@sechroom/cli 2026.8.3 → 2026.8.4

package/dist/index.js

@@ -1072,14 +1072,19 @@ async function fetchSetup(cfg, namespaceSlug) {
     "/operator-surface/setup",
     hasQuery ? { params: { query } } : {}
   );
-  if (error) throw new Error(`GET /operator-surface/setup failed: ${JSON.stringify(error)}`);
+  if (error)
+    throw new Error(
+      `GET /operator-surface/setup failed: ${JSON.stringify(error)}`
+    );
   return data;
 }
 async function listNamespaces(cfg) {
   const client = await makeClient(cfg);
   const { data } = await client.GET("/mcp-aggregator/namespaces", {});
   const rows = data ?? [];
-  return rows.filter((r) => typeof r.slug === "string").map((r) => ({ slug: r.slug, displayName: r.displayName ?? r.slug }));
+  return rows.filter(
+    (r) => typeof r.slug === "string"
+  ).map((r) => ({ slug: r.slug, displayName: r.displayName ?? r.slug }));
 }
 function findSurface(setup, surfaceKey) {
   return setup.surfaces.find((s) => s.surfaceKey === surfaceKey);
@@ -1095,10 +1100,15 @@ function sectionSnippet(section) {
   }
   return null;
 }
-function parseTagArtifactId(id) {
+function parseTagArtifactCandidates(id) {
   if (!id.startsWith("tag:")) return null;
-  const tags = id.slice("tag:".length).split(",").map((t) => t.trim()).filter((t) => t.length > 0);
-  return tags.length > 0 ? tags : null;
+  const candidates = id.slice("tag:".length).split("|").map(
+    (set) => set.split(",").map((t) => t.trim()).filter((t) => t.length > 0)
+  ).filter((set) => set.length > 0);
+  return candidates.length > 0 ? candidates : null;
+}
+function parseTagArtifactId(id) {
+  return parseTagArtifactCandidates(id)?.[0] ?? null;
 }
 async function getPersonalWorkspaceId(cfg) {
   const client = await makeClient(cfg);
@@ -1107,40 +1117,102 @@ async function getPersonalWorkspaceId(cfg) {
 }
 async function fetchMemoryFields(cfg, id) {
   const client = await makeClient(cfg);
-  const { data } = await client.GET("/memories/{memoryId}", { params: { path: { memoryId: id } } });
+  const { data } = await client.GET("/memories/{memoryId}", {
+    params: { path: { memoryId: id } }
+  });
   const env = data;
   const m = env?.item ?? env;
   if (!m) return null;
   const version = typeof m.currentVersion === "string" ? Number(m.currentVersion) : m.currentVersion;
-  return { text: m.text, title: m.title, tags: m.tags, version: Number.isFinite(version) ? version : void 0 };
+  return {
+    text: m.text,
+    title: m.title,
+    tags: m.tags,
+    version: Number.isFinite(version) ? version : void 0
+  };
 }
-async function resolveInstruction(cfg, section, personalWorkspaceId) {
-  const client = await makeClient(cfg);
-  for (const artifact of section.artifacts) {
-    const tags = parseTagArtifactId(artifact.id);
-    if (!tags) continue;
+async function findTemplateByCandidates(client, candidates) {
+  for (let i = 0; i < candidates.length; i++) {
+    const tags = candidates[i];
     const { data } = await client.POST("/memories/search", {
-      body: { query: null, textQuery: null, semanticQuery: null, hybrid: false, limit: 1, includeArchived: false, includeSystem: false, tags }
+      body: {
+        query: null,
+        textQuery: null,
+        semanticQuery: null,
+        hybrid: false,
+        limit: 1,
+        includeArchived: false,
+        includeSystem: false,
+        tags
+      }
     });
     const hits = data?.items ?? [];
     if (hits.length === 0) continue;
-    const templateId = hits[0].id;
+    return { id: hits[0].id, tags, via: i === 0 ? "preferred" : "fallback" };
+  }
+  return null;
+}
+function attemptedTagSets(section) {
+  return section.artifacts.flatMap(
+    (artifact) => parseTagArtifactCandidates(artifact.id) ?? []
+  );
+}
+async function resolveInstruction(cfg, section, personalWorkspaceId) {
+  const client = await makeClient(cfg);
+  for (const artifact of section.artifacts) {
+    const candidates = parseTagArtifactCandidates(artifact.id);
+    if (!candidates) continue;
+    const found = await findTemplateByCandidates(client, candidates);
+    if (!found) continue;
+    const templateId = found.id;
     const template = await fetchMemoryFields(cfg, templateId);
-    if (typeof template?.text !== "string" || template.text.length === 0) continue;
-    const templateTags = template.tags ?? tags;
+    if (typeof template?.text !== "string" || template.text.length === 0)
+      continue;
+    const templateTags = template.tags ?? found.tags;
     if (personalWorkspaceId) {
       const { data: ovr } = await client.POST("/memories/search", {
-        body: { query: null, textQuery: null, semanticQuery: null, hybrid: false, limit: 1, includeArchived: false, includeSystem: false, tags: ["sechroom:role:override", `sechroom:template-ref:${templateId}`], owner: { type: "Workspace", id: personalWorkspaceId } }
+        body: {
+          query: null,
+          textQuery: null,
+          semanticQuery: null,
+          hybrid: false,
+          limit: 1,
+          includeArchived: false,
+          includeSystem: false,
+          tags: [
+            "sechroom:role:override",
+            `sechroom:template-ref:${templateId}`
+          ],
+          owner: { type: "Workspace", id: personalWorkspaceId }
+        }
       });
       const ovrHits = ovr?.items ?? [];
       if (ovrHits.length > 0) {
         const override = await fetchMemoryFields(cfg, ovrHits[0].id);
         if (typeof override?.text === "string" && override.text.length > 0) {
-          return { title: override.title ?? template.title ?? artifact.title, body: override.text, source: "override", templateId, templateTags, sourceRef: `${ovrHits[0].id}@v${override.version ?? 1}` };
+          return {
+            title: override.title ?? template.title ?? artifact.title,
+            body: override.text,
+            source: "override",
+            templateId,
+            templateTags,
+            resolvedVia: found.via,
+            resolvedTags: found.tags,
+            sourceRef: `${ovrHits[0].id}@v${override.version ?? 1}`
+          };
         }
       }
     }
-    return { title: template.title ?? artifact.title, body: template.text, source: "template", templateId, templateTags, sourceRef: `${templateId}@v${template.version ?? 1}` };
+    return {
+      title: template.title ?? artifact.title,
+      body: template.text,
+      source: "template",
+      templateId,
+      templateTags,
+      resolvedVia: found.via,
+      resolvedTags: found.tags,
+      sourceRef: `${templateId}@v${template.version ?? 1}`
+    };
   }
   return null;
 }
@@ -1152,8 +1224,10 @@ async function resolveWorkspaceConventions(cfg, section) {
     const mem = await fetchMemoryFields(cfg, artifact.id);
     if (typeof mem?.text === "string" && mem.text.trim().length > 0) {
       const ref = `${artifact.id}@v${mem.version ?? 1}`;
-      parts.push(`<!-- @sechroom/cli:section source=${ref} -->
-${mem.text.trim()}`);
+      parts.push(
+        `<!-- @sechroom/cli:section source=${ref} -->
+${mem.text.trim()}`
+      );
       refs.push(ref);
     }
   }
@@ -1165,7 +1239,10 @@ async function createOverride(cfg, template, personalWorkspaceId) {
   const overrideTags = template.templateTags.filter(
     (t) => t !== "sechroom:role:template" && !t.startsWith("sechroom:bundle:") && !t.startsWith("sechroom:template-ref:")
   );
-  overrideTags.push("sechroom:role:override", `sechroom:template-ref:${template.templateId}`);
+  overrideTags.push(
+    "sechroom:role:override",
+    `sechroom:template-ref:${template.templateId}`
+  );
   const { error } = await client.POST("/memories", {
     body: {
       text: template.body,
@@ -1179,7 +1256,8 @@ async function createOverride(cfg, template, personalWorkspaceId) {
       owner: { type: "Workspace", id: personalWorkspaceId }
     }
   });
-  if (error) throw new Error(`creating personal copy failed: ${JSON.stringify(error)}`);
+  if (error)
+    throw new Error(`creating personal copy failed: ${JSON.stringify(error)}`);
 }
 
 // src/setup/skill-resolution.ts
@@ -11702,7 +11780,15 @@ async function applyClient(cfg, setup, target, opts) {
           kind: "instruction",
           path: target.instruction.path,
           status: "skipped",
-          note: "no role template found in this tenant \u2014 install the SEM Starter bundle, then re-run `sechroom setup agent-files`"
+          // Name the block even when nothing resolved. Without it the skip reports a
+          // path and no identity, so a consumer cannot tell WHICH managed block went
+          // missing — absent rather than loud, which is the failure this guards.
+          block: "role-template",
+          // GUARD — an unresolved template must NAME what it looked for. A bare
+          // "not found" reads identically whether the bundle is absent or the memo
+          // was retagged out of every candidate family, and the second case is a
+          // silent loss of a template the installation previously had.
+          note: "no role template resolved \u2014 tried " + attemptedTagSets(section).map((set) => `[${set.join(", ")}]`).join(" then ") + " \u2014 install the SEM Starter bundle, or check the template's target tag, then re-run `sechroom setup agent-files`"
         });
       } else {
         const action = applyBlock(
@@ -12049,8 +12135,17 @@ function buildCheckReport(result) {
     stub: 0
   };
   const blocks = [];
+  const unresolved = [];
   for (const { client, actions } of result) {
     for (const action of actions) {
+      if (action.kind === "instruction" && action.status === "skipped" && !action.eval) {
+        unresolved.push({
+          client,
+          path: action.path,
+          block: action.block ?? "unknown",
+          note: action.note
+        });
+      }
       if (!action.eval) continue;
       counts[action.eval]++;
       blocks.push({
@@ -12064,7 +12159,8 @@ function buildCheckReport(result) {
   return {
     eval: counts,
     wouldChange: counts.stale + counts.drift + counts.absent,
-    blocks
+    blocks,
+    unresolved
   };
 }
 function reportCheckAndExit(result, json, refreshCommand, jsonContext = {}) {
@@ -12079,7 +12175,7 @@ function reportCheckAndExit(result, json, refreshCommand, jsonContext = {}) {
       },
       true
     );
-  } else if (report.wouldChange === 0) {
+  } else if (report.wouldChange === 0 && report.unresolved.length === 0) {
     if (report.eval.stub) {
       const files = report.eval.stub === 1 ? "file" : "files";
       process.stdout.write(
@@ -12091,11 +12187,27 @@ function reportCheckAndExit(result, json, refreshCommand, jsonContext = {}) {
     }
   } else {
     const bits = [];
-    if (report.eval.stale) bits.push(`${report.eval.stale} out of date`);
-    if (report.eval.drift) bits.push(`${report.eval.drift} with local edits`);
-    if (report.eval.absent) bits.push(`${report.eval.absent} not yet written`);
+    if (report.wouldChange > 0) {
+      const changes = [];
+      if (report.eval.stale) changes.push(`${report.eval.stale} out of date`);
+      if (report.eval.drift)
+        changes.push(`${report.eval.drift} with local edits`);
+      if (report.eval.absent)
+        changes.push(`${report.eval.absent} not yet written`);
+      bits.push(
+        `${report.wouldChange} instruction block(s) would change: ${changes.join(", ")}`
+      );
+    }
+    if (report.unresolved.length > 0) {
+      const details = report.unresolved.map(
+        ({ client, path, block, note }) => `${client} ${block} at ${path}${note ? ` \u2014 ${note}` : ""}`
+      ).join("; ");
+      bits.push(
+        `${report.unresolved.length} instruction template(s) skipped or unresolved: ${details}`
+      );
+    }
     process.stderr.write(
-      `\u26A0 ${report.wouldChange} instruction block(s) would change: ${bits.join(", ")}. Run ${style.cyan(refreshCommand)}.
+      `\u26A0 ${bits.join("; ")}. Run ${style.cyan(refreshCommand)}.
 `
     );
   }
@@ -12172,7 +12284,7 @@ function registerInit(program2) {
     false
   ).option(
     "--check",
-    "report whether agent files would change and exit (0 = current/stub, 1 = stale/drift/absent); writes nothing",
+    "report whether agent files would change and exit (0 = current/stub or unresolved warning, 1 = stale/drift/absent); writes nothing",
     false
   ).addHelpText(
     "after",
@@ -12315,7 +12427,7 @@ function registerSetup(program2, deps = {}) {
     false
   ).option(
     "--check",
-    "report whether anything would change and exit (0 = current/stub, 1 = stale/drift/absent); writes nothing",
+    "report whether anything would change and exit (0 = current/stub or unresolved warning, 1 = stale/drift/absent); writes nothing",
     false
   ).addHelpText(
     "after",
@@ -13258,7 +13370,7 @@ function registerOnboard(program2) {
     false
   ).option(
     "--check",
-    "report whether anything would change and exit (0 = current/stub, 1 = stale/drift/absent); writes nothing",
+    "report whether anything would change and exit (0 = current/stub or unresolved warning, 1 = stale/drift/absent); writes nothing",
     false
   ).option(
     "-y, --yes",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.8.3",
+  "version": "2026.8.4",
   "description": "Command-line interface for Sechroom — sign in, wire your AI tools, and work with your sechroom from the terminal.",
   "type": "module",
   "license": "UNLICENSED",