@synkro-sh/cli 1.3.58 → 1.4.0

package/dist/bootstrap.js

@@ -324,6 +324,11 @@ var init_hookScripts = __esm({
 
 synkro_log() { echo "[synkro] $1" >&2; }
 
+# True if anything is listening on the local-cc channel TCP port.
+synkro_channel_up() {
+  (exec 3<>/dev/tcp/127.0.0.1/\${SYNKRO_CHANNEL_PORT:-8929}) 2>/dev/null && exec 3<&- 3>&-
+}
+
 # Load config
 CONFIG_FILE="$HOME/.synkro/config.env"
 if [ -f "$CONFIG_FILE" ]; then
@@ -609,10 +614,12 @@ if command -v claude >/dev/null 2>&1; then
   USE_LOCAL=true
 fi
 
-if [ "$USE_LOCAL" = "true" ]; then
-  # \u2500\u2500\u2500 LOCAL: grade via the persistent claude daemon (mode=bash). \u2500\u2500\u2500
-  # The daemon fetches the primer (Synkro IP) directly from the server at
-  # startup and holds it in memory \u2014 never written to disk.
+# Prefer local grading whenever it's available \u2014 the local-cc channel beats
+# the cloud fast tier on latency, and it's available regardless of the
+# server-assigned tier. Fall through to the cloud curl only when neither
+# the channel nor a usable \`claude\` CLI is reachable.
+if synkro_channel_up || { [ "$SYNKRO_INFERENCE_TIER" = "free" ] && command -v claude >/dev/null 2>&1; }; then
+  # \u2500\u2500\u2500 LOCAL PATH: channel-grader first, then \`claude --print\` cold fallback. \u2500\u2500\u2500
 
   RULES_CACHE="$HOME/.synkro/.rules-cache-bash"
   ORG_RULES="[]"
@@ -644,9 +651,16 @@ if [ "$USE_LOCAL" = "true" ]; then
   printf 'Recent actions: %s\\n' "$RECENT_ACTIONS" >> "$GRADER_PROMPT_FILE"
   printf 'Org rules: %s\\n\\n' "$ORG_RULES" >> "$GRADER_PROMPT_FILE"
 
-  if [ -x "$HOME/.synkro/bin/grader_daemon.py" ] && command -v python3 >/dev/null 2>&1; then
-    CC_RESP=$(python3 "$HOME/.synkro/bin/grader_daemon.py" --mode bash grade < "$GRADER_PROMPT_FILE" 2>/dev/null || echo "")
+  ROUTE_TAG=""
+  if synkro_channel_up && [ -n "\${SYNKRO_CLI_BIN:-}" ] && [ -f "$SYNKRO_CLI_BIN" ] && command -v node >/dev/null 2>&1; then
+    ROUTE_TAG="local-cc"
+    CC_RESP=$(node "$SYNKRO_CLI_BIN" grade bash < "$GRADER_PROMPT_FILE" 2>/dev/null || echo "")
+  elif synkro_channel_up && command -v synkro >/dev/null 2>&1; then
+    ROUTE_TAG="local-cc-path"
+    CC_RESP=$(synkro grade bash < "$GRADER_PROMPT_FILE" 2>/dev/null || echo "")
   else
+    # Channel unavailable \u2014 fall back to cold \`claude --print\` (free tier path).
+    ROUTE_TAG="cc-print"
     CC_RESP=$(claude --print --model claude-sonnet-4-6 --no-session-persistence < "$GRADER_PROMPT_FILE" 2>/dev/null || echo "")
   fi
   # Wrapper extraction \u2014 greedy so it tolerates nested XML tags inside.
@@ -696,7 +710,7 @@ fi
 
 if [ -z "$VERDICT" ]; then
   synkro_log "bashGuard $CMD_SHORT \u2192 error (timeout)"
-  jq -n --arg m "[synkro] bashGuard \u2192 error (timeout)" '{systemMessage: $m}'
+  jq -n --arg m "[synkro:\${ROUTE_TAG:-cloud}] bashGuard \u2192 error (timeout)" '{systemMessage: $m}'
   exit 0
 fi
 
@@ -716,6 +730,7 @@ SEVERITY="\${SEVERITY:-audit}"
 VERDICT_KIND="\${VERDICT_KIND:-warn}"
 REASONING="\${REASONING:-matched dangerous-verb regex}"
 CATEGORY="\${CATEGORY:-destructive_command}"
+SYNKRO_PREFIX="[synkro:\${ROUTE_TAG:-cloud}]"
 
 # Backwards-compat: if severity isn't block/audit, derive it from verdict_kind
 # and treat the original severity as the risk_level.
@@ -741,8 +756,8 @@ fi
 
 case "$SEVERITY" in
   block)
-    PERMISSION_REASON="[synkro] \${REASONING}\${ALT_SUFFIX}"
-    ADDITIONAL_CTX="Synkro safety judge (severity: \${SEVERITY}, category: \${CATEGORY}). Reasoning: \${REASONING}.\${ALT_SUFFIX}"
+    PERMISSION_REASON="\${SYNKRO_PREFIX} \${REASONING}\${ALT_SUFFIX}"
+    ADDITIONAL_CTX="Synkro safety judge (severity: \${SEVERITY}, category: \${CATEGORY}, route: \${ROUTE_TAG:-cloud}). Reasoning: \${REASONING}.\${ALT_SUFFIX}"
     if [ "$IS_HEADLESS" = "1" ]; then DECISION="deny"; else DECISION="ask"; fi
     jq -n \\
       --arg ctx "$ADDITIONAL_CTX" \\
@@ -761,11 +776,11 @@ case "$SEVERITY" in
     synkro_log "bashGuard $CMD_SHORT \u2192 pass ($CATEGORY): $REASONING"
     case "$CATEGORY" in
       trivial_utility)
-        jq -n --arg m "[synkro] bashGuard \u2192 pass" '{systemMessage: $m}' ;;
+        jq -n --arg m "\${SYNKRO_PREFIX} bashGuard \u2192 pass" '{systemMessage: $m}' ;;
       judge_unavailable|judge_error|parse_error)
-        jq -n --arg m "[synkro] bashGuard \u2192 pass (grader unavailable)" '{systemMessage: $m}' ;;
+        jq -n --arg m "\${SYNKRO_PREFIX} bashGuard \u2192 pass (grader unavailable)" '{systemMessage: $m}' ;;
       *)
-        jq -n --arg m "[synkro] bashGuard \u2192 pass ($CATEGORY): $REASONING" '{systemMessage: $m}' ;;
+        jq -n --arg m "\${SYNKRO_PREFIX} bashGuard \u2192 pass (\${CATEGORY}): \${REASONING}" '{systemMessage: $m}' ;;
     esac
     ;;
   *)
@@ -773,7 +788,7 @@ case "$SEVERITY" in
     if [ "$IS_HEADLESS" = "1" ]; then DECISION="deny"; else DECISION="ask"; fi
     jq -n \\
       --arg decision "$DECISION" \\
-      --arg reason "[synkro] unexpected severity '\${SEVERITY}' \u2014 blocking by default. Please email team@synkro.sh to report this issue." \\
+      --arg reason "\${SYNKRO_PREFIX} unexpected severity '\${SEVERITY}' \u2014 blocking by default. Please email team@synkro.sh to report this issue." \\
       '{
         hookSpecificOutput: {
           hookEventName: "PreToolUse",
@@ -865,6 +880,11 @@ exit 0
 
 synkro_log() { echo "[synkro] $1" >&2; }
 
+# True if anything is listening on the local-cc channel TCP port.
+synkro_channel_up() {
+  (exec 3<>/dev/tcp/127.0.0.1/\${SYNKRO_CHANNEL_PORT:-8929}) 2>/dev/null && exec 3<&- 3>&-
+}
+
 CONFIG_FILE="$HOME/.synkro/config.env"
 if [ -f "$CONFIG_FILE" ]; then
   set -a
@@ -1110,15 +1130,8 @@ fi
 SYNKRO_INFERENCE_TIER="\${SYNKRO_INFERENCE_TIER:-fast}"
 SYNKRO_CAPTURE_DEPTH="\${SYNKRO_CAPTURE_DEPTH:-full}"
 
-USE_LOCAL=false
-if command -v claude >/dev/null 2>&1; then
-  USE_LOCAL=true
-fi
-
-if [ "$USE_LOCAL" = "true" ]; then
-  # \u2500\u2500\u2500 LOCAL GRADING: grade via the persistent claude daemon (mode=edit).
-  # The daemon fetches the primer (Synkro IP) directly from the server at
-  # startup and holds it in memory \u2014 never written to disk.
+if synkro_channel_up || { [ "$SYNKRO_INFERENCE_TIER" = "free" ] && command -v claude >/dev/null 2>&1; }; then
+  # \u2500\u2500\u2500 LOCAL PATH: channel-grader first, then \`claude --print\` cold fallback. \u2500\u2500\u2500
   RULES_CACHE="$HOME/.synkro/.rules-cache-edit"
   ORG_RULES="[]"
   if [ "$SYNKRO_CAPTURE_DEPTH" = "local_only" ]; then
@@ -1149,8 +1162,12 @@ if [ "$USE_LOCAL" = "true" ]; then
   printf 'Diff:\\n' >> "$GRADER_PROMPT_FILE"
   printf '%s\\n' "$PROPOSED" >> "$GRADER_PROMPT_FILE"
 
-  if [ -x "$HOME/.synkro/bin/grader_daemon.py" ] && command -v python3 >/dev/null 2>&1; then
-    CC_RESP=$(python3 "$HOME/.synkro/bin/grader_daemon.py" --mode edit grade < "$GRADER_PROMPT_FILE" 2>/dev/null || echo "")
+  if synkro_channel_up && [ -n "\${SYNKRO_CLI_BIN:-}" ] && [ -f "$SYNKRO_CLI_BIN" ] && command -v node >/dev/null 2>&1; then
+    synkro_log "editGuard $FILE_SHORT \u2192 routing via local-cc"
+    CC_RESP=$(node "$SYNKRO_CLI_BIN" grade edit < "$GRADER_PROMPT_FILE" 2>/dev/null || echo "")
+  elif synkro_channel_up && command -v synkro >/dev/null 2>&1; then
+    synkro_log "editGuard $FILE_SHORT \u2192 routing via local-cc (PATH)"
+    CC_RESP=$(synkro grade edit < "$GRADER_PROMPT_FILE" 2>/dev/null || echo "")
   else
     CC_RESP=$(claude --print --model claude-sonnet-4-6 --no-session-persistence < "$GRADER_PROMPT_FILE" 2>/dev/null || echo "")
   fi
@@ -1371,6 +1388,11 @@ exit 0
 
 synkro_log() { echo "[synkro] $1" >&2; }
 
+# True if anything is listening on the local-cc channel TCP port.
+synkro_channel_up() {
+  (exec 3<>/dev/tcp/127.0.0.1/\${SYNKRO_CHANNEL_PORT:-8929}) 2>/dev/null && exec 3<&- 3>&-
+}
+
 CONFIG_FILE="$HOME/.synkro/config.env"
 if [ -f "$CONFIG_FILE" ]; then
   set -a
@@ -1566,13 +1588,8 @@ fi
 SYNKRO_INFERENCE_TIER="\${SYNKRO_INFERENCE_TIER:-fast}"
 SYNKRO_CAPTURE_DEPTH="\${SYNKRO_CAPTURE_DEPTH:-full}"
 
-USE_LOCAL=false
-if command -v claude >/dev/null 2>&1; then
-  USE_LOCAL=true
-fi
-
-if [ "$USE_LOCAL" = "true" ]; then
-  # \u2500\u2500\u2500 LOCAL GRADING: grade via the persistent claude daemon (mode=edit). \u2500\u2500\u2500
+if synkro_channel_up || { [ "$SYNKRO_INFERENCE_TIER" = "free" ] && command -v claude >/dev/null 2>&1; }; then
+  # \u2500\u2500\u2500 LOCAL PATH: channel-grader first, then \`claude --print\` cold fallback. \u2500\u2500\u2500
 
   RULES_CACHE="$HOME/.synkro/.rules-cache-edit-capture"
   RULES_RESP=""
@@ -1617,8 +1634,12 @@ if [ "$USE_LOCAL" = "true" ]; then
   printf 'Content:\\n' >> "$GRADER_PROMPT_FILE"
   printf '%s\\n' "$FILE_CONTENT" >> "$GRADER_PROMPT_FILE"
 
-  if [ -x "$HOME/.synkro/bin/grader_daemon.py" ] && command -v python3 >/dev/null 2>&1; then
-    CC_RESP=$(python3 "$HOME/.synkro/bin/grader_daemon.py" --mode edit grade < "$GRADER_PROMPT_FILE" 2>/dev/null || echo "")
+  if synkro_channel_up && [ -n "\${SYNKRO_CLI_BIN:-}" ] && [ -f "$SYNKRO_CLI_BIN" ] && command -v node >/dev/null 2>&1; then
+    synkro_log "editGuard $BASENAME \u2192 routing via local-cc"
+    CC_RESP=$(node "$SYNKRO_CLI_BIN" grade edit < "$GRADER_PROMPT_FILE" 2>/dev/null || echo "")
+  elif synkro_channel_up && command -v synkro >/dev/null 2>&1; then
+    synkro_log "editGuard $BASENAME \u2192 routing via local-cc (PATH)"
+    CC_RESP=$(synkro grade edit < "$GRADER_PROMPT_FILE" 2>/dev/null || echo "")
   else
     CC_RESP=$(claude --print --model claude-sonnet-4-6 --no-session-persistence < "$GRADER_PROMPT_FILE" 2>/dev/null || echo "")
   fi
@@ -1919,20 +1940,31 @@ fi
 GATEWAY_URL="\${SYNKRO_GATEWAY_URL:-https://api.synkro.sh}"
 CREDS_PATH="\${SYNKRO_CREDENTIALS_PATH:-$HOME/.synkro/credentials.json}"
 
+# Route preamble \u2014 tell the user (and CC) which inference path will be used.
+# We probe the local-cc TCP listener directly so the line reflects ground truth
+# rather than just the persisted toggle.
+SYNKRO_PORT="\${SYNKRO_CHANNEL_PORT:-8929}"
+if (exec 3<>/dev/tcp/127.0.0.1/"$SYNKRO_PORT") 2>/dev/null; then
+  exec 3<&- 3>&- 2>/dev/null || true
+  ROUTE_LINE="[synkro] inference: local-cc (channel reachable on 127.0.0.1:$SYNKRO_PORT)"
+else
+  ROUTE_LINE="[synkro] inference: cloud (local-cc channel not reachable)"
+fi
+
 if [ ! -f "$CREDS_PATH" ]; then
-  echo '{}'
+  jq -n --arg m "$ROUTE_LINE" '{ systemMessage: $m }'
   exit 0
 fi
 JWT=$(jq -r '.access_token // empty' "$CREDS_PATH" 2>/dev/null)
 if [ -z "$JWT" ]; then
-  echo '{}'
+  jq -n --arg m "$ROUTE_LINE" '{ systemMessage: $m }'
   exit 0
 fi
 
 PAYLOAD=$(cat)
 CWD=$(echo "$PAYLOAD" | jq -r '.cwd // empty' 2>/dev/null)
 if [ -z "$CWD" ]; then
-  echo '{}'
+  jq -n --arg m "$ROUTE_LINE" '{ systemMessage: $m }'
   exit 0
 fi
 
@@ -1951,7 +1983,7 @@ RESP=$(curl -sS -G "\${GATEWAY_URL}/api/v1/cli/session-context" \\
   --max-time 2 2>/dev/null || echo "")
 
 if [ -z "$RESP" ]; then
-  echo '{}'
+  jq -n --arg m "$ROUTE_LINE" '{ systemMessage: $m }'
   exit 0
 fi
 
@@ -1959,14 +1991,14 @@ PLAN_NUDGE="Before implementing any multi-step plan, call the synkro-guardrails
 
 OPEN=$(echo "$RESP" | jq -r '.open_count // 0' 2>/dev/null)
 if [ "$OPEN" = "0" ] || [ -z "$OPEN" ]; then
-  jq -n --arg sys_msg "[synkro] $PLAN_NUDGE" '{ systemMessage: $sys_msg }'
+  jq -n --arg sys_msg "$ROUTE_LINE"$'\\n'"[synkro] $PLAN_NUDGE" '{ systemMessage: $sys_msg }'
   exit 0
 fi
 
 if [ "$OPEN" = "1" ]; then
-  SYS_MSG="[synkro] session start \u2192 1 open finding in this repo from a prior session. $PLAN_NUDGE"
+  SYS_MSG="$ROUTE_LINE"$'\\n'"[synkro] session start \u2192 1 open finding in this repo from a prior session. $PLAN_NUDGE"
 else
-  SYS_MSG="[synkro] session start \u2192 \${OPEN} open findings in this repo from prior sessions. $PLAN_NUDGE"
+  SYS_MSG="$ROUTE_LINE"$'\\n'"[synkro] session start \u2192 \${OPEN} open findings in this repo from prior sessions. $PLAN_NUDGE"
 fi
 
 jq -n --arg sys_msg "$SYS_MSG" '{ systemMessage: $sys_msg }'
@@ -2156,574 +2188,6 @@ exit 0
   }
 });
 
-// cli/installer/graderDaemon.ts
-var GRADER_DAEMON_PY;
-var init_graderDaemon = __esm({
-  "cli/installer/graderDaemon.ts"() {
-    "use strict";
-    GRADER_DAEMON_PY = `#!/usr/bin/env python3
-"""
-Synkro warm-pool grader \u2014 pre-warmed \`claude --print --system-prompt\` process
-pool fronted by a Unix socket. Each grade uses one warm process and kills it;
-a replacement is pre-warmed in the background.
-
-Zero context bloat: 1 grade per process, system prompt via --system-prompt flag
-(single inference call, no primer-as-conversation-turn overhead).
-
-Warm steady-state: ~2-3s per grade. Cold fallback: ~5-6s if pre-warm not ready.
-
-Commands:
-  start    - bring up daemon if not running (fetches primer from server)
-  grade    - read prompt from stdin, write verdict text to stdout
-  stop     - terminate daemon
-  status   - print "running"/"stopped"
-"""
-
-import os, sys, json, socket, time, signal, fcntl, re, select, queue
-import subprocess, threading, urllib.request, urllib.error
-from pathlib import Path
-
-# \u2500\u2500 Primer fetch \u2014 server-side IP, never written to disk \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-SYNKRO_HOME = Path.home() / ".synkro"
-CREDS_PATH = Path(os.environ.get("SYNKRO_CREDENTIALS_PATH") or str(SYNKRO_HOME / "credentials.json"))
-GATEWAY_URL = os.environ.get("SYNKRO_GATEWAY_URL", "https://api.synkro.sh").rstrip("/")
-CONFIG_ENV = SYNKRO_HOME / "config.env"
-
-def _load_gateway_url():
-    """Read SYNKRO_GATEWAY_URL from config.env if not in env."""
-    global GATEWAY_URL
-    if "SYNKRO_GATEWAY_URL" in os.environ:
-        return
-    try:
-        for line in CONFIG_ENV.read_text().splitlines():
-            line = line.strip()
-            if line.startswith("SYNKRO_GATEWAY_URL="):
-                v = line.split("=", 1)[1].strip().strip("'").strip('"')
-                if v.startswith(("http://", "https://")):
-                    GATEWAY_URL = v.rstrip("/")
-                return
-    except Exception:
-        pass
-
-def _read_jwt():
-    try:
-        with open(CREDS_PATH) as f:
-            return json.load(f).get("access_token", "") or ""
-    except Exception:
-        return ""
-
-def _refresh_jwt():
-    """Refresh the access token using the saved refresh_token. Writes new
-    tokens back to credentials.json. Returns the new access_token or ''."""
-    try:
-        with open(CREDS_PATH) as f:
-            creds = json.load(f)
-        rt = creds.get("refresh_token", "")
-        if not rt:
-            return ""
-        req = urllib.request.Request(
-            f"{GATEWAY_URL}/api/auth/refresh",
-            data=json.dumps({"refresh_token": rt}).encode("utf-8"),
-            headers={
-                "Content-Type": "application/json",
-                "User-Agent": "synkro-cli-grader-daemon/1",
-            },
-        )
-        with urllib.request.urlopen(req, timeout=5) as resp:
-            data = json.loads(resp.read().decode("utf-8"))
-        new_at = data.get("access_token", "")
-        new_rt = data.get("refresh_token", "") or rt
-        if not new_at:
-            return ""
-        creds["access_token"] = new_at
-        creds["refresh_token"] = new_rt
-        tmp = str(CREDS_PATH) + ".synkro.tmp"
-        with open(tmp, "w") as f:
-            json.dump(creds, f)
-        os.replace(tmp, str(CREDS_PATH))
-        return new_at
-    except Exception:
-        return ""
-
-def fetch_primer(mode):
-    """Fetch primer text for {bash,edit} from /cli/judge-prompts. In-memory only.
-    Auto-refreshes JWT on 401 and retries once."""
-    _load_gateway_url()
-    field = "grader_primer_bash" if mode == "bash" else "grader_primer_edit"
-
-    def _do_fetch(jwt):
-        req = urllib.request.Request(
-            f"{GATEWAY_URL}/api/v1/cli/judge-prompts",
-            headers={
-                "Authorization": f"Bearer {jwt}",
-                "User-Agent": "synkro-cli-grader-daemon/1",
-            },
-        )
-        with urllib.request.urlopen(req, timeout=5) as resp:
-            data = json.loads(resp.read().decode("utf-8"))
-        return data.get(field, "") or ""
-
-    jwt = _read_jwt()
-    if not jwt:
-        return ""
-    try:
-        return _do_fetch(jwt)
-    except urllib.error.HTTPError as e:
-        if e.code != 401:
-            return ""
-        # Token expired \u2014 refresh and retry once.
-        new_jwt = _refresh_jwt()
-        if not new_jwt:
-            return ""
-        try:
-            return _do_fetch(new_jwt)
-        except Exception:
-            return ""
-    except Exception:
-        return ""
-
-ALLOWED_MODE_RE = re.compile(r"^[a-z][a-z0-9_-]{0,30}$")
-DAEMON_BASE = Path.home() / ".synkro" / "daemon"
-DAEMON_BASE.mkdir(parents=True, exist_ok=True, mode=0o700)
-
-def mode_paths(mode):
-    d = DAEMON_BASE / mode
-    d.mkdir(parents=True, exist_ok=True, mode=0o700)
-    return d / "daemon.pid", d / "daemon.sock", d / "daemon.log"
-
-MODE = "edit"
-PID_FILE, SOCK_PATH, LOG_FILE = mode_paths(MODE)
-
-GRADE_TIMEOUT_SEC = int(os.environ.get("SYNKRO_DAEMON_GRADE_TIMEOUT", "45"))
-DEFAULT_MODEL = os.environ.get("SYNKRO_DAEMON_MODEL", "claude-sonnet-4-6")
-MAX_PROMPT_BYTES = 4 * 1024 * 1024
-IDLE_SHUTDOWN_SEC = int(os.environ.get("SYNKRO_DAEMON_IDLE_TIMEOUT", "600"))
-
-
-def log(msg):
-    try:
-        with open(LOG_FILE, "a") as f:
-            f.write(f"[{time.strftime('%H:%M:%S')} pid={os.getpid()}] {msg}\\n")
-    except Exception:
-        pass
-
-
-STALL_TIMEOUT_SEC = int(os.environ.get("SYNKRO_DAEMON_STALL_TIMEOUT", "15"))
-
-def _read_response(proc, timeout=45, stop_event=None):
-    """Read stream-json from proc.stdout until a 'result' message arrives.
-    If stop_event is set externally, returns immediately with empty string \u2014
-    used by the parallel-race grade path to abort the loser."""
-    acc = []
-    deadline = time.time() + timeout
-    last_data = time.time()
-    fd = proc.stdout.fileno()
-    buf = ""
-    while True:
-        if stop_event is not None and stop_event.is_set():
-            return ""
-        remaining = deadline - time.time()
-        if remaining <= 0:
-            log("read timeout")
-            return ""
-        if time.time() - last_data > STALL_TIMEOUT_SEC:
-            log(f"stall timeout: no data for {STALL_TIMEOUT_SEC}s")
-            return ""
-        ready, _, _ = select.select([fd], [], [], min(remaining, 1.0))
-        if not ready:
-            if proc.poll() is not None:
-                log("process exited during read")
-                return ""
-            continue
-        chunk = os.read(fd, 65536)
-        if not chunk:
-            return ""
-        last_data = time.time()
-        buf += chunk.decode("utf-8", errors="replace")
-        while "\\n" in buf:
-            line, buf = buf.split("\\n", 1)
-            line = line.strip()
-            if not line:
-                continue
-            try:
-                obj = json.loads(line)
-            except json.JSONDecodeError:
-                continue
-            t = obj.get("type")
-            if t == "assistant":
-                for c in obj.get("message", {}).get("content", []):
-                    if c.get("type") == "text":
-                        acc.append(c["text"])
-            elif t == "result":
-                return "".join(acc)
-
-
-def _send_msg(proc, text, close_stdin=False):
-    """Send a stream-json user message. If close_stdin=True, close stdin after
-    flushing \u2014 this forces claude --print to stop waiting for more input and
-    process what it has. Required for the final/grade message; the prewarm
-    primer ack must keep stdin open so the warm process stays alive for the
-    upcoming grade call."""
-    msg = json.dumps({
-        "type": "user",
-        "message": {"role": "user", "content": [{"type": "text", "text": text}]},
-        "parent_tool_use_id": None,
-        "session_id": "",
-    })
-    proc.stdin.write(msg + "\\n")
-    proc.stdin.flush()
-    if close_stdin:
-        try: proc.stdin.close()
-        except Exception: pass
-
-
-class WarmGrader:
-    """
-    Keeps one pre-warmed claude process ready. Each grade pulls the warm
-    process, sends one prompt, reads the verdict, kills the process, and
-    starts pre-warming a replacement in the background.
-
-    The warm process has the system prompt loaded via --system-prompt and
-    its KV cache primed by a warmup turn. The actual grade is a single
-    inference call that benefits from the cached system prompt tokens.
-    """
-    def __init__(self, primer):
-        self.primer = primer or ""
-        self._warm_proc = None
-        self._warm_ready_at = 0.0
-        self._warm_thread = None
-        self._lock = threading.Lock()
-        self._total_grades = 0
-        self._prewarm_ok = True
-        self._start_prewarm()
-
-    def _make_proc(self):
-        cmd = [
-            "claude", "--print", "--model", DEFAULT_MODEL,
-            "--input-format=stream-json",
-            "--output-format=stream-json",
-            "--verbose",
-            "--no-session-persistence",
-        ]
-        if self.primer:
-            cmd += ["--system-prompt", self.primer]
-        return subprocess.Popen(
-            cmd,
-            stdin=subprocess.PIPE, stdout=subprocess.PIPE,
-            stderr=subprocess.DEVNULL, text=True, bufsize=1,
-        )
-
-    def _kill_proc(self, proc):
-        try: proc.stdin.close()
-        except Exception: pass
-        try: proc.kill(); proc.wait(timeout=2)
-        except Exception: pass
-
-    def _prewarm(self):
-        try:
-            log("pre-warming process")
-            proc = self._make_proc()
-            _send_msg(proc, "Ready")
-            resp = _read_response(proc, timeout=15)
-            if resp:
-                with self._lock:
-                    old = self._warm_proc
-                    self._warm_proc = proc
-                    self._warm_ready_at = time.time()
-                    self._prewarm_ok = True
-                if old:
-                    self._kill_proc(old)
-                log(f"pre-warm ready ({len(resp)} chars)")
-            else:
-                log("pre-warm response empty")
-                self._kill_proc(proc)
-                self._prewarm_ok = False
-        except Exception as e:
-            log(f"pre-warm failed: {e}")
-            self._prewarm_ok = False
-
-    def _start_prewarm(self):
-        self._warm_thread = threading.Thread(target=self._prewarm, daemon=True)
-        self._warm_thread.start()
-
-    def grade(self, prompt):
-        if self._warm_thread and self._prewarm_ok:
-            self._warm_thread.join(timeout=8)
-        elif self._warm_thread and not self._prewarm_ok:
-            log("skipping prewarm join (last prewarm failed)")
-
-        with self._lock:
-            proc = self._warm_proc
-            ready_at = self._warm_ready_at
-            self._warm_proc = None
-            self._warm_ready_at = 0.0
-
-        WARM_TTL_SEC = int(os.environ.get("SYNKRO_DAEMON_WARM_TTL", "15"))
-        # Decide if the warm process is usable for the race.
-        warm_usable = bool(proc) and proc.poll() is None and not proc.stdin.closed
-        if warm_usable and ready_at and (time.time() - ready_at) > WARM_TTL_SEC:
-            self._kill_proc(proc)
-            warm_usable = False
-        if not warm_usable and proc:
-            self._kill_proc(proc)
-            proc = None
-
-        wall_limit = int(os.environ.get("SYNKRO_DAEMON_WALL_TIMEOUT", "20"))
-        race_timeout = min(GRADE_TIMEOUT_SEC, wall_limit)
-
-        # Race a warm and a fresh cold process. Whichever returns a non-empty
-        # response first wins; the other is killed. If we have no warm, just
-        # run cold solo (no benefit to racing two cold spawns of the same age).
-        cold_proc = self._make_proc() if warm_usable else proc or self._make_proc()
-        warm_proc = proc if warm_usable else None
-
-        result_q = queue.Queue()
-        stop_event = threading.Event()
-
-        def grade_worker(p, label):
-            try:
-                _send_msg(p, prompt, close_stdin=True)
-                r = _read_response(p, timeout=race_timeout, stop_event=stop_event)
-                if r:
-                    result_q.put((label, r))
-            except Exception as e:
-                log(f"grade {label} error: {e}")
-
-        threads = []
-        if warm_proc is not None:
-            t = threading.Thread(target=grade_worker, args=(warm_proc, "warm"), daemon=True)
-            t.start()
-            threads.append(t)
-        t = threading.Thread(target=grade_worker, args=(cold_proc, "cold"), daemon=True)
-        t.start()
-        threads.append(t)
-
-        t0 = time.time()
-        winner_label = None
-        resp = ""
-        try:
-            deadline = time.time() + race_timeout + 2
-            while time.time() < deadline:
-                try:
-                    label, r = result_q.get(timeout=0.5)
-                    if r:
-                        resp = r
-                        winner_label = label
-                        break
-                except queue.Empty:
-                    if all(not th.is_alive() for th in threads):
-                        break
-        finally:
-            stop_event.set()
-            if warm_proc is not None:
-                self._kill_proc(warm_proc)
-            self._kill_proc(cold_proc)
-
-        elapsed = (time.time() - t0) * 1000
-        self._total_grades += 1
-        winner = winner_label or "none"
-        log(f"grade #{self._total_grades} race={'warm+cold' if warm_proc else 'cold'} won={winner} elapsed={elapsed:.0f}ms resp={len(resp)}ch")
-
-        self._start_prewarm()
-        return resp
-
-    def shutdown(self):
-        with self._lock:
-            if self._warm_proc:
-                self._kill_proc(self._warm_proc)
-                self._warm_proc = None
-
-
-def serve(primer):
-    pid_fd = os.open(str(PID_FILE), os.O_RDWR | os.O_CREAT, 0o644)
-    try:
-        fcntl.flock(pid_fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
-    except BlockingIOError:
-        log("another daemon already holds the pid file; exiting")
-        sys.exit(0)
-    os.ftruncate(pid_fd, 0)
-    os.write(pid_fd, f"{os.getpid()}\\n".encode())
-    os.fsync(pid_fd)
-
-    grader = WarmGrader(primer)
-
-    if SOCK_PATH.exists():
-        SOCK_PATH.unlink()
-    sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-    sock.bind(str(SOCK_PATH))
-    sock.listen(8)
-    os.chmod(SOCK_PATH, 0o600)
-
-    def cleanup(*_):
-        try: SOCK_PATH.unlink()
-        except Exception: pass
-        try: PID_FILE.unlink()
-        except Exception: pass
-        grader.shutdown()
-        sys.exit(0)
-    signal.signal(signal.SIGTERM, cleanup)
-    signal.signal(signal.SIGINT, cleanup)
-
-    log(f"daemon ready model={DEFAULT_MODEL} idle_shutdown={IDLE_SHUTDOWN_SEC}s sock={SOCK_PATH}")
-
-    last_activity = time.time()
-    sock.settimeout(30)
-    while True:
-        try:
-            conn, _ = sock.accept()
-            last_activity = time.time()
-            threading.Thread(target=_handle_conn, args=(conn, grader), daemon=True).start()
-        except socket.timeout:
-            if time.time() - last_activity > IDLE_SHUTDOWN_SEC:
-                log(f"idle for {IDLE_SHUTDOWN_SEC}s, shutting down")
-                cleanup()
-        except Exception as e:
-            log(f"accept error: {e}")
-            time.sleep(0.1)
-
-
-def _handle_conn(conn, grader):
-    try:
-        with conn:
-            length_bytes = b""
-            while len(length_bytes) < 8:
-                chunk = conn.recv(8 - len(length_bytes))
-                if not chunk: return
-                length_bytes += chunk
-            length = int.from_bytes(length_bytes, "big")
-            if length <= 0 or length > MAX_PROMPT_BYTES:
-                log(f"reject oversized prompt length={length}")
-                return
-            prompt = b""
-            while len(prompt) < length:
-                chunk = conn.recv(min(65536, length - len(prompt)))
-                if not chunk: break
-                prompt += chunk
-            response = grader.grade(prompt.decode("utf-8", errors="replace"))
-            resp_bytes = response.encode("utf-8")
-            conn.sendall(len(resp_bytes).to_bytes(8, "big"))
-            conn.sendall(resp_bytes)
-    except Exception as e:
-        log(f"conn error: {e}")
-
-
-def daemon_running():
-    if not SOCK_PATH.exists():
-        return False
-    try:
-        s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-        s.settimeout(0.5)
-        s.connect(str(SOCK_PATH))
-        s.close()
-        return True
-    except Exception:
-        return False
-
-
-def ensure_daemon_running(primer_path=None):
-    if daemon_running():
-        return True
-    # Fetch primer from server (in-memory only \u2014 never written to disk).
-    # Backwards compat: if a primer_path arg was passed (legacy hook scripts),
-    # read from there as a fallback when API fetch fails.
-    primer = fetch_primer(MODE)
-    if not primer and primer_path:
-        try:
-            primer = Path(primer_path).read_text()
-        except Exception:
-            primer = ""
-    pid = os.fork()
-    if pid == 0:
-        os.setsid()
-        pid2 = os.fork()
-        if pid2 == 0:
-            null = os.open(os.devnull, os.O_RDWR)
-            os.dup2(null, 0); os.dup2(null, 1); os.dup2(null, 2)
-            serve(primer)
-        else:
-            os._exit(0)
-    else:
-        os.waitpid(pid, 0)
-    for _ in range(150):
-        time.sleep(0.1)
-        if daemon_running():
-            return True
-    return False
-
-
-def client_grade(prompt):
-    s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-    s.settimeout(GRADE_TIMEOUT_SEC + 5)
-    s.connect(str(SOCK_PATH))
-    pb = prompt.encode("utf-8")
-    s.sendall(len(pb).to_bytes(8, "big"))
-    s.sendall(pb)
-    length_bytes = b""
-    while len(length_bytes) < 8:
-        chunk = s.recv(8 - len(length_bytes))
-        if not chunk: return ""
-        length_bytes += chunk
-    length = int.from_bytes(length_bytes, "big")
-    resp = b""
-    while len(resp) < length:
-        chunk = s.recv(min(65536, length - len(resp)))
-        if not chunk: break
-        resp += chunk
-    s.close()
-    return resp.decode("utf-8", errors="replace")
-
-
-def main():
-    global MODE, PID_FILE, SOCK_PATH, LOG_FILE
-    args = list(sys.argv[1:])
-    if len(args) >= 2 and args[0] == "--mode":
-        candidate = args[1]
-        if not ALLOWED_MODE_RE.match(candidate):
-            print(f"invalid mode: {candidate}", file=sys.stderr); sys.exit(1)
-        MODE = candidate
-        PID_FILE, SOCK_PATH, LOG_FILE = mode_paths(MODE)
-        args = args[2:]
-
-    if len(args) < 1:
-        print("usage: grader_daemon.py [--mode <name>] {start|grade|stop|status}", file=sys.stderr)
-        sys.exit(1)
-    cmd = args[0]
-    primer_path = args[1] if len(args) > 1 else None
-
-    if cmd == "start":
-        if ensure_daemon_running(primer_path):
-            print("daemon up")
-        else:
-            print("daemon failed to start", file=sys.stderr); sys.exit(1)
-    elif cmd == "grade":
-        ensure_daemon_running(primer_path)
-        prompt = sys.stdin.read()
-        try:
-            print(client_grade(prompt), end="")
-        except Exception as e:
-            print(f"daemon-error: {e}", file=sys.stderr); sys.exit(2)
-    elif cmd == "stop":
-        if PID_FILE.exists():
-            try:
-                pid = int(PID_FILE.read_text().strip())
-                os.kill(pid, signal.SIGTERM)
-                print(f"sent SIGTERM to {pid}")
-            except Exception: pass
-        for p in (SOCK_PATH, PID_FILE):
-            try: p.unlink()
-            except Exception: pass
-    elif cmd == "status":
-        print("running" if daemon_running() else "stopped")
-    else:
-        print(f"unknown command: {cmd}", file=sys.stderr); sys.exit(1)
-
-
-if __name__ == "__main__":
-    main()
-`;
-  }
-});
-
 // cli/auth/stub.ts
 import { createServer } from "http";
 import { writeFileSync as writeFileSync3, readFileSync as readFileSync3, existsSync as existsSync4, mkdirSync as mkdirSync3, unlinkSync as unlinkSync2 } from "fs";
@@ -3186,50 +2650,15 @@ jobs:
 
