@sechroom/cli 2026.9.26-rc.fa5538238 → 2026.9.27-rc.1ea98ba09

package/dist/index.js

@@ -8308,7 +8308,7 @@ function str(v) {
 }
 
 // src/commands/hook.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import { existsSync as existsSync13, mkdirSync as mkdirSync15, readFileSync as readFileSync14, statSync as statSync4, writeFileSync as writeFileSync14 } from "fs";
 import { dirname as dirname14, join as join17 } from "path";
 
@@ -8454,7 +8454,7 @@ function installLaneCommitHook(start) {
 }
 
 // src/commands/session-context.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash4, randomUUID as randomUUID3 } from "crypto";
 import { mkdirSync as mkdirSync14, renameSync as renameSync3, rmSync as rmSync8, writeFileSync as writeFileSync13 } from "fs";
 import { dirname as dirname13, join as join16 } from "path";
 
@@ -8795,6 +8795,31 @@ function removeDirectoryIfEmpty(path) {
 
 // src/commands/session-context.ts
 var DYNAMIC_AGENT_CONTEXT_FILE = join16(".sechroom", "CLAUDE.md");
+function deliveredContext(result, lane) {
+  if (result.status !== "ready") return renderSessionContext(result, lane);
+  const contract = [
+    result.renderVersion,
+    result.text,
+    result.digest,
+    result.revision
+  ];
+  if (contract.every((value) => value === void 0)) {
+    return renderSessionContext(result, lane);
+  }
+  if (contract.some((value) => typeof value !== "string" || value.length === 0)) {
+    throw new Error(
+      "session context resolution returned a partial or malformed render contract (renderVersion, text, digest and revision must all be present); refusing to write it and preserving existing compiled skills"
+    );
+  }
+  const text2 = result.text;
+  const actual = createHash4("sha256").update(text2, "utf8").digest("hex");
+  if (result.digest !== actual) {
+    throw new Error(
+      "session context text does not match its digest; refusing to write it and preserving existing compiled skills"
+    );
+  }
+  return text2;
+}
 function checkoutRoot(start) {
   const semPath = resolveSemPathForRead(start);
   return semPath ? dirname13(dirname13(semPath)) : start;
@@ -8819,6 +8844,9 @@ function renderSessionContext(result, lane) {
     `<!-- sechroom-context lane=${JSON.stringify(lane)} workspace=${JSON.stringify(result.workspaceId ?? "")} -->`,
     ""
   ];
+  for (const notice of result.notices ?? []) {
+    lines.push(`> Notice: ${notice}`, "");
+  }
   for (const member of result.members) {
     lines.push(
       `<!-- sechroom-context-member key=${JSON.stringify(member.key)} layer=${JSON.stringify(member.layer)} bundle=${JSON.stringify(`${member.bundleSlug}@${member.bundleVersion}`)} component=${JSON.stringify(member.componentSlug)} id=${JSON.stringify(member.sourceId)} sourceVersion=${member.sourceVersion} -->`
@@ -8832,39 +8860,54 @@ function renderSessionContext(result, lane) {
 function writeSessionContext(start, lane, result, options = {}) {
   const root = checkoutRoot(start);
   const path = join16(root, DYNAMIC_AGENT_CONTEXT_FILE);
+  const context = deliveredContext(result, lane);
   const skills = materialiseCompiledSkillCompositions(
     root,
     result.status === "hold" ? {
       skills: [],
-      holds: [{
-        code: "session-context-hold",
-        reason: result.reason?.trim() || "Session context resolution held without a reason.",
-        skillName: null
-      }],
+      holds: [
+        {
+          code: "session-context-hold",
+          reason: result.reason?.trim() || "Session context resolution held without a reason.",
+          skillName: null
+        }
+      ],
       preserveExisting: true
     } : { skills: result.skills },
     options
   );
-  const context = renderSessionContext(result, lane);
   mkdirSync14(dirname13(path), { recursive: true });
   const temporaryPath = `${path}.${process.pid}.${randomUUID3()}.tmp`;
   try {
-    writeFileSync13(temporaryPath, context.endsWith("\n") ? context : `${context}
-`, "utf8");
+    writeFileSync13(
+      temporaryPath,
+      context.endsWith("\n") ? context : `${context}
+`,
+      "utf8"
+    );
     renameSync3(temporaryPath, path);
   } catch (error) {
     rmSync8(temporaryPath, { force: true });
     throw error;
   }
-  return { status: result.status, path, context, skills };
+  return {
+    status: result.status,
+    path,
+    context,
+    skills,
+    revision: result.revision ?? null
+  };
 }
 async function materializeSessionContext(client, cfg, lane, start, options = {}) {
-  const { data, error, response } = await client.POST("/session-context/resolve", {
-    body: {
-      laneId: lane,
-      workspaceId: cfg.workspaceId ?? null
+  const { data, error, response } = await client.POST(
+    "/session-context/resolve",
+    {
+      body: {
+        laneId: lane,
+        workspaceId: cfg.workspaceId ?? null
+      }
     }
-  });
+  );
   if (!data) {
     const detail = error ? JSON.stringify(error) : `HTTP ${response?.status ?? "unknown"}`;
     throw new Error(`session context resolution failed: ${detail}`);
@@ -8873,7 +8916,9 @@ async function materializeSessionContext(client, cfg, lane, start, options = {})
   return writeSessionContext(start, lane, data, options);
 }
 function assertSessionContextResult(value) {
-  if (value === null || typeof value !== "object" || !["ready", "hold"].includes(String(value.status)) || !Array.isArray(value.members) || !Array.isArray(value.skills)) {
+  if (value === null || typeof value !== "object" || !["ready", "hold"].includes(
+    String(value.status)
+  ) || !Array.isArray(value.members) || !Array.isArray(value.skills)) {
     throw new Error(
       "session context resolution returned an invalid payload; preserving existing compiled skills"
     );
@@ -9062,7 +9107,7 @@ function intentHash(i) {
     artifacts: i.artifacts ?? [],
     confidence: i.confidence ?? null
   });
-  return createHash4("sha256").update(canonical, "utf8").digest("hex");
+  return createHash5("sha256").update(canonical, "utf8").digest("hex");
 }
 function recentlyCheckpointed(start, minutes) {
   const { lastEpochMs } = readLedger(start);
@@ -9879,6 +9924,18 @@ Displaced snapshot recovery surfaces:
     });
     emit(data, cmd.optsWithGlobals().json);
   });
+  continuity.command("snapshot-seed <id>").description(
+    "Render a snapshot you own or were granted as seed text, at most 16 KiB, with its revision and sha256 digest (GET /continuity/snapshots/{id}/seed)"
+  ).action(async (id, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi(
+      "Rendering snapshot seed",
+      async () => (await makeClient(cfg)).GET("/continuity/snapshots/{id}/seed", {
+        params: { path: { id } }
+      })
+    );
+    emit(data, cmd.optsWithGlobals().json);
+  });
   const snapshots = continuity.command("snapshots").description(
     "List the caller's own snapshots, including displaced recovery candidates (GET /me/continuity/snapshots)"
   ).option("--scope <scope>", "Filter by scope").option("--lane <laneId>", "Filter by lane id").action(async (opts, cmd) => {
@@ -12987,7 +13044,7 @@ Note: CLI memory get omits relationships by default; MCP get_memory includes the
 }
 
 // src/setup/apply.ts
-import { createHash as createHash5, randomUUID as randomUUID4 } from "crypto";
+import { createHash as createHash6, randomUUID as randomUUID4 } from "crypto";
 import {
   chmodSync as chmodSync2,
   copyFileSync,
@@ -13014,7 +13071,7 @@ function normalizeBody(s) {
   return s.replace(/\r\n/g, "\n").trim();
 }
 function bodySha256(body) {
-  return createHash5("sha256").update(normalizeBody(body), "utf8").digest("hex");
+  return createHash6("sha256").update(normalizeBody(body), "utf8").digest("hex");
 }
 function renderBlock(write) {
   const body = normalizeBody(write.body);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.9.26-rc.fa5538238",
+  "version": "2026.9.27-rc.1ea98ba09",
   "description": "Command-line interface for Sechroom — sign in, wire your AI tools, and work with your sechroom from the terminal.",
   "type": "module",
   "license": "UNLICENSED",