@sechroom/cli 2026.9.27-rc.1ea98ba09 → 2026.10.2-rc.25f86daf3

package/dist/index.js

@@ -10171,6 +10171,21 @@ function snapshotGetNotFoundHint(includeAll, status) {
 }
 
 // src/commands/desk.ts
+function deskPacksRequest(opts) {
+  const filter = opts.filter ?? "published";
+  if (filter !== "published" && filter !== "work-layer")
+    throw new Error('--filter must be "published" or "work-layer"');
+  let pageSize;
+  if (opts.pageSize !== void 0) {
+    pageSize = Number(opts.pageSize);
+    if (!Number.isInteger(pageSize) || pageSize < 1 || pageSize > 100)
+      throw new Error(`--page-size must be a whole number from 1 to 100, got "${opts.pageSize}"`);
+  }
+  return {
+    path: "/desk/packs",
+    query: { filter, workspaceId: opts.workspaceId, cursor: opts.cursor, pageSize }
+  };
+}
 function downloadRequestsRequest(opts) {
   if (opts.platform) {
     if (opts.take !== void 0 || opts.user !== void 0)
@@ -10195,6 +10210,7 @@ function downloadRequestsRequest(opts) {
 }
 function registerDesk(program2) {
   const desk = program2.command("desk").description("Sechroom Desk administration");
+  registerDeskPacks(desk);
   const downloads = desk.command("downloads").description("Desk Downloads: which tenants see the page, and who requested which build").addHelpText(
     "after",
     `
@@ -10266,6 +10282,25 @@ Examples:
   registerDeskRooms(desk);
   registerDeskWorkspaces(desk);
 }
+function registerDeskPacks(desk) {
+  desk.command("packs").description("Browse readable published context packs and visible Work Layer task packs").command("list").description("Page through readable Sechroom packs in this tenant (GET /desk/packs)").option("--filter <filter>", 'published or work-layer (default "published")').option("--workspace-id <id>", "limit Work Layer task packs to this workspace").option("--cursor <cursor>", "continue from the previous page").option("--page-size <n>", "rows per page, from 1 to 100 (default 50)").action(async (opts, cmd) => {
+    let request;
+    try {
+      request = deskPacksRequest(opts);
+    } catch (error) {
+      fail(error);
+    }
+    const globals = cmd.optsWithGlobals();
+    const cfg = resolveConfig(globals);
+    const data = await runApi(
+      "Listing Desk context packs",
+      async () => (await makeClient(cfg)).GET("/desk/packs", {
+        params: { query: request.query }
+      })
+    );
+    emit(data, globals.json);
+  });
+}
 function registerDeskRooms(desk) {
   const rooms = desk.command("rooms").description("Governed Desk rooms: which user a device is, and who may be invited").addHelpText(
     "after",
@@ -13043,6 +13078,110 @@ Note: CLI memory get omits relationships by default; MCP get_memory includes the
   });
 }
 
+// src/commands/retrieval.ts
+function parseWholeNumber(name, raw) {
+  if (!/^\d+$/.test(raw.trim())) {
+    fail(`${name} must be a non-negative whole number (got "${raw}").`);
+  }
+  const n = Number(raw);
+  if (!Number.isSafeInteger(n) || n > 2147483647) {
+    fail(`${name} is out of range (got "${raw}").`);
+  }
+  return n;
+}
+var MAX_SCOPE_PAGES = 8;
+function registerRetrieval(program2) {
+  const memory = program2.commands.find((c) => c.name() === "memory") ?? program2.command("memory").description("Create, read, and search memories");
+  memory.command("evidence <memoryId>").description(
+    "Read a byte-exact span of a memory's text at an explicit version, with digests (GET /memories/{targetMemoryId}/evidence)"
+  ).requiredOption(
+    "--at <version>",
+    "Required: 'latest' or a positive version number (no default, so a citation never comes from an implicit head)"
+  ).option("--start <byte>", "Inclusive start byte (with --end)").option("--end <byte>", "Exclusive end byte (with --start); both on UTF-8 character boundaries").option("--include-archived", "Allow reading an archived memory", false).addHelpText(
+    "after",
+    `
+Offsets are BYTES of the UTF-8 text, not characters. Omit --start/--end for the whole text (refused above 64 KiB).
+--at is required. An exact version that is unavailable is refused; it never falls back to another version.
+
+Examples:
+  $ sechroom memory evidence mem_XXXX --at latest --json
+  $ sechroom memory evidence mem_XXXX --at 3 --start 0 --end 120 --json`
+  ).action(async (memoryId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    if (opts.start == null !== (opts.end == null)) {
+      fail("Provide both --start and --end, or neither.");
+    }
+    const query = {};
+    query.version = String(opts.at);
+    if (opts.start != null) {
+      query.startByte = parseWholeNumber("--start", String(opts.start));
+      query.endByte = parseWholeNumber("--end", String(opts.end));
+    }
+    if (opts.includeArchived) query.includeArchived = true;
+    const data = await runApi("Reading evidence", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/memories/{targetMemoryId}/evidence", {
+        params: { path: { targetMemoryId: memoryId }, query }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  const scope = program2.command("scope").description("Navigate the authorised workspace/project scope");
+  scope.command("ls").description("List the workspaces and projects you may see under a scope (GET /retrieval/scope)").option("--kind <kind>", "tenant (default), workspace, project or memories").option("--id <id>", "Workspace or project id (kind workspace/project)").option("--mode <mode>", "direct (default) or subtree").option("--memory-ids <ids>", "Comma-separated memory ids (kind memories, max 100)").option("--limit <n>", "Page size, 1 to 100 (default 50)").option("--cursor <token>", "Continuation token from the previous page").option("--include-archived", "Include archived nodes", false).option(
+    "--all",
+    `Follow continuations (up to ${MAX_SCOPE_PAGES} pages) and print one combined result`,
+    false
+  ).addHelpText(
+    "after",
+    `
+Hidden nodes are never named or counted; an id you cannot see is refused like one that does not exist.
+coverage.scopeExhausted=true with no continuation means the authorised scope is fully listed.
+A continuation is bound to you, this credential and the current authority state: if anything changes the read is
+refused (409 continuation_invalidated) and you restart it.
+
+Examples:
+  $ sechroom scope ls --json
+  $ sechroom scope ls --kind workspace --id wsp_XXXX --mode subtree --all --json
+  $ sechroom scope ls --kind memories --memory-ids mem_A,mem_B --json`
+  ).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const base = {};
+    if (opts.kind) base.kind = String(opts.kind);
+    if (opts.id) base.id = String(opts.id);
+    if (opts.mode) base.mode = String(opts.mode);
+    if (opts.memoryIds) base.memoryIds = String(opts.memoryIds);
+    if (opts.limit != null) base.limit = parseWholeNumber("--limit", String(opts.limit));
+    if (opts.includeArchived) base.includeArchived = true;
+    const fetchPage = (cursor) => runApi("Listing scope", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/retrieval/scope", {
+        params: { query: { ...base, ...cursor ? { cursor } : {} } }
+      });
+    });
+    let page = await fetchPage(opts.cursor);
+    if (!opts.all) {
+      emit(page, cmd.optsWithGlobals().json);
+      return;
+    }
+    const items = [...page.items];
+    let pages = 1;
+    while (page.continuation && pages < MAX_SCOPE_PAGES) {
+      page = await fetchPage(page.continuation);
+      items.push(...page.items);
+      pages++;
+    }
+    emit(
+      {
+        ...page,
+        items,
+        coverage: { ...page.coverage, returned: items.length },
+        pages
+      },
+      cmd.optsWithGlobals().json
+    );
+  });
+}
+
 // src/setup/apply.ts
 import { createHash as createHash6, randomUUID as randomUUID4 } from "crypto";
 import {
@@ -17558,6 +17697,7 @@ local:  ${d.localPath ?? "(none)"} ${JSON.stringify(readLocalConfig())}
 });
 registerAccounts(program);
 registerMemory(program);
+registerRetrieval(program);
 registerLaneGrant(program);
 registerWorklog(program);
 registerFeedback(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.9.27-rc.1ea98ba09",
+  "version": "2026.10.2-rc.25f86daf3",
   "description": "Command-line interface for Sechroom — sign in, wire your AI tools, and work with your sechroom from the terminal.",
   "type": "module",
   "license": "UNLICENSED",