@synkro-sh/cli 1.6.57 → 1.6.58

package/dist/bootstrap.js

@@ -7516,7 +7516,7 @@ async function runClaudeDesktopTap() {
   await new Promise((resolve4) => {
     const child = spawn("bash", [runnerPath], {
       stdio: "inherit",
-      env: { ...process.env, SYNKRO_CAPTURE_URL: CAPTURE_URL, SYNKRO_SCAN_URL: SCAN_URL, SYNKRO_SCAN_TURN_URL: SCAN_TURN_URL, SYNKRO_DLP_POLICY_URL: DLP_POLICY_URL, SYNKRO_TAP_TOKEN: token, SYNKRO_TAP_TOKEN_FILE: JWT_PATH }
+      env: { ...process.env, SYNKRO_CAPTURE_URL: CAPTURE_URL, SYNKRO_SCAN_URL: SCAN_URL, SYNKRO_SCAN_TURN_URL: SCAN_TURN_URL, SYNKRO_DLP_POLICY_URL: DLP_POLICY_URL, SYNKRO_TURN_VERDICTS_URL: TURN_VERDICTS_URL, SYNKRO_TURN_VERDICT_URL: TURN_VERDICT_URL, SYNKRO_TAP_TOKEN: token, SYNKRO_TAP_TOKEN_FILE: JWT_PATH }
     });
     const forward = (sig) => {
       try {
@@ -7533,7 +7533,7 @@ async function runClaudeDesktopTap() {
     });
   });
 }
-var CAPTURE_URL, SCAN_URL, SCAN_TURN_URL, DLP_POLICY_URL, JWT_PATH, ADDON_PY, MCP_PROXY_PY, MCP_PATCH_PY;
+var CAPTURE_URL, SCAN_URL, SCAN_TURN_URL, DLP_POLICY_URL, TURN_VERDICTS_URL, TURN_VERDICT_URL, JWT_PATH, ADDON_PY, MCP_PROXY_PY, MCP_PATCH_PY;
 var init_claudeDesktopTap = __esm({
   "cli/installer/claudeDesktopTap.ts"() {
     "use strict";
@@ -7541,15 +7541,24 @@ var init_claudeDesktopTap = __esm({
     SCAN_URL = "http://127.0.0.1:18931/api/local/scan-upload";
     SCAN_TURN_URL = "http://127.0.0.1:18931/api/local/scan-turn";
     DLP_POLICY_URL = "http://127.0.0.1:18931/api/local/dlp-policy";
+    TURN_VERDICTS_URL = "http://127.0.0.1:18931/api/local/turn-verdicts";
+    TURN_VERDICT_URL = "http://127.0.0.1:18931/api/local/turn-verdict";
     JWT_PATH = join5(homedir5(), ".synkro", ".mcp-jwt");
-    ADDON_PY = `import os, json, threading, urllib.request, urllib.error, re, base64
+    ADDON_PY = `import os, json, threading, urllib.request, urllib.error, re, base64, time, hashlib
 from mitmproxy import http
 
-CAPTURE_URL = os.environ.get("SYNKRO_CAPTURE_URL", "")
+def _safe_url(u):
+    # CWE-918: these URLs come from the environment the installer sets \u2014 accept ONLY
+    # the loopback container endpoints, never an arbitrary host from a tampered env.
+    return u if (u.startswith("http://127.0.0.1:") or u.startswith("http://localhost:")) else ""
+
+CAPTURE_URL = _safe_url(os.environ.get("SYNKRO_CAPTURE_URL", ""))
 TOKEN = os.environ.get("SYNKRO_TAP_TOKEN", "")
-SCAN_URL = os.environ.get("SYNKRO_SCAN_URL", "")
-SCAN_TURN_URL = os.environ.get("SYNKRO_SCAN_TURN_URL", "")
-POLICY_URL = os.environ.get("SYNKRO_DLP_POLICY_URL", "")
+SCAN_URL = _safe_url(os.environ.get("SYNKRO_SCAN_URL", ""))
+SCAN_TURN_URL = _safe_url(os.environ.get("SYNKRO_SCAN_TURN_URL", ""))
+POLICY_URL = _safe_url(os.environ.get("SYNKRO_DLP_POLICY_URL", ""))
+TURN_VERDICTS_URL = _safe_url(os.environ.get("SYNKRO_TURN_VERDICTS_URL", ""))
+TURN_VERDICT_URL = _safe_url(os.environ.get("SYNKRO_TURN_VERDICT_URL", ""))
 # Token file path \u2014 the SERVER_TOKEN rotates whenever the container is recreated,
 # so we re-read it from disk on a 401 instead of needing a tap restart.
 TOKEN_FILE = os.environ.get("SYNKRO_TAP_TOKEN_FILE", "")
@@ -7705,10 +7714,12 @@ def _extract_sse_text(body):
                     if isinstance(x, dict) and isinstance(x.get("text"), str): parts.append(x["text"]); total += len(x["text"])
     return ("".join(parts)[:2000000], tool)
 
-def _neutralize_sse(body, notice):
-    # Rewrite a buffered completion SSE: blank every text/content field (inject the
-    # notice into the FIRST text delta), leaving all structural events intact so
-    # Claude Desktop still renders a valid \u2014 but content-free \u2014 turn.
+def _neutralize_body(body, notice):
+    # Buffered BLOCK render of a COMPLETE response: replace the answer with the notice
+    # (first text delta, rest blanked), blank text/content content_blocks (incl. the
+    # retrieved doc), leave tool_use + thinking + every structural event intact (the
+    # tree GET scrubs thinking durably). Rewriting a WHOLE buffered body \u2014 not the
+    # live stream \u2014 is what avoids the "couldn't finish" fragility.
     out = []
     injected = [False]
     for line in body.split("\\n"):
@@ -7719,7 +7730,7 @@ def _neutralize_sse(body, notice):
             out.append(line); continue
         changed = False
         d = obj.get("delta")
-        if isinstance(d, dict) and isinstance(d.get("text"), str):
+        if isinstance(d, dict) and d.get("type") == "text_delta" and isinstance(d.get("text"), str):
             d["text"] = (notice if not injected[0] else "")
             injected[0] = True; changed = True
         cb = obj.get("content_block")
@@ -7731,6 +7742,304 @@ def _neutralize_sse(body, notice):
         out.append(("data: " + json.dumps(obj)) if changed else line)
     return "\\n".join(out)
 
+# Per-conversation DLP verdict cached by the held completion so the tree GET reuses
+# it (durable scrub) instead of re-grading. Bounded (CWE-400), lock-guarded (CWE-362).
+_turn_verdicts = {}
+_tv_lock = threading.Lock()
+
+def _cache_turn_verdict(cid, verdict):
+    if not cid: return
+    with _tv_lock:
+        if len(_turn_verdicts) > 200: _turn_verdicts.clear()
+        _turn_verdicts[cid] = verdict
+
+def _pop_turn_verdict(cid):
+    with _tv_lock:
+        return _turn_verdicts.pop(cid, None)
+
+# \u2500\u2500 Per-turn durable verdict helpers (PGLite-backed via local endpoints) \u2500\u2500\u2500\u2500\u2500\u2500
+def _msg_blocks(msg):
+    b = msg.get("content", [])
+    return b if isinstance(b, list) else []
+
+def _msg_key(msg):
+    # Stable per-turn id. Prefer the message uuid; fall back to a content hash so the
+    # verdict still keys consistently across reopens even if uuid is ever absent.
+    u = msg.get("uuid") or msg.get("id")
+    if isinstance(u, str) and u:
+        return u
+    try:
+        raw = json.dumps(msg.get("content", ""), sort_keys=True).encode("utf-8", "replace")
+        return "h:" + hashlib.sha256(raw).hexdigest()[:40]
+    except Exception:
+        return ""
+
+def _msg_is_connector(msg):
+    # A turn that pulled content via a connector \u2192 has a tool_result block (the doc).
