@synkro-sh/cli 1.6.56 → 1.6.58

package/dist/bootstrap.js

@@ -440,6 +440,7 @@ function installCursorHooks(hooksJsonPath, config) {
     timeout: 10,
     matcher: "Shell|Bash|terminal|run_terminal_cmd|execute_command|delete_file"
   });
+  pushCcHook(h, "beforeMCPExecution", config.mcpGateScriptPath, { timeout: 30 });
   h.afterAgentThought = h.afterAgentThought ?? [];
   h.afterAgentThought.push({
     command: bunRunCmd(config.agentCaptureScriptPath),
@@ -497,6 +498,7 @@ var init_cursorHookConfig = __esm({
       "preToolUse",
       "afterFileEdit",
       "postToolUse",
+      "beforeMCPExecution",
       "afterAgentThought",
       "afterAgentResponse"
     ];
@@ -7514,7 +7516,7 @@ async function runClaudeDesktopTap() {
   await new Promise((resolve4) => {
     const child = spawn("bash", [runnerPath], {
       stdio: "inherit",
-      env: { ...process.env, SYNKRO_CAPTURE_URL: CAPTURE_URL, SYNKRO_SCAN_URL: SCAN_URL, SYNKRO_TAP_TOKEN: token, SYNKRO_TAP_TOKEN_FILE: JWT_PATH }
+      env: { ...process.env, SYNKRO_CAPTURE_URL: CAPTURE_URL, SYNKRO_SCAN_URL: SCAN_URL, SYNKRO_SCAN_TURN_URL: SCAN_TURN_URL, SYNKRO_DLP_POLICY_URL: DLP_POLICY_URL, SYNKRO_TURN_VERDICTS_URL: TURN_VERDICTS_URL, SYNKRO_TURN_VERDICT_URL: TURN_VERDICT_URL, SYNKRO_TAP_TOKEN: token, SYNKRO_TAP_TOKEN_FILE: JWT_PATH }
     });
     const forward = (sig) => {
       try {
@@ -7531,19 +7533,32 @@ async function runClaudeDesktopTap() {
     });
   });
 }
-var CAPTURE_URL, SCAN_URL, JWT_PATH, ADDON_PY, MCP_PROXY_PY, MCP_PATCH_PY;
+var CAPTURE_URL, SCAN_URL, SCAN_TURN_URL, DLP_POLICY_URL, TURN_VERDICTS_URL, TURN_VERDICT_URL, JWT_PATH, ADDON_PY, MCP_PROXY_PY, MCP_PATCH_PY;
 var init_claudeDesktopTap = __esm({
   "cli/installer/claudeDesktopTap.ts"() {
     "use strict";
     CAPTURE_URL = "http://127.0.0.1:18931/api/local/capture";
     SCAN_URL = "http://127.0.0.1:18931/api/local/scan-upload";
+    SCAN_TURN_URL = "http://127.0.0.1:18931/api/local/scan-turn";
+    DLP_POLICY_URL = "http://127.0.0.1:18931/api/local/dlp-policy";
+    TURN_VERDICTS_URL = "http://127.0.0.1:18931/api/local/turn-verdicts";
+    TURN_VERDICT_URL = "http://127.0.0.1:18931/api/local/turn-verdict";
     JWT_PATH = join5(homedir5(), ".synkro", ".mcp-jwt");
-    ADDON_PY = `import os, json, threading, urllib.request, urllib.error, re, base64
+    ADDON_PY = `import os, json, threading, urllib.request, urllib.error, re, base64, time, hashlib
 from mitmproxy import http
 
-CAPTURE_URL = os.environ.get("SYNKRO_CAPTURE_URL", "")
+def _safe_url(u):
+    # CWE-918: these URLs come from the environment the installer sets \u2014 accept ONLY
+    # the loopback container endpoints, never an arbitrary host from a tampered env.
+    return u if (u.startswith("http://127.0.0.1:") or u.startswith("http://localhost:")) else ""
+
+CAPTURE_URL = _safe_url(os.environ.get("SYNKRO_CAPTURE_URL", ""))
 TOKEN = os.environ.get("SYNKRO_TAP_TOKEN", "")
-SCAN_URL = os.environ.get("SYNKRO_SCAN_URL", "")
+SCAN_URL = _safe_url(os.environ.get("SYNKRO_SCAN_URL", ""))
+SCAN_TURN_URL = _safe_url(os.environ.get("SYNKRO_SCAN_TURN_URL", ""))
+POLICY_URL = _safe_url(os.environ.get("SYNKRO_DLP_POLICY_URL", ""))
+TURN_VERDICTS_URL = _safe_url(os.environ.get("SYNKRO_TURN_VERDICTS_URL", ""))
+TURN_VERDICT_URL = _safe_url(os.environ.get("SYNKRO_TURN_VERDICT_URL", ""))
 # Token file path \u2014 the SERVER_TOKEN rotates whenever the container is recreated,
 # so we re-read it from disk on a 401 instead of needing a tap restart.
 TOKEN_FILE = os.environ.get("SYNKRO_TAP_TOKEN_FILE", "")
@@ -7609,6 +7624,422 @@ def _fmt_tool_name(raw):
         pass
     return raw
 
+# \u2500\u2500 M3 live-hold state \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+# Whether to HOLD connector turns (buffer the live completion until graded).
+# Fetched once from the server: True only when a BLOCK-mode rule exists (+ not
+# silent). Audit-only orgs get False \u2192 stream + async audit, ZERO added latency.
+_dlp_hold = None
+_dlp_lock = threading.Lock()
+# Shown live in place of a held connector turn while the single grader (the tree
+# GET) runs; replaced by the real content (if clean) or the block notice.
+REVIEWING_NOTICE = "\\U0001F6E1\\uFE0F  Synkro is reviewing this response for policy compliance\\u2026"
+
+def _should_hold():
+    global _dlp_hold
+    with _dlp_lock:
+        if _dlp_hold is not None:
+            return _dlp_hold
+    val = False
+    if POLICY_URL:
+        try:
+            with urllib.request.urlopen(urllib.request.Request(POLICY_URL), timeout=4) as resp:
+                val = bool(json.loads(resp.read().decode("utf-8", "replace")).get("hold"))
+        except Exception:
+            val = False
+    with _dlp_lock:
+        _dlp_hold = val
+    return val
+
+def _scan_turn_call(cid, msgs, connector):
+    # Synchronous DLP grade. Returns the block reason (str) on BLOCK, else None.
+    # Fail-OPEN \u2014 a scan error never blocks the turn.
+    if not (SCAN_TURN_URL and TOKEN): return None
+    try:
+        vb = _post_json(SCAN_TURN_URL, json.dumps({"conversation_id": str(cid)[:80], "messages": msgs, "connector": connector}).encode(), 18)
+        vd = json.loads((vb or b"{}").decode("utf-8", "replace"))
+        if vd.get("block"):
+            return str(vd.get("reason", "restricted data"))[:300]
+    except Exception as e:
+        print("[synkro] turn scan error (fail-open): " + str(e))
+    return None
+
+def _scan_sse_line(line, st):
+    # Extract governance metadata (usage window + web-search sources/citations)
+    # from one completion SSE line. Shared by the streaming + buffered paths.
+    if st["usage"] is None:
+        um = re.search(r'"5h":\\{"status":"([^"]*)","resets_at":(\\d+),"utilization":([0-9.]+)', line)
+        if um:
+            st["usage"] = {"window": "5h", "status": um.group(1), "resets_at": int(um.group(2)), "utilization": float(um.group(3))}
+    if len(st["sources"]) < 50:
+        for sm in re.finditer(r'"webpage_metadata","site_domain":"([^"]*)"(?:,"favicon_url":"[^"]*")?,"site_name":"([^"]*)"', line):
+            d = sm.group(1)
+            if d and d not in st["seen"] and len(st["sources"]) < 50:
+                st["seen"].add(d)
+                st["sources"].append({"domain": d, "name": sm.group(2)})
+    if "citation_start_delta" in line and line.startswith("data: ") and len(st["citations"]) < 50:
+        try:
+            cit = json.loads(line[6:]).get("delta", {}).get("citation", {})
+            url = cit.get("url", "")
+            if url and url not in st["cseen"]:
+                st["cseen"].add(url)
+                md = cit.get("metadata") or {}
+                st["citations"].append({"title": cit.get("title", ""), "url": url, "domain": md.get("site_domain", "")})
+        except Exception:
+            pass
+
+def _new_scan_state():
+    return {"carry": "", "usage": None, "sources": [], "seen": set(), "citations": [], "cseen": set()}
+
+def _extract_sse_text(body):
+    # Pull all visible text out of a buffered completion SSE (assistant text +
+    # tool_result content) for grading, and detect whether a tool/connector ran.
+    parts = []
+    tool = ("tool_use" in body) or ("tool_result" in body)
+    total = 0
+    for line in body.split("\\n"):
+        if total > 2000000: break
+        if not line.startswith("data: "): continue
+        try: obj = json.loads(line[6:])
+        except Exception: continue
+        d = obj.get("delta")
+        if isinstance(d, dict) and isinstance(d.get("text"), str):
+            parts.append(d["text"]); total += len(d["text"])
+        cb = obj.get("content_block")
+        if isinstance(cb, dict):
+            if isinstance(cb.get("text"), str): parts.append(cb["text"]); total += len(cb["text"])
+            c = cb.get("content")
+            if isinstance(c, str): parts.append(c); total += len(c)
+            elif isinstance(c, list):
+                for x in c:
+                    if isinstance(x, dict) and isinstance(x.get("text"), str): parts.append(x["text"]); total += len(x["text"])
+    return ("".join(parts)[:2000000], tool)
+
+def _neutralize_body(body, notice):
+    # Buffered BLOCK render of a COMPLETE response: replace the answer with the notice
+    # (first text delta, rest blanked), blank text/content content_blocks (incl. the
+    # retrieved doc), leave tool_use + thinking + every structural event intact (the
+    # tree GET scrubs thinking durably). Rewriting a WHOLE buffered body \u2014 not the
+    # live stream \u2014 is what avoids the "couldn't finish" fragility.
+    out = []
+    injected = [False]
+    for line in body.split("\\n"):
+        if not line.startswith("data: "):
+            out.append(line); continue
+        try: obj = json.loads(line[6:])
+        except Exception:
+            out.append(line); continue
+        changed = False
+        d = obj.get("delta")
+        if isinstance(d, dict) and d.get("type") == "text_delta" and isinstance(d.get("text"), str):
+            d["text"] = (notice if not injected[0] else "")
+            injected[0] = True; changed = True
+        cb = obj.get("content_block")
+        if isinstance(cb, dict):
+            if isinstance(cb.get("text"), str) and cb["text"]:
+                cb["text"] = ""; changed = True
+            if cb.get("content"):
+                cb["content"] = ""; changed = True
+        out.append(("data: " + json.dumps(obj)) if changed else line)
+    return "\\n".join(out)
+
+# Per-conversation DLP verdict cached by the held completion so the tree GET reuses
+# it (durable scrub) instead of re-grading. Bounded (CWE-400), lock-guarded (CWE-362).
+_turn_verdicts = {}
+_tv_lock = threading.Lock()
+
+def _cache_turn_verdict(cid, verdict):
+    if not cid: return
+    with _tv_lock:
+        if len(_turn_verdicts) > 200: _turn_verdicts.clear()
+        _turn_verdicts[cid] = verdict
+
+def _pop_turn_verdict(cid):
+    with _tv_lock:
+        return _turn_verdicts.pop(cid, None)
+
+# \u2500\u2500 Per-turn durable verdict helpers (PGLite-backed via local endpoints) \u2500\u2500\u2500\u2500\u2500\u2500
+def _msg_blocks(msg):
+    b = msg.get("content", [])
+    return b if isinstance(b, list) else []
+
+def _msg_key(msg):
+    # Stable per-turn id. Prefer the message uuid; fall back to a content hash so the
+    # verdict still keys consistently across reopens even if uuid is ever absent.
+    u = msg.get("uuid") or msg.get("id")
+    if isinstance(u, str) and u:
+        return u
+    try:
+        raw = json.dumps(msg.get("content", ""), sort_keys=True).encode("utf-8", "replace")
+        return "h:" + hashlib.sha256(raw).hexdigest()[:40]
+    except Exception:
+        return ""
+
+def _msg_is_connector(msg):
+    # A turn that pulled content via a connector \u2192 has a tool_result block (the doc).
+    for b in _msg_blocks(msg):
+        if isinstance(b, dict) and (b.get("type", "") == "tool_result" or b.get("type", "").endswith("_tool_result")):
+            return True
+    return False
+
+def _msg_grade_payload(msg):
+    # Extract (assistant_text, tool_result_text, connector) from a message's blocks.
+    texts = []; tools = []; connector = ""
+    for b in _msg_blocks(msg):
+        if isinstance(b, str):
+            texts.append(b); continue
+        if not isinstance(b, dict):
+            continue
+        bt = b.get("type", "")
+        if bt == "text":
+            texts.append(b.get("text", "") or "")
+        elif bt == "tool_use" or bt == "server_tool_use":
+            nm = b.get("name", "") or ""
+            if nm and not connector:
+                connector = nm.split(":")[0] if ":" in nm else nm
+        elif bt == "tool_result" or bt.endswith("_tool_result"):
+            rc = b.get("content", "")
+            if isinstance(rc, list):
+                for x in rc:
+                    if isinstance(x, dict):
+                        if isinstance(x.get("text"), str): tools.append(x["text"])
+                        elif x.get("content"): tools.append(str(x.get("content")))
+            elif isinstance(rc, str):
+                tools.append(rc)
+            ic = b.get("integration_name") or b.get("name") or ""
+            if ic and not connector:
+                connector = ic
+    return ("\\n".join(texts), "\\n".join(tools), connector)
+
+def _get_turn_verdicts(uuids):
+    # Batch lookup of durable verdicts from PGLite (one round-trip). {uuid: {blocked,reason}}.
+    if not (TURN_VERDICTS_URL and TOKEN and uuids):
+        return {}
+    try:
+        resp = _post_json(TURN_VERDICTS_URL, json.dumps({"uuids": uuids[:500]}).encode("utf-8"), 8)
+        if resp:
+            o = json.loads(resp.decode("utf-8", "replace"))
+            v = o.get("verdicts")
+            return v if isinstance(v, dict) else {}
+    except Exception as e:
+        print("[synkro] verdict lookup error: " + str(e))
+    return {}
+
+def _put_turn_verdict(uuid, convo_id, blocked, reason):
+    # Persist one graded turn (fire-and-forget, off the tree-GET critical path).
+    if not (TURN_VERDICT_URL and TOKEN and uuid):
+        return
+    def _send():
+        try:
+            _post_json(TURN_VERDICT_URL, json.dumps({"message_uuid": uuid, "convo_id": convo_id, "blocked": bool(blocked), "reason": reason or ""}).encode("utf-8"), 8)
+        except Exception as e:
+            print("[synkro] verdict persist error: " + str(e))
+    threading.Thread(target=_send, daemon=True).start()
+
+def _intent_before(all_msgs, idx):
+    # Most recent human message text before idx \u2014 the turn's user intent for grading.
+    for j in range(idx - 1, -1, -1):
+        if all_msgs[j].get("sender") == "human":
+            for b in _msg_blocks(all_msgs[j]):
+                if isinstance(b, dict) and b.get("type") == "text": return (b.get("text") or "")[:2000]
+                if isinstance(b, str): return b[:2000]
+            return ""
+    return ""
+
+def _apply_turn_verdicts(all_msgs, convo_id):
+    # WHOLE-CONVERSATION per-turn DLP scrub. Mutates all_msgs in place: replaces every
+    # BLOCKED assistant turn's content with the notice. Returns True if anything was
+    # blocked. Verdicts are durable (PGLite via the local endpoints); each connector
+    # turn (a tool_result is present) is graded once on a miss then persisted; pure-chat
+    # turns are skipped. Scrubs EVERY blocked turn \u2014 not just the latest \u2014 so a follow-up
+    # can never resurrect an earlier blocked turn. Fail-OPEN.
+    asst_idx = [i for i in range(len(all_msgs)) if all_msgs[i].get("sender") != "human"]
+    keys = {i: _msg_key(all_msgs[i]) for i in asst_idx}
+    ids = [k for k in keys.values() if k]
+    verdicts = _get_turn_verdicts(ids) if ids else {}
+    do_grade = _should_hold() and SCAN_TURN_URL and TOKEN
+    any_blocked = False
+    for i in asst_idx:
+        key = keys.get(i, "")
+        v = verdicts.get(key) if key else None
+        if v is None and do_grade and key and _msg_is_connector(all_msgs[i]):
+            text, tools, connector = _msg_grade_payload(all_msgs[i])
+            if tools.strip() or text.strip():
+                scan_msgs = [
+                    {"role": "user", "content": _intent_before(all_msgs, i), "name": ""},
+                    {"role": "tool", "content": tools[:500000], "name": connector[:200]},
+                    {"role": "assistant", "content": text[:8000], "name": ""},
+                ]
+                reason = _scan_turn_call(convo_id, scan_msgs, connector)
+                v = {"blocked": reason is not None, "reason": reason or ""}
+                _put_turn_verdict(key, convo_id, v["blocked"], v["reason"])
+        if v and v.get("blocked"):
+            all_msgs[i]["content"] = [{"type": "text", "text": "[Blocked by Synkro] " + (v.get("reason") or "restricted data")}]
+            any_blocked = True
+    return any_blocked
+
+def _feed_answer(chunk, st):
+    # Accumulate the assistant's ANSWER text (text_delta) as the held stream flows,
+    # using a carry for SSE lines split across chunks. The answer reveals the doc's
+    # classification, so once enough has arrived we grade it for an early verdict.
+    txt = st["carry"] + chunk
+    lines = txt.split("\\n")
+    st["carry"] = lines[-1][-100000:]  # bound carried partial line (CWE-400)
+    for ln in lines[:-1]:
+        if not ln.startswith("data: "):
+            continue
+        try:
+            obj = json.loads(ln[6:])
+        except Exception:
+            continue
+        d = obj.get("delta")
+        if isinstance(d, dict) and d.get("type") == "text_delta" and isinstance(d.get("text"), str):
+            if len(st["answer"]) < 200000:  # bound (CWE-400)
+                st["answer"] += d["text"]
+
+def _grade_worker(st, ans):
+    # Runs in a BACKGROUND THREAD (off mitmproxy's event loop). The urllib grade
+    # releases the GIL during I/O, so the loop keeps flushing keep-alive pings.
+    # CWE-362: ans is a snapshot PASSED BY the loop thread (the sole writer of
+    # st["answer"]) at thread-creation \u2014 the worker never reads shared mutable
+    # st["answer"], so there is no data race. It writes only verdict/graded, which the
+    # loop reads AFTER graded.is_set() provides the happens-before barrier.
+    try:
+        ans = ans[:200000]
+        reason = _scan_turn_call(st["cid"], [{"role": "assistant", "content": ans, "name": ""}], "") if ans.strip() else None
+    except Exception:
+        reason = None
+    st["verdict"] = {"block": reason is not None, "reason": reason or ""}
+    _cache_turn_verdict(st["cid"], st["verdict"])
+    st["graded"].set()
+
+def _classify_frame(fr):
+    # Inspect one CRLF SSE frame's data line \u2192 'tool_use_start' | 'text_start' | 'other'
+    # based on the content_block_start type. Used to find where the FINAL answer begins.
+    for ln in fr.split("\\r\\n"):
+        if ln.startswith("data: "):
+            try:
+                o = json.loads(ln[6:])
+            except Exception:
+                return "other"
+            if o.get("type") == "content_block_start":
+                cb = o.get("content_block")
+                if isinstance(cb, dict):
+                    t = cb.get("type")
+                    if t == "tool_use":
+                        return "tool_use_start"
+                    if t == "text":
+                        return "text_start"
+            return "other"
+    return "other"
+
+def _frame_answer_text(fr, st):
+    # Accumulate text_delta text from a HELD frame into st["answer"] (for the grade).
+    for ln in fr.split("\\r\\n"):
+        if ln.startswith("data: "):
+            try:
+                d = json.loads(ln[6:]).get("delta")
+            except Exception:
+                continue
+            if isinstance(d, dict) and d.get("type") == "text_delta" and isinstance(d.get("text"), str):
+                if len(st["answer"]) < 200000:  # CWE-400 bound
+                    st["answer"] += d["text"]
+
+def _block_held(frames, notice):
+    # Frame-aware, CRLF-PRESERVING block render of the held final-answer frames: replace
+    # the answer's text_delta(s) (first\u2192notice, rest\u2192"") and leave every structural frame
+    # (content_block_stop / message_delta / message_stop) intact so the message still
+    # finalizes cleanly. Operates per-frame on \\r\\n lines \u2192 no \\n/\\r\\n mixing, so the
+    # framing stays byte-clean (the thing _neutralize_body's \\n split would have broken).
+    inj = [False]
+    out = []
+    for fr in frames:
+        nl = []
+        for ln in fr.split("\\r\\n"):
+            if ln.startswith("data: "):
+                try:
+                    o = json.loads(ln[6:])
+                    d = o.get("delta")
+                    if isinstance(d, dict) and d.get("type") == "text_delta" and isinstance(d.get("text"), str):
+                        o["delta"]["text"] = notice if not inj[0] else ""
+                        inj[0] = True
+                        ln = "data: " + json.dumps(o)
+                except Exception:
+                    pass
+            nl.append(ln)
+        out.append("\\r\\n".join(nl))
+    return ("\\r\\n\\r\\n".join(out) + "\\r\\n\\r\\n") if out else ""
+
+def _make_hold_stream(cid):
+    # Pass-through-until-FINAL-ANSWER hold for the claude.ai completion (CRLF SSE; frames
+    # split by \\r\\n\\r\\n). A connector turn is: thinking \u2192 text(preamble) \u2192 tool_use \u2192
+    # tool_result \u2192 \u2026 \u2192 text(ANSWER). Only the FINAL answer is in the user's face, so we
+    # STREAM every earlier frame VERBATIM (natural thinking/search activity + tool chips,
+    # zero mutation) and HOLD only the final answer \u2014 the text block that opens AFTER a
+    # tool_use \u2014 through message_stop. Buffer it (no leak), grade off-thread, heartbeat to
+    # keep Desktop alive, then emit the real answer (clean) or a frame-aware block rewrite
+    # (restricted). CWE-362: the grade thread gets an immutable answer snapshot; the
+    # verdict returns via the Event barrier; the loop is the sole writer of held/answer.
+    st = {"cid": cid, "carry": "", "holding": False, "seen_tool": False,
+          "held": [], "held_size": 0, "answer": "", "started": False, "meta": _new_scan_state(),
+          "graded": threading.Event(), "verdict": {"block": False, "reason": ""}}
+    def _hold(data, _st=st):
+        if data:
+            txt = _st["carry"] + data.decode("utf-8", "replace")
+            frames = txt.split("\\r\\n\\r\\n")
+            _st["carry"] = frames[-1][-200000:]   # CWE-400 bounded carry (last partial frame)
+            out = []
+            for fr in frames[:-1]:
+                for ln in fr.split("\\r\\n"):
+                    _scan_sse_line(ln, _st["meta"])   # governance metadata, all frames
+                if not _st["holding"]:
+                    k = _classify_frame(fr)
+                    if k == "tool_use_start":
+                        _st["seen_tool"] = True
+                    if k == "text_start" and _st["seen_tool"]:
+                        _st["holding"] = True          # the FINAL answer begins here \u2192 hold from now
+                    else:
+                        out.append(fr)                 # thinking / preamble / tool_use / tool_result \u2192 verbatim
+                        continue
+                if _st["held_size"] < 8000000:         # CWE-400 bound before append
+                    _st["held"].append(fr); _st["held_size"] += len(fr)
+                _frame_answer_text(fr, _st)
+            if _st["holding"] and not _st["started"] and len(_st["answer"]) >= 1200:
+                _st["started"] = True
+                threading.Thread(target=_grade_worker, args=(_st, _st["answer"][:200000]), daemon=True).start()
+            if out:
+                return ("\\r\\n\\r\\n".join(out) + "\\r\\n\\r\\n").encode("utf-8")  # stream activity verbatim
+            return b": synkro\\n\\n"   # answer held \u2192 heartbeat (keeps Desktop alive, PROVEN)
+        # upstream ended
+        m = _st["meta"]
+        if (m["usage"] or m["sources"] or m["citations"]) and _st["cid"]:
+            with _sse_lock:
+                _sse_meta[_st["cid"]] = {"usage": m["usage"], "sources": m["sources"], "citations": m["citations"]}
+        if not _st["holding"]:   # no final-answer block detected \u2014 everything already streamed
+            return _st["carry"].encode("utf-8") if _st["carry"] else b""
+        if _st["carry"]:
+            _st["held"].append(_st["carry"]); _frame_answer_text(_st["carry"], _st); _st["carry"] = ""
+        if not _st["started"] and _st["answer"].strip():  # short answer never hit the 1200 trigger
+            _st["started"] = True
+            threading.Thread(target=_grade_worker, args=(_st, _st["answer"][:200000]), daemon=True).start()
+        held_frames = list(_st["held"])
+        def _grade_window(_st2=_st, _frames=held_frames):
+            waited = 0.0
+            while not _st2["graded"].is_set() and waited < 60.0:
+                yield b": synkro\\n\\n"   # heartbeat WHILE grading \u2014 keeps Desktop alive (PROVEN)
+                time.sleep(0.5)
+                waited += 0.5
+            v = _st2["verdict"]
+            if _st2["graded"].is_set() and v["block"]:
+                print("[synkro] HELD+BLOCKED live (reason=" + v["reason"][:60] + ")")
+                yield _block_held(_frames, "[Blocked by Synkro] " + v["reason"]).encode("utf-8")
+            elif _st2["graded"].is_set():
+                yield ("\\r\\n\\r\\n".join(_frames) + "\\r\\n\\r\\n").encode("utf-8")  # clean \u2192 real answer
+            else:  # grade never landed in 60s \u2014 never leak; tree GET backstop finalizes
+                print("[synkro] hold: grade timeout \u2192 placeholder + tree-GET backstop")
+                yield _block_held(_frames, "[Synkro is reviewing this response\u2026]").encode("utf-8")
+        return _grade_window()
+    return _hold
+
 class SynkroTap:
     def request(self, flow):
         # \u2500\u2500 Upload DLP gate \u2500\u2500 Scan file uploads BEFORE they reach claude.ai and
@@ -7662,10 +8093,10 @@ class SynkroTap:
             print("[synkro] upload scan error (fail-open): " + str(e))
             return
         if verdict.get("block"):
-            reason = str(verdict.get("reason", "Blocked by Synkro DLP policy"))[:300]
+            reason = str(verdict.get("reason", "Blocked by Synkro policy"))[:300]
             flow.response = http.Response.make(
                 403,
-                json.dumps({"error": {"type": "blocked_by_synkro_dlp", "message": "Blocked by Synkro DLP: " + reason}}).encode(),
+                json.dumps({"error": {"type": "blocked_by_synkro", "message": "Blocked by Synkro: " + reason}}).encode(),
                 {"Content-Type": "application/json"},
             )
             print("[synkro] BLOCKED upload (size=" + str(payload.get("size", 0)) + " rule=" + str(verdict.get("ruleId", "")) + ")")
@@ -7673,46 +8104,28 @@ class SynkroTap:
             print("[synkro] upload scanned -> allow (size=" + str(payload.get("size", 0)) + ")")
 
     def responseheaders(self, flow):
-        # Buffer the small conversation-tree GET (parsed for the dashboard).
-        # For the completion POST, TAP the SSE chunk-by-chunk and pass each
-        # through unchanged \u2014 Claude Desktop keeps streaming normally while we
-        # accumulate a bounded copy for the raw diagnostic dump. Everything else
-        # streams untouched.
+        # The answer the user watches TYPE OUT comes from claude.ai's completion \u2014 THAT
+        # is the stream we HOLD (buffer + heartbeat \u2192 no leak, no disconnect; see
+        # _make_hold_stream). a-api.anthropic.com is a background call that doesn't carry
+        # the answer, so it streams through untouched (default below). The tree GET is
+        # buffered for the dashboard + the durable block scrub.
         r = flow.request
-        if "claude.ai" in (r.pretty_host or "") and "chat_conversations" in r.path:
+        host = r.pretty_host or ""
+        if "claude.ai" in host and "chat_conversations" in r.path:
             if r.method == "GET" and "tree" in r.pretty_url:
                 return
             if r.method == "POST" and "completion" in r.path:
                 cm = re.search(r"chat_conversations/([0-9a-fA-F-]+)", r.path)
                 cid = cm.group(1) if cm else ""
-                # Incremental parse: scan complete SSE lines for the small governance
-                # signals AS THEY STREAM and keep only the extracted results \u2014 never
-                # buffer the body. The carry holds at most one partial line (bounded),
-                # so there's NO cap on total stream length and no source is dropped.
-                st = {"carry": "", "usage": None, "sources": [], "seen": set(), "citations": [], "cseen": set()}
-                def _scan(line, _st=st):
-                    if _st["usage"] is None:
-                        um = re.search(r'"5h":\\{"status":"([^"]*)","resets_at":(\\d+),"utilization":([0-9.]+)', line)
-                        if um:
-                            _st["usage"] = {"window": "5h", "status": um.group(1), "resets_at": int(um.group(2)), "utilization": float(um.group(3))}
-                    if len(_st["sources"]) < 50:
-                        for sm in re.finditer(r'"webpage_metadata","site_domain":"([^"]*)"(?:,"favicon_url":"[^"]*")?,"site_name":"([^"]*)"', line):
-                            d = sm.group(1)
-                            if d and d not in _st["seen"] and len(_st["sources"]) < 50:
-                                _st["seen"].add(d)
-                                _st["sources"].append({"domain": d, "name": sm.group(2)})
-                    # Citations: the specific pages the model cited (title + url +
-                    # domain) \u2014 the real "tool result" for web search.
-                    if "citation_start_delta" in line and line.startswith("data: ") and len(_st["citations"]) < 50:
-                        try:
-                            cit = json.loads(line[6:]).get("delta", {}).get("citation", {})
-                            url = cit.get("url", "")
-                            if url and url not in _st["cseen"]:
-                                _st["cseen"].add(url)
-                                md = cit.get("metadata") or {}
-                                _st["citations"].append({"title": cit.get("title", ""), "url": url, "domain": md.get("site_domain", "")})
-                        except Exception:
-                            pass
+                with _mcp_lock:
+                    has_servers = len(_mcp_registry) > 0
+                # HOLD when a BLOCK-mode rule exists AND connectors are connected \u2014 buffer
+                # the answer, grade off-thread, heartbeat through the grade, emit the verdict.
+                if has_servers and _should_hold():
+                    flow.response.stream = _make_hold_stream(cid)
+                    return
+                # Otherwise just TAP for governance metadata (no hold; audit stays async).
+                st = _new_scan_state()
                 def _tap(data, _st=st, _cid=cid):
                     if data:
                         try:
@@ -7722,9 +8135,9 @@ class SynkroTap:
                         lines = txt.split("\\n")
                         _st["carry"] = lines[-1][-200000:]  # bound the carried partial line (CWE-400)
                         for ln in lines[:-1]:
-                            _scan(ln)
+                            _scan_sse_line(ln, _st)
                     else:  # end of stream \u2014 flush carry + publish
-                        _scan(_st["carry"])
+                        _scan_sse_line(_st["carry"], _st)
                         if (_st["usage"] or _st["sources"] or _st["citations"]) and _cid:
                             with _sse_lock:
                                 _sse_meta[_cid] = {"usage": _st["usage"], "sources": _st["sources"], "citations": _st["citations"]}
@@ -7838,6 +8251,14 @@ class SynkroTap:
                 messages.append({"role": "user", "content": text})
         if not messages: return
         data = {"request": {"model": model, "messages": messages}, "conversation_id": convo_id}
+        # PER-TURN key: the current turn's assistant message id (same key used for
+        # dlp_turn_verdicts). Lets the server store each turn as its OWN event so a
+        # blocked turn isn't overwritten/deleted by a later passing turn.
+        turn_id = ""
+        for _m in reversed(chat):
+            if _m.get("sender") != "human":
+                turn_id = _msg_key(_m); break
+        if turn_id: data["turn_id"] = turn_id
         meta = {}
         if platform: meta["platform"] = platform
         if web_search_on: meta["web_search_enabled"] = True
@@ -7854,6 +8275,17 @@ class SynkroTap:
             ntools += len(mm.get("tool_calls") or [])
         nsrc = len((sm or {}).get("sources") or [])
         print("[synkro] captured chat (msgs=" + str(len(messages)) + " tools=" + str(ntools) + " sources=" + str(nsrc) + " model=" + model + ")")
+
+        # \u2500\u2500 Tier-2 connector DLP gate (WHOLE-CONVERSATION, per-turn, PERSISTENT) \u2500\u2500
+        # Scrub every blocked assistant turn (durable PGLite verdicts; connector turns
+        # graded once on miss). See _apply_turn_verdicts. Fail-OPEN on any error.
+        try:
+            any_blocked = _apply_turn_verdicts(all_msgs, convo_id)
+        except Exception as e:
+            any_blocked = False
+            print("[synkro] turn-verdict scrub error (fail-open): " + str(e))
+
+        # Capture the REAL content for audit regardless of the block decision.
         def send(_d=data):
             try:
                 _post_json(CAPTURE_URL, json.dumps(_d).encode(), 5)
@@ -7861,6 +8293,14 @@ class SynkroTap:
                 print("[synkro] capture error: " + str(e))
         threading.Thread(target=send, daemon=True).start()
 
+        # Re-serialize the tree so the renderer never sees any blocked turn's content.
+        if any_blocked:
+            try:
+                flow.response.text = json.dumps(convo)
+                print("[synkro] BLOCKED turn view (whole-convo per-turn, durable)")
+            except Exception as e:
+                print("[synkro] block scrub failed (fail-open): " + str(e))
+
 addons = [SynkroTap()]
 `;
     MCP_PROXY_PY = `#!/usr/bin/env python3
@@ -9515,7 +9955,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.56")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.58")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -9814,7 +10254,8 @@ async function installCommand(opts = {}) {
         sessionStartScriptPath: scripts.sessionStartScript,
         userPromptSubmitScriptPath: scripts.userPromptSubmitScript,
         transcriptSyncScriptPath: scripts.transcriptSyncScript,
-        installScanScriptPath: scripts.installScanScript
+        installScanScriptPath: scripts.installScanScript,
+        mcpGateScriptPath: scripts.mcpGateScript
       });
       console.log(`Configured ${agent.name} hooks at ${agent.settingsPath}`);
     }
@@ -10298,7 +10739,8 @@ function reconcileHarness() {
       sessionStartScriptPath: scripts.sessionStartScript,
       userPromptSubmitScriptPath: scripts.userPromptSubmitScript,
       transcriptSyncScriptPath: scripts.transcriptSyncScript,
-      installScanScriptPath: scripts.installScanScript
+      installScanScriptPath: scripts.installScanScript,
+      mcpGateScriptPath: scripts.mcpGateScript
     });
     console.log("  \u2713 Cursor hooks registered");
     try {
@@ -12771,7 +13213,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.56");
+  console.log("1.6.58");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents