@sechroom/cli 2026.8.2 → 2026.8.3

package/dist/index.js

@@ -642,6 +642,17 @@ function emitAction(summary, data, json) {
   process.stdout.write(`${ok("\u2713")} ${summary}
 `);
 }
+var JSON_NUMBER = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?$/;
+function confidenceWireValue(value) {
+  if (value === null || value === void 0 || value === "") return null;
+  if (typeof value === "number") return Number.isFinite(value) ? value : String(value);
+  const raw = String(value).trim();
+  if (JSON_NUMBER.test(raw)) {
+    const numeric = Number(raw);
+    if (Number.isFinite(numeric)) return numeric;
+  }
+  return String(value);
+}
 var GOVERNANCE_QUEUED_PROBLEM_TYPE = "https://sechroom.dev/problems/governance-review-queued";
 function isGovernanceQueued(body) {
   return typeof body === "object" && body !== null && "type" in body && body.type === GOVERNANCE_QUEUED_PROBLEM_TYPE;
@@ -688,23 +699,57 @@ function formatFailureMessage(error) {
     if (error.cause instanceof Error && error.cause.message) {
       msg += `: ${error.cause.message}`;
     }
-  } else if (typeof error === "object" && error !== null && "title" in error) {
+  } else if (isRecord(error)) {
     const problem = error;
-    msg = String(problem.title);
-    if (problem.errors && typeof problem.errors === "object") {
-      const detail = Object.entries(problem.errors).flatMap(
-        ([field, msgs]) => (Array.isArray(msgs) ? msgs : [msgs]).map((m) => `  ${field}: ${String(m)}`)
-      );
-      if (detail.length > 0) msg += `
-${detail.join("\n")}`;
+    const title = typeof problem.title === "string" && problem.title.length > 0 ? problem.title : void 0;
+    const problemDetail = typeof problem.detail === "string" && problem.detail.length > 0 ? problem.detail : void 0;
+    const fieldErrors = formatProblemErrors(problem.errors);
+    const structuredErrors = fieldErrors.length === 0 ? formatStructuredViolations(problem.violations) : [];
+    const parts = [
+      ...title ? [title] : [],
+      ...problemDetail ? [problemDetail] : [],
+      ...fieldErrors,
+      ...structuredErrors
+    ];
+    if (parts.length > 0) {
+      if (title && !problemDetail && fieldErrors.length === 0 && structuredErrors.length === 0) {
+        parts.push("No additional error detail was returned by the API.");
+      }
+      msg = parts.join("\n");
+    } else {
+      const serialized = JSON.stringify(error);
+      msg = serialized && serialized !== "{}" ? serialized : "The API returned an empty error response.";
     }
-  } else if (typeof error === "object" && error !== null) {
-    msg = JSON.stringify(error);
   } else {
     msg = String(error);
   }
   return msg;
 }
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function formatProblemErrors(errors) {
+  if (!isRecord(errors)) return [];
+  return Object.entries(errors).flatMap(
+    ([field, messages]) => (Array.isArray(messages) ? messages : [messages]).map(
+      (message) => `  ${field}: ${formatErrorValue(message)}`
+    )
+  );
+}
+function formatStructuredViolations(violations) {
+  if (!Array.isArray(violations)) return [];
+  return violations.flatMap((violation) => {
+    if (!isRecord(violation)) return [formatErrorValue(violation)];
+    const field = typeof violation.field === "string" ? violation.field : "validation";
+    const message = typeof violation.message === "string" ? violation.message : formatErrorValue(violation);
+    return [`  ${field}: ${message}`];
+  });
+}
+function formatErrorValue(value) {
+  if (typeof value === "string") return value;
+  const serialized = JSON.stringify(value);
+  return serialized ?? String(value);
+}
 function fail(error) {
   const msg = formatFailureMessage(error);
   process.stderr.write(`error: ${msg}
@@ -5798,6 +5843,7 @@ Call sechroom_lifecycle_signal at each phase boundary (start/work/verify/closeou
 }
 
 // src/commands/executor.ts
+var DEFAULT_CLAIM_POLICY = "restricted";
 function executorSubscriptionInput(name) {
   return {
     name,
@@ -5859,8 +5905,8 @@ function registerExecutor(program2) {
     "Capability operation keys claimed by this instance"
   ).option(
     "--claim-policy <policy>",
-    "open | restricted (restricted only claims preferred/own-lane/allow-listed-tag work)",
-    "open"
+    "open | restricted (restricted only claims preferred/own-lane/allow-listed-tag work; default restricted)",
+    DEFAULT_CLAIM_POLICY
   ).option(
     "--claim-tag <tag...>",
     "Task tag this instance accepts under --claim-policy restricted"
@@ -5875,7 +5921,12 @@ function registerExecutor(program2) {
     "--subscription-name <name>",
     "SignalR delivery binding name",
     "executor-dispatch"
-  ).option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 600).option(
+  ).option(
+    "--ttl <seconds>",
+    "Advertisement TTL (30 to tenant maximum)",
+    parseInteger,
+    600
+  ).option(
     "--task-lease-ttl <seconds>",
     "Task lease TTL (60-86400)",
     parseInteger,
@@ -5962,7 +6013,7 @@ function registerExecutor(program2) {
       taskLeaseTtlSeconds: opts.taskLeaseTtl,
       modelId: opts.modelId,
       effortLabel: opts.effortLabel,
-      claimPolicy: (opts.claimPolicy ?? "open").toLowerCase() === "restricted" ? "restricted" : "open",
+      claimPolicy: parseClaimPolicy(opts.claimPolicy) === "Restricted" ? "restricted" : "open",
       claimTags: opts.claimTag ?? [],
       excludeTags: opts.excludeTag ?? [],
       relayId: opts.relay,
@@ -6083,8 +6134,8 @@ function registerExecutor(program2) {
     "Capability operation keys claimed by this instance"
   ).option(
     "--claim-policy <policy>",
-    "open | restricted (restricted only claims preferred/own-lane/allow-listed-tag work)",
-    "open"
+    "open | restricted (restricted only claims preferred/own-lane/allow-listed-tag work; default restricted)",
+    DEFAULT_CLAIM_POLICY
   ).option(
     "--claim-tag <tag...>",
     "Task tag this instance accepts under --claim-policy restricted"
@@ -6095,7 +6146,12 @@ function registerExecutor(program2) {
     "--activation-mode <mode>",
     "attached | detached \u2014 detached marks a fleet run as a service that outlives its shell (default attached)",
     "attached"
-  ).option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).option(
+  ).option(
+    "--ttl <seconds>",
+    "Advertisement TTL (30 to tenant maximum)",
+    parseInteger,
+    120
+  ).option(
     "--task-lease-ttl <seconds>",
     "Task lease TTL (60-86400)",
     parseInteger,
@@ -6151,7 +6207,12 @@ function registerExecutor(program2) {
 `)
       );
   });
-  executor.command("refresh <id>").description("Refresh one advertisement lease once").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).action(async (id, opts, cmd) => {
+  executor.command("refresh <id>").description("Refresh one advertisement lease once").option(
+    "--ttl <seconds>",
+    "Advertisement TTL (30 to tenant maximum)",
+    parseInteger,
+    120
+  ).action(async (id, opts, cmd) => {
     const data = await refreshExecutorInstance(
       resolveConfig(cmd.optsWithGlobals()),
       id,
@@ -6159,7 +6220,12 @@ function registerExecutor(program2) {
     );
     emit(data, Boolean(cmd.optsWithGlobals().json));
   });
-  executor.command("heartbeat <id>").description("Keep an advertisement alive until interrupted").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).option("--interval <seconds>", "Refresh interval", parseInteger, 40).action(async (id, opts, cmd) => {
+  executor.command("heartbeat <id>").description("Keep an advertisement alive until interrupted").option(
+    "--ttl <seconds>",
+    "Advertisement TTL (30 to tenant maximum)",
+    parseInteger,
+    120
+  ).option("--interval <seconds>", "Refresh interval", parseInteger, 40).action(async (id, opts, cmd) => {
     if (opts.interval >= opts.ttl)
       fail("heartbeat interval must be shorter than the TTL");
     const cfg = resolveConfig(cmd.optsWithGlobals());
@@ -6321,12 +6387,12 @@ function parseRuntimeKind(value) {
   }
 }
 function parseClaimPolicy(value) {
-  switch ((value ?? "open").trim().toLowerCase()) {
+  switch ((value ?? DEFAULT_CLAIM_POLICY).trim().toLowerCase()) {
     case "":
-    case "open":
-      return "Open";
     case "restricted":
       return "Restricted";
+    case "open":
+      return "Open";
     default:
       return fail("claim-policy must be open or restricted");
   }
@@ -7654,6 +7720,7 @@ function resolveLane(flagLane, cwd) {
   return applyWorktreeLaneSuffix(base, start);
 }
 var INTENT_FILE = join15(".sechroom", "continuity.json");
+var LOCAL_DRY_RUN_VALIDATION_WARNING = "LOCAL-ONLY \u2014 NOT SERVER-VALIDATED";
 function resolveIntentPath(start) {
   let dir = start;
   for (; ; ) {
@@ -7678,6 +7745,16 @@ function hasRequiredIntent(i) {
     i.objective?.trim() && i.state?.trim() && i.lastAction?.trim() && i.nextAction?.trim() && i.resumeInstruction?.trim()
   );
 }
+function localDryRunMissingFields(i) {
+  const required = [
+    ["objective", "--objective"],
+    ["state", "--state"],
+    ["lastAction", "--last-action"],
+    ["nextAction", "--next-action"],
+    ["resumeInstruction", "--resume-instruction"]
+  ];
+  return required.filter(([key]) => !String(i[key] ?? "").trim()).map(([, flag]) => flag);
+}
 async function saveSnapshotFromIntent(cmd, cwd, laneFlag, scopeFlag, defaultScope, opts) {
   const lane = resolveLane(laneFlag, cwd);
   if (!lane) return false;
@@ -7699,7 +7776,9 @@ async function saveSnapshotFromIntent(cmd, cwd, laneFlag, scopeFlag, defaultScop
       openQuestions: intent.questions ?? null,
       surfaceMarkers: intent.surfaceMarkers ?? null,
       relevantArtifactIds: intent.artifacts ?? null,
-      confidence: intent.confidence ?? null,
+      // Preserve invalid JSON-string confidence tokens for the server's semantic
+      // validator; never coerce them through Number/NaN/null.
+      confidence: confidenceWireValue(intent.confidence),
       // Frequent triggers (compaction, session-end) land within the FR-051 4h
       // window; Acknowledge lets the checkpoint persist on the lane.
       concurrentSessionPolicy: "Acknowledge"
@@ -7994,12 +8073,18 @@ Fail-soft: failures exit 0 and never block; session-context refresh failures ren
 function registerCheckpoint(program2) {
   program2.command("checkpoint").description(
     "Checkpoint working state: create a continuity snapshot (server-validated) AND sync ./.sechroom/continuity.json in one step"
-  ).option("--lane <laneId>", "Lane id (else SECHROOM_LANE, else ./.sechroom/lane.json code-lane)").option("--scope <scope>", "Snapshot scope (else the file's scope, else 'session')").option("--objective <text>", "Current objective").option("--state <text>", "Current state").option("--last-action <text>", "Last meaningful action").option("--next-action <text>", "Next intended action").option("--resume-instruction <text>", "Resume instruction").option("--constraint <text...>", "Active constraints (repeatable)").option("--question <text...>", "Open questions (repeatable)").option("--surface-marker <text...>", "Surface markers (repeatable)").option("--artifact <id...>", "Relevant artifact ids (repeatable)").option("--confidence <n>", "Confidence 0..1").option("--dry-run", "validate + print the snapshot payload without creating it or writing the file", false).addHelpText(
+  ).option("--lane <laneId>", "Lane id (else SECHROOM_LANE, else ./.sechroom/lane.json code-lane)").option("--scope <scope>", "Snapshot scope (else the file's scope, else 'session')").option("--objective <text>", "Current objective").option("--state <text>", "Current state").option("--last-action <text>", "Last meaningful action").option("--next-action <text>", "Next intended action").option("--resume-instruction <text>", "Resume instruction").option("--constraint <text...>", "Active constraints (repeatable)").option("--question <text...>", "Open questions (repeatable)").option("--surface-marker <text...>", "Surface markers (repeatable)").option("--artifact <id...>", "Relevant artifact ids (repeatable)").option("--confidence <n>", "Confidence 0..1").option(
+    "--dry-run",
+    "run the local required-field check and print the payload (LOCAL-ONLY; NOT SERVER-VALIDATED)",
+    false
+  ).addHelpText(
     "after",
     `
 File-first: reads ./.sechroom/continuity.json (kept current as you work) as the base; any flag
 overrides that field. The snapshot is created FIRST (server-validated), then the local file is
 written/normalized with the returned snapshotId. Lane: --lane > SECHROOM_LANE > ./.sechroom/lane.json code-lane.
+--dry-run performs only the local required-field check and prints a payload. Its output is
+explicitly LOCAL-ONLY; NOT SERVER-VALIDATED, so it does not establish write-path parity.
 
 Examples:
   $ sechroom checkpoint                          snapshot from ./.sechroom/continuity.json, then sync it
@@ -8022,7 +8107,9 @@ Examples:
       questions: opts.question ?? base.questions,
       surfaceMarkers: opts.surfaceMarker ?? base.surfaceMarkers,
       artifacts: opts.artifact ?? base.artifacts,
-      confidence: opts.confidence != null ? Number(opts.confidence) : base.confidence
+      // Keep the raw token until the server's shared validator sees it. In particular,
+      // Number("high") -> NaN -> JSON null would silently discard the operator's input.
+      confidence: opts.confidence != null ? opts.confidence : base.confidence
     };
     const lane = resolveLane(opts.lane, cwd);
     if (!lane) {
@@ -8030,19 +8117,6 @@ Examples:
         "no lane resolved \u2014 pass --lane, set SECHROOM_LANE, or pin one in ./.sechroom/lane.json (code-lane). See `sechroom lane`."
       );
     }
-    const required = [
-      ["objective", "--objective"],
-      ["state", "--state"],
-      ["lastAction", "--last-action"],
-      ["nextAction", "--next-action"],
-      ["resumeInstruction", "--resume-instruction"]
-    ];
-    const missing = required.filter(([k]) => !String(merged[k] ?? "").trim()).map(([, flag]) => flag);
-    if (missing.length > 0) {
-      fail(
-        `missing required field(s): ${missing.join(", ")} \u2014 supply via flag or in ./.sechroom/continuity.json`
-      );
-    }
     const scope = merged.scope ?? "session";
     const body = {
       laneId: lane,
@@ -8056,13 +8130,33 @@ Examples:
       openQuestions: merged.questions ?? null,
       surfaceMarkers: merged.surfaceMarkers ?? null,
       relevantArtifactIds: merged.artifacts ?? null,
-      confidence: merged.confidence ?? null,
+      confidence: confidenceWireValue(merged.confidence),
       // Explicit checkpoints are often within the FR-051 4h window; Acknowledge
       // lets one land on the lane (matches `hook pre-compact`).
       concurrentSessionPolicy: "Acknowledge"
     };
     if (opts.dryRun) {
-      emit({ dryRun: true, lane, scope, wouldCreate: body }, json);
+      const missing = localDryRunMissingFields(merged);
+      if (missing.length > 0) {
+        fail(
+          `LOCAL-ONLY CHECK \u2014 NOT SERVER-VALIDATED: missing required field(s): ${missing.join(", ")} \u2014 supply via flag or in ./.sechroom/continuity.json`
+        );
+      }
+      emit(
+        {
+          dryRun: true,
+          validation: {
+            mode: "local-only",
+            serverValidated: false,
+            checks: ["required-fields"],
+            warning: LOCAL_DRY_RUN_VALIDATION_WARNING
+          },
+          lane,
+          scope,
+          wouldCreate: body
+        },
+        json
+      );
       return;
     }
     const data = await runApi("Creating snapshot", async () => {
@@ -8299,7 +8393,7 @@ Displaced snapshot recovery surfaces:
           openQuestions: opts.question ?? null,
           surfaceMarkers: opts.surfaceMarker ?? null,
           relevantArtifactIds: opts.artifact ?? null,
-          confidence: opts.confidence != null ? Number(opts.confidence) : null
+          confidence: confidenceWireValue(opts.confidence)
         }
       });
     });
@@ -8448,6 +8542,96 @@ function snapshotGetNotFoundHint(includeAll, status) {
 
 // src/commands/work-plan.ts
 import { readFile as readFile2 } from "fs/promises";
+
+// src/paging.ts
+var MAX_AUTO_PAGES = 100;
+var asNumber = (value) => value === void 0 || value === "" ? void 0 : Number(value);
+function shouldAutoPage(opts) {
+  if (opts.autoPage === false) return false;
+  return asNumber(opts.page) === void 0;
+}
+function singlePageQuery(opts) {
+  const page = asNumber(opts.page);
+  const pageSize = asNumber(opts.pageSize);
+  return {
+    ...page === void 0 ? {} : { page },
+    ...pageSize === void 0 ? {} : { pageSize }
+  };
+}
+async function fetchAllPages(fetchPage, opts = {}, label = "results") {
+  const pages = [];
+  let page = 1;
+  let truncated = false;
+  for (; ; ) {
+    const current = await fetchPage(page);
+    pages.push(current);
+    if (!hasNextPage(current)) break;
+    if (pages.length >= MAX_AUTO_PAGES) {
+      truncated = true;
+      break;
+    }
+    page = current.page + 1;
+  }
+  const first = pages[0];
+  if (!first) throw new Error("paged read returned no envelope at all");
+  if (truncated) {
+    if (!isQuiet()) {
+      process.stderr.write(
+        `${warn("!")} Stopped after ${MAX_AUTO_PAGES} pages \u2014 more ${label} remain. ${style.dim("Narrow the filters, or read a specific window with --page/--page-size.")}
+`
+      );
+    }
+    const partial = pages.flatMap((p) => p.items);
+    return {
+      ...first,
+      items: partial,
+      page: 1,
+      pageSize: partial.length,
+      // Pages OF THIS SIZE, so the number stays consistent with the pageSize just reported.
+      pageCount: partial.length === 0 ? 1 : Math.ceil(first.count / partial.length),
+      hasPreviousPage: false,
+      hasNextPage: true,
+      isFirstPage: true,
+      isLastPage: false,
+      firstItemOnPage: partial.length === 0 ? 0 : 1,
+      lastItemOnPage: partial.length
+    };
+  }
+  if (pages.length === 1) return first;
+  const items = pages.flatMap((current) => current.items);
+  return {
+    ...first,
+    items,
+    page: 1,
+    pageSize: items.length,
+    pageCount: 1,
+    hasPreviousPage: false,
+    hasNextPage: false,
+    isFirstPage: true,
+    isLastPage: true,
+    firstItemOnPage: items.length === 0 ? 0 : 1,
+    lastItemOnPage: items.length
+  };
+}
+function hasNextPage(current) {
+  if (current.hasNextPage !== void 0) return current.hasNextPage;
+  if (current.pageCount !== void 0) return current.page < current.pageCount;
+  return current.page * current.pageSize < current.count;
+}
+var PAGE_OPTION = [
+  "--page <n>",
+  "Page number (reads only that page instead of all)"
+];
+var PAGE_SIZE_OPTION = [
+  "--page-size <n>",
+  "Page size used while paging"
+];
+var NO_AUTO_PAGE_OPTION = [
+  "--no-auto-page",
+  "Read only the first page instead of walking every page"
+];
+
+// src/commands/work-plan.ts
 function registerWorkPlan(program2) {
   const workPlan = program2.command("work-plan").description(
     "Drive a work plan: create one from a brief, then execute / accept / reject"
@@ -8641,22 +8825,27 @@ Examples:
       globals.json
     );
   });
-  workPlan.command("list").description("List work plans, newest-first (GET /decompositions)").option("--status <status>", "Filter by decomposition status").option("--brief <briefId>", "Filter by work-brief memory id").option("--page <n>", "1-based page number", (v) => Number.parseInt(v, 10)).option("--page-size <n>", "Page size", (v) => Number.parseInt(v, 10)).action(async (opts, cmd) => {
+  workPlan.command("list").description(
+    "List work plans, newest-first (GET /decompositions). Walks every page by default."
+  ).option("--status <status>", "Filter by decomposition status").option("--brief <briefId>", "Filter by work-brief memory id").option(...PAGE_OPTION).option(...PAGE_SIZE_OPTION).option(...NO_AUTO_PAGE_OPTION).action(async (opts, cmd) => {
     const globals = cmd.optsWithGlobals();
     const cfg = resolveConfig(globals);
-    const data = await runApi("Listing work plans", async () => {
+    const readPage = (query) => runApi("Listing work plans", async () => {
       const client = await makeClient(cfg);
       return client.GET("/decompositions", {
         params: {
-          query: {
-            status: opts.status,
-            briefId: opts.brief,
-            page: opts.page,
-            pageSize: opts.pageSize
-          }
+          query: { status: opts.status, briefId: opts.brief, ...query }
         }
       });
     });
+    const data = shouldAutoPage(opts) ? await fetchAllPages(
+      (page) => readPage({
+        page,
+        ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
+      }),
+      opts,
+      "work plans"
+    ) : await readPage(singlePageQuery(opts));
     emitAction(
       `listed ${style.bold(String(data.items.length))} of ${data.count} work plan(s)`,
       data,
@@ -8744,35 +8933,53 @@ Examples:
   $ sechroom filing reject fsg_XXXX --reason "wrong workspace"
   $ sechroom filing edit-and-accept fsg_XXXX --target-kind Workspace --existing-target-id wsp_XXXX`
   );
-  filing.command("suggestions").description("List filing suggestions (GET /filing/suggestions)").option("--memory-id <memoryId>", "Filter to a single memory's suggestions").option(
+  filing.command("suggestions").description(
+    "List filing suggestions (GET /filing/suggestions). Walks every page by default."
+  ).option("--memory-id <memoryId>", "Filter to a single memory's suggestions").option(
     "--status <status>",
     "Generating | Pending | Accepted | Rejected | EditedAndAccepted | Deferred | Invalidated"
-  ).option("--page <n>", "Page number").option("--page-size <n>", "Page size").action(async (opts, cmd) => {
+  ).option(...PAGE_OPTION).option(...PAGE_SIZE_OPTION).option(...NO_AUTO_PAGE_OPTION).action(async (opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Listing filing suggestions", async () => {
+    const filters = {
+      ...opts.memoryId ? { memoryId: opts.memoryId } : {},
+      ...opts.status ? {
+        status: opts.status
+      } : {}
+    };
+    const readPage = (query) => runApi("Listing filing suggestions", async () => {
       const client = await makeClient(cfg);
       return client.GET("/filing/suggestions", {
-        params: {
-          query: {
-            ...opts.memoryId ? { memoryId: opts.memoryId } : {},
-            ...opts.status ? { status: opts.status } : {},
-            ...opts.page ? { page: Number(opts.page) } : {},
-            ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
-          }
-        }
+        params: { query: { ...filters, ...query } }
       });
     });
+    const data = shouldAutoPage(opts) ? await fetchAllPages(
+      (page) => readPage({
+        page,
+        ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
+      }),
+      opts,
+      "filing suggestions"
+    ) : await readPage(singlePageQuery(opts));
     emit(data, cmd.optsWithGlobals().json);
   });
-  filing.command("get <id>").description("Fetch a filing suggestion by id (GET /filing/suggestions/{id})").action(async (id, _opts, cmd) => {
+  filing.command("get <id>").description(
+    "Fetch a filing suggestion by id (GET /filing/suggestions/{id})"
+  ).action(async (id, _opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Fetching filing suggestion", async () => {
       const client = await makeClient(cfg);
-      return client.GET("/filing/suggestions/{id}", { params: { path: { id } } });
+      return client.GET("/filing/suggestions/{id}", {
+        params: { path: { id } }
+      });
     });
     emit(data, cmd.optsWithGlobals().json);
   });
-  filing.command("preview").description("Preview a filing suggestion for a memory id or ad-hoc shape (POST /filing/suggestions/preview)").option("--memory-id <memoryId>", "Preview filing for an existing memory").option("--text <text>", "Ad-hoc memory body text (instead of --memory-id)").option("--title <title>", "Ad-hoc memory title").option("--tag <tag...>", "Ad-hoc memory tags (repeatable)").option("--type <type>", "Ad-hoc memory type", "reference").option("--scope-workspace <workspaceId>", "Scope the preview to a workspace").action(async (opts, cmd) => {
+  filing.command("preview").description(
+    "Preview a filing suggestion for a memory id or ad-hoc shape (POST /filing/suggestions/preview)"
+  ).option("--memory-id <memoryId>", "Preview filing for an existing memory").option("--text <text>", "Ad-hoc memory body text (instead of --memory-id)").option("--title <title>", "Ad-hoc memory title").option("--tag <tag...>", "Ad-hoc memory tags (repeatable)").option("--type <type>", "Ad-hoc memory type", "reference").option(
+    "--scope-workspace <workspaceId>",
+    "Scope the preview to a workspace"
+  ).action(async (opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const memory = opts.text ? {
       text: opts.text,
@@ -8792,15 +8999,26 @@ Examples:
     });
     emit(data, cmd.optsWithGlobals().json);
   });
-  filing.command("accept <id>").description("Accept a filing suggestion (POST /filing/suggestions/{id}/accept)").action(async (id, _opts, cmd) => {
+  filing.command("accept <id>").description(
+    "Accept a filing suggestion (POST /filing/suggestions/{id}/accept)"
+  ).action(async (id, _opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Accepting filing suggestion", async () => {
       const client = await makeClient(cfg);
-      return client.POST("/filing/suggestions/{id}/accept", { params: { path: { id } }, body: {} });
+      return client.POST("/filing/suggestions/{id}/accept", {
+        params: { path: { id } },
+        body: {}
+      });
     });
-    emitAction(`accepted filing suggestion ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+    emitAction(
+      `accepted filing suggestion ${style.bold(id)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
-  filing.command("reject <id>").description("Reject a filing suggestion (POST /filing/suggestions/{id}/reject)").option("--reason <reason>", "Why the suggestion was rejected").option("--reason-code <code>", "Structured reason code").action(async (id, opts, cmd) => {
+  filing.command("reject <id>").description(
+    "Reject a filing suggestion (POST /filing/suggestions/{id}/reject)"
+  ).option("--reason <reason>", "Why the suggestion was rejected").option("--reason-code <code>", "Structured reason code").action(async (id, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Rejecting filing suggestion", async () => {
       const client = await makeClient(cfg);
@@ -8812,9 +9030,18 @@ Examples:
         }
       });
     });
-    emitAction(`rejected filing suggestion ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+    emitAction(
+      `rejected filing suggestion ${style.bold(id)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
-  filing.command("defer <id>").description("Defer a filing suggestion (POST /filing/suggestions/{id}/defer)").option("--until <iso>", "Defer until an ISO-8601 timestamp (defaults to indefinite)").action(async (id, opts, cmd) => {
+  filing.command("defer <id>").description(
+    "Defer a filing suggestion (POST /filing/suggestions/{id}/defer)"
+  ).option(
+    "--until <iso>",
+    "Defer until an ISO-8601 timestamp (defaults to indefinite)"
+  ).action(async (id, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Deferring filing suggestion", async () => {
       const client = await makeClient(cfg);
@@ -8823,25 +9050,44 @@ Examples:
         body: { until: opts.until ?? null }
       });
     });
-    emitAction(`deferred filing suggestion ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+    emitAction(
+      `deferred filing suggestion ${style.bold(id)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
-  filing.command("edit-and-accept <id>").description("Override the target then accept (POST /filing/suggestions/{id}/edit-and-accept)").option("--target-kind <kind>", "Workspace | Project").option("--existing-target-id <id>", "File into an existing workspace/project").option("--new-name <name>", "Create a new target with this name").option("--new-description <text>", "Description for the new target").option("--new-parent-workspace <workspaceId>", "Parent workspace for a new project").option("--memory-id <memoryId...>", "Override the memory set (repeatable)").action(async (id, opts, cmd) => {
+  filing.command("edit-and-accept <id>").description(
+    "Override the target then accept (POST /filing/suggestions/{id}/edit-and-accept)"
+  ).option("--target-kind <kind>", "Workspace | Project").option(
+    "--existing-target-id <id>",
+    "File into an existing workspace/project"
+  ).option("--new-name <name>", "Create a new target with this name").option("--new-description <text>", "Description for the new target").option(
+    "--new-parent-workspace <workspaceId>",
+    "Parent workspace for a new project"
+  ).option("--memory-id <memoryId...>", "Override the memory set (repeatable)").action(async (id, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Editing and accepting filing suggestion", async () => {
-      const client = await makeClient(cfg);
-      return client.POST("/filing/suggestions/{id}/edit-and-accept", {
-        params: { path: { id } },
-        body: {
-          targetKind: opts.targetKind ?? null,
-          existingTargetId: opts.existingTargetId ?? null,
-          newName: opts.newName ?? null,
-          newDescription: opts.newDescription ?? null,
-          newParentWorkspaceId: opts.newParentWorkspace ?? null,
-          overrideMemoryIds: opts.memoryId ?? null
-        }
-      });
-    });
-    emitAction(`edited & accepted filing suggestion ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+    const data = await runApi(
+      "Editing and accepting filing suggestion",
+      async () => {
+        const client = await makeClient(cfg);
+        return client.POST("/filing/suggestions/{id}/edit-and-accept", {
+          params: { path: { id } },
+          body: {
+            targetKind: opts.targetKind ?? null,
+            existingTargetId: opts.existingTargetId ?? null,
+            newName: opts.newName ?? null,
+            newDescription: opts.newDescription ?? null,
+            newParentWorkspaceId: opts.newParentWorkspace ?? null,
+            overrideMemoryIds: opts.memoryId ?? null
+          }
+        });
+      }
+    );
+    emitAction(
+      `edited & accepted filing suggestion ${style.bold(id)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
 }
 
@@ -10165,39 +10411,16 @@ function resolveCreateBody(textOpt, fileOpt) {
   return { text: text2, defaultTitle };
 }
 async function fetchAllMemoryRelationships(cfg, memoryId) {
-  const pages = [];
-  let page = 1;
-  while (true) {
-    const current = await runApi(
-      `Fetching relationships (page ${page})`,
-      async () => {
-        const client = await makeClient(cfg);
-        return client.GET("/memories/{memoryId}/relationships", {
-          params: { path: { memoryId }, query: { page } }
-        });
-      }
-    );
-    pages.push(current);
-    const hasNextPage = current.hasNextPage ?? (current.pageCount !== void 0 ? current.page < current.pageCount : current.page * current.pageSize < current.count);
-    if (!hasNextPage) break;
-    page = current.page + 1;
-  }
-  const first = pages[0];
-  if (!first || pages.length === 1) return first;
-  const items = pages.flatMap((current) => current.items);
-  return {
-    ...first,
-    items,
-    page: 1,
-    pageSize: items.length,
-    pageCount: 1,
-    hasPreviousPage: false,
-    hasNextPage: false,
-    isFirstPage: true,
-    isLastPage: true,
-    firstItemOnPage: 1,
-    lastItemOnPage: items.length
-  };
+  return await fetchAllPages(
+    (page) => runApi(`Fetching relationships (page ${page})`, async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/memories/{memoryId}/relationships", {
+        params: { path: { memoryId }, query: { page } }
+      });
+    }),
+    {},
+    "relationships"
+  );
 }
 function registerMemory(program2) {
   const memory = program2.command("memory").description("Create, read, and search memories");
@@ -10697,21 +10920,28 @@ Note: CLI memory get omits relationships by default; MCP get_memory includes the
       cmd.optsWithGlobals().json
     );
   });
-  memory.command("list-archived").description("List archived memories (GET /memories/archived)").option("--workspace <workspaceId>", "Scope to a workspace").option("--project <projectId>", "Scope to a project").option("--page <n>", "Page number").option("--page-size <n>", "Page size").action(async (opts, cmd) => {
+  memory.command("list-archived").description(
+    "List archived memories (GET /memories/archived). Walks every page by default."
+  ).option("--workspace <workspaceId>", "Scope to a workspace").option("--project <projectId>", "Scope to a project").option(...PAGE_OPTION).option(...PAGE_SIZE_OPTION).option(...NO_AUTO_PAGE_OPTION).action(async (opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Listing archived memories", async () => {
+    const filters = {
+      ...opts.workspace ? { workspaceId: opts.workspace } : {},
+      ...opts.project ? { projectId: opts.project } : {}
+    };
+    const readPage = (query) => runApi("Listing archived memories", async () => {
       const client = await makeClient(cfg);
       return client.GET("/memories/archived", {
-        params: {
-          query: {
-            ...opts.workspace ? { workspaceId: opts.workspace } : {},
-            ...opts.project ? { projectId: opts.project } : {},
-            ...opts.page ? { page: Number(opts.page) } : {},
-            ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
-          }
-        }
+        params: { query: { ...filters, ...query } }
       });
     });
+    const data = shouldAutoPage(opts) ? await fetchAllPages(
+      (page) => readPage({
+        page,
+        ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
+      }),
+      opts,
+      "archived memories"
+    ) : await readPage(singlePageQuery(opts));
     emit(data, cmd.optsWithGlobals().json);
   });
   memory.command("versions <memoryId>").description("List a memory's versions (GET /memories/{memoryId}/versions)").action(async (memoryId, _opts, cmd) => {
@@ -13499,7 +13729,13 @@ Examples:
   $ sechroom relationship suggestions --status Pending --memory mem_XXXX
   $ sechroom relationship suggestion accept rsg_XXXX`
   );
-  relationship.command("create <fromMemoryId> <toMemoryId>").description("Create a relationship (POST /memories/{memoryId}/relationships)").option("--type <type>", "Relationship type (Reference, Related, Parent, Child, Follows, \u2026)", "Reference").option(
+  relationship.command("create <fromMemoryId> <toMemoryId>").description(
+    "Create a relationship (POST /memories/{memoryId}/relationships)"
+  ).option(
+    "--type <type>",
+    "Relationship type (Reference, Related, Parent, Child, Follows, \u2026)",
+    "Reference"
+  ).option(
     "--to-version <number>",
     "Version of the target memory to pin the edge to (defaults to the target's current version)"
   ).action(async (fromMemoryId, toMemoryId, opts, cmd) => {
@@ -13509,15 +13745,21 @@ Examples:
     if (opts.toVersion !== void 0) {
       toVersion = Number(opts.toVersion);
       if (!Number.isInteger(toVersion) || toVersion < 1) {
-        fail(`--to-version must be a positive integer (got '${opts.toVersion}').`);
+        fail(
+          `--to-version must be a positive integer (got '${opts.toVersion}').`
+        );
       }
     } else {
       const target = await runApi(
         "Resolving target version",
-        async () => client.GET("/memories/{memoryId}", { params: { path: { memoryId: toMemoryId } } })
+        async () => client.GET("/memories/{memoryId}", {
+          params: { path: { memoryId: toMemoryId } }
+        })
       );
       if (typeof target.item?.currentVersion !== "number") {
-        fail(`Could not resolve the current version of ${toMemoryId}; pass --to-version explicitly.`);
+        fail(
+          `Could not resolve the current version of ${toMemoryId}; pass --to-version explicitly.`
+        );
       }
       toVersion = target.item.currentVersion;
     }
@@ -13541,22 +13783,28 @@ Examples:
       cmd.optsWithGlobals().json
     );
   });
-  relationship.command("list <memoryId>").description("List a memory's relationships (GET /memories/{memoryId}/relationships)").option("--direction <direction>", "Both | Outbound | Inbound").option("--include-deleted", "Include deleted relationships", false).option("--page <n>", "Page number").option("--page-size <n>", "Page size").action(async (memoryId, opts, cmd) => {
+  relationship.command("list <memoryId>").description(
+    "List a memory's relationships (GET /memories/{memoryId}/relationships). Walks every page by default."
+  ).option("--direction <direction>", "Both | Outbound | Inbound").option("--include-deleted", "Include deleted relationships", false).option(...PAGE_OPTION).option(...PAGE_SIZE_OPTION).option(...NO_AUTO_PAGE_OPTION).action(async (memoryId, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Listing relationships", async () => {
+    const filters = {
+      ...opts.direction ? { direction: opts.direction } : {},
+      ...opts.includeDeleted ? { includeDeleted: true } : {}
+    };
+    const readPage = (query) => runApi("Listing relationships", async () => {
       const client = await makeClient(cfg);
       return client.GET("/memories/{memoryId}/relationships", {
-        params: {
-          path: { memoryId },
-          query: {
-            ...opts.direction ? { direction: opts.direction } : {},
-            ...opts.includeDeleted ? { includeDeleted: true } : {},
-            ...opts.page ? { page: Number(opts.page) } : {},
-            ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
-          }
-        }
+        params: { path: { memoryId }, query: { ...filters, ...query } }
       });
     });
+    const data = shouldAutoPage(opts) ? await fetchAllPages(
+      (page) => readPage({
+        page,
+        ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
+      }),
+      opts,
+      "relationships"
+    ) : await readPage(singlePageQuery(opts));
     emit(data, cmd.optsWithGlobals().json);
   });
   relationship.command("delete <id>").description("Delete a relationship (DELETE /relationships/{id})").action(async (id, _opts, cmd) => {
@@ -13568,9 +13816,15 @@ Examples:
         body: {}
       });
     });
-    emitAction(`deleted relationship ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+    emitAction(
+      `deleted relationship ${style.bold(id)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
-  relationship.command("suggest <memoryId>").description("Generate relationship suggestions for a memory (POST /memories/{memoryId}/suggest-relationships)").option("--limit <n>", "Max suggestions to generate").action(async (memoryId, opts, cmd) => {
+  relationship.command("suggest <memoryId>").description(
+    "Generate relationship suggestions for a memory (POST /memories/{memoryId}/suggest-relationships)"
+  ).option("--limit <n>", "Max suggestions to generate").action(async (memoryId, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Suggesting relationships", async () => {
       const client = await makeClient(cfg);
@@ -13587,38 +13841,51 @@ Examples:
       cmd.optsWithGlobals().json
     );
   });
-  relationship.command("suggestions").description("List relationship suggestions (GET /relationship-suggestions)").option("--memory <memoryId>", "Filter to a memory").option(
+  relationship.command("suggestions").description(
+    "List relationship suggestions (GET /relationship-suggestions)"
+  ).option("--memory <memoryId>", "Filter to a memory").option(
     "--status <status>",
     "Pending | Accepted | EditedAndAccepted | Rejected | Superseded | Deferred | Invalidated"
-  ).option("--page <n>", "Page number").option("--page-size <n>", "Page size").action(async (opts, cmd) => {
+  ).option(...PAGE_OPTION).option(...PAGE_SIZE_OPTION).option(...NO_AUTO_PAGE_OPTION).action(async (opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Listing suggestions", async () => {
+    const filters = {
+      ...opts.memory ? { memoryId: opts.memory } : {},
+      ...opts.status ? {
+        status: opts.status
+      } : {}
+    };
+    const readPage = (query) => runApi("Listing suggestions", async () => {
       const client = await makeClient(cfg);
       return client.GET("/relationship-suggestions", {
-        params: {
-          query: {
-            ...opts.memory ? { memoryId: opts.memory } : {},
-            ...opts.status ? {
-              status: opts.status
-            } : {},
-            ...opts.page ? { page: Number(opts.page) } : {},
-            ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
-          }
-        }
+        params: { query: { ...filters, ...query } }
       });
     });
+    const data = shouldAutoPage(opts) ? await fetchAllPages(
+      (page) => readPage({
+        page,
+        ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
+      }),
+      opts,
+      "suggestions"
+    ) : await readPage(singlePageQuery(opts));
     emit(data, cmd.optsWithGlobals().json);
   });
   const suggestion = relationship.command("suggestion").description("Inspect and decide on a single relationship suggestion");
-  suggestion.command("get <id>").description("Fetch a suggestion by id (GET /relationship-suggestions/{id})").action(async (id, _opts, cmd) => {
+  suggestion.command("get <id>").description(
+    "Fetch a suggestion by id (GET /relationship-suggestions/{id})"
+  ).action(async (id, _opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Fetching suggestion", async () => {
       const client = await makeClient(cfg);
-      return client.GET("/relationship-suggestions/{id}", { params: { path: { id } } });
+      return client.GET("/relationship-suggestions/{id}", {
+        params: { path: { id } }
+      });
     });
     emit(data, cmd.optsWithGlobals().json);
   });
-  suggestion.command("accept <id>").description("Accept a suggestion (POST /relationship-suggestions/{instanceId}/accept)").action(async (id, _opts, cmd) => {
+  suggestion.command("accept <id>").description(
+    "Accept a suggestion (POST /relationship-suggestions/{instanceId}/accept)"
+  ).action(async (id, _opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Accepting suggestion", async () => {
       const client = await makeClient(cfg);
@@ -13627,9 +13894,15 @@ Examples:
         body: {}
       });
     });
-    emitAction(`accepted suggestion ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+    emitAction(
+      `accepted suggestion ${style.bold(id)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
-  suggestion.command("reject <id>").description("Reject a suggestion (POST /relationship-suggestions/{instanceId}/reject)").option("--reason <reason>", "Why it's being rejected").option("--reason-code <code>", "Structured reason code").action(async (id, opts, cmd) => {
+  suggestion.command("reject <id>").description(
+    "Reject a suggestion (POST /relationship-suggestions/{instanceId}/reject)"
+  ).option("--reason <reason>", "Why it's being rejected").option("--reason-code <code>", "Structured reason code").action(async (id, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Rejecting suggestion", async () => {
       const client = await makeClient(cfg);
@@ -13641,9 +13914,18 @@ Examples:
         }
       });
     });
-    emitAction(`rejected suggestion ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+    emitAction(
+      `rejected suggestion ${style.bold(id)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
-  suggestion.command("defer <id>").description("Defer a suggestion (POST /relationship-suggestions/{id}/defer)").option("--until <iso>", "Defer until this ISO date-time (omit to defer indefinitely)").action(async (id, opts, cmd) => {
+  suggestion.command("defer <id>").description(
+    "Defer a suggestion (POST /relationship-suggestions/{id}/defer)"
+  ).option(
+    "--until <iso>",
+    "Defer until this ISO date-time (omit to defer indefinitely)"
+  ).action(async (id, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Deferring suggestion", async () => {
       const client = await makeClient(cfg);
@@ -13654,7 +13936,11 @@ Examples:
         }
       });
     });
-    emitAction(`deferred suggestion ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+    emitAction(
+      `deferred suggestion ${style.bold(id)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
 }
 
@@ -14367,17 +14653,15 @@ Examples:
   $ sechroom work-task mark-no-residue mem_XXXX --decomposition wlp_XXXX
   $ sechroom work-task residue-produce mem_XXXX --file residue.json`
   );
-  workTask.command("list").description("List work tasks, newest-first (GET /work-tasks)").option("--shape <shape>", "Filter: bare | managed").option(
+  workTask.command("list").description(
+    "List work tasks, newest-first (GET /work-tasks). Walks every page by default."
+  ).option("--shape <shape>", "Filter: bare | managed").option(
     "--lane <lane>",
     "Filter by dispatch-lane value, e.g. claude-code-chris"
-  ).option("--status <status>", "Filter by status value, e.g. in-progress").option("--page <n>", "1-based page number", (v) => Number.parseInt(v, 10)).option(
-    "--page-size <n>",
-    "Page size (default 50, capped 200)",
-    (v) => Number.parseInt(v, 10)
-  ).action(async (opts, cmd) => {
+  ).option("--status <status>", "Filter by status value, e.g. in-progress").option(...PAGE_OPTION).option(...PAGE_SIZE_OPTION).option(...NO_AUTO_PAGE_OPTION).action(async (opts, cmd) => {
     const globals = cmd.optsWithGlobals();
     const cfg = resolveConfig(globals);
-    const data = await runApi("Listing work tasks", async () => {
+    const readPage = (query) => runApi("Listing work tasks", async () => {
       const client = await makeClient(cfg);
       return client.GET("/work-tasks", {
         params: {
@@ -14385,12 +14669,19 @@ Examples:
             shape: opts.shape,
             lane: opts.lane,
             status: opts.status,
-            page: opts.page,
-            pageSize: opts.pageSize
+            ...query
           }
         }
       });
     });
+    const data = shouldAutoPage(opts) ? await fetchAllPages(
+      (page) => readPage({
+        page,
+        ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
+      }),
+      opts,
+      "tasks"
+    ) : await readPage(singlePageQuery(opts));
     emitAction(
       `listed ${style.bold(String(data.items.length))} of ${data.count} task(s)`,
       data,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.8.2",
+  "version": "2026.8.3",
   "description": "Command-line interface for Sechroom — sign in, wire your AI tools, and work with your sechroom from the terminal.",
   "type": "module",
   "license": "UNLICENSED",