 // cli/installer/githubSetup.ts
 import { existsSync as existsSync5, mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "fs";
+import { execSync as execSync2 } from "child_process";
 import { join as join4 } from "path";
-async function encryptSecret(publicKeyBase64, secret) {
-  const sodium = await import("libsodium-wrappers").then((m) => m.default ?? m);
-  await sodium.ready;
-  const keyBytes = sodium.from_base64(publicKeyBase64, sodium.base64_variants.ORIGINAL);
-  const messageBytes = sodium.from_string(secret);
-  const encryptedBytes = sodium.crypto_box_seal(messageBytes, keyBytes);
-  return sodium.to_base64(encryptedBytes, sodium.base64_variants.ORIGINAL);
-}
-async function getRepoPublicKey(opts, owner, repo) {
-  const url = `https://api.github.com/repos/${owner}/${repo}/actions/secrets/public-key`;
-  const resp = await fetch(url, {
-    headers: {
-      Authorization: `Bearer ${opts.token}`,
-      Accept: "application/vnd.github+json",
-      "X-GitHub-Api-Version": "2022-11-28"
-    }
+function ghSecretSet(token, owner, repo, name, value) {
+  execSync2(`gh secret set ${name} --repo ${owner}/${repo} --body -`, {
+    input: value,
+    env: { ...process.env, GH_TOKEN: token },
+    stdio: ["pipe", "ignore", "pipe"],
+    timeout: 3e4
   });
-  if (!resp.ok) {
-    const text = await resp.text().catch(() => "");
-    throw new Error(`GitHub API ${resp.status} fetching public key for ${owner}/${repo}: ${text.slice(0, 200)}`);
-  }
-  return await resp.json();
-}
-async function putRepoSecret(opts, owner, repo, secretName, secretValue, publicKey) {
-  const encryptedValue = await encryptSecret(publicKey.key, secretValue);
-  const url = `https://api.github.com/repos/${owner}/${repo}/actions/secrets/${encodeURIComponent(secretName)}`;
-  const resp = await fetch(url, {
-    method: "PUT",
-    headers: {
-      Authorization: `Bearer ${opts.token}`,
-      Accept: "application/vnd.github+json",
-      "X-GitHub-Api-Version": "2022-11-28",
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify({
-      encrypted_value: encryptedValue,
-      key_id: publicKey.key_id
-    })
-  });
-  if (!resp.ok) {
-    const text = await resp.text().catch(() => "");
-    throw new Error(`GitHub API ${resp.status} setting secret ${secretName}: ${text.slice(0, 200)}`);
-  }
 }
 async function listAccessibleRepos(opts) {
   const repos = [];
@@ -3257,11 +2686,15 @@ async function listAccessibleRepos(opts) {
   return repos;
 }
 async function pushSecretsToRepo(opts, owner, repo, secrets) {
-  const pubkey = await getRepoPublicKey(opts, owner, repo);
+  try {
+    execSync2("gh --version", { stdio: "ignore", timeout: 5e3 });
+  } catch {
+    throw new Error("GitHub CLI (gh) not found. Install it: https://cli.github.com");
+  }
   if (secrets.claudeCodeOauthToken) {
-    await putRepoSecret(opts, owner, repo, "CLAUDE_CODE_OAUTH_TOKEN", secrets.claudeCodeOauthToken, pubkey);
+    ghSecretSet(opts.token, owner, repo, "CLAUDE_CODE_OAUTH_TOKEN", secrets.claudeCodeOauthToken);
   }
-  await putRepoSecret(opts, owner, repo, "SYNKRO_API_KEY", secrets.synkroApiKey, pubkey);
+  ghSecretSet(opts.token, owner, repo, "SYNKRO_API_KEY", secrets.synkroApiKey);
 }
 function writeWorkflowFile(repoRootPath) {
   const workflowDir = join4(repoRootPath, ".github", "workflows");
@@ -3294,12 +2727,12 @@ var init_githubSetup = __esm({
 });
 
 // cli/commands/repoConnect.ts
-import { execSync as execSync2 } from "child_process";
+import { execSync as execSync3 } from "child_process";
 import { createServer as createServer2 } from "http";
 import { createInterface } from "readline";
 function detectGitRepo() {
   try {
-    const remoteUrl = execSync2("git remote get-url origin", { encoding: "utf-8", timeout: 5e3 }).trim();
+    const remoteUrl = execSync3("git remote get-url origin", { encoding: "utf-8", timeout: 5e3 }).trim();
     const sshMatch = remoteUrl.match(/^git@[^:]+:(.+?)(?:\.git)?$/);
     const httpMatch = remoteUrl.match(/^https?:\/\/[^/]+\/(.+?)(?:\.git)?$/);
     const match = sshMatch || httpMatch;
@@ -3515,7 +2948,7 @@ __export(setupGithub_exports, {
 });
 import { createInterface as createInterface2 } from "readline/promises";
 import { stdin as input, stdout as output } from "process";
-import { execSync as execSync3, spawn as nodeSpawn } from "child_process";
+import { execSync as execSync4, spawn as nodeSpawn } from "child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync4, unlinkSync as unlinkSync3 } from "fs";
 import { homedir as homedir4, platform as platform2 } from "os";
 import { join as join5 } from "path";
@@ -3725,7 +3158,7 @@ async function setupGithubCommand(opts = {}) {
       }
     } catch {
       try {
-        ghToken = execSync3("gh auth token", { encoding: "utf-8", timeout: 5e3 }).trim();
+        ghToken = execSync4("gh auth token", { encoding: "utf-8", timeout: 5e3 }).trim();
       } catch {
         console.error("GitHub not connected. Run `synkro-cli setup-github` interactively to connect.");
         return;
@@ -3759,7 +3192,7 @@ async function setupGithubCommand(opts = {}) {
     }
     console.log("  Validating token...");
     try {
-      const validateResult = execSync3(
+      const validateResult = execSync4(
         'claude --print --output-format json "say ok"',
         { env: { ...process.env, CLAUDE_CODE_OAUTH_TOKEN: claudeToken }, encoding: "utf-8", timeout: 3e4, stdio: ["ignore", "pipe", "pipe"] }
       );
@@ -3776,7 +3209,7 @@ async function setupGithubCommand(opts = {}) {
   if (opts.nonInteractive) {
     let currentFullName = null;
     try {
-      const remoteUrl = execSync3("git remote get-url origin", { encoding: "utf-8", timeout: 5e3 }).trim();
+      const remoteUrl = execSync4("git remote get-url origin", { encoding: "utf-8", timeout: 5e3 }).trim();
       const m = remoteUrl.match(/(?:github\.com)[:/](.+?)(?:\.git)?$/);
       if (m) currentFullName = m[1];
     } catch {
@@ -3870,16 +3303,700 @@ var init_setupGithub = __esm({
   }
 });
 
+// cli/installer/promptFetcher.ts
+import { existsSync as existsSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync5, mkdirSync as mkdirSync5 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join6 } from "path";
+function readCache() {
+  if (!existsSync7(CACHE_PATH)) return null;
+  try {
+    return JSON.parse(readFileSync5(CACHE_PATH, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function writeCache(entry) {
+  mkdirSync5(join6(homedir5(), ".synkro", "prompts"), { recursive: true });
+  writeFileSync5(CACHE_PATH, JSON.stringify(entry, null, 2), "utf-8");
+}
+function isCacheFresh(cache) {
+  const ageMs = Date.now() - cache.fetched_at;
+  const ttlMs = cache.ttl_hours * 60 * 60 * 1e3;
+  return ageMs < ttlMs;
+}
+async function fetchJudgePrompts(opts) {
+  if (!opts.forceRefresh) {
+    const cache = readCache();
+    if (cache && isCacheFresh(cache)) {
+      return mapResponse(cache);
+    }
+  }
+  const url = `${opts.gatewayUrl.replace(/\/$/, "")}/api/v1/cli/judge-prompts`;
+  const resp = await fetch(url, {
+    method: "GET",
+    headers: {
+      "Authorization": `Bearer ${opts.jwt}`,
+      "User-Agent": "synkro-cli/1.0"
+    }
+  });
+  if (!resp.ok) {
+    throw new Error(`Failed to fetch judge prompts: HTTP ${resp.status} ${resp.statusText}`);
+  }
+  const data = await resp.json();
+  if (!data.edit_write_prompt) {
+    throw new Error("Gateway returned empty edit_write_prompt");
+  }
+  writeCache({ ...data, fetched_at: Date.now() });
+  return mapResponse(data);
+}
+function mapResponse(data) {
+  return {
+    editWritePrompt: data.edit_write_prompt,
+    editAutofixAgentPrompt: data.edit_autofix_agent_prompt,
+    editPrecheckAgentPrompt: data.edit_precheck_agent_prompt,
+    graderPrimerBash: data.grader_primer_bash,
+    graderPrimerEdit: data.grader_primer_edit,
+    classificationPrompt: data.classification_prompt,
+    intentClassifyPrompt: data.intent_classify_prompt,
+    remediateIntentClassifyPrompt: data.remediate_intent_classify_prompt,
+    version: data.version
+  };
+}
+var CACHE_PATH;
+var init_promptFetcher = __esm({
+  "cli/installer/promptFetcher.ts"() {
+    "use strict";
+    CACHE_PATH = join6(homedir5(), ".synkro", "prompts", "judge-prompts.json");
+  }
+});
+
+// cli/storage/local.ts
+import Database from "better-sqlite3";
+import { existsSync as existsSync8, mkdirSync as mkdirSync6 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join7 } from "path";
+function getSetting(key) {
+  const row = db.prepare("SELECT value FROM settings WHERE key = ?").get(key);
+  return row?.value ?? null;
+}
+function setSetting(key, value) {
+  db.prepare(
+    `INSERT INTO settings (key, value, updated_at) VALUES (?, ?, datetime('now'))
+     ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`
+  ).run(key, value);
+}
+var SYNKRO_DIR2, DB_PATH, db;
+var init_local = __esm({
+  "cli/storage/local.ts"() {
+    "use strict";
+    SYNKRO_DIR2 = join7(homedir6(), ".synkro");
+    DB_PATH = join7(SYNKRO_DIR2, "sessions.db");
+    if (!existsSync8(SYNKRO_DIR2)) {
+      mkdirSync6(SYNKRO_DIR2, { recursive: true });
+    }
+    try {
+      db = new Database(DB_PATH);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(`Failed to initialize database at ${DB_PATH}: ${msg}`);
+      console.error("Check that ~/.synkro/ is writable and disk is not full.");
+      process.exit(1);
+    }
+    db.exec(`
+  CREATE TABLE IF NOT EXISTS command_history (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    command TEXT NOT NULL,
+    created_at TEXT DEFAULT (datetime('now'))
+  );
+`);
+    db.exec(`
+  CREATE TABLE IF NOT EXISTS project_keys (
+    slug TEXT PRIMARY KEY,
+    project_id TEXT NOT NULL,
+    project_name TEXT NOT NULL,
+    api_key TEXT NOT NULL,
+    created_at TEXT DEFAULT (datetime('now'))
+  );
+`);
+    db.exec(`
+  CREATE TABLE IF NOT EXISTS settings (
+    key TEXT PRIMARY KEY,
+    value TEXT NOT NULL,
+    updated_at TEXT DEFAULT (datetime('now'))
+  );
+`);
+    process.on("exit", () => {
+      db.close();
+    });
+  }
+});
+
+// cli/local-cc/settings.ts
+function getInferenceProvider() {
+  const raw = getSetting(KEY);
+  return raw === "local-cc" ? "local-cc" : "inngest";
+}
+function setInferenceProvider(value) {
+  setSetting(KEY, value);
+}
+function isLocalCCEnabled() {
+  return getInferenceProvider() === "local-cc";
+}
+var KEY;
+var init_settings = __esm({
+  "cli/local-cc/settings.ts"() {
+    "use strict";
+    init_local();
+    KEY = "inference_provider";
+  }
+});
+
+// cli/local-cc/channelSource.ts
+var CHANNEL_PLUGIN_SOURCE;
+var init_channelSource = __esm({
+  "cli/local-cc/channelSource.ts"() {
+    "use strict";
+    CHANNEL_PLUGIN_SOURCE = `#!/usr/bin/env bun
+/**
+ * Synkro local-CC channel plugin (auto-generated by \`synkro install\`).
+ * DO NOT EDIT \u2014 your changes will be overwritten on next install.
+ */
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+
+const PORT = parseInt(process.env.SYNKRO_CHANNEL_PORT || '8929', 10);
+const HOSTNAME = '127.0.0.1';
+
+const REQUEST_TIMEOUT_MS = parseInt(process.env.SYNKRO_CHANNEL_TIMEOUT_MS || '120000', 10);
+
+interface PendingRequest {
+  resolve: (result: string) => void;
+  reject: (err: Error) => void;
+  timer: ReturnType<typeof setTimeout>;
+}
+
+const pending = new Map<string, PendingRequest>();
+let nextRequestId = 1;
+
+const mcp = new Server(
+  { name: 'synkro-local', version: '0.1.0' },
+  {
+    capabilities: {
+      experimental: { 'claude/channel': {} },
+      tools: {},
+    },
+    instructions: [
+      'Synkro local inference channel.',
+      'Each <channel source="synkro-local" req_id="..." role="..."> event contains a',
+      'self-contained instruction block followed by the payload to evaluate. Treat it',
+      'as a fresh isolated request \u2014 IGNORE any prior conversation turns or context.',
+      'Do not call Read, Edit, Write, Bash, or any other tool. Do exactly one thing:',
+      'parse the request, produce the structured response described inside it, then',
+      'call the \\\`reply\\\` tool exactly once with the same req_id and the response',
+      'wrapped as the \\\`result\\\` argument (a string). Output no other text.',
+    ].join(' '),
+  },
+);
+
+mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
+  tools: [{
+    name: 'reply',
+    description: 'Return the response for a Synkro local-inference request',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        req_id: { type: 'string', description: 'The req_id from the channel event being answered' },
+        result: { type: 'string', description: 'The response text. For grading/classification roles, the JSON-tagged verdict the role requested.' },
+      },
+      required: ['req_id', 'result'],
+    },
+  }],
+}));
+
+mcp.setRequestHandler(CallToolRequestSchema, async req => {
+  if (req.params.name !== 'reply') {
+    throw new Error('unknown tool: ' + req.params.name);
+  }
+  const args = req.params.arguments as { req_id?: string; result?: string };
+  const reqId = String(args.req_id ?? '');
+  const result = String(args.result ?? '');
+  const p = pending.get(reqId);
+  if (p) {
+    clearTimeout(p.timer);
+    pending.delete(reqId);
+    p.resolve(result);
+    return { content: [{ type: 'text', text: 'ok' }] };
+  }
+  return { content: [{ type: 'text', text: 'unknown req_id (likely already timed out)' }] };
+});
+
+// Bind the listener BEFORE awaiting mcp.connect \u2014 Bun.serve is synchronous
+// and must run on the script's first tick, otherwise the stdio transport's
+// read loop can starve the serve setup.
+Bun.serve({
+  port: PORT,
+  hostname: HOSTNAME,
+  idleTimeout: 0,
+  async fetch(req) {
+    const url = new URL(req.url);
+    if (url.pathname === '/healthz') {
+      return new Response(JSON.stringify({ ok: true, pending: pending.size }), {
+        headers: { 'Content-Type': 'application/json' },
+      });
+    }
+    if (req.method !== 'POST' || url.pathname !== '/submit') {
+      return new Response('not found', { status: 404 });
+    }
+    let body: { role?: string; content?: string };
+    try {
+      body = await req.json() as typeof body;
+    } catch {
+      return new Response('invalid json', { status: 400 });
+    }
+    const role = String(body.role ?? '');
+    const content = String(body.content ?? '');
+    if (!role || !content) {
+      return new Response('missing role/content', { status: 400 });
+    }
+    const reqId = 'r' + (nextRequestId++) + Date.now().toString(36);
+    const result = await new Promise<string>((resolve, reject) => {
+      const timer = setTimeout(() => {
+        pending.delete(reqId);
+        reject(new Error('timeout waiting for reply (' + REQUEST_TIMEOUT_MS + 'ms)'));
+      }, REQUEST_TIMEOUT_MS);
+      pending.set(reqId, { resolve, reject, timer });
+      mcp.notification({
+        method: 'notifications/claude/channel',
+        params: {
+          content,
+          meta: { req_id: reqId, role },
+        },
+      }).catch(err => {
+        clearTimeout(timer);
+        pending.delete(reqId);
+        reject(err instanceof Error ? err : new Error(String(err)));
+      });
+    }).catch(err => {
+      return JSON.stringify({ error: err instanceof Error ? err.message : String(err) });
+    });
+    if (typeof result === 'string' && result.startsWith('{"error":')) {
+      return new Response(result, { status: 504, headers: { 'Content-Type': 'application/json' } });
+    }
+    return new Response(JSON.stringify({ result }), {
+      headers: { 'Content-Type': 'application/json' },
+    });
+  },
+});
+
+process.on('SIGTERM', () => process.exit(0));
+process.on('SIGINT', () => process.exit(0));
+
+// MCP stdio handshake last. The transport's read loop keeps the process
+// alive; the TCP listener is already bound at this point so the CLI can
+// hit it as soon as Claude finishes its end of the handshake.
+await mcp.connect(new StdioServerTransport());
+`;
+  }
+});
+
+// cli/local-cc/install.ts
+import { existsSync as existsSync9, mkdirSync as mkdirSync7, writeFileSync as writeFileSync6, readFileSync as readFileSync6, chmodSync, copyFileSync, renameSync as renameSync3, unlinkSync as unlinkSync4, openSync, fsyncSync, closeSync } from "fs";
+import { join as join8 } from "path";
+import { homedir as homedir7 } from "os";
+import { spawnSync } from "child_process";
+function writePluginFiles() {
+  mkdirSync7(SESSION_DIR, { recursive: true });
+  mkdirSync7(PLUGIN_SETTINGS_DIR, { recursive: true });
+  writeFileSync6(PLUGIN_PATH, CHANNEL_PLUGIN_SOURCE, "utf-8");
+  chmodSync(PLUGIN_PATH, 493);
+  writeFileSync6(PLUGIN_PKG_PATH, PLUGIN_PACKAGE_JSON, "utf-8");
+  writeFileSync6(
+    PLUGIN_SETTINGS_PATH,
+    JSON.stringify({
+      fastMode: true,
+      // Pre-approve the project-local synkro-local MCP server so claude doesn't
+      // block on a consent prompt at startup. Lives in the PROJECT settings so
+      // it's still picked up under --setting-sources project,local (which
+      // skips user settings to avoid synkro-hook recursion in the grader).
+      enabledMcpjsonServers: ["synkro-local"]
+    }, null, 2) + "\n",
+    "utf-8"
+  );
+  writeFileSync6(RUN_SCRIPT_PATH, RUN_SCRIPT_SOURCE, "utf-8");
+  chmodSync(RUN_SCRIPT_PATH, 493);
+}
+function runBunInstall() {
+  const r = spawnSync("bun", ["install", "--silent"], {
+    cwd: SESSION_DIR,
+    encoding: "utf-8",
+    timeout: 12e4
+  });
+  if (r.status !== 0) {
+    throw new LocalCCInstallError(
+      `bun install failed in ${SESSION_DIR}: ${r.stderr || r.stdout || "unknown"}`
+    );
+  }
+}
+function safelyMutateClaudeJson(mutator) {
+  if (!existsSync9(CLAUDE_JSON_PATH)) {
+    return;
+  }
+  const originalText = readFileSync6(CLAUDE_JSON_PATH, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(originalText);
+  } catch (err) {
+    throw new LocalCCInstallError(
+      `refusing to modify malformed ${CLAUDE_JSON_PATH}: ${err.message}. Please fix the JSON manually before retrying.`,
+      err
+    );
+  }
+  const originalKeys = new Set(Object.keys(parsed));
+  const dirty = mutator(parsed);
+  if (!dirty) return;
+  for (const k of originalKeys) {
+    if (!(k in parsed)) {
+      throw new LocalCCInstallError(
+        `refusing to write ${CLAUDE_JSON_PATH}: mutator dropped top-level key "${k}". This is a bug \u2014 please report.`
+      );
+    }
+  }
+  const newText = JSON.stringify(parsed, null, 2) + "\n";
+  try {
+    JSON.parse(newText);
+  } catch (err) {
+    throw new LocalCCInstallError(
+      `refusing to write ${CLAUDE_JSON_PATH}: serialized result is not valid JSON. This is a bug \u2014 please report.`,
+      err
+    );
+  }
+  copyFileSync(CLAUDE_JSON_PATH, CLAUDE_JSON_BACKUP_PATH);
+  const tmpPath = `${CLAUDE_JSON_PATH}.synkro-tmp.${process.pid}`;
+  try {
+    writeFileSync6(tmpPath, newText, "utf-8");
+    const fd = openSync(tmpPath, "r");
+    try {
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+    renameSync3(tmpPath, CLAUDE_JSON_PATH);
+  } catch (err) {
+    try {
+      unlinkSync4(tmpPath);
+    } catch {
+    }
+    try {
+      copyFileSync(CLAUDE_JSON_BACKUP_PATH, CLAUDE_JSON_PATH);
+    } catch {
+    }
+    throw new LocalCCInstallError(
+      `failed to write ${CLAUDE_JSON_PATH}: ${err.message}. Backup at ${CLAUDE_JSON_BACKUP_PATH} preserves the prior state.`,
+      err
+    );
+  }
+}
+function writeProjectMcpJson() {
+  const mcp = {
+    mcpServers: {
+      [MCP_SERVER_NAME]: {
+        command: "bun",
+        args: [PLUGIN_PATH]
+      }
+    }
+  };
+  writeFileSync6(PROJECT_MCP_PATH, JSON.stringify(mcp, null, 2) + "\n", "utf-8");
+}
+function patchClaudeJson() {
+  safelyMutateClaudeJson((parsed) => {
+    let dirty = false;
+    if (parsed.mcpServers && typeof parsed.mcpServers === "object" && parsed.mcpServers[MCP_SERVER_NAME]) {
+      delete parsed.mcpServers[MCP_SERVER_NAME];
+      dirty = true;
+    }
+    if (!parsed.projects || typeof parsed.projects !== "object") {
+      parsed.projects = {};
+    }
+    const projects = parsed.projects;
+    const existing = projects[SESSION_DIR] && typeof projects[SESSION_DIR] === "object" ? projects[SESSION_DIR] : {};
+    const wantEnabled = Array.from(/* @__PURE__ */ new Set([
+      ...existing.enabledMcpjsonServers ?? [],
+      MCP_SERVER_NAME
+    ]));
+    const next = {
+      ...existing,
+      hasTrustDialogAccepted: true,
+      hasCompletedProjectOnboarding: true,
+      enabledMcpjsonServers: wantEnabled
+    };
+    if (existing.hasTrustDialogAccepted !== true || existing.hasCompletedProjectOnboarding !== true || JSON.stringify(existing.enabledMcpjsonServers ?? []) !== JSON.stringify(wantEnabled)) {
+      projects[SESSION_DIR] = next;
+      dirty = true;
+    }
+    return dirty;
+  });
+}
+function installLocalCC() {
+  const bunCheck = spawnSync("bun", ["--version"], { encoding: "utf-8" });
+  if (bunCheck.status !== 0) {
+    throw new LocalCCInstallError("bun is required for the local-CC channel plugin. Install Bun (https://bun.sh) and retry.");
+  }
+  writePluginFiles();
+  runBunInstall();
+  writeProjectMcpJson();
+  patchClaudeJson();
+  return { sessionDir: SESSION_DIR, pluginPath: PLUGIN_PATH };
+}
+function uninstallLocalCC() {
+  safelyMutateClaudeJson((parsed) => {
+    let dirty = false;
+    if (parsed.mcpServers && parsed.mcpServers[MCP_SERVER_NAME]) {
+      delete parsed.mcpServers[MCP_SERVER_NAME];
+      dirty = true;
+    }
+    if (parsed.projects && typeof parsed.projects === "object" && parsed.projects[SESSION_DIR]) {
+      delete parsed.projects[SESSION_DIR];
+      dirty = true;
+    }
+    return dirty;
+  });
+}
+var CLAUDE_JSON_BACKUP_PATH, SESSION_DIR, PLUGIN_PATH, PLUGIN_PKG_PATH, PLUGIN_SETTINGS_DIR, PLUGIN_SETTINGS_PATH, PROJECT_MCP_PATH, CLAUDE_JSON_PATH, RUN_SCRIPT_PATH, TMUX_SESSION_NAME, RUN_SCRIPT_SOURCE, MCP_SERVER_NAME, PLUGIN_PACKAGE_JSON, LocalCCInstallError;
+var init_install = __esm({
+  "cli/local-cc/install.ts"() {
+    "use strict";
+    init_channelSource();
+    CLAUDE_JSON_BACKUP_PATH = join8(homedir7(), ".claude.json.synkro-bak");
+    SESSION_DIR = join8(homedir7(), ".synkro", "cc_sessions");
+    PLUGIN_PATH = join8(SESSION_DIR, "synkro-channel.ts");
+    PLUGIN_PKG_PATH = join8(SESSION_DIR, "package.json");
+    PLUGIN_SETTINGS_DIR = join8(SESSION_DIR, ".claude");
+    PLUGIN_SETTINGS_PATH = join8(PLUGIN_SETTINGS_DIR, "settings.json");
+    PROJECT_MCP_PATH = join8(SESSION_DIR, ".mcp.json");
+    CLAUDE_JSON_PATH = join8(homedir7(), ".claude.json");
+    RUN_SCRIPT_PATH = join8(SESSION_DIR, "run-claude.sh");
+    TMUX_SESSION_NAME = "synkro-local-cc";
+    RUN_SCRIPT_SOURCE = `#!/usr/bin/env bash
+# Auto-generated by \`synkro install\`. Do not edit.
+set -uo pipefail
+
+SESSION=${TMUX_SESSION_NAME}
+
+# Kill any previous session so restarts come up clean.
+tmux kill-session -t "$SESSION" 2>/dev/null || true
+
+# Start claude inside a detached tmux session so it has a real pty.
+#
+# --setting-sources project,local: skip ~/.claude/settings.json so the
+#   synkro PreToolUse/PostToolUse hooks installed there don't load. Without
+#   this, the grader's own tool calls would re-trigger synkro grading,
+#   causing recursion / deadlock with the same channel session.
+tmux new-session -d -s "$SESSION" \\
+  "claude --dangerously-load-development-channels server:synkro-local --dangerously-skip-permissions --setting-sources project,local"
+
+# Block on the tmux session so pueue's task lifetime tracks claude's.
+while tmux has-session -t "$SESSION" 2>/dev/null; do
+  sleep 5
+done
+`;
+    MCP_SERVER_NAME = "synkro-local";
+    PLUGIN_PACKAGE_JSON = JSON.stringify(
+      {
+        name: "synkro-local-channel",
+        private: true,
+        version: "0.1.0",
+        type: "module",
+        dependencies: {
+          "@modelcontextprotocol/sdk": "^1.0.0"
+        }
+      },
+      null,
+      2
+    ) + "\n";
+    LocalCCInstallError = class extends Error {
+      constructor(message, cause) {
+        super(message);
+        this.cause = cause;
+        this.name = "LocalCCInstallError";
+      }
+      cause;
+    };
+  }
+});
+
+// cli/local-cc/pueue.ts
+import { execFileSync, spawnSync as spawnSync2 } from "child_process";
+import { homedir as homedir8 } from "os";
+import { join as join9 } from "path";
+import { connect } from "net";
+function pueueAvailable() {
+  const r = spawnSync2("pueue", ["--version"], { encoding: "utf-8" });
+  if (r.status !== 0) {
+    throw new PueueError("pueue CLI not found on PATH. Install pueue (https://github.com/Nukesor/pueue) and start `pueued`.");
+  }
+}
+function statusJson() {
+  pueueAvailable();
+  const r = spawnSync2("pueue", ["status", "--json"], { encoding: "utf-8" });
+  if (r.status !== 0) {
+    throw new PueueError(`pueue status failed: ${r.stderr || r.stdout || "unknown error"} \u2014 is pueued running?`);
+  }
+  try {
+    return JSON.parse(r.stdout);
+  } catch (err) {
+    throw new PueueError(`pueue status returned non-JSON output: ${r.stdout.slice(0, 200)}`, err);
+  }
+}
+function statusName(s) {
+  if (typeof s === "string") return s;
+  if (s && typeof s === "object") {
+    if ("Running" in s) return "Running";
+    if ("Done" in s) {
+      const result = s.Done?.result;
+      if (typeof result === "string") return `Done (${result})`;
+      if (result && typeof result === "object") return `Done (${Object.keys(result)[0] ?? "unknown"})`;
+      return "Done";
+    }
+    return Object.keys(s)[0] ?? "unknown";
+  }
+  return "unknown";
+}
+function findTask() {
+  const data = statusJson();
+  for (const [id, t] of Object.entries(data.tasks)) {
+    if (t.label === TASK_LABEL) {
+      return {
+        id: Number(id),
+        label: t.label,
+        status: statusName(t.status),
+        command: t.command,
+        cwd: t.path
+      };
+    }
+  }
+  return null;
+}
+function startTask(opts = {}) {
+  const cwd = opts.cwd ?? SESSION_DIR2;
+  const existing = findTask();
+  if (existing) {
+    spawnSync2("pueue", ["remove", String(existing.id)], { encoding: "utf-8" });
+  }
+  const runScript = join9(cwd, "run-claude.sh");
+  const args2 = [
+    "add",
+    "--label",
+    TASK_LABEL,
+    "--working-directory",
+    cwd,
+    "--",
+    "bash",
+    runScript
+  ];
+  const r = spawnSync2("pueue", args2, { encoding: "utf-8" });
+  if (r.status !== 0) {
+    throw new PueueError(`pueue add failed: ${r.stderr || r.stdout}`);
+  }
+  const created = findTask();
+  if (!created) {
+    throw new PueueError(`pueue add succeeded but no task with label ${TASK_LABEL} found`);
+  }
+  return created;
+}
+function stopTask() {
+  spawnSync2("tmux", ["kill-session", "-t", TMUX_SESSION], { encoding: "utf-8" });
+  const t = findTask();
+  if (!t) return;
+  spawnSync2("pueue", ["kill", String(t.id)], { encoding: "utf-8" });
+  spawnSync2("pueue", ["remove", String(t.id)], { encoding: "utf-8" });
+}
+function tailLogs(lines = 80) {
+  const t = findTask();
+  if (!t) return "(no synkro local-cc task)";
+  const r = spawnSync2("pueue", ["log", "--lines", String(lines), String(t.id)], { encoding: "utf-8" });
+  return r.stdout || r.stderr || "(no output)";
+}
+function ensureRunning(opts = {}) {
+  const t = findTask();
+  if (t && t.status === "Running") return t;
+  return startTask(opts);
+}
+function probePort(host, port, timeoutMs = 500) {
+  return new Promise((resolve2) => {
+    const sock = connect(port, host);
+    const done = (ok) => {
+      try {
+        sock.destroy();
+      } catch {
+      }
+      resolve2(ok);
+    };
+    sock.once("connect", () => done(true));
+    sock.once("error", () => done(false));
+    sock.setTimeout(timeoutMs, () => done(false));
+  });
+}
+function tmuxKickEnter() {
+  spawnSync2("tmux", ["send-keys", "-t", TMUX_SESSION, "Enter"], { encoding: "utf-8" });
+}
+async function waitForChannelReady(port, timeoutMs = 6e4, host = "127.0.0.1") {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (await probePort(host, port)) return true;
+    tmuxKickEnter();
+    await new Promise((r) => setTimeout(r, 1e3));
+  }
+  return probePort(host, port);
+}
+function assertPueueInstalled() {
+  pueueAvailable();
+  try {
+    statusJson();
+  } catch (err) {
+    throw new PueueError(`pueue daemon not reachable: ${err.message}`);
+  }
+}
+function assertClaudeInstalled() {
+  const r = spawnSync2("claude", ["--version"], { encoding: "utf-8" });
+  if (r.status !== 0) {
+    throw new PueueError("claude CLI not found on PATH. Install Claude Code first: https://docs.claude.com/claude-code");
+  }
+}
+function assertTmuxInstalled() {
+  const r = spawnSync2("tmux", ["-V"], { encoding: "utf-8" });
+  if (r.status !== 0) {
+    throw new PueueError("tmux not found on PATH. Install tmux (brew install tmux) and retry.");
+  }
+}
+var TASK_LABEL, TMUX_SESSION, SESSION_DIR2, PueueError;
+var init_pueue = __esm({
+  "cli/local-cc/pueue.ts"() {
+    "use strict";
+    TASK_LABEL = "synkro-local-cc";
+    TMUX_SESSION = "synkro-local-cc";
+    SESSION_DIR2 = join9(homedir8(), ".synkro", "cc_sessions");
+    PueueError = class extends Error {
+      constructor(message, cause) {
+        super(message);
+        this.cause = cause;
+        this.name = "PueueError";
+      }
+      cause;
+    };
+  }
+});
+
 // cli/commands/install.ts
 var install_exports = {};
 __export(install_exports, {
   installCommand: () => installCommand,
   parseArgs: () => parseArgs
 });
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, writeFileSync as writeFileSync5, chmodSync, readFileSync as readFileSync5, readdirSync } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join6 } from "path";
-import { execSync as execSync4 } from "child_process";
+import { existsSync as existsSync10, mkdirSync as mkdirSync8, writeFileSync as writeFileSync7, chmodSync as chmodSync2, readFileSync as readFileSync7, readdirSync } from "fs";
+import { homedir as homedir9 } from "os";
+import { join as join10 } from "path";
+import { execSync as execSync5 } from "child_process";
 import { createInterface as createInterface3 } from "readline";
 function sanitizeGatewayCandidate(raw) {
   if (!raw) return void 0;
@@ -3915,43 +4032,33 @@ async function promptTranscriptConsent() {
   });
 }
 function ensureSynkroDir() {
-  mkdirSync5(SYNKRO_DIR2, { recursive: true });
-  mkdirSync5(HOOKS_DIR, { recursive: true });
-  mkdirSync5(BIN_DIR, { recursive: true });
-  mkdirSync5(OFFSETS_DIR, { recursive: true });
-}
-function writeGraderDaemon() {
-  writeFileSync5(GRADER_DAEMON_PATH, GRADER_DAEMON_PY, "utf-8");
-  chmodSync(GRADER_DAEMON_PATH, 493);
-  for (const p of [GRADER_PRIMER_EDIT_PATH, GRADER_PRIMER_BASH_PATH]) {
-    try {
-      __require("fs").unlinkSync(p);
-    } catch {
-    }
-  }
+  mkdirSync8(SYNKRO_DIR3, { recursive: true });
+  mkdirSync8(HOOKS_DIR, { recursive: true });
+  mkdirSync8(BIN_DIR, { recursive: true });
+  mkdirSync8(OFFSETS_DIR, { recursive: true });
 }
 function writeHookScripts() {
-  const bashScriptPath = join6(HOOKS_DIR, "cc-bash-judge.sh");
-  const bashFollowupScriptPath = join6(HOOKS_DIR, "cc-bash-followup.sh");
-  const editCaptureScriptPath = join6(HOOKS_DIR, "cc-edit-capture.sh");
-  const editPrecheckScriptPath = join6(HOOKS_DIR, "cc-edit-precheck.sh");
-  const stopSummaryScriptPath = join6(HOOKS_DIR, "cc-stop-summary.sh");
-  const sessionStartScriptPath = join6(HOOKS_DIR, "cc-session-start.sh");
-  const transcriptSyncScriptPath = join6(HOOKS_DIR, "cc-transcript-sync.sh");
-  writeFileSync5(bashScriptPath, CC_BASH_JUDGE_SCRIPT, "utf-8");
-  writeFileSync5(bashFollowupScriptPath, CC_BASH_FOLLOWUP_SCRIPT, "utf-8");
-  writeFileSync5(editCaptureScriptPath, CC_EDIT_CAPTURE_SCRIPT, "utf-8");
-  writeFileSync5(editPrecheckScriptPath, CC_EDIT_PRECHECK_SCRIPT, "utf-8");
-  writeFileSync5(stopSummaryScriptPath, CC_STOP_SUMMARY_SCRIPT, "utf-8");
-  writeFileSync5(sessionStartScriptPath, CC_SESSION_START_SCRIPT, "utf-8");
-  writeFileSync5(transcriptSyncScriptPath, CC_TRANSCRIPT_SYNC_SCRIPT, "utf-8");
-  chmodSync(bashScriptPath, 493);
-  chmodSync(bashFollowupScriptPath, 493);
-  chmodSync(editCaptureScriptPath, 493);
-  chmodSync(editPrecheckScriptPath, 493);
-  chmodSync(stopSummaryScriptPath, 493);
-  chmodSync(sessionStartScriptPath, 493);
-  chmodSync(transcriptSyncScriptPath, 493);
+  const bashScriptPath = join10(HOOKS_DIR, "cc-bash-judge.sh");
+  const bashFollowupScriptPath = join10(HOOKS_DIR, "cc-bash-followup.sh");
+  const editCaptureScriptPath = join10(HOOKS_DIR, "cc-edit-capture.sh");
+  const editPrecheckScriptPath = join10(HOOKS_DIR, "cc-edit-precheck.sh");
+  const stopSummaryScriptPath = join10(HOOKS_DIR, "cc-stop-summary.sh");
+  const sessionStartScriptPath = join10(HOOKS_DIR, "cc-session-start.sh");
+  const transcriptSyncScriptPath = join10(HOOKS_DIR, "cc-transcript-sync.sh");
+  writeFileSync7(bashScriptPath, CC_BASH_JUDGE_SCRIPT, "utf-8");
+  writeFileSync7(bashFollowupScriptPath, CC_BASH_FOLLOWUP_SCRIPT, "utf-8");
+  writeFileSync7(editCaptureScriptPath, CC_EDIT_CAPTURE_SCRIPT, "utf-8");
+  writeFileSync7(editPrecheckScriptPath, CC_EDIT_PRECHECK_SCRIPT, "utf-8");
+  writeFileSync7(stopSummaryScriptPath, CC_STOP_SUMMARY_SCRIPT, "utf-8");
+  writeFileSync7(sessionStartScriptPath, CC_SESSION_START_SCRIPT, "utf-8");
+  writeFileSync7(transcriptSyncScriptPath, CC_TRANSCRIPT_SYNC_SCRIPT, "utf-8");
+  chmodSync2(bashScriptPath, 493);
+  chmodSync2(bashFollowupScriptPath, 493);
+  chmodSync2(editCaptureScriptPath, 493);
+  chmodSync2(editPrecheckScriptPath, 493);
+  chmodSync2(stopSummaryScriptPath, 493);
+  chmodSync2(sessionStartScriptPath, 493);
+  chmodSync2(transcriptSyncScriptPath, 493);
   return {
     bashScript: bashScriptPath,
     bashFollowupScript: bashFollowupScriptPath,
@@ -3969,14 +4076,20 @@ function sanitizeConfigValue(raw, maxLen = 256) {
 function shellQuoteSingle(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
+function resolveSynkroBundle() {
+  const scriptPath = process.argv[1];
+  if (scriptPath && existsSync10(scriptPath)) return scriptPath;
+  return null;
+}
 function writeConfigEnv(opts) {
-  const credsPath = join6(SYNKRO_DIR2, "credentials.json");
+  const credsPath = join10(SYNKRO_DIR3, "credentials.json");
   const safeGateway = sanitizeConfigValue(opts.gatewayUrl);
   const safeUserId = sanitizeConfigValue(opts.userId);
   const safeOrgId = sanitizeConfigValue(opts.orgId);
   const safeEmail = sanitizeConfigValue(opts.email);
   const safeTier = sanitizeConfigValue(opts.tier ?? "pro", 32);
   const safeInference = sanitizeConfigValue(opts.inference ?? "fast", 16);
+  const safeSynkroBin = sanitizeConfigValue(opts.synkroBin ?? "", 1024);
   const lines = [
     "# Synkro CLI config (managed by synkro install)",
     "# JWT auth \u2014 the hook scripts read SYNKRO_CREDENTIALS_PATH at runtime",
@@ -3985,8 +4098,9 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.3.58")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.4.0")}`
   ];
+  if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
   if (safeOrgId) lines.push(`SYNKRO_ORG_ID=${shellQuoteSingle(safeOrgId)}`);
   if (safeEmail) lines.push(`SYNKRO_EMAIL=${shellQuoteSingle(safeEmail)}`);
@@ -3994,17 +4108,17 @@ function writeConfigEnv(opts) {
     lines.push(`SYNKRO_TRANSCRIPT_CONSENT=${shellQuoteSingle(opts.transcriptConsent ? "yes" : "no")}`);
   }
   lines.push("");
-  writeFileSync5(CONFIG_PATH2, lines.join("\n"), "utf-8");
-  chmodSync(CONFIG_PATH2, 384);
+  writeFileSync7(CONFIG_PATH2, lines.join("\n"), "utf-8");
+  chmodSync2(CONFIG_PATH2, 384);
 }
 function collectLocalMetadata() {
   const meta = { platform: process.platform };
   try {
-    meta.display_name = execSync4("git config user.name", { encoding: "utf-8", timeout: 3e3 }).trim();
+    meta.display_name = execSync5("git config user.name", { encoding: "utf-8", timeout: 3e3 }).trim();
   } catch {
   }
   try {
-    const remote = execSync4("git remote get-url origin", { encoding: "utf-8", timeout: 3e3 }).trim();
+    const remote = execSync5("git remote get-url origin", { encoding: "utf-8", timeout: 3e3 }).trim();
     const sshMatch = remote.match(/^git@[^:]+:(.+?)(?:\.git)?$/);
     const httpMatch = remote.match(/^https?:\/\/[^/]+\/(.+?)(?:\.git)?$/);
     const m = sshMatch || httpMatch;
@@ -4012,34 +4126,34 @@ function collectLocalMetadata() {
   } catch {
   }
   try {
-    meta.cc_version = execSync4("claude --version", { encoding: "utf-8", timeout: 5e3 }).trim().split("\n")[0];
+    meta.cc_version = execSync5("claude --version", { encoding: "utf-8", timeout: 5e3 }).trim().split("\n")[0];
   } catch {
   }
-  const claudeDir = join6(homedir5(), ".claude");
+  const claudeDir = join10(homedir9(), ".claude");
   try {
-    const settings = JSON.parse(readFileSync5(join6(claudeDir, "settings.json"), "utf-8"));
+    const settings = JSON.parse(readFileSync7(join10(claudeDir, "settings.json"), "utf-8"));
     const plugins = Object.keys(settings.enabledPlugins ?? {}).filter((k) => settings.enabledPlugins[k]);
     if (plugins.length) meta.enabled_plugins = plugins;
     if (settings.permissions?.defaultMode) meta.permissions_mode = settings.permissions.defaultMode;
   } catch {
   }
   try {
-    const mcpCache = JSON.parse(readFileSync5(join6(claudeDir, "mcp-needs-auth-cache.json"), "utf-8"));
+    const mcpCache = JSON.parse(readFileSync7(join10(claudeDir, "mcp-needs-auth-cache.json"), "utf-8"));
     const mcpNames = Object.keys(mcpCache);
     if (mcpNames.length) meta.mcp_servers = mcpNames;
   } catch {
   }
   try {
-    const mcpList = execSync4("claude mcp list 2>/dev/null", { encoding: "utf-8", timeout: 1e4 });
+    const mcpList = execSync5("claude mcp list 2>/dev/null", { encoding: "utf-8", timeout: 1e4 });
     const connected = mcpList.split("\n").filter((l) => l.includes("Connected")).map((l) => l.split(":")[0].trim()).filter(Boolean);
     if (connected.length) meta.mcp_servers_connected = connected;
   } catch {
   }
   try {
-    const sessionsDir = join6(claudeDir, "sessions");
+    const sessionsDir = join10(claudeDir, "sessions");
     const files = readdirSync(sessionsDir).filter((f) => f.endsWith(".json")).slice(-5);
     for (const f of files) {
-      const s = JSON.parse(readFileSync5(join6(sessionsDir, f), "utf-8"));
+      const s = JSON.parse(readFileSync7(join10(sessionsDir, f), "utf-8"));
       if (s.version) {
         meta.cc_version = meta.cc_version || s.version;
         break;
@@ -4094,19 +4208,19 @@ function assertGatewayAllowed(gatewayUrl) {
 }
 function isAlreadyInstalled() {
   const requiredScripts = [
-    join6(HOOKS_DIR, "cc-bash-judge.sh"),
-    join6(HOOKS_DIR, "cc-bash-followup.sh"),
-    join6(HOOKS_DIR, "cc-edit-precheck.sh"),
-    join6(HOOKS_DIR, "cc-edit-capture.sh"),
-    join6(HOOKS_DIR, "cc-stop-summary.sh"),
-    join6(HOOKS_DIR, "cc-session-start.sh")
+    join10(HOOKS_DIR, "cc-bash-judge.sh"),
+    join10(HOOKS_DIR, "cc-bash-followup.sh"),
+    join10(HOOKS_DIR, "cc-edit-precheck.sh"),
+    join10(HOOKS_DIR, "cc-edit-capture.sh"),
+    join10(HOOKS_DIR, "cc-stop-summary.sh"),
+    join10(HOOKS_DIR, "cc-session-start.sh")
   ];
-  if (!requiredScripts.every((p) => existsSync7(p))) return false;
-  if (!existsSync7(CONFIG_PATH2)) return false;
-  const settingsPath = join6(homedir5(), ".claude", "settings.json");
-  if (!existsSync7(settingsPath)) return false;
+  if (!requiredScripts.every((p) => existsSync10(p))) return false;
+  if (!existsSync10(CONFIG_PATH2)) return false;
+  const settingsPath = join10(homedir9(), ".claude", "settings.json");
+  if (!existsSync10(settingsPath)) return false;
   try {
-    const settings = JSON.parse(readFileSync5(settingsPath, "utf-8"));
+    const settings = JSON.parse(readFileSync7(settingsPath, "utf-8"));
     const hooks = settings?.hooks;
     if (!hooks || typeof hooks !== "object") return false;
     const hasManaged = (kind) => Array.isArray(hooks[kind]) && hooks[kind].some((entry) => entry?.__synkro_managed__ === true);
@@ -4213,23 +4327,31 @@ async function installCommand(opts = {}) {
   console.log(`  ${scripts.sessionStartScript}`);
   console.log(`  ${scripts.transcriptSyncScript}
 `);
-  writeGraderDaemon();
   for (const mode of ["edit", "bash"]) {
-    const pidFile = join6(SYNKRO_DIR2, "daemon", mode, "daemon.pid");
+    const pidFile = join10(SYNKRO_DIR3, "daemon", mode, "daemon.pid");
     try {
-      const pid = parseInt(readFileSync5(pidFile, "utf-8").trim(), 10);
+      const pid = parseInt(readFileSync7(pidFile, "utf-8").trim(), 10);
       if (pid > 0) {
         process.kill(pid, "SIGTERM");
-        console.log(`Stopped stale ${mode} daemon (pid ${pid})`);
+        console.log(`Stopped stale ${mode} grader daemon (pid ${pid})`);
       }
     } catch {
     }
   }
-  console.log("Wrote local-tier grader daemon:");
-  console.log(`  ${GRADER_DAEMON_PATH}`);
-  console.log(`  ${GRADER_PRIMER_EDIT_PATH}`);
-  console.log(`  ${GRADER_PRIMER_BASH_PATH}
+  if (isLocalCCEnabled()) {
+    try {
+      assertClaudeInstalled();
+      assertPueueInstalled();
+      const r = installLocalCC();
+      console.log(`Installed local-CC channel plugin at ${r.pluginPath}`);
+      const t = ensureRunning();
+      console.log(`Local-CC pueue task: id=${t.id} status=${t.status}
 `);
+    } catch (err) {
+      console.warn(`  \u26A0 Local-CC setup skipped: ${err.message}`);
+      console.warn("    Run `synkro local-cc enable` after fixing the issue.\n");
+    }
+  }
   let transcriptConsent = true;
   if (process.stdin.isTTY) {
     transcriptConsent = await promptTranscriptConsent();
@@ -4295,10 +4417,19 @@ async function installCommand(opts = {}) {
   } catch {
   }
   const profile = await fetchUserProfile(gatewayUrl, token);
-  writeConfigEnv({ gatewayUrl, userId, orgId, email, tier: profile.tier, inference: profile.inference, transcriptConsent });
+  const synkroBundle = resolveSynkroBundle();
+  writeConfigEnv({ gatewayUrl, userId, orgId, email, tier: profile.tier, inference: profile.inference, synkroBin: synkroBundle, transcriptConsent });
   console.log(`Wrote config to ${CONFIG_PATH2}`);
-  console.log(`  inference: ${profile.inference} (server-side grading)
-`);
+  console.log(`  inference: ${profile.inference} (server-side grading)`);
+  if (synkroBundle) console.log(`  SYNKRO_CLI_BIN=${synkroBundle}`);
+  else console.warn("  \u26A0 Could not resolve synkro bundle path; hooks will fall back to PATH lookup of `synkro`.");
+  try {
+    const prompts = await fetchJudgePrompts({ gatewayUrl, jwt: token });
+    console.log(`  prompts: ${prompts.version} (cached)`);
+  } catch (err) {
+    console.warn(`  \u26A0 Could not cache judge prompts: ${err.message}`);
+  }
+  console.log();
   if (transcriptConsent) {
     try {
       const repo = detectGitRepo2();
@@ -4333,7 +4464,7 @@ async function installCommand(opts = {}) {
 }
 function detectGitRepo2() {
   try {
-    const remoteUrl = execSync4("git remote get-url origin", { encoding: "utf-8", timeout: 5e3 }).trim();
+    const remoteUrl = execSync5("git remote get-url origin", { encoding: "utf-8", timeout: 5e3 }).trim();
     const sshMatch = remoteUrl.match(/^git@[^:]+:(.+?)(?:\.git)?$/);
     const httpMatch = remoteUrl.match(/^https?:\/\/[^/]+\/(.+?)(?:\.git)?$/);
     const match = sshMatch || httpMatch;
@@ -4345,17 +4476,17 @@ function detectGitRepo2() {
 function getClaudeProjectsFolder() {
   const cwd = process.cwd();
   const sanitized = "-" + cwd.replace(/\//g, "-");
-  const projectsDir = join6(homedir5(), ".claude", "projects", sanitized);
-  return existsSync7(projectsDir) ? projectsDir : null;
+  const projectsDir = join10(homedir9(), ".claude", "projects", sanitized);
+  return existsSync10(projectsDir) ? projectsDir : null;
 }
 function extractSessionInsights(projectsDir) {
   const insights = [];
   const files = readdirSync(projectsDir).filter((f) => f.endsWith(".jsonl"));
   for (const file of files) {
     const sessionId = file.replace(".jsonl", "");
-    const filePath = join6(projectsDir, file);
+    const filePath = join10(projectsDir, file);
     try {
-      const content = readFileSync5(filePath, "utf-8");
+      const content = readFileSync7(filePath, "utf-8");
       const lines = content.split("\n").filter(Boolean);
       for (let i = 0; i < lines.length; i++) {
         try {
@@ -4431,7 +4562,7 @@ function extractTextContent(content) {
   return "";
 }
 function parseTranscriptFile(filePath) {
-  const content = readFileSync5(filePath, "utf-8");
+  const content = readFileSync7(filePath, "utf-8");
   const lines = content.split("\n").filter(Boolean);
   const messages = [];
   for (let i = 0; i < lines.length; i++) {
@@ -4482,7 +4613,7 @@ async function syncTranscriptsBulk(gatewayUrl, token, repo) {
     const sessions = [];
     for (const file of batch) {
       const sessionId = file.replace(".jsonl", "");
-      const filePath = join6(projectsDir, file);
+      const filePath = join10(projectsDir, file);
       try {
         const allMessages = parseTranscriptFile(filePath);
         const messages = allMessages.length > maxMessagesPerSession ? allMessages.slice(-maxMessagesPerSession) : allMessages;
@@ -4511,38 +4642,38 @@ async function syncTranscriptsBulk(gatewayUrl, token, repo) {
     }
     for (const file of batch) {
       const sessionId = file.replace(".jsonl", "");
-      const filePath = join6(projectsDir, file);
+      const filePath = join10(projectsDir, file);
       try {
-        const content = readFileSync5(filePath, "utf-8");
+        const content = readFileSync7(filePath, "utf-8");
         const lineCount = content.split("\n").filter(Boolean).length;
-        writeFileSync5(join6(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
+        writeFileSync7(join10(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
       } catch {
       }
     }
   }
   return { sessions: totalSessions, messages: totalMessages };
 }
-var SYNKRO_DIR2, HOOKS_DIR, BIN_DIR, CONFIG_PATH2, GRADER_DAEMON_PATH, GRADER_PRIMER_EDIT_PATH, GRADER_PRIMER_BASH_PATH, OFFSETS_DIR;
-var init_install = __esm({
+var SYNKRO_DIR3, HOOKS_DIR, BIN_DIR, CONFIG_PATH2, OFFSETS_DIR;
+var init_install2 = __esm({
   "cli/commands/install.ts"() {
     "use strict";
     init_agentDetect();
     init_ccHookConfig();
     init_mcpConfig();
     init_hookScripts();
-    init_graderDaemon();
     init_stub();
     init_repoConnect();
     init_projects();
     init_setupGithub();
-    SYNKRO_DIR2 = join6(homedir5(), ".synkro");
-    HOOKS_DIR = join6(SYNKRO_DIR2, "hooks");
-    BIN_DIR = join6(SYNKRO_DIR2, "bin");
-    CONFIG_PATH2 = join6(SYNKRO_DIR2, "config.env");
-    GRADER_DAEMON_PATH = join6(BIN_DIR, "grader_daemon.py");
-    GRADER_PRIMER_EDIT_PATH = join6(SYNKRO_DIR2, "grader-primer-edit.txt");
-    GRADER_PRIMER_BASH_PATH = join6(SYNKRO_DIR2, "grader-primer-bash.txt");
-    OFFSETS_DIR = join6(SYNKRO_DIR2, ".transcript-offsets");
+    init_promptFetcher();
+    init_settings();
+    init_install();
+    init_pueue();
+    SYNKRO_DIR3 = join10(homedir9(), ".synkro");
+    HOOKS_DIR = join10(SYNKRO_DIR3, "hooks");
+    BIN_DIR = join10(SYNKRO_DIR3, "bin");
+    CONFIG_PATH2 = join10(SYNKRO_DIR3, "config.env");
+    OFFSETS_DIR = join10(SYNKRO_DIR3, ".transcript-offsets");
   }
 });
 
@@ -4618,13 +4749,13 @@ var status_exports = {};
 __export(status_exports, {
   statusCommand: () => statusCommand
 });
-import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
-import { homedir as homedir6 } from "os";
-import { join as join7 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync8 } from "fs";
+import { homedir as homedir10 } from "os";
+import { join as join11 } from "path";
 function readConfigEnv() {
-  if (!existsSync8(CONFIG_PATH3)) return {};
+  if (!existsSync11(CONFIG_PATH3)) return {};
   const out = {};
-  const raw = readFileSync6(CONFIG_PATH3, "utf-8");
+  const raw = readFileSync8(CONFIG_PATH3, "utf-8");
   for (const line of raw.split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -4697,19 +4828,19 @@ async function statusCommand() {
     }
   }
   console.log();
-  const bashScript = join7(SYNKRO_DIR3, "hooks", "cc-bash-judge.sh");
-  const bashFollowupScript = join7(SYNKRO_DIR3, "hooks", "cc-bash-followup.sh");
-  const editPrecheckScript = join7(SYNKRO_DIR3, "hooks", "cc-edit-precheck.sh");
-  const editCaptureScript = join7(SYNKRO_DIR3, "hooks", "cc-edit-capture.sh");
-  const stopSummaryScript = join7(SYNKRO_DIR3, "hooks", "cc-stop-summary.sh");
-  const sessionStartScript = join7(SYNKRO_DIR3, "hooks", "cc-session-start.sh");
+  const bashScript = join11(SYNKRO_DIR4, "hooks", "cc-bash-judge.sh");
+  const bashFollowupScript = join11(SYNKRO_DIR4, "hooks", "cc-bash-followup.sh");
+  const editPrecheckScript = join11(SYNKRO_DIR4, "hooks", "cc-edit-precheck.sh");
+  const editCaptureScript = join11(SYNKRO_DIR4, "hooks", "cc-edit-capture.sh");
+  const stopSummaryScript = join11(SYNKRO_DIR4, "hooks", "cc-stop-summary.sh");
+  const sessionStartScript = join11(SYNKRO_DIR4, "hooks", "cc-session-start.sh");
   console.log("Hook scripts:");
-  console.log(`  ${existsSync8(bashScript) ? "\u2713" : "\u2717"} ${bashScript}`);
-  console.log(`  ${existsSync8(bashFollowupScript) ? "\u2713" : "\u2717"} ${bashFollowupScript}`);
-  console.log(`  ${existsSync8(editPrecheckScript) ? "\u2713" : "\u2717"} ${editPrecheckScript}`);
-  console.log(`  ${existsSync8(editCaptureScript) ? "\u2713" : "\u2717"} ${editCaptureScript}`);
-  console.log(`  ${existsSync8(stopSummaryScript) ? "\u2713" : "\u2717"} ${stopSummaryScript}`);
-  console.log(`  ${existsSync8(sessionStartScript) ? "\u2713" : "\u2717"} ${sessionStartScript}`);
+  console.log(`  ${existsSync11(bashScript) ? "\u2713" : "\u2717"} ${bashScript}`);
+  console.log(`  ${existsSync11(bashFollowupScript) ? "\u2713" : "\u2717"} ${bashFollowupScript}`);
+  console.log(`  ${existsSync11(editPrecheckScript) ? "\u2713" : "\u2717"} ${editPrecheckScript}`);
+  console.log(`  ${existsSync11(editCaptureScript) ? "\u2713" : "\u2717"} ${editCaptureScript}`);
+  console.log(`  ${existsSync11(stopSummaryScript) ? "\u2713" : "\u2717"} ${stopSummaryScript}`);
+  console.log(`  ${existsSync11(sessionStartScript) ? "\u2713" : "\u2717"} ${sessionStartScript}`);
   console.log();
   const mcp = inspectMcpConfig();
   console.log("Guardrails MCP server (Claude Code):");
@@ -4721,7 +4852,7 @@ async function statusCommand() {
     console.log(`    expected at ${mcp.configPath} \u2192 mcpServers.synkro-guardrails`);
   }
 }
-var SYNKRO_DIR3, CONFIG_PATH3;
+var SYNKRO_DIR4, CONFIG_PATH3;
 var init_status = __esm({
   "cli/commands/status.ts"() {
     "use strict";
@@ -4729,8 +4860,8 @@ var init_status = __esm({
     init_agentDetect();
     init_ccHookConfig();
     init_mcpConfig();
-    SYNKRO_DIR3 = join7(homedir6(), ".synkro");
-    CONFIG_PATH3 = join7(SYNKRO_DIR3, "config.env");
+    SYNKRO_DIR4 = join11(homedir10(), ".synkro");
+    CONFIG_PATH3 = join11(SYNKRO_DIR4, "config.env");
   }
 });
 
@@ -4819,13 +4950,13 @@ var config_exports = {};
 __export(config_exports, {
   configCommand: () => configCommand
 });
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync6, existsSync as existsSync9 } from "fs";
-import { join as join8 } from "path";
-import { homedir as homedir7 } from "os";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync8, existsSync as existsSync12 } from "fs";
+import { join as join12 } from "path";
+import { homedir as homedir11 } from "os";
 function readConfigEnv2() {
-  if (!existsSync9(CONFIG_PATH4)) return {};
+  if (!existsSync12(CONFIG_PATH4)) return {};
   const out = {};
-  for (const line of readFileSync7(CONFIG_PATH4, "utf-8").split("\n")) {
+  for (const line of readFileSync9(CONFIG_PATH4, "utf-8").split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#")) continue;
     const eq = t.indexOf("=");
@@ -4834,11 +4965,11 @@ function readConfigEnv2() {
   return out;
 }
 function updateConfigValue(key, value) {
-  if (!existsSync9(CONFIG_PATH4)) {
+  if (!existsSync12(CONFIG_PATH4)) {
     console.error("No config found. Run `synkro install` first.");
     process.exit(1);
   }
-  const lines = readFileSync7(CONFIG_PATH4, "utf-8").split("\n");
+  const lines = readFileSync9(CONFIG_PATH4, "utf-8").split("\n");
   const pattern = new RegExp(`^${key}=`);
   let found = false;
   const updated = lines.map((line) => {
@@ -4849,7 +4980,7 @@ function updateConfigValue(key, value) {
     return line;
   });
   if (!found) updated.splice(updated.length - 1, 0, `${key}='${value}'`);
-  writeFileSync6(CONFIG_PATH4, updated.join("\n"), "utf-8");
+  writeFileSync8(CONFIG_PATH4, updated.join("\n"), "utf-8");
 }
 async function configCommand(args2) {
   if (args2.length === 0) {
@@ -4900,13 +5031,13 @@ To change: synkro config --inference fast|standard`);
   updateConfigValue("SYNKRO_INFERENCE", inferenceValue);
   console.log(`\u2713 Inference set to '${inferenceValue}'.`);
 }
-var SYNKRO_DIR4, CONFIG_PATH4;
+var SYNKRO_DIR5, CONFIG_PATH4;
 var init_config = __esm({
   "cli/commands/config.ts"() {
     "use strict";
     init_stub();
-    SYNKRO_DIR4 = join8(homedir7(), ".synkro");
-    CONFIG_PATH4 = join8(SYNKRO_DIR4, "config.env");
+    SYNKRO_DIR5 = join12(homedir11(), ".synkro");
+    CONFIG_PATH4 = join12(SYNKRO_DIR5, "config.env");
   }
 });
 
@@ -4915,9 +5046,9 @@ var scanPr_exports = {};
 __export(scanPr_exports, {
   scanPrCommand: () => scanPrCommand
 });
-import { execSync as execSync5, spawn } from "child_process";
-import { readFileSync as readFileSync8, existsSync as existsSync10 } from "fs";
-import { join as join9 } from "path";
+import { execSync as execSync6, spawn } from "child_process";
+import { readFileSync as readFileSync10, existsSync as existsSync13 } from "fs";
+import { join as join13 } from "path";
 function parseMatchSpec(condition) {
   if (!condition.startsWith("match_spec:")) return null;
   try {
@@ -5023,7 +5154,7 @@ function shouldSkipFile(filename) {
   return SKIP_FILE_PATTERNS.some((p) => p.test(filename));
 }
 function ghJson(args2) {
-  const out = execSync5(`gh ${args2.map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(" ")}`, {
+  const out = execSync6(`gh ${args2.map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(" ")}`, {
     encoding: "utf-8",
     maxBuffer: 16 * 1024 * 1024
   });
@@ -5321,7 +5452,7 @@ function postPrReview(repo, prNumber, sha, review, skipLineReview = false) {
 ${review.summary}
 
 ` + review.comments.map((c) => `**${c.path}:${c.line}** \u2014 ${c.body}`).join("\n\n");
-      execSync5(`gh api -X POST /repos/${repo}/issues/${prNumber}/comments --input -`, {
+      execSync6(`gh api -X POST /repos/${repo}/issues/${prNumber}/comments --input -`, {
         encoding: "utf-8",
         input: JSON.stringify({ body }),
         stdio: ["pipe", "ignore", "pipe"]
@@ -5346,7 +5477,7 @@ ${review.summary}`,
       comments: review.comments
     });
     try {
-      execSync5(`gh api -X POST /repos/${repo}/pulls/${prNumber}/reviews --input -`, {
+      execSync6(`gh api -X POST /repos/${repo}/pulls/${prNumber}/reviews --input -`, {
         encoding: "utf-8",
         input: body,
         stdio: ["pipe", "pipe", "pipe"]
@@ -5381,7 +5512,7 @@ function postCheckRun(repo, sha, conclusion, findings) {
     }
   });
   try {
-    execSync5(`gh api -X POST /repos/${repo}/check-runs --input -`, {
+    execSync6(`gh api -X POST /repos/${repo}/check-runs --input -`, {
       encoding: "utf-8",
       input: body,
       stdio: ["pipe", "ignore", "pipe"]
@@ -5396,10 +5527,10 @@ function shouldFail(findings, threshold) {
   return findings.some((f) => order.indexOf(f.severity) >= thresholdIdx);
 }
 function readRepoDeps() {
-  const pkgPath = join9(process.cwd(), "package.json");
-  if (!existsSync10(pkgPath)) return {};
+  const pkgPath = join13(process.cwd(), "package.json");
+  if (!existsSync13(pkgPath)) return {};
   try {
-    const pkg = JSON.parse(readFileSync8(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync10(pkgPath, "utf-8"));
     return { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
   } catch {
     return {};
@@ -5407,7 +5538,7 @@ function readRepoDeps() {
 }
 function getFullFileContent(filename) {
   try {
-    return execSync5(`git show HEAD:${filename}`, { encoding: "utf-8", maxBuffer: 128 * 1024 });
+    return execSync6(`git show HEAD:${filename}`, { encoding: "utf-8", maxBuffer: 128 * 1024 });
   } catch {
     return null;
   }
@@ -5652,7 +5783,7 @@ async function updateCommand() {
 var init_update = __esm({
   "cli/commands/update.ts"() {
     "use strict";
-    init_install();
+    init_install2();
   }
 });
 
@@ -5661,12 +5792,24 @@ var disconnect_exports = {};
 __export(disconnect_exports, {
   disconnectCommand: () => disconnectCommand
 });
-import { existsSync as existsSync11, rmSync } from "fs";
-import { homedir as homedir8 } from "os";
-import { join as join10 } from "path";
+import { existsSync as existsSync14, rmSync } from "fs";
+import { homedir as homedir12 } from "os";
+import { join as join14 } from "path";
+function tearDownLocalCC() {
+  let hadTask = false;
+  try {
+    hadTask = !!findTask();
+    stopTask();
+  } catch {
+  }
+  console.log(`${hadTask ? "\u2713" : "\xB7"} local-cc runtime: ${hadTask ? "stopped pueue task + tmux session" : "no live task"}`);
+  uninstallLocalCC();
+  console.log("\u2713 local-cc config: cleaned ~/.claude.json entries");
+}
 function disconnectCommand(args2 = []) {
   const purge = args2.includes("--purge");
   console.log("Synkro disconnect starting...\n");
+  tearDownLocalCC();
   const agents = detectAgents();
   let sawClaudeCode = false;
   for (const agent of agents) {
@@ -5681,25 +5824,27 @@ function disconnectCommand(args2 = []) {
     console.log(`${mcpRemoved ? "\u2713" : "\xB7"} MCP guardrails server: ${mcpRemoved ? "removed entry from ~/.claude.json" : "no Synkro MCP entry found"}`);
   }
   if (purge) {
-    if (existsSync11(SYNKRO_DIR5)) {
-      rmSync(SYNKRO_DIR5, { recursive: true, force: true });
-      console.log(`\u2713 Removed ${SYNKRO_DIR5}`);
+    if (existsSync14(SYNKRO_DIR6)) {
+      rmSync(SYNKRO_DIR6, { recursive: true, force: true });
+      console.log(`\u2713 Removed ${SYNKRO_DIR6}`);
     } else {
-      console.log(`\xB7 ${SYNKRO_DIR5} already gone, nothing to remove`);
+      console.log(`\xB7 ${SYNKRO_DIR6} already gone, nothing to remove`);
     }
-  } else if (existsSync11(SYNKRO_DIR5)) {
-    console.log(`Config preserved at ${SYNKRO_DIR5}. Run with --purge to remove.`);
+  } else if (existsSync14(SYNKRO_DIR6)) {
+    console.log(`Config preserved at ${SYNKRO_DIR6}. Run with --purge to remove.`);
   }
   console.log("\nSynkro disconnected.");
 }
-var SYNKRO_DIR5;
+var SYNKRO_DIR6;
 var init_disconnect = __esm({
   "cli/commands/disconnect.ts"() {
     "use strict";
     init_agentDetect();
     init_ccHookConfig();
     init_mcpConfig();
-    SYNKRO_DIR5 = join10(homedir8(), ".synkro");
+    init_pueue();
+    init_install();
+    SYNKRO_DIR6 = join14(homedir12(), ".synkro");
   }
 });
 
@@ -5736,20 +5881,682 @@ var init_reinstall = __esm({
   "cli/commands/reinstall.ts"() {
     "use strict";
     init_disconnect();
+    init_install2();
+  }
+});
+
+// cli/local-cc/turnLog.ts
+import { appendFileSync, existsSync as existsSync15, mkdirSync as mkdirSync9, openSync as openSync2, readFileSync as readFileSync11, readSync, closeSync as closeSync2, statSync, watchFile, unwatchFile } from "fs";
+import { dirname as dirname5, join as join15 } from "path";
+import { homedir as homedir13 } from "os";
+function truncate(s, max = PREVIEW_MAX) {
+  if (s.length <= max) return s;
+  return s.slice(0, max) + "\u2026 [+" + (s.length - max) + " chars]";
+}
+function extractSeverity(result) {
+  const m = result.match(/<synkro-(?:verdict|intent)>([\s\S]*?)<\/synkro-(?:verdict|intent)>/);
+  if (!m) return void 0;
+  try {
+    const obj = JSON.parse(m[1]);
+    if (obj.severity) return String(obj.severity);
+    if (typeof obj.ok === "boolean") return obj.ok ? "ok" : "violations";
+    if (obj.type) return String(obj.type);
+    if (obj.verdict) return String(obj.verdict);
+  } catch {
+  }
+  return void 0;
+}
+function appendTurn(args2) {
+  try {
+    mkdirSync9(dirname5(TURN_LOG_PATH), { recursive: true });
+    const entry = {
+      ts: new Date(args2.startedAt).toISOString(),
+      role: args2.role,
+      duration_ms: Date.now() - args2.startedAt,
+      status: args2.status,
+      request_preview: truncate(args2.request),
+      response_preview: args2.result ? truncate(args2.result) : "",
+      severity: args2.result ? extractSeverity(args2.result) : void 0,
+      error: args2.error
+    };
+    appendFileSync(TURN_LOG_PATH, JSON.stringify(entry) + "\n", "utf-8");
+  } catch {
+  }
+}
+function readRecentTurns(n = 20) {
+  if (!existsSync15(TURN_LOG_PATH)) return [];
+  try {
+    const size = statSync(TURN_LOG_PATH).size;
+    if (size === 0) return [];
+    const text = readFileSync11(TURN_LOG_PATH, "utf-8");
+    const lines = text.split("\n").filter(Boolean);
+    const lastN = lines.slice(-n).reverse();
+    return lastN.map((line) => {
+      try {
+        return JSON.parse(line);
+      } catch {
+        return null;
+      }
+    }).filter((x) => x !== null);
+  } catch {
+    return [];
+  }
+}
+function followTurns(onEntry) {
+  try {
+    mkdirSync9(dirname5(TURN_LOG_PATH), { recursive: true });
+    if (!existsSync15(TURN_LOG_PATH)) {
+      appendFileSync(TURN_LOG_PATH, "", "utf-8");
+    }
+  } catch {
+  }
+  let lastSize = (() => {
+    try {
+      return statSync(TURN_LOG_PATH).size;
+    } catch {
+      return 0;
+    }
+  })();
+  let pendingPartial = "";
+  const drainNewBytes = (from, to) => {
+    if (to <= from) return;
+    let fd = null;
+    try {
+      fd = openSync2(TURN_LOG_PATH, "r");
+      const len = to - from;
+      const buf = Buffer.alloc(len);
+      readSync(fd, buf, 0, len, from);
+      const text = pendingPartial + buf.toString("utf-8");
+      const lastNewline = text.lastIndexOf("\n");
+      if (lastNewline === -1) {
+        pendingPartial = text;
+        return;
+      }
+      const complete = text.slice(0, lastNewline);
+      pendingPartial = text.slice(lastNewline + 1);
+      for (const line of complete.split("\n")) {
+        if (!line) continue;
+        try {
+          onEntry(JSON.parse(line));
+        } catch {
+        }
+      }
+    } catch {
+    } finally {
+      if (fd !== null) {
+        try {
+          closeSync2(fd);
+        } catch {
+        }
+      }
+    }
+  };
+  watchFile(TURN_LOG_PATH, { interval: 250 }, (curr, prev) => {
+    if (curr.size < lastSize) {
+      lastSize = 0;
+      pendingPartial = "";
+    }
+    if (curr.size > lastSize) {
+      drainNewBytes(lastSize, curr.size);
+      lastSize = curr.size;
+    }
+  });
+  return () => unwatchFile(TURN_LOG_PATH);
+}
+var TURN_LOG_PATH, PREVIEW_MAX;
+var init_turnLog = __esm({
+  "cli/local-cc/turnLog.ts"() {
+    "use strict";
+    TURN_LOG_PATH = join15(homedir13(), ".synkro", "cc_sessions", "turns.log");
+    PREVIEW_MAX = 400;
+  }
+});
+
+// cli/local-cc/prompts.ts
+import { existsSync as existsSync16, readFileSync as readFileSync12 } from "fs";
+import { homedir as homedir14 } from "os";
+import { join as join16 } from "path";
+function loadCachedPrompts() {
+  if (_cached) return _cached;
+  if (!existsSync16(CACHE_PATH2)) {
+    throw new Error("Prompts cache not found. Run `synkro install` or `synkro update` first.");
+  }
+  try {
+    _cached = JSON.parse(readFileSync12(CACHE_PATH2, "utf-8"));
+    return _cached;
+  } catch {
+    throw new Error("Prompts cache is corrupted. Run `synkro update` to refresh.");
+  }
+}
+function getPrimer(role) {
+  const cache = loadCachedPrompts();
+  const primer = role === "grade-edit" ? cache.grader_primer_edit : cache.grader_primer_bash;
+  if (!primer) {
+    throw new Error(`No cached primer for role "${role}". Run \`synkro update\` to refresh prompts.`);
+  }
+  return primer;
+}
+function buildChannelContent(role, payload) {
+  return `${getPrimer(role)}
+
+---
+PAYLOAD (the input to evaluate):
+
+${payload}`;
+}
+var CACHE_PATH2, _cached;
+var init_prompts = __esm({
+  "cli/local-cc/prompts.ts"() {
+    "use strict";
+    CACHE_PATH2 = join16(homedir14(), ".synkro", "prompts", "judge-prompts.json");
+    _cached = null;
+  }
+});
+
+// cli/local-cc/client.ts
+import { request as httpRequest } from "http";
+import { connect as connect2 } from "net";
+async function submitToChannel(role, payload, opts = {}) {
+  const content = buildChannelContent(role, payload);
+  const body = JSON.stringify({ role, content });
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const startedAt = Date.now();
+  try {
+    const result = await new Promise((resolve2, reject) => {
+      const req = httpRequest({
+        host: CHANNEL_HOST,
+        port: CHANNEL_PORT,
+        method: "POST",
+        path: "/submit",
+        headers: {
+          "Content-Type": "application/json",
+          "Content-Length": Buffer.byteLength(body)
+        },
+        timeout: timeoutMs
+      }, (res) => {
+        const chunks = [];
+        res.on("data", (c) => chunks.push(c));
+        res.on("end", () => {
+          const text = Buffer.concat(chunks).toString("utf-8");
+          if (res.statusCode !== 200) {
+            reject(new LocalCCError(`channel returned ${res.statusCode}: ${text.slice(0, 500)}`));
+            return;
+          }
+          try {
+            const parsed = JSON.parse(text);
+            if (parsed.error) {
+              reject(new LocalCCError(parsed.error));
+              return;
+            }
+            resolve2(String(parsed.result ?? ""));
+          } catch (err) {
+            reject(new LocalCCError(`malformed channel response: ${text.slice(0, 200)}`, err));
+          }
+        });
+      });
+      req.on("timeout", () => {
+        req.destroy(new LocalCCError(`channel request timed out after ${timeoutMs}ms`));
+      });
+      req.on("error", (err) => {
+        const msg = err.code === "ECONNREFUSED" ? `channel connection refused at ${CHANNEL_HOST}:${CHANNEL_PORT} (is the pueue task running?)` : `channel request failed: ${err.message}`;
+        reject(new LocalCCError(msg, err));
+      });
+      req.write(body);
+      req.end();
+    });
+    appendTurn({ startedAt, role, request: payload, result, status: "ok" });
+    return result;
+  } catch (err) {
+    const message = err.message ?? String(err);
+    const status = /timed out/i.test(message) ? "timeout" : "error";
+    appendTurn({ startedAt, role, request: payload, status, error: message });
+    throw err;
+  }
+}
+function isChannelAvailable(timeoutMs = 500) {
+  return new Promise((resolve2) => {
+    const sock = connect2(CHANNEL_PORT, CHANNEL_HOST);
+    const done = (ok) => {
+      try {
+        sock.destroy();
+      } catch {
+      }
+      resolve2(ok);
+    };
+    sock.once("connect", () => done(true));
+    sock.once("error", () => done(false));
+    sock.setTimeout(timeoutMs, () => done(false));
+  });
+}
+var CHANNEL_HOST, CHANNEL_PORT, DEFAULT_TIMEOUT_MS, LocalCCError;
+var init_client = __esm({
+  "cli/local-cc/client.ts"() {
+    "use strict";
+    init_prompts();
+    init_turnLog();
+    CHANNEL_HOST = "127.0.0.1";
+    CHANNEL_PORT = parseInt(process.env.SYNKRO_CHANNEL_PORT || "8929", 10);
+    DEFAULT_TIMEOUT_MS = 9e4;
+    LocalCCError = class extends Error {
+      constructor(message, cause) {
+        super(message);
+        this.cause = cause;
+        this.name = "LocalCCError";
+      }
+      cause;
+    };
+  }
+});
+
+// cli/commands/localCc.ts
+var localCc_exports = {};
+__export(localCc_exports, {
+  localCcCommand: () => localCcCommand
+});
+import { spawnSync as spawnSync3 } from "child_process";
+import { homedir as homedir15 } from "os";
+import { join as join17 } from "path";
+function printHelp() {
+  const dbPath = join17(homedir15(), ".synkro", "sessions.db");
+  console.log(`synkro local-cc \u2014 manage the local Claude Code inference session
+
+OVERVIEW
+  Routes Synkro's grading and intent-classification work through a long-running
+  Claude Code session on this machine instead of remote Inngest+Gemini.
+
+  When enabled, three call sites switch over:
+    \u2022 security grading on edit/bash hooks
+    \u2022 intent classification (agent input \u2192 structured intent)
+    \u2022 remediate intent classification
+
+  The session is hosted in a detached tmux session managed by a pueue task.
+  The CLI talks to it via Claude Code's channels API: a Bun MCP plugin that
+  pushes events into the session and receives Claude's responses through a
+  \`reply\` MCP tool.
+
+USAGE
+  synkro local-cc <subcommand> [args]
+
+SUBCOMMANDS
+  enable                Install plugin, start pueue task, flip toggle to local-cc
+  disable               Flip toggle back to inngest (pueue task left running)
+  status                Show provider toggle, pueue task state, channel reachability
+  start                 Idempotently bring up the pueue task + wait for the channel
+  stop                  Kill the tmux session and remove the pueue task
+  restart               stop, then start
+  install               Regenerate ~/.synkro/cc_sessions/ files (plugin, runner, settings)
+  logs [N] [--raw] [--live]
+                        Show the last N (default 20) channel turns: when, role,
+                        duration, severity, request preview.
+                        --raw / -r   include full request/response payloads
+                        --live / -f  tail the log; print new turns as they arrive
+                                     (Ctrl-C to exit)
+                        --tmux       escape hatch \u2014 print the raw pueue/tmux
+                                     pane log instead
+  attach [--readonly]   Attach to the tmux session hosting claude (Ctrl-B D to detach;
+                        --readonly / -r to attach view-only)
+  test                  Send a smoke-test classification through the channel
+  help                  Show this message
+
+CONFIGURATION
+  Provider toggle (single global switch, default 'inngest'):
+    Stored in ${dbPath} (settings table, key='inference_provider').
+    Toggle via:  synkro local-cc enable / disable
+    Or directly via SQL:
+      INSERT OR REPLACE INTO settings (key, value) VALUES ('inference_provider', 'local-cc');
+
+  Claude Code session settings (scoped to ~/.synkro/cc_sessions only):
+    ${PLUGIN_SETTINGS_PATH}
+    Currently sets {"fastMode": true}. Edit to add other CC settings for this
+    session without affecting your other CC projects.
+
+  MCP server registration (for the channel plugin):
+    ${CLAUDE_JSON_PATH}
+    A 'synkro-local' entry under mcpServers, pointing at:
+      bun ${PLUGIN_PATH}
+    Workspace trust is also pre-accepted under projects[\`${SESSION_DIR}\`].
+
+  Channel runtime files:
+    ${RUN_SCRIPT_PATH}
+      bash wrapper that pueue invokes; owns the tmux session lifecycle.
+    ${PLUGIN_PATH}
+      Bun MCP channel plugin (auto-generated, do not edit).
+    127.0.0.1:${CHANNEL_PORT}
+      Loopback TCP endpoint the CLI POSTs to in order to submit a request.
+
+ENVIRONMENT VARIABLES
+  SYNKRO_CHANNEL_PORT       Override the TCP port used by both the plugin and
+                            the CLI client (loopback only). Default: 8929
+  SYNKRO_CHANNEL_TIMEOUT_MS Per-request timeout inside the channel plugin
+                            (default: 120000)
+
+REQUIRED TOOLS
+  claude    Claude Code CLI, authenticated to your subscription
+  pueue     pueue + pueued (https://github.com/Nukesor/pueue) running
+  tmux      For detached pty around claude
+  bun       Runtime for the MCP channel plugin
+
+TROUBLESHOOTING
+  \u2022 Channel unreachable after \`enable\`?
+      synkro local-cc logs           # check pueue task output
+      tmux attach -t ${TMUX_SESSION_NAME}    # see what claude is showing
+  \u2022 Stale state after a crash:
+      synkro local-cc stop && synkro local-cc start
+  \u2022 Want to inspect or interact with the live session:
+      synkro local-cc attach
+`);
+}
+async function cmdStatus() {
+  console.log(`Inference provider: ${getInferenceProvider()}`);
+  try {
+    assertPueueInstalled();
+  } catch (err) {
+    console.log(`Pueue: NOT AVAILABLE (${err.message})`);
+    return;
+  }
+  const t = findTask();
+  if (!t) {
+    console.log("Pueue task: not present");
+  } else {
+    console.log(`Pueue task: id=${t.id} status=${t.status} cwd=${t.cwd}`);
+    console.log(`  command: ${t.command}`);
+  }
+  const channelUp = await isChannelAvailable();
+  console.log(`Channel ${CHANNEL_HOST}:${CHANNEL_PORT}: ${channelUp ? "reachable" : "unreachable"}`);
+  const tmuxCheck = spawnSync3("tmux", ["has-session", "-t", TMUX_SESSION_NAME], { encoding: "utf-8" });
+  console.log(`tmux session '${TMUX_SESSION_NAME}': ${tmuxCheck.status === 0 ? "live" : "absent"}`);
+}
+async function cmdEnable() {
+  assertClaudeInstalled();
+  assertPueueInstalled();
+  assertTmuxInstalled();
+  console.log("Installing local-CC channel plugin...");
+  const r = installLocalCC();
+  console.log(`  plugin: ${r.pluginPath}`);
+  console.log(`  cwd:    ${r.sessionDir}`);
+  console.log("Starting pueue task...");
+  const t = ensureRunning();
+  console.log(`  task: id=${t.id} status=${t.status}`);
+  console.log("Waiting for channel (auto-confirming any CC prompts)...");
+  const ready = await waitForChannelReady(CHANNEL_PORT, 6e4, CHANNEL_HOST);
+  if (ready) console.log(`  channel ready at ${CHANNEL_HOST}:${CHANNEL_PORT}`);
+  else console.warn(`  \u26A0 channel did not come up within 60s \u2014 check \`synkro local-cc logs\``);
+  setInferenceProvider("local-cc");
+  console.log("Inference provider set to local-cc.");
+}
+function cmdDisable() {
+  setInferenceProvider("inngest");
+  console.log("Inference provider set to inngest. (Pueue task left running \u2014 use `synkro local-cc stop` to terminate.)");
+}
+async function cmdStart() {
+  assertClaudeInstalled();
+  assertPueueInstalled();
+  assertTmuxInstalled();
+  const t = ensureRunning();
+  console.log(`Pueue task: id=${t.id} status=${t.status}`);
+  const ready = await waitForChannelReady(CHANNEL_PORT, 6e4, CHANNEL_HOST);
+  console.log(ready ? "channel ready." : "\u26A0 channel did not come up within 60s.");
+}
+function cmdStop() {
+  stopTask();
+  console.log("Pueue task stopped.");
+}
+async function cmdRestart() {
+  stopTask();
+  const t = startTask();
+  console.log(`Pueue task restarted: id=${t.id} status=${t.status}`);
+  const ready = await waitForChannelReady(CHANNEL_PORT, 6e4, CHANNEL_HOST);
+  console.log(ready ? "channel ready." : "\u26A0 channel did not come up within 60s.");
+}
+function relativeTime(iso) {
+  const ts = new Date(iso).getTime();
+  if (!Number.isFinite(ts)) return iso;
+  const sec = Math.max(0, Math.round((Date.now() - ts) / 1e3));
+  if (sec < 60) return `${sec}s ago`;
+  if (sec < 3600) return `${Math.round(sec / 60)}m ago`;
+  if (sec < 86400) return `${Math.round(sec / 3600)}h ago`;
+  return `${Math.round(sec / 86400)}d ago`;
+}
+function colorize(s, code) {
+  if (!process.stdout.isTTY) return s;
+  return `\x1B[${code}m${s}\x1B[0m`;
+}
+function statusGlyph(t) {
+  if (t.status === "ok") return colorize("\u2713", 32);
+  if (t.status === "timeout") return colorize("\u23F1", 33);
+  return colorize("\u2717", 31);
+}
+function severityCell(t) {
+  if (t.severity) {
+    const sev = t.severity;
+    if (sev === "block" || sev === "violations" || sev === "unclear") return colorize(sev, 33);
+    return colorize(sev, 36);
+  }
+  if (t.error) return colorize(t.error.slice(0, 40), 31);
+  return "\u2014";
+}
+function firstLine(s) {
+  return s.split("\n").find((l) => l.trim().length > 0)?.trim() ?? "";
+}
+function formatTurn(t, raw) {
+  const when = relativeTime(t.ts).padEnd(8);
+  const dur = (t.duration_ms < 1e3 ? `${t.duration_ms}ms` : `${(t.duration_ms / 1e3).toFixed(1)}s`).padStart(7);
+  const role = t.role.padEnd(24);
+  const sev = severityCell(t).padEnd(20);
+  const preview = (() => {
+    const req = firstLine(t.request_preview).slice(0, 60);
+    return colorize(req, 90);
+  })();
+  const head = `${statusGlyph(t)} ${when} ${dur} ${role} ${sev} ${preview}`;
+  if (!raw) return head;
+  const blocks = [head];
+  blocks.push(colorize("  request:", 90));
+  blocks.push("    " + t.request_preview.replace(/\n/g, "\n    "));
+  if (t.response_preview) {
+    blocks.push(colorize("  response:", 90));
+    blocks.push("    " + t.response_preview.replace(/\n/g, "\n    "));
+  }
+  if (t.error) {
+    blocks.push(colorize("  error:", 31) + " " + t.error);
+  }
+  return blocks.join("\n");
+}
+function cmdLogs(rest) {
+  let n = 20;
+  let raw = false;
+  let live = false;
+  for (const arg of rest) {
+    if (arg === "--raw" || arg === "-r") raw = true;
+    else if (arg === "--live" || arg === "-f") live = true;
+    else if (arg === "--tmux") {
+      console.log(tailLogs(80));
+      return;
+    } else {
+      const parsed = parseInt(arg, 10);
+      if (parsed > 0) n = parsed;
+    }
+  }
+  const header = "  " + colorize("status when     dur     role                     severity             request", 90);
+  const turns = readRecentTurns(n);
+  if (turns.length === 0) {
+    if (!live) {
+      console.log(`No turns logged yet at ${TURN_LOG_PATH}.`);
+      console.log("Run a few requests through the channel (synkro local-cc test) and try again.");
+      return;
+    }
+    console.log(`No turns logged yet at ${TURN_LOG_PATH} \u2014 waiting for new entries\u2026 (Ctrl-C to exit)`);
+  } else {
+    console.log(`Last ${turns.length} channel turn(s) (newest first):`);
+    console.log(header);
+    for (const t of turns) console.log("  " + formatTurn(t, raw));
+  }
+  if (!live) {
+    if (!raw) console.log("  " + colorize("(use --raw / -r to see full payloads, --live / -f to follow)", 90));
+    return;
+  }
+  return new Promise((resolve2) => {
+    console.log("  " + colorize("\u2014 following new turns (Ctrl-C to exit) \u2014", 90));
+    const stop = followTurns((t) => {
+      console.log("  " + formatTurn(t, raw));
+    });
+    const onSigint = () => {
+      stop();
+      process.removeListener("SIGINT", onSigint);
+      resolve2();
+    };
+    process.on("SIGINT", onSigint);
+  });
+}
+function cmdAttach(rest) {
+  assertTmuxInstalled();
+  const readonly = rest.some((a) => a === "--readonly" || a === "-r");
+  const has = spawnSync3("tmux", ["has-session", "-t", TMUX_SESSION_NAME], { encoding: "utf-8" });
+  if (has.status !== 0) {
+    console.error(`No tmux session '${TMUX_SESSION_NAME}' running. Start it with: synkro local-cc start`);
+    process.exit(1);
+  }
+  if (!process.stdout.isTTY) {
+    console.error("attach requires a TTY. Run this command directly in your terminal, not piped.");
+    process.exit(1);
+  }
+  console.log(`Attaching to tmux session '${TMUX_SESSION_NAME}'${readonly ? " (read-only)" : ""}.`);
+  console.log("Detach with Ctrl-B then D. (Do not press Ctrl-C \u2014 that would interrupt claude.)");
+  console.log();
+  const args2 = readonly ? ["attach-session", "-r", "-t", TMUX_SESSION_NAME] : ["attach-session", "-t", TMUX_SESSION_NAME];
+  const r = spawnSync3("tmux", args2, { stdio: "inherit" });
+  process.exit(r.status ?? 0);
+}
+async function cmdTest() {
+  console.log("Sending smoke-test grading request through the channel...");
+  const result = await submitToChannel(
+    "grade-bash",
+    'Command: echo "hello world"\nIntent: testing channel connectivity'
+  );
+  console.log("Raw reply:");
+  console.log(result);
+}
+function cmdInstall() {
+  const r = installLocalCC();
+  console.log(`Reinstalled plugin at ${r.pluginPath}`);
+}
+async function localCcCommand(args2) {
+  const sub = args2[0] ?? "";
+  try {
+    switch (sub) {
+      case "enable":
+        await cmdEnable();
+        break;
+      case "disable":
+        cmdDisable();
+        break;
+      case "status":
+        await cmdStatus();
+        break;
+      case "start":
+        await cmdStart();
+        break;
+      case "stop":
+        cmdStop();
+        break;
+      case "restart":
+        await cmdRestart();
+        break;
+      case "install":
+        cmdInstall();
+        break;
+      case "logs":
+        await cmdLogs(args2.slice(1));
+        break;
+      case "attach":
+        cmdAttach(args2.slice(1));
+        break;
+      case "test":
+        await cmdTest();
+        break;
+      case "":
+      case "help":
+      case "--help":
+      case "-h":
+        printHelp();
+        break;
+      default:
+        console.error(`Unknown subcommand: ${sub}`);
+        printHelp();
+        process.exit(1);
+    }
+  } catch (err) {
+    console.error(err.message);
+    process.exit(1);
+  }
+}
+var init_localCc = __esm({
+  "cli/commands/localCc.ts"() {
+    "use strict";
     init_install();
+    init_turnLog();
+    init_pueue();
+    init_settings();
+    init_client();
+  }
+});
+
+// cli/commands/grade.ts
+var grade_exports = {};
+__export(grade_exports, {
+  gradeCommand: () => gradeCommand
+});
+async function readStdin() {
+  return new Promise((resolve2, reject) => {
+    const chunks = [];
+    process.stdin.on("data", (c) => chunks.push(c));
+    process.stdin.on("end", () => resolve2(Buffer.concat(chunks).toString("utf-8")));
+    process.stdin.on("error", reject);
+  });
+}
+async function gradeCommand(args2) {
+  const mode = args2[0] ?? "";
+  let role;
+  if (mode === "edit") role = "grade-edit";
+  else if (mode === "bash") role = "grade-bash";
+  else {
+    console.error("Usage: synkro grade <edit|bash>");
+    process.exit(2);
+  }
+  const payload = await readStdin();
+  if (!payload.trim()) {
+    console.error("synkro grade: empty stdin");
+    process.exit(2);
+  }
+  try {
+    const result = await submitToChannel(role, payload, { timeoutMs: 6e4 });
+    process.stdout.write(result);
+    if (!result.endsWith("\n")) process.stdout.write("\n");
+  } catch (err) {
+    if (err instanceof LocalCCError) {
+      console.error(`synkro grade: ${err.message}`);
+    } else {
+      console.error(`synkro grade: ${err.message}`);
+    }
+    process.exit(3);
+  }
+}
+var init_grade = __esm({
+  "cli/commands/grade.ts"() {
+    "use strict";
+    init_client();
   }
 });
 
 // cli/bootstrap.js
-import { readFileSync as readFileSync9, existsSync as existsSync12 } from "fs";
+import { readFileSync as readFileSync13, existsSync as existsSync17 } from "fs";
 import { resolve } from "path";
 var envCandidates = [
   resolve(process.cwd(), ".env"),
   resolve(process.env.HOME ?? "", ".synkro", "config.env")
 ];
 for (const envPath of envCandidates) {
-  if (!existsSync12(envPath)) continue;
-  const envContent = readFileSync9(envPath, "utf-8");
+  if (!existsSync17(envPath)) continue;
+  const envContent = readFileSync13(envPath, "utf-8");
   for (const line of envContent.split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -5763,7 +6570,7 @@ for (const envPath of envCandidates) {
 var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
-function printHelp() {
+function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents
 
 Usage:
@@ -5783,6 +6590,8 @@ Commands:
   disconnect [--purge] Remove Synkro hooks from agents (--purge also removes ~/.synkro)
   uninstall            Fully remove Synkro from this machine
   reinstall            Clean uninstall + fresh install
+  local-cc <sub>       Manage the local Claude Code inference session (enable/disable/status/start/stop/logs/test)
+  grade <edit|bash>    Internal: read prompt from stdin, return verdict (called by hook scripts)
   help                 Show this message
 
 Quick start:
@@ -5795,7 +6604,7 @@ Quick start:
 async function main() {
   switch (cmd) {
     case "install": {
-      const { installCommand: installCommand2, parseArgs: parseArgs2 } = await Promise.resolve().then(() => (init_install(), install_exports));
+      const { installCommand: installCommand2, parseArgs: parseArgs2 } = await Promise.resolve().then(() => (init_install2(), install_exports));
       await installCommand2(parseArgs2(subArgs));
       break;
     }
@@ -5866,16 +6675,26 @@ async function main() {
       await reinstallCommand2();
       break;
     }
+    case "local-cc": {
+      const { localCcCommand: localCcCommand2 } = await Promise.resolve().then(() => (init_localCc(), localCc_exports));
+      await localCcCommand2(subArgs);
+      break;
+    }
+    case "grade": {
+      const { gradeCommand: gradeCommand2 } = await Promise.resolve().then(() => (init_grade(), grade_exports));
+      await gradeCommand2(subArgs);
+      break;
+    }
     case "help":
     case "--help":
     case "-h":
     case "": {
-      printHelp();
+      printHelp2();
       break;
     }
     default: {
       console.error(`Unknown command: ${cmd}`);
-      printHelp();
+      printHelp2();
       process.exit(1);
     }
   }