@synkro-sh/cli 1.6.10 → 1.6.12

package/dist/bootstrap.js

@@ -990,6 +990,12 @@ export interface HookConfig {
   policyName: string;
   rules: Rule[];
   scanExemptions: Array<{ path: string; cwe_id: string }>;
+  // User-owned data axes. gradingMode: 'local' (container worker pool) | 'byok'
+  // (LLM API with the user's own key). storageMode: 'local' (PGLite) | 'cloud'
+  // (Timescale). Sourced from config.env (the installed choice); the server
+  // value from /v1/hook/config is only a fallback when the env var is unset.
+  gradingMode: string;
+  storageMode: string;
 }
 
 export async function loadConfig(jwt: string, query?: string): Promise<HookConfig> {
@@ -1000,6 +1006,8 @@ export async function loadConfig(jwt: string, query?: string): Promise<HookConfi
     policyName: '',
     rules: [],
     scanExemptions: [],
+    gradingMode: process.env.SYNKRO_GRADING_MODE || 'local',
+    storageMode: process.env.SYNKRO_STORAGE_MODE || 'local',
   };
 
   // Kick the telemetry spool drainer. Fire-and-forget: it runs concurrently
@@ -1047,6 +1055,9 @@ export async function loadConfig(jwt: string, query?: string): Promise<HookConfi
     config.captureDepth = data.capture_depth || 'local_only';
     config.tier = data.tier || 'standard';
     config.silent = data.silent_mode === true || data.silent_mode === 'true';
+    // Env var (config.env, the installed choice) wins; server value is fallback.
+    if (!process.env.SYNKRO_GRADING_MODE && data.grading_mode) config.gradingMode = data.grading_mode;
+    if (!process.env.SYNKRO_STORAGE_MODE && data.storage_mode) config.storageMode = data.storage_mode;
     config.policyName = data.active_policy_name || '';
     if (Array.isArray(data.scan_exemptions)) {
       config.scanExemptions = data.scan_exemptions
@@ -1123,10 +1134,34 @@ async function channelGrade(role: GradeRole, prompt: string, _jwt: string, port:
   return String(data.result || '');
 }
 
+// BYOK grading \u2014 grade via the cloud /v1/grade endpoint, which runs the same
+// grader prompt through an LLM API using the org's own provider key. Any
+// non-2xx (incl. 422 when no key is configured) throws, so the caller's
+// existing catch falls open \u2014 never a hard block on a grader error.
+async function cloudGrade(surface: string, prompt: string, jwt: string, timeoutMs: number): Promise<string> {
+  const resp = await fetch(GATEWAY_URL + '/api/v1/grade', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
+    body: JSON.stringify({ surface, grader_prompt: prompt }),
+    signal: AbortSignal.timeout(timeoutMs),
+  });
+  if (!resp.ok) {
+    const text = await resp.text().catch(() => '');
+    throw new Error('cloud grade ' + resp.status + ': ' + text.slice(0, 200));
+  }
+  const data = await resp.json() as { verdict?: string };
+  return String(data.verdict || '');
+}
+
 export async function localGrade(surface: string, prompt: string, timeoutMs = 30000, agentKind: AgentKind = 'claude_code'): Promise<string> {
-  if (!(await channelUp())) throw new Error('SYNKRO_CHANNEL_DOWN');
   const jwt = loadJwt();
   if (!jwt) throw new Error('NO_JWT');
+  // BYOK grading mode routes the grade through an LLM API instead of the
+  // on-device channel worker pool. The grader prompt + parseVerdict are shared.
+  if ((process.env.SYNKRO_GRADING_MODE || 'local') === 'byok') {
+    return cloudGrade(surface, prompt, jwt, timeoutMs);
+  }
+  if (!(await channelUp())) throw new Error('SYNKRO_CHANNEL_DOWN');
   return channelGrade(ROLE_MAP[surface] || 'grade-edit', prompt, jwt, 18929, timeoutMs, agentKind);
 }
 
@@ -1518,6 +1553,19 @@ export function parseVerdict(resp: string): Verdict {
 
 // \u2500\u2500\u2500 Telemetry Dispatch \u2500\u2500\u2500
 
+// Gated cloud telemetry POST \u2014 fires only when storage mode is 'cloud'. The
+// local PGLite spool (appendLocalTelemetry) always gets the data regardless,
+// so 'local' storage keeps everything on the machine.
+function shipCloud(jwt: string, path: string, body: Record<string, any>, timeoutMs = 3000): void {
+  if ((process.env.SYNKRO_STORAGE_MODE || 'local') !== 'cloud') return;
+  fetch(GATEWAY_URL + path, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(timeoutMs),
+  }).catch(() => {});
+}
+
 export function dispatchCapture(
   jwt: string,
   hookType: string,
@@ -1540,9 +1588,6 @@ export function dispatchCapture(
   // Fire-and-forget
   const eventId = 'evt_' + Date.now() + '_' + process.pid;
   const model = opts?.ccModel || 'unknown';
-  const sendFull =
-    captureDepth === 'full' ||
-    (captureDepth === 'evidence_on_violation' && ['block', 'warning', 'deny'].includes(verdictStr));
 
   const body: Record<string, any> = {
     capture_type: 'local_verdict',
@@ -1570,24 +1615,16 @@ export function dispatchCapture(
   }
   appendLocalTelemetry(localBody);
 
-  // local_only: no data leaves the machine
-  if (captureDepth === 'local_only') return;
-
-  if (sendFull && opts) {
-    body.capture_depth = captureDepth;
+  // Cloud copy carries the same full content as the local spool; shipCloud
+  // gates on storage mode (no-op when storage is local).
+  if (opts) {
     if (opts.command) body.command = opts.command;
     if (opts.reasoning) body.reasoning = opts.reasoning;
     if (opts.rulesChecked) body.rules_checked = opts.rulesChecked;
     if (opts.violatedRules) body.violated_rules = opts.violatedRules;
     if (opts.recentUserMessages) body.recent_user_messages = opts.recentUserMessages;
   }
-
-  fetch(GATEWAY_URL + '/api/v1/hook/capture', {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
-    body: JSON.stringify(body),
-    signal: AbortSignal.timeout(3000),
-  }).catch(() => {});
+  shipCloud(jwt, '/api/v1/hook/capture', body);
 }
 
 // \u2500\u2500\u2500 Durable Telemetry Spool \u2500\u2500\u2500
@@ -2059,36 +2096,24 @@ export function dispatchFinding(
   };
   appendLocalTelemetry(localEntry);
 
-  if (captureDepth === 'local_only') return;
-
+  // Cloud copy carries the full finding; shipCloud gates on storage mode.
   const cloudBody: Record<string, any> = {
     finding_type: finding.finding_type,
     finding_id: finding.finding_id,
     severity: finding.severity,
     status: finding.status,
     session_id: finding.session_id,
+    file_path: finding.file_path,
+    package_name: finding.package_name,
+    package_version: finding.package_version,
+    fixed_version: finding.fixed_version,
+    aliases: finding.aliases,
+    references: finding.references,
+    cwe_name: finding.cwe_name,
+    detail: finding.detail,
+    description: finding.description,
   };
-
-  if (captureDepth === 'evidence_on_violation' || captureDepth === 'full') {
-    cloudBody.file_path = finding.file_path;
-    cloudBody.package_name = finding.package_name;
-    cloudBody.package_version = finding.package_version;
-    cloudBody.fixed_version = finding.fixed_version;
-    cloudBody.aliases = finding.aliases;
-    cloudBody.references = finding.references;
-    cloudBody.cwe_name = finding.cwe_name;
-  }
-  if (captureDepth === 'full') {
-    cloudBody.detail = finding.detail;
-    cloudBody.description = finding.description;
-  }
-
-  fetch(GATEWAY_URL + '/api/v1/hook/finding', {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
-    body: JSON.stringify(cloudBody),
-    signal: AbortSignal.timeout(3000),
-  }).catch(() => {});
+  shipCloud(jwt, '/api/v1/hook/finding', cloudBody);
 }
 
 // \u2500\u2500\u2500 Hook tool-name sets (CC + Cursor) \u2500\u2500\u2500
@@ -3744,12 +3769,7 @@ async function main() {
           ...(sessionId ? { session_id: sessionId } : {}),
         };
         appendLocalTelemetry(usageBody);
-        fetch(GATEWAY_URL + '/api/v1/hook/capture', {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
-          body: JSON.stringify(usageBody),
-          signal: AbortSignal.timeout(3000),
-        }).catch(() => {});
+        shipCloud(jwt, '/api/v1/hook/capture', usageBody);
       }
     }
 
@@ -3910,16 +3930,7 @@ async function main() {
     };
 
     appendLocalTelemetry(body);
-
-    const config = await loadConfig(jwt);
-    if (config.captureDepth !== 'local_only') {
-      fetch(GATEWAY_URL + '/api/v1/hook/capture', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
-        body: JSON.stringify(body),
-        signal: AbortSignal.timeout(3000),
-      }).catch(() => {});
-    }
+    shipCloud(jwt, '/api/v1/hook/capture', body);
 
     outputEmpty();
   } catch {
@@ -3932,7 +3943,7 @@ main();
     TRANSCRIPT_SYNC_TS = `#!/usr/bin/env bun
 import {
   loadJwt, detectRepo, readStdin, aggregateUsage, appendLocalTelemetry,
-  outputEmpty, setupCursorHookSignals, hookSessionId, GATEWAY_URL,
+  outputEmpty, setupCursorHookSignals, hookSessionId, GATEWAY_URL, readSessionLog,
 } from './_synkro-common.ts';
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join, dirname } from 'node:path';
@@ -3976,12 +3987,7 @@ async function main() {
         session_id: sessionId,
       };
       appendLocalTelemetry(usageBody);
-      fetch(GATEWAY_URL + '/api/v1/hook/capture', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
-        body: JSON.stringify(usageBody),
-        signal: AbortSignal.timeout(3000),
-      }).catch(() => {});
+      shipCloud(jwt, '/api/v1/hook/capture', usageBody);
     }
 
     // Transcript consent gates only CLOUD transmission. Local persistence \u2014
@@ -4056,25 +4062,19 @@ async function main() {
       }).catch(() => {});
     }
 
-    // Cloud sync \u2014 only when consented and the org isn't local-only.
-    if (cloudConsent && gitRepo) {
-      let captureDepth = 'local_only';
-      try {
-        const r = await fetch(GATEWAY_URL + '/api/v1/hook/config', {
-          headers: { Authorization: 'Bearer ' + jwt },
-          signal: AbortSignal.timeout(3000),
-        });
-        const data = await r.json() as any;
-        captureDepth = data.capture_depth || 'local_only';
-      } catch {}
-      if (captureDepth !== 'local_only') {
-        fetch(GATEWAY_URL + '/api/v1/cli/sync-transcripts', {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
-          body: JSON.stringify({ repo: gitRepo, sessions: [{ cc_session_id: sessionId, messages }] }),
-          signal: AbortSignal.timeout(10000),
-        }).catch(() => {});
-      }
+    // Cloud sync \u2014 only when storage mode is cloud (and transcript consent
+    // wasn't declined). Carries the transcript + the session step-log so cloud
+    // storage matches the local PGLite shape.
+    if (cloudConsent && gitRepo && (process.env.SYNKRO_STORAGE_MODE || 'local') === 'cloud') {
+      fetch(GATEWAY_URL + '/api/v1/cli/sync-transcripts', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
+        body: JSON.stringify({
+          repo: gitRepo,
+          sessions: [{ cc_session_id: sessionId, messages, actions: readSessionLog(sessionId) }],
+        }),
+        signal: AbortSignal.timeout(10000),
+      }).catch(() => {});
     }
 
     outputEmpty();
@@ -4511,12 +4511,7 @@ async function main() {
     if (repo) captureBody.repo = repo;
 
     appendLocalTelemetry(captureBody);
-    fetch(GATEWAY_URL + '/api/v1/hook/capture', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
-      body: JSON.stringify(captureBody),
-      signal: AbortSignal.timeout(10000),
-    }).catch(() => {});
+    shipCloud(jwt, '/api/v1/hook/capture', captureBody, 10000);
 
     finish();
   } catch (e) {
@@ -5281,459 +5276,96 @@ var init_repoConnect = __esm({
   }
 });
 