+    for b in _msg_blocks(msg):
+        if isinstance(b, dict) and (b.get("type", "") == "tool_result" or b.get("type", "").endswith("_tool_result")):
+            return True
+    return False
+
+def _msg_grade_payload(msg):
+    # Extract (assistant_text, tool_result_text, connector) from a message's blocks.
+    texts = []; tools = []; connector = ""
+    for b in _msg_blocks(msg):
+        if isinstance(b, str):
+            texts.append(b); continue
+        if not isinstance(b, dict):
+            continue
+        bt = b.get("type", "")
+        if bt == "text":
+            texts.append(b.get("text", "") or "")
+        elif bt == "tool_use" or bt == "server_tool_use":
+            nm = b.get("name", "") or ""
+            if nm and not connector:
+                connector = nm.split(":")[0] if ":" in nm else nm
+        elif bt == "tool_result" or bt.endswith("_tool_result"):
+            rc = b.get("content", "")
+            if isinstance(rc, list):
+                for x in rc:
+                    if isinstance(x, dict):
+                        if isinstance(x.get("text"), str): tools.append(x["text"])
+                        elif x.get("content"): tools.append(str(x.get("content")))
+            elif isinstance(rc, str):
+                tools.append(rc)
+            ic = b.get("integration_name") or b.get("name") or ""
+            if ic and not connector:
+                connector = ic
+    return ("\\n".join(texts), "\\n".join(tools), connector)
+
+def _get_turn_verdicts(uuids):
+    # Batch lookup of durable verdicts from PGLite (one round-trip). {uuid: {blocked,reason}}.
+    if not (TURN_VERDICTS_URL and TOKEN and uuids):
+        return {}
+    try:
+        resp = _post_json(TURN_VERDICTS_URL, json.dumps({"uuids": uuids[:500]}).encode("utf-8"), 8)
+        if resp:
+            o = json.loads(resp.decode("utf-8", "replace"))
+            v = o.get("verdicts")
+            return v if isinstance(v, dict) else {}
+    except Exception as e:
+        print("[synkro] verdict lookup error: " + str(e))
+    return {}
+
+def _put_turn_verdict(uuid, convo_id, blocked, reason):
+    # Persist one graded turn (fire-and-forget, off the tree-GET critical path).
+    if not (TURN_VERDICT_URL and TOKEN and uuid):
+        return
+    def _send():
+        try:
+            _post_json(TURN_VERDICT_URL, json.dumps({"message_uuid": uuid, "convo_id": convo_id, "blocked": bool(blocked), "reason": reason or ""}).encode("utf-8"), 8)
+        except Exception as e:
+            print("[synkro] verdict persist error: " + str(e))
+    threading.Thread(target=_send, daemon=True).start()
+
+def _intent_before(all_msgs, idx):
+    # Most recent human message text before idx \u2014 the turn's user intent for grading.
+    for j in range(idx - 1, -1, -1):
+        if all_msgs[j].get("sender") == "human":
+            for b in _msg_blocks(all_msgs[j]):
+                if isinstance(b, dict) and b.get("type") == "text": return (b.get("text") or "")[:2000]
+                if isinstance(b, str): return b[:2000]
+            return ""
+    return ""
+
+def _apply_turn_verdicts(all_msgs, convo_id):
+    # WHOLE-CONVERSATION per-turn DLP scrub. Mutates all_msgs in place: replaces every
+    # BLOCKED assistant turn's content with the notice. Returns True if anything was
+    # blocked. Verdicts are durable (PGLite via the local endpoints); each connector
+    # turn (a tool_result is present) is graded once on a miss then persisted; pure-chat
+    # turns are skipped. Scrubs EVERY blocked turn \u2014 not just the latest \u2014 so a follow-up
+    # can never resurrect an earlier blocked turn. Fail-OPEN.
+    asst_idx = [i for i in range(len(all_msgs)) if all_msgs[i].get("sender") != "human"]
+    keys = {i: _msg_key(all_msgs[i]) for i in asst_idx}
+    ids = [k for k in keys.values() if k]
+    verdicts = _get_turn_verdicts(ids) if ids else {}
+    do_grade = _should_hold() and SCAN_TURN_URL and TOKEN
+    any_blocked = False
+    for i in asst_idx:
+        key = keys.get(i, "")
+        v = verdicts.get(key) if key else None
+        if v is None and do_grade and key and _msg_is_connector(all_msgs[i]):
+            text, tools, connector = _msg_grade_payload(all_msgs[i])
+            if tools.strip() or text.strip():
+                scan_msgs = [
+                    {"role": "user", "content": _intent_before(all_msgs, i), "name": ""},
+                    {"role": "tool", "content": tools[:500000], "name": connector[:200]},
+                    {"role": "assistant", "content": text[:8000], "name": ""},
+                ]
+                reason = _scan_turn_call(convo_id, scan_msgs, connector)
+                v = {"blocked": reason is not None, "reason": reason or ""}
+                _put_turn_verdict(key, convo_id, v["blocked"], v["reason"])
+        if v and v.get("blocked"):
+            all_msgs[i]["content"] = [{"type": "text", "text": "[Blocked by Synkro] " + (v.get("reason") or "restricted data")}]
+            any_blocked = True
+    return any_blocked
+
+def _feed_answer(chunk, st):
+    # Accumulate the assistant's ANSWER text (text_delta) as the held stream flows,
+    # using a carry for SSE lines split across chunks. The answer reveals the doc's
+    # classification, so once enough has arrived we grade it for an early verdict.
+    txt = st["carry"] + chunk
+    lines = txt.split("\\n")
+    st["carry"] = lines[-1][-100000:]  # bound carried partial line (CWE-400)
+    for ln in lines[:-1]:
+        if not ln.startswith("data: "):
+            continue
+        try:
+            obj = json.loads(ln[6:])
+        except Exception:
+            continue
+        d = obj.get("delta")
+        if isinstance(d, dict) and d.get("type") == "text_delta" and isinstance(d.get("text"), str):
+            if len(st["answer"]) < 200000:  # bound (CWE-400)
+                st["answer"] += d["text"]
+
+def _grade_worker(st, ans):
+    # Runs in a BACKGROUND THREAD (off mitmproxy's event loop). The urllib grade
+    # releases the GIL during I/O, so the loop keeps flushing keep-alive pings.
+    # CWE-362: ans is a snapshot PASSED BY the loop thread (the sole writer of
+    # st["answer"]) at thread-creation \u2014 the worker never reads shared mutable
+    # st["answer"], so there is no data race. It writes only verdict/graded, which the
+    # loop reads AFTER graded.is_set() provides the happens-before barrier.
+    try:
+        ans = ans[:200000]
+        reason = _scan_turn_call(st["cid"], [{"role": "assistant", "content": ans, "name": ""}], "") if ans.strip() else None
+    except Exception:
+        reason = None
+    st["verdict"] = {"block": reason is not None, "reason": reason or ""}
+    _cache_turn_verdict(st["cid"], st["verdict"])
+    st["graded"].set()
+
+def _classify_frame(fr):
+    # Inspect one CRLF SSE frame's data line \u2192 'tool_use_start' | 'text_start' | 'other'
+    # based on the content_block_start type. Used to find where the FINAL answer begins.
+    for ln in fr.split("\\r\\n"):
+        if ln.startswith("data: "):
+            try:
+                o = json.loads(ln[6:])
+            except Exception:
+                return "other"
+            if o.get("type") == "content_block_start":
+                cb = o.get("content_block")
+                if isinstance(cb, dict):
+                    t = cb.get("type")
+                    if t == "tool_use":
+                        return "tool_use_start"
+                    if t == "text":
+                        return "text_start"
+            return "other"
+    return "other"
+
+def _frame_answer_text(fr, st):
+    # Accumulate text_delta text from a HELD frame into st["answer"] (for the grade).
+    for ln in fr.split("\\r\\n"):
+        if ln.startswith("data: "):
+            try:
+                d = json.loads(ln[6:]).get("delta")
+            except Exception:
+                continue
+            if isinstance(d, dict) and d.get("type") == "text_delta" and isinstance(d.get("text"), str):
+                if len(st["answer"]) < 200000:  # CWE-400 bound
+                    st["answer"] += d["text"]
+
+def _block_held(frames, notice):
+    # Frame-aware, CRLF-PRESERVING block render of the held final-answer frames: replace
+    # the answer's text_delta(s) (first\u2192notice, rest\u2192"") and leave every structural frame
+    # (content_block_stop / message_delta / message_stop) intact so the message still
+    # finalizes cleanly. Operates per-frame on \\r\\n lines \u2192 no \\n/\\r\\n mixing, so the
+    # framing stays byte-clean (the thing _neutralize_body's \\n split would have broken).
+    inj = [False]
+    out = []
+    for fr in frames:
+        nl = []
+        for ln in fr.split("\\r\\n"):
+            if ln.startswith("data: "):
+                try:
+                    o = json.loads(ln[6:])
+                    d = o.get("delta")
+                    if isinstance(d, dict) and d.get("type") == "text_delta" and isinstance(d.get("text"), str):
+                        o["delta"]["text"] = notice if not inj[0] else ""
+                        inj[0] = True
+                        ln = "data: " + json.dumps(o)
+                except Exception:
+                    pass
+            nl.append(ln)
+        out.append("\\r\\n".join(nl))
+    return ("\\r\\n\\r\\n".join(out) + "\\r\\n\\r\\n") if out else ""
+
+def _make_hold_stream(cid):
+    # Pass-through-until-FINAL-ANSWER hold for the claude.ai completion (CRLF SSE; frames
+    # split by \\r\\n\\r\\n). A connector turn is: thinking \u2192 text(preamble) \u2192 tool_use \u2192
+    # tool_result \u2192 \u2026 \u2192 text(ANSWER). Only the FINAL answer is in the user's face, so we
+    # STREAM every earlier frame VERBATIM (natural thinking/search activity + tool chips,
+    # zero mutation) and HOLD only the final answer \u2014 the text block that opens AFTER a
+    # tool_use \u2014 through message_stop. Buffer it (no leak), grade off-thread, heartbeat to
+    # keep Desktop alive, then emit the real answer (clean) or a frame-aware block rewrite
+    # (restricted). CWE-362: the grade thread gets an immutable answer snapshot; the
+    # verdict returns via the Event barrier; the loop is the sole writer of held/answer.
+    st = {"cid": cid, "carry": "", "holding": False, "seen_tool": False,
+          "held": [], "held_size": 0, "answer": "", "started": False, "meta": _new_scan_state(),
+          "graded": threading.Event(), "verdict": {"block": False, "reason": ""}}
+    def _hold(data, _st=st):
+        if data:
+            txt = _st["carry"] + data.decode("utf-8", "replace")
+            frames = txt.split("\\r\\n\\r\\n")
+            _st["carry"] = frames[-1][-200000:]   # CWE-400 bounded carry (last partial frame)
+            out = []
+            for fr in frames[:-1]:
+                for ln in fr.split("\\r\\n"):
+                    _scan_sse_line(ln, _st["meta"])   # governance metadata, all frames
+                if not _st["holding"]:
+                    k = _classify_frame(fr)
+                    if k == "tool_use_start":
+                        _st["seen_tool"] = True
+                    if k == "text_start" and _st["seen_tool"]:
+                        _st["holding"] = True          # the FINAL answer begins here \u2192 hold from now
+                    else:
+                        out.append(fr)                 # thinking / preamble / tool_use / tool_result \u2192 verbatim
+                        continue
+                if _st["held_size"] < 8000000:         # CWE-400 bound before append
+                    _st["held"].append(fr); _st["held_size"] += len(fr)
+                _frame_answer_text(fr, _st)
+            if _st["holding"] and not _st["started"] and len(_st["answer"]) >= 1200:
+                _st["started"] = True
+                threading.Thread(target=_grade_worker, args=(_st, _st["answer"][:200000]), daemon=True).start()
+            if out:
+                return ("\\r\\n\\r\\n".join(out) + "\\r\\n\\r\\n").encode("utf-8")  # stream activity verbatim
+            return b": synkro\\n\\n"   # answer held \u2192 heartbeat (keeps Desktop alive, PROVEN)
+        # upstream ended
+        m = _st["meta"]
+        if (m["usage"] or m["sources"] or m["citations"]) and _st["cid"]:
+            with _sse_lock:
+                _sse_meta[_st["cid"]] = {"usage": m["usage"], "sources": m["sources"], "citations": m["citations"]}
+        if not _st["holding"]:   # no final-answer block detected \u2014 everything already streamed
+            return _st["carry"].encode("utf-8") if _st["carry"] else b""
+        if _st["carry"]:
+            _st["held"].append(_st["carry"]); _frame_answer_text(_st["carry"], _st); _st["carry"] = ""
+        if not _st["started"] and _st["answer"].strip():  # short answer never hit the 1200 trigger
+            _st["started"] = True
+            threading.Thread(target=_grade_worker, args=(_st, _st["answer"][:200000]), daemon=True).start()
+        held_frames = list(_st["held"])
+        def _grade_window(_st2=_st, _frames=held_frames):
+            waited = 0.0
+            while not _st2["graded"].is_set() and waited < 60.0:
+                yield b": synkro\\n\\n"   # heartbeat WHILE grading \u2014 keeps Desktop alive (PROVEN)
+                time.sleep(0.5)
+                waited += 0.5
+            v = _st2["verdict"]
+            if _st2["graded"].is_set() and v["block"]:
+                print("[synkro] HELD+BLOCKED live (reason=" + v["reason"][:60] + ")")
+                yield _block_held(_frames, "[Blocked by Synkro] " + v["reason"]).encode("utf-8")
+            elif _st2["graded"].is_set():
+                yield ("\\r\\n\\r\\n".join(_frames) + "\\r\\n\\r\\n").encode("utf-8")  # clean \u2192 real answer
+            else:  # grade never landed in 60s \u2014 never leak; tree GET backstop finalizes
+                print("[synkro] hold: grade timeout \u2192 placeholder + tree-GET backstop")
+                yield _block_held(_frames, "[Synkro is reviewing this response\u2026]").encode("utf-8")
+        return _grade_window()
+    return _hold
+
 class SynkroTap:
     def request(self, flow):
         # \u2500\u2500 Upload DLP gate \u2500\u2500 Scan file uploads BEFORE they reach claude.ai and
@@ -7795,13 +8104,14 @@ class SynkroTap:
             print("[synkro] upload scanned -> allow (size=" + str(payload.get("size", 0)) + ")")
 
     def responseheaders(self, flow):
-        # Buffer the small conversation-tree GET (parsed for the dashboard).
-        # For the completion POST, TAP the SSE chunk-by-chunk and pass each
-        # through unchanged \u2014 Claude Desktop keeps streaming normally while we
-        # accumulate a bounded copy for the raw diagnostic dump. Everything else
-        # streams untouched.
+        # The answer the user watches TYPE OUT comes from claude.ai's completion \u2014 THAT
+        # is the stream we HOLD (buffer + heartbeat \u2192 no leak, no disconnect; see
+        # _make_hold_stream). a-api.anthropic.com is a background call that doesn't carry
+        # the answer, so it streams through untouched (default below). The tree GET is
+        # buffered for the dashboard + the durable block scrub.
         r = flow.request
-        if "claude.ai" in (r.pretty_host or "") and "chat_conversations" in r.path:
+        host = r.pretty_host or ""
+        if "claude.ai" in host and "chat_conversations" in r.path:
             if r.method == "GET" and "tree" in r.pretty_url:
                 return
             if r.method == "POST" and "completion" in r.path:
@@ -7809,16 +8119,12 @@ class SynkroTap:
                 cid = cm.group(1) if cm else ""
                 with _mcp_lock:
                     has_servers = len(_mcp_registry) > 0
-                # M3 LIVE HOLD: only when a BLOCK-mode rule exists AND connectors are
-                # connected, BUFFER the whole completion (leave .stream unset) so
-                # response() can grade it and neutralize restricted content BEFORE the
-                # user sees a single token. Audit-only / no-connector turns skip this
-                # entirely and stream as before \u2014 zero added latency.
+                # HOLD when a BLOCK-mode rule exists AND connectors are connected \u2014 buffer
+                # the answer, grade off-thread, heartbeat through the grade, emit the verdict.
                 if has_servers and _should_hold():
-                    flow.metadata["synkro_hold_cid"] = cid
+                    flow.response.stream = _make_hold_stream(cid)
                     return
-                # Streaming path (unchanged behaviour): tap chunk-by-chunk, extract
-                # governance metadata only, never buffer the body. Audit stays async.
+                # Otherwise just TAP for governance metadata (no hold; audit stays async).
                 st = _new_scan_state()
                 def _tap(data, _st=st, _cid=cid):
                     if data:
@@ -7845,36 +8151,6 @@ class SynkroTap:
     def response(self, flow):
         r = flow.request
         if "claude.ai" not in (r.pretty_host or ""): return
-        # \u2500\u2500 M3: a HELD completion (buffered for inline grading) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-        # We have the full SSE body now. Re-derive governance metadata (same as the
-        # streaming path), then \u2014 if the turn used a tool/connector \u2014 grade it
-        # SYNCHRONOUSLY and, on a block, NEUTRALIZE the response so the user never
-        # sees the restricted content. Verdict is cached for the tree GET to reuse.
-        hold_cid = (flow.metadata.get("synkro_hold_cid") if hasattr(flow, "metadata") else None)
-        if hold_cid is not None and "completion" in r.path and flow.response:
-            try:
-                body = flow.response.get_text() or ""
-            except Exception:
-                body = ""
-            st = _new_scan_state()
-            for ln in body.split("\\n"):
-                _scan_sse_line(ln, st)
-            if (st["usage"] or st["sources"] or st["citations"]) and hold_cid:
-                with _sse_lock:
-                    _sse_meta[hold_cid] = {"usage": st["usage"], "sources": st["sources"], "citations": st["citations"]}
-            text, has_tool = _extract_sse_text(body)
-            if has_tool:
-                # The turn used a connector \u2014 HOLD the live view: replace the streamed
-                # content with a "reviewing" placeholder so the user never sees the raw
-                # response. The tree GET is the SINGLE grader and renders the final
-                # state (real content if clean, block notice if restricted) \u2014 so there
-                # is exactly one full-document grade per turn (no double-grade race).
-                try:
-                    flow.response.text = _neutralize_sse(body, REVIEWING_NOTICE)
-                    print("[synkro] HELD completion -> reviewing placeholder")
-                except Exception as e:
-                    print("[synkro] hold placeholder failed (fail-open): " + str(e))
-            return
         # MCP server registry from the bootstrap SSE stream.
         if "mcp" in r.path and "bootstrap" in r.path and flow.response:
             try:
@@ -7975,6 +8251,14 @@ class SynkroTap:
                 messages.append({"role": "user", "content": text})
         if not messages: return
         data = {"request": {"model": model, "messages": messages}, "conversation_id": convo_id}
+        # PER-TURN key: the current turn's assistant message id (same key used for
+        # dlp_turn_verdicts). Lets the server store each turn as its OWN event so a
+        # blocked turn isn't overwritten/deleted by a later passing turn.
+        turn_id = ""
+        for _m in reversed(chat):
+            if _m.get("sender") != "human":
+                turn_id = _msg_key(_m); break
+        if turn_id: data["turn_id"] = turn_id
         meta = {}
         if platform: meta["platform"] = platform
         if web_search_on: meta["web_search_enabled"] = True
@@ -7992,32 +8276,14 @@ class SynkroTap:
         nsrc = len((sm or {}).get("sources") or [])
         print("[synkro] captured chat (msgs=" + str(len(messages)) + " tools=" + str(ntools) + " sources=" + str(nsrc) + " model=" + model + ")")
 
-        # \u2500\u2500 Tier-2 connector DLP gate \u2500\u2500 If this turn pulled content via an MCP
-        # connector, scan it SYNCHRONOUSLY against blocking org rules. On a block
-        # verdict we HOLD this tree GET (the authoritative render) until the verdict
-        # and then SCRUB the turn from the tree the renderer sees \u2014 the employee
-        # never sees the restricted content. The REAL content is still captured
-        # below for audit (record-everything-even-when-blocked). Fail-OPEN.
-        blocked_reason = None
-        has_connector = any(m.get("role") == "tool" and m.get("content") for m in messages)
-        # SINGLE grader: the held completion only shows a "reviewing" placeholder, so
-        # the tree GET is the one and only place a turn is graded \u2014 exactly one
-        # full-document grade per turn (no double-grade). Gated on a BLOCK-mode rule
-        # existing; audit-only orgs (_should_hold False) skip this and stay async.
-        if _should_hold() and SCAN_TURN_URL and TOKEN and has_connector:
-            # CWE-20/CWE-400: bounded, shape-validated payload (<=200 msgs, <=2MB).
-            scan_msgs = []
-            budget = 2000000
-            for m in messages[:200]:
-                if budget <= 0: break
-                c = str(m.get("content", ""))[:min(500000, budget)]
-                budget -= len(c)
-                scan_msgs.append({"role": str(m.get("role", "user"))[:20], "content": c, "name": str(m.get("name", ""))[:200]})
-            connector = ""
-            for m in scan_msgs:
-                if m["role"] == "tool" and m["name"]:
-                    nm = m["name"]; connector = (nm.split(":")[0] if ":" in nm else nm); break
-            blocked_reason = _scan_turn_call(convo_id, scan_msgs, connector)
+        # \u2500\u2500 Tier-2 connector DLP gate (WHOLE-CONVERSATION, per-turn, PERSISTENT) \u2500\u2500
+        # Scrub every blocked assistant turn (durable PGLite verdicts; connector turns
+        # graded once on miss). See _apply_turn_verdicts. Fail-OPEN on any error.
+        try:
+            any_blocked = _apply_turn_verdicts(all_msgs, convo_id)
+        except Exception as e:
+            any_blocked = False
+            print("[synkro] turn-verdict scrub error (fail-open): " + str(e))
 
         # Capture the REAL content for audit regardless of the block decision.
         def send(_d=data):
@@ -8027,17 +8293,11 @@ class SynkroTap:
                 print("[synkro] capture error: " + str(e))
         threading.Thread(target=send, daemon=True).start()
 
-        # Block the rendered view: replace this turn's assistant message content in
-        # the tree (everything after the last human turn) with a Synkro notice, so
-        # the restricted content + any model output derived from it is never shown.
-        if blocked_reason is not None:
-            notice = "[Blocked by Synkro] " + blocked_reason
-            for i in range(last_human + 1, len(all_msgs)):
-                if all_msgs[i].get("sender") != "human":
-                    all_msgs[i]["content"] = [{"type": "text", "text": notice}]
+        # Re-serialize the tree so the renderer never sees any blocked turn's content.
+        if any_blocked:
             try:
                 flow.response.text = json.dumps(convo)
-                print("[synkro] BLOCKED turn view (reason=" + blocked_reason[:80] + ")")
+                print("[synkro] BLOCKED turn view (whole-convo per-turn, durable)")
             except Exception as e:
                 print("[synkro] block scrub failed (fail-open): " + str(e))
 
@@ -9695,7 +9955,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.57")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.58")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -12953,7 +13213,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.57");
+  console.log("1.6.58");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents