \u2014 nothing written)\n" : "\nDone.\n"
+  );
 }
 
 // src/commands/namespace.ts
@@ -11537,7 +12314,7 @@ import { basename as basename5, join as join21 } from "path";
 
 // src/commands/fanout.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync14, readFileSync as readFileSync17, readdirSync as readdirSync4, statSync as statSync5 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync17, readdirSync as readdirSync4, statSync as statSync6 } from "fs";
 import { isAbsolute as isAbsolute3, join as join20, resolve as resolve7 } from "path";
 var ICON = {
   refresh: "\u21BB",
@@ -11560,7 +12337,7 @@ function discoverChildren(root) {
     if (name.startsWith(".") || name === "node_modules") continue;
     const dir = join20(root, name);
     try {
-      if (!statSync5(dir).isDirectory()) continue;
+      if (!statSync6(dir).isDirectory()) continue;
     } catch {
       continue;
     }
@@ -11686,20 +12463,27 @@ function resolveBaseUrl(g) {
   return baseUrl.replace(/\/$/, "");
 }
 async function fetchWorkspaces(client) {
-  const { data, error } = await client.GET("/workspaces", { params: { query: { includeArchived: false } } });
-  if (error) throw new Error(`Couldn't list your workspaces: ${JSON.stringify(error)}`);
+  const { data, error } = await client.GET("/workspaces", {
+    params: { query: { includeArchived: false } }
+  });
+  if (error)
+    throw new Error(`Couldn't list your workspaces: ${JSON.stringify(error)}`);
   const rows = data ?? [];
   return rows.map((r) => r.item ?? r).filter((w) => Boolean(w?.id && w?.name)).map((w) => ({ id: w.id, name: w.name, parentId: w.parentId ?? null }));
 }
 async function lookupWorkspace(client, id) {
-  const { data, error } = await client.GET("/workspaces/{workspaceId}", { params: { path: { workspaceId: id } } });
+  const { data, error } = await client.GET("/workspaces/{workspaceId}", {
+    params: { path: { workspaceId: id } }
+  });
   if (error) return null;
   const env = data;
   const w = env?.item ?? env;
   return w?.id ? { id: w.id, name: w.name ?? id, parentId: w.parentId ?? null } : null;
 }
 async function warnIfProjectStray(client, projectId, workspaceId, json) {
-  const { data, error } = await client.GET("/projects/{projectId}", { params: { path: { projectId } } });
+  const { data, error } = await client.GET("/projects/{projectId}", {
+    params: { path: { projectId } }
+  });
   if (error) return;
   const env = data;
   const owner = env?.item?.workspaceId;
@@ -11743,10 +12527,15 @@ function personalSubtreeIds(personalId, all) {
 async function pickWorkspace(client, opts = {}) {
   const promptLabel = opts.promptLabel ?? "Bind this directory to a workspace:";
   const dirName = opts.dirName ?? basename5(process.cwd());
-  const all = await withSpinner("Listing your workspaces", () => fetchWorkspaces(client));
+  const all = await withSpinner(
+    "Listing your workspaces",
+    () => fetchWorkspaces(client)
+  );
   if (all.length === 0) {
-    process.stderr.write(`no workspaces found \u2014 skipping workspace binding (you can set it later with \`sechroom config set --local workspaceId <id>\`)
-`);
+    process.stderr.write(
+      `no workspaces found \u2014 skipping workspace binding (you can set it later with \`sechroom config set --local workspaceId <id>\`)
+`
+    );
     return void 0;
   }
   const byId = new Map(all.map((w) => [w.id, w]));
@@ -11761,19 +12550,35 @@ async function pickWorkspace(client, opts = {}) {
   const matched = candidates.filter(isMatch).sort(byPath);
   const rest = candidates.filter((w) => !isMatch(w)).sort(byPath);
   const choices = [
-    ...matched.map((w) => ({ label: workspacePath(w, byId), value: w.id, hint: style.dim(`matches "${dirName}"`) })),
-    ...rest.map((w) => ({ label: workspacePath(w, byId), value: w.id, hint: w.id })),
-    { label: style.dim("skip \u2014 don't bind a workspace"), value: SKIP, hint: void 0 }
+    ...matched.map((w) => ({
+      label: workspacePath(w, byId),
+      value: w.id,
+      hint: style.dim(`matches "${dirName}"`)
+    })),
+    ...rest.map((w) => ({
+      label: workspacePath(w, byId),
+      value: w.id,
+      hint: w.id
+    })),
+    {
+      label: style.dim("skip \u2014 don't bind a workspace"),
+      value: SKIP,
+      hint: void 0
+    }
   ];
   const defaultValue = matched.length === 1 ? matched[0].id : SKIP;
   const chosen = candidates.length > 12 ? await promptAutocomplete(promptLabel, choices, defaultValue) : await promptSelect(promptLabel, choices, defaultValue);
   if (chosen === SKIP) return void 0;
   const picked = byId.get(chosen);
-  const collisions = all.filter((w) => w.id !== picked.id && namesCollide(w.name, picked.name));
+  const collisions = all.filter(
+    (w) => w.id !== picked.id && namesCollide(w.name, picked.name)
+  );
   if (collisions.length > 0) {
     process.stderr.write(
       `${warn("\u26A0")} ${collisions.length} other workspace(s) have a similar name to ${style.cyan(workspacePath(picked, byId))}:
-` + collisions.map((w) => `    ${style.dim(workspacePath(w, byId))} ${style.dim(`(${w.id})`)}`).join("\n") + `
+` + collisions.map(
+        (w) => `    ${style.dim(workspacePath(w, byId))} ${style.dim(`(${w.id})`)}`
+      ).join("\n") + `
     You picked ${style.dim(picked.id)} \u2014 re-run \`sechroom config set --local workspaceId <id>\` if that's wrong.
 `
     );
@@ -11800,10 +12605,17 @@ async function ensureTenant(baseUrl, g, opts) {
   const local = readLocalConfig();
   let tenant = g.tenant ?? process.env.SECHROOM_TENANT ?? local.tenant ?? persisted.tenant ?? "";
   if (!tenant) {
-    const client = await makeClient({ baseUrl, tenant: "", account: resolveAccountAlias(), clientId: persisted.clientId });
+    const client = await makeClient({
+      baseUrl,
+      tenant: "",
+      account: resolveAccountAlias(),
+      clientId: persisted.clientId
+    });
     const { data, error } = await client.GET("/auth/me/tenants", {});
     if (error) {
-      fail(`Couldn't list your tenants: ${JSON.stringify(error)}. Pass --tenant <id> to skip this.`);
+      fail(
+        `Couldn't list your tenants: ${JSON.stringify(error)}. Pass --tenant <id> to skip this.`
+      );
     }
     const tenants = data?.tenants ?? [];
     if (tenants.length === 0) {
@@ -11835,21 +12647,44 @@ async function ensureTenant(baseUrl, g, opts) {
     }
   }
   const existingWorkspace = local.workspaceId ?? persisted.workspaceId ?? void 0;
-  const wsClient = await makeClient({ baseUrl, tenant, account: resolveAccountAlias(), clientId: persisted.clientId });
-  const workspaceId = await resolveWorkspaceBinding(wsClient, existingWorkspace, {
-    yes: opts.yes,
-    json: opts.json,
-    workspace: opts.workspace
+  const wsClient = await makeClient({
+    baseUrl,
+    tenant,
+    account: resolveAccountAlias(),
+    clientId: persisted.clientId
   });
+  const workspaceId = await resolveWorkspaceBinding(
+    wsClient,
+    existingWorkspace,
+    {
+      yes: opts.yes,
+      json: opts.json,
+      workspace: opts.workspace
+    }
+  );
   const defaultProjectId = local.defaultProjectId ?? persisted.defaultProjectId ?? void 0;
-  if (defaultProjectId && workspaceId) await warnIfProjectStray(wsClient, defaultProjectId, workspaceId, opts.json);
+  if (defaultProjectId && workspaceId)
+    await warnIfProjectStray(
+      wsClient,
+      defaultProjectId,
+      workspaceId,
+      opts.json
+    );
   let storeLocal = Boolean(opts.local);
   if (!opts.local && canPrompt() && !opts.yes) {
     storeLocal = await promptSelect(
       "Where should this tenant + base URL be saved?",
       [
-        { label: "Globally", value: "global", hint: "all projects on this machine" },
-        { label: "This directory", value: "local", hint: ".sechroom.json \u2014 committed, project + subdirs" }
+        {
+          label: "Globally",
+          value: "global",
+          hint: "all projects on this machine"
+        },
+        {
+          label: "This directory",
+          value: "local",
+          hint: ".sechroom.json \u2014 committed, project + subdirs"
+        }
       ],
       local.path ? "local" : "global"
     ) === "local";
@@ -11858,19 +12693,34 @@ async function ensureTenant(baseUrl, g, opts) {
     const patch = { baseUrl, tenant, ...workspaceId ? { workspaceId } : {} };
     if (storeLocal) {
       const path = writeLocalConfig(patch, { here: Boolean(opts.here) });
-      if (!opts.json) process.stderr.write(`${ok("\u2713")} config saved to ${path} (directory-local)
-`);
+      if (!opts.json)
+        process.stderr.write(
+          `${ok("\u2713")} config saved to ${path} (directory-local)
+`
+        );
     } else {
       writePersisted(patch);
-      if (!opts.json) process.stderr.write(`${ok("\u2713")} config saved globally (~/.config/sechroom/config.json)
-`);
+      if (!opts.json)
+        process.stderr.write(
+          `${ok("\u2713")} config saved globally (~/.config/sechroom/config.json)
+`
+        );
     }
     if (workspaceId && !existingWorkspace && !opts.json) {
-      process.stderr.write(`${ok("\u2713")} bound to workspace ${style.dim(workspaceId)}
-`);
+      process.stderr.write(
+        `${ok("\u2713")} bound to workspace ${style.dim(workspaceId)}
+`
+      );
     }
   }
-  return { baseUrl, tenant, account: resolveAccountAlias(), workspaceId, defaultProjectId, clientId: persisted.clientId };
+  return {
+    baseUrl,
+    tenant,
+    account: resolveAccountAlias(),
+    workspaceId,
+    defaultProjectId,
+    clientId: persisted.clientId
+  };
 }
 async function ensureAuth(cfg, yes) {
   if (process.env.SECHROOM_TOKEN) return;
@@ -11878,17 +12728,27 @@ async function ensureAuth(cfg, yes) {
   const usable = Boolean(cached?.accessToken) && (cached.expiresAt === void 0 || Date.now() < cached.expiresAt - 6e4 || Boolean(cached.refreshToken));
   if (usable) return;
   if (!canPrompt() || yes) {
-    fail("Not signed in. Run `sechroom login` first, or set SECHROOM_TOKEN for headless use.");
+    fail(
+      "Not signed in. Run `sechroom login` first, or set SECHROOM_TOKEN for headless use."
+    );
   }
-  process.stderr.write("\nNot signed in \u2014 opening the browser to authenticate.\n");
+  process.stderr.write(
+    "\nNot signed in \u2014 opening the browser to authenticate.\n"
+  );
   await login(cfg);
 }
 async function ensureTimezone(cfg, opts) {
   const client = await makeClient(cfg);
   const { data, error } = await client.GET("/me/profile", {});
-  if (error) return { timezone: null, action: "skipped", note: "could not read profile" };
+  if (error)
+    return {
+      timezone: null,
+      action: "skipped",
+      note: "could not read profile"
+    };
   const current = data?.effectiveTimezone;
-  if (current && current.trim().length > 0) return { timezone: current, action: "already-set" };
+  if (current && current.trim().length > 0)
+    return { timezone: current, action: "already-set" };
   const system = systemTimezone();
   let tz = system;
   if (canPrompt() && !opts.yes) {
@@ -11900,12 +12760,18 @@ async function ensureTimezone(cfg, opts) {
       note: "no timezone set \u2014 re-run interactively or pass --yes to adopt the system timezone"
     };
   }
-  if (!tz) return { timezone: null, action: "skipped", note: "no timezone provided" };
+  if (!tz)
+    return { timezone: null, action: "skipped", note: "no timezone provided" };
   if (opts.dryRun) return { timezone: tz, action: "dry-run" };
   const { error: putErr } = await client.PUT("/me/profile", {
     body: { displayName: null, photoUrl: null, bio: null, timezone: tz }
   });
-  if (putErr) return { timezone: tz, action: "skipped", note: `update failed: ${JSON.stringify(putErr)}` };
+  if (putErr)
+    return {
+      timezone: tz,
+      action: "skipped",
+      note: `update failed: ${JSON.stringify(putErr)}`
+    };
   return { timezone: tz, action: "set" };
 }
 async function chooseClients(clientFlag, yes, cwd) {
@@ -11930,7 +12796,11 @@ async function chooseScope(scopeFlag, yes) {
   return promptSelect(
     "Install skills, agents, and hooks globally or just for this project?",
     [
-      { label: "Globally", value: "global", hint: "~/.claude (or CLAUDE_CONFIG_DIR) \u2014 all projects" },
+      {
+        label: "Globally",
+        value: "global",
+        hint: "~/.claude (or CLAUDE_CONFIG_DIR) \u2014 all projects"
+      },
       { label: "This project", value: "project", hint: "<repo>/.claude" }
     ],
     "global"
@@ -11939,7 +12809,13 @@ async function chooseScope(scopeFlag, yes) {
 async function planRecurseChild(entry, root, client, opts) {
   const dir = resolveChildDir(entry.path, root);
   if (!existsSync15(dir)) {
-    return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
+    return {
+      label: entry.path,
+      dir,
+      disposition: "skip-missing",
+      argv: [],
+      reason: "directory does not exist"
+    };
   }
   if (existsSync15(join21(dir, ".sechroom.json"))) {
     return {
@@ -11960,20 +12836,40 @@ async function planRecurseChild(entry, root, client, opts) {
     };
   }
   if (opts.dryRun) {
-    return { label: entry.path, dir, disposition: "bind", argv: ["onboard", "--yes", "--local", "--workspace", "<prompt>"], reason: "unbound \u2014 would prompt for a workspace" };
+    return {
+      label: entry.path,
+      dir,
+      disposition: "bind",
+      argv: ["onboard", "--yes", "--local", "--workspace", "<prompt>"],
+      reason: "unbound \u2014 would prompt for a workspace"
+    };
   }
   if (opts.yes || !canPrompt()) {
-    return { label: entry.path, dir, disposition: "skip-unbound", argv: [], reason: "unbound + no workspace (run interactively, or add it to ./.sechroom/repos.json)" };
+    return {
+      label: entry.path,
+      dir,
+      disposition: "skip-unbound",
+      argv: [],
+      reason: "unbound + no workspace (run interactively, or add it to ./.sechroom/repos.json)"
+    };
   }
-  process.stderr.write(`
+  process.stderr.write(
+    `
 ${style.bold(entry.path)} ${style.dim("is not bound yet.")}
-`);
+`
+  );
   const ws = await pickWorkspace(client, {
     promptLabel: `Bind ${style.cyan(entry.path)} to a workspace:`,
     dirName: basename5(entry.path)
   });
   if (!ws) {
-    return { label: entry.path, dir, disposition: "skip-unbound", argv: [], reason: "unbound \u2014 no workspace chosen (skipped)" };
+    return {
+      label: entry.path,
+      dir,
+      disposition: "skip-unbound",
+      argv: [],
+      reason: "unbound \u2014 no workspace chosen (skipped)"
+    };
   }
   return {
     label: entry.path,
@@ -11988,20 +12884,34 @@ async function resolveFanoutLane(cfg, opts) {
   let design = opts.designLane ?? process.env.SECHROOM_DESIGN_LANE;
   if (!code || !design) {
     const clients = detectInstalledClients(process.cwd());
-    const inferred = await inferLanes(cfg, clients.length ? clients : void 0);
+    const inferred = await inferLanes(
+      cfg,
+      clients.length ? clients : void 0
+    );
     code = code ?? inferred.code;
     design = design ?? inferred.design;
   }
   if (!opts.lane && !opts.yes && !opts.dryRun && canPrompt() && (code || design)) {
-    process.stderr.write(`
+    process.stderr.write(
+      `
 This fan-out will pin the same lane in every repo:
-`);
-    if (code) process.stderr.write(`  ${style.dim("code-lane")}   = ${style.cyan(code)}
-`);
-    if (design) process.stderr.write(`  ${style.dim("design-lane")} = ${style.cyan(design)}
-`);
+`
+    );
+    if (code)
+      process.stderr.write(
+        `  ${style.dim("code-lane")}   = ${style.cyan(code)}
+`
+      );
+    if (design)
+      process.stderr.write(
+        `  ${style.dim("design-lane")} = ${style.cyan(design)}
+`
+      );
     if (!await promptYesNo("Use this lane for all repos?")) {
-      code = await promptText("Code-lane id (blank = let each repo infer)?", code ?? "") || void 0;
+      code = await promptText(
+        "Code-lane id (blank = let each repo infer)?",
+        code ?? ""
+      ) || void 0;
       design = await promptText("Design-lane id (blank = skip)?", design ?? "") || void 0;
     }
   }
@@ -12019,30 +12929,112 @@ async function runRecurse(cfg, g, opts) {
   const entries = fromManifest ?? discoverChildren(root).map((path) => ({ path }));
   const sourceLabel = fromManifest ? `manifest ${manifestPath}` : `auto-discovered under ${root}`;
   if (entries.length === 0) {
-    if (json) process.stdout.write(JSON.stringify({ recurse: true, root, repos: [] }) + "\n");
-    else process.stderr.write(`${warn("\u26A0")} no child repos found ${fromManifest ? `in ${manifestPath}` : `under ${root}`} \u2014 nothing to do.
-`);
+    if (json)
+      process.stdout.write(
+        JSON.stringify({ recurse: true, root, repos: [] }) + "\n"
+      );
+    else
+      process.stderr.write(
+        `${warn("\u26A0")} no child repos found ${fromManifest ? `in ${manifestPath}` : `under ${root}`} \u2014 nothing to do.
+`
+      );
     return;
   }
   if (!json) {
-    process.stderr.write(`${style.bold("onboard --recurse")} ${style.dim(`(${entries.length} repo${entries.length === 1 ? "" : "s"} from ${sourceLabel})`)}
-`);
+    process.stderr.write(
+      `${style.bold("onboard --recurse")} ${style.dim(`(${entries.length} repo${entries.length === 1 ? "" : "s"} from ${sourceLabel})`)}
+`
+    );
   }
-  const lane = await resolveFanoutLane(cfg, { lane: opts.lane, designLane: opts.designLane, yes, dryRun });
-  if (!json && lane.code) process.stderr.write(`${ok("\u2713")} lane ${style.cyan(lane.code)}${lane.design ? ` ${style.dim(`/ ${lane.design}`)}` : ""} for every repo
-`);
+  const lane = await resolveFanoutLane(cfg, {
+    lane: opts.lane,
+    designLane: opts.designLane,
+    yes,
+    dryRun
+  });
+  if (!json && lane.code)
+    process.stderr.write(
+      `${ok("\u2713")} lane ${style.cyan(lane.code)}${lane.design ? ` ${style.dim(`/ ${lane.design}`)}` : ""} for every repo
+`
+    );
   const client = await makeClient(cfg);
   const plans = [];
-  for (const entry of entries) plans.push(await planRecurseChild(entry, root, client, { yes, dryRun }));
-  const results = runChildren(plans, { globals: passthroughGlobals(g), dryRun, json });
+  for (const entry of entries)
+    plans.push(await planRecurseChild(entry, root, client, { yes, dryRun }));
+  const results = runChildren(plans, {
+    globals: passthroughGlobals(g),
+    dryRun,
+    json
+  });
   if (json) {
-    process.stdout.write(JSON.stringify({ recurse: true, root, dryRun, repos: results }) + "\n");
+    process.stdout.write(
+      JSON.stringify({ recurse: true, root, dryRun, repos: results }) + "\n"
+    );
     return;
   }
   summarizeFanout(results, { dryRun });
 }
 function registerOnboard(program2) {
-  program2.command("onboard").description("Guided first-run setup: configure, sign in, set timezone, detect clients, and wire this project").option("--recurse", "orchestration-root mode: onboard every child repo under this dir (auto-discovered, or from ./.sechroom/repos.json) \u2014 refreshes bound repos, prompts a workspace per new one", false).option("--lane <id>", "set the code-lane (substrate source identity) explicitly instead of inferring it; with --recurse it's used for every child repo").option("--design-lane <id>", "set the design-lane explicitly (substrate-authoring identity); with --recurse applies to every child").option("--client <list...>", `clients to wire \u2014 space- or comma-separated (${ALL_CLIENT_KEYS.join(", ")}) or 'all' (default: auto-detected)`).option("--scope <scope>", "install skills/agents/hooks 'global' (config dir / CLAUDE_CONFIG_DIR) or 'project' (<cwd>/.claude) \u2014 default: prompt, else global").option("--local", "save the binding (tenant + base URL + workspace) to a committed .sechroom.json in this repo instead of the global config", false).option("--here", "with --local: write the binding at THIS directory even when a parent already carries one \u2014 binds a subtree (e.g. a monorepo's frontend/) to its own workspace", false).option("--workspace <id>", "bind this directory to a workspace (skips the interactive workspace pick)").option("--cli-only", "configure the CLI only \u2014 don't wire any AI client (no MCP config, no agent files)", false).option("--no-mcp", "skip the MCP server config (.mcp.json etc.); still write the agent instruction files").option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--dry-run", "walk through without writing files or changing the profile", false).option("--refresh", "re-fetch descriptors and refresh any out-of-date managed blocks (local edits preserved to .proposed)", false).option("--force", "rewrite every managed block, overwriting local edits inside the markers (content outside untouched)", false).option("--check", "report whether anything would change and exit (0 = current/stub, 1 = stale/drift/absent); writes nothing", false).option("-y, --yes", "non-interactive: accept defaults (system timezone, detected clients, global config, full wire)", false).addHelpText(
+  program2.command("onboard").description(
+    "Guided first-run setup: configure, sign in, set timezone, detect clients, and wire this project"
+  ).option(
+    "--recurse",
+    "orchestration-root mode: onboard every child repo under this dir (auto-discovered, or from ./.sechroom/repos.json) \u2014 refreshes bound repos, prompts a workspace per new one",
+    false
+  ).option(
+    "--lane <id>",
+    "set the code-lane (substrate source identity) explicitly instead of inferring it; with --recurse it's used for every child repo"
+  ).option(
+    "--design-lane <id>",
+    "set the design-lane explicitly (substrate-authoring identity); with --recurse applies to every child"
+  ).option(
+    "--client <list...>",
+    `clients to wire \u2014 space- or comma-separated (${ALL_CLIENT_KEYS.join(", ")}) or 'all' (default: auto-detected)`
+  ).option(
+    "--scope <scope>",
+    "install skills/agents/hooks 'global' (config dir / CLAUDE_CONFIG_DIR) or 'project' (<cwd>/.claude) \u2014 default: prompt, else global"
+  ).option(
+    "--local",
+    "save the binding (tenant + base URL + workspace) to a committed .sechroom.json in this repo instead of the global config",
+    false
+  ).option(
+    "--here",
+    "with --local: write the binding at THIS directory even when a parent already carries one \u2014 binds a subtree (e.g. a monorepo's frontend/) to its own workspace",
+    false
+  ).option(
+    "--workspace <id>",
+    "bind this directory to a workspace (skips the interactive workspace pick)"
+  ).option(
+    "--cli-only",
+    "configure the CLI only \u2014 don't wire any AI client (no MCP config, no agent files)",
+    false
+  ).option(
+    "--no-mcp",
+    "skip the MCP server config (.mcp.json etc.); still write the agent instruction files"
+  ).option(
+    "--copy",
+    "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)"
+  ).option(
+    "--dry-run",
+    "walk through without writing files or changing the profile",
+    false
+  ).option(
+    "--refresh",
+    "re-fetch descriptors and refresh any out-of-date managed blocks (local edits preserved to .proposed)",
+    false
+  ).option(
+    "--force",
+    "rewrite every managed block, overwriting local edits inside the markers (content outside untouched)",
+    false
+  ).option(
+    "--check",
+    "report whether anything would change and exit (0 = current/stub, 1 = stale/drift/absent); writes nothing",
+    false
+  ).option(
+    "-y, --yes",
+    "non-interactive: accept defaults (system timezone, detected clients, global config, full wire)",
+    false
+  ).addHelpText(
     "after",
     `
 Examples:
@@ -12065,20 +13057,56 @@ Examples:
     const check = mode === "check";
     const yes = Boolean(opts.yes) || check;
     if (check && (opts.recurse || opts.cliOnly)) {
-      fail("--check inspects this project's agent files and cannot be combined with --recurse or --cli-only.");
+      fail(
+        "--check inspects this project's agent files and cannot be combined with --recurse or --cli-only."
+      );
     }
     if (opts.lane) process.env.SECHROOM_CODE_LANE = opts.lane;
     if (opts.designLane) process.env.SECHROOM_DESIGN_LANE = opts.designLane;
     if (opts.recurse) {
       const baseUrl2 = resolveBaseUrl(g);
-      await ensureAuth({ baseUrl: baseUrl2, tenant: "", account: resolveAccountAlias(), clientId: readPersisted().clientId }, yes);
-      const cfg2 = await ensureTenant(baseUrl2, g, { yes: true, json, persist: false });
-      await runRecurse(cfg2, g, { yes, dryRun, json, lane: opts.lane, designLane: opts.designLane });
+      await ensureAuth(
+        {
+          baseUrl: baseUrl2,
+          tenant: "",
+          account: resolveAccountAlias(),
+          clientId: readPersisted().clientId
+        },
+        yes
+      );
+      const cfg2 = await ensureTenant(baseUrl2, g, {
+        yes: true,
+        json,
+        persist: false
+      });
+      await runRecurse(cfg2, g, {
+        yes,
+        dryRun,
+        json,
+        lane: opts.lane,
+        designLane: opts.designLane
+      });
       return;
     }
     const baseUrl = resolveBaseUrl(g);
-    await ensureAuth({ baseUrl, tenant: "", account: resolveAccountAlias(), clientId: readPersisted().clientId }, yes);
-    const cfg = await ensureTenant(baseUrl, g, { yes, json, local: Boolean(opts.local), workspace: opts.workspace, persist: !check });
+    await ensureAuth(
+      {
+        baseUrl,
+        tenant: "",
+        account: resolveAccountAlias(),
+        clientId: readPersisted().clientId
+      },
+      yes
+    );
+    const scope = await chooseScope(opts.scope, yes);
+    const cfg = await ensureTenant(baseUrl, g, {
+      yes,
+      json,
+      local: Boolean(opts.local) || scope === "project",
+      here: scope === "project" ? true : Boolean(opts.here),
+      workspace: opts.workspace,
+      persist: !check
+    });
     const tz = await ensureTimezone(cfg, { yes, dryRun: dryRun || check });
     if (!json && tz.action !== "already-set") {
       const line = tz.action === "set" ? `${ok("\u2713")} timezone set to ${tz.timezone}
@@ -12088,21 +13116,48 @@ Examples:
       process.stderr.write(line);
     }
     const wire = await chooseWire(opts, yes);
-    const scope = await chooseScope(opts.scope, yes);
-    const claudeTargets = resolveClaudeTargets({ override: g.claudeConfigDir, scope, cwd: process.cwd() });
+    const claudeTargets = resolveClaudeTargets({
+      override: g.claudeConfigDir,
+      scope,
+      cwd: process.cwd()
+    });
     const codexHomes = resolveCodexHomes({ override: g.codexHome, scope });
     if (scope === "project" && g.claudeConfigDir && !json) {
-      process.stderr.write(`${style.dim("(--claude-config-dir is ignored for --scope project \u2014 project files are repo-relative)")}
-`);
+      process.stderr.write(
+        `${style.dim("(--claude-config-dir is ignored for --scope project \u2014 project files are repo-relative)")}
+`
+      );
     }
     if (wire === "cli-only") {
       if (json) {
-        emit({ dryRun, baseUrl: cfg.baseUrl, tenant: cfg.tenant, workspaceId: cfg.workspaceId ?? null, timezone: tz, wire, clients: [] }, true);
+        emit(
+          {
+            dryRun,
+            baseUrl: cfg.baseUrl,
+            tenant: cfg.tenant,
+            workspaceId: cfg.workspaceId ?? null,
+            timezone: tz,
+            wire,
+            clients: []
+          },
+          true
+        );
         return;
       }
       if (!dryRun) {
-        await ensureLanePin(cfg, { yes, dryRun, clients: detectInstalledClients(process.cwd()) });
-        await maybeOfferHooks({ yes, dryRun, cwd: process.cwd(), scope, claudeConfigDir: g.claudeConfigDir, codexHome: g.codexHome });
+        await ensureLanePin(cfg, {
+          yes,
+          dryRun,
+          clients: detectInstalledClients(process.cwd())
+        });
+        await maybeOfferHooks({
+          yes,
+          dryRun,
+          cwd: process.cwd(),
+          scope,
+          claudeConfigDir: g.claudeConfigDir,
+          codexHome: g.codexHome
+        });
       }
       process.stdout.write(
         `
@@ -12113,12 +13168,36 @@ Try: ${style.cyan('sechroom memory search "..."')}  or  ${style.cyan("sechroom -
       await printStarterPrompt("cli");
       return;
     }
-    const keys = await chooseClients(opts.client, yes, process.cwd());
-    const setup = await withSpinner("Fetching setup descriptors", () => fetchSetup(cfg));
-    const targets = clientTargets(process.cwd(), { claudeDir: claudeTargets[0]?.dir, codexHome: codexHomes[0] });
+    const requestedKeys = await chooseClients(
+      opts.client,
+      yes,
+      process.cwd()
+    );
+    const keys = scope === "project" ? requestedKeys.filter((key) => key !== "codex") : requestedKeys;
+    if (scope === "project" && requestedKeys.includes("codex") && !json) {
+      process.stderr.write(
+        `${style.dim("Codex has no project scope \u2014 skipped (use --scope global for Codex).")}
+`
+      );
+    }
+    const setup = await withSpinner(
+      "Fetching setup descriptors",
+      () => fetchSetup(cfg)
+    );
+    const targets = clientTargets(process.cwd(), {
+      claudeDir: claudeTargets[0]?.dir,
+      codexHome: codexHomes[0] ?? null
+    });
     const personalWorkspaceId = await getPersonalWorkspaceId(cfg);
     if (!dryRun && !check) {
-      await maybeOfferCopies(cfg, setup, targets, keys, personalWorkspaceId, copyChoice(opts));
+      await maybeOfferCopies(
+        cfg,
+        setup,
+        targets,
+        keys,
+        personalWorkspaceId,
+        copyChoice(opts)
+      );
     }
     const writeMcp = wire === "full";
     const result = [];
@@ -12135,16 +13214,11 @@ Try: ${style.cyan('sechroom memory search "..."')}  or  ${style.cyan("sechroom -
       if (!json && !check) printActions(target, actions);
     }
     if (check) {
-      reportCheckAndExit(
-        result,
-        json,
-        "sechroom onboard --refresh",
-        {
-          baseUrl: cfg.baseUrl,
-          tenant: cfg.tenant,
-          workspaceId: cfg.workspaceId ?? null
-        }
-      );
+      reportCheckAndExit(result, json, "sechroom onboard --refresh", {
+        baseUrl: cfg.baseUrl,
+        tenant: cfg.tenant,
+        workspaceId: cfg.workspaceId ?? null
+      });
     }
     const evalCounts = buildCheckReport(result).eval;
     if (!json && !dryRun) {
@@ -12152,19 +13226,45 @@ Try: ${style.cyan('sechroom memory search "..."')}  or  ${style.cyan("sechroom -
     }
     if (!json && !dryRun) {
       for (const t of claudeTargets) {
-        await maybeOfferSkills(cfg, personalWorkspaceId, { yes, dryRun, surface: "claude-code", configDir: t.dir });
+        await maybeOfferSkills(cfg, personalWorkspaceId, {
+          yes,
+          dryRun,
+          surface: "claude-code",
+          configDir: t.dir
+        });
       }
     }
     if (!json && !dryRun) {
-      await maybeOfferHooks({ yes, dryRun, cwd: process.cwd(), scope, claudeConfigDir: g.claudeConfigDir, codexHome: g.codexHome });
+      await maybeOfferHooks({
+        yes,
+        dryRun,
+        cwd: process.cwd(),
+        scope,
+        claudeConfigDir: g.claudeConfigDir,
+        codexHome: g.codexHome
+      });
     }
     if (json) {
-      emit({ dryRun, baseUrl: cfg.baseUrl, tenant: cfg.tenant, workspaceId: cfg.workspaceId ?? null, timezone: tz, wire, eval: evalCounts, clients: result }, true);
+      emit(
+        {
+          dryRun,
+          baseUrl: cfg.baseUrl,
+          tenant: cfg.tenant,
+          workspaceId: cfg.workspaceId ?? null,
+          timezone: tz,
+          wire,
+          eval: evalCounts,
+          clients: result
+        },
+        true
+      );
       return;
     }
     if (!dryRun && evalCounts.stale) {
-      process.stderr.write(`${style.cyan("\u21BB")} refreshed ${evalCounts.stale} section(s) the server had moved
-`);
+      process.stderr.write(
+        `${style.cyan("\u21BB")} refreshed ${evalCounts.stale} section(s) the server had moved
+`
+      );
     }
     if (!dryRun && evalCounts.drift) {
       process.stderr.write(
@@ -12173,7 +13273,9 @@ Try: ${style.cyan('sechroom memory search "..."')}  or  ${style.cyan("sechroom -
 `
       );
     }
-    const wroteSomething = result.some(({ actions }) => actions.some((a) => a.status === "created" || a.status === "merged"));
+    const wroteSomething = result.some(
+      ({ actions }) => actions.some((a) => a.status === "created" || a.status === "merged")
+    );
     process.stdout.write(
       dryRun ? "\n(dry run \u2014 nothing written)\n" : !wroteSomething ? `
 ${style.bold("Done.")} Everything's already up to date.
@@ -12192,9 +13294,21 @@ async function chooseWire(opts, yes) {
     return promptSelect(
       "How should I set up Sechroom in this project?",
       [
-        { label: "Wire my AI client", value: "full", hint: "MCP server (.mcp.json) + agent instructions" },
-        { label: "Agent instructions only", value: "agent-only", hint: "skip MCP config" },
-        { label: "CLI only", value: "cli-only", hint: "don't write any AI-client files" }
+        {
+          label: "Wire my AI client",
+          value: "full",
+          hint: "MCP server (.mcp.json) + agent instructions"
+        },
+        {
+          label: "Agent instructions only",
+          value: "agent-only",
+          hint: "skip MCP config"
+        },
+        {
+          label: "CLI only",
+          value: "cli-only",
+          hint: "don't write any AI-client files"
+        }
       ],
       "full"
     );
@@ -12216,7 +13330,9 @@ ${rule}
 }
 async function printStarterPrompt(mode, cfg) {
   if (mode === "cli") {
-    printNextStepBlock("Next \u2014 pick up where you left off:", [style.cyan("sechroom continuity resume-me")]);
+    printNextStepBlock("Next \u2014 pick up where you left off:", [
+      style.cyan("sechroom continuity resume-me")
+    ]);
     return;
   }
   let primary = FALLBACK_AGENT_PROMPT;
@@ -12228,7 +13344,9 @@ async function printStarterPrompt(mode, cfg) {
     } catch {
     }
   }
-  printNextStepBlock("Next \u2014 paste this into your AI agent to get going:", [style.cyan(`"${primary}"`)]);
+  printNextStepBlock("Next \u2014 paste this into your AI agent to get going:", [
+    style.cyan(`"${primary}"`)
+  ]);
 }
 
 // src/commands/project.ts
@@ -12543,7 +13661,7 @@ Examples:
 // src/commands/reset.ts
 import { homedir as homedir6 } from "os";
 import { join as join22 } from "path";
-import { existsSync as existsSync16, readFileSync as readFileSync18, rmSync as rmSync7 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync18, rmSync as rmSync8 } from "fs";
 var SKILLS_LOCK2 = ".sechroom-skills.json";
 var localSkillsDir = () => join22(process.cwd(), ".claude", "skills");
 var globalSkillsDir = () => join22(homedir6(), ".claude", "skills");
@@ -12559,14 +13677,14 @@ function removeMaterialisedSkills(dir) {
       for (const name of entry.skills ?? []) {
         const p = join22(dir, name);
         if (existsSync16(p)) {
-          rmSync7(p, { recursive: true, force: true });
+          rmSync8(p, { recursive: true, force: true });
           removed.push(p);
         }
       }
     }
   } catch {
   }
-  rmSync7(lockPath, { force: true });
+  rmSync8(lockPath, { force: true });
   removed.push(lockPath);
   return removed;
 }
@@ -12605,17 +13723,17 @@ function registerReset(program2) {
     const removed = [];
     const stateDir = join22(process.cwd(), ".sechroom");
     if (existsSync16(stateDir)) {
-      rmSync7(stateDir, { recursive: true, force: true });
+      rmSync8(stateDir, { recursive: true, force: true });
       removed.push(stateDir);
     }
     const legacyCfg = join22(process.cwd(), ".sechroom.json");
     if (existsSync16(legacyCfg)) {
-      rmSync7(legacyCfg, { force: true });
+      rmSync8(legacyCfg, { force: true });
       removed.push(legacyCfg);
     }
     const legacySem = join22(process.cwd(), ".sem");
     if (existsSync16(legacySem)) {
-      rmSync7(legacySem, { force: true });
+      rmSync8(legacySem, { force: true });
       removed.push(legacySem);
     }
     removed.push(...removeMaterialisedSkills(localSkillsDir()));
@@ -12640,7 +13758,7 @@ function registerReset(program2) {
 }
 
 // src/commands/skills.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync18, statSync as statSync6, writeFileSync as writeFileSync17 } from "fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync18, statSync as statSync7, writeFileSync as writeFileSync17 } from "fs";
 import { join as join23 } from "path";
 function filenameFromDisposition(header) {
   if (!header) return void 0;
@@ -12650,7 +13768,7 @@ function filenameFromDisposition(header) {
 function resolveOutputPath(output, serverFilename) {
   const filename = serverFilename || "skills.zip";
   if (!output) return join23(process.cwd(), filename);
-  const looksLikeDir = output.endsWith("/") || existsSync17(output) && statSync6(output).isDirectory();
+  const looksLikeDir = output.endsWith("/") || existsSync17(output) && statSync7(output).isDirectory();
   if (looksLikeDir) {
     mkdirSync18(output, { recursive: true });
     return join23(output, filename);