-// cli/commands/setupGithub.ts
-var setupGithub_exports = {};
-__export(setupGithub_exports, {
-  connectGitHub: () => connectGitHub,
-  setupGithubCommand: () => setupGithubCommand
-});
-import { createInterface as createInterface2 } from "readline/promises";
-import { stdin as input, stdout as output } from "process";
-import { execSync as execSync4, spawn as nodeSpawn } from "child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync5, unlinkSync as unlinkSync3 } from "fs";
-import { homedir as homedir5, platform as platform2 } from "os";
-import { join as join5 } from "path";
-import { execFile as execFile2 } from "child_process";
-function readConfig() {
-  if (!existsSync6(CONFIG_PATH)) return {};
-  const out = {};
-  for (const line of readFileSync5(CONFIG_PATH, "utf-8").split("\n")) {
-    const t = line.trim();
-    if (!t || t.startsWith("#")) continue;
-    const eq = t.indexOf("=");
-    if (eq > 0) out[t.slice(0, eq).trim()] = t.slice(eq + 1).trim().replace(/^['"]|['"]$/g, "");
+// cli/installer/promptFetcher.ts
+async function fetchJudgePrompts(opts) {
+  const url = `${opts.gatewayUrl.replace(/\/$/, "")}/api/v1/hook/config`;
+  const resp = await fetch(url, {
+    method: "GET",
+    headers: {
+      "Authorization": `Bearer ${opts.jwt}`,
+      "User-Agent": "synkro-cli/1.0"
+    },
+    signal: AbortSignal.timeout(5e3)
+  });
+  if (!resp.ok) {
+    return { version: "unknown" };
   }
-  return out;
+  const data = await resp.json();
+  return { version: data.prompts?.version ?? "unknown" };
 }
-async function prompt(rl, q, opts = {}) {
-  if (opts.silent) {
-    process.stdout.write(q);
-    const wasRaw = process.stdin.isRaw;
-    if (process.stdin.setRawMode) process.stdin.setRawMode(true);
-    return await new Promise((resolve3) => {
-      let chunk = "";
-      const onData = (data) => {
-        const s = data.toString("utf-8");
-        if (s === "\r" || s === "\n" || s === "\r\n") {
-          process.stdin.removeListener("data", onData);
-          if (process.stdin.setRawMode) process.stdin.setRawMode(wasRaw ?? false);
-          process.stdout.write("\n");
-          resolve3(chunk);
-          return;
-        }
-        if (s === "") process.exit(130);
-        if (s === "\x7F" || s === "\b") {
-          chunk = chunk.slice(0, -1);
-          return;
-        }
-        chunk += s;
-      };
-      process.stdin.on("data", onData);
-    });
+var init_promptFetcher = __esm({
+  "cli/installer/promptFetcher.ts"() {
+    "use strict";
   }
-  return await rl.question(q);
+});
+
+// cli/local-cc/macKeychain.ts
+var macKeychain_exports = {};
+__export(macKeychain_exports, {
+  CLAUDE_CREDS_DIR: () => CLAUDE_CREDS_DIR,
+  CLAUDE_CREDS_FILE: () => CLAUDE_CREDS_FILE,
+  CURSOR_API_KEY_FILE: () => CURSOR_API_KEY_FILE,
+  CURSOR_CREDS_DIR: () => CURSOR_CREDS_DIR,
+  KeychainExportError: () => KeychainExportError,
+  SYNKRO_DIR: () => SYNKRO_DIR,
+  credsAreStale: () => credsAreStale,
+  cursorApiKeyConfigured: () => cursorApiKeyConfigured,
+  exportKeychainCreds: () => exportKeychainCreds,
+  loadRefreshAgent: () => loadRefreshAgent,
+  needsKeychainBridge: () => needsKeychainBridge,
+  readExportedCreds: () => readExportedCreds,
+  readKeychainCreds: () => readKeychainCreds,
+  refreshCreds: () => refreshCreds,
+  uninstallRefreshAgent: () => uninstallRefreshAgent,
+  validateCursorApiKey: () => validateCursorApiKey,
+  writeCursorApiKey: () => writeCursorApiKey,
+  writeRefreshAgent: () => writeRefreshAgent
+});
+import { existsSync as existsSync6, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, chmodSync, readFileSync as readFileSync5, statSync } from "fs";
+import { homedir as homedir5, platform as platform2 } from "os";
+import { join as join5 } from "path";
+import { spawnSync } from "child_process";
+function needsKeychainBridge() {
+  return platform2() === "darwin";
 }
-function openBrowser3(url) {
-  const os = platform2();
-  let bin;
-  let args2;
-  switch (os) {
-    case "darwin":
-      bin = "open";
-      args2 = [url];
-      break;
-    case "win32":
-      bin = "cmd";
-      args2 = ["/c", "start", "", url];
-      break;
-    default:
-      bin = "xdg-open";
-      args2 = [url];
-      break;
-  }
-  execFile2(bin, args2, () => {
+function readKeychainCreds() {
+  if (platform2() !== "darwin") return null;
+  const r = spawnSync("security", ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-w"], {
+    encoding: "utf-8",
+    timeout: 5e3
   });
+  if (r.status !== 0) return null;
+  const blob = (r.stdout || "").trim();
+  return blob || null;
 }
-function sleep(ms) {
-  return new Promise((r) => setTimeout(r, ms));
-}
-function captureClaudeSetupToken() {
-  const tmpFile = join5(SYNKRO_DIR, `token-capture-${Date.now()}.raw`);
-  return new Promise((resolve3, reject) => {
-    const proc = nodeSpawn("script", ["-q", tmpFile, "claude", "setup-token"], {
-      stdio: "inherit"
-    });
-    proc.on("error", (err) => reject(new Error(`Failed to spawn claude setup-token: ${err.message}`)));
-    proc.on("close", (code) => {
-      let raw = "";
-      try {
-        raw = readFileSync5(tmpFile, "utf-8");
-      } catch (e) {
-        reject(new Error(`Could not read script output file: ${e.message}`));
-        return;
-      }
-      try {
-        unlinkSync3(tmpFile);
-      } catch {
-      }
-      if (code !== 0) {
-        reject(new Error(`claude setup-token exited with code ${code}`));
-        return;
-      }
-      const yellowRe = /\x1B\[38;2;255;193;7m([^\x1B]*)/g;
-      let yellow = "";
-      let m;
-      while ((m = yellowRe.exec(raw)) !== null) yellow += m[1];
-      const token = yellow.replace(/\s/g, "").match(/sk-ant-oat01-[A-Za-z0-9_-]+/);
-      if (!token) {
-        reject(new Error(`Could not find token in claude setup-token output (file=${raw.length}b, yellow=${yellow.length}b)`));
-        return;
-      }
-      resolve3(token[0]);
-    });
-  });
+function exportKeychainCreds() {
+  const blob = readKeychainCreds();
+  if (!blob) return null;
+  mkdirSync6(CLAUDE_CREDS_DIR, { recursive: true });
+  chmodSync(CLAUDE_CREDS_DIR, 448);
+  writeFileSync6(CLAUDE_CREDS_FILE, blob, "utf-8");
+  chmodSync(CLAUDE_CREDS_FILE, 384);
+  return CLAUDE_CREDS_FILE;
 }
-async function apiCall(gatewayUrl, jwt2, path, opts = {}) {
-  const resp = await fetch(`${gatewayUrl}${path}`, {
-    ...opts,
-    headers: {
-      "Authorization": `Bearer ${jwt2}`,
-      "Content-Type": "application/json",
-      ...opts.headers || {}
-    }
-  });
-  if (!resp.ok) {
-    const text = await resp.text().catch(() => "");
-    throw new Error(`API ${resp.status}: ${text.slice(0, 200)}`);
+function cursorApiKeyConfigured() {
+  try {
+    return existsSync6(CURSOR_API_KEY_FILE) && readFileSync5(CURSOR_API_KEY_FILE, "utf-8").trim().length > 0;
+  } catch {
+    return false;
   }
-  return resp.json();
 }
-async function connectGitHub(gatewayUrl, jwt2, opts = {}) {
+function writeCursorApiKey(key) {
+  const trimmed = key.trim();
+  if (!trimmed) return;
+  mkdirSync6(CURSOR_CREDS_DIR, { recursive: true });
+  chmodSync(CURSOR_CREDS_DIR, 448);
+  writeFileSync6(CURSOR_API_KEY_FILE, trimmed, "utf-8");
+  chmodSync(CURSOR_API_KEY_FILE, 384);
+}
+async function validateCursorApiKey() {
+  let key;
   try {
-    const result = await apiCall(
-      gatewayUrl,
-      jwt2,
-      "/api/v1/cli/github-token"
-    );
-    if (result.connected && result.token) {
-      if (!opts.silent) console.log("  \u2713 GitHub already connected via Synkro.");
-      return result.token;
-    }
-  } catch {
-  }
-  if (!opts.silent) console.log("  Opening browser to authorize GitHub...");
-  try {
-    const authResp = await apiCall(
-      gatewayUrl,
-      jwt2,
-      "/api/pipes-widget/authorize/github",
-      { method: "POST", body: "{}" }
-    );
-    openBrowser3(authResp.url);
-    if (!opts.silent) console.log("  Waiting for authorization...");
-  } catch (err) {
-    if (!opts.silent) console.error(`  Failed to start GitHub authorization: ${err.message}`);
-    return null;
-  }
-  const deadline = Date.now() + 12e4;
-  while (Date.now() < deadline) {
-    await sleep(2e3);
-    try {
-      const result = await apiCall(
-        gatewayUrl,
-        jwt2,
-        "/api/v1/cli/github-token"
-      );
-      if (result.connected && result.token) {
-        if (!opts.silent) console.log("\n  \u2713 GitHub connected!");
-        return result.token;
-      }
-    } catch {
-    }
-    if (!opts.silent) process.stdout.write(".");
-  }
-  if (!opts.silent) console.error("\n  Timed out waiting for GitHub authorization.");
-  return null;
-}
-async function setupGithubCommand(opts = {}) {
-  if (!isAuthenticated()) {
-    console.error("Not authenticated. Run `synkro-cli login` first.");
-    process.exit(1);
-  }
-  const config = readConfig();
-  const gatewayUrl = (config.SYNKRO_GATEWAY_URL || process.env.SYNKRO_GATEWAY_URL || "https://api.synkro.sh").replace(/\/$/, "");
-  const jwt2 = getAccessToken();
-  if (!jwt2) {
-    console.error("Could not load access token from ~/.synkro/credentials.json. Run `synkro-cli login`.");
-    process.exit(1);
-  }
-  console.log("Requesting CI API key from Synkro...");
-  let synkroCiApiKey;
-  try {
-    const minted = await apiCall(
-      gatewayUrl,
-      jwt2,
-      "/api/v1/cli/ci-api-key",
-      { method: "POST", body: "{}" }
-    );
-    synkroCiApiKey = minted.api_key;
-    console.log(`  \u2713 Issued CI key (${synkroCiApiKey.slice(0, 18)}\u2026), expires ${minted.expires_at.slice(0, 10)}`);
-  } catch (err) {
-    console.error(`Failed to mint CI API key: ${err.message}`);
-    process.exit(1);
-  }
-  let ghToken;
-  if (opts.githubToken) {
-    ghToken = opts.githubToken;
-  } else if (opts.nonInteractive) {
-    try {
-      const result = await apiCall(
-        gatewayUrl,
-        jwt2,
-        "/api/v1/cli/github-token"
-      );
-      if (result.connected && result.token) {
-        ghToken = result.token;
-      } else {
-        throw new Error("not connected");
-      }
-    } catch {
-      try {
-        ghToken = execSync4("gh auth token", { encoding: "utf-8", timeout: 5e3 }).trim();
-      } catch {
-        console.error("GitHub not connected. Run `synkro-cli setup-github` interactively to connect.");
-        return;
-      }
-    }
-  } else {
-    console.log("\nConnecting to GitHub...");
-    const token = await connectGitHub(gatewayUrl, jwt2);
-    if (!token) {
-      console.error("GitHub connection failed. Try again.");
-      process.exit(1);
-    }
-    ghToken = token;
-    console.log();
-  }
-  let claudeToken;
-  if (!opts.skipClaudeToken) {
-    console.log("Generating Claude Code OAuth token...");
-    console.log("  A browser window will open \u2014 authorize with your Claude account.\n");
-    try {
-      claudeToken = await captureClaudeSetupToken();
-    } catch (err) {
-      console.error(`Failed to get Claude token: ${err instanceof Error ? err.message : String(err)}`);
-      if (opts.nonInteractive) return;
-      process.exit(1);
-    }
-    if (!claudeToken.startsWith("sk-ant-oat01-")) {
-      console.error("Invalid token received from `claude setup-token`. Expected sk-ant-oat01-...");
-      if (opts.nonInteractive) return;
-      process.exit(1);
-    }
-    console.log("  Validating token...");
-    try {
-      const validateResult = execSync4(
-        'claude --print --output-format json "say ok"',
-        { env: { ...process.env, CLAUDE_CODE_OAUTH_TOKEN: claudeToken }, encoding: "utf-8", timeout: 3e4, stdio: ["ignore", "pipe", "pipe"] }
-      );
-      const result = JSON.parse(validateResult);
-      if (result.is_error) throw new Error(result.result || "auth failed");
-      console.log("  \u2713 Token validated.\n");
-    } catch (err) {
-      console.error(`Token validation failed: ${err instanceof Error ? err.message : String(err)}`);
-      if (opts.nonInteractive) return;
-      process.exit(1);
-    }
-  }
-  let selected;
-  if (opts.nonInteractive) {
-    let currentFullName = null;
-    try {
-      const remoteUrl = execSync4("git remote get-url origin", { encoding: "utf-8", timeout: 5e3 }).trim();
-      const m = remoteUrl.match(/(?:github\.com)[:/](.+?)(?:\.git)?$/);
-      if (m) currentFullName = m[1];
-    } catch {
-    }
-    if (!currentFullName) {
-      console.warn("  \u26A0 Not in a GitHub repo. Skipping PR scan setup.");
-      return;
-    }
-    const [owner, repo] = currentFullName.split("/");
-    selected = [{ owner, repo, full_name: currentFullName }];
-    console.log(`  Auto-selected repo: ${currentFullName}`);
-  } else {
-    console.log("Fetching accessible repos...");
-    const repos = await listAccessibleRepos({ token: ghToken });
-    if (repos.length === 0) {
-      console.error("No accessible repos found. Check your GitHub permissions.");
-      process.exit(1);
-    }
-    console.log(`
-Found ${repos.length} accessible repo(s):
-`);
-    repos.slice(0, 100).forEach((r, i) => {
-      console.log(`  ${String(i + 1).padStart(3)}.  ${r.full_name}`);
-    });
-    console.log();
-    const rl2 = createInterface2({ input, output });
-    const selectionRaw = await prompt(rl2, "Select repos to enable (comma-separated numbers, e.g. 1,3,5): ");
-    const selectedIdx = selectionRaw.split(",").map((s) => parseInt(s.trim(), 10) - 1).filter((n) => !isNaN(n) && n >= 0 && n < repos.length);
-    if (selectedIdx.length === 0) {
-      console.error("No valid selections.");
-      rl2.close();
-      process.exit(1);
-    }
-    selected = selectedIdx.map((i) => repos[i]);
-    console.log(`
-Will push secrets to ${selected.length} repo(s):`);
-    for (const r of selected) console.log(`  \u2022 ${r.full_name}`);
-    console.log();
-    const confirm = (await prompt(rl2, "Continue? (yes/no): ")).trim().toLowerCase();
-    if (confirm !== "yes" && confirm !== "y") {
-      console.log("Cancelled.");
-      rl2.close();
-      process.exit(0);
-    }
-    rl2.close();
-  }
-  console.log();
-  for (const r of selected) {
-    process.stdout.write(`Pushing secrets to ${r.full_name}... `);
-    try {
-      await pushSecretsToRepo(
-        { token: ghToken },
-        r.owner,
-        r.repo,
-        {
-          claudeCodeOauthToken: claudeToken,
-          synkroApiKey: synkroCiApiKey
-        }
-      );
-      console.log("\u2713");
-    } catch (err) {
-      console.log(`\u2717 (${err.message})`);
-    }
-  }
-  console.log();
-  const gitRoot = findGitRoot(process.cwd());
-  if (gitRoot) {
-    const written = writeWorkflowFile(gitRoot);
-    if (written) {
-      console.log(`Wrote workflow: ${written}`);
-      console.log("Commit and push it to enable PR scanning.");
-    }
-  } else {
-    console.log("Not in a git repo. To enable scanning, add this file to your repo:");
-    console.log(`  Path: ${WORKFLOW_RELATIVE_PATH}`);
-    console.log(`  Content: run \`synkro-cli setup-github\` from inside a repo to write it automatically`);
-  }
-  console.log();
-  console.log("\u2713 PR scan setup complete.");
-  console.log(`Secrets pushed: ${SECRET_NAMES.CLAUDE_OAUTH}, ${SECRET_NAMES.SYNKRO_API_KEY}`);
-  console.log("Open a PR on any selected repo to trigger your first Synkro scan.");
-}
-var SYNKRO_DIR, CONFIG_PATH;
-var init_setupGithub = __esm({
-  "cli/commands/setupGithub.ts"() {
-    "use strict";
-    init_githubSetup();
-    init_stub();
-    SYNKRO_DIR = join5(homedir5(), ".synkro");
-    CONFIG_PATH = join5(SYNKRO_DIR, "config.env");
-  }
-});
-
-// cli/installer/promptFetcher.ts
-async function fetchJudgePrompts(opts) {
-  const url = `${opts.gatewayUrl.replace(/\/$/, "")}/api/v1/hook/config`;
-  const resp = await fetch(url, {
-    method: "GET",
-    headers: {
-      "Authorization": `Bearer ${opts.jwt}`,
-      "User-Agent": "synkro-cli/1.0"
-    },
-    signal: AbortSignal.timeout(5e3)
-  });
-  if (!resp.ok) {
-    return { version: "unknown" };
-  }
-  const data = await resp.json();
-  return { version: data.prompts?.version ?? "unknown" };
-}
-var init_promptFetcher = __esm({
-  "cli/installer/promptFetcher.ts"() {
-    "use strict";
-  }
-});
-
-// cli/local-cc/macKeychain.ts
-var macKeychain_exports = {};
-__export(macKeychain_exports, {
-  CLAUDE_CREDS_DIR: () => CLAUDE_CREDS_DIR,
-  CLAUDE_CREDS_FILE: () => CLAUDE_CREDS_FILE,
-  CURSOR_API_KEY_FILE: () => CURSOR_API_KEY_FILE,
-  CURSOR_CREDS_DIR: () => CURSOR_CREDS_DIR,
-  KeychainExportError: () => KeychainExportError,
-  SYNKRO_DIR: () => SYNKRO_DIR2,
-  credsAreStale: () => credsAreStale,
-  cursorApiKeyConfigured: () => cursorApiKeyConfigured,
-  exportKeychainCreds: () => exportKeychainCreds,
-  loadRefreshAgent: () => loadRefreshAgent,
-  needsKeychainBridge: () => needsKeychainBridge,
-  readExportedCreds: () => readExportedCreds,
-  readKeychainCreds: () => readKeychainCreds,
-  refreshCreds: () => refreshCreds,
-  uninstallRefreshAgent: () => uninstallRefreshAgent,
-  validateCursorApiKey: () => validateCursorApiKey,
-  writeCursorApiKey: () => writeCursorApiKey,
-  writeRefreshAgent: () => writeRefreshAgent
-});
-import { existsSync as existsSync7, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, chmodSync, readFileSync as readFileSync6, statSync } from "fs";
-import { homedir as homedir6, platform as platform3 } from "os";
-import { join as join6 } from "path";
-import { spawnSync } from "child_process";
-function needsKeychainBridge() {
-  return platform3() === "darwin";
-}
-function readKeychainCreds() {
-  if (platform3() !== "darwin") return null;
-  const r = spawnSync("security", ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-w"], {
-    encoding: "utf-8",
-    timeout: 5e3
-  });
-  if (r.status !== 0) return null;
-  const blob = (r.stdout || "").trim();
-  return blob || null;
-}
-function exportKeychainCreds() {
-  const blob = readKeychainCreds();
-  if (!blob) return null;
-  mkdirSync6(CLAUDE_CREDS_DIR, { recursive: true });
-  chmodSync(CLAUDE_CREDS_DIR, 448);
-  writeFileSync6(CLAUDE_CREDS_FILE, blob, "utf-8");
-  chmodSync(CLAUDE_CREDS_FILE, 384);
-  return CLAUDE_CREDS_FILE;
-}
-function cursorApiKeyConfigured() {
-  try {
-    return existsSync7(CURSOR_API_KEY_FILE) && readFileSync6(CURSOR_API_KEY_FILE, "utf-8").trim().length > 0;
-  } catch {
-    return false;
-  }
-}
-function writeCursorApiKey(key) {
-  const trimmed = key.trim();
-  if (!trimmed) return;
-  mkdirSync6(CURSOR_CREDS_DIR, { recursive: true });
-  chmodSync(CURSOR_CREDS_DIR, 448);
-  writeFileSync6(CURSOR_API_KEY_FILE, trimmed, "utf-8");
-  chmodSync(CURSOR_API_KEY_FILE, 384);
-}
-async function validateCursorApiKey() {
-  let key;
-  try {
-    key = readFileSync6(CURSOR_API_KEY_FILE, "utf-8").trim();
+    key = readFileSync5(CURSOR_API_KEY_FILE, "utf-8").trim();
   } catch {
     return null;
   }
@@ -5752,7 +5384,7 @@ async function validateCursorApiKey() {
   }
 }
 function credsAreStale() {
-  if (!existsSync7(CLAUDE_CREDS_FILE)) return true;
+  if (!existsSync6(CLAUDE_CREDS_FILE)) return true;
   try {
     const ageMs = Date.now() - statSync(CLAUDE_CREDS_FILE).mtimeMs;
     return ageMs > REFRESH_INTERVAL_SECONDS * 1e3;
@@ -5761,10 +5393,10 @@ function credsAreStale() {
   }
 }
 function writeRefreshAgent(synkroBinPath) {
-  if (platform3() !== "darwin") {
+  if (platform2() !== "darwin") {
     throw new KeychainExportError("writeRefreshAgent is darwin-only");
   }
-  mkdirSync6(join6(homedir6(), "Library", "LaunchAgents"), { recursive: true });
+  mkdirSync6(join5(homedir5(), "Library", "LaunchAgents"), { recursive: true });
   const shellCmd = `export PATH="/opt/homebrew/bin:/usr/local/bin:$PATH" && { "${synkroBinPath}" local-cc refresh-creds || synkro local-cc refresh-creds; }`;
   const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -5783,9 +5415,9 @@ function writeRefreshAgent(synkroBinPath) {
   <key>RunAtLoad</key>
   <true/>
   <key>StandardErrorPath</key>
-  <string>${join6(SYNKRO_DIR2, "claude-creds-refresh.log")}</string>
+  <string>${join5(SYNKRO_DIR, "claude-creds-refresh.log")}</string>
   <key>StandardOutPath</key>
-  <string>${join6(SYNKRO_DIR2, "claude-creds-refresh.log")}</string>
+  <string>${join5(SYNKRO_DIR, "claude-creds-refresh.log")}</string>
 </dict>
 </plist>
 `;
@@ -5793,7 +5425,7 @@ function writeRefreshAgent(synkroBinPath) {
   return LAUNCHD_PLIST;
 }
 function loadRefreshAgent() {
-  if (platform3() !== "darwin") return;
+  if (platform2() !== "darwin") return;
   spawnSync("launchctl", ["bootout", `gui/${process.getuid?.() ?? 501}`, LAUNCHD_PLIST], {
     encoding: "utf-8",
     timeout: 5e3
@@ -5809,13 +5441,13 @@ function loadRefreshAgent() {
   }
 }
 function uninstallRefreshAgent() {
-  if (platform3() !== "darwin") return;
+  if (platform2() !== "darwin") return;
   spawnSync("launchctl", ["bootout", `gui/${process.getuid?.() ?? 501}`, LAUNCHD_PLIST], {
     encoding: "utf-8",
     timeout: 5e3
   });
   try {
-    if (existsSync7(LAUNCHD_PLIST)) {
+    if (existsSync6(LAUNCHD_PLIST)) {
       __require("fs").unlinkSync(LAUNCHD_PLIST);
     }
   } catch {
@@ -5827,23 +5459,23 @@ function refreshCreds() {
 }
 function readExportedCreds() {
   try {
-    return readFileSync6(CLAUDE_CREDS_FILE, "utf-8");
+    return readFileSync5(CLAUDE_CREDS_FILE, "utf-8");
   } catch {
     return null;
   }
 }
-var SYNKRO_DIR2, CLAUDE_CREDS_DIR, CLAUDE_CREDS_FILE, CURSOR_CREDS_DIR, CURSOR_API_KEY_FILE, KEYCHAIN_SERVICE, LAUNCHD_LABEL, LAUNCHD_PLIST, REFRESH_INTERVAL_SECONDS, KeychainExportError;
+var SYNKRO_DIR, CLAUDE_CREDS_DIR, CLAUDE_CREDS_FILE, CURSOR_CREDS_DIR, CURSOR_API_KEY_FILE, KEYCHAIN_SERVICE, LAUNCHD_LABEL, LAUNCHD_PLIST, REFRESH_INTERVAL_SECONDS, KeychainExportError;
 var init_macKeychain = __esm({
   "cli/local-cc/macKeychain.ts"() {
     "use strict";
-    SYNKRO_DIR2 = join6(homedir6(), ".synkro");
-    CLAUDE_CREDS_DIR = join6(SYNKRO_DIR2, "claude-creds");
-    CLAUDE_CREDS_FILE = join6(CLAUDE_CREDS_DIR, ".credentials.json");
-    CURSOR_CREDS_DIR = join6(SYNKRO_DIR2, "cursor-creds");
-    CURSOR_API_KEY_FILE = join6(CURSOR_CREDS_DIR, "api-key");
+    SYNKRO_DIR = join5(homedir5(), ".synkro");
+    CLAUDE_CREDS_DIR = join5(SYNKRO_DIR, "claude-creds");
+    CLAUDE_CREDS_FILE = join5(CLAUDE_CREDS_DIR, ".credentials.json");
+    CURSOR_CREDS_DIR = join5(SYNKRO_DIR, "cursor-creds");
+    CURSOR_API_KEY_FILE = join5(CURSOR_CREDS_DIR, "api-key");
     KEYCHAIN_SERVICE = "Claude Code-credentials";
     LAUNCHD_LABEL = "com.synkro.cli.claude-creds-refresh";
-    LAUNCHD_PLIST = join6(homedir6(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+    LAUNCHD_PLIST = join5(homedir5(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
     REFRESH_INTERVAL_SECONDS = 45 * 60;
     KeychainExportError = class extends Error {
       constructor(message, cause) {
@@ -5860,7 +5492,7 @@ var init_macKeychain = __esm({
 var dockerInstall_exports = {};
 __export(dockerInstall_exports, {
   DockerInstallError: () => DockerInstallError,
-  SYNKRO_DIR: () => SYNKRO_DIR3,
+  SYNKRO_DIR: () => SYNKRO_DIR2,
   assertDockerAvailable: () => assertDockerAvailable,
   dockerInstall: () => dockerInstall,
   dockerRemove: () => dockerRemove,
@@ -5876,9 +5508,9 @@ __export(dockerInstall_exports, {
   splitWorkers: () => splitWorkers,
   waitForContainerReady: () => waitForContainerReady
 });
-import { copyFileSync, existsSync as existsSync8, mkdirSync as mkdirSync7, readdirSync } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join7 } from "path";
+import { copyFileSync, existsSync as existsSync7, mkdirSync as mkdirSync7, readdirSync } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join6 } from "path";
 import { spawnSync as spawnSync2 } from "child_process";
 function splitWorkers(total, providers) {
   const t = Math.max(0, Math.floor(total));
@@ -5953,7 +5585,7 @@ function assertDockerAvailable() {
 }
 function claudeCredsHostDir() {
   if (needsKeychainBridge()) return CLAUDE_CREDS_DIR;
-  return join7(homedir7(), ".claude");
+  return join6(homedir6(), ".claude");
 }
 function resolveSynkroBin() {
   const which2 = spawnSync2("which", ["synkro"], { encoding: "utf-8", timeout: 5e3 });
@@ -5969,11 +5601,11 @@ async function dockerInstall(opts = {}) {
   mkdirSync7(PGDATA_PATH, { recursive: true });
   mkdirSync7(BACKUP_DIR, { recursive: true });
   mkdirSync7(CLAUDE_HOST_STATE_DIR, { recursive: true });
-  const hostClaudeJson = join7(homedir7(), ".claude.json");
-  if (existsSync8(hostClaudeJson)) {
+  const hostClaudeJson = join6(homedir6(), ".claude.json");
+  if (existsSync7(hostClaudeJson)) {
     copyFileSync(hostClaudeJson, CLAUDE_HOST_STATE_FILE);
   }
-  if (!existsSync8(MCP_JWT_PATH)) {
+  if (!existsSync7(MCP_JWT_PATH)) {
     throw new DockerInstallError(
       `MCP JWT missing at ${MCP_JWT_PATH}. The installer should mint this before calling dockerInstall.`
     );
@@ -6001,7 +5633,7 @@ async function dockerInstall(opts = {}) {
       console.warn(`    Plist written to ${plist} \u2014 load manually with launchctl bootstrap when ready.`);
     }
   } else {
-    mkdirSync7(join7(homedir7(), ".claude"), { recursive: true });
+    mkdirSync7(join6(homedir6(), ".claude"), { recursive: true });
   }
   console.log(`  Pulling ${image}...`);
   const pull = spawnSync2("docker", ["pull", image], { encoding: "utf-8", stdio: "inherit", timeout: 6e5 });
@@ -6039,11 +5671,11 @@ async function dockerInstall(opts = {}) {
     // sidesteps Docker Desktop for macOS's unreliable single-file bind mounts
     // (which previously left a dangling symlink that blocked container start).
     "-v",
-    `${SYNKRO_DIR3}:/data/synkro-host:ro`,
+    `${SYNKRO_DIR2}:/data/synkro-host:ro`,
     "-v",
     `${credsDir}:/home/synkro/.claude:rw`,
     "-v",
-    `${join7(homedir7(), ".claude")}:/data/claude-host:ro`,
+    `${join6(homedir6(), ".claude")}:/data/claude-host:ro`,
     "-v",
     `${CLAUDE_HOST_STATE_DIR}:/data/claude-host-state:ro`,
     // Cursor creds — mounted RW so the in-container refresher can rotate the
@@ -6087,203 +5719,566 @@ async function waitForContainerReady(timeoutMs = 6e4) {
     }
     await new Promise((r) => setTimeout(r, 1e3));
   }
-  return false;
-}
-function dockerRemove() {
-  spawnSync2("docker", ["rm", CONTAINER_NAME], { encoding: "utf-8", timeout: 3e4 });
-}
-function dockerStop() {
-  spawnSync2("docker", ["stop", "--timeout=30", CONTAINER_NAME], { encoding: "utf-8", timeout: 45e3 });
-  spawnSync2("docker", ["rm", CONTAINER_NAME], { encoding: "utf-8", timeout: 3e4 });
+  return false;
+}
+function dockerRemove() {
+  spawnSync2("docker", ["rm", CONTAINER_NAME], { encoding: "utf-8", timeout: 3e4 });
+}
+function dockerStop() {
+  spawnSync2("docker", ["stop", "--timeout=30", CONTAINER_NAME], { encoding: "utf-8", timeout: 45e3 });
+  spawnSync2("docker", ["rm", CONTAINER_NAME], { encoding: "utf-8", timeout: 3e4 });
+}
+async function dockerUpdate(opts = {}) {
+  if (dockerStatus().running) {
+    await dockerSafeStop();
+  }
+  dockerRemove();
+  await dockerInstall(opts);
+}
+function dockerStatus() {
+  const r = spawnSync2("docker", ["inspect", "--format", "{{.State.Status}}", CONTAINER_NAME], {
+    encoding: "utf-8",
+    timeout: 5e3
+  });
+  const status = (r.stdout || "").trim();
+  if (status !== "running") return { running: false };
+  return {
+    running: true,
+    image: imageTag(),
+    healthz: `http://127.0.0.1:${HOST_MCP_PORT}/`
+  };
+}
+function readContainerConfig() {
+  const r = spawnSync2("docker", ["inspect", "--format", "{{json .Config.Env}}", CONTAINER_NAME], {
+    encoding: "utf-8",
+    timeout: 5e3
+  });
+  if (r.status !== 0 || !r.stdout) return null;
+  let env;
+  try {
+    env = JSON.parse(r.stdout.trim());
+  } catch {
+    return null;
+  }
+  if (!Array.isArray(env)) return null;
+  const get = (k) => {
+    const hit = env.find((e) => typeof e === "string" && e.startsWith(k + "="));
+    return hit ? hit.slice(k.length + 1) : void 0;
+  };
+  const num = (s) => {
+    if (s === void 0) return void 0;
+    const n = parseInt(s, 10);
+    return Number.isFinite(n) ? n : void 0;
+  };
+  return {
+    claudeWorkers: num(get("CLAUDE_WORKERS")),
+    cursorWorkers: num(get("CURSOR_WORKERS")),
+    connectedRepo: get("SYNKRO_CONNECTED_REPO") || void 0
+  };
+}
+async function dockerSafeStop() {
+  const status = dockerStatus();
+  if (!status.running) {
+    console.log("  Container is not running.");
+    return { ok: true, pgdataCheck: checkPgdata() };
+  }
+  console.log("  Requesting data snapshot before shutdown...");
+  let snapshot = { ok: false, error: "not attempted" };
+  try {
+    const resp = await fetch(`http://127.0.0.1:${HOST_MCP_PORT}/api/local/snapshot`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ reason: "cli-stop" }),
+      signal: AbortSignal.timeout(2e4)
+    });
+    if (resp.ok) {
+      snapshot = { ok: true };
+      console.log("  \u2713 Snapshot saved.");
+    } else {
+      snapshot = { ok: false, error: `HTTP ${resp.status}` };
+      console.warn(`  \u26A0 Snapshot request failed (HTTP ${resp.status}). Proceeding with stop.`);
+    }
+  } catch (e) {
+    snapshot = { ok: false, error: String(e).slice(0, 100) };
+    console.warn(`  \u26A0 Snapshot request failed: ${snapshot.error}. Proceeding with stop.`);
+  }
+  console.log("  Stopping container (30s grace for CHECKPOINT + WAL flush)...");
+  const stop = spawnSync2("docker", ["stop", "--timeout=30", CONTAINER_NAME], {
+    encoding: "utf-8",
+    timeout: 45e3
+  });
+  const inspect = spawnSync2("docker", ["inspect", "--format", "{{.State.ExitCode}}", CONTAINER_NAME], {
+    encoding: "utf-8",
+    timeout: 5e3
+  });
+  const exitCode = parseInt((inspect.stdout || "").trim(), 10);
+  if (exitCode === 0) {
+    console.log("  \u2713 Container stopped cleanly (exit 0).");
+  } else {
+    console.warn(`  \u26A0 Container exited with code ${exitCode}.`);
+  }
+  const pgCheck = checkPgdata();
+  if (pgCheck.healthy) {
+    console.log(`  \u2713 pgdata looks healthy: ${pgCheck.details}`);
+  } else {
+    console.warn(`  \u26A0 pgdata check: ${pgCheck.details}`);
+  }
+  return { ok: stop.status === 0, snapshot, exitCode, pgdataCheck: pgCheck };
+}
+async function dockerSafeStart() {
+  const status = dockerStatus();
+  if (status.running) {
+    console.log("  Container is already running.");
+    return { ok: true, pgdataState: "running" };
+  }
+  const exists = spawnSync2("docker", ["inspect", "--format", "{{.State.Status}}", CONTAINER_NAME], {
+    encoding: "utf-8",
+    timeout: 5e3
+  });
+  if (exists.status !== 0) {
+    return { ok: false, pgdataState: "no_container", error: "No synkro-server container found. Run `synkro install` first." };
+  }
+  const pgCheck = checkPgdata();
+  if (existsSync7(PGDATA_PATH) && readdirSync(PGDATA_PATH).length > 0) {
+    if (pgCheck.healthy) {
+      console.log(`  pgdata: existing data found \u2014 ${pgCheck.details}`);
+    } else {
+      console.warn(`  \u26A0 pgdata: ${pgCheck.details}`);
+      console.log("  Starting anyway \u2014 entrypoint will attempt recovery from snapshots if needed.");
+    }
+  } else {
+    console.log("  pgdata: no existing data \u2014 fresh start.");
+    mkdirSync7(PGDATA_PATH, { recursive: true });
+  }
+  console.log("  Starting container...");
+  const start = spawnSync2("docker", ["start", CONTAINER_NAME], {
+    encoding: "utf-8",
+    timeout: 3e4
+  });
+  if (start.status !== 0) {
+    return { ok: false, pgdataState: "start_failed", error: `docker start failed: ${(start.stderr || "").slice(0, 200)}` };
+  }
+  console.log("  Waiting for server to become healthy...");
+  const ready = await waitForContainerReady(6e4);
+  if (ready) {
+    console.log("  \u2713 Server is healthy and ready.");
+    return { ok: true, pgdataState: pgCheck.healthy ? "existing" : "recovered" };
+  } else {
+    return { ok: false, pgdataState: "unhealthy", error: "Server did not become healthy within 60s. Check: docker logs synkro-server" };
+  }
+}
+async function dockerSafeRestart() {
+  console.log("  === Stop ===");
+  const stopResult = await dockerSafeStop();
+  if (!stopResult.ok) {
+    console.error("  Stop failed. Aborting restart.");
+    return { ok: false, stop: stopResult, start: { ok: false, pgdataState: "not_started", error: "stop failed" } };
+  }
+  console.log("\n  === Start ===");
+  const startResult = await dockerSafeStart();
+  return { ok: startResult.ok, stop: stopResult, start: startResult };
+}
+function checkPgdata() {
+  if (!existsSync7(PGDATA_PATH)) return { healthy: false, details: "pgdata directory does not exist" };
+  const entries = readdirSync(PGDATA_PATH);
+  if (entries.length === 0) return { healthy: true, details: "empty (fresh start)" };
+  const hasPidFile = entries.includes("postmaster.pid");
+  const hasWalDir = entries.includes("pg_wal");
+  const hasPgControl = entries.includes("global") || entries.includes("pg_control");
+  if (hasPidFile) return { healthy: false, details: "stale postmaster.pid present (unclean shutdown)" };
+  if (!hasWalDir) return { healthy: false, details: "pg_wal directory missing" };
+  if (!hasPgControl) return { healthy: false, details: "pg_control/global directory missing" };
+  return { healthy: true, details: `${entries.length} entries, WAL present, no stale PID` };
+}
+var SYNKRO_DIR2, MCP_JWT_PATH, PGDATA_PATH, CLAUDE_HOST_STATE_DIR, CLAUDE_HOST_STATE_FILE, HOST_MCP_PORT, HOST_GRADER_PORT, HOST_CWE_PORT, HOST_PG_PORT, CONTAINER_NAME, DEFAULT_IMAGE, DockerInstallError, BACKUP_DIR;
+var init_dockerInstall = __esm({
+  "cli/local-cc/dockerInstall.ts"() {
+    "use strict";
+    init_agentDetect();
+    init_macKeychain();
+    SYNKRO_DIR2 = join6(homedir6(), ".synkro");
+    MCP_JWT_PATH = join6(SYNKRO_DIR2, ".mcp-jwt");
+    PGDATA_PATH = join6(SYNKRO_DIR2, "pgdata");
+    CLAUDE_HOST_STATE_DIR = join6(SYNKRO_DIR2, "claude-host-state");
+    CLAUDE_HOST_STATE_FILE = join6(CLAUDE_HOST_STATE_DIR, ".claude.json");
+    HOST_MCP_PORT = parseInt(process.env.SYNKRO_HOST_MCP_PORT || "18931", 10);
+    HOST_GRADER_PORT = parseInt(process.env.SYNKRO_HOST_GRADER_PORT || "18929", 10);
+    HOST_CWE_PORT = parseInt(process.env.SYNKRO_HOST_CWE_PORT || "18930", 10);
+    HOST_PG_PORT = parseInt(process.env.SYNKRO_HOST_PG_PORT || "15433", 10);
+    CONTAINER_NAME = "synkro-server";
+    DEFAULT_IMAGE = "ghcr.io/synkro-sh/synkro-server:latest";
+    DockerInstallError = class extends Error {
+      constructor(message, cause) {
+        super(message);
+        this.cause = cause;
+        this.name = "DockerInstallError";
+      }
+      cause;
+    };
+    BACKUP_DIR = join6(SYNKRO_DIR2, "pgdata-backups");
+  }
+});
+
+// cli/commands/setupGithub.ts
+var setupGithub_exports = {};
+__export(setupGithub_exports, {
+  connectGitHub: () => connectGitHub,
+  setupGithubCommand: () => setupGithubCommand
+});
+import { createInterface as createInterface2 } from "readline/promises";
+import { stdin as input, stdout as output } from "process";
+import { execSync as execSync4, spawn as nodeSpawn } from "child_process";
+import { existsSync as existsSync8, readFileSync as readFileSync6, unlinkSync as unlinkSync3 } from "fs";
+import { homedir as homedir7, platform as platform4 } from "os";
+import { join as join7 } from "path";
+import { execFile as execFile2 } from "child_process";
+function readConfig() {
+  if (!existsSync8(CONFIG_PATH)) return {};
+  const out = {};
+  for (const line of readFileSync6(CONFIG_PATH, "utf-8").split("\n")) {
+    const t = line.trim();
+    if (!t || t.startsWith("#")) continue;
+    const eq = t.indexOf("=");
+    if (eq > 0) out[t.slice(0, eq).trim()] = t.slice(eq + 1).trim().replace(/^['"]|['"]$/g, "");
+  }
+  return out;
+}
+async function prompt(rl, q, opts = {}) {
+  if (opts.silent) {
+    process.stdout.write(q);
+    const wasRaw = process.stdin.isRaw;
+    if (process.stdin.setRawMode) process.stdin.setRawMode(true);
+    return await new Promise((resolve3) => {
+      let chunk = "";
+      const onData = (data) => {
+        const s = data.toString("utf-8");
+        if (s === "\r" || s === "\n" || s === "\r\n") {
+          process.stdin.removeListener("data", onData);
+          if (process.stdin.setRawMode) process.stdin.setRawMode(wasRaw ?? false);
+          process.stdout.write("\n");
+          resolve3(chunk);
+          return;
+        }
+        if (s === "") process.exit(130);
+        if (s === "\x7F" || s === "\b") {
+          chunk = chunk.slice(0, -1);
+          return;
+        }
+        chunk += s;
+      };
+      process.stdin.on("data", onData);
+    });
+  }
+  return await rl.question(q);
+}
+function openBrowser3(url) {
+  const os = platform4();
+  let bin;
+  let args2;
+  switch (os) {
+    case "darwin":
+      bin = "open";
+      args2 = [url];
+      break;
+    case "win32":
+      bin = "cmd";
+      args2 = ["/c", "start", "", url];
+      break;
+    default:
+      bin = "xdg-open";
+      args2 = [url];
+      break;
+  }
+  execFile2(bin, args2, () => {
+  });
 }
-async function dockerUpdate(opts = {}) {
-  if (dockerStatus().running) {
-    await dockerSafeStop();
-  }
-  dockerRemove();
-  await dockerInstall(opts);
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
 }
-function dockerStatus() {
-  const r = spawnSync2("docker", ["inspect", "--format", "{{.State.Status}}", CONTAINER_NAME], {
-    encoding: "utf-8",
-    timeout: 5e3
+function captureClaudeSetupToken() {
+  const tmpFile = join7(SYNKRO_DIR3, `token-capture-${Date.now()}.raw`);
+  return new Promise((resolve3, reject) => {
+    const proc = nodeSpawn("script", ["-q", tmpFile, "claude", "setup-token"], {
+      stdio: "inherit"
+    });
+    proc.on("error", (err) => reject(new Error(`Failed to spawn claude setup-token: ${err.message}`)));
+    proc.on("close", (code) => {
+      let raw = "";
+      try {
+        raw = readFileSync6(tmpFile, "utf-8");
+      } catch (e) {
+        reject(new Error(`Could not read script output file: ${e.message}`));
+        return;
+      }
+      try {
+        unlinkSync3(tmpFile);
+      } catch {
+      }
+      if (code !== 0) {
+        reject(new Error(`claude setup-token exited with code ${code}`));
+        return;
+      }
+      const yellowRe = /\x1B\[38;2;255;193;7m([^\x1B]*)/g;
+      let yellow = "";
+      let m;
+      while ((m = yellowRe.exec(raw)) !== null) yellow += m[1];
+      const token = yellow.replace(/\s/g, "").match(/sk-ant-oat01-[A-Za-z0-9_-]+/);
+      if (!token) {
+        reject(new Error(`Could not find token in claude setup-token output (file=${raw.length}b, yellow=${yellow.length}b)`));
+        return;
+      }
+      resolve3(token[0]);
+    });
   });
-  const status = (r.stdout || "").trim();
-  if (status !== "running") return { running: false };
-  return {
-    running: true,
-    image: imageTag(),
-    healthz: `http://127.0.0.1:${HOST_MCP_PORT}/`
-  };
 }
-function readContainerConfig() {
-  const r = spawnSync2("docker", ["inspect", "--format", "{{json .Config.Env}}", CONTAINER_NAME], {
-    encoding: "utf-8",
-    timeout: 5e3
+async function apiCall(gatewayUrl, jwt2, path, opts = {}) {
+  const resp = await fetch(`${gatewayUrl}${path}`, {
+    ...opts,
+    headers: {
+      "Authorization": `Bearer ${jwt2}`,
+      "Content-Type": "application/json",
+      ...opts.headers || {}
+    }
   });
-  if (r.status !== 0 || !r.stdout) return null;
-  let env;
+  if (!resp.ok) {
+    const text = await resp.text().catch(() => "");
+    throw new Error(`API ${resp.status}: ${text.slice(0, 200)}`);
+  }
+  return resp.json();
+}
+async function connectGitHub(gatewayUrl, jwt2, opts = {}) {
   try {
-    env = JSON.parse(r.stdout.trim());
+    const result = await apiCall(
+      gatewayUrl,
+      jwt2,
+      "/api/v1/cli/github-token"
+    );
+    if (result.connected && result.token) {
+      if (!opts.silent) console.log("  \u2713 GitHub already connected via Synkro.");
+      return result.token;
+    }
   } catch {
+  }
+  if (!opts.silent) console.log("  Opening browser to authorize GitHub...");
+  try {
+    const authResp = await apiCall(
+      gatewayUrl,
+      jwt2,
+      "/api/pipes-widget/authorize/github",
+      { method: "POST", body: "{}" }
+    );
+    openBrowser3(authResp.url);
+    if (!opts.silent) console.log("  Waiting for authorization...");
+  } catch (err) {
+    if (!opts.silent) console.error(`  Failed to start GitHub authorization: ${err.message}`);
     return null;
   }
-  if (!Array.isArray(env)) return null;
-  const get = (k) => {
-    const hit = env.find((e) => typeof e === "string" && e.startsWith(k + "="));
-    return hit ? hit.slice(k.length + 1) : void 0;
-  };
-  const num = (s) => {
-    if (s === void 0) return void 0;
-    const n = parseInt(s, 10);
-    return Number.isFinite(n) ? n : void 0;
-  };
-  return {
-    claudeWorkers: num(get("CLAUDE_WORKERS")),
-    cursorWorkers: num(get("CURSOR_WORKERS")),
-    connectedRepo: get("SYNKRO_CONNECTED_REPO") || void 0
-  };
+  const deadline = Date.now() + 12e4;
+  while (Date.now() < deadline) {
+    await sleep(2e3);
+    try {
+      const result = await apiCall(
+        gatewayUrl,
+        jwt2,
+        "/api/v1/cli/github-token"
+      );
+      if (result.connected && result.token) {
+        if (!opts.silent) console.log("\n  \u2713 GitHub connected!");
+        return result.token;
+      }
+    } catch {
+    }
+    if (!opts.silent) process.stdout.write(".");
+  }
+  if (!opts.silent) console.error("\n  Timed out waiting for GitHub authorization.");
+  return null;
 }
-async function dockerSafeStop() {
-  const status = dockerStatus();
-  if (!status.running) {
-    console.log("  Container is not running.");
-    return { ok: true, pgdataCheck: checkPgdata() };
+async function setupGithubCommand(opts = {}) {
+  if (!isAuthenticated()) {
+    console.error("Not authenticated. Run `synkro-cli login` first.");
+    process.exit(1);
   }
-  console.log("  Requesting data snapshot before shutdown...");
-  let snapshot = { ok: false, error: "not attempted" };
-  try {
-    const resp = await fetch(`http://127.0.0.1:${HOST_MCP_PORT}/api/local/snapshot`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ reason: "cli-stop" }),
-      signal: AbortSignal.timeout(2e4)
-    });
-    if (resp.ok) {
-      snapshot = { ok: true };
-      console.log("  \u2713 Snapshot saved.");
-    } else {
-      snapshot = { ok: false, error: `HTTP ${resp.status}` };
-      console.warn(`  \u26A0 Snapshot request failed (HTTP ${resp.status}). Proceeding with stop.`);
-    }
-  } catch (e) {
-    snapshot = { ok: false, error: String(e).slice(0, 100) };
-    console.warn(`  \u26A0 Snapshot request failed: ${snapshot.error}. Proceeding with stop.`);
+  const config = readConfig();
+  const gatewayUrl = (config.SYNKRO_GATEWAY_URL || process.env.SYNKRO_GATEWAY_URL || "https://api.synkro.sh").replace(/\/$/, "");
+  const jwt2 = getAccessToken();
+  if (!jwt2) {
+    console.error("Could not load access token from ~/.synkro/credentials.json. Run `synkro-cli login`.");
+    process.exit(1);
   }
-  console.log("  Stopping container (30s grace for CHECKPOINT + WAL flush)...");
-  const stop = spawnSync2("docker", ["stop", "--timeout=30", CONTAINER_NAME], {
-    encoding: "utf-8",
-    timeout: 45e3
-  });
-  const inspect = spawnSync2("docker", ["inspect", "--format", "{{.State.ExitCode}}", CONTAINER_NAME], {
-    encoding: "utf-8",
-    timeout: 5e3
-  });
-  const exitCode = parseInt((inspect.stdout || "").trim(), 10);
-  if (exitCode === 0) {
-    console.log("  \u2713 Container stopped cleanly (exit 0).");
-  } else {
-    console.warn(`  \u26A0 Container exited with code ${exitCode}.`);
+  console.log("Requesting CI API key from Synkro...");
+  let synkroCiApiKey;
+  try {
+    const minted = await apiCall(
+      gatewayUrl,
+      jwt2,
+      "/api/v1/cli/ci-api-key",
+      { method: "POST", body: "{}" }
+    );
+    synkroCiApiKey = minted.api_key;
+    console.log(`  \u2713 Issued CI key (${synkroCiApiKey.slice(0, 18)}\u2026), expires ${minted.expires_at.slice(0, 10)}`);
+  } catch (err) {
+    console.error(`Failed to mint CI API key: ${err.message}`);
+    process.exit(1);
   }
-  const pgCheck = checkPgdata();
-  if (pgCheck.healthy) {
-    console.log(`  \u2713 pgdata looks healthy: ${pgCheck.details}`);
+  let ghToken;
+  if (opts.githubToken) {
+    ghToken = opts.githubToken;
+  } else if (opts.nonInteractive) {
+    try {
+      const result = await apiCall(
+        gatewayUrl,
+        jwt2,
+        "/api/v1/cli/github-token"
+      );
+      if (result.connected && result.token) {
+        ghToken = result.token;
+      } else {
+        throw new Error("not connected");
+      }
+    } catch {
+      try {
+        ghToken = execSync4("gh auth token", { encoding: "utf-8", timeout: 5e3 }).trim();
+      } catch {
+        console.error("GitHub not connected. Run `synkro-cli setup-github` interactively to connect.");
+        return;
+      }
+    }
   } else {
-    console.warn(`  \u26A0 pgdata check: ${pgCheck.details}`);
-  }
-  return { ok: stop.status === 0, snapshot, exitCode, pgdataCheck: pgCheck };
-}
-async function dockerSafeStart() {
-  const status = dockerStatus();
-  if (status.running) {
-    console.log("  Container is already running.");
-    return { ok: true, pgdataState: "running" };
+    console.log("\nConnecting to GitHub...");
+    const token = await connectGitHub(gatewayUrl, jwt2);
+    if (!token) {
+      console.error("GitHub connection failed. Try again.");
+      process.exit(1);
+    }
+    ghToken = token;
+    console.log();
   }
-  const exists = spawnSync2("docker", ["inspect", "--format", "{{.State.Status}}", CONTAINER_NAME], {
-    encoding: "utf-8",
-    timeout: 5e3
-  });
-  if (exists.status !== 0) {
-    return { ok: false, pgdataState: "no_container", error: "No synkro-server container found. Run `synkro install` first." };
+  let claudeToken;
+  if (!opts.skipClaudeToken) {
+    console.log("Generating Claude Code OAuth token...");
+    console.log("  A browser window will open \u2014 authorize with your Claude account.\n");
+    try {
+      claudeToken = await captureClaudeSetupToken();
+    } catch (err) {
+      console.error(`Failed to get Claude token: ${err instanceof Error ? err.message : String(err)}`);
+      if (opts.nonInteractive) return;
+      process.exit(1);
+    }
+    if (!claudeToken.startsWith("sk-ant-oat01-")) {
+      console.error("Invalid token received from `claude setup-token`. Expected sk-ant-oat01-...");
+      if (opts.nonInteractive) return;
+      process.exit(1);
+    }
+    console.log("  Validating token...");
+    try {
+      const validateResult = execSync4(
+        'claude --print --output-format json "say ok"',
+        { env: { ...process.env, CLAUDE_CODE_OAUTH_TOKEN: claudeToken }, encoding: "utf-8", timeout: 3e4, stdio: ["ignore", "pipe", "pipe"] }
+      );
+      const result = JSON.parse(validateResult);
+      if (result.is_error) throw new Error(result.result || "auth failed");
+      console.log("  \u2713 Token validated.\n");
+    } catch (err) {
+      console.error(`Token validation failed: ${err instanceof Error ? err.message : String(err)}`);
+      if (opts.nonInteractive) return;
+      process.exit(1);
+    }
   }
-  const pgCheck = checkPgdata();
-  if (existsSync8(PGDATA_PATH) && readdirSync(PGDATA_PATH).length > 0) {
-    if (pgCheck.healthy) {
-      console.log(`  pgdata: existing data found \u2014 ${pgCheck.details}`);
-    } else {
-      console.warn(`  \u26A0 pgdata: ${pgCheck.details}`);
-      console.log("  Starting anyway \u2014 entrypoint will attempt recovery from snapshots if needed.");
+  let selected;
+  if (opts.nonInteractive) {
+    let currentFullName = null;
+    try {
+      const remoteUrl = execSync4("git remote get-url origin", { encoding: "utf-8", timeout: 5e3 }).trim();
+      const m = remoteUrl.match(/(?:github\.com)[:/](.+?)(?:\.git)?$/);
+      if (m) currentFullName = m[1];
+    } catch {
     }
+    if (!currentFullName) {
+      console.warn("  \u26A0 Not in a GitHub repo. Skipping PR scan setup.");
+      return;
+    }
+    const [owner, repo] = currentFullName.split("/");
+    selected = [{ owner, repo, full_name: currentFullName }];
+    console.log(`  Auto-selected repo: ${currentFullName}`);
   } else {
-    console.log("  pgdata: no existing data \u2014 fresh start.");
-    mkdirSync7(PGDATA_PATH, { recursive: true });
+    console.log("Fetching accessible repos...");
+    const repos = await listAccessibleRepos({ token: ghToken });
+    if (repos.length === 0) {
+      console.error("No accessible repos found. Check your GitHub permissions.");
+      process.exit(1);
+    }
+    console.log(`
+Found ${repos.length} accessible repo(s):
+`);
+    repos.slice(0, 100).forEach((r, i) => {
+      console.log(`  ${String(i + 1).padStart(3)}.  ${r.full_name}`);
+    });
+    console.log();
+    const rl2 = createInterface2({ input, output });
+    const selectionRaw = await prompt(rl2, "Select repos to enable (comma-separated numbers, e.g. 1,3,5): ");
+    const selectedIdx = selectionRaw.split(",").map((s) => parseInt(s.trim(), 10) - 1).filter((n) => !isNaN(n) && n >= 0 && n < repos.length);
+    if (selectedIdx.length === 0) {
+      console.error("No valid selections.");
+      rl2.close();
+      process.exit(1);
+    }
+    selected = selectedIdx.map((i) => repos[i]);
+    console.log(`
+Will push secrets to ${selected.length} repo(s):`);
+    for (const r of selected) console.log(`  \u2022 ${r.full_name}`);
+    console.log();
+    const confirm = (await prompt(rl2, "Continue? (yes/no): ")).trim().toLowerCase();
+    if (confirm !== "yes" && confirm !== "y") {
+      console.log("Cancelled.");
+      rl2.close();
+      process.exit(0);
+    }
+    rl2.close();
   }
-  console.log("  Starting container...");
-  const start = spawnSync2("docker", ["start", CONTAINER_NAME], {
-    encoding: "utf-8",
-    timeout: 3e4
-  });
-  if (start.status !== 0) {
-    return { ok: false, pgdataState: "start_failed", error: `docker start failed: ${(start.stderr || "").slice(0, 200)}` };
+  console.log();
+  for (const r of selected) {
+    process.stdout.write(`Pushing secrets to ${r.full_name}... `);
+    try {
+      await pushSecretsToRepo(
+        { token: ghToken },
+        r.owner,
+        r.repo,
+        {
+          claudeCodeOauthToken: claudeToken,
+          synkroApiKey: synkroCiApiKey
+        }
+      );
+      console.log("\u2713");
+    } catch (err) {
+      console.log(`\u2717 (${err.message})`);
+    }
   }
-  console.log("  Waiting for server to become healthy...");
-  const ready = await waitForContainerReady(6e4);
-  if (ready) {
-    console.log("  \u2713 Server is healthy and ready.");
-    return { ok: true, pgdataState: pgCheck.healthy ? "existing" : "recovered" };
+  console.log();
+  const gitRoot = findGitRoot(process.cwd());
+  if (gitRoot) {
+    const written = writeWorkflowFile(gitRoot);
+    if (written) {
+      console.log(`Wrote workflow: ${written}`);
+      console.log("Commit and push it to enable PR scanning.");
+    }
   } else {
-    return { ok: false, pgdataState: "unhealthy", error: "Server did not become healthy within 60s. Check: docker logs synkro-server" };
-  }
-}
-async function dockerSafeRestart() {
-  console.log("  === Stop ===");
-  const stopResult = await dockerSafeStop();
-  if (!stopResult.ok) {
-    console.error("  Stop failed. Aborting restart.");
-    return { ok: false, stop: stopResult, start: { ok: false, pgdataState: "not_started", error: "stop failed" } };
+    console.log("Not in a git repo. To enable scanning, add this file to your repo:");
+    console.log(`  Path: ${WORKFLOW_RELATIVE_PATH}`);
+    console.log(`  Content: run \`synkro-cli setup-github\` from inside a repo to write it automatically`);
   }
-  console.log("\n  === Start ===");
-  const startResult = await dockerSafeStart();
-  return { ok: startResult.ok, stop: stopResult, start: startResult };
-}
-function checkPgdata() {
-  if (!existsSync8(PGDATA_PATH)) return { healthy: false, details: "pgdata directory does not exist" };
-  const entries = readdirSync(PGDATA_PATH);
-  if (entries.length === 0) return { healthy: true, details: "empty (fresh start)" };
-  const hasPidFile = entries.includes("postmaster.pid");
-  const hasWalDir = entries.includes("pg_wal");
-  const hasPgControl = entries.includes("global") || entries.includes("pg_control");
-  if (hasPidFile) return { healthy: false, details: "stale postmaster.pid present (unclean shutdown)" };
-  if (!hasWalDir) return { healthy: false, details: "pg_wal directory missing" };
-  if (!hasPgControl) return { healthy: false, details: "pg_control/global directory missing" };
-  return { healthy: true, details: `${entries.length} entries, WAL present, no stale PID` };
+  console.log();
+  console.log("\u2713 PR scan setup complete.");
+  console.log(`Secrets pushed: ${SECRET_NAMES.CLAUDE_OAUTH}, ${SECRET_NAMES.SYNKRO_API_KEY}`);
+  console.log("Open a PR on any selected repo to trigger your first Synkro scan.");
 }
-var SYNKRO_DIR3, MCP_JWT_PATH, PGDATA_PATH, CLAUDE_HOST_STATE_DIR, CLAUDE_HOST_STATE_FILE, HOST_MCP_PORT, HOST_GRADER_PORT, HOST_CWE_PORT, HOST_PG_PORT, CONTAINER_NAME, DEFAULT_IMAGE, DockerInstallError, BACKUP_DIR;
-var init_dockerInstall = __esm({
-  "cli/local-cc/dockerInstall.ts"() {
+var SYNKRO_DIR3, CONFIG_PATH;
+var init_setupGithub = __esm({
+  "cli/commands/setupGithub.ts"() {
     "use strict";
-    init_agentDetect();
-    init_macKeychain();
+    init_githubSetup();
+    init_stub();
     SYNKRO_DIR3 = join7(homedir7(), ".synkro");
-    MCP_JWT_PATH = join7(SYNKRO_DIR3, ".mcp-jwt");
-    PGDATA_PATH = join7(SYNKRO_DIR3, "pgdata");
-    CLAUDE_HOST_STATE_DIR = join7(SYNKRO_DIR3, "claude-host-state");
-    CLAUDE_HOST_STATE_FILE = join7(CLAUDE_HOST_STATE_DIR, ".claude.json");
-    HOST_MCP_PORT = parseInt(process.env.SYNKRO_HOST_MCP_PORT || "18931", 10);
-    HOST_GRADER_PORT = parseInt(process.env.SYNKRO_HOST_GRADER_PORT || "18929", 10);
-    HOST_CWE_PORT = parseInt(process.env.SYNKRO_HOST_CWE_PORT || "18930", 10);
-    HOST_PG_PORT = parseInt(process.env.SYNKRO_HOST_PG_PORT || "15433", 10);
-    CONTAINER_NAME = "synkro-server";
-    DEFAULT_IMAGE = "ghcr.io/synkro-sh/synkro-server:latest";
-    DockerInstallError = class extends Error {
-      constructor(message, cause) {
-        super(message);
-        this.cause = cause;
-        this.name = "DockerInstallError";
-      }
-      cause;
-    };
-    BACKUP_DIR = join7(SYNKRO_DIR3, "pgdata-backups");
+    CONFIG_PATH = join7(SYNKRO_DIR3, "config.env");
   }
 });
 
@@ -6378,6 +6373,32 @@ async function promptCursorApiKey(opts) {
     console.log("  \u26A0 Skipped \u2014 Cursor workers will be idle. Re-run install or pass --cursor-api-key=\u2026 later.");
   }
 }
+async function promptGradingMode() {
+  if (!process.stdin.isTTY) return "local";
+  const rl = createInterface3({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve3) => {
+    rl.question(
+      "Where should grading run?\n  local \u2014 on this machine, via the Synkro container (default)\n  byok  \u2014 via an LLM API using your own provider key\nChoose [local] / byok: ",
+      (answer) => {
+        rl.close();
+        resolve3(answer.trim().toLowerCase() === "byok" ? "byok" : "local");
+      }
+    );
+  });
+}
+async function promptStorageMode() {
+  if (!process.stdin.isTTY) return "local";
+  const rl = createInterface3({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve3) => {
+    rl.question(
+      "Where should telemetry be stored?\n  local \u2014 on this machine only (default)\n  cloud \u2014 sent to Synkro cloud\nChoose [local] / cloud: ",
+      (answer) => {
+        rl.close();
+        resolve3(answer.trim().toLowerCase() === "cloud" ? "cloud" : "local");
+      }
+    );
+  });
+}
 function ensureSynkroDir() {
   mkdirSync8(SYNKRO_DIR4, { recursive: true });
   mkdirSync8(HOOKS_DIR, { recursive: true });
@@ -6479,7 +6500,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.10")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.12")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -6491,6 +6512,8 @@ function writeConfigEnv(opts) {
   lines.push(`SYNKRO_LOCAL_INFERENCE=${shellQuoteSingle(opts.localInference ? "yes" : "no")}`);
   const safeMode = sanitizeConfigValue(opts.deploymentMode ?? "docker", 16);
   lines.push(`SYNKRO_DEPLOYMENT_MODE=${shellQuoteSingle(safeMode)}`);
+  lines.push(`SYNKRO_GRADING_MODE=${shellQuoteSingle(sanitizeConfigValue(opts.gradingMode ?? "local", 16))}`);
+  lines.push(`SYNKRO_STORAGE_MODE=${shellQuoteSingle(sanitizeConfigValue(opts.storageMode ?? "local", 16))}`);
   lines.push("");
   writeFileSync7(CONFIG_PATH2, lines.join("\n"), "utf-8");
   chmodSync2(CONFIG_PATH2, 384);
@@ -6650,30 +6673,7 @@ async function installCommand(opts = {}) {
     console.error("No access token available after auth.");
     process.exit(1);
   }
-  let ghToken = null;
-  if (process.stdin.isTTY) {
-    const rl = createInterface3({ input: process.stdin, output: process.stdout });
-    const wantsPR = await new Promise((resolve3) => {
-      rl.question("Would you like to enable GitHub PR scanning? (y/N) ", (answer) => {
-        rl.close();
-        const trimmed = answer.trim().toLowerCase();
-        resolve3(trimmed === "y" || trimmed === "yes");
-      });
-    });
-    if (wantsPR) {
-      try {
-        ghToken = await connectGitHub(gatewayUrl, token);
-      } catch {
-      }
-      if (ghToken) {
-        console.log();
-      } else {
-        console.log("  Skipped. Run `synkro install` again to enable PR scanning.\n");
-      }
-    } else {
-      console.log("  Skipped PR scanning.\n");
-    }
-  }
+  const ghToken = null;
   setApiBaseUrl(`${gatewayUrl}/api`);
   await promptRepoConnection({ linkRepo: opts.linkRepo });
   const detected = detectAgents();
@@ -6691,6 +6691,14 @@ async function installCommand(opts = {}) {
     console.log(`Installing hooks for: ${agents.map((a) => a.name).join(", ")}
 `);
   }
+  const gradingMode = await promptGradingMode();
+  const storageMode = await promptStorageMode();
+  console.log(`  grading: ${gradingMode}    storage: ${storageMode}
+`);
+  if (gradingMode === "byok") {
+    console.log("  BYOK grading uses your own provider key \u2014 register one in the");
+    console.log("  dashboard under Settings \u2192 Provider Keys if you have not already.\n");
+  }
   ensureSynkroDir();
   const scripts = writeHookScripts();
   console.log("Wrote hook scripts:");
@@ -6768,7 +6776,7 @@ async function installCommand(opts = {}) {
   } catch {
   }
   const profile = await fetchUserProfile(gatewayUrl, token);
-  const useLocalMcp = profile.captureDepth === "local_only" || profile.localInference;
+  const useLocalMcp = true;
   if (hasClaudeCode && !opts.noMcp) {
     if (useLocalMcp) {
       try {
@@ -6868,7 +6876,7 @@ async function installCommand(opts = {}) {
   }
   const synkroBundle = resolveSynkroBundle();
   const persistedMode = resolveDeploymentMode();
-  writeConfigEnv({ gatewayUrl, userId, orgId, email, tier: profile.tier, inference: profile.inference, synkroBin: synkroBundle, transcriptConsent, localInference: profile.localInference, deploymentMode: persistedMode });
+  writeConfigEnv({ gatewayUrl, userId, orgId, email, tier: profile.tier, inference: profile.inference, synkroBin: synkroBundle, transcriptConsent, localInference: profile.localInference, deploymentMode: persistedMode, gradingMode, storageMode });
   console.log(`Wrote config to ${CONFIG_PATH2}`);
   console.log(`  inference: ${profile.inference} (server-side grading)`);
   if (profile.localInference) console.log(`  local inference: enabled (gradingProvider=claude-code)`);
@@ -7157,7 +7165,6 @@ var init_install = __esm({
     init_stub();
     init_repoConnect();
     init_projects();
-    init_setupGithub();
     init_promptFetcher();
     init_dockerInstall();
     SYNKRO_DIR4 = join8(homedir8(), ".synkro");
@@ -8980,16 +8987,141 @@ var init_lifecycle = __esm({
   }
 });
 
+// cli/commands/config.ts
+var config_exports = {};
+__export(config_exports, {
+  configCommand: () => configCommand
+});
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync10, existsSync as existsSync15 } from "fs";
+import { join as join15 } from "path";
+import { homedir as homedir15 } from "os";
+function readConfigEnv() {
+  if (!existsSync15(CONFIG_PATH5)) return {};
+  const out = {};
+  for (const line of readFileSync12(CONFIG_PATH5, "utf-8").split("\n")) {
+    const t = line.trim();
+    if (!t || t.startsWith("#")) continue;
+    const eq = t.indexOf("=");
+    if (eq > 0) out[t.slice(0, eq).trim()] = t.slice(eq + 1).trim().replace(/^['"]|['"]$/g, "");
+  }
+  return out;
+}
+function updateConfigValue(key, value) {
+  if (!existsSync15(CONFIG_PATH5)) {
+    console.error("No config found. Run `synkro install` first.");
+    process.exit(1);
+  }
+  const lines = readFileSync12(CONFIG_PATH5, "utf-8").split("\n");
+  const pattern = new RegExp(`^${key}=`);
+  let found = false;
+  const updated = lines.map((line) => {
+    if (pattern.test(line.trim())) {
+      found = true;
+      return `${key}='${value}'`;
+    }
+    return line;
+  });
+  if (!found) updated.splice(updated.length - 1, 0, `${key}='${value}'`);
+  writeFileSync10(CONFIG_PATH5, updated.join("\n"), "utf-8");
+}
+async function configCommand(args2) {
+  if (args2.length === 0) {
+    const config2 = readConfigEnv();
+    console.log("Synkro config:\n");
+    console.log(`  grading:    ${config2.SYNKRO_GRADING_MODE || "local"}`);
+    console.log(`  storage:    ${config2.SYNKRO_STORAGE_MODE || "local"}`);
+    console.log(`  inference:  ${config2.SYNKRO_INFERENCE || "fast"}`);
+    console.log(`  tier:       ${config2.SYNKRO_TIER || "pro"}`);
+    console.log(`  gateway:    ${config2.SYNKRO_GATEWAY_URL || "https://api.synkro.sh"}`);
+    console.log(`  version:    ${config2.SYNKRO_VERSION || "?"}`);
+    console.log(`
+To change:`);
+    console.log(`  synkro config grading <local|byok>    \u2014 where grading runs`);
+    console.log(`  synkro config storage <local|cloud>   \u2014 where telemetry is stored`);
+    console.log(`  synkro config --inference fast|standard`);
+    return;
+  }
+  if (args2[0] === "grading") {
+    const value = args2[1];
+    if (value !== "local" && value !== "byok") {
+      console.error("Usage: synkro config grading <local|byok>");
+      process.exit(1);
+    }
+    updateConfigValue("SYNKRO_GRADING_MODE", value);
+    console.log(`\u2713 Grading mode set to '${value}'.`);
+    if (value === "byok") {
+      console.log("  BYOK grading uses your own provider key \u2014 register one in the");
+      console.log("  dashboard under Settings \u2192 Provider Keys if you have not already.");
+    }
+    return;
+  }
+  if (args2[0] === "storage") {
+    const value = args2[1];
+    if (value !== "local" && value !== "cloud") {
+      console.error("Usage: synkro config storage <local|cloud>");
+      process.exit(1);
+    }
+    updateConfigValue("SYNKRO_STORAGE_MODE", value);
+    console.log(`\u2713 Storage mode set to '${value}'.`);
+    return;
+  }
+  let inferenceValue;
+  for (const a of args2) {
+    if (a.startsWith("--inference=")) inferenceValue = a.slice("--inference=".length);
+    else if (a === "--inference" && args2.indexOf(a) + 1 < args2.length) inferenceValue = args2[args2.indexOf(a) + 1];
+  }
+  if (!inferenceValue || !["fast", "standard"].includes(inferenceValue)) {
+    console.error("Usage: synkro config --inference fast|standard");
+    process.exit(1);
+  }
+  if (!isAuthenticated()) {
+    console.error("Not authenticated. Run `synkro login` first.");
+    process.exit(1);
+  }
+  const token = getAccessToken();
+  const config = readConfigEnv();
+  const gatewayUrl = (config.SYNKRO_GATEWAY_URL || "https://api.synkro.sh").replace(/\/$/, "");
+  try {
+    const resp = await fetch(`${gatewayUrl}/api/v1/cli/me`, {
+      method: "PATCH",
+      headers: {
+        "Authorization": `Bearer ${token}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ fast_inference: inferenceValue === "fast" })
+    });
+    if (!resp.ok) {
+      const errText = await resp.text().catch(() => "");
+      console.error(`Failed to update: ${resp.status} ${errText.slice(0, 200)}`);
+      process.exit(1);
+    }
+  } catch (err) {
+    console.error(`Failed to reach server: ${err.message}`);
+    process.exit(1);
+  }
+  updateConfigValue("SYNKRO_INFERENCE", inferenceValue);
+  console.log(`\u2713 Inference set to '${inferenceValue}'.`);
+}
+var SYNKRO_DIR6, CONFIG_PATH5;
+var init_config = __esm({
+  "cli/commands/config.ts"() {
+    "use strict";
+    init_stub();
+    SYNKRO_DIR6 = join15(homedir15(), ".synkro");
+    CONFIG_PATH5 = join15(SYNKRO_DIR6, "config.env");
+  }
+});
+
 // cli/bootstrap.js
-import { readFileSync as readFileSync12, existsSync as existsSync15 } from "fs";
+import { readFileSync as readFileSync13, existsSync as existsSync16 } from "fs";
 import { resolve as resolve2 } from "path";
 var envCandidates = [
   resolve2(process.cwd(), ".env"),
   resolve2(process.env.HOME ?? "", ".synkro", "config.env")
 ];
 for (const envPath of envCandidates) {
-  if (!existsSync15(envPath)) continue;
-  const envContent = readFileSync12(envPath, "utf-8");
+  if (!existsSync16(envPath)) continue;
+  const envContent = readFileSync13(envPath, "utf-8");
   for (const line of envContent.split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -9004,7 +9136,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.10");
+  console.log("1.6.12");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents
@@ -9019,8 +9151,14 @@ Commands:
   start [opts]           Start the server (with pgdata integrity check)
   restart [opts]         Safe restart (stop \u2192 start, data preserved)
   update                 Pull the latest container image and safely restart
+  config                 Show or change grading + storage modes
   version                Show version
 
+  config:
+    synkro config                        show current settings
+    synkro config grading <local|byok>   where grading runs
+    synkro config storage <local|cloud>  where telemetry is stored
+
   start/restart opts (recreate the worker pool):
     --workers N          total grader workers (default 8, even-split)
     --providers a,b      grading agents: claude, cursor (or both)
@@ -9087,6 +9225,11 @@ async function main() {
       await updateCommand2();
       break;
     }
+    case "config": {
+      const { configCommand: configCommand2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+      await configCommand2(args.slice(1));
+      break;
+    }
     default: {
       console.error(`Unknown command: ${cmd}`);
       printHelp2();