@synkro-sh/cli 1.6.55 → 1.6.57

package/dist/bootstrap.js

@@ -193,6 +193,19 @@ function installCCHooks(settingsPath, config) {
     ],
     [SYNKRO_MARKER]: true
   });
+  if (config.mcpGateScriptPath) {
+    settings.hooks.PreToolUse.push({
+      matcher: "mcp__.*",
+      hooks: [
+        {
+          type: "command",
+          command: config.mcpGateScriptPath,
+          timeout: 30
+        }
+      ],
+      [SYNKRO_MARKER]: true
+    });
+  }
   if (config.taskActivateIntentScriptPath) {
     settings.hooks.PreToolUse.push({
       matcher: "mcp__synkro-guardrails__activate_standard",
@@ -427,6 +440,7 @@ function installCursorHooks(hooksJsonPath, config) {
     timeout: 10,
     matcher: "Shell|Bash|terminal|run_terminal_cmd|execute_command|delete_file"
   });
+  pushCcHook(h, "beforeMCPExecution", config.mcpGateScriptPath, { timeout: 30 });
   h.afterAgentThought = h.afterAgentThought ?? [];
   h.afterAgentThought.push({
     command: bunRunCmd(config.agentCaptureScriptPath),
@@ -484,6 +498,7 @@ var init_cursorHookConfig = __esm({
       "preToolUse",
       "afterFileEdit",
       "postToolUse",
+      "beforeMCPExecution",
       "afterAgentThought",
       "afterAgentResponse"
     ];
@@ -820,7 +835,7 @@ synkro_post_with_retry() {
 function stubHook(surface, optsLiteral) {
   return "#!/usr/bin/env bun\nimport { runStub } from './_synkro-stub-common.ts';\nrunStub(" + JSON.stringify(surface) + ", " + optsLiteral + ");\n";
 }
-var SYNKRO_COMMON_TS, EDIT_PRECHECK_TS, CWE_PRECHECK_TS, CVE_PRECHECK_TS, INSTALL_SCAN_TS, BASH_JUDGE_TS, AGENT_JUDGE_TS, PLAN_JUDGE_TS, STOP_SUMMARY_TS, SESSION_START_TS, BASH_FOLLOWUP_TS, TRANSCRIPT_SYNC_TS, USER_PROMPT_SUBMIT_TS, CURSOR_BASH_JUDGE_TS, CURSOR_EDIT_CAPTURE_TS, CURSOR_AGENT_CAPTURE_TS, STUB_COMMON_TS, STUB_EDIT_PRECHECK_TS, STUB_CWE_PRECHECK_TS, STUB_CVE_PRECHECK_TS, STUB_BASH_JUDGE_TS, STUB_INSTALL_SCAN_TS, STUB_AGENT_JUDGE_TS, STUB_PLAN_JUDGE_TS, STUB_STOP_SUMMARY_TS, STUB_SESSION_START_TS, STUB_TRANSCRIPT_SYNC_TS, STUB_USER_PROMPT_SUBMIT_TS, STUB_BASH_FOLLOWUP_TS, STUB_TASK_ACTIVATE_INTENT_TS, STUB_CURSOR_BASH_JUDGE_TS, STUB_CURSOR_EDIT_CAPTURE_TS, STUB_CURSOR_AGENT_CAPTURE_TS;
+var SYNKRO_COMMON_TS, EDIT_PRECHECK_TS, CWE_PRECHECK_TS, CVE_PRECHECK_TS, INSTALL_SCAN_TS, BASH_JUDGE_TS, AGENT_JUDGE_TS, PLAN_JUDGE_TS, STOP_SUMMARY_TS, SESSION_START_TS, BASH_FOLLOWUP_TS, TRANSCRIPT_SYNC_TS, USER_PROMPT_SUBMIT_TS, CURSOR_BASH_JUDGE_TS, CURSOR_EDIT_CAPTURE_TS, CURSOR_AGENT_CAPTURE_TS, STUB_COMMON_TS, STUB_EDIT_PRECHECK_TS, STUB_CWE_PRECHECK_TS, STUB_CVE_PRECHECK_TS, STUB_BASH_JUDGE_TS, STUB_INSTALL_SCAN_TS, STUB_AGENT_JUDGE_TS, STUB_MCP_GATE_TS, STUB_PLAN_JUDGE_TS, STUB_STOP_SUMMARY_TS, STUB_SESSION_START_TS, STUB_TRANSCRIPT_SYNC_TS, STUB_USER_PROMPT_SUBMIT_TS, STUB_BASH_FOLLOWUP_TS, STUB_TASK_ACTIVATE_INTENT_TS, STUB_CURSOR_BASH_JUDGE_TS, STUB_CURSOR_EDIT_CAPTURE_TS, STUB_CURSOR_AGENT_CAPTURE_TS;
 var init_hookScriptsTs = __esm({
   "cli/installer/hookScriptsTs.ts"() {
     "use strict";
@@ -6432,6 +6447,7 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
     STUB_BASH_JUDGE_TS = stubHook("bash-judge", "{ needsTranscript: true }");
     STUB_INSTALL_SCAN_TS = stubHook("install-scan", "{ needsTranscript: true }");
     STUB_AGENT_JUDGE_TS = stubHook("agent-judge", "{ needsTranscript: true }");
+    STUB_MCP_GATE_TS = stubHook("mcp-gate", "{ needsTranscript: true }");
     STUB_PLAN_JUDGE_TS = stubHook("plan-judge", "{ needsPlan: true }");
     STUB_STOP_SUMMARY_TS = stubHook("stop-summary", "{ needsTranscript: true, fullTranscript: true }");
     STUB_SESSION_START_TS = stubHook("session-start", "{ telemetry: true }");
@@ -7364,9 +7380,9 @@ __export(claudeDesktopTap_exports, {
   runClaudeDesktopTap: () => runClaudeDesktopTap
 });
 import { spawn } from "child_process";
-import { writeFileSync as writeFileSync6, mkdtempSync, readFileSync as readFileSync5, existsSync as existsSync7 } from "fs";
+import { writeFileSync as writeFileSync6, mkdtempSync, mkdirSync as mkdirSync6, readFileSync as readFileSync5, existsSync as existsSync7 } from "fs";
 import { join as join5 } from "path";
-import { tmpdir, homedir as homedir5 } from "os";
+import { homedir as homedir5 } from "os";
 function claudeDesktopInstalled() {
   return process.platform === "darwin" && existsSync7("/Applications/Claude.app/Contents/MacOS/Claude");
 }
@@ -7451,7 +7467,7 @@ fi
 echo "Starting proxy on :$PROXY_PORT..."
 # stdin from /dev/null so mitmdump can't grab the TTY in raw mode \u2014 otherwise it
 # captures keypresses (incl. Ctrl+C) instead of letting them become a signal.
-mitmdump --set confdir="$MITM_CA_DIR" --listen-port $PROXY_PORT --mode regular -s "$TAP_SCRIPT" </dev/null &>/tmp/synkro-mitm.log &
+mitmdump --set confdir="$MITM_CA_DIR" --listen-port $PROXY_PORT --mode regular -s "$TAP_SCRIPT" </dev/null &>"$(dirname "$TAP_SCRIPT")/mitm.log" &
 MITM_PID=$!
 sleep 2
 
@@ -7489,7 +7505,9 @@ async function runClaudeDesktopTap() {
     console.log("  Could not read local auth token (~/.synkro/.mcp-jwt). Run `synkro install` first.");
     return;
   }
-  const sessionDir = mkdtempSync(join5(tmpdir(), "synkro-cd-"));
+  const cdRoot = join5(homedir5(), ".synkro", "cd-sessions");
+  mkdirSync6(cdRoot, { recursive: true });
+  const sessionDir = mkdtempSync(join5(cdRoot, "synkro-cd-"));
   writeFileSync6(join5(sessionDir, "tap.py"), ADDON_PY, "utf-8");
   writeFileSync6(join5(sessionDir, "mcp_proxy.py"), MCP_PROXY_PY, { mode: 493 });
   writeFileSync6(join5(sessionDir, "mcp_patch.py"), MCP_PATCH_PY, "utf-8");
@@ -7498,7 +7516,7 @@ async function runClaudeDesktopTap() {
   await new Promise((resolve4) => {
     const child = spawn("bash", [runnerPath], {
       stdio: "inherit",
-      env: { ...process.env, SYNKRO_CAPTURE_URL: CAPTURE_URL, SYNKRO_TAP_TOKEN: token }
+      env: { ...process.env, SYNKRO_CAPTURE_URL: CAPTURE_URL, SYNKRO_SCAN_URL: SCAN_URL, SYNKRO_SCAN_TURN_URL: SCAN_TURN_URL, SYNKRO_DLP_POLICY_URL: DLP_POLICY_URL, SYNKRO_TAP_TOKEN: token, SYNKRO_TAP_TOKEN_FILE: JWT_PATH }
     });
     const forward = (sig) => {
       try {
@@ -7515,17 +7533,55 @@ async function runClaudeDesktopTap() {
     });
   });
 }
-var CAPTURE_URL, JWT_PATH, ADDON_PY, MCP_PROXY_PY, MCP_PATCH_PY;
+var CAPTURE_URL, SCAN_URL, SCAN_TURN_URL, DLP_POLICY_URL, JWT_PATH, ADDON_PY, MCP_PROXY_PY, MCP_PATCH_PY;
 var init_claudeDesktopTap = __esm({
   "cli/installer/claudeDesktopTap.ts"() {
     "use strict";
     CAPTURE_URL = "http://127.0.0.1:18931/api/local/capture";
+    SCAN_URL = "http://127.0.0.1:18931/api/local/scan-upload";
+    SCAN_TURN_URL = "http://127.0.0.1:18931/api/local/scan-turn";
+    DLP_POLICY_URL = "http://127.0.0.1:18931/api/local/dlp-policy";
     JWT_PATH = join5(homedir5(), ".synkro", ".mcp-jwt");
-    ADDON_PY = `import os, json, threading, urllib.request, re
+    ADDON_PY = `import os, json, threading, urllib.request, urllib.error, re, base64
 from mitmproxy import http
 
 CAPTURE_URL = os.environ.get("SYNKRO_CAPTURE_URL", "")
 TOKEN = os.environ.get("SYNKRO_TAP_TOKEN", "")
+SCAN_URL = os.environ.get("SYNKRO_SCAN_URL", "")
+SCAN_TURN_URL = os.environ.get("SYNKRO_SCAN_TURN_URL", "")
+POLICY_URL = os.environ.get("SYNKRO_DLP_POLICY_URL", "")
+# Token file path \u2014 the SERVER_TOKEN rotates whenever the container is recreated,
+# so we re-read it from disk on a 401 instead of needing a tap restart.
+TOKEN_FILE = os.environ.get("SYNKRO_TAP_TOKEN_FILE", "")
+_token_lock = threading.Lock()
+
+def _reload_token():
+    global TOKEN
+    if not TOKEN_FILE: return
+    try:
+        with open(TOKEN_FILE) as f:
+            t = f.read().strip()
+        if t:
+            with _token_lock: TOKEN = t
+            print("[synkro] auth token reloaded after 401 (container likely recreated)")
+    except Exception:
+        pass
+
+def _post_json(url, payload_bytes, timeout):
+    # POST JSON with auto-reauth: on a 401 (token rotated by a container recreate),
+    # re-read the token file and retry ONCE. CWE-362: TOKEN is always snapshotted
+    # under the lock before use, never read bare.
+    for attempt in range(2):
+        with _token_lock: tok = TOKEN
+        try:
+            req = urllib.request.Request(url, data=payload_bytes, headers={"Content-Type": "application/json", "Authorization": "Bearer " + tok})
+            with urllib.request.urlopen(req, timeout=timeout) as resp:
+                return resp.read()
+        except urllib.error.HTTPError as e:
+            if e.code == 401 and attempt == 0:
+                _reload_token(); continue
+            raise
+    return None
 
 # Governance signals parsed from the completion SSE (usage window + web-search
 # sources), keyed by conversation id. The completion POST always precedes the
@@ -7538,7 +7594,206 @@ _sse_lock = threading.Lock()
 _mcp_registry = {}
 _mcp_lock = threading.Lock()
 
+def _fmt_tool_name(raw):
+    # Claude Desktop names connector tool_use blocks as "<ServerName><tool>" with
+    # no delimiter (e.g. "Linearlist_issues"). Split it back to "Server:tool" using
+    # the captured MCP registry so the dashboard can resolve the server favicon +
+    # render a clean label. Exact server+tool match only \u2014 never a fuzzy guess.
+    if not raw or ":" in raw: return raw
+    try:
+        with _mcp_lock:
+            servers = list(_mcp_registry.values())
+        for s in servers:
+            sname = s.get("name", "")
+            if not sname or not raw.startswith(sname): continue
+            rest = raw[len(sname):]
+            for t in s.get("tools", []):
+                tn = t.get("name", "")
+                if tn and rest == tn:
+                    return sname + ":" + tn
+    except Exception:
+        pass
+    return raw
+
+# \u2500\u2500 M3 live-hold state \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+# Whether to HOLD connector turns (buffer the live completion until graded).
+# Fetched once from the server: True only when a BLOCK-mode rule exists (+ not
+# silent). Audit-only orgs get False \u2192 stream + async audit, ZERO added latency.
+_dlp_hold = None
+_dlp_lock = threading.Lock()
+# Shown live in place of a held connector turn while the single grader (the tree
+# GET) runs; replaced by the real content (if clean) or the block notice.
+REVIEWING_NOTICE = "\\U0001F6E1\\uFE0F  Synkro is reviewing this response for policy compliance\\u2026"
+
+def _should_hold():
+    global _dlp_hold
+    with _dlp_lock:
+        if _dlp_hold is not None:
+            return _dlp_hold
+    val = False
+    if POLICY_URL:
+        try:
+            with urllib.request.urlopen(urllib.request.Request(POLICY_URL), timeout=4) as resp:
+                val = bool(json.loads(resp.read().decode("utf-8", "replace")).get("hold"))
+        except Exception:
+            val = False
+    with _dlp_lock:
+        _dlp_hold = val
+    return val
+
+def _scan_turn_call(cid, msgs, connector):
+    # Synchronous DLP grade. Returns the block reason (str) on BLOCK, else None.
+    # Fail-OPEN \u2014 a scan error never blocks the turn.
+    if not (SCAN_TURN_URL and TOKEN): return None
+    try:
+        vb = _post_json(SCAN_TURN_URL, json.dumps({"conversation_id": str(cid)[:80], "messages": msgs, "connector": connector}).encode(), 18)
+        vd = json.loads((vb or b"{}").decode("utf-8", "replace"))
+        if vd.get("block"):
+            return str(vd.get("reason", "restricted data"))[:300]
+    except Exception as e:
+        print("[synkro] turn scan error (fail-open): " + str(e))
+    return None
+
+def _scan_sse_line(line, st):
+    # Extract governance metadata (usage window + web-search sources/citations)
+    # from one completion SSE line. Shared by the streaming + buffered paths.
+    if st["usage"] is None:
+        um = re.search(r'"5h":\\{"status":"([^"]*)","resets_at":(\\d+),"utilization":([0-9.]+)', line)
+        if um:
+            st["usage"] = {"window": "5h", "status": um.group(1), "resets_at": int(um.group(2)), "utilization": float(um.group(3))}
+    if len(st["sources"]) < 50:
+        for sm in re.finditer(r'"webpage_metadata","site_domain":"([^"]*)"(?:,"favicon_url":"[^"]*")?,"site_name":"([^"]*)"', line):
+            d = sm.group(1)
+            if d and d not in st["seen"] and len(st["sources"]) < 50:
+                st["seen"].add(d)
+                st["sources"].append({"domain": d, "name": sm.group(2)})
+    if "citation_start_delta" in line and line.startswith("data: ") and len(st["citations"]) < 50:
+        try:
+            cit = json.loads(line[6:]).get("delta", {}).get("citation", {})
+            url = cit.get("url", "")
+            if url and url not in st["cseen"]:
+                st["cseen"].add(url)
+                md = cit.get("metadata") or {}
+                st["citations"].append({"title": cit.get("title", ""), "url": url, "domain": md.get("site_domain", "")})
+        except Exception:
+            pass
+
+def _new_scan_state():
+    return {"carry": "", "usage": None, "sources": [], "seen": set(), "citations": [], "cseen": set()}
+
+def _extract_sse_text(body):
+    # Pull all visible text out of a buffered completion SSE (assistant text +
+    # tool_result content) for grading, and detect whether a tool/connector ran.
+    parts = []
+    tool = ("tool_use" in body) or ("tool_result" in body)
+    total = 0
+    for line in body.split("\\n"):
+        if total > 2000000: break
+        if not line.startswith("data: "): continue
+        try: obj = json.loads(line[6:])
+        except Exception: continue
+        d = obj.get("delta")
+        if isinstance(d, dict) and isinstance(d.get("text"), str):
+            parts.append(d["text"]); total += len(d["text"])
+        cb = obj.get("content_block")
+        if isinstance(cb, dict):
+            if isinstance(cb.get("text"), str): parts.append(cb["text"]); total += len(cb["text"])
+            c = cb.get("content")
+            if isinstance(c, str): parts.append(c); total += len(c)
+            elif isinstance(c, list):
+                for x in c:
+                    if isinstance(x, dict) and isinstance(x.get("text"), str): parts.append(x["text"]); total += len(x["text"])
+    return ("".join(parts)[:2000000], tool)
+
+def _neutralize_sse(body, notice):
+    # Rewrite a buffered completion SSE: blank every text/content field (inject the
+    # notice into the FIRST text delta), leaving all structural events intact so
+    # Claude Desktop still renders a valid \u2014 but content-free \u2014 turn.
+    out = []
+    injected = [False]
+    for line in body.split("\\n"):
+        if not line.startswith("data: "):
+            out.append(line); continue
+        try: obj = json.loads(line[6:])
+        except Exception:
+            out.append(line); continue
+        changed = False
+        d = obj.get("delta")
+        if isinstance(d, dict) and isinstance(d.get("text"), str):
+            d["text"] = (notice if not injected[0] else "")
+            injected[0] = True; changed = True
+        cb = obj.get("content_block")
+        if isinstance(cb, dict):
+            if isinstance(cb.get("text"), str) and cb["text"]:
+                cb["text"] = ""; changed = True
+            if cb.get("content"):
+                cb["content"] = ""; changed = True
+        out.append(("data: " + json.dumps(obj)) if changed else line)
+    return "\\n".join(out)
+
 class SynkroTap:
+    def request(self, flow):
+        # \u2500\u2500 Upload DLP gate \u2500\u2500 Scan file uploads BEFORE they reach claude.ai and
+        # refuse a blocked one (the file never enters the model). SYNCHRONOUS: this
+        # upload waits for the verdict. Fail-OPEN \u2014 a scan error never breaks an
+        # upload. CWE-200: never print the filename/content (size/rule only).
+        r = flow.request
+        if not SCAN_URL or not TOKEN: return
+        if "claude.ai" not in (r.pretty_host or ""): return
+        if r.method != "POST": return
+        ct = r.headers.get("content-type", "")
+        path = r.path or ""
+        is_upload = ("multipart/form-data" in ct) or bool(re.search(r"/(files|upload|convert)(/|$|\\?)", path))
+        if not is_upload: return
+        # CWE-400: bound everything. Oversized uploads scan on name/type only \u2014 we
+        # never pull a multi-MB body into memory or forward it to the scanner.
+        MAX_RAW = 8 * 1024 * 1024
+        try: clen = int(r.headers.get("content-length", "0") or "0")
+        except Exception: clen = 0
+        if clen and clen > MAX_RAW:
+            payload = {"file_name": "", "size": clen, "content_b64": ""}
+        else:
+            try: body = r.get_content() or b""
+            except Exception: return
+            if not body or len(body) > MAX_RAW: return
+            fname = ""
+            fm = re.search(rb'filename="([^"]*)"', body)
+            if fm:
+                try: fname = fm.group(1).decode("utf-8", "replace")[:300]
+                except Exception: fname = ""
+            # Extract the uploaded file's RAW bytes from the multipart body so the
+            # grader Reads the real file (a PDF/image must be intact, not the
+            # multipart envelope). Fall back to the whole body if no part is found.
+            file_bytes = None
+            bm = re.search(r"boundary=([^;]+)", ct)
+            if bm and fm:
+                boundary = ("--" + bm.group(1).strip().strip('"')).encode()
+                hdr_end = body.find(b"\\r\\n\\r\\n", fm.start())
+                if hdr_end != -1:
+                    s = hdr_end + 4
+                    e = body.find(b"\\r\\n" + boundary, s)
+                    if e != -1: file_bytes = body[s:e]
+            if file_bytes is None: file_bytes = body
+            try: b64 = base64.b64encode(file_bytes).decode("ascii")
+            except Exception: return
+            payload = {"file_name": fname, "size": len(file_bytes), "content_b64": b64}
+        try:
+            respb = _post_json(SCAN_URL, json.dumps(payload).encode(), 55)
+            verdict = json.loads((respb or b"{}").decode("utf-8", "replace"))
+        except Exception as e:
+            print("[synkro] upload scan error (fail-open): " + str(e))
+            return
+        if verdict.get("block"):
+            reason = str(verdict.get("reason", "Blocked by Synkro policy"))[:300]
+            flow.response = http.Response.make(
+                403,
+                json.dumps({"error": {"type": "blocked_by_synkro", "message": "Blocked by Synkro: " + reason}}).encode(),
+                {"Content-Type": "application/json"},
+            )
+            print("[synkro] BLOCKED upload (size=" + str(payload.get("size", 0)) + " rule=" + str(verdict.get("ruleId", "")) + ")")
+        else:
+            print("[synkro] upload scanned -> allow (size=" + str(payload.get("size", 0)) + ")")
+
     def responseheaders(self, flow):
         # Buffer the small conversation-tree GET (parsed for the dashboard).
         # For the completion POST, TAP the SSE chunk-by-chunk and pass each
@@ -7552,34 +7807,19 @@ class SynkroTap:
             if r.method == "POST" and "completion" in r.path:
                 cm = re.search(r"chat_conversations/([0-9a-fA-F-]+)", r.path)
                 cid = cm.group(1) if cm else ""
-                # Incremental parse: scan complete SSE lines for the small governance
-                # signals AS THEY STREAM and keep only the extracted results \u2014 never
-                # buffer the body. The carry holds at most one partial line (bounded),
-                # so there's NO cap on total stream length and no source is dropped.
-                st = {"carry": "", "usage": None, "sources": [], "seen": set(), "citations": [], "cseen": set()}
-                def _scan(line, _st=st):
-                    if _st["usage"] is None:
-                        um = re.search(r'"5h":\\{"status":"([^"]*)","resets_at":(\\d+),"utilization":([0-9.]+)', line)
-                        if um:
-                            _st["usage"] = {"window": "5h", "status": um.group(1), "resets_at": int(um.group(2)), "utilization": float(um.group(3))}
-                    if len(_st["sources"]) < 50:
-                        for sm in re.finditer(r'"webpage_metadata","site_domain":"([^"]*)"(?:,"favicon_url":"[^"]*")?,"site_name":"([^"]*)"', line):
-                            d = sm.group(1)
-                            if d and d not in _st["seen"] and len(_st["sources"]) < 50:
-                                _st["seen"].add(d)
-                                _st["sources"].append({"domain": d, "name": sm.group(2)})
-                    # Citations: the specific pages the model cited (title + url +
-                    # domain) \u2014 the real "tool result" for web search.
-                    if "citation_start_delta" in line and line.startswith("data: ") and len(_st["citations"]) < 50:
-                        try:
-                            cit = json.loads(line[6:]).get("delta", {}).get("citation", {})
-                            url = cit.get("url", "")
-                            if url and url not in _st["cseen"]:
-                                _st["cseen"].add(url)
-                                md = cit.get("metadata") or {}
-                                _st["citations"].append({"title": cit.get("title", ""), "url": url, "domain": md.get("site_domain", "")})
-                        except Exception:
-                            pass
+                with _mcp_lock:
+                    has_servers = len(_mcp_registry) > 0
+                # M3 LIVE HOLD: only when a BLOCK-mode rule exists AND connectors are
+                # connected, BUFFER the whole completion (leave .stream unset) so
+                # response() can grade it and neutralize restricted content BEFORE the
+                # user sees a single token. Audit-only / no-connector turns skip this
+                # entirely and stream as before \u2014 zero added latency.
+                if has_servers and _should_hold():
+                    flow.metadata["synkro_hold_cid"] = cid
+                    return
+                # Streaming path (unchanged behaviour): tap chunk-by-chunk, extract
+                # governance metadata only, never buffer the body. Audit stays async.
+                st = _new_scan_state()
                 def _tap(data, _st=st, _cid=cid):
                     if data:
                         try:
@@ -7589,9 +7829,9 @@ class SynkroTap:
                         lines = txt.split("\\n")
                         _st["carry"] = lines[-1][-200000:]  # bound the carried partial line (CWE-400)
                         for ln in lines[:-1]:
-                            _scan(ln)
+                            _scan_sse_line(ln, _st)
                     else:  # end of stream \u2014 flush carry + publish
-                        _scan(_st["carry"])
+                        _scan_sse_line(_st["carry"], _st)
                         if (_st["usage"] or _st["sources"] or _st["citations"]) and _cid:
                             with _sse_lock:
                                 _sse_meta[_cid] = {"usage": _st["usage"], "sources": _st["sources"], "citations": _st["citations"]}
@@ -7605,6 +7845,36 @@ class SynkroTap:
     def response(self, flow):
         r = flow.request
         if "claude.ai" not in (r.pretty_host or ""): return
+        # \u2500\u2500 M3: a HELD completion (buffered for inline grading) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+        # We have the full SSE body now. Re-derive governance metadata (same as the
+        # streaming path), then \u2014 if the turn used a tool/connector \u2014 grade it
+        # SYNCHRONOUSLY and, on a block, NEUTRALIZE the response so the user never
+        # sees the restricted content. Verdict is cached for the tree GET to reuse.
+        hold_cid = (flow.metadata.get("synkro_hold_cid") if hasattr(flow, "metadata") else None)
+        if hold_cid is not None and "completion" in r.path and flow.response:
+            try:
+                body = flow.response.get_text() or ""
+            except Exception:
+                body = ""
+            st = _new_scan_state()
+            for ln in body.split("\\n"):
+                _scan_sse_line(ln, st)
+            if (st["usage"] or st["sources"] or st["citations"]) and hold_cid:
+                with _sse_lock:
+                    _sse_meta[hold_cid] = {"usage": st["usage"], "sources": st["sources"], "citations": st["citations"]}
+            text, has_tool = _extract_sse_text(body)
+            if has_tool:
+                # The turn used a connector \u2014 HOLD the live view: replace the streamed
+                # content with a "reviewing" placeholder so the user never sees the raw
+                # response. The tree GET is the SINGLE grader and renders the final
+                # state (real content if clean, block notice if restricted) \u2014 so there
+                # is exactly one full-document grade per turn (no double-grade race).
+                try:
+                    flow.response.text = _neutralize_sse(body, REVIEWING_NOTICE)
+                    print("[synkro] HELD completion -> reviewing placeholder")
+                except Exception as e:
+                    print("[synkro] hold placeholder failed (fail-open): " + str(e))
+            return
         # MCP server registry from the bootstrap SSE stream.
         if "mcp" in r.path and "bootstrap" in r.path and flow.response:
             try:
@@ -7668,7 +7938,7 @@ class SynkroTap:
                     elif bt == "thinking":
                         thinking += b.get("thinking", "") or b.get("text", "")
                     elif bt == "tool_use" or bt == "server_tool_use":
-                        tool_calls.append({"name": b.get("name", ""), "id": b.get("id", ""), "arguments": json.dumps(b.get("input", {}))})
+                        tool_calls.append({"name": _fmt_tool_name(b.get("name", "")), "id": b.get("id", ""), "arguments": json.dumps(b.get("input", {}))})
                     elif bt.endswith("_tool_result") or bt == "tool_result":
                         rc = b.get("content", "")
                         if isinstance(rc, list):
@@ -7690,7 +7960,7 @@ class SynkroTap:
                         # web_search results are server-side (content:[]); we surface the
                         # sources via sse_meta instead. Only record a non-empty result.
                         if rc and str(rc).strip():
-                            tool_results.append({"name": b.get("name", ""), "content": str(rc)})
+                            tool_results.append({"name": _fmt_tool_name(b.get("name", "")), "content": str(rc)})
             elif isinstance(blocks, str):
                 text_parts.append(blocks)
             text = " ".join(p for p in text_parts if p).strip()
@@ -7721,23 +7991,92 @@ class SynkroTap:
             ntools += len(mm.get("tool_calls") or [])
         nsrc = len((sm or {}).get("sources") or [])
         print("[synkro] captured chat (msgs=" + str(len(messages)) + " tools=" + str(ntools) + " sources=" + str(nsrc) + " model=" + model + ")")
+
+        # \u2500\u2500 Tier-2 connector DLP gate \u2500\u2500 If this turn pulled content via an MCP
+        # connector, scan it SYNCHRONOUSLY against blocking org rules. On a block
+        # verdict we HOLD this tree GET (the authoritative render) until the verdict
+        # and then SCRUB the turn from the tree the renderer sees \u2014 the employee
+        # never sees the restricted content. The REAL content is still captured
+        # below for audit (record-everything-even-when-blocked). Fail-OPEN.
+        blocked_reason = None
+        has_connector = any(m.get("role") == "tool" and m.get("content") for m in messages)
+        # SINGLE grader: the held completion only shows a "reviewing" placeholder, so
+        # the tree GET is the one and only place a turn is graded \u2014 exactly one
+        # full-document grade per turn (no double-grade). Gated on a BLOCK-mode rule
+        # existing; audit-only orgs (_should_hold False) skip this and stay async.
+        if _should_hold() and SCAN_TURN_URL and TOKEN and has_connector:
+            # CWE-20/CWE-400: bounded, shape-validated payload (<=200 msgs, <=2MB).
+            scan_msgs = []
+            budget = 2000000
+            for m in messages[:200]:
+                if budget <= 0: break
+                c = str(m.get("content", ""))[:min(500000, budget)]
+                budget -= len(c)
+                scan_msgs.append({"role": str(m.get("role", "user"))[:20], "content": c, "name": str(m.get("name", ""))[:200]})
+            connector = ""
+            for m in scan_msgs:
+                if m["role"] == "tool" and m["name"]:
+                    nm = m["name"]; connector = (nm.split(":")[0] if ":" in nm else nm); break
+            blocked_reason = _scan_turn_call(convo_id, scan_msgs, connector)
+
+        # Capture the REAL content for audit regardless of the block decision.
         def send(_d=data):
             try:
-                req = urllib.request.Request(CAPTURE_URL, data=json.dumps(_d).encode(), headers={"Content-Type": "application/json", "Authorization": "Bearer " + TOKEN})
-                urllib.request.urlopen(req, timeout=5)
+                _post_json(CAPTURE_URL, json.dumps(_d).encode(), 5)
             except Exception as e:
                 print("[synkro] capture error: " + str(e))
         threading.Thread(target=send, daemon=True).start()
 
+        # Block the rendered view: replace this turn's assistant message content in
+        # the tree (everything after the last human turn) with a Synkro notice, so
+        # the restricted content + any model output derived from it is never shown.
+        if blocked_reason is not None:
+            notice = "[Blocked by Synkro] " + blocked_reason
+            for i in range(last_human + 1, len(all_msgs)):
+                if all_msgs[i].get("sender") != "human":
+                    all_msgs[i]["content"] = [{"type": "text", "text": notice}]
+            try:
+                flow.response.text = json.dumps(convo)
+                print("[synkro] BLOCKED turn view (reason=" + blocked_reason[:80] + ")")
+            except Exception as e:
+                print("[synkro] block scrub failed (fail-open): " + str(e))
+
 addons = [SynkroTap()]
 `;
     MCP_PROXY_PY = `#!/usr/bin/env python3
 """Synkro MCP Proxy (local) \u2014 stdio passthrough that taps MCP tool calls."""
-import sys, os, json, subprocess, threading, urllib.request, time
+import sys, os, json, subprocess, threading, urllib.request, urllib.error, time
 
 CAPTURE_URL = os.environ.get("SYNKRO_CAPTURE_URL", "")
 TOKEN = os.environ.get("SYNKRO_TAP_TOKEN", "")
 SERVER_NAME = os.environ.get("SYNKRO_MCP_SERVER", "unknown")
+# The SERVER_TOKEN rotates on container recreate; re-read it from disk on a 401.
+TOKEN_FILE = os.environ.get("SYNKRO_TAP_TOKEN_FILE", "") or os.path.expanduser("~/.synkro/.mcp-jwt")
+_token_lock = threading.Lock()
+
+def _reload_token():
+    global TOKEN
+    try:
+        with open(TOKEN_FILE) as f:
+            t = f.read().strip()
+        if t:
+            with _token_lock: TOKEN = t
+    except Exception:
+        pass
+
+def _post_json(url, payload_bytes, timeout):
+    # CWE-362: TOKEN snapshotted under the lock. Auto-reauth retry once on 401.
+    for attempt in range(2):
+        with _token_lock: tok = TOKEN
+        try:
+            req = urllib.request.Request(url, data=payload_bytes, headers={"Content-Type": "application/json", "Authorization": "Bearer " + tok})
+            with urllib.request.urlopen(req, timeout=timeout) as resp:
+                return resp.read()
+        except urllib.error.HTTPError as e:
+            if e.code == 401 and attempt == 0:
+                _reload_token(); continue
+            raise
+    return None
 
 pending = {}
 pending_lock = threading.Lock()
@@ -7755,8 +8094,7 @@ def send_capture(tool_name, tool_args, tool_result, latency_ms):
             },
             "mcp": {"server": SERVER_NAME, "tool": tool_name, "latency_ms": latency_ms}
         }).encode()
-        req = urllib.request.Request(CAPTURE_URL, data=payload, headers={"Content-Type": "application/json", "Authorization": "Bearer " + TOKEN})
-        urllib.request.urlopen(req, timeout=5)
+        _post_json(CAPTURE_URL, payload, 5)
     except Exception as e:
         print("[synkro-mcp] capture error: " + str(e), file=sys.stderr)
 
@@ -7883,7 +8221,7 @@ __export(macKeychain_exports, {
   writeCursorApiKey: () => writeCursorApiKey,
   writeRefreshAgent: () => writeRefreshAgent
 });
-import { existsSync as existsSync8, mkdirSync as mkdirSync6, writeFileSync as writeFileSync7, chmodSync, readFileSync as readFileSync6, statSync } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync7, writeFileSync as writeFileSync7, chmodSync, readFileSync as readFileSync6, statSync } from "fs";
 import { homedir as homedir6, platform as platform2 } from "os";
 import { join as join6 } from "path";
 import { spawnSync } from "child_process";
@@ -7903,7 +8241,7 @@ function readKeychainCreds() {
 function exportKeychainCreds() {
   const blob = readKeychainCreds();
   if (!blob) return null;
-  mkdirSync6(CLAUDE_CREDS_DIR, { recursive: true });
+  mkdirSync7(CLAUDE_CREDS_DIR, { recursive: true });
   chmodSync(CLAUDE_CREDS_DIR, 448);
   writeFileSync7(CLAUDE_CREDS_FILE, blob, "utf-8");
   chmodSync(CLAUDE_CREDS_FILE, 384);
@@ -7919,7 +8257,7 @@ function cursorApiKeyConfigured() {
 function writeCursorApiKey(key) {
   const trimmed = key.trim();
   if (!trimmed) return;
-  mkdirSync6(CURSOR_CREDS_DIR, { recursive: true });
+  mkdirSync7(CURSOR_CREDS_DIR, { recursive: true });
   chmodSync(CURSOR_CREDS_DIR, 448);
   writeFileSync7(CURSOR_API_KEY_FILE, trimmed, "utf-8");
   chmodSync(CURSOR_API_KEY_FILE, 384);
@@ -7958,7 +8296,7 @@ function writeRefreshAgent(synkroBinPath) {
   if (platform2() !== "darwin") {
     throw new KeychainExportError("writeRefreshAgent is darwin-only");
   }
-  mkdirSync6(join6(homedir6(), "Library", "LaunchAgents"), { recursive: true });
+  mkdirSync7(join6(homedir6(), "Library", "LaunchAgents"), { recursive: true });
   const shellCmd = `export PATH="/opt/homebrew/bin:/usr/local/bin:$PATH" && { "${synkroBinPath}" local-cc refresh-creds || synkro local-cc refresh-creds; }`;
   const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -8074,7 +8412,7 @@ __export(dockerInstall_exports, {
   waitForContainerReady: () => waitForContainerReady,
   waitForWorkersReady: () => waitForWorkersReady
 });
-import { copyFileSync, existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync7, readdirSync as readdirSync2 } from "fs";
+import { copyFileSync, existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync7, readdirSync as readdirSync2 } from "fs";
 import { homedir as homedir7 } from "os";
 import { join as join7 } from "path";
 import { execSync as execSync4, spawnSync as spawnSync2 } from "child_process";
@@ -8301,9 +8639,9 @@ async function dockerInstall(opts = {}) {
   const claudeWorkers = opts.claudeWorkers ?? opts.workersPerPool ?? 8;
   const cursorWorkers = opts.cursorWorkers ?? 0;
   const totalWorkers = claudeWorkers + cursorWorkers;
-  mkdirSync7(PGDATA_PATH, { recursive: true });
-  mkdirSync7(BACKUP_DIR, { recursive: true });
-  mkdirSync7(CLAUDE_HOST_STATE_DIR, { recursive: true });
+  mkdirSync8(PGDATA_PATH, { recursive: true });
+  mkdirSync8(BACKUP_DIR, { recursive: true });
+  mkdirSync8(CLAUDE_HOST_STATE_DIR, { recursive: true });
   const hostClaudeJson = join7(homedir7(), ".claude.json");
   if (existsSync9(hostClaudeJson)) {
     copyFileSync(hostClaudeJson, CLAUDE_HOST_STATE_FILE);
@@ -8313,7 +8651,7 @@ async function dockerInstall(opts = {}) {
       `MCP JWT missing at ${MCP_JWT_PATH}. The installer should mint this before calling dockerInstall.`
     );
   }
-  mkdirSync7(CURSOR_CREDS_DIR, { recursive: true });
+  mkdirSync8(CURSOR_CREDS_DIR, { recursive: true });
   if (needsKeychainBridge()) {
     if (claudeWorkers > 0) {
       const path = exportKeychainCreds();
@@ -8336,7 +8674,7 @@ async function dockerInstall(opts = {}) {
       console.warn(`    Plist written to ${plist} \u2014 load manually with launchctl bootstrap when ready.`);
     }
   } else {
-    mkdirSync7(join7(homedir7(), ".claude"), { recursive: true });
+    mkdirSync8(join7(homedir7(), ".claude"), { recursive: true });
   }
   const imageExistsLocally = () => spawnSync2("docker", ["image", "inspect", image], { stdio: "ignore", timeout: 3e4 }).status === 0;
   const skipPull = process.env.SYNKRO_SKIP_PULL === "1" || process.env.SYNKRO_SKIP_PULL === "true";
@@ -8578,7 +8916,7 @@ async function dockerSafeStart() {
     }
   } else {
     console.log("  pgdata: no existing data \u2014 fresh start.");
-    mkdirSync7(PGDATA_PATH, { recursive: true });
+    mkdirSync8(PGDATA_PATH, { recursive: true });
   }
   console.log("  Starting container...");
   const start = spawnSync2("docker", ["start", CONTAINER_NAME], {
@@ -9022,7 +9360,7 @@ __export(install_exports, {
   syncSkillFiles: () => syncSkillFiles,
   writeHookScripts: () => writeHookScripts
 });
-import { existsSync as existsSync11, mkdirSync as mkdirSync8, writeFileSync as writeFileSync8, chmodSync as chmodSync2, readFileSync as readFileSync9, readdirSync as readdirSync3, unlinkSync as unlinkSync4, statSync as statSync2 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, chmodSync as chmodSync2, readFileSync as readFileSync9, readdirSync as readdirSync3, unlinkSync as unlinkSync4, statSync as statSync2 } from "fs";
 import { homedir as homedir9 } from "os";
 import { join as join9 } from "path";
 import { execSync as execSync6 } from "child_process";
@@ -9180,11 +9518,11 @@ coding patterns and the dashboard shows full history. (Y/n) `
   }
 }
 function ensureSynkroDir() {
-  mkdirSync8(SYNKRO_DIR4, { recursive: true });
-  mkdirSync8(HOOKS_DIR, { recursive: true });
-  mkdirSync8(BIN_DIR, { recursive: true });
-  mkdirSync8(OFFSETS_DIR, { recursive: true });
-  mkdirSync8(join9(SYNKRO_DIR4, "sessions"), { recursive: true });
+  mkdirSync9(SYNKRO_DIR4, { recursive: true });
+  mkdirSync9(HOOKS_DIR, { recursive: true });
+  mkdirSync9(BIN_DIR, { recursive: true });
+  mkdirSync9(OFFSETS_DIR, { recursive: true });
+  mkdirSync9(join9(SYNKRO_DIR4, "sessions"), { recursive: true });
 }
 function writeHookScripts(mode = "stub") {
   const installExtractCorePath = join9(HOOKS_DIR, "installExtractCore.ts");
@@ -9207,6 +9545,7 @@ function writeHookScripts(mode = "stub") {
   const cursorAgentCapturePath = join9(HOOKS_DIR, "cursor-agent-capture.ts");
   const mcpStdioProxyPath = join9(HOOKS_DIR, "mcp-stdio-proxy.ts");
   const taskActivateIntentScriptPath = join9(HOOKS_DIR, "cc-task-activate-intent.ts");
+  const mcpGateScriptPath = join9(HOOKS_DIR, "cc-mcp-gate.ts");
   if (mode === "stub") {
     const stubCommonPath = join9(HOOKS_DIR, "_synkro-stub-common.ts");
     const stubFiles = [
@@ -9224,6 +9563,7 @@ function writeHookScripts(mode = "stub") {
       [userPromptSubmitScriptPath, STUB_USER_PROMPT_SUBMIT_TS],
       [installScanScriptPath, STUB_INSTALL_SCAN_TS],
       [taskActivateIntentScriptPath, STUB_TASK_ACTIVATE_INTENT_TS],
+      [mcpGateScriptPath, STUB_MCP_GATE_TS],
       [cursorBashJudgePath, STUB_CURSOR_BASH_JUDGE_TS],
       [cursorEditCapturePath, STUB_CURSOR_EDIT_CAPTURE_TS],
       [cursorAgentCapturePath, STUB_CURSOR_AGENT_CAPTURE_TS]
@@ -9256,7 +9596,8 @@ function writeHookScripts(mode = "stub") {
       cursorBashJudgeScript: cursorBashJudgePath,
       cursorEditCaptureScript: cursorEditCapturePath,
       cursorAgentCaptureScript: cursorAgentCapturePath,
-      taskActivateIntentScript: taskActivateIntentScriptPath
+      taskActivateIntentScript: taskActivateIntentScriptPath,
+      mcpGateScript: mcpGateScriptPath
     };
   }
   writeFileSync8(bashScriptPath, BASH_JUDGE_TS, "utf-8");
@@ -9279,6 +9620,7 @@ function writeHookScripts(mode = "stub") {
   writeFileSync8(mcpStdioProxyPath, MCP_STDIO_PROXY_SRC, "utf-8");
   writeFileSync8(installExtractCorePath, "/**\n * Deterministic install-command extraction \u2014 no LLM, no network.\n * Shared by the API pkg-scan route and the hook scripts (copied to ~/.synkro/hooks/).\n */\nimport { parse as shellParse } from 'shell-quote';\n\nexport interface DeterministicPkgRequest {\n  name: string;\n  version: string;\n  ecosystem: string;\n}\n\ninterface RawInstall {\n  ecosystem: string;\n  name: string;\n  versionSpec: string | null;\n  source: 'registry' | 'git' | 'local' | 'url' | 'unknown';\n}\n\nconst SEPARATOR_OPS = new Set(['&&', '||', ';', '|', '&', '\\n']);\n\n/** Split a shell command into command segments (each an argv string array). */\nexport function segmentCommand(command: string): string[][] {\n  let tokens: unknown[];\n  try {\n    tokens = shellParse(command) as unknown[];\n  } catch {\n    return [command.split(/\\s+/).filter(Boolean)];\n  }\n  const segments: string[][] = [];\n  let current: string[] = [];\n  for (const tok of tokens) {\n    if (typeof tok === 'string') {\n      current.push(tok);\n      continue;\n    }\n    if (tok && typeof tok === 'object') {\n      const op = (tok as { op?: string }).op;\n      const pattern = (tok as { pattern?: string }).pattern;\n      if (op && SEPARATOR_OPS.has(op)) {\n        if (current.length) segments.push(current);\n        current = [];\n      } else if (typeof pattern === 'string') {\n        current.push(pattern);\n      }\n    }\n  }\n  if (current.length) segments.push(current);\n  return segments;\n}\n\nconst PM_TABLE: Record<string, { subs: Set<string>; ecosystem: string }> = {\n  npm:      { subs: new Set(['install', 'i', 'add', 'ci']),  ecosystem: 'npm' },\n  pnpm:     { subs: new Set(['add', 'install', 'i', 'dlx']), ecosystem: 'npm' },\n  yarn:     { subs: new Set(['add', 'install']),             ecosystem: 'npm' },\n  bun:      { subs: new Set(['add', 'install', 'i']),        ecosystem: 'npm' },\n  pip:      { subs: new Set(['install']),                    ecosystem: 'PyPI' },\n  pip3:     { subs: new Set(['install']),                    ecosystem: 'PyPI' },\n  cargo:    { subs: new Set(['add', 'install']),             ecosystem: 'crates.io' },\n  go:       { subs: new Set(['get', 'install']),             ecosystem: 'Go' },\n  gem:      { subs: new Set(['install']),                    ecosystem: 'RubyGems' },\n  composer: { subs: new Set(['require']),                    ecosystem: 'Packagist' },\n};\nconst SYSTEM_PMS = new Set(['apt', 'apt-get', 'apk', 'brew', 'dnf', 'yum', 'pacman']);\nconst SYSTEM_SUBS = new Set(['install', 'add']);\n\nconst WRAPPERS = new Set(['sudo', 'doas', 'command', 'env', 'xargs', 'nice', 'time']);\nconst VALUE_FLAGS = new Set([\n  '--filter', '-F', '-C', '--dir', '--prefix', '--registry', '--tag', '--features',\n  '-v', '--version', '--index-url', '--extra-index-url', '--target', '-t',\n]);\n\nfunction basename(p: string): string {\n  const i = p.lastIndexOf('/');\n  return i >= 0 ? p.slice(i + 1) : p;\n}\n\nfunction stripPrefixes(argv: string[]): string[] {\n  let i = 0;\n  while (i < argv.length) {\n    const t = argv[i];\n    if (WRAPPERS.has(basename(t).toLowerCase())) { i++; continue; }\n    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(t)) { i++; continue; }\n    break;\n  }\n  return argv.slice(i);\n}\n\nfunction looksLikePath(tok: string): boolean {\n  return tok === '.' || tok === '..' || /^\\.{0,2}\\//.test(tok) || tok.startsWith('~/') || tok.startsWith('file:');\n}\n\n/** Shell redirect fragments (e.g. `2>&1` \u2192 argv `2`, `1`) \u2014 not package names. */\nfunction isRedirectFragment(tok: string): boolean {\n  if (/^\\d+$/.test(tok)) return true;\n  if (/^[<>]|[<>]$/.test(tok)) return true;\n  if (tok === '&' || tok === '|') return true;\n  if (/^\\d*[<>]/.test(tok)) return true;\n  return false;\n}\n\nfunction parsePackageToken(tok: string, ecosystem: string): RawInstall | null {\n  if (/^(https?:)?\\/\\//.test(tok) || tok.startsWith('git+') || tok.startsWith('git:')) {\n    return { ecosystem, name: tok, versionSpec: null, source: tok.includes('git') ? 'git' : 'url' };\n  }\n  if (looksLikePath(tok)) {\n    return { ecosystem, name: basename(tok.replace(/\\/+$/, '')) || tok, versionSpec: null, source: 'local' };\n  }\n  if (ecosystem === 'PyPI') {\n    const noExtras = tok.replace(/\\[[^\\]]*\\]/g, '');\n    const m = noExtras.match(/^([A-Za-z0-9_.-]+)\\s*([=~!<>].*)?$/);\n    if (!m) return null;\n    return { ecosystem, name: m[1], versionSpec: m[2] ? m[2].trim() : null, source: 'registry' };\n  }\n  if (ecosystem === 'Packagist') {\n    // composer uses vendor/package:version-constraint (e.g. monolog/monolog:1.0.0).\n    // Split on the first ':' after the vendor/ slash; never on the '/'.\n    const ci = tok.indexOf(':');\n    if (ci > 0) return { ecosystem, name: tok.slice(0, ci), versionSpec: tok.slice(ci + 1) || null, source: 'registry' };\n    return { ecosystem, name: tok, versionSpec: null, source: 'registry' };\n  }\n  const at = tok.lastIndexOf('@');\n  if (at > 0) {\n    return { ecosystem, name: tok.slice(0, at), versionSpec: tok.slice(at + 1) || null, source: 'registry' };\n  }\n  return { ecosystem, name: tok, versionSpec: null, source: 'registry' };\n}\n\n/** Deterministic extraction for a single command segment. */\nexport function extractSegment(rawArgv: string[]): RawInstall[] {\n  let argv = stripPrefixes(rawArgv);\n  if (argv.length < 2) return [];\n  let bin = basename(argv[0]).toLowerCase();\n\n  if (bin === 'uv' && argv[1] === 'pip') { argv = argv.slice(1); bin = 'pip'; }\n  if ((bin === 'python' || bin === 'python3') && argv.includes('-m')) {\n    const mi = argv.indexOf('-m');\n    if (argv[mi + 1] === 'pip') { argv = ['pip', ...argv.slice(mi + 2)]; bin = 'pip'; }\n  }\n\n  const isSystem = SYSTEM_PMS.has(bin);\n  const entry = PM_TABLE[bin];\n  if (!entry && !isSystem) return [];\n  const ecosystem = entry ? entry.ecosystem : 'system';\n  const subs = entry ? entry.subs : SYSTEM_SUBS;\n\n  let subIdx = -1;\n  for (let i = 1; i < argv.length; i++) {\n    if (subs.has(argv[i].toLowerCase())) { subIdx = i; break; }\n  }\n  if (subIdx === -1) return [];\n\n  const installs: RawInstall[] = [];\n  // gem pins the version with a separate `-v`/`--version` flag rather than an\n  // inline spec; capture it and apply to the package(s) in this segment.\n  let flagVersion: string | null = null;\n  for (let i = subIdx + 1; i < argv.length; i++) {\n    const tok = argv[i];\n    if (isRedirectFragment(tok)) break;\n    if (tok.startsWith('-')) {\n      const lower = tok.toLowerCase();\n      if (ecosystem === 'RubyGems' && (lower === '-v' || lower === '--version')) {\n        flagVersion = (argv[i + 1] || '').replace(/^[v=\\s]+/, '') || null;\n        i++;\n        continue;\n      }\n      if (VALUE_FLAGS.has(tok)) i++;\n      continue;\n    }\n    const parsed = parsePackageToken(tok, ecosystem);\n    if (parsed) installs.push(parsed);\n  }\n  if (flagVersion) {\n    for (const ins of installs) {\n      if (ins.source === 'registry' && !ins.versionSpec) ins.versionSpec = flagVersion;\n    }\n  }\n  return installs;\n}\n\nconst ECO_TO_OSV: Record<string, string | null> = {\n  npm: 'npm',\n  pypi: 'PyPI', PyPI: 'PyPI',\n  cargo: 'crates.io', 'crates.io': 'crates.io',\n  go: 'Go', Go: 'Go',\n  rubygems: 'RubyGems', RubyGems: 'RubyGems',\n  packagist: 'Packagist', Packagist: 'Packagist',\n  maven: 'Maven', Maven: 'Maven',\n  nuget: 'NuGet', NuGet: 'NuGet',\n  apt: null, brew: null, system: null, other: null,\n};\n\nfunction normalizeName(name: string, osvEco: string): string {\n  const n = name.trim();\n  if (osvEco === 'npm') return n.toLowerCase();\n  if (osvEco === 'PyPI') return n.toLowerCase().replace(/[-_.]+/g, '-');\n  return n;\n}\n\nfunction concretePin(spec: string | null): string | null {\n  if (!spec) return null;\n  const c = spec.trim().replace(/^[v=\\s]+/, '');\n  if (c.toLowerCase() === 'latest' || c === '') return null;\n  if (/[\\^~><|*\\sx]/i.test(c)) return null;\n  return /^\\d[\\w.\\-+]*$/.test(c) ? c : null;\n}\n\nconst PKG_JSON_DEP_FIELDS = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];\n\nfunction safeParseObject(text: string): Record<string, any> | null {\n  try {\n    const v = JSON.parse(text);\n    return v && typeof v === 'object' && !Array.isArray(v) ? v : null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Diff two package.json contents and return the registry packages that are\n * newly added or whose version spec changed in the new content. The caller\n * scans these against the vuln DB before letting the edit land \u2014 so a bare\n * `pnpm install` afterwards has nothing left to vet. Non-registry sources\n * (file:, link:, workspace:, git, http, relative paths) are skipped.\n */\nexport function extractPackageJsonDelta(oldText: string, newText: string): DeterministicPkgRequest[] {\n  const newJson = safeParseObject(newText);\n  if (!newJson) return [];\n  const oldJson = safeParseObject(oldText) || {};\n\n  const out = new Map<string, DeterministicPkgRequest>();\n  for (const field of PKG_JSON_DEP_FIELDS) {\n    const oldDeps = (oldJson[field] && typeof oldJson[field] === 'object') ? oldJson[field] : {};\n    const newDeps = (newJson[field] && typeof newJson[field] === 'object') ? newJson[field] : {};\n    for (const [rawName, version] of Object.entries(newDeps)) {\n      if (typeof version !== 'string') continue;\n      if (oldDeps[rawName] === version) continue;\n      const spec = version.trim();\n      if (\n        spec.startsWith('file:') || spec.startsWith('link:') ||\n        spec.startsWith('http') || spec.startsWith('git') ||\n        spec.startsWith('workspace:') || spec.startsWith('catalog:') ||\n        spec.startsWith('npm:') ||\n        spec.startsWith('./') || spec.startsWith('../') ||\n        spec === '' || spec === '*'\n      ) continue;\n      const name = rawName.toLowerCase();\n      out.set(name, {\n        name,\n        version: concretePin(spec) ?? '*',\n        ecosystem: 'npm',\n      });\n    }\n  }\n  return [...out.values()];\n}\n\n/**\n * Parse registry installs from a shell command without LLM/network.\n * Unpinned versions use '*' so OSV scans the full advisory history.\n */\nexport function extractDeterministicPkgRequests(command: string): DeterministicPkgRequest[] {\n  const merged = new Map<string, DeterministicPkgRequest>();\n  for (const r of segmentCommand(command).flatMap(extractSegment)) {\n    if (r.source !== 'registry') continue;\n    const osvEco = ECO_TO_OSV[r.ecosystem] ?? ECO_TO_OSV[r.ecosystem.toLowerCase()] ?? null;\n    if (!osvEco) continue;\n    const name = normalizeName(r.name, osvEco);\n    if (!name) continue;\n    const key = osvEco + '|' + name.toLowerCase();\n    const version = concretePin(r.versionSpec) ?? '*';\n    const prev = merged.get(key);\n    if (!prev || (prev.version === '*' && version !== '*')) {\n      merged.set(key, { name, version, ecosystem: osvEco });\n    }\n  }\n  return [...merged.values()];\n}\n", "utf-8");
   writeFileSync8(taskActivateIntentScriptPath, STUB_TASK_ACTIVATE_INTENT_TS, "utf-8");
+  writeFileSync8(mcpGateScriptPath, STUB_MCP_GATE_TS, "utf-8");
   chmodSync2(bashScriptPath, 493);
   chmodSync2(bashFollowupScriptPath, 493);
   chmodSync2(editPrecheckScriptPath, 493);
@@ -9299,6 +9641,7 @@ function writeHookScripts(mode = "stub") {
   chmodSync2(mcpStdioProxyPath, 493);
   chmodSync2(installExtractCorePath, 493);
   chmodSync2(taskActivateIntentScriptPath, 493);
+  chmodSync2(mcpGateScriptPath, 493);
   try {
     unlinkSync4(join9(HOOKS_DIR, "_synkro-stub-common.ts"));
   } catch {
@@ -9319,7 +9662,8 @@ function writeHookScripts(mode = "stub") {
     cursorBashJudgeScript: cursorBashJudgePath,
     cursorEditCaptureScript: cursorEditCapturePath,
     cursorAgentCaptureScript: cursorAgentCapturePath,
-    taskActivateIntentScript: taskActivateIntentScriptPath
+    taskActivateIntentScript: taskActivateIntentScriptPath,
+    mcpGateScript: mcpGateScriptPath
   };
 }
 function sanitizeConfigValue(raw, maxLen = 256) {
@@ -9351,7 +9695,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.55")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.57")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -9630,6 +9974,7 @@ async function installCommand(opts = {}) {
         userPromptSubmitScriptPath: scripts.userPromptSubmitScript,
         installScanScriptPath: scripts.installScanScript,
         taskActivateIntentScriptPath: scripts.taskActivateIntentScript,
+        mcpGateScriptPath: scripts.mcpGateScript,
         skipTranscriptSync: !transcriptConsent
       });
       console.log(`Configured ${agent.name} hooks at ${agent.settingsPath}`);
@@ -9649,7 +9994,8 @@ async function installCommand(opts = {}) {
         sessionStartScriptPath: scripts.sessionStartScript,
         userPromptSubmitScriptPath: scripts.userPromptSubmitScript,
         transcriptSyncScriptPath: scripts.transcriptSyncScript,
-        installScanScriptPath: scripts.installScanScript
+        installScanScriptPath: scripts.installScanScript,
+        mcpGateScriptPath: scripts.mcpGateScript
       });
       console.log(`Configured ${agent.name} hooks at ${agent.settingsPath}`);
     }
@@ -10101,7 +10447,8 @@ function reconcileHarness() {
       transcriptSyncScriptPath: scripts.transcriptSyncScript,
       userPromptSubmitScriptPath: scripts.userPromptSubmitScript,
       installScanScriptPath: scripts.installScanScript,
-      taskActivateIntentScriptPath: scripts.taskActivateIntentScript
+      taskActivateIntentScriptPath: scripts.taskActivateIntentScript,
+      mcpGateScriptPath: scripts.mcpGateScript
     });
     console.log("  \u2713 Claude Code hooks registered");
     try {
@@ -10132,7 +10479,8 @@ function reconcileHarness() {
       sessionStartScriptPath: scripts.sessionStartScript,
       userPromptSubmitScriptPath: scripts.userPromptSubmitScript,
       transcriptSyncScriptPath: scripts.transcriptSyncScript,
-      installScanScriptPath: scripts.installScanScript
+      installScanScriptPath: scripts.installScanScript,
+      mcpGateScriptPath: scripts.mcpGateScript
     });
     console.log("  \u2713 Cursor hooks registered");
     try {
@@ -10645,14 +10993,14 @@ rl.on('line', async (line) => {
 });
 
 // cli/local-cc/install.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync9, writeFileSync as writeFileSync9, readFileSync as readFileSync10, chmodSync as chmodSync3, copyFileSync as copyFileSync2, renameSync as renameSync4, unlinkSync as unlinkSync5, openSync, fsyncSync, closeSync } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync10, writeFileSync as writeFileSync9, readFileSync as readFileSync10, chmodSync as chmodSync3, copyFileSync as copyFileSync2, renameSync as renameSync4, unlinkSync as unlinkSync5, openSync, fsyncSync, closeSync } from "fs";
 import { join as join10 } from "path";
 import { homedir as homedir10 } from "os";
 import { spawnSync as spawnSync4 } from "child_process";
 function writePluginFiles() {
   for (const c of CHANNELS) {
-    mkdirSync9(c.sessionDir, { recursive: true });
-    mkdirSync9(c.pluginSettingsDir, { recursive: true });
+    mkdirSync10(c.sessionDir, { recursive: true });
+    mkdirSync10(c.pluginSettingsDir, { recursive: true });
     writeFileSync9(c.pluginPkgPath, PLUGIN_PACKAGE_JSON, "utf-8");
     writeFileSync9(
       c.pluginSettingsPath,
@@ -11254,7 +11602,7 @@ var init_disconnect = __esm({
 });
 
 // cli/local-cc/turnLog.ts
-import { appendFileSync, existsSync as existsSync14, mkdirSync as mkdirSync10, openSync as openSync2, readFileSync as readFileSync11, readSync, closeSync as closeSync2, statSync as statSync3, watchFile, unwatchFile } from "fs";
+import { appendFileSync, existsSync as existsSync14, mkdirSync as mkdirSync11, openSync as openSync2, readFileSync as readFileSync11, readSync, closeSync as closeSync2, statSync as statSync3, watchFile, unwatchFile } from "fs";
 import { dirname as dirname6, join as join12 } from "path";
 import { homedir as homedir12 } from "os";
 function truncate(s, max = PREVIEW_MAX) {
@@ -11276,7 +11624,7 @@ function extractSeverity(result) {
 }
 function appendTurn(args2) {
   try {
-    mkdirSync10(dirname6(TURN_LOG_PATH), { recursive: true });
+    mkdirSync11(dirname6(TURN_LOG_PATH), { recursive: true });
     const entry = {
       ts: new Date(args2.startedAt).toISOString(),
       role: args2.role,
@@ -11312,7 +11660,7 @@ function readRecentTurns(n = 20) {
 }
 function followTurns(onEntry) {
   try {
-    mkdirSync10(dirname6(TURN_LOG_PATH), { recursive: true });
+    mkdirSync11(dirname6(TURN_LOG_PATH), { recursive: true });
     if (!existsSync14(TURN_LOG_PATH)) {
       appendFileSync(TURN_LOG_PATH, "", "utf-8");
     }
@@ -12605,7 +12953,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.55");
+  console.log("1.6.57");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents