@sechroom/cli 2026.9.26-rc.fa5538238 → 2026.10.1-rc.8cc2a58bd

package/dist/index.js

@@ -8308,7 +8308,7 @@ function str(v) {
 }
 
 // src/commands/hook.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import { existsSync as existsSync13, mkdirSync as mkdirSync15, readFileSync as readFileSync14, statSync as statSync4, writeFileSync as writeFileSync14 } from "fs";
 import { dirname as dirname14, join as join17 } from "path";
 
@@ -8454,7 +8454,7 @@ function installLaneCommitHook(start) {
 }
 
 // src/commands/session-context.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash4, randomUUID as randomUUID3 } from "crypto";
 import { mkdirSync as mkdirSync14, renameSync as renameSync3, rmSync as rmSync8, writeFileSync as writeFileSync13 } from "fs";
 import { dirname as dirname13, join as join16 } from "path";
 
@@ -8795,6 +8795,31 @@ function removeDirectoryIfEmpty(path) {
 
 // src/commands/session-context.ts
 var DYNAMIC_AGENT_CONTEXT_FILE = join16(".sechroom", "CLAUDE.md");
+function deliveredContext(result, lane) {
+  if (result.status !== "ready") return renderSessionContext(result, lane);
+  const contract = [
+    result.renderVersion,
+    result.text,
+    result.digest,
+    result.revision
+  ];
+  if (contract.every((value) => value === void 0)) {
+    return renderSessionContext(result, lane);
+  }
+  if (contract.some((value) => typeof value !== "string" || value.length === 0)) {
+    throw new Error(
+      "session context resolution returned a partial or malformed render contract (renderVersion, text, digest and revision must all be present); refusing to write it and preserving existing compiled skills"
+    );
+  }
+  const text2 = result.text;
+  const actual = createHash4("sha256").update(text2, "utf8").digest("hex");
+  if (result.digest !== actual) {
+    throw new Error(
+      "session context text does not match its digest; refusing to write it and preserving existing compiled skills"
+    );
+  }
+  return text2;
+}
 function checkoutRoot(start) {
   const semPath = resolveSemPathForRead(start);
   return semPath ? dirname13(dirname13(semPath)) : start;
@@ -8819,6 +8844,9 @@ function renderSessionContext(result, lane) {
     `<!-- sechroom-context lane=${JSON.stringify(lane)} workspace=${JSON.stringify(result.workspaceId ?? "")} -->`,
     ""
   ];
+  for (const notice of result.notices ?? []) {
+    lines.push(`> Notice: ${notice}`, "");
+  }
   for (const member of result.members) {
     lines.push(
       `<!-- sechroom-context-member key=${JSON.stringify(member.key)} layer=${JSON.stringify(member.layer)} bundle=${JSON.stringify(`${member.bundleSlug}@${member.bundleVersion}`)} component=${JSON.stringify(member.componentSlug)} id=${JSON.stringify(member.sourceId)} sourceVersion=${member.sourceVersion} -->`
@@ -8832,39 +8860,54 @@ function renderSessionContext(result, lane) {
 function writeSessionContext(start, lane, result, options = {}) {
   const root = checkoutRoot(start);
   const path = join16(root, DYNAMIC_AGENT_CONTEXT_FILE);
+  const context = deliveredContext(result, lane);
   const skills = materialiseCompiledSkillCompositions(
     root,
     result.status === "hold" ? {
       skills: [],
-      holds: [{
-        code: "session-context-hold",
-        reason: result.reason?.trim() || "Session context resolution held without a reason.",
-        skillName: null
-      }],
+      holds: [
+        {
+          code: "session-context-hold",
+          reason: result.reason?.trim() || "Session context resolution held without a reason.",
+          skillName: null
+        }
+      ],
       preserveExisting: true
     } : { skills: result.skills },
     options
   );
-  const context = renderSessionContext(result, lane);
   mkdirSync14(dirname13(path), { recursive: true });
   const temporaryPath = `${path}.${process.pid}.${randomUUID3()}.tmp`;
   try {
-    writeFileSync13(temporaryPath, context.endsWith("\n") ? context : `${context}
-`, "utf8");
+    writeFileSync13(
+      temporaryPath,
+      context.endsWith("\n") ? context : `${context}
+`,
+      "utf8"
+    );
     renameSync3(temporaryPath, path);
   } catch (error) {
     rmSync8(temporaryPath, { force: true });
     throw error;
   }
-  return { status: result.status, path, context, skills };
+  return {
+    status: result.status,
+    path,
+    context,
+    skills,
+    revision: result.revision ?? null
+  };
 }
 async function materializeSessionContext(client, cfg, lane, start, options = {}) {
-  const { data, error, response } = await client.POST("/session-context/resolve", {
-    body: {
-      laneId: lane,
-      workspaceId: cfg.workspaceId ?? null
+  const { data, error, response } = await client.POST(
+    "/session-context/resolve",
+    {
+      body: {
+        laneId: lane,
+        workspaceId: cfg.workspaceId ?? null
+      }
     }
-  });
+  );
   if (!data) {
     const detail = error ? JSON.stringify(error) : `HTTP ${response?.status ?? "unknown"}`;
     throw new Error(`session context resolution failed: ${detail}`);
@@ -8873,7 +8916,9 @@ async function materializeSessionContext(client, cfg, lane, start, options = {})
   return writeSessionContext(start, lane, data, options);
 }
 function assertSessionContextResult(value) {
-  if (value === null || typeof value !== "object" || !["ready", "hold"].includes(String(value.status)) || !Array.isArray(value.members) || !Array.isArray(value.skills)) {
+  if (value === null || typeof value !== "object" || !["ready", "hold"].includes(
+    String(value.status)
+  ) || !Array.isArray(value.members) || !Array.isArray(value.skills)) {
     throw new Error(
       "session context resolution returned an invalid payload; preserving existing compiled skills"
     );
@@ -9062,7 +9107,7 @@ function intentHash(i) {
     artifacts: i.artifacts ?? [],
     confidence: i.confidence ?? null
   });
-  return createHash4("sha256").update(canonical, "utf8").digest("hex");
+  return createHash5("sha256").update(canonical, "utf8").digest("hex");
 }
 function recentlyCheckpointed(start, minutes) {
   const { lastEpochMs } = readLedger(start);
@@ -9879,6 +9924,18 @@ Displaced snapshot recovery surfaces:
     });
     emit(data, cmd.optsWithGlobals().json);
   });
+  continuity.command("snapshot-seed <id>").description(
+    "Render a snapshot you own or were granted as seed text, at most 16 KiB, with its revision and sha256 digest (GET /continuity/snapshots/{id}/seed)"
+  ).action(async (id, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi(
+      "Rendering snapshot seed",
+      async () => (await makeClient(cfg)).GET("/continuity/snapshots/{id}/seed", {
+        params: { path: { id } }
+      })
+    );
+    emit(data, cmd.optsWithGlobals().json);
+  });
   const snapshots = continuity.command("snapshots").description(
     "List the caller's own snapshots, including displaced recovery candidates (GET /me/continuity/snapshots)"
   ).option("--scope <scope>", "Filter by scope").option("--lane <laneId>", "Filter by lane id").action(async (opts, cmd) => {
@@ -10114,6 +10171,21 @@ function snapshotGetNotFoundHint(includeAll, status) {
 }
 
 // src/commands/desk.ts
+function deskPacksRequest(opts) {
+  const filter = opts.filter ?? "published";
+  if (filter !== "published" && filter !== "work-layer")
+    throw new Error('--filter must be "published" or "work-layer"');
+  let pageSize;
+  if (opts.pageSize !== void 0) {
+    pageSize = Number(opts.pageSize);
+    if (!Number.isInteger(pageSize) || pageSize < 1 || pageSize > 100)
+      throw new Error(`--page-size must be a whole number from 1 to 100, got "${opts.pageSize}"`);
+  }
+  return {
+    path: "/desk/packs",
+    query: { filter, workspaceId: opts.workspaceId, cursor: opts.cursor, pageSize }
+  };
+}
 function downloadRequestsRequest(opts) {
   if (opts.platform) {
     if (opts.take !== void 0 || opts.user !== void 0)
@@ -10138,6 +10210,7 @@ function downloadRequestsRequest(opts) {
 }
 function registerDesk(program2) {
   const desk = program2.command("desk").description("Sechroom Desk administration");
+  registerDeskPacks(desk);
   const downloads = desk.command("downloads").description("Desk Downloads: which tenants see the page, and who requested which build").addHelpText(
     "after",
     `
@@ -10209,6 +10282,25 @@ Examples:
   registerDeskRooms(desk);
   registerDeskWorkspaces(desk);
 }
+function registerDeskPacks(desk) {
+  desk.command("packs").description("Browse readable published context packs and visible Work Layer task packs").command("list").description("Page through readable Sechroom packs in this tenant (GET /desk/packs)").option("--filter <filter>", 'published or work-layer (default "published")').option("--workspace-id <id>", "limit Work Layer task packs to this workspace").option("--cursor <cursor>", "continue from the previous page").option("--page-size <n>", "rows per page, from 1 to 100 (default 50)").action(async (opts, cmd) => {
+    let request;
+    try {
+      request = deskPacksRequest(opts);
+    } catch (error) {
+      fail(error);
+    }
+    const globals = cmd.optsWithGlobals();
+    const cfg = resolveConfig(globals);
+    const data = await runApi(
+      "Listing Desk context packs",
+      async () => (await makeClient(cfg)).GET("/desk/packs", {
+        params: { query: request.query }
+      })
+    );
+    emit(data, globals.json);
+  });
+}
 function registerDeskRooms(desk) {
   const rooms = desk.command("rooms").description("Governed Desk rooms: which user a device is, and who may be invited").addHelpText(
     "after",
@@ -12986,8 +13078,112 @@ Note: CLI memory get omits relationships by default; MCP get_memory includes the
   });
 }
 
+// src/commands/retrieval.ts
+function parseWholeNumber(name, raw) {
+  if (!/^\d+$/.test(raw.trim())) {
+    fail(`${name} must be a non-negative whole number (got "${raw}").`);
+  }
+  const n = Number(raw);
+  if (!Number.isSafeInteger(n) || n > 2147483647) {
+    fail(`${name} is out of range (got "${raw}").`);
+  }
+  return n;
+}
+var MAX_SCOPE_PAGES = 8;
+function registerRetrieval(program2) {
+  const memory = program2.commands.find((c) => c.name() === "memory") ?? program2.command("memory").description("Create, read, and search memories");
+  memory.command("evidence <memoryId>").description(
+    "Read a byte-exact span of a memory's text at an explicit version, with digests (GET /memories/{targetMemoryId}/evidence)"
+  ).requiredOption(
+    "--at <version>",
+    "Required: 'latest' or a positive version number (no default, so a citation never comes from an implicit head)"
+  ).option("--start <byte>", "Inclusive start byte (with --end)").option("--end <byte>", "Exclusive end byte (with --start); both on UTF-8 character boundaries").option("--include-archived", "Allow reading an archived memory", false).addHelpText(
+    "after",
+    `
+Offsets are BYTES of the UTF-8 text, not characters. Omit --start/--end for the whole text (refused above 64 KiB).
+--at is required. An exact version that is unavailable is refused; it never falls back to another version.
+
+Examples:
+  $ sechroom memory evidence mem_XXXX --at latest --json
+  $ sechroom memory evidence mem_XXXX --at 3 --start 0 --end 120 --json`
+  ).action(async (memoryId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    if (opts.start == null !== (opts.end == null)) {
+      fail("Provide both --start and --end, or neither.");
+    }
+    const query = {};
+    query.version = String(opts.at);
+    if (opts.start != null) {
+      query.startByte = parseWholeNumber("--start", String(opts.start));
+      query.endByte = parseWholeNumber("--end", String(opts.end));
+    }
+    if (opts.includeArchived) query.includeArchived = true;
+    const data = await runApi("Reading evidence", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/memories/{targetMemoryId}/evidence", {
+        params: { path: { targetMemoryId: memoryId }, query }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  const scope = program2.command("scope").description("Navigate the authorised workspace/project scope");
+  scope.command("ls").description("List the workspaces and projects you may see under a scope (GET /retrieval/scope)").option("--kind <kind>", "tenant (default), workspace, project or memories").option("--id <id>", "Workspace or project id (kind workspace/project)").option("--mode <mode>", "direct (default) or subtree").option("--memory-ids <ids>", "Comma-separated memory ids (kind memories, max 100)").option("--limit <n>", "Page size, 1 to 100 (default 50)").option("--cursor <token>", "Continuation token from the previous page").option("--include-archived", "Include archived nodes", false).option(
+    "--all",
+    `Follow continuations (up to ${MAX_SCOPE_PAGES} pages) and print one combined result`,
+    false
+  ).addHelpText(
+    "after",
+    `
+Hidden nodes are never named or counted; an id you cannot see is refused like one that does not exist.
+coverage.scopeExhausted=true with no continuation means the authorised scope is fully listed.
+A continuation is bound to you, this credential and the current authority state: if anything changes the read is
+refused (409 continuation_invalidated) and you restart it.
+
+Examples:
+  $ sechroom scope ls --json
+  $ sechroom scope ls --kind workspace --id wsp_XXXX --mode subtree --all --json
+  $ sechroom scope ls --kind memories --memory-ids mem_A,mem_B --json`
+  ).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const base = {};
+    if (opts.kind) base.kind = String(opts.kind);
+    if (opts.id) base.id = String(opts.id);
+    if (opts.mode) base.mode = String(opts.mode);
+    if (opts.memoryIds) base.memoryIds = String(opts.memoryIds);
+    if (opts.limit != null) base.limit = parseWholeNumber("--limit", String(opts.limit));
+    if (opts.includeArchived) base.includeArchived = true;
+    const fetchPage = (cursor) => runApi("Listing scope", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/retrieval/scope", {
+        params: { query: { ...base, ...cursor ? { cursor } : {} } }
+      });
+    });
+    let page = await fetchPage(opts.cursor);
+    if (!opts.all) {
+      emit(page, cmd.optsWithGlobals().json);
+      return;
+    }
+    const items = [...page.items];
+    let pages = 1;
+    while (page.continuation && pages < MAX_SCOPE_PAGES) {
+      page = await fetchPage(page.continuation);
+      items.push(...page.items);
+      pages++;
+    }
+    emit(
+      {
+        ...page,
+        items,
+        coverage: { ...page.coverage, returned: items.length },
+        pages
+      },
+      cmd.optsWithGlobals().json
+    );
+  });
+}
+
 // src/setup/apply.ts
-import { createHash as createHash5, randomUUID as randomUUID4 } from "crypto";
+import { createHash as createHash6, randomUUID as randomUUID4 } from "crypto";
 import {
   chmodSync as chmodSync2,
   copyFileSync,
@@ -13014,7 +13210,7 @@ function normalizeBody(s) {
   return s.replace(/\r\n/g, "\n").trim();
 }
 function bodySha256(body) {
-  return createHash5("sha256").update(normalizeBody(body), "utf8").digest("hex");
+  return createHash6("sha256").update(normalizeBody(body), "utf8").digest("hex");
 }
 function renderBlock(write) {
   const body = normalizeBody(write.body);
@@ -17501,6 +17697,7 @@ local:  ${d.localPath ?? "(none)"} ${JSON.stringify(readLocalConfig())}
 });
 registerAccounts(program);
 registerMemory(program);
+registerRetrieval(program);
 registerLaneGrant(program);
 registerWorklog(program);
 registerFeedback(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.9.26-rc.fa5538238",
+  "version": "2026.10.1-rc.8cc2a58bd",
   "description": "Command-line interface for Sechroom — sign in, wire your AI tools, and work with your sechroom from the terminal.",
   "type": "module",
   "license": "UNLICENSED",