@synkro-sh/cli 1.10.5 → 1.10.8

package/dist/bootstrap.js

@@ -147,7 +147,7 @@ function getIdentity() {
   if (cached2) return cached2;
   let cliVersion2 = "0.0.0";
   try {
-    cliVersion2 = "1.10.5";
+    cliVersion2 = "1.10.8";
   } catch {
   }
   const creds = loadCredentialsIdentity();
@@ -2351,7 +2351,7 @@ function buildCodexHookTrustEdits(hooks) {
   return [...edits.values()];
 }
 function queryCodexHookTrust(codexBinary = "codex", cwd = process.cwd(), autoTrust = false) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     let settled = false;
     let stdout = "";
     let pending = "";
@@ -2369,7 +2369,7 @@ function queryCodexHookTrust(codexBinary = "codex", cwd = process.cwd(), autoTru
         child.kill();
       } catch {
       }
-      resolve7(summary);
+      resolve8(summary);
     };
     const timer = setTimeout(() => finish(null), 1e4);
     try {
@@ -3255,10 +3255,15 @@ function pruneToolCallMarks(now: number): void {
 
 // The user's answer to "move into the task worktree, or stay here?". Written by the
 // "synkro workspace stay" command (the CLI owns ~/.synkro, so nothing hand-writes it)
-// and read here. Keyed by task alone: the decision resets when the active task
-// changes, which is the scope the workspace gate is asking about.
+// and read here. The filename includes a one-way session key so consent in one
+// Claude/Codex chat can never silently authorize another chat working the task.
 const WORKSPACE_CHOICE_DIR = join(HOME, '.synkro', 'workspace-choice');
 
+function taskWorkspaceChoicePath(taskId: string, sessionId: string): string {
+  const sessionKey = createHash('sha256').update(String(sessionId || '')).digest('hex').slice(0, 16);
+  return join(WORKSPACE_CHOICE_DIR, taskId + '.' + sessionKey + '.stay');
+}
+
 // The user answers the workspace question in plain language on their next
 // prompt. Writing the marker is exactly what the CLI's "workspace stay"
 // command does — but the consent matcher only accepts one literal spelling,
@@ -3279,14 +3284,23 @@ function isWorkspaceStayIntent(prompt: string): boolean {
   ].some((pattern) => pattern.test(normalized));
 }
 
-function taskWorkspaceStayRecorded(taskId: string): boolean {
-  if (!/^task_[a-z0-9]{8}$/i.test(String(taskId || ''))) return false;
-  try { return existsSync(join(WORKSPACE_CHOICE_DIR, taskId + '.stay')); } catch { return false; }
+function taskWorkspaceStayRecorded(taskId: string, sessionId: string): boolean {
+  if (!/^task_[a-z0-9]{8}$/i.test(String(taskId || '')) || !sessionId) return false;
+  try { return existsSync(taskWorkspaceChoicePath(taskId, sessionId)); } catch { return false; }
 }
 
-// Our own context string, so the shape is stable: '... task=<id> ...'.
-function taskIdFromScmContext(context: string): string {
-  const marker = ' task=';
+function recordTaskWorkspaceStay(taskId: string, sessionId: string): boolean {
+  if (!/^task_[a-z0-9]{8}$/i.test(String(taskId || '')) || !sessionId) return false;
+  try {
+    mkdirSync(WORKSPACE_CHOICE_DIR, { recursive: true });
+    writeFileSync(taskWorkspaceChoicePath(taskId, sessionId), new Date().toISOString() + '\n', { mode: 0o600 });
+    return true;
+  } catch { return false; }
+}
+
+// Our own context string, so the shape is stable: '... task=<id> branch=<name> ...'.
+function fieldFromScmContext(context: string, field: string): string {
+  const marker = ' ' + field + '=';
   const at = String(context || '').indexOf(marker);
   if (at === -1) return '';
   const rest = context.slice(at + marker.length);
@@ -3294,14 +3308,73 @@ function taskIdFromScmContext(context: string): string {
   return (end === -1 ? rest : rest.slice(0, end)).trim();
 }
 
+function taskIdFromScmContext(context: string): string {
+  return fieldFromScmContext(context, 'task');
+}
+
+// An exact-command allowance must not be defeated by the output plumbing agents
+// reflexively append ('2>&1 | tail -2') — requiring the bare spelling made the
+// gate's own escape hatch block itself (observed live). Only harmless trailing
+// redirection plus a single display filter pass; anything that could chain a
+// second command (&&, ;, extra pipes, substitution) still rejects.
+function isBareCommandWithPlumbing(command: string, head: string): boolean {
+  if (!command.startsWith(head)) return false;
+  const rest = command.slice(head.length);
+  return /^(?:\s+2>&1)?(?:\s*\|\s*(?:tail|head|cat)(?:\s+[-\w.+]+)*)?\s*$/.test(rest);
+}
+
+function bashCommandOf(payload: any): string {
+  if (String(payload?.tool_name || '') !== 'Bash') return '';
+  const input = payload?.tool_input && typeof payload.tool_input === 'object' ? payload.tool_input : {};
+  return String(input.command || input.cmd || '').trim();
+}
+
 // Consent must never deadlock behind the block it resolves: the command that records
 // the answer is allowed through for the task currently being asked about, and nothing
 // else is.
-function isWorkspaceConsentCommand(payload: any, taskId: string): boolean {
-  if (!taskId || String(payload?.tool_name || '') !== 'Bash') return false;
+function workspaceReadOnlyShellSegment(segment: string): boolean {
+  const value = String(segment || '').trim();
+  if (!value || /[;&><$]/.test(value) || value.includes(String.fromCharCode(96))) return false;
+  const tokens = value.split(/\s+/);
+  const verb = String(tokens[0] || '').toLowerCase();
+  const writeOptions = new Set(['-i', '--in-place', '-o', '--output', '--output-document']);
+  if (tokens.some((token) => writeOptions.has(token) || token.startsWith('--output='))) return false;
+  const reads = new Set(['cat', 'head', 'tail', 'grep', 'egrep', 'fgrep', 'rg', 'ag', 'find', 'fd', 'ls', 'wc', 'cmp', 'diff', 'file', 'stat', 'pwd', 'sort', 'uniq', 'cut', 'tr', 'jq', 'yq']);
+  if (reads.has(verb)) {
+    if ((verb === 'find' || verb === 'fd') && tokens.some((token) => new Set(['-exec', '-execdir', '-ok', '-okdir', '-delete', '-fprint', '-fprint0', '-fls', '--exec', '--exec-batch']).has(token))) return false;
+    return true;
+  }
+  if (verb !== 'git') return false;
+  return new Set(['log', 'show', 'diff', 'blame', 'status', 'rev-parse', 'ls-files', 'ls-tree', 'cat-file', 'shortlog', 'describe']).has(String(tokens[1] || '').toLowerCase());
+}
+
+function isWorkspaceReadOnlyDiagnostic(payload: any): boolean {
+  const toolName = String(payload?.tool_name || '');
+  if (/^(?:Read|ReadFile|read_file|Grep|grep_search|codebase_search|file_search|Glob|list_dir)$/i.test(toolName)) return true;
+  if (!/^(?:Bash|Shell|terminal|run_terminal_cmd|execute_command)$/i.test(toolName)) return false;
   const input = payload?.tool_input && typeof payload.tool_input === 'object' ? payload.tool_input : {};
   const command = String(input.command || input.cmd || '').trim();
-  return command === 'synkro workspace stay ' + taskId;
+  if (!command || /\|\||(^|[^&])&([^&]|$)|;/.test(command)) return false;
+  return command.split('|').every(workspaceReadOnlyShellSegment);
+}
+
+function isWorkspaceConsentCommand(payload: any, taskId: string): boolean {
+  if (!taskId) return false;
+  const command = bashCommandOf(payload);
+  return Boolean(command) && isBareCommandWithPlumbing(command, 'synkro workspace stay ' + taskId);
+}
+
+// A session that is already inside the task worktree but on the wrong branch needs
+// exactly one repair: checking out the canonical branch. The gate demands that
+// branch, so blocking the checkout that reaches it would deadlock (observed live
+// after an agent created a side branch in the task worktree). Elsewhere the command
+// is harmless: git itself refuses to check out a branch held by another worktree.
+function isWorkspaceRepairCommand(payload: any, branchName: string): boolean {
+  if (!branchName) return false;
+  const command = bashCommandOf(payload);
+  if (!command) return false;
+  return isBareCommandWithPlumbing(command, 'git checkout ' + branchName)
+    || isBareCommandWithPlumbing(command, 'git switch ' + branchName);
 }
 
 function firstHookForToolCall(sessionId: string, payload: any): boolean {
@@ -3666,7 +3739,7 @@ function shellTaskWorkspaceArg(value: string): string {
   return "'" + value.replace(/'/g, "'\"'\"'") + "'";
 }
 
-function taskScmWorkspaceInstruction(harness: string, sessionId: string, workspace: any): string {
+function taskScmWorkspaceInstruction(harness: string, sessionId: string, workspace: any, root = ''): string {
   const context = taskScmWorkspaceContext(workspace, harness);
   const worktreePath = String(workspace?.worktreePath || '');
   const branchName = String(workspace?.branchName || '');
@@ -3676,6 +3749,15 @@ function taskScmWorkspaceInstruction(harness: string, sessionId: string, workspa
     + 'the task worktree and canonical branch.';
   if (harness === 'cc') {
     if (!worktreePath) return context + '\nTask worktree creation failed closed; retry workspace preparation.';
+    // Already inside the task worktree, just not on its branch: the move/stay
+    // question was answered the moment the session got here, and re-asking it
+    // offers two exits that both fail. Name the one command that repairs it —
+    // the gate lets exactly that command through.
+    if (root && samePath(root, worktreePath)) {
+      return context + '\nThis session is already in the task worktree but not on its canonical branch. '
+        + 'Run "git checkout ' + branchName + '" to continue; that command is allowed through this gate, '
+        + 'and substantive tools stay blocked until the branch matches.';
+    }
     // Ask, do not command. The user may legitimately want to keep working where they
     // are, and Synkro should not move them without their say-so.
     return context + '\nAsk the user whether to move this task into its isolated worktree '
@@ -3691,14 +3773,18 @@ function taskScmWorkspaceInstruction(harness: string, sessionId: string, workspa
       + '. Confirm the resumed workspace is on branch ' + JSON.stringify(branchName) + '. ' + requirement;
   }
   if (!worktreePath) {
-    return context + '\n[synkro:workspace-handoff] Invoke Codex\'s native task/worktree Handoff now for this exact task. '
-      + 'Check out branch ' + JSON.stringify(branchName) + ' in a new worktree and continue this same chat there. '
-      + 'Do not switch the shared Local checkout or ask the user to switch branches. '
-      + 'Synkro keeps substantive tools blocked until this exact session reports the new worktree path and canonical branch.';
+    return context + '\nAsk the user whether to move this task into a generated isolated Codex worktree on branch '
+      + JSON.stringify(branchName) + ', or keep working in the current workspace. Do not decide for them. '
+      + 'To move: use Codex\'s Environment control or native Handoff for this task; never hand off a different task as a workaround. '
+      + 'To stay: run "synkro workspace stay ' + String(workspace?.taskId || '') + '". '
+      + 'Never switch the shared Local checkout.';
   }
-  return context + '\n[synkro:workspace-handoff] Invoke Codex\'s native task/worktree Handoff now for this exact task, '
-    + 'using the existing worktree ' + JSON.stringify(worktreePath) + ' on branch ' + JSON.stringify(branchName) + '. '
-    + 'The Codex Environment panel must show that worktree and branch before retrying the blocked action. ' + requirement;
+  return context + '\nAsk the user whether to move this task to its prepared worktree '
+    + JSON.stringify(worktreePath) + ' on branch ' + JSON.stringify(branchName)
+    + ', or keep working in the current isolated Codex worktree. Do not decide for them. '
+    + 'To move: use Codex\'s Environment control or native Handoff for this task; never hand off a different task as a workaround. '
+    + 'To stay: run "synkro workspace stay ' + String(workspace?.taskId || '') + '". '
+    + 'Never switch the shared Local checkout.';
 }
 
 // CC validates hookSpecificOutput.hookEventName against the event that actually fired.
@@ -3780,7 +3866,7 @@ async function reconcileTaskScm(
         : result?.workspace;
       return {
         reason: result?.waiting
-          ? (taskScmWorkspaceInstruction(harness, sessionId, workspace)
+          ? (taskScmWorkspaceInstruction(harness, sessionId, workspace, root)
             || String(result.reason || 'task source-control preparation is pending'))
           : '',
         context: taskScmWorkspaceContext(workspace, harness),
@@ -4479,19 +4565,21 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
     // prompt records the same durable marker the CLI command writes. Reconcile
     // just told us WHICH task is being asked, so no extra state is needed and
     // ordinary prompts outside a pending ask are never scanned.
-    if (surface === 'prompt-submit' && scm.reason && scmTaskId && !taskWorkspaceStayRecorded(scmTaskId)) {
+    if (surface === 'prompt-submit' && scm.reason && scmTaskId && !taskWorkspaceStayRecorded(scmTaskId, sessionId)) {
       const promptText = String(payload.prompt || payload.user_message || '');
       if (isWorkspaceStayIntent(promptText)) {
-        try {
-          mkdirSync(WORKSPACE_CHOICE_DIR, { recursive: true });
-          writeFileSync(join(WORKSPACE_CHOICE_DIR, scmTaskId + '.stay'), new Date().toISOString() + '\n');
-        } catch { /* fail-open: the CLI command and the exact-string path remain */ }
+        recordTaskWorkspaceStay(scmTaskId, sessionId);
       }
     }
-    // The user was asked and chose to keep working here, or is answering right now.
+    const workspaceConsentCommand = Boolean(scmTaskId) && isWorkspaceConsentCommand(payload, scmTaskId);
+    if (workspaceConsentCommand) recordTaskWorkspaceStay(scmTaskId, sessionId);
+    // The user was asked and chose to keep working here, is answering right now,
+    // or the tool call is the one git command that repairs the workspace itself.
     const workspaceConsentSettled = Boolean(scmTaskId)
-      && (taskWorkspaceStayRecorded(scmTaskId) || isWorkspaceConsentCommand(payload, scmTaskId));
-    if (scm.reason && substantiveTool && !workspaceConsentSettled) {
+      && (taskWorkspaceStayRecorded(scmTaskId, sessionId)
+        || workspaceConsentCommand
+        || isWorkspaceRepairCommand(payload, fieldFromScmContext(scm.context, 'branch')));
+    if (scm.reason && substantiveTool && !workspaceConsentSettled && !isWorkspaceReadOnlyDiagnostic(payload)) {
       out(taskScmBlockResponse(harness, scm.reason, firstHookForToolCall(sessionId, payload)));
       return;
     }
@@ -4680,7 +4768,7 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
     let scmContext = scm.context && surface === 'prompt-submit' && firstHookForToolCall(sessionId, payload) ? scm.context : '';
     // Say plainly that work is continuing outside the task worktree by the user's choice,
     // so the state is never mistaken for a binding that silently failed.
-    if (scmContext && scmTaskId && taskWorkspaceStayRecorded(scmTaskId)) {
+    if (scmContext && scmTaskId && taskWorkspaceStayRecorded(scmTaskId, sessionId)) {
       scmContext += ' workspace=staying-here-by-user-choice';
     }
     const responseText = withActualHookEvent(withTaskScmContext(contractResponseText, harness, scmContext), payload);
@@ -5023,6 +5111,7 @@ if (process.env.SYNKRO_HOOK_FORMAT === 'codex' && hookEventName === 'PermissionR
 // cli/auth/stub.ts
 var stub_exports = {};
 __export(stub_exports, {
+  accessTokenExpired: () => accessTokenExpired,
   authedFetch: () => authedFetch,
   authenticate: () => authenticate,
   clearCredentials: () => clearCredentials,
@@ -5092,7 +5181,7 @@ function createCallbackServer() {
     "Access-Control-Allow-Headers": "Content-Type",
     "Vary": "Origin"
   };
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const server = createServer((req, res) => {
       if (req.method === "OPTIONS") {
         const origin = req.headers.origin;
@@ -5181,7 +5270,7 @@ function createCallbackServer() {
         res.end(JSON.stringify({ ok: true }));
         setTimeout(() => {
           server.close();
-          resolve7(authData);
+          resolve8(authData);
         }, 200);
       });
       req.on("error", (e) => {
@@ -5280,19 +5369,23 @@ function getAccessToken() {
   const creds = loadCredentials();
   return creds?.access_token || null;
 }
-function isTokenExpired() {
-  const creds = loadCredentials();
-  if (!creds) return true;
+function accessTokenExpired(accessToken, now = Date.now()) {
   try {
-    const decoded = jwt.decode(creds.access_token);
+    const decoded = jwt.decode(accessToken);
     if (!decoded?.exp) return true;
     const expiresAt = decoded.exp * 1e3;
-    const buffer = 5 * 60 * 1e3;
-    return Date.now() > expiresAt - buffer;
+    const lifetimeMs = decoded.iat ? (decoded.exp - decoded.iat) * 1e3 : 0;
+    const buffer = lifetimeMs > 0 ? Math.min(MAX_EXPIRY_BUFFER_MS, Math.floor(lifetimeMs / 5)) : MAX_EXPIRY_BUFFER_MS;
+    return now > expiresAt - buffer;
   } catch {
     return true;
   }
 }
+function isTokenExpired() {
+  const creds = loadCredentials();
+  if (!creds?.access_token) return true;
+  return accessTokenExpired(creds.access_token);
+}
 async function refreshToken() {
   const creds = loadCredentials();
   if (!creds?.refresh_token) return false;
@@ -5360,7 +5453,7 @@ async function getSecrets(userId, integrationId) {
     LANGSMITH_API_KEY: process.env.USER_LANGSMITH_KEY || ""
   };
 }
-var PORT, RAW_WEB_AUTH_URL, SYNKRO_WEB_AUTH_URL, AUTH_FILE, RAW_API_URL, SYNKRO_API_URL, ERROR_HTML, refreshPromise;
+var PORT, RAW_WEB_AUTH_URL, SYNKRO_WEB_AUTH_URL, AUTH_FILE, RAW_API_URL, SYNKRO_API_URL, ERROR_HTML, MAX_EXPIRY_BUFFER_MS, refreshPromise;
 var init_stub = __esm({
   "cli/auth/stub.ts"() {
     "use strict";
@@ -5410,6 +5503,7 @@ var init_stub = __esm({
 </body>
 </html>
 `;
+    MAX_EXPIRY_BUFFER_MS = 60 * 1e3;
     refreshPromise = null;
   }
 });
@@ -5512,7 +5606,7 @@ function detectSubdirRepos() {
   }
 }
 function ask(rl, question) {
-  return new Promise((resolve7) => rl.question(question, resolve7));
+  return new Promise((resolve8) => rl.question(question, resolve8));
 }
 async function linkRepo(repo, linkedNames) {
   try {
@@ -5751,7 +5845,7 @@ async function runClaudeDesktopTap(opts = {}) {
   writeFileSync12(join13(sessionDir, "mcp_patch.py"), MCP_PATCH_PY, "utf-8");
   const runnerPath = join13(sessionDir, "run.sh");
   writeFileSync12(runnerPath, buildRunner(sessionDir), { mode: 493 });
-  await new Promise((resolve7) => {
+  await new Promise((resolve8) => {
     const child = spawn3("bash", [runnerPath], {
       stdio: "inherit",
       env: { ...process.env, SYNKRO_CAPTURE_URL: CAPTURE_URL, SYNKRO_SCAN_URL: SCAN_URL, SYNKRO_SCAN_TURN_URL: SCAN_TURN_URL, SYNKRO_DLP_POLICY_URL: DLP_POLICY_URL, SYNKRO_TURN_VERDICTS_URL: TURN_VERDICTS_URL, SYNKRO_TURN_VERDICT_URL: TURN_VERDICT_URL, SYNKRO_MCP_EVENT_URL: MCP_EVENT_URL, SYNKRO_TAP_TOKEN: token, SYNKRO_TAP_TOKEN_FILE: JWT_PATH, SYNKRO_CD_BACKFILL: opts.backfill ? "1" : "" }
@@ -5767,7 +5861,7 @@ async function runClaudeDesktopTap(opts = {}) {
     child.on("exit", () => {
       process.off("SIGINT", forward);
       process.off("SIGTERM", forward);
-      resolve7();
+      resolve8();
     });
   });
 }
@@ -7840,7 +7934,7 @@ var init_dockerInstall = __esm({
     HOST_PGLITE_PORT = parseInt(process.env.SYNKRO_HOST_PGLITE_PORT || "15433", 10);
     CONTAINER_NAME = resolveContainerName();
     defaultImageVersion = () => {
-      if (true) return "1.10.5";
+      if (true) return "1.10.8";
       try {
         const pkg = JSON.parse(readFileSync17(new URL("../../package.json", import.meta.url), "utf8"));
         if (pkg.version) return pkg.version;
@@ -7872,7 +7966,7 @@ function captureClaudeSetupToken() {
   const bin = "script";
   const args2 = isMac ? ["-q", tmpFile, "claude", "setup-token"] : ["-qec", "claude setup-token", tmpFile];
   const OAUTH_HINT = 'The browser approval did not return a token. This usually means claude.ai rejected the OAuth request (its "Authorization failed \u2014 Unsupported media type" page), most often because a browser extension (Grammarly, ad/script blockers, AI-assistant toolbars) stripped the request headers, or you approved on the wrong Claude account. Fix: retry in a clean incognito window with extensions disabled, and approve on the Claude account you want the cloud workers to use.';
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const proc = nodeSpawn(bin, args2, {
       stdio: "inherit",
       env: { ...process.env, FORCE_COLOR: "3", COLORTERM: "truecolor", TERM: "xterm-256color" }
@@ -7939,7 +8033,7 @@ function captureClaudeSetupToken() {
         reject(new Error(`Captured no setup token from claude setup-token output. ${reason}`));
         return;
       }
-      resolve7(token);
+      resolve8(token);
     });
   });
 }
@@ -7965,13 +8059,13 @@ function findCodexBinary() {
 function runCodexLogin(codexBin, codexHome) {
   mkdirSync13(codexHome, { recursive: true, mode: 448 });
   writeFileSync15(join17(codexHome, "config.toml"), 'cli_auth_credentials_store = "file"\n', { mode: 384 });
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const proc = nodeSpawn2(codexBin, ["login"], {
       stdio: "inherit",
       env: { ...process.env, CODEX_HOME: codexHome }
     });
     proc.on("error", (err) => reject(new Error(`failed to spawn codex login: ${err.message}`)));
-    proc.on("close", (code) => code === 0 ? resolve7() : reject(new Error(`codex login exited with code ${code}`)));
+    proc.on("close", (code) => code === 0 ? resolve8() : reject(new Error(`codex login exited with code ${code}`)));
   });
 }
 async function setupCodexCloud(gatewayUrl, bearerToken, onStatus) {
@@ -8673,20 +8767,20 @@ async function promptAgentSelection(detected) {
   detected.forEach((a, i) => console.log(`  ${i + 1}. ${a.name}`));
   console.log(`  ${detected.length + 1}. Both / all (default)`);
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
-  const ask3 = () => new Promise((resolve7) => {
+  const ask3 = () => new Promise((resolve8) => {
     rl.question(`Pick [1-${detected.length + 1}] (default: all): `, (answer) => {
       const t = answer.trim().toLowerCase();
       if (t === "" || t === String(detected.length + 1) || t === "both" || t === "all") {
         rl.close();
-        return resolve7(detected);
+        return resolve8(detected);
       }
       const n = parseInt(t, 10);
       if (Number.isInteger(n) && n >= 1 && n <= detected.length) {
         rl.close();
-        return resolve7([detected[n - 1]]);
+        return resolve8([detected[n - 1]]);
       }
       console.log("Invalid choice. Try again.");
-      resolve7(ask3());
+      resolve8(ask3());
     });
   });
   return ask3();
@@ -8709,12 +8803,12 @@ async function promptCursorApiKey(opts) {
     return;
   }
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
-  const key = await new Promise((resolve7) => {
+  const key = await new Promise((resolve8) => {
     rl.question(
       "Cursor grading needs a Cursor API key (cursor.com \u2192 Settings \u2192 API Keys).\nPaste it now, or press Enter to skip (Cursor workers stay idle until set): ",
       (answer) => {
         rl.close();
-        resolve7(answer.trim());
+        resolve8(answer.trim());
       }
     );
   });
@@ -8729,7 +8823,7 @@ async function promptDeployLocation(current = "local") {
   if (!process.stdin.isTTY) return current;
   const other = current === "cloud" ? "local" : "cloud";
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     rl.question(
       `Where should Synkro run?
   local \u2014 a grading container on this machine (Docker)
@@ -8738,7 +8832,7 @@ Each worker uses the account credentials you authorize. Choose [${current}] / ${
       (answer) => {
         rl.close();
         const a = answer.trim().toLowerCase();
-        resolve7(a === "cloud" ? "cloud" : a === "local" ? "local" : current);
+        resolve8(a === "cloud" ? "cloud" : a === "local" ? "local" : current);
       }
     );
   });
@@ -8900,7 +8994,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle2(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle2(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle2(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle2("1.10.5")}`
+    `SYNKRO_VERSION=${shellQuoteSingle2("1.10.8")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle2(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle2(safeUserId)}`);
@@ -9647,7 +9741,7 @@ async function installCommand(opts = {}) {
   await setTelemetryState({ enabled: true, remoteFlushEnabled: telemetryConsent });
   emit("install", {
     phase: "started",
-    cli_version_to: "1.10.5",
+    cli_version_to: "1.10.8",
     agents_detected: agents.map((a) => a.kind),
     with_github: false,
     with_local_cc: false,
@@ -10715,8 +10809,8 @@ function ensureReachabilityGitHook() {
       }
       return "updated";
     }
-    const sep3 = cur.endsWith("\n") ? "" : "\n";
-    writeFileSync17(hookPath, cur + sep3 + "\n" + block + "\n");
+    const sep4 = cur.endsWith("\n") ? "" : "\n";
+    writeFileSync17(hookPath, cur + sep4 + "\n" + block + "\n");
     try {
       chmodSync5(hookPath, 493);
     } catch {
@@ -11936,10 +12030,10 @@ function confirmPurge() {
     return Promise.resolve(false);
   }
   const rl = createInterface3({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     rl.question("   Type 'yes' to wipe everything (anything else cancels): ", (answer) => {
       rl.close();
-      resolve7(answer.trim().toLowerCase() === "yes");
+      resolve8(answer.trim().toLowerCase() === "yes");
     });
   });
 }
@@ -12192,7 +12286,7 @@ async function submitToChannel(role, payload, opts = {}) {
   const port = opts.port ?? CHANNEL_PORT;
   const startedAt = Date.now();
   try {
-    const result = await new Promise((resolve7, reject) => {
+    const result = await new Promise((resolve8, reject) => {
       const req = httpRequest({
         host: CHANNEL_HOST,
         port,
@@ -12218,7 +12312,7 @@ async function submitToChannel(role, payload, opts = {}) {
               reject(new LocalCCError(parsed.error));
               return;
             }
-            resolve7(String(parsed.result ?? ""));
+            resolve8(String(parsed.result ?? ""));
           } catch (err) {
             reject(new LocalCCError(`malformed channel response: ${text.slice(0, 200)}`, err));
           }
@@ -12244,14 +12338,14 @@ async function submitToChannel(role, payload, opts = {}) {
   }
 }
 function isChannelAvailable(port = CHANNEL_PORT, timeoutMs = 500) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const sock = connect(port, CHANNEL_HOST);
     const done = (ok) => {
       try {
         sock.destroy();
       } catch {
       }
-      resolve7(ok);
+      resolve8(ok);
     };
     sock.once("connect", () => done(true));
     sock.once("error", () => done(false));
@@ -12283,10 +12377,10 @@ __export(grade_exports, {
   gradeCommand: () => gradeCommand
 });
 async function readStdin() {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const chunks = [];
     process.stdin.on("data", (c) => chunks.push(c));
-    process.stdin.on("end", () => resolve7(Buffer.concat(chunks).toString("utf-8")));
+    process.stdin.on("end", () => resolve8(Buffer.concat(chunks).toString("utf-8")));
     process.stdin.on("error", reject);
   });
 }
@@ -12540,7 +12634,7 @@ function spawnClaudeJudge(file, claudeToken, promptHeader) {
 Diff:
 ${hunks}`;
   const fullPrompt = promptHeader + userMessage;
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const t0 = Date.now();
     const proc = spawn6(
       "claude",
@@ -12568,7 +12662,7 @@ ${hunks}`;
       const latencyMs = Date.now() - t0;
       if (code !== 0) {
         console.warn(`  claude exited ${code}: ${(stderr || stdout).slice(0, 500)}`);
-        resolve7({ findings: [], latencyMs });
+        resolve8({ findings: [], latencyMs });
         return;
       }
       try {
@@ -12587,10 +12681,10 @@ ${hunks}`;
           description: f.description,
           fix: f.fix
         }));
-        resolve7({ findings, latencyMs });
+        resolve8({ findings, latencyMs });
       } catch (parseErr) {
         console.warn(`  failed to parse claude response: ${stdout.slice(0, 300)}`);
-        resolve7({ findings: [], latencyMs });
+        resolve8({ findings: [], latencyMs });
       }
     });
   });
@@ -12639,7 +12733,7 @@ ${JSON.stringify(findings, null, 2)}
 `;
 }
 function spawnOpusConsolidator(findings, claudeToken) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const prompt = buildConsolidationPrompt(findings);
     const proc = spawn6(
       "claude",
@@ -12666,7 +12760,7 @@ function spawnOpusConsolidator(findings, claudeToken) {
     proc.on("close", (code) => {
       if (code !== 0) {
         console.warn(`  opus consolidation exited ${code}: ${(stderr || stdout).slice(0, 300)}`);
-        resolve7(fallbackReview(findings));
+        resolve8(fallbackReview(findings));
         return;
       }
       try {
@@ -12687,10 +12781,10 @@ function spawnOpusConsolidator(findings, claudeToken) {
           const order = ["low", "medium", "high", "critical"];
           return order.indexOf(f.severity) > order.indexOf(max) ? f.severity : max;
         }, "low");
-        resolve7({ summary: review.summary || "", comments, severity: maxSeverity });
+        resolve8({ summary: review.summary || "", comments, severity: maxSeverity });
       } catch {
         console.warn(`  failed to parse opus response, using fallback`);
-        resolve7(fallbackReview(findings));
+        resolve8(fallbackReview(findings));
       }
     });
   });
@@ -13173,14 +13267,14 @@ function ensureRunning(opts = {}) {
   return startTask(opts);
 }
 function probePort(host, port, timeoutMs = 500) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const sock = connect2(port, host);
     const done = (ok) => {
       try {
         sock.destroy();
       } catch {
       }
-      resolve7(ok);
+      resolve8(ok);
     };
     sock.once("connect", () => done(true));
     sock.once("error", () => done(false));
@@ -13730,7 +13824,7 @@ function cmdLogs(rest) {
     if (!raw) console.log("  " + colorize("(use --raw / -r to see full payloads, --live / -f to follow)", 90));
     return;
   }
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     console.log("  " + colorize("\u2014 following new turns (Ctrl-C to exit) \u2014", 90));
     const stop = followTurns((t) => {
       console.log("  " + formatTurn(t, raw));
@@ -13738,7 +13832,7 @@ function cmdLogs(rest) {
     const onSigint = () => {
       stop();
       process.removeListener("SIGINT", onSigint);
-      resolve7();
+      resolve8();
     };
     process.on("SIGINT", onSigint);
   });
@@ -14027,9 +14121,9 @@ function parseSession(file, seenStableIds) {
 }
 function ask2(q) {
   const rl = createInterface4({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve7) => rl.question(q, (a) => {
+  return new Promise((resolve8) => rl.question(q, (a) => {
     rl.close();
-    resolve7(/^y(es)?$/i.test(a.trim()));
+    resolve8(/^y(es)?$/i.test(a.trim()));
   }));
 }
 async function importCommand() {
@@ -14429,6 +14523,16 @@ import { homedir as homedir31 } from "os";
 function markerPath(taskId) {
   return join31(WORKSPACE_CHOICE_DIR, `${taskId}.stay`);
 }
+function markerNamesForTask(taskId) {
+  try {
+    return existsSync33(WORKSPACE_CHOICE_DIR) ? readdirSync8(WORKSPACE_CHOICE_DIR).filter((name) => name === `${taskId}.stay` || name.startsWith(`${taskId}.`) && name.endsWith(".stay")) : [];
+  } catch {
+    return [];
+  }
+}
+function taskIdFromMarker(name) {
+  return (name.match(/^(task_[a-z0-9]{8})(?:\.[a-f0-9]{16})?\.stay$/i) || [])[1] || "";
+}
 function usage() {
   console.log(`synkro workspace \u2014 record where a task's work happens
 
@@ -14437,8 +14541,8 @@ Usage:
   synkro workspace clear <taskId>    forget the choice (the gate asks again)
   synkro workspace status [taskId]   show recorded choices
 
-The gate asks once per task. "stay" is remembered until the choice is cleared or
-the active task changes.`);
+The gate asks once per task session. "stay" is remembered in that chat until the
+choice is cleared or the active task changes.`);
 }
 async function workspaceCommand(args2) {
   const sub = String(args2[0] || "").trim();
@@ -14455,7 +14559,7 @@ async function workspaceCommand(args2) {
       recorded = [];
     }
     if (taskId) {
-      const on = recorded.includes(`${taskId}.stay`);
+      const on = markerNamesForTask(taskId).length > 0;
       console.log(`${taskId}: ${on ? "stay recorded" : "no choice recorded"}`);
       return;
     }
@@ -14464,7 +14568,7 @@ async function workspaceCommand(args2) {
       return;
     }
     console.log("Staying in the current checkout for:");
-    for (const name of recorded.sort()) console.log(`  ${name.replace(/\.stay$/, "")}`);
+    for (const id of [...new Set(recorded.map(taskIdFromMarker).filter(Boolean))].sort()) console.log(`  ${id}`);
     return;
   }
   if (sub !== "stay" && sub !== "clear") {
@@ -14479,9 +14583,11 @@ async function workspaceCommand(args2) {
     return;
   }
   if (sub === "clear") {
-    try {
-      rmSync5(markerPath(taskId), { force: true });
-    } catch {
+    for (const name of markerNamesForTask(taskId)) {
+      try {
+        rmSync5(join31(WORKSPACE_CHOICE_DIR, name), { force: true });
+      } catch {
+      }
     }
     console.log(`Cleared the workspace choice for ${taskId}.`);
     return;
@@ -14544,6 +14650,7 @@ function buildSpawnAgent(opts) {
     // and its own history scrolls — without it only the last screen is
     // reachable once the session is nested inside the layout.
     ["tmux", "set-option", "-t", session, "mouse", "on"],
+    ...buildClipboardBindings(session),
     ["tmux", "set-option", "-t", session, "-q", "@synkro_harness", opts.harness],
     ["tmux", "set-option", "-t", session, "-q", "@synkro_space", opts.space],
     ["tmux", "set-option", "-t", session, "-q", "@synkro_backend", opts.backend],
@@ -14552,6 +14659,13 @@ function buildSpawnAgent(opts) {
     ["tmux", "set-option", "-t", session, "remain-on-exit", "on"]
   ];
 }
+function buildClipboardBindings(session) {
+  return [
+    ["tmux", "set-option", "-t", session, "set-clipboard", "on"],
+    ["tmux", "bind-key", "-T", "copy-mode", "MouseDragEnd1Pane", "send-keys", "-X", "copy-pipe-and-cancel", SYSTEM_CLIPBOARD],
+    ["tmux", "bind-key", "-T", "copy-mode-vi", "MouseDragEnd1Pane", "send-keys", "-X", "copy-pipe-and-cancel", SYSTEM_CLIPBOARD]
+  ];
+}
 function buildListAgents() {
   return ["tmux", "list-sessions", "-F", ["#{session_name}", "#{?pane_dead,dead,alive}", "#{@synkro_harness}", "#{@synkro_space}", "#{@synkro_backend}", "#{@synkro_pueue}", "#{pane_current_path}"].join(FIELD_SEP)];
 }
@@ -14595,6 +14709,9 @@ function buildSendText(session, text) {
 function buildEnableMouse(session) {
   return ["tmux", "set-option", "-t", session, "mouse", "on"];
 }
+function buildKeepPaneAfterExit(pane) {
+  return ["tmux", "set-option", "-p", "-t", pane, "remain-on-exit", "on"];
+}
 function buildInterrupt(session) {
   return ["tmux", "send-keys", "-t", session, "Escape"];
 }
@@ -14661,7 +14778,7 @@ function parseWorktrees(porcelain) {
   }
   return rows;
 }
-var execFileAsync, AGENT_PREFIX, UI_SESSION, CONTAINER_USER, FIELD_SEP;
+var execFileAsync, AGENT_PREFIX, UI_SESSION, CONTAINER_USER, SYSTEM_CLIPBOARD, FIELD_SEP;
 var init_tmux = __esm({
   "cli/ui/tmux.ts"() {
     "use strict";
@@ -14669,6 +14786,7 @@ var init_tmux = __esm({
     AGENT_PREFIX = "synkro-agent-";
     UI_SESSION = "synkro-ui";
     CONTAINER_USER = "synkro";
+    SYSTEM_CLIPBOARD = "if command -v pbcopy >/dev/null 2>&1; then pbcopy; elif command -v wl-copy >/dev/null 2>&1; then wl-copy; elif command -v xclip >/dev/null 2>&1; then xclip -selection clipboard; else cat >/dev/null; fi";
     FIELD_SEP = "|";
   }
 });
@@ -14801,6 +14919,10 @@ function visibleAgents(all, space, filter, grouped) {
   if (grouped || filter === "all" || !space) return all;
   return all.filter((agent) => agent.repo === space.path);
 }
+function nextLiveAgent(all, preferredRepo = "") {
+  const live = all.filter((agent) => agent.status !== "offline" && agent.status !== "done");
+  return live.find((agent) => Boolean(preferredRepo) && agent.repo === preferredRepo) || live[0];
+}
 async function discoverAgents(runner, backend, memory) {
   const snapshot = await run(runner, buildAgentSnapshot());
   const { list, captures } = parseAgentSnapshot(snapshot.ok ? snapshot.stdout : "");
@@ -15039,6 +15161,10 @@ async function styleOuterSession(bootPath, repoCwd, sidebarWidth) {
     // focus it, click rows/chips. Without this the fixed split reads as
     // "blocked in".
     ["set-option", "-t", UI_SESSION, "mouse", "on"],
+    // Scrollback deep enough to hold a real working session. tmux defaults to
+    // 2000 lines, which a long harness session blows through — the start of the
+    // conversation would silently fall off the top with no way back to it.
+    ["set-option", "-t", UI_SESSION, "history-limit", "50000"],
     ["set-option", "-t", UI_SESSION, "status-position", "top"],
     ["set-option", "-t", UI_SESSION, "status-style", "bg=colour233,fg=colour245"],
     ["set-option", "-t", UI_SESSION, "status-format[0]", chipStrip(sidebarWidth)],
@@ -15062,8 +15188,10 @@ async function styleOuterSession(bootPath, repoCwd, sidebarWidth) {
     ["bind-key", "-n", "M-s", "select-pane", "-L"]
   ];
   for (const argv of style) await run(HOST, ["tmux", ...argv]);
+  for (const argv of buildClipboardBindings(UI_SESSION)) await run(HOST, argv);
 }
 async function buildTab(bootPath, repoCwd, spec) {
+  await run(HOST, ["tmux", "set-option", "-g", "history-limit", "50000"]);
   let windowTarget;
   if (!await uiSessionExists()) {
     const cols = String(Number(process.stdout.columns || 0) || 220);
@@ -15103,6 +15231,7 @@ async function buildTab(bootPath, repoCwd, spec) {
   const sidebarPane = split.stdout.trim();
   const panes = await run(HOST, ["tmux", "list-panes", "-t", windowTarget, "-F", "#{pane_id}"]);
   const centerPane = panes.stdout.split("\n").map((line) => line.trim()).filter(Boolean).find((id) => id !== sidebarPane) || "";
+  await run(HOST, buildKeepPaneAfterExit(centerPane));
   if (spec.agentSession) {
     await run(HOST, ["tmux", "set-option", "-t", windowTarget, "-w", "-q", "@synkro_agent", spec.agentSession]);
   }
@@ -15132,11 +15261,29 @@ async function uiSessionExists() {
   const result = await run(HOST, ["tmux", "has-session", "-t", UI_SESSION]);
   return result.ok;
 }
+function parseCollapsedClients(listOutput) {
+  return String(listOutput || "").split("\n").map((line) => line.trim().split("|")).filter(([name, width, height]) => Boolean(name) && Number.isFinite(Number(width)) && Number.isFinite(Number(height)) && (Number(width) < 20 || Number(height) < 5)).map(([name]) => name);
+}
+async function pruneCollapsedClients() {
+  const listed = await run(HOST, [
+    "tmux",
+    "list-clients",
+    "-t",
+    UI_SESSION,
+    "-F",
+    "#{client_name}|#{client_width}|#{client_height}"
+  ]);
+  if (!listed.ok) return 0;
+  const collapsed = parseCollapsedClients(listed.stdout);
+  for (const name of collapsed) await run(HOST, ["tmux", "detach-client", "-t", name]);
+  return collapsed.length;
+}
 async function launchUi(bootPath, repoCwd) {
   rememberSpace(repoCwd);
   if (!await uiSessionExists()) {
     await buildTab(bootPath, repoCwd, { cwd: repoCwd, center: makeTerminalCommand(bootPath), focus: "sidebar" });
   }
+  await pruneCollapsedClients();
   return runInherit(process.env.TMUX ? ["tmux", "switch-client", "-t", UI_SESSION] : ["tmux", "attach-session", "-t", UI_SESSION]);
 }
 var HOST, TAB_GLYPHS;
@@ -15464,6 +15611,9 @@ async function detectContainerBackend() {
   }
   return { runner: { kind: "host" }, backend: "host", note: "runtime: host (container unavailable)" };
 }
+function harnessCommand(request) {
+  return request.resume ? resumeCommand(request.harness) : HARNESS_COMMANDS[request.harness] || "claude";
+}
 async function provisionContainerWorkspace(runner, slug) {
   const dir = CONTAINER_WORK + "/ui-" + slug;
   await run(runner, [
@@ -15481,7 +15631,7 @@ async function spawnAgent(info, request) {
   if (request.backend === "container") {
     cwd = request.cwd.startsWith(CONTAINER_WORK) ? request.cwd : await provisionContainerWorkspace(runner, slug);
   }
-  const command = request.resume ? resumeCommand(request.harness) : HARNESS_COMMANDS[request.harness] || "claude";
+  const command = harnessCommand(request);
   for (const argv of buildSpawnAgent({ name: slug, cwd, command, harness: request.harness, space: cwd, backend: request.backend })) {
     const result = await run(runner, argv);
     if (!result.ok && argv[1] === "new-session") {
@@ -15772,6 +15922,24 @@ async function runSidebar() {
     const agent = state.agents[state.agentIndex];
     if (agent) await showAgent(agent);
   }
+  async function showWorkspaceTerminal(cwd) {
+    if (!centerPane || !cwd) return;
+    const command = makeTerminalCommand(bootPath);
+    const argv = ["tmux", "respawn-pane", "-k", "-t", centerPane, "-c", cwd];
+    if (command) argv.push(command);
+    const respawned = await run(host, argv);
+    if (!respawned.ok) {
+      state.message = "could not restore workspace terminal";
+      return;
+    }
+    const spaceName = cwd.split("/").filter(Boolean).pop() || "space";
+    await run(host, ["tmux", "set-option", "-t", centerPane, "-w", "-u", "@synkro_agent"]);
+    await run(host, ["tmux", "set-option", "-t", centerPane, "-w", "-q", "@synkro_cwd", cwd]);
+    await run(host, ["tmux", "set-option", "-t", centerPane, "-w", "-q", "@synkro_kind", "terminal"]);
+    await run(host, ["tmux", "rename-window", "-t", centerPane, tabTitle("terminal", spaceName)]);
+    state.viewing = "";
+    await snapshotTabs();
+  }
   async function showAgent(agent) {
     if (!centerPane) return;
     if (agent.status === "offline") {
@@ -15790,6 +15958,9 @@ async function runSidebar() {
       return;
     }
     await run(runnerFor(agent.backend), buildEnableMouse(agent.session));
+    for (const argv of buildClipboardBindings(agent.session)) {
+      await run(runnerFor(agent.backend), argv);
+    }
     const command = buildCenterAttachCommand(runnerFor(agent.backend), agent.session);
     await run(host, ["tmux", "respawn-pane", "-k", "-t", centerPane, command]);
     const where = agent.space ? agent.space.split("/").filter(Boolean).pop() || "" : "";
@@ -15802,7 +15973,15 @@ async function runSidebar() {
   async function confirmKillAgent() {
     const agent = state.agents[state.agentIndex];
     if (!agent) return;
+    const wasViewing = state.viewing === agent.session;
     await openDialog("kill", [agent.backend, agent.session]);
+    await refresh();
+    if (allAgents.some((candidate) => candidate.session === agent.session && candidate.status !== "offline")) return;
+    state.message = "closed " + agent.name;
+    if (!wasViewing) return;
+    await showWorkspaceTerminal(agent.space || selectedSpace()?.path || repoCwd);
+    const successor = nextLiveAgent(allAgents, agent.repo || "");
+    if (successor) await showAgent(successor);
   }
   async function consent(action) {
     const agent = state.agents[state.agentIndex];
@@ -15825,6 +16004,7 @@ async function runSidebar() {
       const remembered = space ? lastAgentFor(space.path) : "";
       const agent = allAgents.find((row2) => row2.session === remembered && row2.status !== "offline");
       if (agent) await showAgent(agent);
+      else if (space) await showWorkspaceTerminal(space.path);
     } else if (target.kind === "agent") {
       state.section = "agents";
       state.agentIndex = target.index;
@@ -16026,6 +16206,9 @@ var init_repos = __esm({
 
 // cli/ui/tabs.ts
 import { execSync as execSync7 } from "child_process";
+function isLegacyCodexRenderer(command) {
+  return /(?:^|\s)ui\s+--run\s+codex(?:\s|$)/.test(String(command || "").trim());
+}
 function repoRoot() {
   try {
     return execSync7("git rev-parse --show-toplevel", { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim() || process.cwd();
@@ -16046,16 +16229,6 @@ async function createTab(bootPath, kind, spacePath) {
     });
     return;
   }
-  if (kind === "cursor-synkro") {
-    await buildTab(bootPath, repo, {
-      cwd: spacePath,
-      center: ["node", bootPath, "ui", "--run", "cursor", spacePath].map(shellQuote3).join(" "),
-      title: tabTitle("cursor", space),
-      kind: "cursor-synkro",
-      focus: "center"
-    });
-    return;
-  }
   if (kind === "settings") {
     await buildTab(bootPath, repo, {
       cwd: spacePath,
@@ -16066,12 +16239,13 @@ async function createTab(bootPath, kind, spacePath) {
     });
     return;
   }
+  if (!["claude", "codex", "cursor"].includes(kind)) return;
   const info = await detectContainerBackend();
   const spaceName = space;
   const stamp = String(process.pid % 1e4);
-  const harness = ["claude", "codex", "cursor"].includes(kind) ? kind : "claude";
+  const harness = kind;
   const reachable = info.backend === "container" && (await run(info.runner, ["test", "-d", spacePath])).ok;
-  const backend = reachable ? "container" : "host";
+  const backend = harness === "codex" ? "host" : reachable ? "container" : "host";
   const spawned = await spawnAgent(info, {
     name: spaceName + "-" + harness + "-" + stamp,
     harness,
@@ -16102,16 +16276,34 @@ async function openAgentTab(bootPath, session) {
   ]);
   const [harness, space, backend] = (meta.stdout.trim() || "||").split("|");
   const containerHosted = backend === "container";
-  const runner = containerHosted ? info.runner : HOST2;
-  const alive = (await run(runner, ["tmux", "has-session", "-t", session])).ok;
-  if (!alive) return;
+  let runner = containerHosted ? info.runner : HOST2;
+  let activeSession = session;
   const spaceName = (space || "").split("/").filter(Boolean).pop() || "space";
+  if (harness === "codex") {
+    const command = await run(HOST2, ["tmux", "display-message", "-p", "-t", session, "#{pane_start_command}"]);
+    if (command.ok && isLegacyCodexRenderer(command.stdout)) {
+      await run(HOST2, buildKillSession(session));
+      const restored = await spawnAgent(info, {
+        name: session.replace(/^synkro-agent-/, ""),
+        harness: "codex",
+        spaceName,
+        cwd: space || repoRoot(),
+        backend: "host",
+        resume: true
+      });
+      if (!restored.ok) return;
+      activeSession = restored.session;
+      runner = HOST2;
+    }
+  }
+  const alive = (await run(runner, ["tmux", "has-session", "-t", activeSession])).ok;
+  if (!alive) return;
   await buildTab(bootPath, repoRoot(), {
     cwd: space || repoRoot(),
-    center: buildCenterAttachCommand(runner, session),
+    center: buildCenterAttachCommand(runner, activeSession),
     title: tabTitle(harness || "claude", spaceName),
     kind: harness || "claude",
-    agentSession: session,
+    agentSession: activeSession,
     focus: "center"
   });
 }
@@ -16127,11 +16319,23 @@ async function restoreTabs(bootPath, repoCwd) {
     const space = tab.cwd.split("/").filter(Boolean).pop() || "space";
     const containerHosted = info.backend === "container" && (await run(info.runner, ["test", "-d", tab.cwd])).ok;
     const harness = ["claude", "codex", "cursor"].includes(tab.kind) ? tab.kind : "";
-    if (tab.agentSession && alive.has(tab.agentSession)) {
-      await run(containerHosted ? info.runner : HOST2, buildEnableMouse(tab.agentSession));
+    const sessionRunner = harness === "codex" ? HOST2 : containerHosted ? info.runner : HOST2;
+    let sessionAlive = Boolean(tab.agentSession && alive.has(tab.agentSession));
+    if (sessionAlive && harness === "codex") {
+      const command = await run(HOST2, ["tmux", "display-message", "-p", "-t", tab.agentSession, "#{pane_start_command}"]);
+      if (command.ok && isLegacyCodexRenderer(command.stdout)) {
+        await run(HOST2, buildKillSession(tab.agentSession));
+        sessionAlive = false;
+      }
+    }
+    if (tab.agentSession && sessionAlive) {
+      await run(sessionRunner, buildEnableMouse(tab.agentSession));
+      for (const argv of buildClipboardBindings(tab.agentSession)) {
+        await run(sessionRunner, argv);
+      }
       await buildTab(bootPath, repoCwd, {
         cwd: tab.cwd,
-        center: buildCenterAttachCommand(containerHosted ? info.runner : HOST2, tab.agentSession),
+        center: buildCenterAttachCommand(sessionRunner, tab.agentSession),
         title: tab.title,
         kind: tab.kind,
         agentSession: tab.agentSession,
@@ -16143,12 +16347,13 @@ async function restoreTabs(bootPath, repoCwd) {
         harness,
         spaceName: space,
         cwd: tab.cwd,
-        backend: containerHosted ? "container" : "host",
+        backend: harness === "codex" ? "host" : containerHosted ? "container" : "host",
         resume: true
       });
+      const restoredInContainer = harness !== "codex" && containerHosted;
       await buildTab(bootPath, repoCwd, spawned.ok ? {
         cwd: tab.cwd,
-        center: buildCenterAttachCommand(containerHosted ? info.runner : HOST2, spawned.session),
+        center: buildCenterAttachCommand(restoredInContainer ? info.runner : HOST2, spawned.session),
         title: tabTitle(harness, space),
         kind: harness,
         agentSession: spawned.session,
@@ -16241,7 +16446,7 @@ async function pick(opts) {
   const perItem = opts.choices.some((choice) => choice.detail) ? 2 : 1;
   const visibleItems = Math.max(1, Math.floor(Math.max(2, height - 5) / perItem));
   const firstRow = 4;
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const view = () => opts.choices.filter((choice) => matches(choice, filter));
     const draw = () => {
       const shown = view();
@@ -16289,7 +16494,7 @@ async function pick(opts) {
           const hit = shown.findIndex((_, index) => y >= rowOfItem(index) && y < rowOfItem(index) + perItem);
           if (hit >= 0) {
             process.stdin.off("data", onData);
-            resolve7(shown[hit].value);
+            resolve8(shown[hit].value);
             return;
           }
         }
@@ -16297,13 +16502,13 @@ async function pick(opts) {
       if (!sawMouse) {
         if (input === KEY_ESC && !input.includes("[<") || input === KEY_CTRL_C2) {
           process.stdin.off("data", onData);
-          resolve7(null);
+          resolve8(null);
           return;
         }
         if (input === "\r") {
           if (shown.length === 0) return;
           process.stdin.off("data", onData);
-          resolve7(shown[selected].value);
+          resolve8(shown[selected].value);
           return;
         }
         const down = input === CSI2 + "B" || opts.menu && (input === "j" || input === CSI2 + "C");
@@ -16327,7 +16532,7 @@ async function readLine(opts) {
   let value = "";
   let error = "";
   const width = Math.max(20, Number(process.stdout.columns || 80));
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const draw = () => {
       const lines = [
         " " + S.title + opts.title + S.reset,
@@ -16346,7 +16551,7 @@ async function readLine(opts) {
       const input = chunk.toString("utf8");
       if (input === KEY_ESC || input === KEY_CTRL_C2) {
         process.stdin.off("data", onData);
-        resolve7(null);
+        resolve8(null);
         return;
       }
       if (input === "\r") {
@@ -16358,7 +16563,7 @@ async function readLine(opts) {
             return;
           }
           process.stdin.off("data", onData);
-          resolve7(value.trim());
+          resolve8(value.trim());
         })();
         return;
       }
@@ -16625,9 +16830,6 @@ async function runDialog(kind, repoCwd, argA = "", argB = "") {
       label: (TAB_GLYPHS[harness] || "") + "  " + (HARNESS_LABELS[harness] || harness)
     }))
   ];
-  if (harnesses.includes("cursor")) {
-    sessions.push({ value: "cursor-synkro", label: TAB_GLYPHS.cursor + "  Cursor in Synkro UX" });
-  }
   for (; ; ) {
     const session = await pick({
       menu: true,
@@ -16686,21 +16888,418 @@ var init_dialog = __esm({
   }
 });
 
+// cli/harness/render.ts
+function spinnerFrame(tick) {
+  return SPINNER[Math.abs(tick) % SPINNER.length];
+}
+function terminalText(text) {
+  return String(text).replace(/[\u0000-\u001F\u007F-\u009F]/g, "");
+}
+function clip3(text, max) {
+  const value = String(text || "").replace(/\s+/g, " ").trim();
+  if (max <= 1) return value;
+  return value.length <= max ? value : value.slice(0, max - 1) + "\u2026";
+}
+function seconds(ms) {
+  const total = Math.max(0, Math.round(ms / 1e3));
+  if (total < 60) return total + "s";
+  return Math.floor(total / 60) + "m" + String(total % 60).padStart(2, "0") + "s";
+}
+function statusLine(opts) {
+  const hint = opts.hint ? " \xB7 " + opts.hint : "";
+  const body = opts.text + " (" + seconds(opts.elapsedMs) + hint + ")";
+  const width = Math.max(20, (opts.width || 100) - 4);
+  return S2.think + "  " + spinnerFrame(opts.tick) + " " + clip3(body, width) + S2.reset;
+}
+function renderEvent(event, width = 100) {
+  const body = Math.max(30, width - 4);
+  switch (event.type) {
+    // The workspace and both accounts are already in the session header, so
+    // this line carries only what the header could not know before the harness
+    // started: which model answered, and whether a subscription or a key paid.
+    case "session-start":
+      return [
+        "",
+        S2.dim + "  " + clip3(event.model, body - 20) + (event.authSource === "login" ? "  \xB7  subscription" : "  \xB7  api key") + S2.reset,
+        ""
+      ];
+    case "user-message":
+      return ["", S2.user + "  \u276F " + S2.reset + S2.bold + clip3(event.text, body) + S2.reset, ""];
+    // Live state, not transcript. The runner promotes these to the status line.
+    case "thinking":
+      return [];
+    case "assistant-message": {
+      const lines = wrap(event.text, body - 2);
+      return [
+        "",
+        ...lines.map((line, index) => index === 0 ? S2.agent + "  " + BULLET + " " + line + S2.reset : S2.agent + "    " + line + S2.reset),
+        ""
+      ];
+    }
+    case "tool-start": {
+      const label = TOOL_LABEL[event.kind] || TOOL_LABEL.other;
+      return [
+        S2.tool + "  " + BULLET + " " + label + S2.reset + S2.dim + "(" + clip3(event.target, body - label.length - 8) + ")" + S2.reset
+      ];
+    }
+    case "tool-end": {
+      if (event.blocked) {
+        return [
+          S2.blocked + "  " + BULLET + " Blocked" + S2.reset + S2.dim + "  " + clip3(terminalText(event.target), body - 14) + S2.reset,
+          ...wrap(terminalText(event.reason), body - 6).map((line, index) => index === 0 ? S2.blocked + "    " + ELBOW + " " + S2.reset + S2.rule + line + S2.reset : S2.rule + "      " + line + S2.reset)
+        ];
+      }
+      const detail = event.ok ? event.output.trim() ? clip3(terminalText(event.output), body - 10) : "done" : "failed" + (event.exitCode === null ? "" : " (exit " + event.exitCode + ")");
+      const tint = event.ok ? S2.ok : S2.blocked;
+      return [tint + "    " + ELBOW + " " + S2.reset + S2.dim + detail + S2.reset];
+    }
+    // A clean finish needs no announcement: the prompt returning IS the signal.
+    case "turn-end":
+      return event.ok ? [] : ["", S2.blocked + "  " + BULLET + " turn ended with an error" + S2.reset, ""];
+    case "notice":
+      return [S2.dim + "  " + clip3(event.text, body) + S2.reset];
+    default:
+      return [];
+  }
+}
+function wrap(text, width) {
+  const words = String(text || "").replace(/\s+/g, " ").trim().split(" ").filter(Boolean);
+  if (words.length === 0) return [];
+  const lines = [];
+  let line = "";
+  for (const word of words) {
+    if (!line) line = word;
+    else if ((line + " " + word).length <= width) line += " " + word;
+    else {
+      lines.push(line);
+      line = word;
+    }
+  }
+  if (line) lines.push(line);
+  return lines;
+}
+var ESC2, S2, CLEAR_LINE, BULLET, ELBOW, SPINNER, TOOL_LABEL;
+var init_render2 = __esm({
+  "cli/harness/render.ts"() {
+    "use strict";
+    ESC2 = "\x1B[";
+    S2 = {
+      reset: ESC2 + "0m",
+      dim: ESC2 + "2m",
+      bold: ESC2 + "1m",
+      user: ESC2 + "38;5;111m",
+      agent: ESC2 + "38;5;252m",
+      think: ESC2 + "38;5;244m",
+      tool: ESC2 + "38;5;180m",
+      ok: ESC2 + "38;5;114m",
+      blocked: ESC2 + "38;5;203m",
+      rule: ESC2 + "38;5;211m"
+    };
+    CLEAR_LINE = "\r" + ESC2 + "2K";
+    BULLET = "\u23FA";
+    ELBOW = "\u23BF";
+    SPINNER = ["\xB7", "\u2722", "\u2733", "\u2217", "\u273B", "\u273D"];
+    TOOL_LABEL = {
+      shell: "Shell",
+      read: "Read",
+      edit: "Edit",
+      write: "Write",
+      delete: "Delete",
+      search: "Search",
+      list: "List",
+      todo: "Todo",
+      other: "Tool"
+    };
+  }
+});
+
+// cli/harness/composer.ts
+import { execFileSync as execFileSync5, spawnSync as spawnSync12 } from "child_process";
+import { existsSync as existsSync38, mkdtempSync as mkdtempSync2, rmSync as rmSync7, statSync as statSync5, writeFileSync as writeFileSync27 } from "fs";
+import { homedir as homedir38, tmpdir } from "os";
+import { basename as basename3, dirname as dirname12, extname, isAbsolute as isAbsolute2, join as join37, resolve as resolve5, sep as sep3 } from "path";
+import { createInterface as createInterface5 } from "readline";
+function markerCarryLength(input, marker) {
+  for (let length = Math.min(input.length, marker.length - 1); length > 0; length -= 1) {
+    if (marker.startsWith(input.slice(-length))) return length;
+  }
+  return 0;
+}
+function normalizePathToken(raw) {
+  let value = raw.trim();
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    value = value.slice(1, -1);
+  }
+  value = value.replace(/\\([\\ "'()])/g, "$1");
+  if (value === "~") return homedir38();
+  if (value.startsWith("~/")) return join37(homedir38(), value.slice(2));
+  return value;
+}
+function imagePathsInText(text, cwd) {
+  const candidates = String(text || "").match(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|(?:\\.|[^\s])+/g) || [];
+  const images = [];
+  for (const candidate of candidates) {
+    const token = normalizePathToken(candidate);
+    if (!IMAGE_EXTENSIONS.has(extname(token).toLowerCase())) continue;
+    const path = isAbsolute2(token) ? token : resolve5(cwd, token);
+    try {
+      if (statSync5(path).isFile() && !images.includes(path)) images.push(path);
+    } catch {
+    }
+  }
+  return images;
+}
+function codexUserInput(draft) {
+  const input = [];
+  if (draft.text.trim()) input.push({ type: "text", text: draft.text, text_elements: [] });
+  for (const path of draft.images) input.push({ type: "localImage", path });
+  return input;
+}
+function clipboardText() {
+  try {
+    if (process.platform === "darwin") return execFileSync5("pbpaste", [], { encoding: "utf8", timeout: 1500 });
+    const wayland = spawnSync12("wl-paste", ["--no-newline"], { encoding: "utf8", timeout: 1500 });
+    if (wayland.status === 0) return String(wayland.stdout || "");
+    const x11 = spawnSync12("xclip", ["-selection", "clipboard", "-o"], { encoding: "utf8", timeout: 1500 });
+    return x11.status === 0 ? String(x11.stdout || "") : "";
+  } catch {
+    return "";
+  }
+}
+function macClipboardPng(target) {
+  const script = [
+    "on run argv",
+    "set outputPath to item 1 of argv",
+    "set imageData to the clipboard as \xABclass PNGf\xBB",
+    "set outputFile to open for access POSIX file outputPath with write permission",
+    "set eof outputFile to 0",
+    "write imageData to outputFile",
+    "close access outputFile",
+    "end run"
+  ].join("\n");
+  const result = spawnSync12("osascript", ["-e", script, target], { encoding: "utf8", timeout: 3e3 });
+  return result.status === 0 && existsSync38(target);
+}
+function linuxClipboardPng(target) {
+  const wayland = spawnSync12("wl-paste", ["--type", "image/png"], { encoding: null, timeout: 3e3 });
+  if (wayland.status === 0 && Buffer.isBuffer(wayland.stdout) && wayland.stdout.length > 0) {
+    writeFileSync27(target, wayland.stdout);
+    return true;
+  }
+  const x11 = spawnSync12("xclip", ["-selection", "clipboard", "-t", "image/png", "-o"], { encoding: null, timeout: 3e3 });
+  if (x11.status === 0 && Buffer.isBuffer(x11.stdout) && x11.stdout.length > 0) {
+    writeFileSync27(target, x11.stdout);
+    return true;
+  }
+  return false;
+}
+function clipboardImage() {
+  const directory = mkdtempSync2(join37(tmpdir(), "synkro-paste-"));
+  const target = join37(directory, "clipboard.png");
+  try {
+    const copied = process.platform === "darwin" ? macClipboardPng(target) : process.platform === "linux" && linuxClipboardPng(target);
+    if (copied && statSync5(target).size > 0) return target;
+  } catch {
+  }
+  rmSync7(directory, { recursive: true, force: true });
+  return "";
+}
+function cleanupPromptDraft(draft) {
+  for (const path of draft.temporaryImages) {
+    const directory = dirname12(resolve5(path));
+    const temporaryRoot = resolve5(tmpdir()) + sep3;
+    if (!directory.startsWith(temporaryRoot) || !basename3(directory).startsWith("synkro-paste-")) continue;
+    try {
+      rmSync7(directory, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
+function fallbackPrompt(cwd) {
+  return new Promise((resolveDraft) => {
+    const rl = createInterface5({ input: process.stdin, output: process.stdout });
+    let settled = false;
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      rl.close();
+      resolveDraft(value);
+    };
+    rl.once("close", () => finish(null));
+    rl.once("SIGINT", () => finish(null));
+    rl.question(S2.user + "  \u276F " + S2.reset, (text) => {
+      finish({ text, images: imagePathsInText(text, cwd), temporaryImages: [] });
+    });
+  });
+}
+function readPrompt(cwd) {
+  const input = process.stdin;
+  const output = process.stdout;
+  if (!input.isTTY || !output.isTTY || !input.setRawMode) return fallbackPrompt(cwd);
+  return new Promise((resolveDraft) => {
+    let text = "";
+    let cursor = 0;
+    let stream = "";
+    let pasting = false;
+    let settled = false;
+    const images = [];
+    const temporaryImages = [];
+    const wasRaw = Boolean(input.isRaw);
+    const prompt = S2.user + "  \u276F " + S2.reset;
+    const redraw = () => {
+      const safe = text.replace(/[\u0000-\u0008\u000B-\u001F\u007F-\u009F]/g, "").replace(/[\r\n]+/g, " / ");
+      const attachmentLabel = images.length ? "  [" + images.length + " image" + (images.length === 1 ? "" : "s") + "]" : "";
+      const attachments = attachmentLabel ? S2.dim + attachmentLabel + S2.reset : "";
+      output.write("\r\x1B[2K" + prompt + safe + attachments);
+      const after = text.slice(cursor).replace(/[\r\n]+/g, " / ").length + attachmentLabel.length;
+      if (after > 0) output.write("\x1B[" + after + "D");
+    };
+    const finish = (draft) => {
+      if (settled) return;
+      settled = true;
+      input.off("data", onData);
+      input.setRawMode?.(wasRaw);
+      output.write("\x1B[?2004l\n");
+      if (!draft) cleanupPromptDraft({ temporaryImages });
+      resolveDraft(draft);
+    };
+    const insert = (value) => {
+      text = text.slice(0, cursor) + value + text.slice(cursor);
+      cursor += value.length;
+    };
+    const attachClipboard = () => {
+      const image = clipboardImage();
+      if (image) {
+        images.push(image);
+        temporaryImages.push(image);
+        return;
+      }
+      insert(clipboardText());
+    };
+    const processStream = () => {
+      while (stream && !settled) {
+        if (pasting) {
+          const end = stream.indexOf(PASTE_END);
+          if (end < 0) {
+            const keep = markerCarryLength(stream, PASTE_END);
+            insert(stream.slice(0, stream.length - keep));
+            stream = stream.slice(stream.length - keep);
+            break;
+          }
+          insert(stream.slice(0, end));
+          stream = stream.slice(end + PASTE_END.length);
+          pasting = false;
+          continue;
+        }
+        if (stream.startsWith(PASTE_START)) {
+          stream = stream.slice(PASTE_START.length);
+          pasting = true;
+          continue;
+        }
+        if (PASTE_START.startsWith(stream)) break;
+        if (stream.startsWith("\x1B[D")) {
+          cursor = Math.max(0, cursor - 1);
+          stream = stream.slice(3);
+          continue;
+        }
+        if (stream.startsWith("\x1B[C")) {
+          cursor = Math.min(text.length, cursor + 1);
+          stream = stream.slice(3);
+          continue;
+        }
+        if (stream.startsWith("\x1B[H")) {
+          cursor = 0;
+          stream = stream.slice(3);
+          continue;
+        }
+        if (stream.startsWith("\x1B[F")) {
+          cursor = text.length;
+          stream = stream.slice(3);
+          continue;
+        }
+        if (stream.startsWith("\x1B[A") || stream.startsWith("\x1B[B")) {
+          stream = stream.slice(3);
+          continue;
+        }
+        if (stream.startsWith("\x1B") && stream.length < 3) break;
+        const char = stream[0];
+        stream = stream.slice(1);
+        if (char === "\r" || char === "\n") {
+          const found = imagePathsInText(text, cwd);
+          for (const path of found) if (!images.includes(path)) images.push(path);
+          finish({ text, images, temporaryImages });
+        } else if (char === "" || char === "" && !text && images.length === 0) {
+          finish(null);
+        } else if (char === "\x7F" || char === "\b") {
+          if (cursor > 0) {
+            text = text.slice(0, cursor - 1) + text.slice(cursor);
+            cursor -= 1;
+          }
+        } else if (char === "") {
+          text = text.slice(cursor);
+          cursor = 0;
+        } else if (char === "") {
+          const before = text.slice(0, cursor).replace(/\s*\S+\s*$/, "");
+          text = before + text.slice(cursor);
+          cursor = before.length;
+        } else if (char === "") {
+          attachClipboard();
+        } else if (char >= " " || char === "	") {
+          insert(char);
+        }
+      }
+      if (!settled) redraw();
+    };
+    let queue = Promise.resolve();
+    const onData = (chunk) => {
+      queue = queue.then(() => {
+        stream += chunk.toString("utf8");
+        processStream();
+      });
+    };
+    input.setRawMode(true);
+    input.resume();
+    input.on("data", onData);
+    output.write("\x1B[?2004h" + prompt);
+  });
+}
+var PASTE_START, PASTE_END, IMAGE_EXTENSIONS;
+var init_composer = __esm({
+  "cli/harness/composer.ts"() {
+    "use strict";
+    init_render2();
+    PASTE_START = "\x1B[200~";
+    PASTE_END = "\x1B[201~";
+    IMAGE_EXTENSIONS = /* @__PURE__ */ new Set([".png", ".jpg", ".jpeg", ".gif", ".webp"]);
+  }
+});
+
 // cli/harness/events.ts
+function fixPollId(raw) {
+  const text = String(raw || "");
+  return FIX_POLL_MARKER.exec(text)?.[1] || LEGACY_FIX_POLL_MARKER.exec(text)?.[1] || "";
+}
+function cleanGuardText(raw) {
+  return String(raw || "").replace(FIX_POLL_MARKER, "").replace(/\n*\s*SYNKRO FIX POLL[\s\S]*$/i, "").replace(/\n?\d{4}-\d\d-\d\dT[^\n]*\sERROR\s+codex_core::tools::router:[^\n]*/gi, "").replace(/\s*Checking command\s*$/i, "").trim();
+}
 function blockReason(raw) {
-  const text = String(raw || "").trim();
+  const text = cleanGuardText(raw);
   if (!text) return "blocked by policy";
+  const guardAt = text.lastIndexOf("Guard:");
+  if (guardAt >= 0) return text.slice(guardAt + "Guard:".length).trim();
   const afterTag = text.match(/\[synkro:[^\]]*\]\s*(.+)/is);
   if (afterTag) return afterTag[1].trim();
   const afterHook = text.match(/blocked by a hook:\s*(.+)/is);
   if (afterHook) return afterHook[1].trim();
   return text;
 }
-var BLOCK_MARKER;
+var BLOCK_MARKER, FIX_POLL_MARKER, LEGACY_FIX_POLL_MARKER;
 var init_events = __esm({
   "cli/harness/events.ts"() {
     "use strict";
     BLOCK_MARKER = /blocked by a hook|\[synkro:/i;
+    FIX_POLL_MARKER = /\[synkro:fix-poll\s+item_id=\\?["']?([A-Za-z0-9_-]+)\\?["']?\]/i;
+    LEGACY_FIX_POLL_MARKER = /SYNKRO FIX POLL\s*\(item_id=([A-Za-z0-9_-]+)\)/i;
   }
 });
 
@@ -16781,6 +17380,7 @@ function parseCursorLine(line) {
         ok: Boolean(success) && Number(success?.exitCode ?? 0) === 0,
         blocked,
         reason: rejected ? blocked ? blockReason(rawReason) : rawReason || "rejected" : "",
+        pollId: blocked ? fixPollId(rawReason) : "",
         exitCode: success ? Number(success.exitCode ?? 0) : null,
         output: String(success?.stdout || success?.stderr || "")
       }];
@@ -16805,6 +17405,15 @@ function parseCursorLine(line) {
   }
   return [];
 }
+function stderrNotice(raw) {
+  const text = String(raw || "").trim();
+  if (!text) return "";
+  if (/ActionRequiredError/i.test(text) && /usage limit/i.test(text)) {
+    return "Cursor usage limit reached \u2014 replies still land, but turns will keep stalling until the plan resets or is topped up";
+  }
+  if (/RetriableError/i.test(text)) return "";
+  return /error|fatal/i.test(text) ? text : "";
+}
 function feed(buffer, chunk) {
   const combined = buffer + chunk;
   const parts = combined.split("\n");
@@ -16843,97 +17452,6 @@ var init_cursor = __esm({
   }
 });
 
-// cli/harness/render.ts
-function clip3(text, max) {
-  const value = String(text || "").replace(/\s+/g, " ").trim();
-  return value.length <= max ? value : value.slice(0, max - 1) + "\u2026";
-}
-function renderEvent(event, width = 100) {
-  const body = Math.max(30, width - 4);
-  switch (event.type) {
-    case "session-start":
-      return [
-        "",
-        S2.dim + "  " + event.model + "  \xB7  " + clip3(event.cwd, body - 30) + (event.authSource === "login" ? "  \xB7  subscription" : "") + S2.reset,
-        ""
-      ];
-    case "user-message":
-      return ["", S2.user + "  \u276F " + S2.reset + S2.bold + clip3(event.text, body) + S2.reset, ""];
-    case "thinking":
-      return [S2.think + "  \xB7 thinking\u2026" + S2.reset];
-    case "assistant-message":
-      return ["", ...wrap(event.text, body).map((line) => S2.agent + "  " + line + S2.reset), ""];
-    case "tool-start": {
-      const glyph = GLYPH[event.kind] || GLYPH.other;
-      return [S2.tool + "  " + glyph + " " + S2.reset + S2.dim + clip3(event.target, body - 6) + S2.reset];
-    }
-    case "tool-end": {
-      if (event.blocked) {
-        return [
-          S2.blocked + "  \u26D4 blocked" + S2.reset + S2.dim + "  " + clip3(event.target, body - 14) + S2.reset,
-          ...wrap(event.reason, body - 6).map((line) => "     " + S2.rule + line + S2.reset)
-        ];
-      }
-      const mark = event.ok ? S2.ok + "  \u2713" : S2.blocked + "  \u2717";
-      const code = event.exitCode === null || event.exitCode === 0 ? "" : " (exit " + event.exitCode + ")";
-      const out = event.output.trim() ? S2.dim + "  " + clip3(event.output, body - 20) + S2.reset : "";
-      return [mark + S2.reset + code + out];
-    }
-    case "turn-end":
-      return ["", S2.dim + "  " + (event.ok ? "done" : "ended with an error") + S2.reset, ""];
-    case "notice":
-      return [S2.dim + "  " + clip3(event.text, body) + S2.reset];
-    default:
-      return [];
-  }
-}
-function wrap(text, width) {
-  const words = String(text || "").replace(/\s+/g, " ").trim().split(" ").filter(Boolean);
-  if (words.length === 0) return [];
-  const lines = [];
-  let line = "";
-  for (const word of words) {
-    if (!line) line = word;
-    else if ((line + " " + word).length <= width) line += " " + word;
-    else {
-      lines.push(line);
-      line = word;
-    }
-  }
-  if (line) lines.push(line);
-  return lines;
-}
-var ESC2, S2, GLYPH;
-var init_render2 = __esm({
-  "cli/harness/render.ts"() {
-    "use strict";
-    ESC2 = "\x1B[";
-    S2 = {
-      reset: ESC2 + "0m",
-      dim: ESC2 + "2m",
-      bold: ESC2 + "1m",
-      user: ESC2 + "38;5;111m",
-      agent: ESC2 + "38;5;252m",
-      think: ESC2 + "38;5;244m",
-      tool: ESC2 + "38;5;180m",
-      ok: ESC2 + "38;5;114m",
-      blocked: ESC2 + "38;5;203m",
-      rule: ESC2 + "38;5;211m"
-    };
-    GLYPH = {
-      shell: "\u276F",
-      read: "\u25C4",
-      edit: "\u270E",
-      write: "\u270E",
-      delete: "\u2716",
-      search: "\u2315",
-      list: "\u2630",
-      todo: "\u2611",
-      other: "\u2022"
-    };
-  }
-});
-
 // cli/harness/run.ts
 import { spawn as spawn9 } from "child_process";
 function replayKey(event) {
@@ -16952,33 +17470,149 @@ function replayKey(event) {
 }
 function createTurnSink(opts) {
   const events = [];
+  const now = opts.now || (() => Date.now());
+  const showPrompt = opts.showPrompt !== false;
   let blocked = 0;
-  let lastWasThinking = false;
   let replaying = false;
   const seen = /* @__PURE__ */ new Set();
   let sawTurnEnd = false;
   let sawAnswer = false;
   let buffer = "";
+  let reconnecting = false;
+  let lastWasAnswer = false;
+  const toolStartedAt = /* @__PURE__ */ new Map();
+  let statusText = "";
+  let statusKind = "progress";
+  let statusShown = false;
+  let tick = 0;
+  const startedAt = now();
+  let timer = null;
+  const drawStatus = () => {
+    if (!opts.animate || !statusText) return;
+    opts.write(statusLine({
+      tick,
+      text: statusText,
+      elapsedMs: now() - startedAt,
+      width: opts.width,
+      hint: "ctrl-c to interrupt"
+    }));
+    statusShown = true;
+  };
+  const clearStatus = () => {
+    if (!statusShown) return;
+    opts.write(CLEAR_LINE);
+    statusShown = false;
+  };
+  const setStatus = (text, kind = "progress") => {
+    statusText = text;
+    statusKind = kind;
+    if (!opts.animate) return;
+    if (!timer) {
+      timer = setInterval(() => {
+        tick += 1;
+        clearStatus();
+        drawStatus();
+      }, TICK_MS);
+      timer.unref?.();
+    }
+    clearStatus();
+    drawStatus();
+  };
+  const stopStatus = () => {
+    statusText = "";
+    statusKind = "progress";
+    if (timer) {
+      clearInterval(timer);
+      timer = null;
+    }
+    clearStatus();
+  };
+  let gaveUp = false;
+  let stall = null;
+  const graceMs = opts.postAnswerGraceMs ?? 15e3;
+  const disarmStall = () => {
+    if (stall) {
+      clearTimeout(stall);
+      stall = null;
+    }
+  };
+  const giveUp = () => {
+    if (gaveUp) return;
+    gaveUp = true;
+    disarmStall();
+    opts.onGiveUp?.();
+  };
+  const armStall = () => {
+    disarmStall();
+    stall = setTimeout(giveUp, graceMs);
+    stall.unref?.();
+  };
+  const settle = () => {
+    reconnecting = false;
+    if (statusKind === "retry") setStatus("Thinking");
+  };
   const emit2 = (event) => {
     events.push(event);
     if (event.type === "tool-end" && event.blocked) blocked += 1;
     opts.onEvent?.(event);
+    if (event.type === "notice" && event.kind === "retry") {
+      reconnecting = true;
+      if (sawAnswer && lastWasAnswer) {
+        setStatus("finishing up", "retry");
+        armStall();
+      } else {
+        setStatus(event.text, "retry");
+      }
+      return;
+    }
     if (event.type === "thinking") {
-      if (lastWasThinking) return;
-      lastWasThinking = true;
-    } else {
-      lastWasThinking = false;
+      if (!reconnecting) setStatus("Thinking");
+      return;
+    }
+    if (event.type === "user-message" && !showPrompt) return;
+    if (event.type === "session-start" && opts.showHeader === false) return;
+    if (event.type === "assistant-message" || event.type === "tool-end") settle();
+    if (event.type === "tool-start") {
+      reconnecting = false;
+      setStatus("Running " + event.kind);
     }
+    if (event.type === "turn-end") stopStatus();
     const rendered = renderEvent(event, opts.width);
-    if (rendered.length) opts.write(rendered.join("\n") + "\n");
+    if (!rendered.length) return;
+    clearStatus();
+    opts.write(rendered.join("\n") + "\n");
+    drawStatus();
   };
-  const take = (event) => {
-    if (event.type === "notice" && event.kind === "retry") replaying = true;
+  const take = (incoming) => {
+    let event = incoming;
+    if (event.type === "tool-start" && event.id && !toolStartedAt.has(event.id)) {
+      toolStartedAt.set(event.id, now());
+    } else if (event.type === "tool-end") {
+      const started = toolStartedAt.get(event.id);
+      if ((event.durationMs === null || event.durationMs === void 0) && started !== void 0) {
+        event = { ...event, durationMs: Math.max(0, now() - started) };
+      }
+      toolStartedAt.delete(event.id);
+    }
+    const isRetry = event.type === "notice" && event.kind === "retry";
+    if (!isRetry) disarmStall();
+    if (isRetry) {
+      if (reconnecting && sawAnswer && lastWasAnswer) {
+        giveUp();
+        return;
+      }
+      replaying = true;
+    }
     const key = replayKey(event);
     if (key) {
-      if (replaying && seen.has(key)) return;
+      if (replaying && seen.has(key)) {
+        lastWasAnswer = event.type === "assistant-message";
+        settle();
+        return;
+      }
       seen.add(key);
     }
+    if (key || event.type === "thinking") lastWasAnswer = event.type === "assistant-message";
     if (event.type === "turn-end") sawTurnEnd = true;
     if (event.type === "assistant-message") sawAnswer = true;
     emit2(event);
@@ -16992,57 +17626,626 @@ function createTurnSink(opts) {
     notice(text) {
       emit2({ type: "notice", text });
     },
-    finish(exit) {
+    event(event) {
+      take(event);
+    },
+    finish(exit, interrupted = false) {
+      disarmStall();
+      stopStatus();
       if (!sawTurnEnd) {
-        if (exit !== 0) {
-          emit2({
-            type: "notice",
-            text: sawAnswer ? "cursor-agent exited " + exit + " after retrying; the reply above is complete" : "cursor-agent exited " + exit + " without completing the turn"
-          });
+        if (interrupted) {
+          emit2({ type: "notice", text: "interrupted" });
+          emit2({ type: "turn-end", ok: true, text: "" });
+        } else {
+          if (exit !== 0 && !sawAnswer) {
+            emit2({ type: "notice", text: "cursor-agent exited " + exit + " without completing the turn" });
+          }
+          emit2({ type: "turn-end", ok: sawAnswer, text: "" });
         }
-        emit2({ type: "turn-end", ok: sawAnswer, text: "" });
       }
-      return { events, blocked, exitCode: sawAnswer ? 0 : exit };
+      stopStatus();
+      return { events, blocked, exitCode: interrupted ? 130 : sawAnswer ? 0 : exit };
     }
   };
 }
 async function runCursorTurn(opts) {
   const write2 = opts.write || ((text) => process.stdout.write(text));
   const width = opts.width || Number(process.stdout.columns || 100);
-  const sink = createTurnSink({ write: write2, onEvent: opts.onEvent, width });
-  return new Promise((resolve7) => {
+  let stopHarness = () => {
+  };
+  const sink = createTurnSink({
+    write: write2,
+    onEvent: opts.onEvent,
+    width,
+    animate: Boolean(process.stdout.isTTY),
+    showPrompt: opts.showPrompt,
+    showHeader: opts.showHeader,
+    onGiveUp: () => stopHarness()
+  });
+  return new Promise((resolve8) => {
     const child = spawn9("cursor-agent", cursorArgs(opts.prompt), {
       cwd: opts.cwd,
       stdio: ["ignore", "pipe", "pipe"]
     });
+    stopHarness = () => {
+      child.kill();
+      const hard = setTimeout(() => child.kill("SIGKILL"), 3e3);
+      hard.unref?.();
+      child.once("close", () => clearTimeout(hard));
+    };
+    let interrupted = false;
+    const onAbort = () => {
+      interrupted = true;
+      stopHarness();
+    };
+    if (opts.signal?.aborted) onAbort();
+    else opts.signal?.addEventListener("abort", onAbort, { once: true });
     child.stdout.on("data", (chunk) => sink.chunk(chunk.toString("utf8")));
+    let lastNote = "";
     child.stderr.on("data", (chunk) => {
-      const text = chunk.toString("utf8").trim();
-      if (/error|fatal/i.test(text) && !/RetriableError/i.test(text)) sink.notice(text);
+      const note = stderrNotice(chunk.toString("utf8"));
+      if (note && note !== lastNote) {
+        lastNote = note;
+        sink.notice(note);
+      }
+    });
+    child.on("close", (code) => {
+      opts.signal?.removeEventListener("abort", onAbort);
+      resolve8(sink.finish(code ?? 0, interrupted));
     });
-    child.on("close", (code) => resolve7(sink.finish(code ?? 0)));
     child.on("error", (error) => {
       sink.notice("failed to start cursor-agent: " + String(error));
-      resolve7(sink.finish(1));
+      resolve8(sink.finish(1, interrupted));
     });
   });
 }
+var TICK_MS;
 var init_run = __esm({
   "cli/harness/run.ts"() {
     "use strict";
     init_cursor();
     init_render2();
+    TICK_MS = 120;
+  }
+});
+
+// cli/harness/codex.ts
+import { spawn as spawn10 } from "child_process";
+function itemTarget(item) {
+  if (item?.type === "commandExecution") {
+    return { kind: "shell", target: String(item.command || ""), description: "" };
+  }
+  if (item?.type === "fileChange") {
+    const paths = Array.isArray(item.changes) ? item.changes.map((change) => String(change?.path || "")).filter(Boolean) : [];
+    return { kind: "edit", target: paths.join(", ") || "files", description: "" };
+  }
+  if (item?.type === "mcpToolCall") {
+    return { kind: "other", target: String(item.server || "") + "::" + String(item.tool || ""), description: "MCP tool" };
+  }
+  if (item?.type === "dynamicToolCall") {
+    return { kind: "other", target: [item.namespace, item.tool].filter(Boolean).join("::"), description: "tool" };
+  }
+  return { kind: "other", target: String(item?.type || "tool"), description: "" };
+}
+function itemOutput(item) {
+  if (item?.type === "commandExecution") return String(item.aggregatedOutput || "");
+  if (item?.type === "mcpToolCall") return item.error ? String(item.error?.message || JSON.stringify(item.error)) : item.result ? JSON.stringify(item.result) : "";
+  if (item?.type === "dynamicToolCall") return item.contentItems ? JSON.stringify(item.contentItems) : "";
+  return "";
+}
+function parseCodexNotification(method, params, startedAt = /* @__PURE__ */ new Map(), approvalReasons = /* @__PURE__ */ new Map()) {
+  if (method === "hook/started" || method === "hook/completed") {
+    const run2 = params?.run || {};
+    if (run2.eventName !== "preToolUse") return [];
+    const asMs = (value) => {
+      const number = Number(value || 0);
+      return number > 0 && number < 1e11 ? number * 1e3 : number;
+    };
+    const started = asMs(run2.startedAt);
+    const priorStart = Number(approvalReasons.get("__pretool_started__") || 0);
+    if (started && (!priorStart || started < priorStart)) approvalReasons.set("__pretool_started__", String(started));
+    if (method === "hook/completed") {
+      const completed = asMs(run2.completedAt) || started + Number(run2.durationMs || 0);
+      const priorCompleted = Number(approvalReasons.get("__pretool_completed__") || 0);
+      if (completed > priorCompleted) approvalReasons.set("__pretool_completed__", String(completed));
+      const entries = Array.isArray(run2.entries) ? run2.entries : [];
+      const pollEntry = entries.find((entry) => fixPollId(String(entry?.text || "")));
+      const blockingEntry = entries.find((entry) => entry?.kind === "stop" || entry?.kind === "error");
+      const text = String(pollEntry?.text || blockingEntry?.text || run2.statusMessage || "");
+      if (text && (run2.status === "blocked" || run2.status === "failed" || BLOCK_MARKER.test(text))) {
+        approvalReasons.set("__latest_hook__", text);
+        approvalReasons.set("__latest_hook_id__", String(run2.id || "synkro-policy-block"));
+        approvalReasons.set("__latest_hook_duration__", String(Number(run2.durationMs || Math.max(0, completed - started))));
+      }
+    }
+    return [];
+  }
+  if (method === "item/started") {
+    const item = params?.item;
+    if (!item?.id) return [];
+    startedAt.set(String(item.id), Number(params.startedAtMs || Date.now()));
+    if (!["commandExecution", "fileChange", "mcpToolCall", "dynamicToolCall"].includes(item.type)) return [];
+    return [{ type: "tool-start", id: String(item.id), ...itemTarget(item) }];
+  }
+  if (method === "item/completed") {
+    const item = params?.item;
+    if (!item?.id) return [];
+    if (item.type === "hookPrompt") {
+      const text = Array.isArray(item.fragments) ? item.fragments.map((fragment) => String(fragment?.text || "")).filter(Boolean).join("\n") : "";
+      if (text) {
+        const start2 = startedAt.get(String(item.id));
+        const completed2 = Number(params.completedAtMs || Date.now());
+        approvalReasons.set("__latest_hook__", text);
+        approvalReasons.set("__latest_hook_id__", String(item.id));
+        approvalReasons.set("__latest_hook_duration__", String(start2 === void 0 ? 0 : Math.max(0, completed2 - start2)));
+      }
+      startedAt.delete(String(item.id));
+      return [];
+    }
+    if (item.type === "agentMessage") {
+      return item.text ? [{ type: "assistant-message", text: String(item.text) }] : [];
+    }
+    if (item.type === "reasoning") {
+      const text = [...item.summary || [], ...item.content || []].join(" ").trim();
+      return text ? [{ type: "thinking", text }] : [];
+    }
+    if (!["commandExecution", "fileChange", "mcpToolCall", "dynamicToolCall"].includes(item.type)) return [];
+    const output = itemOutput(item);
+    const approvalReason = approvalReasons.get(String(item.id)) || "";
+    const hookReason = approvalReasons.get("__latest_hook__") || "";
+    const rawReason = [approvalReason, hookReason, output].filter(Boolean).join("\n");
+    const status = String(item.status || "");
+    const blocked = BLOCK_MARKER.test(rawReason) || /blocked by PreToolUse hook/i.test(rawReason) || Boolean(hookReason) && (status === "failed" || status === "declined");
+    const itemStart = startedAt.get(String(item.id));
+    const hookStart = Number(approvalReasons.get("__pretool_started__") || 0);
+    const start = itemStart === void 0 ? hookStart || void 0 : hookStart ? Math.min(itemStart, hookStart) : itemStart;
+    const completed = Number(params.completedAtMs || Date.now());
+    const durationMs = start === void 0 ? item.durationMs ?? null : Math.max(0, completed - start);
+    startedAt.delete(String(item.id));
+    approvalReasons.delete(String(item.id));
+    approvalReasons.delete("__latest_hook__");
+    approvalReasons.delete("__latest_hook_id__");
+    approvalReasons.delete("__latest_hook_duration__");
+    approvalReasons.delete("__pretool_started__");
+    approvalReasons.delete("__pretool_completed__");
+    return [{
+      type: "tool-end",
+      id: String(item.id),
+      ...itemTarget(item),
+      ok: status === "completed" && Number(item.exitCode ?? 0) === 0,
+      blocked,
+      reason: blocked ? blockReason(rawReason) : "",
+      pollId: blocked ? fixPollId(rawReason) : "",
+      exitCode: item.exitCode === null || item.exitCode === void 0 ? null : Number(item.exitCode),
+      output: blocked ? "" : output,
+      durationMs
+    }];
+  }
+  if (method === "turn/completed") {
+    const status = String(params?.turn?.status || "failed");
+    const hookReason = approvalReasons.get("__latest_hook__") || "";
+    const events = [];
+    if (hookReason) {
+      events.push({
+        type: "tool-end",
+        id: approvalReasons.get("__latest_hook_id__") || "synkro-policy-block",
+        kind: "other",
+        target: "policy check",
+        ok: false,
+        blocked: true,
+        reason: blockReason(hookReason),
+        pollId: fixPollId(hookReason),
+        exitCode: null,
+        output: "",
+        durationMs: Number(approvalReasons.get("__latest_hook_duration__") || 0)
+      });
+      approvalReasons.delete("__latest_hook__");
+      approvalReasons.delete("__latest_hook_id__");
+      approvalReasons.delete("__latest_hook_duration__");
+    }
+    approvalReasons.delete("__pretool_started__");
+    approvalReasons.delete("__pretool_completed__");
+    events.push({ type: "turn-end", ok: status === "completed", text: String(params?.turn?.error?.message || "") });
+    return events;
+  }
+  return [];
+}
+function codexStderrNotice(raw, initialized) {
+  const text = String(raw || "").trim();
+  if (!text || initialized) return "";
+  return /fatal|panic|authentication failed|not logged in/i.test(text) ? text.split("\n")[0].slice(0, 300) : "";
+}
+async function askApproval(text) {
+  const input = process.stdin;
+  const output = process.stdout;
+  if (!input.isTTY || !output.isTTY) return false;
+  output.write("\n" + S2.rule + "  Synkro approval required" + S2.reset + "\n  " + text.replace(/[\u0000-\u001F\u007F-\u009F]/g, " ").slice(0, 600) + "\n");
+  output.write(S2.dim + "  Press y to allow once; any other key denies." + S2.reset + "\n");
+  return new Promise((resolve8) => {
+    const wasRaw = Boolean(input.isRaw);
+    const onData = (chunk) => {
+      input.off("data", onData);
+      if (input.setRawMode) input.setRawMode(wasRaw);
+      resolve8(chunk.toString("utf8").toLowerCase() === "y");
+    };
+    if (input.setRawMode) input.setRawMode(true);
+    input.resume();
+    input.on("data", onData);
+  });
+}
+async function runCodexTurn(opts) {
+  const session = new CodexAppSession();
+  try {
+    return await session.turn(opts);
+  } finally {
+    session.close();
+  }
+}
+var CodexAppSession;
+var init_codex = __esm({
+  "cli/harness/codex.ts"() {
+    "use strict";
+    init_composer();
+    init_events();
+    init_run();
+    init_render2();
+    CodexAppSession = class {
+      child = null;
+      buffer = "";
+      nextId = 1;
+      pending = /* @__PURE__ */ new Map();
+      initialized = false;
+      threadId = "";
+      model = "Codex";
+      cwd = "";
+      active = null;
+      send(message) {
+        this.child?.stdin.write(JSON.stringify({ jsonrpc: "2.0", ...message }) + "\n");
+      }
+      request(method, params) {
+        const id = this.nextId++;
+        return new Promise((resolve8, reject) => {
+          this.pending.set(id, { resolve: resolve8, reject });
+          this.send({ id, method, params });
+        });
+      }
+      respond(id, result) {
+        this.send({ id, result });
+      }
+      async handleServerRequest(message) {
+        const method = String(message.method || "");
+        const params = message.params || {};
+        if (params.itemId && params.reason) this.active?.approvalReasons.set(String(params.itemId), String(params.reason));
+        if (method === "item/commandExecution/requestApproval" || method === "item/fileChange/requestApproval") {
+          const summary = String(params.reason || params.command || params.grantRoot || "Allow this action?");
+          const accepted = await askApproval(summary);
+          this.respond(message.id, { decision: accepted ? "accept" : "decline" });
+          return;
+        }
+        if (method === "item/tool/requestUserInput") {
+          const answers = {};
+          for (const question of params.questions || []) answers[String(question.id)] = { answers: [] };
+          this.respond(message.id, { answers });
+          return;
+        }
+        if (method === "mcpServer/elicitation/request") {
+          this.respond(message.id, { action: "decline" });
+          return;
+        }
+        this.respond(message.id, {});
+      }
+      handleLine(line) {
+        let message;
+        try {
+          message = JSON.parse(line);
+        } catch {
+          return;
+        }
+        if (message.method && message.id !== void 0) {
+          void this.handleServerRequest(message);
+          return;
+        }
+        if (message.method) {
+          const active = this.active;
+          if (!active) return;
+          const events = parseCodexNotification(message.method, message.params, active.startedAt, active.approvalReasons);
+          for (const event of events) active.sink.event(event);
+          if (message.method === "turn/started") active.turnId = String(message.params?.turn?.id || "");
+          if (message.method === "turn/completed") {
+            const result = active.sink.finish(message.params?.turn?.status === "completed" ? 0 : 1, active.interrupted);
+            this.active = null;
+            active.resolve(result);
+          }
+          return;
+        }
+        if (message.id !== void 0) {
+          const pending = this.pending.get(Number(message.id));
+          if (!pending) return;
+          this.pending.delete(Number(message.id));
+          if (message.error) pending.reject(new Error(String(message.error?.message || JSON.stringify(message.error))));
+          else pending.resolve(message.result);
+        }
+      }
+      async start(cwd) {
+        if (this.child) return;
+        this.cwd = cwd;
+        this.child = spawn10("codex", ["app-server"], { cwd, stdio: ["pipe", "pipe", "pipe"] });
+        this.child.stdout.on("data", (chunk) => {
+          this.buffer += chunk.toString("utf8");
+          let newline = this.buffer.indexOf("\n");
+          while (newline !== -1) {
+            const line = this.buffer.slice(0, newline).trim();
+            this.buffer = this.buffer.slice(newline + 1);
+            if (line) this.handleLine(line);
+            newline = this.buffer.indexOf("\n");
+          }
+        });
+        this.child.stderr.on("data", (chunk) => {
+          const note = codexStderrNotice(chunk.toString("utf8"), this.initialized);
+          if (note) this.active?.sink.notice(note);
+        });
+        this.child.on("close", (code) => {
+          const active = this.active;
+          if (active) {
+            this.active = null;
+            active.resolve(active.sink.finish(code ?? 1, active.interrupted));
+          }
+          for (const pending of this.pending.values()) pending.reject(new Error("codex app-server exited"));
+          this.pending.clear();
+          this.child = null;
+        });
+        this.child.on("error", (error) => {
+          const failure = new Error("failed to start codex app-server: " + String(error));
+          const active = this.active;
+          if (active) {
+            active.sink.notice(failure.message);
+            this.active = null;
+            active.resolve(active.sink.finish(1, active.interrupted));
+          }
+          for (const pending of this.pending.values()) pending.reject(failure);
+          this.pending.clear();
+        });
+        const initialized = await this.request("initialize", { clientInfo: { name: "synkro-governed", version: "1.0.0" } });
+        this.initialized = true;
+        this.send({ method: "initialized", params: {} });
+        const started = await this.request("thread/start", {
+          cwd,
+          approvalPolicy: "on-request",
+          approvalsReviewer: "user",
+          sandbox: "workspace-write",
+          ephemeral: false
+        });
+        this.threadId = String(started?.thread?.id || "");
+        this.model = String(started?.model || initialized?.userAgent || "Codex");
+        if (!this.threadId) throw new Error("codex app-server did not return a thread id");
+      }
+      async turn(opts) {
+        await this.start(opts.cwd);
+        if (this.active) throw new Error("a Codex turn is already running");
+        const sink = createTurnSink({
+          write: opts.write || ((text) => process.stdout.write(text)),
+          onEvent: opts.onEvent,
+          width: opts.width || Number(process.stdout.columns || 100),
+          animate: false,
+          showPrompt: opts.showPrompt,
+          showHeader: opts.showHeader
+        });
+        sink.event({ type: "session-start", sessionId: this.threadId, model: this.model, cwd: this.cwd, authSource: "login" });
+        sink.event({
+          type: "user-message",
+          text: opts.prompt || (opts.images?.length ? "[" + opts.images.length + " image attached]" : "")
+        });
+        const result = new Promise((resolve8) => {
+          this.active = { sink, resolve: resolve8, startedAt: /* @__PURE__ */ new Map(), approvalReasons: /* @__PURE__ */ new Map(), turnId: "", interrupted: false };
+        });
+        const onAbort = () => {
+          if (!this.active) return;
+          this.active.interrupted = true;
+          if (this.active.turnId) void this.request("turn/interrupt", { threadId: this.threadId, turnId: this.active.turnId }).catch(() => {
+          });
+        };
+        if (opts.signal?.aborted) onAbort();
+        else opts.signal?.addEventListener("abort", onAbort, { once: true });
+        try {
+          await this.request("turn/start", {
+            threadId: this.threadId,
+            cwd: opts.cwd,
+            input: codexUserInput({ text: opts.prompt, images: opts.images || [] })
+          });
+          return await result;
+        } finally {
+          opts.signal?.removeEventListener("abort", onAbort);
+        }
+      }
+      close() {
+        this.child?.kill();
+        this.child = null;
+      }
+    };
+  }
+});
+
+// cli/harness/fixPoll.ts
+function pollBaseUrl() {
+  const port = String(process.env.SYNKRO_MCP_PORT || "18931");
+  return "http://127.0.0.1:" + port + "/api/local/fix-poll";
+}
+function neutralizeTerminalControls(value) {
+  return value.replace(/[\u0000-\u0008\u000B-\u001F\u007F-\u009F\u001B]/g, "");
+}
+async function loadFixPoll(itemId, fetchImpl = fetch) {
+  const response = await fetchImpl(pollBaseUrl() + "?item_id=" + encodeURIComponent(itemId));
+  if (!response.ok) return null;
+  const body = await response.json();
+  const candidates = Array.isArray(body.candidates) ? body.candidates.filter((candidate) => typeof candidate === "string").slice(0, 8) : [];
+  if (!candidates.length || body.status !== "pending") return null;
+  return {
+    itemId,
+    filePath: String(body.file_path || ""),
+    ruleId: String(body.rule_id || ""),
+    candidates
+  };
+}
+async function recordFixPoll(itemId, chosenIdx, fetchImpl = fetch) {
+  const response = await fetchImpl(pollBaseUrl() + "/record", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ item_id: itemId, chosen_idx: chosenIdx })
+  });
+  return response.ok;
+}
+function fixPollLines(poll, selected, width = 100) {
+  const max = Math.max(32, width - 10);
+  const choices = [...poll.candidates, "None of the above"];
+  const scope = [poll.ruleId, poll.filePath].filter(Boolean).join("  \xB7  ");
+  const lines = [
+    "",
+    S2.bold + S2.rule + "  Synkro needs your decision" + S2.reset,
+    ...scope ? [S2.dim + "  " + neutralizeTerminalControls(scope) + S2.reset] : [],
+    ""
+  ];
+  choices.forEach((choice, index) => {
+    const prefix = index === selected ? S2.user + "  \u276F " : S2.dim + "    ";
+    const text = wrap(index + 1 + ". " + neutralizeTerminalControls(choice), max);
+    lines.push(prefix + (text[0] || "") + S2.reset);
+    for (const continuation of text.slice(1)) lines.push("      " + continuation);
+  });
+  lines.push("", S2.dim + "  \u2191/\u2193 select  \xB7  Enter confirm  \xB7  1-" + choices.length + " choose" + S2.reset);
+  return lines;
+}
+async function pickFixPoll(poll, io = {}) {
+  const input = io.input || process.stdin;
+  const output = io.output || process.stdout;
+  if (!input.isTTY || !output.isTTY) return -1;
+  let selected = 0;
+  let rendered = 0;
+  const draw = () => {
+    if (rendered) output.write("\x1B[" + rendered + "A\x1B[J");
+    const lines = fixPollLines(poll, selected, Number(output.columns || 100));
+    output.write(lines.join("\n") + "\n");
+    rendered = lines.length;
+  };
+  const choice = await new Promise((resolve8) => {
+    const choices = poll.candidates.length + 1;
+    const wasRaw = Boolean(input.isRaw);
+    const done = (index) => {
+      input.off("data", onData);
+      if (input.setRawMode) input.setRawMode(wasRaw);
+      resolve8(index === poll.candidates.length ? -1 : index);
+    };
+    const onData = (chunk) => {
+      const key = chunk.toString("utf8");
+      if (key === "") return done(poll.candidates.length);
+      if (key === "\x1B" || key.toLowerCase() === "n") return done(poll.candidates.length);
+      if (key === "\r" || key === "\n") return done(selected);
+      if (key === "\x1B[A" || key === "k") selected = (selected - 1 + choices) % choices;
+      else if (key === "\x1B[B" || key === "j") selected = (selected + 1) % choices;
+      else if (/^[1-9]$/.test(key)) {
+        const index = Number(key) - 1;
+        if (index < choices) return done(index);
+      } else return;
+      draw();
+    };
+    if (input.setRawMode) input.setRawMode(true);
+    input.resume();
+    input.on("data", onData);
+    draw();
+  });
+  return choice;
+}
+async function resolveFixPolls(events, io = {}) {
+  const ids = Array.from(new Set(events.filter((event) => event.type === "tool-end").map((event) => event.pollId || "").filter(Boolean)));
+  const recorded = [];
+  for (const itemId of ids) {
+    const poll = await loadFixPoll(itemId, io.fetchImpl).catch(() => null);
+    if (!poll) continue;
+    const chosen = await pickFixPoll(poll, io);
+    const ok = await recordFixPoll(itemId, chosen, io.fetchImpl).catch(() => false);
+    if (ok) recorded.push(chosen);
+    else (io.output || process.stdout).write(S2.blocked + "  Could not record that Synkro decision.\n" + S2.reset);
+  }
+  return recorded;
+}
+var init_fixPoll = __esm({
+  "cli/harness/fixPoll.ts"() {
+    "use strict";
+    init_render2();
+  }
+});
+
+// cli/harness/identity.ts
+import { execFileSync as execFileSync6 } from "child_process";
+import { homedir as homedir39 } from "os";
+function shortenPath(path, home = homedir39()) {
+  const value = String(path || "");
+  if (home && value === home) return "~";
+  if (home && value.startsWith(home + "/")) return "~" + value.slice(home.length);
+  return value;
+}
+function parseCursorAccount(output) {
+  const match = String(output || "").match(/logged in as\s+(\S+)/i);
+  return match ? match[1].trim() : "";
+}
+function cursorAccount() {
+  try {
+    const out = execFileSync6("cursor-agent", ["status"], {
+      encoding: "utf8",
+      timeout: 5e3,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    return parseCursorAccount(out);
+  } catch {
+    return "";
+  }
+}
+function synkroAccount() {
+  let email = "";
+  try {
+    email = String(getUserInfo().email || "");
+  } catch {
+    return { email: "", needsLogin: false };
+  }
+  let needsLogin = false;
+  try {
+    needsLogin = isTokenExpired() && !loadCredentials()?.refresh_token;
+  } catch {
+  }
+  return { email, needsLogin };
+}
+function readIdentity(harness) {
+  const synkro = synkroAccount();
+  return {
+    harness: harness === "cursor" ? cursorAccount() : "",
+    synkro: synkro.email,
+    needsLogin: synkro.needsLogin
+  };
+}
+function identityHeader(opts) {
+  const lines = ["", S2.bold + "  " + shortenPath(opts.cwd, opts.home) + S2.reset];
+  const label = (name, value, note = "") => S2.dim + "  " + name.padEnd(7) + S2.reset + S2.think + value + S2.reset + note;
+  if (opts.identity.harness) lines.push(label(opts.harness, opts.identity.harness));
+  if (opts.identity.synkro) {
+    lines.push(label("synkro", opts.identity.synkro, opts.identity.needsLogin ? S2.blocked + "  \xB7  session ended, run synkro login" + S2.reset : ""));
+  }
+  lines.push("");
+  return lines;
+}
+var init_identity2 = __esm({
+  "cli/harness/identity.ts"() {
+    "use strict";
+    init_auth();
+    init_render2();
   }
 });
 
 // cli/harness/session.ts
-import { createInterface as createInterface5 } from "readline";
-async function runOnce(harness, cwd, prompt) {
-  if (harness !== "cursor") {
+async function runOnce(harness, cwd, prompt, echoPrompt = true, showHeader = true, signal) {
+  if (harness !== "cursor" && harness !== "codex") {
     process.stdout.write(S2.dim + "  " + harness + " sessions are not embedded yet\n" + S2.reset);
     return 1;
   }
-  const result = await runCursorTurn({ prompt, cwd });
+  const result = harness === "codex" ? await runCodexTurn({ prompt, cwd, showPrompt: echoPrompt, showHeader, signal }) : await runCursorTurn({ prompt, cwd, showPrompt: echoPrompt, showHeader, signal });
+  await resolveFixPolls(result.events);
   if (result.blocked > 0) {
     process.stdout.write(
       S2.blocked + "  " + result.blocked + " action" + (result.blocked === 1 ? "" : "s") + " blocked by policy" + S2.reset + "\n"
@@ -17052,31 +18255,52 @@ async function runOnce(harness, cwd, prompt) {
 }
 async function runGovernedSession(harness, cwd, prompt) {
   if (prompt) return runOnce(harness, cwd, prompt);
-  process.stdout.write(BANNER.join("\n") + "\n");
-  const rl = createInterface5({ input: process.stdin, output: process.stdout });
-  const ask3 = () => new Promise((resolve7) => rl.question(S2.user + "  \u276F " + S2.reset, resolve7));
-  for (; ; ) {
-    const line = (await ask3()).trim();
-    if (!line) continue;
-    if (line === "exit" || line === "quit") break;
-    await runOnce(harness, cwd, line);
+  process.stdout.write(identityHeader({ cwd, harness, identity: readIdentity(harness) }).join("\n") + "\n");
+  const codex = harness === "codex" ? new CodexAppSession() : null;
+  let turn = null;
+  const interruptTurn = () => {
+    turn?.abort();
+  };
+  process.on("SIGINT", interruptTurn);
+  let first = true;
+  try {
+    for (; ; ) {
+      const draft = await readPrompt(cwd);
+      if (draft === null) break;
+      const line = draft.text.trim();
+      if (!line && draft.images.length === 0) continue;
+      if (draft.images.length === 0 && (line === "exit" || line === "quit")) break;
+      try {
+        turn = new AbortController();
+        const cursorPrompt = draft.images.length ? [draft.text, "", "Attached image files:", ...draft.images].join("\n") : draft.text;
+        const result = codex ? await codex.turn({ prompt: draft.text, images: draft.images, cwd, showPrompt: false, showHeader: first, signal: turn.signal }) : await runCursorTurn({ prompt: cursorPrompt, cwd, showPrompt: false, showHeader: first, signal: turn.signal });
+        await resolveFixPolls(result.events);
+        if (result.blocked > 0) {
+          process.stdout.write(
+            S2.blocked + "  " + result.blocked + " action" + (result.blocked === 1 ? "" : "s") + " blocked by policy" + S2.reset + "\n"
+          );
+        }
+        first = false;
+      } finally {
+        cleanupPromptDraft(draft);
+        turn = null;
+      }
+    }
+  } finally {
+    process.off("SIGINT", interruptTurn);
+    codex?.close();
   }
-  rl.close();
   return 0;
 }
-var BANNER;
 var init_session = __esm({
   "cli/harness/session.ts"() {
     "use strict";
+    init_composer();
     init_run();
+    init_codex();
+    init_fixPoll();
+    init_identity2();
     init_render2();
-    BANNER = [
-      "",
-      S2.bold + "  synkro" + S2.reset + S2.dim + "  governed session" + S2.reset,
-      S2.dim + "  every tool call passes Synkro policy before it runs" + S2.reset,
-      S2.dim + "  ctrl-c to leave" + S2.reset,
-      ""
-    ];
   }
 });
 
@@ -17098,7 +18322,7 @@ async function takeover(kind, cwd) {
   const harness = ["claude", "codex", "cursor"].includes(kind) ? kind : "claude";
   const info = await detectContainerBackend();
   const reachable = info.backend === "container" ? (await run(info.runner, ["test", "-d", cwd])).ok : false;
-  const backend = reachable ? "container" : "host";
+  const backend = harness === "codex" ? "host" : reachable ? "container" : "host";
   const spaceName = cwd.split("/").filter(Boolean).pop() || "space";
   const spawned = await spawnAgent(info, {
     name: spaceName + "-" + harness + "-" + String(process.pid % 1e4),
@@ -17126,7 +18350,7 @@ async function restoreSession(session) {
     harness: record.harness,
     spaceName: record.spaceName,
     cwd: record.space,
-    backend: record.backend,
+    backend: record.harness === "codex" ? "host" : record.backend,
     resume: true
   });
 }
@@ -17269,11 +18493,11 @@ __export(linear_exports, {
   linearCommand: () => linearCommand
 });
 import { readFileSync as readFileSync33 } from "fs";
-import { homedir as homedir38 } from "os";
-import { join as join37 } from "path";
+import { homedir as homedir40 } from "os";
+import { join as join38 } from "path";
 function mcpJwt() {
   try {
-    return readFileSync33(join37(SYNKRO_DIR14, ".mcp-jwt"), "utf-8").trim();
+    return readFileSync33(join38(SYNKRO_DIR14, ".mcp-jwt"), "utf-8").trim();
   } catch {
     return "";
   }
@@ -17312,7 +18536,7 @@ var SYNKRO_DIR14, PORT2, BASE;
 var init_linear = __esm({
   "cli/commands/linear.ts"() {
     "use strict";
-    SYNKRO_DIR14 = join37(homedir38(), ".synkro");
+    SYNKRO_DIR14 = join38(homedir40(), ".synkro");
     PORT2 = process.env.SYNKRO_MCP_PORT || "18931";
     BASE = `http://127.0.0.1:${PORT2}`;
   }
@@ -17461,10 +18685,10 @@ var init_cveReachability = __esm({
 });
 
 // cli/reachability/reachabilityScan.ts
-import { spawnSync as spawnSync12, execFileSync as execFileSync5 } from "child_process";
-import { readFileSync as readFileSync35, writeFileSync as writeFileSync27, existsSync as existsSync38, readdirSync as readdirSync10 } from "fs";
-import { join as join38 } from "path";
-import { homedir as homedir39 } from "os";
+import { spawnSync as spawnSync13, execFileSync as execFileSync7 } from "child_process";
+import { readFileSync as readFileSync35, writeFileSync as writeFileSync28, existsSync as existsSync39, readdirSync as readdirSync10 } from "fs";
+import { join as join39 } from "path";
+import { homedir as homedir41 } from "os";
 import { createRequire } from "module";
 function walkSourceFiles(repoRoot3, maxFiles = 4e3, maxBytes = 5e5) {
   const SKIP2 = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", "coverage", ".next", ".turbo", "out", ".cache", ".synkro", ".claude", "vendor", "__tests__", "test-results"]);
@@ -17481,7 +18705,7 @@ function walkSourceFiles(repoRoot3, maxFiles = 4e3, maxBytes = 5e5) {
     }
     for (const e of ents) {
       if (files.length >= maxFiles) break;
-      const full = join38(dir, e.name);
+      const full = join39(dir, e.name);
       if (e.isDirectory()) {
         if (!SKIP2.has(e.name) && !e.name.startsWith(".")) stack.push(full);
         continue;
@@ -17508,12 +18732,12 @@ function cleanVersion(spec) {
 function gatherManifestVersions(repoRoot3) {
   const out = {};
   const dirs = [repoRoot3];
-  const pkgsDir = join38(repoRoot3, "packages");
-  if (existsSync38(pkgsDir)) {
+  const pkgsDir = join39(repoRoot3, "packages");
+  if (existsSync39(pkgsDir)) {
     try {
       for (const d of readdirSync10(pkgsDir)) {
-        const pd = join38(pkgsDir, d);
-        if (existsSync38(join38(pd, "package.json"))) dirs.push(pd);
+        const pd = join39(pkgsDir, d);
+        if (existsSync39(join39(pd, "package.json"))) dirs.push(pd);
       }
     } catch {
     }
@@ -17522,7 +18746,7 @@ function gatherManifestVersions(repoRoot3) {
   for (const dir of dirs) {
     let pkg;
     try {
-      pkg = JSON.parse(readFileSync35(join38(dir, "package.json"), "utf8"));
+      pkg = JSON.parse(readFileSync35(join39(dir, "package.json"), "utf8"));
     } catch {
       continue;
     }
@@ -17545,25 +18769,25 @@ function findJelly(repoRoot3) {
     const pkg = JSON.parse(readFileSync35(pkgJson, "utf8"));
     const bin = typeof pkg.bin === "string" ? pkg.bin : pkg.bin && (pkg.bin.jelly || pkg.bin[Object.keys(pkg.bin)[0]]);
     if (bin) {
-      const p = join38(dir, bin);
-      if (existsSync38(p)) return p;
+      const p = join39(dir, bin);
+      if (existsSync39(p)) return p;
     }
   } catch {
   }
   for (const base of [repoRoot3, process.cwd()]) {
-    const b = join38(base, "node_modules", ".bin", "jelly");
-    if (existsSync38(b)) return b;
+    const b = join39(base, "node_modules", ".bin", "jelly");
+    if (existsSync39(b)) return b;
   }
   return null;
 }
 function findEntries(repoRoot3) {
   const dirs = [repoRoot3];
-  const pkgsDir = join38(repoRoot3, "packages");
-  if (existsSync38(pkgsDir)) {
+  const pkgsDir = join39(repoRoot3, "packages");
+  if (existsSync39(pkgsDir)) {
     try {
       for (const d of readdirSync10(pkgsDir)) {
-        const pd = join38(pkgsDir, d);
-        if (existsSync38(join38(pd, "package.json"))) dirs.push(pd);
+        const pd = join39(pkgsDir, d);
+        if (existsSync39(join39(pd, "package.json"))) dirs.push(pd);
       }
     } catch {
     }
@@ -17571,12 +18795,12 @@ function findEntries(repoRoot3) {
   const entries = [];
   for (const dir of dirs) {
     try {
-      const pkg = JSON.parse(readFileSync35(join38(dir, "package.json"), "utf8"));
+      const pkg = JSON.parse(readFileSync35(join39(dir, "package.json"), "utf8"));
       const cands = [pkg.source, pkg.module, pkg.main, "src/index.ts", "src/index.js", "src/main.ts", "src/server.ts", "index.ts", "index.js"];
       for (const c of cands) {
         if (typeof c !== "string") continue;
-        const f = join38(dir, c);
-        if (existsSync38(f)) {
+        const f = join39(dir, c);
+        if (existsSync39(f)) {
           entries.push(f);
           break;
         }
@@ -17588,7 +18812,7 @@ function findEntries(repoRoot3) {
 }
 function currentCommit(repoRoot3) {
   try {
-    return execFileSync5("git", ["rev-parse", "HEAD"], { cwd: repoRoot3, encoding: "utf8" }).trim();
+    return execFileSync7("git", ["rev-parse", "HEAD"], { cwd: repoRoot3, encoding: "utf8" }).trim();
   } catch {
     return "";
   }
@@ -17609,7 +18833,7 @@ function parseApiUsage(log) {
 }
 function runReachabilityScan(repoRoot3, opts = {}) {
   const commit = currentCommit(repoRoot3);
-  if (!opts.force && commit && existsSync38(REACHABILITY_PATH)) {
+  if (!opts.force && commit && existsSync39(REACHABILITY_PATH)) {
     try {
       const prev = JSON.parse(readFileSync35(REACHABILITY_PATH, "utf8"));
       if (prev.commit === commit) return { ok: true, cached: true, packages: Object.keys(prev.packages || {}).length };
@@ -17662,7 +18886,7 @@ function runReachabilityScan(repoRoot3, opts = {}) {
   if (jelly) {
     const entries = findEntries(repoRoot3);
     if (entries.length > 0) {
-      const r = spawnSync12(
+      const r = spawnSync13(
         process.execPath,
         [jelly, "-b", repoRoot3, "--api-usage", ...entries],
         { encoding: "utf8", timeout: opts.timeoutMs ?? 18e4, maxBuffer: 2e8 }
@@ -17700,7 +18924,7 @@ function runReachabilityScan(repoRoot3, opts = {}) {
   if (Object.keys(packages).length === 0) return { ok: false, reason: "no package usage found (no jelly output, no AST imports)" };
   const file = { generatedAt: (/* @__PURE__ */ new Date()).toISOString(), commit, tool, packages, versions: gatherManifestVersions(repoRoot3) };
   try {
-    writeFileSync27(REACHABILITY_PATH, JSON.stringify(file, null, 2));
+    writeFileSync28(REACHABILITY_PATH, JSON.stringify(file, null, 2));
   } catch (e) {
     return { ok: false, reason: "write failed: " + String(e.message || e) };
   }
@@ -17712,7 +18936,7 @@ var init_reachabilityScan = __esm({
     "use strict";
     init_cveReachability();
     require2 = createRequire(import.meta.url);
-    REACHABILITY_PATH = join38(homedir39(), ".synkro", "reachability.json");
+    REACHABILITY_PATH = join39(homedir41(), ".synkro", "reachability.json");
   }
 });
 
@@ -17721,13 +18945,13 @@ var reachabilityScan_exports = {};
 __export(reachabilityScan_exports, {
   reachabilityScanCommand: () => reachabilityScanCommand
 });
-import { readFileSync as readFileSync36, existsSync as existsSync39 } from "fs";
-import { join as join39 } from "path";
-import { homedir as homedir40 } from "os";
-import { execFileSync as execFileSync6 } from "child_process";
+import { readFileSync as readFileSync36, existsSync as existsSync40 } from "fs";
+import { join as join40 } from "path";
+import { homedir as homedir42 } from "os";
+import { execFileSync as execFileSync8 } from "child_process";
 function readConfigEnv4() {
-  const p = join39(SYNKRO_DIR15, "config.env");
-  if (!existsSync39(p)) return {};
+  const p = join40(SYNKRO_DIR15, "config.env");
+  if (!existsSync40(p)) return {};
   const out = {};
   for (const line of readFileSync36(p, "utf-8").split("\n")) {
     const t = line.trim();
@@ -17739,7 +18963,7 @@ function readConfigEnv4() {
 }
 function repoRoot2() {
   try {
-    return execFileSync6("git", ["rev-parse", "--show-toplevel"], { encoding: "utf-8" }).trim();
+    return execFileSync8("git", ["rev-parse", "--show-toplevel"], { encoding: "utf-8" }).trim();
   } catch {
     return process.cwd();
   }
@@ -17747,7 +18971,7 @@ function repoRoot2() {
 function repoSlug(root) {
   const run2 = (a) => {
     try {
-      return execFileSync6("git", a, { encoding: "utf-8" }).trim();
+      return execFileSync8("git", a, { encoding: "utf-8" }).trim();
     } catch {
       return "";
     }
@@ -17761,10 +18985,10 @@ async function pushToCloud(cfg, repo) {
   while (gwBase.endsWith("/")) gwBase = gwBase.slice(0, -1);
   let jwt2 = "";
   try {
-    jwt2 = readFileSync36(join39(SYNKRO_DIR15, ".mcp-jwt"), "utf-8").trim();
+    jwt2 = readFileSync36(join40(SYNKRO_DIR15, ".mcp-jwt"), "utf-8").trim();
   } catch {
   }
-  if (!jwt2 || !existsSync39(REACHABILITY_PATH)) return;
+  if (!jwt2 || !existsSync40(REACHABILITY_PATH)) return;
   const body = readFileSync36(REACHABILITY_PATH, "utf-8");
   try {
     const resp = await fetch(gwBase + "/api/v1/reachability?repo=" + encodeURIComponent(repo), {
@@ -17797,7 +19021,7 @@ var init_reachabilityScan2 = __esm({
   "cli/commands/reachabilityScan.ts"() {
     "use strict";
     init_reachabilityScan();
-    SYNKRO_DIR15 = join39(homedir40(), ".synkro");
+    SYNKRO_DIR15 = join40(homedir42(), ".synkro");
   }
 });
 
@@ -17927,11 +19151,11 @@ var config_exports = {};
 __export(config_exports, {
   configCommand: () => configCommand
 });
-import { readFileSync as readFileSync37, writeFileSync as writeFileSync28, existsSync as existsSync40 } from "fs";
-import { join as join40 } from "path";
-import { homedir as homedir41 } from "os";
+import { readFileSync as readFileSync37, writeFileSync as writeFileSync29, existsSync as existsSync41 } from "fs";
+import { join as join41 } from "path";
+import { homedir as homedir43 } from "os";
 function readConfigEnv5() {
-  if (!existsSync40(CONFIG_PATH9)) return {};
+  if (!existsSync41(CONFIG_PATH9)) return {};
   const out = {};
   for (const line of readFileSync37(CONFIG_PATH9, "utf-8").split("\n")) {
     const t = line.trim();
@@ -17942,7 +19166,7 @@ function readConfigEnv5() {
   return out;
 }
 function updateConfigValue(key, value) {
-  if (!existsSync40(CONFIG_PATH9)) {
+  if (!existsSync41(CONFIG_PATH9)) {
     console.error("No config found. Run `synkro install` first.");
     process.exit(1);
   }
@@ -17957,7 +19181,7 @@ function updateConfigValue(key, value) {
     return line;
   });
   if (!found) updated.splice(updated.length - 1, 0, `${key}='${value}'`);
-  writeFileSync28(CONFIG_PATH9, updated.join("\n"), "utf-8");
+  writeFileSync29(CONFIG_PATH9, updated.join("\n"), "utf-8");
 }
 function resolveInferenceMode(cfg) {
   if ((cfg.SYNKRO_GRADING_MODE || "local") === "byok") return "byok";
@@ -18115,8 +19339,8 @@ var init_config = __esm({
     "use strict";
     init_stub();
     init_optout();
-    SYNKRO_DIR16 = join40(homedir41(), ".synkro");
-    CONFIG_PATH9 = join40(SYNKRO_DIR16, "config.env");
+    SYNKRO_DIR16 = join41(homedir43(), ".synkro");
+    CONFIG_PATH9 = join41(SYNKRO_DIR16, "config.env");
   }
 });
 
@@ -18206,12 +19430,12 @@ async function runExport(args2) {
 }
 function confirmYesNo(question) {
   if (!process.stdin.isTTY) return Promise.resolve(false);
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const rl = createInterface6({ input: process.stdin, output: process.stdout });
     rl.question(`${question} (y/N): `, (answer) => {
       rl.close();
       const t = answer.trim().toLowerCase();
-      resolve7(t === "y" || t === "yes");
+      resolve8(t === "y" || t === "yes");
     });
   });
 }
@@ -18306,11 +19530,11 @@ Usage:
 
 // cli/inventory/identity.ts
 import { randomUUID as randomUUID5 } from "crypto";
-import { existsSync as existsSync41, mkdirSync as mkdirSync24, readFileSync as readFileSync38, renameSync as renameSync9, writeFileSync as writeFileSync29 } from "fs";
-import { homedir as homedir42 } from "os";
-import { dirname as dirname12, join as join41 } from "path";
+import { existsSync as existsSync42, mkdirSync as mkdirSync24, readFileSync as readFileSync38, renameSync as renameSync9, writeFileSync as writeFileSync30 } from "fs";
+import { homedir as homedir44 } from "os";
+import { dirname as dirname13, join as join42 } from "path";
 function operationalIdentityPath() {
-  return process.env.SYNKRO_OPERATIONAL_IDENTITY_PATH || join41(homedir42(), ".synkro", "installation.json");
+  return process.env.SYNKRO_OPERATIONAL_IDENTITY_PATH || join42(homedir44(), ".synkro", "installation.json");
 }
 function validIdentity(value) {
   if (!value || typeof value !== "object") return false;
@@ -18318,15 +19542,15 @@ function validIdentity(value) {
   return typeof row2.installation_id === "string" && UUID_RE.test(row2.installation_id) && typeof row2.created_at === "string" && Number.isFinite(Date.parse(row2.created_at));
 }
 function writeIdentity(path, identity) {
-  mkdirSync24(dirname12(path), { recursive: true, mode: 448 });
+  mkdirSync24(dirname13(path), { recursive: true, mode: 448 });
   const temp = `${path}.${process.pid}.${randomUUID5()}.tmp`;
-  writeFileSync29(temp, JSON.stringify(identity, null, 2) + "\n", { encoding: "utf8", mode: 384 });
+  writeFileSync30(temp, JSON.stringify(identity, null, 2) + "\n", { encoding: "utf8", mode: 384 });
   renameSync9(temp, path);
 }
 function getOperationalInstallationIdentity(path = operationalIdentityPath()) {
   const prior = cached4.get(path);
   if (prior) return prior;
-  if (existsSync41(path)) {
+  if (existsSync42(path)) {
     try {
       const parsed = JSON.parse(readFileSync38(path, "utf8"));
       if (validIdentity(parsed)) {
@@ -18342,7 +19566,7 @@ function getOperationalInstallationIdentity(path = operationalIdentityPath()) {
   return identity;
 }
 var UUID_RE, cached4;
-var init_identity2 = __esm({
+var init_identity3 = __esm({
   "cli/inventory/identity.ts"() {
     "use strict";
     UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -18353,13 +19577,13 @@ var init_identity2 = __esm({
 // cli/inventory/collector.ts
 import { createHash as createHash5 } from "crypto";
 import {
-  existsSync as existsSync42,
+  existsSync as existsSync43,
   readFileSync as readFileSync39,
   readdirSync as readdirSync11,
-  statSync as statSync5
+  statSync as statSync6
 } from "fs";
-import { arch, homedir as homedir43, hostname as hostname2, platform as platform6, release as release2 } from "os";
-import { basename as basename3, join as join42, relative, resolve as resolve5 } from "path";
+import { arch, homedir as homedir45, hostname as hostname2, platform as platform6, release as release2 } from "os";
+import { basename as basename4, join as join43, relative, resolve as resolve6 } from "path";
 import { fileURLToPath } from "url";
 function sha256(value) {
   return createHash5("sha256").update(value).digest("hex");
@@ -18369,14 +19593,14 @@ function pseudonymousHostnameHash(installationId, host) {
 }
 function cliVersion() {
   try {
-    return "1.10.5";
+    return "1.10.8";
   } catch {
     return "0.0.0";
   }
 }
 function readJson(path) {
   try {
-    if (!existsSync42(path)) return null;
+    if (!existsSync43(path)) return null;
     const parsed = JSON.parse(readFileSync39(path, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
@@ -18385,7 +19609,7 @@ function readJson(path) {
 }
 function readText(path) {
   try {
-    if (!existsSync42(path)) return "";
+    if (!existsSync43(path)) return "";
     return readFileSync39(path, "utf8");
   } catch {
     return "";
@@ -18406,7 +19630,7 @@ function canonical(raw) {
 }
 function safePackageName(command, args2) {
   if (typeof command !== "string" || !command.trim()) return void 0;
-  const runner = basename3(command.trim()).replace(/\.exe$/i, "");
+  const runner = basename4(command.trim()).replace(/\.exe$/i, "");
   if (Array.isArray(args2) && ["npx", "bunx", "uvx"].includes(runner)) {
     const pkg = args2.find((arg) => typeof arg === "string" && !arg.startsWith("-"));
     if (typeof pkg === "string") {
@@ -18414,7 +19638,7 @@ function safePackageName(command, args2) {
       if (/^(?:@[a-z0-9_.-]+\/)?[a-z0-9_.-]+(?:@[a-z0-9_.+~-]+)?$/i.test(candidate)) {
         return candidate;
       }
-      return basename3(candidate);
+      return basename4(candidate);
     }
   }
   return runner;
@@ -18472,16 +19696,16 @@ function mcpArtifactsFromJson(harness, config, configScope = "user") {
 }
 function claudeDesktopConfigCandidates(home, targetPlatform) {
   if (targetPlatform === "darwin") {
-    return [join42(home, "Library", "Application Support", "Claude", "claude_desktop_config.json")];
+    return [join43(home, "Library", "Application Support", "Claude", "claude_desktop_config.json")];
   }
   if (targetPlatform === "linux") {
     return [
-      join42(home, ".config", "Claude", "claude_desktop_config.json"),
-      join42(home, ".config", "claude", "claude_desktop_config.json")
+      join43(home, ".config", "Claude", "claude_desktop_config.json"),
+      join43(home, ".config", "claude", "claude_desktop_config.json")
     ];
   }
   if (targetPlatform === "win32" && process.env.APPDATA) {
-    return [join42(process.env.APPDATA, "Claude", "claude_desktop_config.json")];
+    return [join43(process.env.APPDATA, "Claude", "claude_desktop_config.json")];
   }
   return [];
 }
@@ -18489,7 +19713,7 @@ function claudeManagedMcpConfigCandidates(targetPlatform) {
   if (targetPlatform === "darwin") return ["/Library/Application Support/ClaudeCode/managed-mcp.json"];
   if (targetPlatform === "linux") return ["/etc/claude-code/managed-mcp.json"];
   if (targetPlatform === "win32" && process.env.ProgramFiles) {
-    return [join42(process.env.ProgramFiles, "ClaudeCode", "managed-mcp.json")];
+    return [join43(process.env.ProgramFiles, "ClaudeCode", "managed-mcp.json")];
   }
   return [];
 }
@@ -18497,8 +19721,8 @@ function discoveredProjectRoots(claudeState, currentDirectory, explicit = [], cu
   const roots = /* @__PURE__ */ new Set();
   const add = (value) => {
     if (typeof value !== "string" || !value.trim()) return;
-    const path = resolve5(value);
-    if (existsSync42(path)) roots.add(path);
+    const path = resolve6(value);
+    if (existsSync43(path)) roots.add(path);
   };
   add(currentDirectory);
   for (const path of explicit) add(path);
@@ -18509,17 +19733,17 @@ function discoveredProjectRoots(claudeState, currentDirectory, explicit = [], cu
   return [...roots];
 }
 function cursorWorkspaceStorageCandidates(home, targetPlatform) {
-  if (targetPlatform === "darwin") return [join42(home, "Library", "Application Support", "Cursor", "User", "workspaceStorage")];
-  if (targetPlatform === "linux") return [join42(home, ".config", "Cursor", "User", "workspaceStorage")];
+  if (targetPlatform === "darwin") return [join43(home, "Library", "Application Support", "Cursor", "User", "workspaceStorage")];
+  if (targetPlatform === "linux") return [join43(home, ".config", "Cursor", "User", "workspaceStorage")];
   if (targetPlatform === "win32" && process.env.APPDATA) {
-    return [join42(process.env.APPDATA, "Cursor", "User", "workspaceStorage")];
+    return [join43(process.env.APPDATA, "Cursor", "User", "workspaceStorage")];
   }
   return [];
 }
 function cursorWorkspaceRoots(home, targetPlatform) {
   const roots = /* @__PURE__ */ new Set();
   for (const storage of cursorWorkspaceStorageCandidates(home, targetPlatform)) {
-    if (!existsSync42(storage)) continue;
+    if (!existsSync43(storage)) continue;
     let entries = [];
     try {
       entries = readdirSync11(storage, { withFileTypes: true });
@@ -18528,12 +19752,12 @@ function cursorWorkspaceRoots(home, targetPlatform) {
     }
     for (const entry of entries) {
       if (!entry.isDirectory() || entry.isSymbolicLink?.()) continue;
-      const state = readJson(join42(storage, entry.name, "workspace.json"));
+      const state = readJson(join43(storage, entry.name, "workspace.json"));
       const raw = state?.folder;
       if (typeof raw !== "string" || !raw.trim()) continue;
       try {
         const path = raw.startsWith("file:") ? fileURLToPath(raw) : raw;
-        if (existsSync42(path)) roots.add(resolve5(path));
+        if (existsSync43(path)) roots.add(resolve6(path));
       } catch {
       }
     }
@@ -18609,10 +19833,10 @@ function hookArtifacts(harness, config) {
         harness,
         type: "hook",
         canonical_id: `${canonical(event)}:${commandHash.slice(0, 20)}`,
-        display_name: `${event} \xB7 ${basename3(String(entry.command).split(/\s+/)[0] || "hook")}`,
+        display_name: `${event} \xB7 ${basename4(String(entry.command).split(/\s+/)[0] || "hook")}`,
         enabled: entry.enabled !== false,
         config_scope: "user",
-        package_name: basename3(String(entry.command).split(/\s+/)[0] || "") || void 0,
+        package_name: basename4(String(entry.command).split(/\s+/)[0] || "") || void 0,
         config_hash: commandHash,
         metadata: { managed, events: [event] }
       });
@@ -18627,7 +19851,7 @@ function parseFrontmatter(content) {
   return { name: value("name"), version: value("version") };
 }
 function skillArtifacts(harness, root) {
-  if (!existsSync42(root)) return [];
+  if (!existsSync43(root)) return [];
   const manifests = [];
   const visit = (dir) => {
     let entries;
@@ -18638,7 +19862,7 @@ function skillArtifacts(harness, root) {
     }
     for (const entry of entries) {
       if (entry.isSymbolicLink?.()) continue;
-      const path = join42(dir, entry.name);
+      const path = join43(dir, entry.name);
       if (entry.isFile() && entry.name === "SKILL.md") manifests.push(path);
       else if (entry.isDirectory()) visit(path);
     }
@@ -18648,7 +19872,7 @@ function skillArtifacts(harness, root) {
     const content = readText(path);
     const frontmatter = parseFrontmatter(content);
     const rel = relative(root, path).replaceAll("\\", "/");
-    const name = frontmatter.name || basename3(join42(path, "..")) || "skill";
+    const name = frontmatter.name || basename4(join43(path, "..")) || "skill";
     return {
       harness,
       type: "skill",
@@ -18663,7 +19887,7 @@ function skillArtifacts(harness, root) {
   });
 }
 function cursorExtensionArtifacts(root) {
-  if (!existsSync42(root)) return [];
+  if (!existsSync43(root)) return [];
   let dirs = [];
   try {
     dirs = readdirSync11(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.isSymbolicLink());
@@ -18672,7 +19896,7 @@ function cursorExtensionArtifacts(root) {
   }
   const artifacts = [];
   for (const dir of dirs) {
-    const pkg = readJson(join42(root, dir.name, "package.json"));
+    const pkg = readJson(join43(root, dir.name, "package.json"));
     if (!pkg) continue;
     const publisher = typeof pkg.publisher === "string" ? pkg.publisher : void 0;
     const name = typeof pkg.name === "string" ? pkg.name : dir.name;
@@ -18692,20 +19916,20 @@ function cursorExtensionArtifacts(root) {
   return artifacts;
 }
 function deploymentMode2(home) {
-  const raw = readText(join42(home, ".synkro", "config.env"));
+  const raw = readText(join43(home, ".synkro", "config.env"));
   const value = (key) => raw.match(new RegExp(`^${key}=['"]?([^'"\\n]*)`, "m"))?.[1]?.toLowerCase();
   if (value("SYNKRO_GRADING_MODE") === "byok") return "byok";
   if (value("SYNKRO_STORAGE_MODE") === "cloud") return "cloud";
   return "local";
 }
 function telemetryHealth(home) {
-  const meta = readJson(join42(home, ".synkro", "telemetry-meta.json"));
+  const meta = readJson(join43(home, ".synkro", "telemetry-meta.json"));
   const health = {};
   if (meta?.last_flush_ok_at && Number.isFinite(Date.parse(meta.last_flush_ok_at))) health.telemetry_last_flush_at = meta.last_flush_ok_at;
   if (meta?.last_flush_error) health.telemetry_last_error = "flush_failed";
-  const queue = join42(home, ".synkro", "telemetry-pending.jsonl");
+  const queue = join43(home, ".synkro", "telemetry-pending.jsonl");
   try {
-    const size = statSync5(queue).size;
+    const size = statSync6(queue).size;
     health.telemetry_backlog = size <= 5 * 1024 * 1024 ? readFileSync39(queue, "utf8").split("\n").filter(Boolean).length : Math.ceil(size / 1024);
   } catch {
   }
@@ -18747,7 +19971,7 @@ function harnessSnapshot(agent) {
   }
   const config = readJson(agent.settingsPath);
   const coverage = inspectCodexHooks(agent.settingsPath);
-  const toml = readText(join42(agent.configDir, "config.toml"));
+  const toml = readText(join43(agent.configDir, "config.toml"));
   const permission = toml.match(/^\s*approval_policy\s*=\s*["']([^"']+)/m)?.[1];
   return {
     row: {
@@ -18764,11 +19988,11 @@ function harnessSnapshot(agent) {
   };
 }
 function collectOperationalInventory(options = {}) {
-  const home = options.homeDir ?? homedir43();
+  const home = options.homeDir ?? homedir45();
   const detected = options.detectedAgents ?? detectAgents();
   const identity = getOperationalInstallationIdentity(options.identityPath);
   const targetPlatform = options.platformName ?? platform6();
-  const codexHome = options.homeDir ? join42(home, ".codex") : process.env.CODEX_HOME || join42(home, ".codex");
+  const codexHome = options.homeDir ? join43(home, ".codex") : process.env.CODEX_HOME || join43(home, ".codex");
   const harnesses = [];
   const artifacts = [];
   for (const agent of detected) {
@@ -18776,7 +20000,7 @@ function collectOperationalInventory(options = {}) {
     harnesses.push(row2);
     artifacts.push(...hookArtifacts(row2.harness, config));
   }
-  const claudeJson = readJson(join42(home, ".claude.json"));
+  const claudeJson = readJson(join43(home, ".claude.json"));
   artifacts.push(...mcpArtifactsFromJson("claude_code", claudeJson));
   if (claudeJson?.projects && typeof claudeJson.projects === "object") {
     for (const [projectPath, project] of Object.entries(claudeJson.projects)) {
@@ -18784,8 +20008,8 @@ function collectOperationalInventory(options = {}) {
       artifacts.push(...mcpArtifactsFromJson("claude_code", project, `local:${sha256(projectPath).slice(0, 16)}`));
     }
   }
-  artifacts.push(...mcpArtifactsFromJson("cursor", readJson(join42(home, ".cursor", "mcp.json"))));
-  artifacts.push(...codexMcpArtifacts(readText(join42(codexHome, "config.toml"))));
+  artifacts.push(...mcpArtifactsFromJson("cursor", readJson(join43(home, ".cursor", "mcp.json"))));
+  artifacts.push(...codexMcpArtifacts(readText(join43(codexHome, "config.toml"))));
   const projectRoots = discoveredProjectRoots(
     claudeJson,
     options.currentDirectory ?? process.cwd(),
@@ -18796,11 +20020,11 @@ function collectOperationalInventory(options = {}) {
     const scopeHash = sha256(projectRoot).slice(0, 16);
     artifacts.push(...mcpArtifactsFromJson(
       "claude_code",
-      readJson(join42(projectRoot, ".mcp.json")),
+      readJson(join43(projectRoot, ".mcp.json")),
       `project:${scopeHash}`
     ));
-    const cursorProjectConfig = join42(projectRoot, ".cursor", "mcp.json");
-    if (resolve5(cursorProjectConfig) !== resolve5(join42(home, ".cursor", "mcp.json"))) {
+    const cursorProjectConfig = join43(projectRoot, ".cursor", "mcp.json");
+    if (resolve6(cursorProjectConfig) !== resolve6(join43(home, ".cursor", "mcp.json"))) {
       artifacts.push(...mcpArtifactsFromJson(
         "cursor",
         readJson(cursorProjectConfig),
@@ -18811,7 +20035,7 @@ function collectOperationalInventory(options = {}) {
   for (const managedPath of claudeManagedMcpConfigCandidates(targetPlatform)) {
     artifacts.push(...mcpArtifactsFromJson("claude_code", readJson(managedPath), "managed"));
   }
-  const desktopConfigPath = claudeDesktopConfigCandidates(home, targetPlatform).find((path) => existsSync42(path));
+  const desktopConfigPath = claudeDesktopConfigCandidates(home, targetPlatform).find((path) => existsSync43(path));
   if (desktopConfigPath) {
     const desktopConfig = readJson(desktopConfigPath);
     harnesses.push({
@@ -18822,7 +20046,7 @@ function collectOperationalInventory(options = {}) {
     });
     artifacts.push(...mcpArtifactsFromJson("claude_desktop", desktopConfig));
   }
-  const claudeSettings = readJson(join42(home, ".claude", "settings.json"));
+  const claudeSettings = readJson(join43(home, ".claude", "settings.json"));
   if (claudeSettings?.enabledPlugins && typeof claudeSettings.enabledPlugins === "object") {
     for (const [name, enabled] of Object.entries(claudeSettings.enabledPlugins)) {
       artifacts.push({
@@ -18836,10 +20060,10 @@ function collectOperationalInventory(options = {}) {
       });
     }
   }
-  artifacts.push(...skillArtifacts("claude_code", join42(home, ".claude", "skills")));
-  artifacts.push(...skillArtifacts("cursor", join42(home, ".cursor", "skills")));
-  artifacts.push(...skillArtifacts("codex", join42(codexHome, "skills")));
-  artifacts.push(...cursorExtensionArtifacts(join42(home, ".cursor", "extensions")));
+  artifacts.push(...skillArtifacts("claude_code", join43(home, ".claude", "skills")));
+  artifacts.push(...skillArtifacts("cursor", join43(home, ".cursor", "skills")));
+  artifacts.push(...skillArtifacts("codex", join43(codexHome, "skills")));
+  artifacts.push(...cursorExtensionArtifacts(join43(home, ".cursor", "extensions")));
   const uniqueArtifacts = /* @__PURE__ */ new Map();
   for (const artifact of artifacts) {
     const key = `${artifact.harness || "global"}:${artifact.type}:${artifact.canonical_id}`;
@@ -18876,7 +20100,7 @@ var init_collector = __esm({
     init_ccHookConfig();
     init_cursorHookConfig();
     init_codexHookConfig();
-    init_identity2();
+    init_identity3();
   }
 });
 
@@ -18892,18 +20116,18 @@ __export(sync_exports2, {
   syncOperationalInventoryDetached: () => syncOperationalInventoryDetached
 });
 import { createHash as createHash6, randomUUID as randomUUID6 } from "crypto";
-import { spawn as spawn10 } from "child_process";
+import { spawn as spawn11 } from "child_process";
 import {
-  existsSync as existsSync43,
+  existsSync as existsSync44,
   mkdirSync as mkdirSync25,
   readFileSync as readFileSync40,
   renameSync as renameSync10,
-  writeFileSync as writeFileSync30
+  writeFileSync as writeFileSync31
 } from "fs";
-import { homedir as homedir44 } from "os";
-import { dirname as dirname13, join as join43 } from "path";
+import { homedir as homedir46 } from "os";
+import { dirname as dirname14, join as join44 } from "path";
 function syncStatePath() {
-  return process.env.SYNKRO_INVENTORY_SYNC_STATE_PATH || join43(homedir44(), ".synkro", "inventory-sync.json");
+  return process.env.SYNKRO_INVENTORY_SYNC_STATE_PATH || join44(homedir46(), ".synkro", "inventory-sync.json");
 }
 function readState(path = syncStatePath()) {
   try {
@@ -18915,9 +20139,9 @@ function readState(path = syncStatePath()) {
 }
 function writeState(state, path = syncStatePath()) {
   try {
-    mkdirSync25(dirname13(path), { recursive: true, mode: 448 });
+    mkdirSync25(dirname14(path), { recursive: true, mode: 448 });
     const temp = `${path}.${process.pid}.tmp`;
-    writeFileSync30(temp, JSON.stringify(state, null, 2) + "\n", { encoding: "utf8", mode: 384 });
+    writeFileSync31(temp, JSON.stringify(state, null, 2) + "\n", { encoding: "utf8", mode: 384 });
     renameSync10(temp, path);
   } catch {
   }
@@ -18930,7 +20154,7 @@ function shouldSyncInventory(state, now = Date.now(), target) {
   return !Number.isFinite(lastAttempt) || lastAttempt <= 0 || now - lastAttempt >= FAILURE_RETRY_MS;
 }
 function readConfig() {
-  const path = join43(homedir44(), ".synkro", "config.env");
+  const path = join44(homedir46(), ".synkro", "config.env");
   const out = {};
   try {
     for (const rawLine of readFileSync40(path, "utf8").split("\n")) {
@@ -18972,7 +20196,7 @@ function resolveInventoryGateway(raw) {
 }
 async function loadToken() {
   try {
-    const durable = readFileSync40(join43(homedir44(), ".synkro", ".mcp-jwt"), "utf8").trim();
+    const durable = readFileSync40(join44(homedir46(), ".synkro", ".mcp-jwt"), "utf8").trim();
     if (durable) return durable;
   } catch {
   }
@@ -19090,8 +20314,8 @@ function syncOperationalInventoryDetached() {
   writeState({ ...state, last_attempt_at: (/* @__PURE__ */ new Date()).toISOString(), last_target: target }, path);
   try {
     const script = process.argv[1];
-    if (!script || !existsSync43(script)) return;
-    const child = spawn10(process.execPath, [script, "inventory-sync", "--detached"], {
+    if (!script || !existsSync44(script)) return;
+    const child = spawn11(process.execPath, [script, "inventory-sync", "--detached"], {
       detached: true,
       stdio: "ignore",
       env: { ...process.env, SYNKRO_INVENTORY_DETACHED: "1" }
@@ -19114,14 +20338,14 @@ var init_sync2 = __esm({
 });
 
 // cli/bootstrap.js
-import { readFileSync as readFileSync41, existsSync as existsSync44 } from "fs";
-import { resolve as resolve6 } from "path";
+import { readFileSync as readFileSync41, existsSync as existsSync45 } from "fs";
+import { resolve as resolve7 } from "path";
 process.title = "synkro";
 var envCandidates = [
-  resolve6(process.env.HOME ?? "", ".synkro", "config.env")
+  resolve7(process.env.HOME ?? "", ".synkro", "config.env")
 ];
 for (const envPath of envCandidates) {
-  if (!existsSync44(envPath)) continue;
+  if (!existsSync45(envPath)) continue;
   const envContent = readFileSync41(envPath, "utf-8");
   for (const line of envContent.split("\n")) {
     const trimmed = line.trim();
@@ -19139,7 +20363,7 @@ var subArgs = args.slice(1);
 var isDetachedChild = process.env.SYNKRO_TELEMETRY_DETACHED === "1";
 var FLUSH_SKIP = /* @__PURE__ */ new Set(["grade", "inventory-sync", "version", "--version", "-v", "help", "--help", "-h", ""]);
 function printVersion() {
-  console.log("1.10.5");
+  console.log("1.10.8");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents