@sechroom/cli 2026.8.4-rc.e38fd260b → 2026.8.4

package/dist/index.js

@@ -642,6 +642,17 @@ function emitAction(summary, data, json) {
   process.stdout.write(`${ok("\u2713")} ${summary}
 `);
 }
+var JSON_NUMBER = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?$/;
+function confidenceWireValue(value) {
+  if (value === null || value === void 0 || value === "") return null;
+  if (typeof value === "number") return Number.isFinite(value) ? value : String(value);
+  const raw = String(value).trim();
+  if (JSON_NUMBER.test(raw)) {
+    const numeric = Number(raw);
+    if (Number.isFinite(numeric)) return numeric;
+  }
+  return String(value);
+}
 var GOVERNANCE_QUEUED_PROBLEM_TYPE = "https://sechroom.dev/problems/governance-review-queued";
 function isGovernanceQueued(body) {
   return typeof body === "object" && body !== null && "type" in body && body.type === GOVERNANCE_QUEUED_PROBLEM_TYPE;
@@ -688,23 +699,57 @@ function formatFailureMessage(error) {
     if (error.cause instanceof Error && error.cause.message) {
       msg += `: ${error.cause.message}`;
     }
-  } else if (typeof error === "object" && error !== null && "title" in error) {
+  } else if (isRecord(error)) {
     const problem = error;
-    msg = String(problem.title);
-    if (problem.errors && typeof problem.errors === "object") {
-      const detail = Object.entries(problem.errors).flatMap(
-        ([field, msgs]) => (Array.isArray(msgs) ? msgs : [msgs]).map((m) => `  ${field}: ${String(m)}`)
-      );
-      if (detail.length > 0) msg += `
-${detail.join("\n")}`;
+    const title = typeof problem.title === "string" && problem.title.length > 0 ? problem.title : void 0;
+    const problemDetail = typeof problem.detail === "string" && problem.detail.length > 0 ? problem.detail : void 0;
+    const fieldErrors = formatProblemErrors(problem.errors);
+    const structuredErrors = fieldErrors.length === 0 ? formatStructuredViolations(problem.violations) : [];
+    const parts = [
+      ...title ? [title] : [],
+      ...problemDetail ? [problemDetail] : [],
+      ...fieldErrors,
+      ...structuredErrors
+    ];
+    if (parts.length > 0) {
+      if (title && !problemDetail && fieldErrors.length === 0 && structuredErrors.length === 0) {
+        parts.push("No additional error detail was returned by the API.");
+      }
+      msg = parts.join("\n");
+    } else {
+      const serialized = JSON.stringify(error);
+      msg = serialized && serialized !== "{}" ? serialized : "The API returned an empty error response.";
     }
-  } else if (typeof error === "object" && error !== null) {
-    msg = JSON.stringify(error);
   } else {
     msg = String(error);
   }
   return msg;
 }
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function formatProblemErrors(errors) {
+  if (!isRecord(errors)) return [];
+  return Object.entries(errors).flatMap(
+    ([field, messages]) => (Array.isArray(messages) ? messages : [messages]).map(
+      (message) => `  ${field}: ${formatErrorValue(message)}`
+    )
+  );
+}
+function formatStructuredViolations(violations) {
+  if (!Array.isArray(violations)) return [];
+  return violations.flatMap((violation) => {
+    if (!isRecord(violation)) return [formatErrorValue(violation)];
+    const field = typeof violation.field === "string" ? violation.field : "validation";
+    const message = typeof violation.message === "string" ? violation.message : formatErrorValue(violation);
+    return [`  ${field}: ${message}`];
+  });
+}
+function formatErrorValue(value) {
+  if (typeof value === "string") return value;
+  const serialized = JSON.stringify(value);
+  return serialized ?? String(value);
+}
 function fail(error) {
   const msg = formatFailureMessage(error);
   process.stderr.write(`error: ${msg}
@@ -1027,14 +1072,19 @@ async function fetchSetup(cfg, namespaceSlug) {
     "/operator-surface/setup",
     hasQuery ? { params: { query } } : {}
   );
-  if (error) throw new Error(`GET /operator-surface/setup failed: ${JSON.stringify(error)}`);
+  if (error)
+    throw new Error(
+      `GET /operator-surface/setup failed: ${JSON.stringify(error)}`
+    );
   return data;
 }
 async function listNamespaces(cfg) {
   const client = await makeClient(cfg);
   const { data } = await client.GET("/mcp-aggregator/namespaces", {});
   const rows = data ?? [];
-  return rows.filter((r) => typeof r.slug === "string").map((r) => ({ slug: r.slug, displayName: r.displayName ?? r.slug }));
+  return rows.filter(
+    (r) => typeof r.slug === "string"
+  ).map((r) => ({ slug: r.slug, displayName: r.displayName ?? r.slug }));
 }
 function findSurface(setup, surfaceKey) {
   return setup.surfaces.find((s) => s.surfaceKey === surfaceKey);
@@ -1050,10 +1100,15 @@ function sectionSnippet(section) {
   }
   return null;
 }
-function parseTagArtifactId(id) {
+function parseTagArtifactCandidates(id) {
   if (!id.startsWith("tag:")) return null;
-  const tags = id.slice("tag:".length).split(",").map((t) => t.trim()).filter((t) => t.length > 0);
-  return tags.length > 0 ? tags : null;
+  const candidates = id.slice("tag:".length).split("|").map(
+    (set) => set.split(",").map((t) => t.trim()).filter((t) => t.length > 0)
+  ).filter((set) => set.length > 0);
+  return candidates.length > 0 ? candidates : null;
+}
+function parseTagArtifactId(id) {
+  return parseTagArtifactCandidates(id)?.[0] ?? null;
 }
 async function getPersonalWorkspaceId(cfg) {
   const client = await makeClient(cfg);
@@ -1062,40 +1117,102 @@ async function getPersonalWorkspaceId(cfg) {
 }
 async function fetchMemoryFields(cfg, id) {
   const client = await makeClient(cfg);
-  const { data } = await client.GET("/memories/{memoryId}", { params: { path: { memoryId: id } } });
+  const { data } = await client.GET("/memories/{memoryId}", {
+    params: { path: { memoryId: id } }
+  });
   const env = data;
   const m = env?.item ?? env;
   if (!m) return null;
   const version = typeof m.currentVersion === "string" ? Number(m.currentVersion) : m.currentVersion;
-  return { text: m.text, title: m.title, tags: m.tags, version: Number.isFinite(version) ? version : void 0 };
+  return {
+    text: m.text,
+    title: m.title,
+    tags: m.tags,
+    version: Number.isFinite(version) ? version : void 0
+  };
 }
-async function resolveInstruction(cfg, section, personalWorkspaceId) {
-  const client = await makeClient(cfg);
-  for (const artifact of section.artifacts) {
-    const tags = parseTagArtifactId(artifact.id);
-    if (!tags) continue;
+async function findTemplateByCandidates(client, candidates) {
+  for (let i = 0; i < candidates.length; i++) {
+    const tags = candidates[i];
     const { data } = await client.POST("/memories/search", {
-      body: { query: null, textQuery: null, semanticQuery: null, hybrid: false, limit: 1, includeArchived: false, includeSystem: false, tags }
+      body: {
+        query: null,
+        textQuery: null,
+        semanticQuery: null,
+        hybrid: false,
+        limit: 1,
+        includeArchived: false,
+        includeSystem: false,
+        tags
+      }
     });
     const hits = data?.items ?? [];
     if (hits.length === 0) continue;
-    const templateId = hits[0].id;
+    return { id: hits[0].id, tags, via: i === 0 ? "preferred" : "fallback" };
+  }
+  return null;
+}
+function attemptedTagSets(section) {
+  return section.artifacts.flatMap(
+    (artifact) => parseTagArtifactCandidates(artifact.id) ?? []
+  );
+}
+async function resolveInstruction(cfg, section, personalWorkspaceId) {
+  const client = await makeClient(cfg);
+  for (const artifact of section.artifacts) {
+    const candidates = parseTagArtifactCandidates(artifact.id);
+    if (!candidates) continue;
+    const found = await findTemplateByCandidates(client, candidates);
+    if (!found) continue;
+    const templateId = found.id;
     const template = await fetchMemoryFields(cfg, templateId);
-    if (typeof template?.text !== "string" || template.text.length === 0) continue;
-    const templateTags = template.tags ?? tags;
+    if (typeof template?.text !== "string" || template.text.length === 0)
+      continue;
+    const templateTags = template.tags ?? found.tags;
     if (personalWorkspaceId) {
       const { data: ovr } = await client.POST("/memories/search", {
-        body: { query: null, textQuery: null, semanticQuery: null, hybrid: false, limit: 1, includeArchived: false, includeSystem: false, tags: ["sechroom:role:override", `sechroom:template-ref:${templateId}`], owner: { type: "Workspace", id: personalWorkspaceId } }
+        body: {
+          query: null,
+          textQuery: null,
+          semanticQuery: null,
+          hybrid: false,
+          limit: 1,
+          includeArchived: false,
+          includeSystem: false,
+          tags: [
+            "sechroom:role:override",
+            `sechroom:template-ref:${templateId}`
+          ],
+          owner: { type: "Workspace", id: personalWorkspaceId }
+        }
       });
       const ovrHits = ovr?.items ?? [];
       if (ovrHits.length > 0) {
         const override = await fetchMemoryFields(cfg, ovrHits[0].id);
         if (typeof override?.text === "string" && override.text.length > 0) {
-          return { title: override.title ?? template.title ?? artifact.title, body: override.text, source: "override", templateId, templateTags, sourceRef: `${ovrHits[0].id}@v${override.version ?? 1}` };
+          return {
+            title: override.title ?? template.title ?? artifact.title,
+            body: override.text,
+            source: "override",
+            templateId,
+            templateTags,
+            resolvedVia: found.via,
+            resolvedTags: found.tags,
+            sourceRef: `${ovrHits[0].id}@v${override.version ?? 1}`
+          };
         }
       }
     }
-    return { title: template.title ?? artifact.title, body: template.text, source: "template", templateId, templateTags, sourceRef: `${templateId}@v${template.version ?? 1}` };
+    return {
+      title: template.title ?? artifact.title,
+      body: template.text,
+      source: "template",
+      templateId,
+      templateTags,
+      resolvedVia: found.via,
+      resolvedTags: found.tags,
+      sourceRef: `${templateId}@v${template.version ?? 1}`
+    };
   }
   return null;
 }
@@ -1107,8 +1224,10 @@ async function resolveWorkspaceConventions(cfg, section) {
     const mem = await fetchMemoryFields(cfg, artifact.id);
     if (typeof mem?.text === "string" && mem.text.trim().length > 0) {
       const ref = `${artifact.id}@v${mem.version ?? 1}`;
-      parts.push(`<!-- @sechroom/cli:section source=${ref} -->
-${mem.text.trim()}`);
+      parts.push(
+        `<!-- @sechroom/cli:section source=${ref} -->
+${mem.text.trim()}`
+      );
       refs.push(ref);
     }
   }
@@ -1120,7 +1239,10 @@ async function createOverride(cfg, template, personalWorkspaceId) {
   const overrideTags = template.templateTags.filter(
     (t) => t !== "sechroom:role:template" && !t.startsWith("sechroom:bundle:") && !t.startsWith("sechroom:template-ref:")
   );
-  overrideTags.push("sechroom:role:override", `sechroom:template-ref:${template.templateId}`);
+  overrideTags.push(
+    "sechroom:role:override",
+    `sechroom:template-ref:${template.templateId}`
+  );
   const { error } = await client.POST("/memories", {
     body: {
       text: template.body,
@@ -1134,7 +1256,8 @@ async function createOverride(cfg, template, personalWorkspaceId) {
       owner: { type: "Workspace", id: personalWorkspaceId }
     }
   });
-  if (error) throw new Error(`creating personal copy failed: ${JSON.stringify(error)}`);
+  if (error)
+    throw new Error(`creating personal copy failed: ${JSON.stringify(error)}`);
 }
 
 // src/setup/skill-resolution.ts
@@ -4366,9 +4489,19 @@ import { dirname as dirname5, join as join7 } from "path";
 function claudeDesktopConfigPath(home) {
   switch (process.platform) {
     case "darwin":
-      return join7(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+      return join7(
+        home,
+        "Library",
+        "Application Support",
+        "Claude",
+        "claude_desktop_config.json"
+      );
     case "win32":
-      return join7(process.env.APPDATA ?? join7(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
+      return join7(
+        process.env.APPDATA ?? join7(home, "AppData", "Roaming"),
+        "Claude",
+        "claude_desktop_config.json"
+      );
     default:
       return join7(home, ".config", "Claude", "claude_desktop_config.json");
   }
@@ -4376,30 +4509,53 @@ function claudeDesktopConfigPath(home) {
 function clientTargets(cwd, opts = {}) {
   const home = homedir3();
   const claudeDir = opts.claudeDir ?? join7(home, ".claude");
-  const codexHome = opts.codexHome ?? join7(home, ".codex");
+  const codexHome = opts.codexHome === void 0 ? join7(home, ".codex") : opts.codexHome;
   return {
     "claude-code": {
       key: "claude-code",
       label: "Claude Code",
-      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join7(cwd, ".mcp.json"), format: "json" },
+      mcp: {
+        surfaceKey: "claude-code",
+        sectionType: SectionType.McpConfig,
+        path: join7(cwd, ".mcp.json"),
+        format: "json"
+      },
       instruction: { surfaceKey: "claude-code", path: join7(cwd, "CLAUDE.md") }
     },
     "claude-desktop": {
       key: "claude-desktop",
       label: "Claude Desktop",
-      mcp: { surfaceKey: "claude-desktop", sectionType: SectionType.McpConfig, path: claudeDesktopConfigPath(home), format: "json" },
-      instruction: { surfaceKey: "claude-desktop", path: join7(claudeDir, "CLAUDE.md") }
+      mcp: {
+        surfaceKey: "claude-desktop",
+        sectionType: SectionType.McpConfig,
+        path: claudeDesktopConfigPath(home),
+        format: "json"
+      },
+      instruction: {
+        surfaceKey: "claude-desktop",
+        path: join7(claudeDir, "CLAUDE.md")
+      }
     },
     codex: {
       key: "codex",
       label: "Codex CLI",
-      mcp: { surfaceKey: "chatgpt", sectionType: SectionType.McpConfigToml, path: join7(codexHome, "config.toml"), format: "toml" },
+      mcp: codexHome ? {
+        surfaceKey: "chatgpt",
+        sectionType: SectionType.McpConfigToml,
+        path: join7(codexHome, "config.toml"),
+        format: "toml"
+      } : null,
       instruction: { surfaceKey: "chatgpt", path: join7(cwd, "AGENTS.md") }
     },
     cursor: {
       key: "cursor",
       label: "Cursor",
-      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join7(cwd, ".cursor", "mcp.json"), format: "json" },
+      mcp: {
+        surfaceKey: "claude-code",
+        sectionType: SectionType.McpConfig,
+        path: join7(cwd, ".cursor", "mcp.json"),
+        format: "json"
+      },
       instruction: { surfaceKey: "chatgpt", path: join7(cwd, "AGENTS.md") }
     },
     antigravity: {
@@ -4411,20 +4567,34 @@ function clientTargets(cwd, opts = {}) {
       // `type` — comes from the `antigravity` server surface, so we don't
       // hardcode it here. Instructions go in the project `AGENTS.md`
       // (cross-tool, shared with Codex/Cursor).
-      mcp: { surfaceKey: "antigravity", sectionType: SectionType.McpConfig, path: join7(home, ".gemini", "config", "mcp_config.json"), format: "json" },
+      mcp: {
+        surfaceKey: "antigravity",
+        sectionType: SectionType.McpConfig,
+        path: join7(home, ".gemini", "config", "mcp_config.json"),
+        format: "json"
+      },
       instruction: { surfaceKey: "antigravity", path: join7(cwd, "AGENTS.md") }
     }
   };
 }
-var ALL_CLIENT_KEYS = ["claude-code", "claude-desktop", "codex", "cursor", "antigravity"];
+var ALL_CLIENT_KEYS = [
+  "claude-code",
+  "claude-desktop",
+  "codex",
+  "cursor",
+  "antigravity"
+];
 var DEFAULT_CLIENT_KEY = "claude-code";
 function detectInstalledClients(cwd) {
   const home = homedir3();
   const detected = [];
-  if (resolveClaudeTargets({}).some((t) => existsSync5(t.dir))) detected.push("claude-code");
-  if (existsSync5(dirname5(claudeDesktopConfigPath(home)))) detected.push("claude-desktop");
+  if (resolveClaudeTargets({}).some((t) => existsSync5(t.dir)))
+    detected.push("claude-code");
+  if (existsSync5(dirname5(claudeDesktopConfigPath(home))))
+    detected.push("claude-desktop");
   if (resolveCodexHomes({}).some((d) => existsSync5(d))) detected.push("codex");
-  if (existsSync5(join7(home, ".cursor")) || existsSync5(join7(cwd, ".cursor"))) detected.push("cursor");
+  if (existsSync5(join7(home, ".cursor")) || existsSync5(join7(cwd, ".cursor")))
+    detected.push("cursor");
   if (existsSync5(join7(home, ".gemini"))) detected.push("antigravity");
   return detected;
 }
@@ -5751,6 +5921,7 @@ Call sechroom_lifecycle_signal at each phase boundary (start/work/verify/closeou
 }
 
 // src/commands/executor.ts
+var DEFAULT_CLAIM_POLICY = "restricted";
 function executorSubscriptionInput(name) {
   return {
     name,
@@ -5812,8 +5983,8 @@ function registerExecutor(program2) {
     "Capability operation keys claimed by this instance"
   ).option(
     "--claim-policy <policy>",
-    "open | restricted (restricted only claims preferred/own-lane/allow-listed-tag work)",
-    "open"
+    "open | restricted (restricted only claims preferred/own-lane/allow-listed-tag work; default restricted)",
+    DEFAULT_CLAIM_POLICY
   ).option(
     "--claim-tag <tag...>",
     "Task tag this instance accepts under --claim-policy restricted"
@@ -5828,7 +5999,12 @@ function registerExecutor(program2) {
     "--subscription-name <name>",
     "SignalR delivery binding name",
     "executor-dispatch"
-  ).option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 600).option(
+  ).option(
+    "--ttl <seconds>",
+    "Advertisement TTL (30 to tenant maximum)",
+    parseInteger,
+    600
+  ).option(
     "--task-lease-ttl <seconds>",
     "Task lease TTL (60-86400)",
     parseInteger,
@@ -5915,7 +6091,7 @@ function registerExecutor(program2) {
       taskLeaseTtlSeconds: opts.taskLeaseTtl,
       modelId: opts.modelId,
       effortLabel: opts.effortLabel,
-      claimPolicy: (opts.claimPolicy ?? "open").toLowerCase() === "restricted" ? "restricted" : "open",
+      claimPolicy: parseClaimPolicy(opts.claimPolicy) === "Restricted" ? "restricted" : "open",
       claimTags: opts.claimTag ?? [],
       excludeTags: opts.excludeTag ?? [],
       relayId: opts.relay,
@@ -6036,8 +6212,8 @@ function registerExecutor(program2) {
     "Capability operation keys claimed by this instance"
   ).option(
     "--claim-policy <policy>",
-    "open | restricted (restricted only claims preferred/own-lane/allow-listed-tag work)",
-    "open"
+    "open | restricted (restricted only claims preferred/own-lane/allow-listed-tag work; default restricted)",
+    DEFAULT_CLAIM_POLICY
   ).option(
     "--claim-tag <tag...>",
     "Task tag this instance accepts under --claim-policy restricted"
@@ -6048,7 +6224,12 @@ function registerExecutor(program2) {
     "--activation-mode <mode>",
     "attached | detached \u2014 detached marks a fleet run as a service that outlives its shell (default attached)",
     "attached"
-  ).option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).option(
+  ).option(
+    "--ttl <seconds>",
+    "Advertisement TTL (30 to tenant maximum)",
+    parseInteger,
+    120
+  ).option(
     "--task-lease-ttl <seconds>",
     "Task lease TTL (60-86400)",
     parseInteger,
@@ -6104,7 +6285,12 @@ function registerExecutor(program2) {
 `)
       );
   });
-  executor.command("refresh <id>").description("Refresh one advertisement lease once").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).action(async (id, opts, cmd) => {
+  executor.command("refresh <id>").description("Refresh one advertisement lease once").option(
+    "--ttl <seconds>",
+    "Advertisement TTL (30 to tenant maximum)",
+    parseInteger,
+    120
+  ).action(async (id, opts, cmd) => {
     const data = await refreshExecutorInstance(
       resolveConfig(cmd.optsWithGlobals()),
       id,
@@ -6112,7 +6298,12 @@ function registerExecutor(program2) {
     );
     emit(data, Boolean(cmd.optsWithGlobals().json));
   });
-  executor.command("heartbeat <id>").description("Keep an advertisement alive until interrupted").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).option("--interval <seconds>", "Refresh interval", parseInteger, 40).action(async (id, opts, cmd) => {
+  executor.command("heartbeat <id>").description("Keep an advertisement alive until interrupted").option(
+    "--ttl <seconds>",
+    "Advertisement TTL (30 to tenant maximum)",
+    parseInteger,
+    120
+  ).option("--interval <seconds>", "Refresh interval", parseInteger, 40).action(async (id, opts, cmd) => {
     if (opts.interval >= opts.ttl)
       fail("heartbeat interval must be shorter than the TTL");
     const cfg = resolveConfig(cmd.optsWithGlobals());
@@ -6274,12 +6465,12 @@ function parseRuntimeKind(value) {
   }
 }
 function parseClaimPolicy(value) {
-  switch ((value ?? "open").trim().toLowerCase()) {
+  switch ((value ?? DEFAULT_CLAIM_POLICY).trim().toLowerCase()) {
     case "":
-    case "open":
-      return "Open";
     case "restricted":
       return "Restricted";
+    case "open":
+      return "Open";
     default:
       return fail("claim-policy must be open or restricted");
   }
@@ -7607,6 +7798,7 @@ function resolveLane(flagLane, cwd) {
   return applyWorktreeLaneSuffix(base, start);
 }
 var INTENT_FILE = join15(".sechroom", "continuity.json");
+var LOCAL_DRY_RUN_VALIDATION_WARNING = "LOCAL-ONLY \u2014 NOT SERVER-VALIDATED";
 function resolveIntentPath(start) {
   let dir = start;
   for (; ; ) {
@@ -7631,6 +7823,16 @@ function hasRequiredIntent(i) {
     i.objective?.trim() && i.state?.trim() && i.lastAction?.trim() && i.nextAction?.trim() && i.resumeInstruction?.trim()
   );
 }
+function localDryRunMissingFields(i) {
+  const required = [
+    ["objective", "--objective"],
+    ["state", "--state"],
+    ["lastAction", "--last-action"],
+    ["nextAction", "--next-action"],
+    ["resumeInstruction", "--resume-instruction"]
+  ];
+  return required.filter(([key]) => !String(i[key] ?? "").trim()).map(([, flag]) => flag);
+}
 async function saveSnapshotFromIntent(cmd, cwd, laneFlag, scopeFlag, defaultScope, opts) {
   const lane = resolveLane(laneFlag, cwd);
   if (!lane) return false;
@@ -7652,7 +7854,9 @@ async function saveSnapshotFromIntent(cmd, cwd, laneFlag, scopeFlag, defaultScop
       openQuestions: intent.questions ?? null,
       surfaceMarkers: intent.surfaceMarkers ?? null,
       relevantArtifactIds: intent.artifacts ?? null,
-      confidence: intent.confidence ?? null,
+      // Preserve invalid JSON-string confidence tokens for the server's semantic
+      // validator; never coerce them through Number/NaN/null.
+      confidence: confidenceWireValue(intent.confidence),
       // Frequent triggers (compaction, session-end) land within the FR-051 4h
       // window; Acknowledge lets the checkpoint persist on the lane.
       concurrentSessionPolicy: "Acknowledge"
@@ -7947,12 +8151,18 @@ Fail-soft: failures exit 0 and never block; session-context refresh failures ren
 function registerCheckpoint(program2) {
   program2.command("checkpoint").description(
     "Checkpoint working state: create a continuity snapshot (server-validated) AND sync ./.sechroom/continuity.json in one step"
-  ).option("--lane <laneId>", "Lane id (else SECHROOM_LANE, else ./.sechroom/lane.json code-lane)").option("--scope <scope>", "Snapshot scope (else the file's scope, else 'session')").option("--objective <text>", "Current objective").option("--state <text>", "Current state").option("--last-action <text>", "Last meaningful action").option("--next-action <text>", "Next intended action").option("--resume-instruction <text>", "Resume instruction").option("--constraint <text...>", "Active constraints (repeatable)").option("--question <text...>", "Open questions (repeatable)").option("--surface-marker <text...>", "Surface markers (repeatable)").option("--artifact <id...>", "Relevant artifact ids (repeatable)").option("--confidence <n>", "Confidence 0..1").option("--dry-run", "validate + print the snapshot payload without creating it or writing the file", false).addHelpText(
+  ).option("--lane <laneId>", "Lane id (else SECHROOM_LANE, else ./.sechroom/lane.json code-lane)").option("--scope <scope>", "Snapshot scope (else the file's scope, else 'session')").option("--objective <text>", "Current objective").option("--state <text>", "Current state").option("--last-action <text>", "Last meaningful action").option("--next-action <text>", "Next intended action").option("--resume-instruction <text>", "Resume instruction").option("--constraint <text...>", "Active constraints (repeatable)").option("--question <text...>", "Open questions (repeatable)").option("--surface-marker <text...>", "Surface markers (repeatable)").option("--artifact <id...>", "Relevant artifact ids (repeatable)").option("--confidence <n>", "Confidence 0..1").option(
+    "--dry-run",
+    "run the local required-field check and print the payload (LOCAL-ONLY; NOT SERVER-VALIDATED)",
+    false
+  ).addHelpText(
     "after",
     `
 File-first: reads ./.sechroom/continuity.json (kept current as you work) as the base; any flag
 overrides that field. The snapshot is created FIRST (server-validated), then the local file is
 written/normalized with the returned snapshotId. Lane: --lane > SECHROOM_LANE > ./.sechroom/lane.json code-lane.
+--dry-run performs only the local required-field check and prints a payload. Its output is
+explicitly LOCAL-ONLY; NOT SERVER-VALIDATED, so it does not establish write-path parity.
 
 Examples:
   $ sechroom checkpoint                          snapshot from ./.sechroom/continuity.json, then sync it
@@ -7975,7 +8185,9 @@ Examples:
       questions: opts.question ?? base.questions,
       surfaceMarkers: opts.surfaceMarker ?? base.surfaceMarkers,
       artifacts: opts.artifact ?? base.artifacts,
-      confidence: opts.confidence != null ? Number(opts.confidence) : base.confidence
+      // Keep the raw token until the server's shared validator sees it. In particular,
+      // Number("high") -> NaN -> JSON null would silently discard the operator's input.
+      confidence: opts.confidence != null ? opts.confidence : base.confidence
     };
     const lane = resolveLane(opts.lane, cwd);
     if (!lane) {
@@ -7983,19 +8195,6 @@ Examples:
         "no lane resolved \u2014 pass --lane, set SECHROOM_LANE, or pin one in ./.sechroom/lane.json (code-lane). See `sechroom lane`."
       );
     }
-    const required = [
-      ["objective", "--objective"],
-      ["state", "--state"],
-      ["lastAction", "--last-action"],
-      ["nextAction", "--next-action"],
-      ["resumeInstruction", "--resume-instruction"]
-    ];
-    const missing = required.filter(([k]) => !String(merged[k] ?? "").trim()).map(([, flag]) => flag);
-    if (missing.length > 0) {
-      fail(
-        `missing required field(s): ${missing.join(", ")} \u2014 supply via flag or in ./.sechroom/continuity.json`
-      );
-    }
     const scope = merged.scope ?? "session";
     const body = {
       laneId: lane,
@@ -8009,13 +8208,33 @@ Examples:
       openQuestions: merged.questions ?? null,
       surfaceMarkers: merged.surfaceMarkers ?? null,
       relevantArtifactIds: merged.artifacts ?? null,
-      confidence: merged.confidence ?? null,
+      confidence: confidenceWireValue(merged.confidence),
       // Explicit checkpoints are often within the FR-051 4h window; Acknowledge
       // lets one land on the lane (matches `hook pre-compact`).
       concurrentSessionPolicy: "Acknowledge"
     };
     if (opts.dryRun) {
-      emit({ dryRun: true, lane, scope, wouldCreate: body }, json);
+      const missing = localDryRunMissingFields(merged);
+      if (missing.length > 0) {
+        fail(
+          `LOCAL-ONLY CHECK \u2014 NOT SERVER-VALIDATED: missing required field(s): ${missing.join(", ")} \u2014 supply via flag or in ./.sechroom/continuity.json`
+        );
+      }
+      emit(
+        {
+          dryRun: true,
+          validation: {
+            mode: "local-only",
+            serverValidated: false,
+            checks: ["required-fields"],
+            warning: LOCAL_DRY_RUN_VALIDATION_WARNING
+          },
+          lane,
+          scope,
+          wouldCreate: body
+        },
+        json
+      );
       return;
     }
     const data = await runApi("Creating snapshot", async () => {
@@ -8252,7 +8471,7 @@ Displaced snapshot recovery surfaces:
           openQuestions: opts.question ?? null,
           surfaceMarkers: opts.surfaceMarker ?? null,
           relevantArtifactIds: opts.artifact ?? null,
-          confidence: opts.confidence != null ? Number(opts.confidence) : null
+          confidence: confidenceWireValue(opts.confidence)
         }
       });
     });
@@ -8401,6 +8620,96 @@ function snapshotGetNotFoundHint(includeAll, status) {
 
 // src/commands/work-plan.ts
 import { readFile as readFile2 } from "fs/promises";
+
+// src/paging.ts
+var MAX_AUTO_PAGES = 100;
+var asNumber = (value) => value === void 0 || value === "" ? void 0 : Number(value);
+function shouldAutoPage(opts) {
+  if (opts.autoPage === false) return false;
+  return asNumber(opts.page) === void 0;
+}
+function singlePageQuery(opts) {
+  const page = asNumber(opts.page);
+  const pageSize = asNumber(opts.pageSize);
+  return {
+    ...page === void 0 ? {} : { page },
+    ...pageSize === void 0 ? {} : { pageSize }
+  };
+}
+async function fetchAllPages(fetchPage, opts = {}, label = "results") {
+  const pages = [];
+  let page = 1;
+  let truncated = false;
+  for (; ; ) {
+    const current = await fetchPage(page);
+    pages.push(current);
+    if (!hasNextPage(current)) break;
+    if (pages.length >= MAX_AUTO_PAGES) {
+      truncated = true;
+      break;
+    }
+    page = current.page + 1;
+  }
+  const first = pages[0];
+  if (!first) throw new Error("paged read returned no envelope at all");
+  if (truncated) {
+    if (!isQuiet()) {
+      process.stderr.write(
+        `${warn("!")} Stopped after ${MAX_AUTO_PAGES} pages \u2014 more ${label} remain. ${style.dim("Narrow the filters, or read a specific window with --page/--page-size.")}
+`
+      );
+    }
+    const partial = pages.flatMap((p) => p.items);
+    return {
+      ...first,
+      items: partial,
+      page: 1,
+      pageSize: partial.length,
+      // Pages OF THIS SIZE, so the number stays consistent with the pageSize just reported.
+      pageCount: partial.length === 0 ? 1 : Math.ceil(first.count / partial.length),
+      hasPreviousPage: false,
+      hasNextPage: true,
+      isFirstPage: true,
+      isLastPage: false,
+      firstItemOnPage: partial.length === 0 ? 0 : 1,
+      lastItemOnPage: partial.length
+    };
+  }
+  if (pages.length === 1) return first;
+  const items = pages.flatMap((current) => current.items);
+  return {
+    ...first,
+    items,
+    page: 1,
+    pageSize: items.length,
+    pageCount: 1,
+    hasPreviousPage: false,
+    hasNextPage: false,
+    isFirstPage: true,
+    isLastPage: true,
+    firstItemOnPage: items.length === 0 ? 0 : 1,
+    lastItemOnPage: items.length
+  };
+}
+function hasNextPage(current) {
+  if (current.hasNextPage !== void 0) return current.hasNextPage;
+  if (current.pageCount !== void 0) return current.page < current.pageCount;
+  return current.page * current.pageSize < current.count;
+}
+var PAGE_OPTION = [
+  "--page <n>",
+  "Page number (reads only that page instead of all)"
+];
+var PAGE_SIZE_OPTION = [
+  "--page-size <n>",
+  "Page size used while paging"
+];
+var NO_AUTO_PAGE_OPTION = [
+  "--no-auto-page",
+  "Read only the first page instead of walking every page"
+];
+
+// src/commands/work-plan.ts
 function registerWorkPlan(program2) {
   const workPlan = program2.command("work-plan").description(
     "Drive a work plan: create one from a brief, then execute / accept / reject"
@@ -8594,22 +8903,27 @@ Examples:
       globals.json
     );
   });
-  workPlan.command("list").description("List work plans, newest-first (GET /decompositions)").option("--status <status>", "Filter by decomposition status").option("--brief <briefId>", "Filter by work-brief memory id").option("--page <n>", "1-based page number", (v) => Number.parseInt(v, 10)).option("--page-size <n>", "Page size", (v) => Number.parseInt(v, 10)).action(async (opts, cmd) => {
+  workPlan.command("list").description(
+    "List work plans, newest-first (GET /decompositions). Walks every page by default."
+  ).option("--status <status>", "Filter by decomposition status").option("--brief <briefId>", "Filter by work-brief memory id").option(...PAGE_OPTION).option(...PAGE_SIZE_OPTION).option(...NO_AUTO_PAGE_OPTION).action(async (opts, cmd) => {
     const globals = cmd.optsWithGlobals();
     const cfg = resolveConfig(globals);
-    const data = await runApi("Listing work plans", async () => {
+    const readPage = (query) => runApi("Listing work plans", async () => {
       const client = await makeClient(cfg);
       return client.GET("/decompositions", {
         params: {
-          query: {
-            status: opts.status,
-            briefId: opts.brief,
-            page: opts.page,
-            pageSize: opts.pageSize
-          }
+          query: { status: opts.status, briefId: opts.brief, ...query }
         }
       });
     });
+    const data = shouldAutoPage(opts) ? await fetchAllPages(
+      (page) => readPage({
+        page,
+        ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
+      }),
+      opts,
+      "work plans"
+    ) : await readPage(singlePageQuery(opts));
     emitAction(
       `listed ${style.bold(String(data.items.length))} of ${data.count} work plan(s)`,
       data,
@@ -8697,35 +9011,53 @@ Examples:
   $ sechroom filing reject fsg_XXXX --reason "wrong workspace"
   $ sechroom filing edit-and-accept fsg_XXXX --target-kind Workspace --existing-target-id wsp_XXXX`
   );
-  filing.command("suggestions").description("List filing suggestions (GET /filing/suggestions)").option("--memory-id <memoryId>", "Filter to a single memory's suggestions").option(
+  filing.command("suggestions").description(
+    "List filing suggestions (GET /filing/suggestions). Walks every page by default."
+  ).option("--memory-id <memoryId>", "Filter to a single memory's suggestions").option(
     "--status <status>",
     "Generating | Pending | Accepted | Rejected | EditedAndAccepted | Deferred | Invalidated"
-  ).option("--page <n>", "Page number").option("--page-size <n>", "Page size").action(async (opts, cmd) => {
+  ).option(...PAGE_OPTION).option(...PAGE_SIZE_OPTION).option(...NO_AUTO_PAGE_OPTION).action(async (opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Listing filing suggestions", async () => {
+    const filters = {
+      ...opts.memoryId ? { memoryId: opts.memoryId } : {},
+      ...opts.status ? {
+        status: opts.status
+      } : {}
+    };
+    const readPage = (query) => runApi("Listing filing suggestions", async () => {
       const client = await makeClient(cfg);
       return client.GET("/filing/suggestions", {
-        params: {
-          query: {
-            ...opts.memoryId ? { memoryId: opts.memoryId } : {},
-            ...opts.status ? { status: opts.status } : {},
-            ...opts.page ? { page: Number(opts.page) } : {},
-            ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
-          }
-        }
+        params: { query: { ...filters, ...query } }
       });
     });
+    const data = shouldAutoPage(opts) ? await fetchAllPages(
+      (page) => readPage({
+        page,
+        ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
+      }),
+      opts,
+      "filing suggestions"
+    ) : await readPage(singlePageQuery(opts));
     emit(data, cmd.optsWithGlobals().json);
   });
-  filing.command("get <id>").description("Fetch a filing suggestion by id (GET /filing/suggestions/{id})").action(async (id, _opts, cmd) => {
+  filing.command("get <id>").description(
+    "Fetch a filing suggestion by id (GET /filing/suggestions/{id})"
+  ).action(async (id, _opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Fetching filing suggestion", async () => {
       const client = await makeClient(cfg);
-      return client.GET("/filing/suggestions/{id}", { params: { path: { id } } });
+      return client.GET("/filing/suggestions/{id}", {
+        params: { path: { id } }
+      });
     });
     emit(data, cmd.optsWithGlobals().json);
   });
-  filing.command("preview").description("Preview a filing suggestion for a memory id or ad-hoc shape (POST /filing/suggestions/preview)").option("--memory-id <memoryId>", "Preview filing for an existing memory").option("--text <text>", "Ad-hoc memory body text (instead of --memory-id)").option("--title <title>", "Ad-hoc memory title").option("--tag <tag...>", "Ad-hoc memory tags (repeatable)").option("--type <type>", "Ad-hoc memory type", "reference").option("--scope-workspace <workspaceId>", "Scope the preview to a workspace").action(async (opts, cmd) => {
+  filing.command("preview").description(
+    "Preview a filing suggestion for a memory id or ad-hoc shape (POST /filing/suggestions/preview)"
+  ).option("--memory-id <memoryId>", "Preview filing for an existing memory").option("--text <text>", "Ad-hoc memory body text (instead of --memory-id)").option("--title <title>", "Ad-hoc memory title").option("--tag <tag...>", "Ad-hoc memory tags (repeatable)").option("--type <type>", "Ad-hoc memory type", "reference").option(
+    "--scope-workspace <workspaceId>",
+    "Scope the preview to a workspace"
+  ).action(async (opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const memory = opts.text ? {
       text: opts.text,
@@ -8745,15 +9077,26 @@ Examples:
     });
     emit(data, cmd.optsWithGlobals().json);
   });
-  filing.command("accept <id>").description("Accept a filing suggestion (POST /filing/suggestions/{id}/accept)").action(async (id, _opts, cmd) => {
+  filing.command("accept <id>").description(
+    "Accept a filing suggestion (POST /filing/suggestions/{id}/accept)"
+  ).action(async (id, _opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Accepting filing suggestion", async () => {
       const client = await makeClient(cfg);
-      return client.POST("/filing/suggestions/{id}/accept", { params: { path: { id } }, body: {} });
+      return client.POST("/filing/suggestions/{id}/accept", {
+        params: { path: { id } },
+        body: {}
+      });
     });
-    emitAction(`accepted filing suggestion ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+    emitAction(
+      `accepted filing suggestion ${style.bold(id)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
-  filing.command("reject <id>").description("Reject a filing suggestion (POST /filing/suggestions/{id}/reject)").option("--reason <reason>", "Why the suggestion was rejected").option("--reason-code <code>", "Structured reason code").action(async (id, opts, cmd) => {
+  filing.command("reject <id>").description(
+    "Reject a filing suggestion (POST /filing/suggestions/{id}/reject)"
+  ).option("--reason <reason>", "Why the suggestion was rejected").option("--reason-code <code>", "Structured reason code").action(async (id, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Rejecting filing suggestion", async () => {
       const client = await makeClient(cfg);
@@ -8765,9 +9108,18 @@ Examples:
         }
       });
     });
-    emitAction(`rejected filing suggestion ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+    emitAction(
+      `rejected filing suggestion ${style.bold(id)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
-  filing.command("defer <id>").description("Defer a filing suggestion (POST /filing/suggestions/{id}/defer)").option("--until <iso>", "Defer until an ISO-8601 timestamp (defaults to indefinite)").action(async (id, opts, cmd) => {
+  filing.command("defer <id>").description(
+    "Defer a filing suggestion (POST /filing/suggestions/{id}/defer)"
+  ).option(
+    "--until <iso>",
+    "Defer until an ISO-8601 timestamp (defaults to indefinite)"
+  ).action(async (id, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Deferring filing suggestion", async () => {
       const client = await makeClient(cfg);
@@ -8776,25 +9128,44 @@ Examples:
         body: { until: opts.until ?? null }
       });
     });
-    emitAction(`deferred filing suggestion ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+    emitAction(
+      `deferred filing suggestion ${style.bold(id)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
-  filing.command("edit-and-accept <id>").description("Override the target then accept (POST /filing/suggestions/{id}/edit-and-accept)").option("--target-kind <kind>", "Workspace | Project").option("--existing-target-id <id>", "File into an existing workspace/project").option("--new-name <name>", "Create a new target with this name").option("--new-description <text>", "Description for the new target").option("--new-parent-workspace <workspaceId>", "Parent workspace for a new project").option("--memory-id <memoryId...>", "Override the memory set (repeatable)").action(async (id, opts, cmd) => {
+  filing.command("edit-and-accept <id>").description(
+    "Override the target then accept (POST /filing/suggestions/{id}/edit-and-accept)"
+  ).option("--target-kind <kind>", "Workspace | Project").option(
+    "--existing-target-id <id>",
+    "File into an existing workspace/project"
+  ).option("--new-name <name>", "Create a new target with this name").option("--new-description <text>", "Description for the new target").option(
+    "--new-parent-workspace <workspaceId>",
+    "Parent workspace for a new project"
+  ).option("--memory-id <memoryId...>", "Override the memory set (repeatable)").action(async (id, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Editing and accepting filing suggestion", async () => {
-      const client = await makeClient(cfg);
-      return client.POST("/filing/suggestions/{id}/edit-and-accept", {
-        params: { path: { id } },
-        body: {
-          targetKind: opts.targetKind ?? null,
-          existingTargetId: opts.existingTargetId ?? null,
-          newName: opts.newName ?? null,
-          newDescription: opts.newDescription ?? null,
-          newParentWorkspaceId: opts.newParentWorkspace ?? null,
-          overrideMemoryIds: opts.memoryId ?? null
-        }
-      });
-    });
-    emitAction(`edited & accepted filing suggestion ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+    const data = await runApi(
+      "Editing and accepting filing suggestion",
+      async () => {
+        const client = await makeClient(cfg);
+        return client.POST("/filing/suggestions/{id}/edit-and-accept", {
+          params: { path: { id } },
+          body: {
+            targetKind: opts.targetKind ?? null,
+            existingTargetId: opts.existingTargetId ?? null,
+            newName: opts.newName ?? null,
+            newDescription: opts.newDescription ?? null,
+            newParentWorkspaceId: opts.newParentWorkspace ?? null,
+            overrideMemoryIds: opts.memoryId ?? null
+          }
+        });
+      }
+    );
+    emitAction(
+      `edited & accepted filing suggestion ${style.bold(id)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
 }
 
@@ -10117,6 +10488,18 @@ function resolveCreateBody(textOpt, fileOpt) {
   );
   return { text: text2, defaultTitle };
 }
+async function fetchAllMemoryRelationships(cfg, memoryId) {
+  return await fetchAllPages(
+    (page) => runApi(`Fetching relationships (page ${page})`, async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/memories/{memoryId}/relationships", {
+        params: { path: { memoryId }, query: { page } }
+      });
+    }),
+    {},
+    "relationships"
+  );
+}
 function registerMemory(program2) {
   const memory = program2.command("memory").description("Create, read, and search memories");
   memory.addHelpText(
@@ -10371,7 +10754,16 @@ ${plan.rows.map(
       false
     );
   });
-  memory.command("get <memoryId>").description("Fetch a memory by id (GET /memories/{memoryId})").action(async (memoryId, _opts, cmd) => {
+  const get = memory.command("get <memoryId>").description("Fetch a memory by id (GET /memories/{memoryId})").option(
+    "--with-relationships",
+    "Include the memory's relationships in the response",
+    false
+  ).addHelpText(
+    "after",
+    `
+Note: CLI memory get omits relationships by default; MCP get_memory includes them. Use --with-relationships to read all relationship pages, or relationship list <memoryId> to inspect edges.`
+  );
+  get.action(async (memoryId, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Fetching memory", async () => {
       const client = await makeClient(cfg);
@@ -10379,6 +10771,11 @@ ${plan.rows.map(
         params: { path: { memoryId } }
       });
     });
+    if (opts.withRelationships) {
+      const relationships = await fetchAllMemoryRelationships(cfg, memoryId);
+      emit({ ...data, relationships }, cmd.optsWithGlobals().json);
+      return;
+    }
     emit(data, cmd.optsWithGlobals().json);
   });
   memory.command("search <query>").description(
@@ -10601,21 +10998,28 @@ ${plan.rows.map(
       cmd.optsWithGlobals().json
     );
   });
-  memory.command("list-archived").description("List archived memories (GET /memories/archived)").option("--workspace <workspaceId>", "Scope to a workspace").option("--project <projectId>", "Scope to a project").option("--page <n>", "Page number").option("--page-size <n>", "Page size").action(async (opts, cmd) => {
+  memory.command("list-archived").description(
+    "List archived memories (GET /memories/archived). Walks every page by default."
+  ).option("--workspace <workspaceId>", "Scope to a workspace").option("--project <projectId>", "Scope to a project").option(...PAGE_OPTION).option(...PAGE_SIZE_OPTION).option(...NO_AUTO_PAGE_OPTION).action(async (opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Listing archived memories", async () => {
+    const filters = {
+      ...opts.workspace ? { workspaceId: opts.workspace } : {},
+      ...opts.project ? { projectId: opts.project } : {}
+    };
+    const readPage = (query) => runApi("Listing archived memories", async () => {
       const client = await makeClient(cfg);
       return client.GET("/memories/archived", {
-        params: {
-          query: {
-            ...opts.workspace ? { workspaceId: opts.workspace } : {},
-            ...opts.project ? { projectId: opts.project } : {},
-            ...opts.page ? { page: Number(opts.page) } : {},
-            ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
-          }
-        }
+        params: { query: { ...filters, ...query } }
       });
     });
+    const data = shouldAutoPage(opts) ? await fetchAllPages(
+      (page) => readPage({
+        page,
+        ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
+      }),
+      opts,
+      "archived memories"
+    ) : await readPage(singlePageQuery(opts));
     emit(data, cmd.optsWithGlobals().json);
   });
   memory.command("versions <memoryId>").description("List a memory's versions (GET /memories/{memoryId}/versions)").action(async (memoryId, _opts, cmd) => {
@@ -10726,8 +11130,18 @@ ${plan.rows.map(
 }
 
 // src/setup/apply.ts
-import { createHash as createHash5 } from "crypto";
-import { mkdirSync as mkdirSync16, readFileSync as readFileSync16, writeFileSync as writeFileSync15, existsSync as existsSync13 } from "fs";
+import { createHash as createHash5, randomUUID as randomUUID3 } from "crypto";
+import {
+  chmodSync as chmodSync2,
+  copyFileSync,
+  existsSync as existsSync13,
+  mkdirSync as mkdirSync16,
+  readFileSync as readFileSync16,
+  renameSync as renameSync4,
+  rmSync as rmSync7,
+  statSync as statSync5,
+  writeFileSync as writeFileSync15
+} from "fs";
 import { dirname as dirname15 } from "path";
 var MARKER_BEGIN = "<!-- @sechroom/cli:begin";
 var MARKER_END = "<!-- @sechroom/cli:end";
@@ -10773,11 +11187,17 @@ function parseManagedBlock(content, block) {
   const keyed = content.match(keyedBlockRe(block));
   if (keyed) {
     const attrs = parseAttrs(keyed[0].slice(0, keyed[0].indexOf("\n")));
-    return { block, source: attrs.source ?? null, sha256: attrs.sha256 ?? null, body: innerBody(keyed[0]) };
+    return {
+      block,
+      source: attrs.source ?? null,
+      sha256: attrs.sha256 ?? null,
+      body: innerBody(keyed[0])
+    };
   }
   if (block === "role-template") {
     const legacy = content.match(legacyBlockRe());
-    if (legacy) return { block, source: null, sha256: null, body: innerBody(legacy[0]) };
+    if (legacy)
+      return { block, source: null, sha256: null, body: innerBody(legacy[0]) };
   }
   return null;
 }
@@ -10799,56 +11219,469 @@ function mergeMcpJson(path, snippet, dryRun) {
     try {
       current = JSON.parse(readFileSync16(path, "utf8"));
     } catch {
-      return { kind: "mcp", path, status: "skipped", note: "existing file isn't valid JSON \u2014 left untouched" };
+      return {
+        kind: "mcp",
+        path,
+        status: "skipped",
+        note: "existing file isn't valid JSON \u2014 left untouched"
+      };
     }
   }
-  current.mcpServers = { ...current.mcpServers ?? {}, ...incoming.mcpServers ?? {} };
+  current.mcpServers = {
+    ...current.mcpServers ?? {},
+    ...incoming.mcpServers ?? {}
+  };
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
   writeFileSync15(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
-function mergeCodexToml(path, snippet, dryRun) {
-  const existed = existsSync13(path);
-  let body = readOr(path, "");
-  body = body.replace(/(^|\n)\[mcp_servers\.sechroom\][^[]*/, "\n").replace(/\n{3,}/g, "\n\n");
-  const trimmed = body.trim();
-  const next = (trimmed.length > 0 ? trimmed + "\n\n" : "") + snippet.trim() + "\n";
-  if (dryRun) return { kind: "mcp", path, status: "dry-run" };
-  ensureDir2(path);
-  writeFileSync15(path, next, { mode: 384 });
-  return { kind: "mcp", path, status: existed ? "merged" : "created" };
-}
-function writeInstructionBlock(path, write, dryRun) {
-  const existed = existsSync13(path);
-  const next = computeBlockFile(readOr(path, ""), write);
-  if (dryRun) return { kind: "instruction", path, status: "dry-run", block: write.block };
-  ensureDir2(path);
-  writeFileSync15(path, next);
-  return { kind: "instruction", path, status: existed ? "merged" : "created", block: write.block };
+var CODEX_MCP_TABLE = "mcp_servers.sechroom";
+function decodeTomlBasicString(value) {
+  let decoded = "";
+  for (let i = 0; i < value.length; i += 1) {
+    const char = value[i];
+    if (char !== "\\") {
+      decoded += char;
+      continue;
+    }
+    const escaped = value[++i];
+    if (escaped === void 0) throw new Error("unterminated TOML escape");
+    const simple = {
+      b: "\b",
+      f: "\f",
+      n: "\n",
+      r: "\r",
+      t: "	",
+      '"': '"',
+      "\\": "\\"
+    };
+    if (escaped in simple) {
+      decoded += simple[escaped];
+      continue;
+    }
+    const digits = escaped === "u" ? 4 : escaped === "U" ? 8 : 0;
+    if (digits === 0) throw new Error(`invalid TOML escape '\\\\${escaped}'`);
+    const code = value.slice(i + 1, i + 1 + digits);
+    if (!new RegExp(`^[0-9a-fA-F]{${digits}}$`).test(code))
+      throw new Error(`invalid TOML Unicode escape '\\\\${escaped}${code}'`);
+    decoded += String.fromCodePoint(Number.parseInt(code, 16));
+    i += digits;
+  }
+  return decoded;
 }
-function computeBlockFile(current, write) {
-  const rendered = renderBlock(write);
-  const keyed = keyedBlockRe(write.block);
-  if (keyed.test(current)) return current.replace(keyed, rendered);
-  if (write.block === "role-template" && legacyBlockRe().test(current)) {
-    return current.replace(legacyBlockRe(), rendered);
+function normalizeTomlKey(raw) {
+  const segments = [];
+  let i = 0;
+  while (i < raw.length) {
+    while (/\s/.test(raw[i] ?? "")) i += 1;
+    if (i >= raw.length) break;
+    const quote = raw[i];
+    let segment;
+    if (quote === '"' || quote === "'") {
+      i += 1;
+      const start = i;
+      let escaped = false;
+      while (i < raw.length) {
+        const char = raw[i];
+        if (quote === '"' && escaped) {
+          escaped = false;
+          i += 1;
+          continue;
+        }
+        if (quote === '"' && char === "\\") {
+          escaped = true;
+          i += 1;
+          continue;
+        }
+        if (char === quote) break;
+        i += 1;
+      }
+      if (raw[i] !== quote) throw new Error(`unterminated TOML key '${raw}'`);
+      const encoded = raw.slice(start, i);
+      segment = quote === '"' ? decodeTomlBasicString(encoded) : encoded;
+      i += 1;
+    } else {
+      const start = i;
+      while (i < raw.length && /[A-Za-z0-9_-]/.test(raw[i])) i += 1;
+      segment = raw.slice(start, i);
+      if (!segment) throw new Error(`invalid TOML key '${raw.trim()}'`);
+    }
+    segments.push(segment);
+    while (/\s/.test(raw[i] ?? "")) i += 1;
+    if (i >= raw.length) break;
+    if (raw[i] !== ".") throw new Error(`invalid TOML key '${raw.trim()}'`);
+    i += 1;
+  }
+  if (segments.length === 0) throw new Error("empty TOML key");
+  return segments;
+}
+function sameTomlKey(left, right) {
+  return left.length === right.length && left.every((segment, index) => segment === right[index]);
+}
+function isTomlKeyPrefix(prefix, candidate) {
+  return prefix.length < candidate.length && prefix.every((segment, index) => segment === candidate[index]);
+}
+function tomlKeyLabel(key) {
+  return key.join(".");
+}
+function stripTomlComment(line) {
+  let quote = null;
+  let escaped = false;
+  for (let i = 0; i < line.length; i += 1) {
+    const rest = line.slice(i);
+    const char = line[i];
+    if (quote === "multiline-basic") {
+      if (rest.startsWith('"""') && !escaped) {
+        escaped = false;
+        quote = null;
+        i += 2;
+        continue;
+      }
+      if (escaped) escaped = false;
+      else if (char === "\\") escaped = true;
+      continue;
+    }
+    if (quote === "multiline-literal") {
+      if (rest.startsWith("'''")) {
+        i += 2;
+        quote = null;
+      }
+      continue;
+    }
+    if (quote === "basic") {
+      if (escaped) escaped = false;
+      else if (char === "\\") escaped = true;
+      else if (char === '"') quote = null;
+      continue;
+    }
+    if (quote === "literal") {
+      if (char === "'") quote = null;
+      continue;
+    }
+    if (rest.startsWith('"""')) {
+      quote = "multiline-basic";
+      i += 2;
+    } else if (rest.startsWith("'''")) {
+      quote = "multiline-literal";
+      i += 2;
+    } else if (char === '"') quote = "basic";
+    else if (char === "'") quote = "literal";
+    else if (char === "#") return line.slice(0, i);
+  }
+  return line;
+}
+function scanTomlValue(value, state) {
+  for (let i = 0; i < value.length; i += 1) {
+    const rest = value.slice(i);
+    const char = value[i];
+    if (state.quote === "multiline-basic") {
+      if (rest.startsWith('"""') && !state.escaped) {
+        state.quote = null;
+        i += 2;
+        continue;
+      }
+      if (state.escaped) state.escaped = false;
+      else if (char === "\\") state.escaped = true;
+      continue;
+    }
+    if (state.quote === "multiline-literal") {
+      if (rest.startsWith("'''")) {
+        state.quote = null;
+        i += 2;
+      }
+      continue;
+    }
+    if (state.quote === "basic") {
+      if (state.escaped) state.escaped = false;
+      else if (char === "\\") state.escaped = true;
+      else if (char === '"') state.quote = null;
+      continue;
+    }
+    if (state.quote === "literal") {
+      if (char === "'") state.quote = null;
+      continue;
+    }
+    if (char === "#") break;
+    if (rest.startsWith('"""')) {
+      state.quote = "multiline-basic";
+      i += 2;
+    } else if (rest.startsWith("'''")) {
+      state.quote = "multiline-literal";
+      i += 2;
+    } else if (char === '"') state.quote = "basic";
+    else if (char === "'") state.quote = "literal";
+    else if (char === "[" || char === "{") state.containers.push(char);
+    else if (char === "]" || char === "}") {
+      const expected = char === "]" ? "[" : "{";
+      if (state.containers.pop() !== expected)
+        throw new Error(`unbalanced TOML delimiter '${char}'`);
+    }
+  }
+}
+function parseTomlHeader(rawLine) {
+  const line = stripTomlComment(rawLine).trim();
+  const array = line.startsWith("[[") && line.endsWith("]]");
+  const table = !array && line.startsWith("[") && line.endsWith("]");
+  if (!array && !table) return null;
+  const prefix = array ? 2 : 1;
+  const suffix = array ? 2 : 1;
+  const rawName = line.slice(prefix, line.length - suffix).trim();
+  if (!rawName) throw new Error("empty TOML table name");
+  return { name: normalizeTomlKey(rawName), array };
+}
+function findTomlEquals(line) {
+  let quote = null;
+  let escaped = false;
+  for (let i = 0; i < line.length; i += 1) {
+    const char = line[i];
+    if (quote === "basic") {
+      if (escaped) escaped = false;
+      else if (char === "\\") escaped = true;
+      else if (char === '"') quote = null;
+      continue;
+    }
+    if (quote === "literal") {
+      if (char === "'") quote = null;
+      continue;
+    }
+    if (char === '"') quote = "basic";
+    else if (char === "'") quote = "literal";
+    else if (char === "=") return i;
   }
-  return current.trim().length > 0 ? `${current.trimEnd()}
-
-${rendered}` : rendered;
+  return -1;
 }
-function evaluateBlock(content, block, serverBody) {
-  const onDisk = parseManagedBlock(content, block);
-  if (!onDisk) {
-    const hasManagedMarker = content.includes(MARKER_BEGIN) || content.includes(MARKER_END);
-    if (!hasManagedMarker && content.includes(BOOTSTRAP_STUB_REFUSAL))
-      return "stub";
-    return "absent";
+function arrayTableContext(name, arrays) {
+  let best = null;
+  for (let i = arrays.length - 1; i >= 0; i -= 1) {
+    const candidate = arrays[i];
+    if (isTomlKeyPrefix(candidate.key, name)) {
+      if (!best || candidate.key.length > best.key.length) best = candidate;
+    }
   }
-  const actual = bodySha256(onDisk.body);
-  if (onDisk.sha256 && actual !== onDisk.sha256) return "drift";
-  return actual === bodySha256(serverBody) ? "current" : "stale";
+  return best;
+}
+function tomlTableIdentity(key, context) {
+  return `${context?.identity ?? "root"}:${JSON.stringify(key)}`;
+}
+function isTomlScalar(value) {
+  const decimal = "[+-]?(?:0|[1-9](?:_?[0-9])*)(?:\\.[0-9](?:_?[0-9])*)?(?:[eE][+-]?[0-9](?:_?[0-9])*)?";
+  const number = new RegExp(
+    `^(?:${decimal}|[+-]?0x[0-9A-Fa-f](?:_?[0-9A-Fa-f])*|[+-]?0o[0-7](?:_?[0-7])*|[+-]?0b[01](?:_?[01])*|[+-]?(?:inf|nan))$`
+  );
+  const datetime = /^(?:[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]+)?|[0-9]{4}-[0-9]{2}-[0-9]{2}(?:(?:[Tt ]|[Tt])[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]+)?(?:Z|[+-][0-9]{2}:[0-9]{2})?)?)$/;
+  return number.test(value) || datetime.test(value) || /^(?:true|false)$/.test(value);
+}
+function validateTomlValueShape(value) {
+  const token = stripTomlComment(value).trim();
+  if (!token) throw new Error("empty TOML value");
+  if (token.startsWith('"') || token.startsWith("'")) {
+    const quote = token[0];
+    if (quote && token.endsWith(quote)) return;
+  }
+  if (token.startsWith("[") && token.endsWith("]")) return;
+  if (token.startsWith("{") && token.endsWith("}")) return;
+  if (isTomlScalar(token)) return;
+  throw new Error(`invalid TOML value '${token}'`);
+}
+function validateToml(content) {
+  const tables = /* @__PURE__ */ new Set();
+  const keys = /* @__PURE__ */ new Set();
+  const arrayInstances = [];
+  let currentTable = { identity: "root" };
+  let valueState = {
+    containers: [],
+    quote: null,
+    escaped: false
+  };
+  for (const rawLine of content.replace(/\r\n/g, "\n").split("\n")) {
+    if (valueState.quote || valueState.containers.length > 0) {
+      scanTomlValue(rawLine, valueState);
+      continue;
+    }
+    const line = stripTomlComment(rawLine).trim();
+    if (!line) continue;
+    const header = parseTomlHeader(rawLine);
+    if (header) {
+      if (header.array) {
+        const context = arrayTableContext(header.name, arrayInstances);
+        const parentIdentity = context?.identity ?? null;
+        const previous = [...arrayInstances].reverse().find(
+          (candidate) => sameTomlKey(candidate.key, header.name) && candidate.parentIdentity === parentIdentity
+        );
+        const count = (previous?.count ?? 0) + 1;
+        const instance = {
+          key: header.name,
+          parentIdentity,
+          identity: `${parentIdentity ?? "root"}:${JSON.stringify(header.name)}#${count}`,
+          count
+        };
+        arrayInstances.push(instance);
+        currentTable = { identity: instance.identity };
+      } else {
+        const context = arrayTableContext(header.name, arrayInstances);
+        currentTable = {
+          identity: tomlTableIdentity(header.name, context)
+        };
+        if (tables.has(currentTable.identity))
+          throw new Error(
+            `duplicate TOML table '${tomlKeyLabel(header.name)}'`
+          );
+        tables.add(currentTable.identity);
+      }
+      continue;
+    }
+    const equals = findTomlEquals(line);
+    if (equals <= 0) throw new Error(`invalid TOML line '${rawLine}'`);
+    const key = normalizeTomlKey(line.slice(0, equals).trim());
+    const value = line.slice(equals + 1).trim();
+    if (!value || value.startsWith("#"))
+      throw new Error(`empty TOML value for '${tomlKeyLabel(key)}'`);
+    const fullKey = `${currentTable.identity}\0${JSON.stringify(key)}`;
+    if (keys.has(fullKey))
+      throw new Error(`duplicate TOML key '${tomlKeyLabel(key)}'`);
+    keys.add(fullKey);
+    scanTomlValue(line.slice(equals + 1), valueState);
+    if (valueState.quote === "basic" || valueState.quote === "literal")
+      throw new Error("unterminated TOML string");
+    if (!valueState.quote && valueState.containers.length === 0)
+      validateTomlValueShape(value);
+  }
+  if (valueState.quote) throw new Error("unterminated TOML string");
+  if (valueState.containers.length > 0)
+    throw new Error("unbalanced TOML value");
+}
+function isTomlTableHeader(line) {
+  try {
+    return parseTomlHeader(line) !== null;
+  } catch {
+    return false;
+  }
+}
+function replaceTomlTable(content, tableName, replacement) {
+  const target = normalizeTomlKey(tableName);
+  const lines = content.replace(/\r\n/g, "\n").split("\n");
+  const replacementLines = replacement.trim().split("\n");
+  const kept = [];
+  let i = 0;
+  while (i < lines.length) {
+    const header = parseTomlHeader(lines[i]);
+    if (header && (sameTomlKey(header.name, target) || isTomlKeyPrefix(target, header.name))) {
+      i += 1;
+      while (i < lines.length && !isTomlTableHeader(lines[i])) i += 1;
+      continue;
+    }
+    kept.push(lines[i]);
+    i += 1;
+  }
+  const base = kept.join("\n").trim();
+  return `${base.length > 0 ? `${base}
+
+` : ""}${replacementLines.join("\n")}
+`;
+}
+var defaultTomlFileOperations = {
+  copyFileSync,
+  renameSync: renameSync4
+};
+function writeTomlAtomic(path, content, fileOperations = {}) {
+  ensureDir2(path);
+  const operations = { ...defaultTomlFileOperations, ...fileOperations };
+  const temporary = `${path}.sechroom-${process.pid}-${randomUUID3()}.tmp`;
+  const backup = `${path}.bak`;
+  const backupTemporary = `${backup}.sechroom-${process.pid}-${randomUUID3()}.tmp`;
+  const mode = existsSync13(path) ? statSync5(path).mode & 4095 : 384;
+  try {
+    writeFileSync15(temporary, content, { mode });
+    chmodSync2(temporary, mode);
+    validateToml(readFileSync16(temporary, "utf8"));
+    if (existsSync13(path) && !existsSync13(backup)) {
+      operations.copyFileSync(path, backupTemporary);
+      chmodSync2(backupTemporary, mode);
+      validateToml(readFileSync16(backupTemporary, "utf8"));
+      operations.renameSync(backupTemporary, backup);
+    }
+    operations.renameSync(temporary, path);
+  } finally {
+    rmSync7(temporary, { force: true });
+    rmSync7(backupTemporary, { force: true });
+  }
+}
+function mergeCodexToml(path, snippet, dryRun, fileOperations = {}) {
+  const existed = existsSync13(path);
+  const body = readOr(path, "");
+  try {
+    validateToml(body);
+  } catch (error) {
+    return {
+      kind: "mcp",
+      path,
+      status: "skipped",
+      note: `existing TOML is invalid \u2014 left untouched (${error.message})`
+    };
+  }
+  const next = replaceTomlTable(body, CODEX_MCP_TABLE, snippet);
+  try {
+    validateToml(next);
+  } catch (error) {
+    return {
+      kind: "mcp",
+      path,
+      status: "skipped",
+      note: `generated TOML is invalid \u2014 left untouched (${error.message})`
+    };
+  }
+  if (dryRun) return { kind: "mcp", path, status: "dry-run" };
+  if (next === body)
+    return { kind: "mcp", path, status: existed ? "current" : "created" };
+  try {
+    writeTomlAtomic(path, next, fileOperations);
+  } catch (error) {
+    return {
+      kind: "mcp",
+      path,
+      status: "skipped",
+      note: `could not replace TOML \u2014 left untouched (${error.message})`
+    };
+  }
+  return { kind: "mcp", path, status: existed ? "merged" : "created" };
+}
+function writeInstructionBlock(path, write, dryRun) {
+  const existed = existsSync13(path);
+  const next = computeBlockFile(readOr(path, ""), write);
+  if (dryRun)
+    return { kind: "instruction", path, status: "dry-run", block: write.block };
+  ensureDir2(path);
+  writeFileSync15(path, next);
+  return {
+    kind: "instruction",
+    path,
+    status: existed ? "merged" : "created",
+    block: write.block
+  };
+}
+function computeBlockFile(current, write) {
+  const rendered = renderBlock(write);
+  const keyed = keyedBlockRe(write.block);
+  if (keyed.test(current)) return current.replace(keyed, rendered);
+  if (write.block === "role-template" && legacyBlockRe().test(current)) {
+    return current.replace(legacyBlockRe(), rendered);
+  }
+  return current.trim().length > 0 ? `${current.trimEnd()}
+
+${rendered}` : rendered;
+}
+function evaluateBlock(content, block, serverBody) {
+  const onDisk = parseManagedBlock(content, block);
+  if (!onDisk) {
+    const hasManagedMarker = content.includes(MARKER_BEGIN) || content.includes(MARKER_END);
+    if (!hasManagedMarker && content.includes(BOOTSTRAP_STUB_REFUSAL))
+      return "stub";
+    return "absent";
+  }
+  const actual = bodySha256(onDisk.body);
+  if (onDisk.sha256 && actual !== onDisk.sha256) return "drift";
+  return actual === bodySha256(serverBody) ? "current" : "stale";
 }
 function applyBlock(path, write, mode, dryRun) {
   const current = readOr(path, "");
@@ -10874,7 +11707,13 @@ function applyBlock(path, write, mode, dryRun) {
     };
   }
   if (state === "current") {
-    return { kind: "instruction", path, status: "current", eval: "current", block: write.block };
+    return {
+      kind: "instruction",
+      path,
+      status: "current",
+      eval: "current",
+      block: write.block
+    };
   }
   if (state === "drift" && mode !== "force") {
     const proposedPath = `${path}.proposed`;
@@ -10909,7 +11748,12 @@ async function applyClient(cfg, setup, target, opts) {
     const section = findSection(surface, target.mcp.sectionType);
     const snippet = sectionSnippet(section);
     if (!snippet) {
-      actions.push({ kind: "mcp", path: target.mcp.path, status: "skipped", note: `no ${target.mcp.sectionType} section on surface '${target.mcp.surfaceKey}'` });
+      actions.push({
+        kind: "mcp",
+        path: target.mcp.path,
+        status: "skipped",
+        note: `no ${target.mcp.sectionType} section on surface '${target.mcp.surfaceKey}'`
+      });
     } else {
       actions.push(
         target.mcp.format === "toml" ? mergeCodexToml(target.mcp.path, snippet, dryRun) : mergeMcpJson(target.mcp.path, snippet, dryRun)
@@ -10920,25 +11764,52 @@ async function applyClient(cfg, setup, target, opts) {
     const surface = findSurface(setup, target.instruction.surfaceKey);
     const section = findSection(surface, SectionType.InstructionFile);
     if (!section) {
-      actions.push({ kind: "instruction", path: target.instruction.path, status: "skipped", note: `no instruction-file section on surface '${target.instruction.surfaceKey}'` });
+      actions.push({
+        kind: "instruction",
+        path: target.instruction.path,
+        status: "skipped",
+        note: `no instruction-file section on surface '${target.instruction.surfaceKey}'`
+      });
     } else {
       const resolved = await withSpinner(
         `Resolving ${target.label} agent instructions`,
         () => resolveInstruction(cfg, section, opts.personalWorkspaceId)
       );
       if (!resolved) {
-        actions.push({ kind: "instruction", path: target.instruction.path, status: "skipped", note: "no role template found in this tenant \u2014 install the SEM Starter bundle, then re-run `sechroom setup agent-files`" });
+        actions.push({
+          kind: "instruction",
+          path: target.instruction.path,
+          status: "skipped",
+          // Name the block even when nothing resolved. Without it the skip reports a
+          // path and no identity, so a consumer cannot tell WHICH managed block went
+          // missing — absent rather than loud, which is the failure this guards.
+          block: "role-template",
+          // GUARD — an unresolved template must NAME what it looked for. A bare
+          // "not found" reads identically whether the bundle is absent or the memo
+          // was retagged out of every candidate family, and the second case is a
+          // silent loss of a template the installation previously had.
+          note: "no role template resolved \u2014 tried " + attemptedTagSets(section).map((set) => `[${set.join(", ")}]`).join(" then ") + " \u2014 install the SEM Starter bundle, or check the template's target tag, then re-run `sechroom setup agent-files`"
+        });
       } else {
         const action = applyBlock(
           target.instruction.path,
-          { block: "role-template", body: resolved.body, source: resolved.sourceRef },
+          {
+            block: "role-template",
+            body: resolved.body,
+            source: resolved.sourceRef
+          },
           mode,
           opts.dryRun
         );
-        actions.push(resolved.source === "override" && action.status !== "current" ? { ...action, note: action.note ?? "your personal copy" } : action);
+        actions.push(
+          resolved.source === "override" && action.status !== "current" ? { ...action, note: action.note ?? "your personal copy" } : action
+        );
       }
     }
-    const conventionsSection = findSection(surface, SectionType.WorkspaceConventions);
+    const conventionsSection = findSection(
+      surface,
+      SectionType.WorkspaceConventions
+    );
     if (conventionsSection) {
       const conventions = await withSpinner(
         `Composing ${target.label} workspace conventions`,
@@ -10947,11 +11818,20 @@ async function applyClient(cfg, setup, target, opts) {
       if (conventions) {
         const action = applyBlock(
           target.instruction.path,
-          { block: "workspace-conventions", body: conventions.body, source: `workspace:${cfg.workspaceId ?? ""}` },
+          {
+            block: "workspace-conventions",
+            body: conventions.body,
+            source: `workspace:${cfg.workspaceId ?? ""}`
+          },
           mode,
           opts.dryRun
         );
-        actions.push(action.status === "current" ? action : { ...action, note: action.note ?? `workspace conventions (${conventions.refs.length})` });
+        actions.push(
+          action.status === "current" ? action : {
+            ...action,
+            note: action.note ?? `workspace conventions (${conventions.refs.length})`
+          }
+        );
       }
     }
   }
@@ -11169,7 +12049,12 @@ function buildConventionDraft(title, rawKind, rawBody) {
 
 ${body}
 `,
-    tags: ["agent-setup-bundle", "scope:sechroom", `kind:${kind}`, "archetype:document"]
+    tags: [
+      "agent-setup-bundle",
+      "scope:sechroom",
+      `kind:${kind}`,
+      "archetype:document"
+    ]
   };
 }
 function copyChoice(opts) {
@@ -11182,9 +12067,16 @@ async function maybeOfferCopies(cfg, setup, targets, keys, personalWorkspaceId,
     const instr = targets[key]?.instruction;
     if (!instr || seen.has(instr.surfaceKey)) continue;
     seen.add(instr.surfaceKey);
-    const section = findSection(findSurface(setup, instr.surfaceKey), SectionType.InstructionFile);
+    const section = findSection(
+      findSurface(setup, instr.surfaceKey),
+      SectionType.InstructionFile
+    );
     if (!section) continue;
-    const resolved = await resolveInstruction(cfg, section, personalWorkspaceId);
+    const resolved = await resolveInstruction(
+      cfg,
+      section,
+      personalWorkspaceId
+    );
     if (!resolved || resolved.source === "override") continue;
     let make = choice === "yes";
     if (choice === "ask") {
@@ -11199,8 +12091,10 @@ version, the shared template stays clean, and you can discard back anytime.
     }
     if (make) {
       await createOverride(cfg, resolved, personalWorkspaceId);
-      process.stderr.write(`\u2713 personal copy created for ${instr.surfaceKey} \u2014 edit it on the Agent setup page or via the API.
-`);
+      process.stderr.write(
+        `\u2713 personal copy created for ${instr.surfaceKey} \u2014 edit it on the Agent setup page or via the API.
+`
+      );
     }
   }
 }
@@ -11210,7 +12104,9 @@ function resolveClientKeys(raw) {
   if (tokens.includes("all")) return [...ALL_CLIENT_KEYS];
   for (const k of tokens) {
     if (!targets[k]) {
-      fail(`unknown client '${k}'. Known: ${ALL_CLIENT_KEYS.join(", ")}, or 'all'.`);
+      fail(
+        `unknown client '${k}'. Known: ${ALL_CLIENT_KEYS.join(", ")}, or 'all'.`
+      );
     }
   }
   return [...new Set(tokens)];
@@ -11221,8 +12117,10 @@ ${client.label} (${client.key}):
 `);
   for (const a of actions) {
     const tag = a.status === "skipped" ? "skip" : a.status;
-    process.stdout.write(`  [${tag}] ${a.kind}: ${a.path}${a.note ? ` \u2014 ${a.note}` : ""}
-`);
+    process.stdout.write(
+      `  [${tag}] ${a.kind}: ${a.path}${a.note ? ` \u2014 ${a.note}` : ""}
+`
+    );
   }
 }
 function resolveEvalMode(opts) {
@@ -11237,8 +12135,17 @@ function buildCheckReport(result) {
     stub: 0
   };
   const blocks = [];
+  const unresolved = [];
   for (const { client, actions } of result) {
     for (const action of actions) {
+      if (action.kind === "instruction" && action.status === "skipped" && !action.eval) {
+        unresolved.push({
+          client,
+          path: action.path,
+          block: action.block ?? "unknown",
+          note: action.note
+        });
+      }
       if (!action.eval) continue;
       counts[action.eval]++;
       blocks.push({
@@ -11252,7 +12159,8 @@ function buildCheckReport(result) {
   return {
     eval: counts,
     wouldChange: counts.stale + counts.drift + counts.absent,
-    blocks
+    blocks,
+    unresolved
   };
 }
 function reportCheckAndExit(result, json, refreshCommand, jsonContext = {}) {
@@ -11267,7 +12175,7 @@ function reportCheckAndExit(result, json, refreshCommand, jsonContext = {}) {
       },
       true
     );
-  } else if (report.wouldChange === 0) {
+  } else if (report.wouldChange === 0 && report.unresolved.length === 0) {
     if (report.eval.stub) {
       const files = report.eval.stub === 1 ? "file" : "files";
       process.stdout.write(
@@ -11279,11 +12187,27 @@ function reportCheckAndExit(result, json, refreshCommand, jsonContext = {}) {
     }
   } else {
     const bits = [];
-    if (report.eval.stale) bits.push(`${report.eval.stale} out of date`);
-    if (report.eval.drift) bits.push(`${report.eval.drift} with local edits`);
-    if (report.eval.absent) bits.push(`${report.eval.absent} not yet written`);
+    if (report.wouldChange > 0) {
+      const changes = [];
+      if (report.eval.stale) changes.push(`${report.eval.stale} out of date`);
+      if (report.eval.drift)
+        changes.push(`${report.eval.drift} with local edits`);
+      if (report.eval.absent)
+        changes.push(`${report.eval.absent} not yet written`);
+      bits.push(
+        `${report.wouldChange} instruction block(s) would change: ${changes.join(", ")}`
+      );
+    }
+    if (report.unresolved.length > 0) {
+      const details = report.unresolved.map(
+        ({ client, path, block, note }) => `${client} ${block} at ${path}${note ? ` \u2014 ${note}` : ""}`
+      ).join("; ");
+      bits.push(
+        `${report.unresolved.length} instruction template(s) skipped or unresolved: ${details}`
+      );
+    }
     process.stderr.write(
-      `\u26A0 ${report.wouldChange} instruction block(s) would change: ${bits.join(", ")}. Run ${style.cyan(refreshCommand)}.
+      `\u26A0 ${bits.join("; ")}. Run ${style.cyan(refreshCommand)}.
 `
     );
   }
@@ -11296,8 +12220,10 @@ function summarizeEval(result, mode, json, dryRun) {
   const { eval: counts } = buildCheckReport(result);
   if (json) return;
   if (!dryRun && counts.stale) {
-    process.stderr.write(`\u21BB refreshed ${counts.stale} section(s) the server had moved
-`);
+    process.stderr.write(
+      `\u21BB refreshed ${counts.stale} section(s) the server had moved
+`
+    );
   }
   if (!dryRun && counts.drift) {
     process.stderr.write(
@@ -11328,7 +12254,39 @@ async function resolveNamespaceChoice(cfg, flag) {
   return picked === GLOBAL_NAMESPACE ? null : picked;
 }
 function registerInit(program2) {
-  program2.command("init").description("Wire this project for sechroom: write MCP config + agent instruction files from the server's setup descriptors").option("--client <list...>", `clients to wire \u2014 space- or comma-separated (${ALL_CLIENT_KEYS.join(", ")}) or 'all'`, DEFAULT_CLIENT_KEY).option("--scope <scope>", "install skills/agents/hooks 'global' (config dir / CLAUDE_CONFIG_DIR) or 'project' (<cwd>/.claude) \u2014 default global", "global").option("--dry-run", "print what would be written without writing", false).option("--mcp-only", "only write MCP config (skip agent files)", false).option("--agent-files-only", "only write agent instruction files (skip MCP config)", false).option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--namespace <slug>", "MCP namespace for the connection URL (interactive picker if omitted on a TTY; defaults to tenant-global)").option("--refresh", "refresh out-of-date agent-file blocks in place (local edits preserved to .proposed)", false).option("--force", "rewrite agent-file managed blocks, overwriting local edits inside the markers", false).option("--check", "report whether agent files would change and exit (0 = current/stub, 1 = stale/drift/absent); writes nothing", false).addHelpText(
+  program2.command("init").description(
+    "Wire this project for sechroom: write MCP config + agent instruction files from the server's setup descriptors"
+  ).option(
+    "--client <list...>",
+    `clients to wire \u2014 space- or comma-separated (${ALL_CLIENT_KEYS.join(", ")}) or 'all'`,
+    DEFAULT_CLIENT_KEY
+  ).option(
+    "--scope <scope>",
+    "install skills/agents/hooks 'global' (config dir / CLAUDE_CONFIG_DIR) or 'project' (<cwd>/.claude) \u2014 default global",
+    "global"
+  ).option("--dry-run", "print what would be written without writing", false).option("--mcp-only", "only write MCP config (skip agent files)", false).option(
+    "--agent-files-only",
+    "only write agent instruction files (skip MCP config)",
+    false
+  ).option(
+    "--copy",
+    "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)"
+  ).option(
+    "--namespace <slug>",
+    "MCP namespace for the connection URL (interactive picker if omitted on a TTY; defaults to tenant-global)"
+  ).option(
+    "--refresh",
+    "refresh out-of-date agent-file blocks in place (local edits preserved to .proposed)",
+    false
+  ).option(
+    "--force",
+    "rewrite agent-file managed blocks, overwriting local edits inside the markers",
+    false
+  ).option(
+    "--check",
+    "report whether agent files would change and exit (0 = current/stub or unresolved warning, 1 = stale/drift/absent); writes nothing",
+    false
+  ).addHelpText(
     "after",
     `
 Examples:
@@ -11343,7 +12301,9 @@ Examples:
     const mode = resolveEvalMode(opts);
     const check = mode === "check";
     if (check && opts.mcpOnly) {
-      fail("--check inspects agent files and cannot be combined with --mcp-only.");
+      fail(
+        "--check inspects agent files and cannot be combined with --mcp-only."
+      );
     }
     const namespaceSlug = await resolveNamespaceChoice(cfg, opts.namespace);
     const setup = await withSpinner(
@@ -11357,14 +12317,28 @@ Examples:
     } catch (err2) {
       return fail(err2.message);
     }
-    const claudeTargets = resolveClaudeTargets({ override: g.claudeConfigDir, scope, cwd: process.cwd() });
+    const claudeTargets = resolveClaudeTargets({
+      override: g.claudeConfigDir,
+      scope,
+      cwd: process.cwd()
+    });
     const codexHomes = resolveCodexHomes({ override: g.codexHome, scope });
-    const targets = clientTargets(process.cwd(), { claudeDir: claudeTargets[0]?.dir, codexHome: codexHomes[0] });
+    const targets = clientTargets(process.cwd(), {
+      claudeDir: claudeTargets[0]?.dir,
+      codexHome: codexHomes[0] ?? null
+    });
     const keys = resolveClientKeys(opts.client);
     const json = g.json;
     const personalWorkspaceId = await getPersonalWorkspaceId(cfg);
     if (!opts.dryRun && !opts.mcpOnly && !check) {
-      await maybeOfferCopies(cfg, setup, targets, keys, personalWorkspaceId, copyChoice(opts));
+      await maybeOfferCopies(
+        cfg,
+        setup,
+        targets,
+        keys,
+        personalWorkspaceId,
+        copyChoice(opts)
+      );
     }
     const result = [];
     for (const key of keys) {
@@ -11382,18 +12356,33 @@ Examples:
     summarizeEval(result, mode, Boolean(json), Boolean(opts.dryRun));
     if (!json && !opts.dryRun && !opts.mcpOnly && !check) {
       for (const t of claudeTargets) {
-        await maybeOfferSkills(cfg, personalWorkspaceId, { yes: false, dryRun: Boolean(opts.dryRun), surface: "claude-code", configDir: t.dir });
+        await maybeOfferSkills(cfg, personalWorkspaceId, {
+          yes: false,
+          dryRun: Boolean(opts.dryRun),
+          surface: "claude-code",
+          configDir: t.dir
+        });
       }
     }
     if (!json && !opts.dryRun && !opts.mcpOnly && !check) {
-      await maybeOfferHooks({ yes: false, dryRun: Boolean(opts.dryRun), cwd: process.cwd(), scope, claudeConfigDir: g.claudeConfigDir, codexHome: g.codexHome });
+      await maybeOfferHooks({
+        yes: false,
+        dryRun: Boolean(opts.dryRun),
+        cwd: process.cwd(),
+        scope,
+        claudeConfigDir: g.claudeConfigDir,
+        codexHome: g.codexHome
+      });
     }
     if (json) {
       emit({ dryRun: Boolean(opts.dryRun), clients: result }, true);
       return;
     }
     const first = targets[keys[0]];
-    const surface = findSurface(setup, first.mcp?.surfaceKey ?? first.instruction?.surfaceKey ?? "");
+    const surface = findSurface(
+      setup,
+      first.mcp?.surfaceKey ?? first.instruction?.surfaceKey ?? ""
+    );
     const verify = findSection(surface, SectionType.Verify);
     if (verify?.description) {
       process.stdout.write(`
@@ -11407,13 +12396,64 @@ Next \u2014 verify: ${verify.description}
 }
 function registerSetup(program2, deps = {}) {
   const setup = program2.command("setup").description("Granular onboarding steps (init runs these together)");
-  setup.command("mcp <clients...>").description(`Write only the MCP config for one or more clients (${ALL_CLIENT_KEYS.join(", ")}, or 'all')`).option("--dry-run", "print what would be written without writing", false).option("--namespace <slug>", "MCP namespace for the connection URL (interactive picker if omitted on a TTY; defaults to tenant-global)").addHelpText("after", "\nExamples:\n  $ sechroom setup mcp codex\n  $ sechroom setup mcp claude-code codex\n  $ sechroom setup mcp all").action(async (clients, opts, cmd) => {
-    await runClients(clients, cmd, { dryRun: Boolean(opts.dryRun), mcp: true, agentFiles: false, namespace: opts.namespace });
-  });
-  setup.command("agent-files <clients...>").description(`Write only the agent instruction file(s) for one or more clients (${ALL_CLIENT_KEYS.join(", ")}, or 'all')`).option("--dry-run", "print what would be written without writing", false).option("--copy", "make a personal copy you can edit (default: prompt on a TTY, else skip)").option("--refresh", "refresh out-of-date blocks in place (local edits preserved to .proposed)", false).option("--force", "rewrite managed blocks, overwriting local edits inside the markers", false).option("--check", "report whether anything would change and exit (0 = current/stub, 1 = stale/drift/absent); writes nothing", false).addHelpText("after", "\nExamples:\n  $ sechroom setup agent-files claude-code        CLAUDE.md\n  $ sechroom setup agent-files claude-code codex  CLAUDE.md + AGENTS.md in one run\n  $ sechroom setup agent-files all --check        CI gate: nonzero exit if out of date\n  $ sechroom setup agent-files claude-code --force   overwrite local edits in the managed block").action(async (clients, opts, cmd) => {
-    await runClients(clients, cmd, { dryRun: Boolean(opts.dryRun), mcp: false, agentFiles: true, copy: opts.copy, mode: resolveEvalMode(opts) });
+  setup.command("mcp <clients...>").description(
+    `Write only the MCP config for one or more clients (${ALL_CLIENT_KEYS.join(", ")}, or 'all')`
+  ).option("--dry-run", "print what would be written without writing", false).option(
+    "--namespace <slug>",
+    "MCP namespace for the connection URL (interactive picker if omitted on a TTY; defaults to tenant-global)"
+  ).addHelpText(
+    "after",
+    "\nExamples:\n  $ sechroom setup mcp codex\n  $ sechroom setup mcp claude-code codex\n  $ sechroom setup mcp all"
+  ).action(async (clients, opts, cmd) => {
+    await runClients(clients, cmd, {
+      dryRun: Boolean(opts.dryRun),
+      mcp: true,
+      agentFiles: false,
+      namespace: opts.namespace
+    });
+  });
+  setup.command("agent-files <clients...>").description(
+    `Write only the agent instruction file(s) for one or more clients (${ALL_CLIENT_KEYS.join(", ")}, or 'all')`
+  ).option("--dry-run", "print what would be written without writing", false).option(
+    "--copy",
+    "make a personal copy you can edit (default: prompt on a TTY, else skip)"
+  ).option(
+    "--refresh",
+    "refresh out-of-date blocks in place (local edits preserved to .proposed)",
+    false
+  ).option(
+    "--force",
+    "rewrite managed blocks, overwriting local edits inside the markers",
+    false
+  ).option(
+    "--check",
+    "report whether anything would change and exit (0 = current/stub or unresolved warning, 1 = stale/drift/absent); writes nothing",
+    false
+  ).addHelpText(
+    "after",
+    "\nExamples:\n  $ sechroom setup agent-files claude-code        CLAUDE.md\n  $ sechroom setup agent-files claude-code codex  CLAUDE.md + AGENTS.md in one run\n  $ sechroom setup agent-files all --check        CI gate: nonzero exit if out of date\n  $ sechroom setup agent-files claude-code --force   overwrite local edits in the managed block"
+  ).action(async (clients, opts, cmd) => {
+    await runClients(clients, cmd, {
+      dryRun: Boolean(opts.dryRun),
+      mcp: false,
+      agentFiles: true,
+      copy: opts.copy,
+      mode: resolveEvalMode(opts)
+    });
   });
-  setup.command("new-convention <title...>").description("Scaffold a workspace-conventions section: author a correctly-tagged memo (header as first body line) + regen the agent files").option("--kind <kind>", "reference | standard (orders the section; reference first)", "reference").option("--workspace <id>", "workspace to author in (default: the bound workspace)").option("--body <markdown>", "section body (default: a TODO scaffold to edit later)").option("--no-regen", "skip the agent-files regen after authoring").option("--dry-run", "print what would be authored; write nothing", false).addHelpText(
+  setup.command("new-convention <title...>").description(
+    "Scaffold a workspace-conventions section: author a correctly-tagged memo (header as first body line) + regen the agent files"
+  ).option(
+    "--kind <kind>",
+    "reference | standard (orders the section; reference first)",
+    "reference"
+  ).option(
+    "--workspace <id>",
+    "workspace to author in (default: the bound workspace)"
+  ).option(
+    "--body <markdown>",
+    "section body (default: a TODO scaffold to edit later)"
+  ).option("--no-regen", "skip the agent-files regen after authoring").option("--dry-run", "print what would be authored; write nothing", false).addHelpText(
     "after",
     `
 The memo carries the two conventions a workspace-conventions section needs (FR-sechroom-236):
@@ -11429,10 +12469,15 @@ Examples:
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const json = Boolean(cmd.optsWithGlobals().json);
     const title = titleParts.join(" ").trim();
-    if (!title) fail('a section title is required, e.g. `sechroom setup new-convention "Deploy runbook"`.');
+    if (!title)
+      fail(
+        'a section title is required, e.g. `sechroom setup new-convention "Deploy runbook"`.'
+      );
     const workspaceId = opts.workspace ?? cfg.workspaceId;
     if (!workspaceId)
-      fail("no workspace \u2014 pass --workspace <id> or bind one (`sechroom config set --local workspaceId <id>`).");
+      fail(
+        "no workspace \u2014 pass --workspace <id> or bind one (`sechroom config set --local workspaceId <id>`)."
+      );
     const draft = buildConventionDraft(title, opts.kind, opts.body);
     if (opts.dryRun) {
       emit(
@@ -11473,7 +12518,10 @@ Examples:
     }
     if (opts.regen === false) {
       if (json) emit({ id: data.id, workspaceId, regen: false }, true);
-      else process.stdout.write("Skipped regen (--no-regen). Run `sechroom setup agent-files all` to apply.\n");
+      else
+        process.stdout.write(
+          "Skipped regen (--no-regen). Run `sechroom setup agent-files all` to apply.\n"
+        );
       return;
     }
     const regenerate = deps.regenerateConvention ?? runClients;
@@ -11502,7 +12550,14 @@ async function runClients(clients, cmd, opts) {
   );
   const personalWorkspaceId = await getPersonalWorkspaceId(cfg);
   if (opts.agentFiles && !opts.dryRun && !check) {
-    await maybeOfferCopies(cfg, setupData, targets, keys, personalWorkspaceId, copyChoice(opts));
+    await maybeOfferCopies(
+      cfg,
+      setupData,
+      targets,
+      keys,
+      personalWorkspaceId,
+      copyChoice(opts)
+    );
   }
   const json = g.json;
   const result = [];
@@ -11523,7 +12578,9 @@ async function runClients(clients, cmd, opts) {
     emit({ dryRun: opts.dryRun, clients: result }, true);
     return;
   }
-  process.stdout.write(opts.dryRun ? "\n(dry run \u2014 nothing written)\n" : "\nDone.\n");
+  process.stdout.write(
+    opts.dryRun ? "\n(dry run \u2014 nothing written)\n" : "\nDone.\n"
+  );
 }
 
 // src/commands/namespace.ts
@@ -11599,7 +12656,7 @@ import { basename as basename5, join as join21 } from "path";
 
 // src/commands/fanout.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync14, readFileSync as readFileSync17, readdirSync as readdirSync4, statSync as statSync5 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync17, readdirSync as readdirSync4, statSync as statSync6 } from "fs";
 import { isAbsolute as isAbsolute3, join as join20, resolve as resolve7 } from "path";
 var ICON = {
   refresh: "\u21BB",
@@ -11622,7 +12679,7 @@ function discoverChildren(root) {
     if (name.startsWith(".") || name === "node_modules") continue;
     const dir = join20(root, name);
     try {
-      if (!statSync5(dir).isDirectory()) continue;
+      if (!statSync6(dir).isDirectory()) continue;
     } catch {
       continue;
     }
@@ -11748,20 +12805,27 @@ function resolveBaseUrl(g) {
   return baseUrl.replace(/\/$/, "");
 }
 async function fetchWorkspaces(client) {
-  const { data, error } = await client.GET("/workspaces", { params: { query: { includeArchived: false } } });
-  if (error) throw new Error(`Couldn't list your workspaces: ${JSON.stringify(error)}`);
+  const { data, error } = await client.GET("/workspaces", {
+    params: { query: { includeArchived: false } }
+  });
+  if (error)
+    throw new Error(`Couldn't list your workspaces: ${JSON.stringify(error)}`);
   const rows = data ?? [];
   return rows.map((r) => r.item ?? r).filter((w) => Boolean(w?.id && w?.name)).map((w) => ({ id: w.id, name: w.name, parentId: w.parentId ?? null }));
 }
 async function lookupWorkspace(client, id) {
-  const { data, error } = await client.GET("/workspaces/{workspaceId}", { params: { path: { workspaceId: id } } });
+  const { data, error } = await client.GET("/workspaces/{workspaceId}", {
+    params: { path: { workspaceId: id } }
+  });
   if (error) return null;
   const env = data;
   const w = env?.item ?? env;
   return w?.id ? { id: w.id, name: w.name ?? id, parentId: w.parentId ?? null } : null;
 }
 async function warnIfProjectStray(client, projectId, workspaceId, json) {
-  const { data, error } = await client.GET("/projects/{projectId}", { params: { path: { projectId } } });
+  const { data, error } = await client.GET("/projects/{projectId}", {
+    params: { path: { projectId } }
+  });
   if (error) return;
   const env = data;
   const owner = env?.item?.workspaceId;
@@ -11805,10 +12869,15 @@ function personalSubtreeIds(personalId, all) {
 async function pickWorkspace(client, opts = {}) {
   const promptLabel = opts.promptLabel ?? "Bind this directory to a workspace:";
   const dirName = opts.dirName ?? basename5(process.cwd());
-  const all = await withSpinner("Listing your workspaces", () => fetchWorkspaces(client));
+  const all = await withSpinner(
+    "Listing your workspaces",
+    () => fetchWorkspaces(client)
+  );
   if (all.length === 0) {
-    process.stderr.write(`no workspaces found \u2014 skipping workspace binding (you can set it later with \`sechroom config set --local workspaceId <id>\`)
-`);
+    process.stderr.write(
+      `no workspaces found \u2014 skipping workspace binding (you can set it later with \`sechroom config set --local workspaceId <id>\`)
+`
+    );
     return void 0;
   }
   const byId = new Map(all.map((w) => [w.id, w]));
@@ -11823,19 +12892,35 @@ async function pickWorkspace(client, opts = {}) {
   const matched = candidates.filter(isMatch).sort(byPath);
   const rest = candidates.filter((w) => !isMatch(w)).sort(byPath);
   const choices = [
-    ...matched.map((w) => ({ label: workspacePath(w, byId), value: w.id, hint: style.dim(`matches "${dirName}"`) })),
-    ...rest.map((w) => ({ label: workspacePath(w, byId), value: w.id, hint: w.id })),
-    { label: style.dim("skip \u2014 don't bind a workspace"), value: SKIP, hint: void 0 }
+    ...matched.map((w) => ({
+      label: workspacePath(w, byId),
+      value: w.id,
+      hint: style.dim(`matches "${dirName}"`)
+    })),
+    ...rest.map((w) => ({
+      label: workspacePath(w, byId),
+      value: w.id,
+      hint: w.id
+    })),
+    {
+      label: style.dim("skip \u2014 don't bind a workspace"),
+      value: SKIP,
+      hint: void 0
+    }
   ];
   const defaultValue = matched.length === 1 ? matched[0].id : SKIP;
   const chosen = candidates.length > 12 ? await promptAutocomplete(promptLabel, choices, defaultValue) : await promptSelect(promptLabel, choices, defaultValue);
   if (chosen === SKIP) return void 0;
   const picked = byId.get(chosen);
-  const collisions = all.filter((w) => w.id !== picked.id && namesCollide(w.name, picked.name));
+  const collisions = all.filter(
+    (w) => w.id !== picked.id && namesCollide(w.name, picked.name)
+  );
   if (collisions.length > 0) {
     process.stderr.write(
       `${warn("\u26A0")} ${collisions.length} other workspace(s) have a similar name to ${style.cyan(workspacePath(picked, byId))}:
-` + collisions.map((w) => `    ${style.dim(workspacePath(w, byId))} ${style.dim(`(${w.id})`)}`).join("\n") + `
+` + collisions.map(
+        (w) => `    ${style.dim(workspacePath(w, byId))} ${style.dim(`(${w.id})`)}`
+      ).join("\n") + `
     You picked ${style.dim(picked.id)} \u2014 re-run \`sechroom config set --local workspaceId <id>\` if that's wrong.
 `
     );
@@ -11862,10 +12947,17 @@ async function ensureTenant(baseUrl, g, opts) {
   const local = readLocalConfig();
   let tenant = g.tenant ?? process.env.SECHROOM_TENANT ?? local.tenant ?? persisted.tenant ?? "";
   if (!tenant) {
-    const client = await makeClient({ baseUrl, tenant: "", account: resolveAccountAlias(), clientId: persisted.clientId });
+    const client = await makeClient({
+      baseUrl,
+      tenant: "",
+      account: resolveAccountAlias(),
+      clientId: persisted.clientId
+    });
     const { data, error } = await client.GET("/auth/me/tenants", {});
     if (error) {
-      fail(`Couldn't list your tenants: ${JSON.stringify(error)}. Pass --tenant <id> to skip this.`);
+      fail(
+        `Couldn't list your tenants: ${JSON.stringify(error)}. Pass --tenant <id> to skip this.`
+      );
     }
     const tenants = data?.tenants ?? [];
     if (tenants.length === 0) {
@@ -11897,21 +12989,44 @@ async function ensureTenant(baseUrl, g, opts) {
     }
   }
   const existingWorkspace = local.workspaceId ?? persisted.workspaceId ?? void 0;
-  const wsClient = await makeClient({ baseUrl, tenant, account: resolveAccountAlias(), clientId: persisted.clientId });
-  const workspaceId = await resolveWorkspaceBinding(wsClient, existingWorkspace, {
-    yes: opts.yes,
-    json: opts.json,
-    workspace: opts.workspace
+  const wsClient = await makeClient({
+    baseUrl,
+    tenant,
+    account: resolveAccountAlias(),
+    clientId: persisted.clientId
   });
+  const workspaceId = await resolveWorkspaceBinding(
+    wsClient,
+    existingWorkspace,
+    {
+      yes: opts.yes,
+      json: opts.json,
+      workspace: opts.workspace
+    }
+  );
   const defaultProjectId = local.defaultProjectId ?? persisted.defaultProjectId ?? void 0;
-  if (defaultProjectId && workspaceId) await warnIfProjectStray(wsClient, defaultProjectId, workspaceId, opts.json);
+  if (defaultProjectId && workspaceId)
+    await warnIfProjectStray(
+      wsClient,
+      defaultProjectId,
+      workspaceId,
+      opts.json
+    );
   let storeLocal = Boolean(opts.local);
   if (!opts.local && canPrompt() && !opts.yes) {
     storeLocal = await promptSelect(
       "Where should this tenant + base URL be saved?",
       [
-        { label: "Globally", value: "global", hint: "all projects on this machine" },
-        { label: "This directory", value: "local", hint: ".sechroom.json \u2014 committed, project + subdirs" }
+        {
+          label: "Globally",
+          value: "global",
+          hint: "all projects on this machine"
+        },
+        {
+          label: "This directory",
+          value: "local",
+          hint: ".sechroom.json \u2014 committed, project + subdirs"
+        }
       ],
       local.path ? "local" : "global"
     ) === "local";
@@ -11920,19 +13035,34 @@ async function ensureTenant(baseUrl, g, opts) {
     const patch = { baseUrl, tenant, ...workspaceId ? { workspaceId } : {} };
     if (storeLocal) {
       const path = writeLocalConfig(patch, { here: Boolean(opts.here) });
-      if (!opts.json) process.stderr.write(`${ok("\u2713")} config saved to ${path} (directory-local)
-`);
+      if (!opts.json)
+        process.stderr.write(
+          `${ok("\u2713")} config saved to ${path} (directory-local)
+`
+        );
     } else {
       writePersisted(patch);
-      if (!opts.json) process.stderr.write(`${ok("\u2713")} config saved globally (~/.config/sechroom/config.json)
-`);
+      if (!opts.json)
+        process.stderr.write(
+          `${ok("\u2713")} config saved globally (~/.config/sechroom/config.json)
+`
+        );
     }
     if (workspaceId && !existingWorkspace && !opts.json) {
-      process.stderr.write(`${ok("\u2713")} bound to workspace ${style.dim(workspaceId)}
-`);
+      process.stderr.write(
+        `${ok("\u2713")} bound to workspace ${style.dim(workspaceId)}
+`
+      );
     }
   }
-  return { baseUrl, tenant, account: resolveAccountAlias(), workspaceId, defaultProjectId, clientId: persisted.clientId };
+  return {
+    baseUrl,
+    tenant,
+    account: resolveAccountAlias(),
+    workspaceId,
+    defaultProjectId,
+    clientId: persisted.clientId
+  };
 }
 async function ensureAuth(cfg, yes) {
   if (process.env.SECHROOM_TOKEN) return;
@@ -11940,17 +13070,27 @@ async function ensureAuth(cfg, yes) {
   const usable = Boolean(cached?.accessToken) && (cached.expiresAt === void 0 || Date.now() < cached.expiresAt - 6e4 || Boolean(cached.refreshToken));
   if (usable) return;
   if (!canPrompt() || yes) {
-    fail("Not signed in. Run `sechroom login` first, or set SECHROOM_TOKEN for headless use.");
+    fail(
+      "Not signed in. Run `sechroom login` first, or set SECHROOM_TOKEN for headless use."
+    );
   }
-  process.stderr.write("\nNot signed in \u2014 opening the browser to authenticate.\n");
+  process.stderr.write(
+    "\nNot signed in \u2014 opening the browser to authenticate.\n"
+  );
   await login(cfg);
 }
 async function ensureTimezone(cfg, opts) {
   const client = await makeClient(cfg);
   const { data, error } = await client.GET("/me/profile", {});
-  if (error) return { timezone: null, action: "skipped", note: "could not read profile" };
+  if (error)
+    return {
+      timezone: null,
+      action: "skipped",
+      note: "could not read profile"
+    };
   const current = data?.effectiveTimezone;
-  if (current && current.trim().length > 0) return { timezone: current, action: "already-set" };
+  if (current && current.trim().length > 0)
+    return { timezone: current, action: "already-set" };
   const system = systemTimezone();
   let tz = system;
   if (canPrompt() && !opts.yes) {
@@ -11962,12 +13102,18 @@ async function ensureTimezone(cfg, opts) {
       note: "no timezone set \u2014 re-run interactively or pass --yes to adopt the system timezone"
     };
   }
-  if (!tz) return { timezone: null, action: "skipped", note: "no timezone provided" };
+  if (!tz)
+    return { timezone: null, action: "skipped", note: "no timezone provided" };
   if (opts.dryRun) return { timezone: tz, action: "dry-run" };
   const { error: putErr } = await client.PUT("/me/profile", {
     body: { displayName: null, photoUrl: null, bio: null, timezone: tz }
   });
-  if (putErr) return { timezone: tz, action: "skipped", note: `update failed: ${JSON.stringify(putErr)}` };
+  if (putErr)
+    return {
+      timezone: tz,
+      action: "skipped",
+      note: `update failed: ${JSON.stringify(putErr)}`
+    };
   return { timezone: tz, action: "set" };
 }
 async function chooseClients(clientFlag, yes, cwd) {
@@ -11992,7 +13138,11 @@ async function chooseScope(scopeFlag, yes) {
   return promptSelect(
     "Install skills, agents, and hooks globally or just for this project?",
     [
-      { label: "Globally", value: "global", hint: "~/.claude (or CLAUDE_CONFIG_DIR) \u2014 all projects" },
+      {
+        label: "Globally",
+        value: "global",
+        hint: "~/.claude (or CLAUDE_CONFIG_DIR) \u2014 all projects"
+      },
       { label: "This project", value: "project", hint: "<repo>/.claude" }
     ],
     "global"
@@ -12001,7 +13151,13 @@ async function chooseScope(scopeFlag, yes) {
 async function planRecurseChild(entry, root, client, opts) {
   const dir = resolveChildDir(entry.path, root);
   if (!existsSync15(dir)) {
-    return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
+    return {
+      label: entry.path,
+      dir,
+      disposition: "skip-missing",
+      argv: [],
+      reason: "directory does not exist"
+    };
   }
   if (existsSync15(join21(dir, ".sechroom.json"))) {
     return {
@@ -12022,20 +13178,40 @@ async function planRecurseChild(entry, root, client, opts) {
     };
   }
   if (opts.dryRun) {
-    return { label: entry.path, dir, disposition: "bind", argv: ["onboard", "--yes", "--local", "--workspace", "<prompt>"], reason: "unbound \u2014 would prompt for a workspace" };
+    return {
+      label: entry.path,
+      dir,
+      disposition: "bind",
+      argv: ["onboard", "--yes", "--local", "--workspace", "<prompt>"],
+      reason: "unbound \u2014 would prompt for a workspace"
+    };
   }
   if (opts.yes || !canPrompt()) {
-    return { label: entry.path, dir, disposition: "skip-unbound", argv: [], reason: "unbound + no workspace (run interactively, or add it to ./.sechroom/repos.json)" };
+    return {
+      label: entry.path,
+      dir,
+      disposition: "skip-unbound",
+      argv: [],
+      reason: "unbound + no workspace (run interactively, or add it to ./.sechroom/repos.json)"
+    };
   }
-  process.stderr.write(`
+  process.stderr.write(
+    `
 ${style.bold(entry.path)} ${style.dim("is not bound yet.")}
-`);
+`
+  );
   const ws = await pickWorkspace(client, {
     promptLabel: `Bind ${style.cyan(entry.path)} to a workspace:`,
     dirName: basename5(entry.path)
   });
   if (!ws) {
-    return { label: entry.path, dir, disposition: "skip-unbound", argv: [], reason: "unbound \u2014 no workspace chosen (skipped)" };
+    return {
+      label: entry.path,
+      dir,
+      disposition: "skip-unbound",
+      argv: [],
+      reason: "unbound \u2014 no workspace chosen (skipped)"
+    };
   }
   return {
     label: entry.path,
@@ -12050,20 +13226,34 @@ async function resolveFanoutLane(cfg, opts) {
   let design = opts.designLane ?? process.env.SECHROOM_DESIGN_LANE;
   if (!code || !design) {
     const clients = detectInstalledClients(process.cwd());
-    const inferred = await inferLanes(cfg, clients.length ? clients : void 0);
+    const inferred = await inferLanes(
+      cfg,
+      clients.length ? clients : void 0
+    );
     code = code ?? inferred.code;
     design = design ?? inferred.design;
   }
   if (!opts.lane && !opts.yes && !opts.dryRun && canPrompt() && (code || design)) {
-    process.stderr.write(`
+    process.stderr.write(
+      `
 This fan-out will pin the same lane in every repo:
-`);
-    if (code) process.stderr.write(`  ${style.dim("code-lane")}   = ${style.cyan(code)}
-`);
-    if (design) process.stderr.write(`  ${style.dim("design-lane")} = ${style.cyan(design)}
-`);
+`
+    );
+    if (code)
+      process.stderr.write(
+        `  ${style.dim("code-lane")}   = ${style.cyan(code)}
+`
+      );
+    if (design)
+      process.stderr.write(
+        `  ${style.dim("design-lane")} = ${style.cyan(design)}
+`
+      );
     if (!await promptYesNo("Use this lane for all repos?")) {
-      code = await promptText("Code-lane id (blank = let each repo infer)?", code ?? "") || void 0;
+      code = await promptText(
+        "Code-lane id (blank = let each repo infer)?",
+        code ?? ""
+      ) || void 0;
       design = await promptText("Design-lane id (blank = skip)?", design ?? "") || void 0;
     }
   }
@@ -12081,30 +13271,112 @@ async function runRecurse(cfg, g, opts) {
   const entries = fromManifest ?? discoverChildren(root).map((path) => ({ path }));
   const sourceLabel = fromManifest ? `manifest ${manifestPath}` : `auto-discovered under ${root}`;
   if (entries.length === 0) {
-    if (json) process.stdout.write(JSON.stringify({ recurse: true, root, repos: [] }) + "\n");
-    else process.stderr.write(`${warn("\u26A0")} no child repos found ${fromManifest ? `in ${manifestPath}` : `under ${root}`} \u2014 nothing to do.
-`);
+    if (json)
+      process.stdout.write(
+        JSON.stringify({ recurse: true, root, repos: [] }) + "\n"
+      );
+    else
+      process.stderr.write(
+        `${warn("\u26A0")} no child repos found ${fromManifest ? `in ${manifestPath}` : `under ${root}`} \u2014 nothing to do.
+`
+      );
     return;
   }
   if (!json) {
-    process.stderr.write(`${style.bold("onboard --recurse")} ${style.dim(`(${entries.length} repo${entries.length === 1 ? "" : "s"} from ${sourceLabel})`)}
-`);
+    process.stderr.write(
+      `${style.bold("onboard --recurse")} ${style.dim(`(${entries.length} repo${entries.length === 1 ? "" : "s"} from ${sourceLabel})`)}
+`
+    );
   }
-  const lane = await resolveFanoutLane(cfg, { lane: opts.lane, designLane: opts.designLane, yes, dryRun });
-  if (!json && lane.code) process.stderr.write(`${ok("\u2713")} lane ${style.cyan(lane.code)}${lane.design ? ` ${style.dim(`/ ${lane.design}`)}` : ""} for every repo
-`);
+  const lane = await resolveFanoutLane(cfg, {
+    lane: opts.lane,
+    designLane: opts.designLane,
+    yes,
+    dryRun
+  });
+  if (!json && lane.code)
+    process.stderr.write(
+      `${ok("\u2713")} lane ${style.cyan(lane.code)}${lane.design ? ` ${style.dim(`/ ${lane.design}`)}` : ""} for every repo
+`
+    );
   const client = await makeClient(cfg);
   const plans = [];
-  for (const entry of entries) plans.push(await planRecurseChild(entry, root, client, { yes, dryRun }));
-  const results = runChildren(plans, { globals: passthroughGlobals(g), dryRun, json });
+  for (const entry of entries)
+    plans.push(await planRecurseChild(entry, root, client, { yes, dryRun }));
+  const results = runChildren(plans, {
+    globals: passthroughGlobals(g),
+    dryRun,
+    json
+  });
   if (json) {
-    process.stdout.write(JSON.stringify({ recurse: true, root, dryRun, repos: results }) + "\n");
+    process.stdout.write(
+      JSON.stringify({ recurse: true, root, dryRun, repos: results }) + "\n"
+    );
     return;
   }
   summarizeFanout(results, { dryRun });
 }
 function registerOnboard(program2) {
-  program2.command("onboard").description("Guided first-run setup: configure, sign in, set timezone, detect clients, and wire this project").option("--recurse", "orchestration-root mode: onboard every child repo under this dir (auto-discovered, or from ./.sechroom/repos.json) \u2014 refreshes bound repos, prompts a workspace per new one", false).option("--lane <id>", "set the code-lane (substrate source identity) explicitly instead of inferring it; with --recurse it's used for every child repo").option("--design-lane <id>", "set the design-lane explicitly (substrate-authoring identity); with --recurse applies to every child").option("--client <list...>", `clients to wire \u2014 space- or comma-separated (${ALL_CLIENT_KEYS.join(", ")}) or 'all' (default: auto-detected)`).option("--scope <scope>", "install skills/agents/hooks 'global' (config dir / CLAUDE_CONFIG_DIR) or 'project' (<cwd>/.claude) \u2014 default: prompt, else global").option("--local", "save the binding (tenant + base URL + workspace) to a committed .sechroom.json in this repo instead of the global config", false).option("--here", "with --local: write the binding at THIS directory even when a parent already carries one \u2014 binds a subtree (e.g. a monorepo's frontend/) to its own workspace", false).option("--workspace <id>", "bind this directory to a workspace (skips the interactive workspace pick)").option("--cli-only", "configure the CLI only \u2014 don't wire any AI client (no MCP config, no agent files)", false).option("--no-mcp", "skip the MCP server config (.mcp.json etc.); still write the agent instruction files").option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--dry-run", "walk through without writing files or changing the profile", false).option("--refresh", "re-fetch descriptors and refresh any out-of-date managed blocks (local edits preserved to .proposed)", false).option("--force", "rewrite every managed block, overwriting local edits inside the markers (content outside untouched)", false).option("--check", "report whether anything would change and exit (0 = current/stub, 1 = stale/drift/absent); writes nothing", false).option("-y, --yes", "non-interactive: accept defaults (system timezone, detected clients, global config, full wire)", false).addHelpText(
+  program2.command("onboard").description(
+    "Guided first-run setup: configure, sign in, set timezone, detect clients, and wire this project"
+  ).option(
+    "--recurse",
+    "orchestration-root mode: onboard every child repo under this dir (auto-discovered, or from ./.sechroom/repos.json) \u2014 refreshes bound repos, prompts a workspace per new one",
+    false
+  ).option(
+    "--lane <id>",
+    "set the code-lane (substrate source identity) explicitly instead of inferring it; with --recurse it's used for every child repo"
+  ).option(
+    "--design-lane <id>",
+    "set the design-lane explicitly (substrate-authoring identity); with --recurse applies to every child"
+  ).option(
+    "--client <list...>",
+    `clients to wire \u2014 space- or comma-separated (${ALL_CLIENT_KEYS.join(", ")}) or 'all' (default: auto-detected)`
+  ).option(
+    "--scope <scope>",
+    "install skills/agents/hooks 'global' (config dir / CLAUDE_CONFIG_DIR) or 'project' (<cwd>/.claude) \u2014 default: prompt, else global"
+  ).option(
+    "--local",
+    "save the binding (tenant + base URL + workspace) to a committed .sechroom.json in this repo instead of the global config",
+    false
+  ).option(
+    "--here",
+    "with --local: write the binding at THIS directory even when a parent already carries one \u2014 binds a subtree (e.g. a monorepo's frontend/) to its own workspace",
+    false
+  ).option(
+    "--workspace <id>",
+    "bind this directory to a workspace (skips the interactive workspace pick)"
+  ).option(
+    "--cli-only",
+    "configure the CLI only \u2014 don't wire any AI client (no MCP config, no agent files)",
+    false
+  ).option(
+    "--no-mcp",
+    "skip the MCP server config (.mcp.json etc.); still write the agent instruction files"
+  ).option(
+    "--copy",
+    "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)"
+  ).option(
+    "--dry-run",
+    "walk through without writing files or changing the profile",
+    false
+  ).option(
+    "--refresh",
+    "re-fetch descriptors and refresh any out-of-date managed blocks (local edits preserved to .proposed)",
+    false
+  ).option(
+    "--force",
+    "rewrite every managed block, overwriting local edits inside the markers (content outside untouched)",
+    false
+  ).option(
+    "--check",
+    "report whether anything would change and exit (0 = current/stub or unresolved warning, 1 = stale/drift/absent); writes nothing",
+    false
+  ).option(
+    "-y, --yes",
+    "non-interactive: accept defaults (system timezone, detected clients, global config, full wire)",
+    false
+  ).addHelpText(
     "after",
     `
 Examples:
@@ -12127,20 +13399,56 @@ Examples:
     const check = mode === "check";
     const yes = Boolean(opts.yes) || check;
     if (check && (opts.recurse || opts.cliOnly)) {
-      fail("--check inspects this project's agent files and cannot be combined with --recurse or --cli-only.");
+      fail(
+        "--check inspects this project's agent files and cannot be combined with --recurse or --cli-only."
+      );
     }
     if (opts.lane) process.env.SECHROOM_CODE_LANE = opts.lane;
     if (opts.designLane) process.env.SECHROOM_DESIGN_LANE = opts.designLane;
     if (opts.recurse) {
       const baseUrl2 = resolveBaseUrl(g);
-      await ensureAuth({ baseUrl: baseUrl2, tenant: "", account: resolveAccountAlias(), clientId: readPersisted().clientId }, yes);
-      const cfg2 = await ensureTenant(baseUrl2, g, { yes: true, json, persist: false });
-      await runRecurse(cfg2, g, { yes, dryRun, json, lane: opts.lane, designLane: opts.designLane });
+      await ensureAuth(
+        {
+          baseUrl: baseUrl2,
+          tenant: "",
+          account: resolveAccountAlias(),
+          clientId: readPersisted().clientId
+        },
+        yes
+      );
+      const cfg2 = await ensureTenant(baseUrl2, g, {
+        yes: true,
+        json,
+        persist: false
+      });
+      await runRecurse(cfg2, g, {
+        yes,
+        dryRun,
+        json,
+        lane: opts.lane,
+        designLane: opts.designLane
+      });
       return;
     }
     const baseUrl = resolveBaseUrl(g);
-    await ensureAuth({ baseUrl, tenant: "", account: resolveAccountAlias(), clientId: readPersisted().clientId }, yes);
-    const cfg = await ensureTenant(baseUrl, g, { yes, json, local: Boolean(opts.local), workspace: opts.workspace, persist: !check });
+    await ensureAuth(
+      {
+        baseUrl,
+        tenant: "",
+        account: resolveAccountAlias(),
+        clientId: readPersisted().clientId
+      },
+      yes
+    );
+    const scope = await chooseScope(opts.scope, yes);
+    const cfg = await ensureTenant(baseUrl, g, {
+      yes,
+      json,
+      local: Boolean(opts.local) || scope === "project",
+      here: scope === "project" ? true : Boolean(opts.here),
+      workspace: opts.workspace,
+      persist: !check
+    });
     const tz = await ensureTimezone(cfg, { yes, dryRun: dryRun || check });
     if (!json && tz.action !== "already-set") {
       const line = tz.action === "set" ? `${ok("\u2713")} timezone set to ${tz.timezone}
@@ -12150,21 +13458,48 @@ Examples:
       process.stderr.write(line);
     }
     const wire = await chooseWire(opts, yes);
-    const scope = await chooseScope(opts.scope, yes);
-    const claudeTargets = resolveClaudeTargets({ override: g.claudeConfigDir, scope, cwd: process.cwd() });
+    const claudeTargets = resolveClaudeTargets({
+      override: g.claudeConfigDir,
+      scope,
+      cwd: process.cwd()
+    });
     const codexHomes = resolveCodexHomes({ override: g.codexHome, scope });
     if (scope === "project" && g.claudeConfigDir && !json) {
-      process.stderr.write(`${style.dim("(--claude-config-dir is ignored for --scope project \u2014 project files are repo-relative)")}
-`);
+      process.stderr.write(
+        `${style.dim("(--claude-config-dir is ignored for --scope project \u2014 project files are repo-relative)")}
+`
+      );
     }
     if (wire === "cli-only") {
       if (json) {
-        emit({ dryRun, baseUrl: cfg.baseUrl, tenant: cfg.tenant, workspaceId: cfg.workspaceId ?? null, timezone: tz, wire, clients: [] }, true);
+        emit(
+          {
+            dryRun,
+            baseUrl: cfg.baseUrl,
+            tenant: cfg.tenant,
+            workspaceId: cfg.workspaceId ?? null,
+            timezone: tz,
+            wire,
+            clients: []
+          },
+          true
+        );
         return;
       }
       if (!dryRun) {
-        await ensureLanePin(cfg, { yes, dryRun, clients: detectInstalledClients(process.cwd()) });
-        await maybeOfferHooks({ yes, dryRun, cwd: process.cwd(), scope, claudeConfigDir: g.claudeConfigDir, codexHome: g.codexHome });
+        await ensureLanePin(cfg, {
+          yes,
+          dryRun,
+          clients: detectInstalledClients(process.cwd())
+        });
+        await maybeOfferHooks({
+          yes,
+          dryRun,
+          cwd: process.cwd(),
+          scope,
+          claudeConfigDir: g.claudeConfigDir,
+          codexHome: g.codexHome
+        });
       }
       process.stdout.write(
         `
@@ -12175,12 +13510,36 @@ Try: ${style.cyan('sechroom memory search "..."')}  or  ${style.cyan("sechroom -
       await printStarterPrompt("cli");
       return;
     }
-    const keys = await chooseClients(opts.client, yes, process.cwd());
-    const setup = await withSpinner("Fetching setup descriptors", () => fetchSetup(cfg));
-    const targets = clientTargets(process.cwd(), { claudeDir: claudeTargets[0]?.dir, codexHome: codexHomes[0] });
+    const requestedKeys = await chooseClients(
+      opts.client,
+      yes,
+      process.cwd()
+    );
+    const keys = scope === "project" ? requestedKeys.filter((key) => key !== "codex") : requestedKeys;
+    if (scope === "project" && requestedKeys.includes("codex") && !json) {
+      process.stderr.write(
+        `${style.dim("Codex has no project scope \u2014 skipped (use --scope global for Codex).")}
+`
+      );
+    }
+    const setup = await withSpinner(
+      "Fetching setup descriptors",
+      () => fetchSetup(cfg)
+    );
+    const targets = clientTargets(process.cwd(), {
+      claudeDir: claudeTargets[0]?.dir,
+      codexHome: codexHomes[0] ?? null
+    });
     const personalWorkspaceId = await getPersonalWorkspaceId(cfg);
     if (!dryRun && !check) {
-      await maybeOfferCopies(cfg, setup, targets, keys, personalWorkspaceId, copyChoice(opts));
+      await maybeOfferCopies(
+        cfg,
+        setup,
+        targets,
+        keys,
+        personalWorkspaceId,
+        copyChoice(opts)
+      );
     }
     const writeMcp = wire === "full";
     const result = [];
@@ -12197,16 +13556,11 @@ Try: ${style.cyan('sechroom memory search "..."')}  or  ${style.cyan("sechroom -
       if (!json && !check) printActions(target, actions);
     }
     if (check) {
-      reportCheckAndExit(
-        result,
-        json,
-        "sechroom onboard --refresh",
-        {
-          baseUrl: cfg.baseUrl,
-          tenant: cfg.tenant,
-          workspaceId: cfg.workspaceId ?? null
-        }
-      );
+      reportCheckAndExit(result, json, "sechroom onboard --refresh", {
+        baseUrl: cfg.baseUrl,
+        tenant: cfg.tenant,
+        workspaceId: cfg.workspaceId ?? null
+      });
     }
     const evalCounts = buildCheckReport(result).eval;
     if (!json && !dryRun) {
@@ -12214,19 +13568,45 @@ Try: ${style.cyan('sechroom memory search "..."')}  or  ${style.cyan("sechroom -
     }
     if (!json && !dryRun) {
       for (const t of claudeTargets) {
-        await maybeOfferSkills(cfg, personalWorkspaceId, { yes, dryRun, surface: "claude-code", configDir: t.dir });
+        await maybeOfferSkills(cfg, personalWorkspaceId, {
+          yes,
+          dryRun,
+          surface: "claude-code",
+          configDir: t.dir
+        });
       }
     }
     if (!json && !dryRun) {
-      await maybeOfferHooks({ yes, dryRun, cwd: process.cwd(), scope, claudeConfigDir: g.claudeConfigDir, codexHome: g.codexHome });
+      await maybeOfferHooks({
+        yes,
+        dryRun,
+        cwd: process.cwd(),
+        scope,
+        claudeConfigDir: g.claudeConfigDir,
+        codexHome: g.codexHome
+      });
     }
     if (json) {
-      emit({ dryRun, baseUrl: cfg.baseUrl, tenant: cfg.tenant, workspaceId: cfg.workspaceId ?? null, timezone: tz, wire, eval: evalCounts, clients: result }, true);
+      emit(
+        {
+          dryRun,
+          baseUrl: cfg.baseUrl,
+          tenant: cfg.tenant,
+          workspaceId: cfg.workspaceId ?? null,
+          timezone: tz,
+          wire,
+          eval: evalCounts,
+          clients: result
+        },
+        true
+      );
       return;
     }
     if (!dryRun && evalCounts.stale) {
-      process.stderr.write(`${style.cyan("\u21BB")} refreshed ${evalCounts.stale} section(s) the server had moved
-`);
+      process.stderr.write(
+        `${style.cyan("\u21BB")} refreshed ${evalCounts.stale} section(s) the server had moved
+`
+      );
     }
     if (!dryRun && evalCounts.drift) {
       process.stderr.write(
@@ -12235,7 +13615,9 @@ Try: ${style.cyan('sechroom memory search "..."')}  or  ${style.cyan("sechroom -
 `
       );
     }
-    const wroteSomething = result.some(({ actions }) => actions.some((a) => a.status === "created" || a.status === "merged"));
+    const wroteSomething = result.some(
+      ({ actions }) => actions.some((a) => a.status === "created" || a.status === "merged")
+    );
     process.stdout.write(
       dryRun ? "\n(dry run \u2014 nothing written)\n" : !wroteSomething ? `
 ${style.bold("Done.")} Everything's already up to date.
@@ -12254,9 +13636,21 @@ async function chooseWire(opts, yes) {
     return promptSelect(
       "How should I set up Sechroom in this project?",
       [
-        { label: "Wire my AI client", value: "full", hint: "MCP server (.mcp.json) + agent instructions" },
-        { label: "Agent instructions only", value: "agent-only", hint: "skip MCP config" },
-        { label: "CLI only", value: "cli-only", hint: "don't write any AI-client files" }
+        {
+          label: "Wire my AI client",
+          value: "full",
+          hint: "MCP server (.mcp.json) + agent instructions"
+        },
+        {
+          label: "Agent instructions only",
+          value: "agent-only",
+          hint: "skip MCP config"
+        },
+        {
+          label: "CLI only",
+          value: "cli-only",
+          hint: "don't write any AI-client files"
+        }
       ],
       "full"
     );
@@ -12278,7 +13672,9 @@ ${rule}
 }
 async function printStarterPrompt(mode, cfg) {
   if (mode === "cli") {
-    printNextStepBlock("Next \u2014 pick up where you left off:", [style.cyan("sechroom continuity resume-me")]);
+    printNextStepBlock("Next \u2014 pick up where you left off:", [
+      style.cyan("sechroom continuity resume-me")
+    ]);
     return;
   }
   let primary = FALLBACK_AGENT_PROMPT;
@@ -12290,7 +13686,9 @@ async function printStarterPrompt(mode, cfg) {
     } catch {
     }
   }
-  printNextStepBlock("Next \u2014 paste this into your AI agent to get going:", [style.cyan(`"${primary}"`)]);
+  printNextStepBlock("Next \u2014 paste this into your AI agent to get going:", [
+    style.cyan(`"${primary}"`)
+  ]);
 }
 
 // src/commands/project.ts
@@ -12443,7 +13841,13 @@ Examples:
   $ sechroom relationship suggestions --status Pending --memory mem_XXXX
   $ sechroom relationship suggestion accept rsg_XXXX`
   );
-  relationship.command("create <fromMemoryId> <toMemoryId>").description("Create a relationship (POST /memories/{memoryId}/relationships)").option("--type <type>", "Relationship type (Reference, Related, Parent, Child, Follows, \u2026)", "Reference").option(
+  relationship.command("create <fromMemoryId> <toMemoryId>").description(
+    "Create a relationship (POST /memories/{memoryId}/relationships)"
+  ).option(
+    "--type <type>",
+    "Relationship type (Reference, Related, Parent, Child, Follows, \u2026)",
+    "Reference"
+  ).option(
     "--to-version <number>",
     "Version of the target memory to pin the edge to (defaults to the target's current version)"
   ).action(async (fromMemoryId, toMemoryId, opts, cmd) => {
@@ -12453,15 +13857,21 @@ Examples:
     if (opts.toVersion !== void 0) {
       toVersion = Number(opts.toVersion);
       if (!Number.isInteger(toVersion) || toVersion < 1) {
-        fail(`--to-version must be a positive integer (got '${opts.toVersion}').`);
+        fail(
+          `--to-version must be a positive integer (got '${opts.toVersion}').`
+        );
       }
     } else {
       const target = await runApi(
         "Resolving target version",
-        async () => client.GET("/memories/{memoryId}", { params: { path: { memoryId: toMemoryId } } })
+        async () => client.GET("/memories/{memoryId}", {
+          params: { path: { memoryId: toMemoryId } }
+        })
       );
       if (typeof target.item?.currentVersion !== "number") {
-        fail(`Could not resolve the current version of ${toMemoryId}; pass --to-version explicitly.`);
+        fail(
+          `Could not resolve the current version of ${toMemoryId}; pass --to-version explicitly.`
+        );
       }
       toVersion = target.item.currentVersion;
     }
@@ -12485,22 +13895,28 @@ Examples:
       cmd.optsWithGlobals().json
     );
   });
-  relationship.command("list <memoryId>").description("List a memory's relationships (GET /memories/{memoryId}/relationships)").option("--direction <direction>", "Both | Outbound | Inbound").option("--include-deleted", "Include deleted relationships", false).option("--page <n>", "Page number").option("--page-size <n>", "Page size").action(async (memoryId, opts, cmd) => {
+  relationship.command("list <memoryId>").description(
+    "List a memory's relationships (GET /memories/{memoryId}/relationships). Walks every page by default."
+  ).option("--direction <direction>", "Both | Outbound | Inbound").option("--include-deleted", "Include deleted relationships", false).option(...PAGE_OPTION).option(...PAGE_SIZE_OPTION).option(...NO_AUTO_PAGE_OPTION).action(async (memoryId, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Listing relationships", async () => {
+    const filters = {
+      ...opts.direction ? { direction: opts.direction } : {},
+      ...opts.includeDeleted ? { includeDeleted: true } : {}
+    };
+    const readPage = (query) => runApi("Listing relationships", async () => {
       const client = await makeClient(cfg);
       return client.GET("/memories/{memoryId}/relationships", {
-        params: {
-          path: { memoryId },
-          query: {
-            ...opts.direction ? { direction: opts.direction } : {},
-            ...opts.includeDeleted ? { includeDeleted: true } : {},
-            ...opts.page ? { page: Number(opts.page) } : {},
-            ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
-          }
-        }
+        params: { path: { memoryId }, query: { ...filters, ...query } }
       });
     });
+    const data = shouldAutoPage(opts) ? await fetchAllPages(
+      (page) => readPage({
+        page,
+        ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
+      }),
+      opts,
+      "relationships"
+    ) : await readPage(singlePageQuery(opts));
     emit(data, cmd.optsWithGlobals().json);
   });
   relationship.command("delete <id>").description("Delete a relationship (DELETE /relationships/{id})").action(async (id, _opts, cmd) => {
@@ -12512,9 +13928,15 @@ Examples:
         body: {}
       });
     });
-    emitAction(`deleted relationship ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+    emitAction(
+      `deleted relationship ${style.bold(id)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
-  relationship.command("suggest <memoryId>").description("Generate relationship suggestions for a memory (POST /memories/{memoryId}/suggest-relationships)").option("--limit <n>", "Max suggestions to generate").action(async (memoryId, opts, cmd) => {
+  relationship.command("suggest <memoryId>").description(
+    "Generate relationship suggestions for a memory (POST /memories/{memoryId}/suggest-relationships)"
+  ).option("--limit <n>", "Max suggestions to generate").action(async (memoryId, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Suggesting relationships", async () => {
       const client = await makeClient(cfg);
@@ -12531,38 +13953,51 @@ Examples:
       cmd.optsWithGlobals().json
     );
   });
-  relationship.command("suggestions").description("List relationship suggestions (GET /relationship-suggestions)").option("--memory <memoryId>", "Filter to a memory").option(
+  relationship.command("suggestions").description(
+    "List relationship suggestions (GET /relationship-suggestions)"
+  ).option("--memory <memoryId>", "Filter to a memory").option(
     "--status <status>",
     "Pending | Accepted | EditedAndAccepted | Rejected | Superseded | Deferred | Invalidated"
-  ).option("--page <n>", "Page number").option("--page-size <n>", "Page size").action(async (opts, cmd) => {
+  ).option(...PAGE_OPTION).option(...PAGE_SIZE_OPTION).option(...NO_AUTO_PAGE_OPTION).action(async (opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Listing suggestions", async () => {
+    const filters = {
+      ...opts.memory ? { memoryId: opts.memory } : {},
+      ...opts.status ? {
+        status: opts.status
+      } : {}
+    };
+    const readPage = (query) => runApi("Listing suggestions", async () => {
       const client = await makeClient(cfg);
       return client.GET("/relationship-suggestions", {
-        params: {
-          query: {
-            ...opts.memory ? { memoryId: opts.memory } : {},
-            ...opts.status ? {
-              status: opts.status
-            } : {},
-            ...opts.page ? { page: Number(opts.page) } : {},
-            ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
-          }
-        }
+        params: { query: { ...filters, ...query } }
       });
     });
+    const data = shouldAutoPage(opts) ? await fetchAllPages(
+      (page) => readPage({
+        page,
+        ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
+      }),
+      opts,
+      "suggestions"
+    ) : await readPage(singlePageQuery(opts));
     emit(data, cmd.optsWithGlobals().json);
   });
   const suggestion = relationship.command("suggestion").description("Inspect and decide on a single relationship suggestion");
-  suggestion.command("get <id>").description("Fetch a suggestion by id (GET /relationship-suggestions/{id})").action(async (id, _opts, cmd) => {
+  suggestion.command("get <id>").description(
+    "Fetch a suggestion by id (GET /relationship-suggestions/{id})"
+  ).action(async (id, _opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Fetching suggestion", async () => {
       const client = await makeClient(cfg);
-      return client.GET("/relationship-suggestions/{id}", { params: { path: { id } } });
+      return client.GET("/relationship-suggestions/{id}", {
+        params: { path: { id } }
+      });
     });
     emit(data, cmd.optsWithGlobals().json);
   });
-  suggestion.command("accept <id>").description("Accept a suggestion (POST /relationship-suggestions/{instanceId}/accept)").action(async (id, _opts, cmd) => {
+  suggestion.command("accept <id>").description(
+    "Accept a suggestion (POST /relationship-suggestions/{instanceId}/accept)"
+  ).action(async (id, _opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Accepting suggestion", async () => {
       const client = await makeClient(cfg);
@@ -12571,9 +14006,15 @@ Examples:
         body: {}
       });
     });
-    emitAction(`accepted suggestion ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+    emitAction(
+      `accepted suggestion ${style.bold(id)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
-  suggestion.command("reject <id>").description("Reject a suggestion (POST /relationship-suggestions/{instanceId}/reject)").option("--reason <reason>", "Why it's being rejected").option("--reason-code <code>", "Structured reason code").action(async (id, opts, cmd) => {
+  suggestion.command("reject <id>").description(
+    "Reject a suggestion (POST /relationship-suggestions/{instanceId}/reject)"
+  ).option("--reason <reason>", "Why it's being rejected").option("--reason-code <code>", "Structured reason code").action(async (id, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Rejecting suggestion", async () => {
       const client = await makeClient(cfg);
@@ -12585,9 +14026,18 @@ Examples:
         }
       });
     });
-    emitAction(`rejected suggestion ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+    emitAction(
+      `rejected suggestion ${style.bold(id)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
-  suggestion.command("defer <id>").description("Defer a suggestion (POST /relationship-suggestions/{id}/defer)").option("--until <iso>", "Defer until this ISO date-time (omit to defer indefinitely)").action(async (id, opts, cmd) => {
+  suggestion.command("defer <id>").description(
+    "Defer a suggestion (POST /relationship-suggestions/{id}/defer)"
+  ).option(
+    "--until <iso>",
+    "Defer until this ISO date-time (omit to defer indefinitely)"
+  ).action(async (id, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Deferring suggestion", async () => {
       const client = await makeClient(cfg);
@@ -12598,14 +14048,18 @@ Examples:
         }
       });
     });
-    emitAction(`deferred suggestion ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
+    emitAction(
+      `deferred suggestion ${style.bold(id)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
 }
 
 // src/commands/reset.ts
 import { homedir as homedir6 } from "os";
 import { join as join22 } from "path";
-import { existsSync as existsSync16, readFileSync as readFileSync18, rmSync as rmSync7 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync18, rmSync as rmSync8 } from "fs";
 var SKILLS_LOCK2 = ".sechroom-skills.json";
 var localSkillsDir = () => join22(process.cwd(), ".claude", "skills");
 var globalSkillsDir = () => join22(homedir6(), ".claude", "skills");
@@ -12621,14 +14075,14 @@ function removeMaterialisedSkills(dir) {
       for (const name of entry.skills ?? []) {
         const p = join22(dir, name);
         if (existsSync16(p)) {
-          rmSync7(p, { recursive: true, force: true });
+          rmSync8(p, { recursive: true, force: true });
           removed.push(p);
         }
       }
     }
   } catch {
   }
-  rmSync7(lockPath, { force: true });
+  rmSync8(lockPath, { force: true });
   removed.push(lockPath);
   return removed;
 }
@@ -12667,17 +14121,17 @@ function registerReset(program2) {
     const removed = [];
     const stateDir = join22(process.cwd(), ".sechroom");
     if (existsSync16(stateDir)) {
-      rmSync7(stateDir, { recursive: true, force: true });
+      rmSync8(stateDir, { recursive: true, force: true });
       removed.push(stateDir);
     }
     const legacyCfg = join22(process.cwd(), ".sechroom.json");
     if (existsSync16(legacyCfg)) {
-      rmSync7(legacyCfg, { force: true });
+      rmSync8(legacyCfg, { force: true });
       removed.push(legacyCfg);
     }
     const legacySem = join22(process.cwd(), ".sem");
     if (existsSync16(legacySem)) {
-      rmSync7(legacySem, { force: true });
+      rmSync8(legacySem, { force: true });
       removed.push(legacySem);
     }
     removed.push(...removeMaterialisedSkills(localSkillsDir()));
@@ -12702,7 +14156,7 @@ function registerReset(program2) {
 }
 
 // src/commands/skills.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync18, statSync as statSync6, writeFileSync as writeFileSync17 } from "fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync18, statSync as statSync7, writeFileSync as writeFileSync17 } from "fs";
 import { join as join23 } from "path";
 function filenameFromDisposition(header) {
   if (!header) return void 0;
@@ -12712,7 +14166,7 @@ function filenameFromDisposition(header) {
 function resolveOutputPath(output, serverFilename) {
   const filename = serverFilename || "skills.zip";
   if (!output) return join23(process.cwd(), filename);
-  const looksLikeDir = output.endsWith("/") || existsSync17(output) && statSync6(output).isDirectory();
+  const looksLikeDir = output.endsWith("/") || existsSync17(output) && statSync7(output).isDirectory();
   if (looksLikeDir) {
     mkdirSync18(output, { recursive: true });
     return join23(output, filename);
@@ -13311,17 +14765,15 @@ Examples:
   $ sechroom work-task mark-no-residue mem_XXXX --decomposition wlp_XXXX
   $ sechroom work-task residue-produce mem_XXXX --file residue.json`
   );
-  workTask.command("list").description("List work tasks, newest-first (GET /work-tasks)").option("--shape <shape>", "Filter: bare | managed").option(
+  workTask.command("list").description(
+    "List work tasks, newest-first (GET /work-tasks). Walks every page by default."
+  ).option("--shape <shape>", "Filter: bare | managed").option(
     "--lane <lane>",
     "Filter by dispatch-lane value, e.g. claude-code-chris"
-  ).option("--status <status>", "Filter by status value, e.g. in-progress").option("--page <n>", "1-based page number", (v) => Number.parseInt(v, 10)).option(
-    "--page-size <n>",
-    "Page size (default 50, capped 200)",
-    (v) => Number.parseInt(v, 10)
-  ).action(async (opts, cmd) => {
+  ).option("--status <status>", "Filter by status value, e.g. in-progress").option(...PAGE_OPTION).option(...PAGE_SIZE_OPTION).option(...NO_AUTO_PAGE_OPTION).action(async (opts, cmd) => {
     const globals = cmd.optsWithGlobals();
     const cfg = resolveConfig(globals);
-    const data = await runApi("Listing work tasks", async () => {
+    const readPage = (query) => runApi("Listing work tasks", async () => {
       const client = await makeClient(cfg);
       return client.GET("/work-tasks", {
         params: {
@@ -13329,12 +14781,19 @@ Examples:
             shape: opts.shape,
             lane: opts.lane,
             status: opts.status,
-            page: opts.page,
-            pageSize: opts.pageSize
+            ...query
           }
         }
       });
     });
+    const data = shouldAutoPage(opts) ? await fetchAllPages(
+      (page) => readPage({
+        page,
+        ...opts.pageSize ? { pageSize: Number(opts.pageSize) } : {}
+      }),
+      opts,
+      "tasks"
+    ) : await readPage(singlePageQuery(opts));
     emitAction(
       `listed ${style.bold(String(data.items.length))} of ${data.count} task(s)`,
       data,