@synkro-sh/cli 1.6.57 → 1.6.59

package/dist/bootstrap.js

@@ -509,6 +509,8 @@ var init_cursorHookConfig = __esm({
 import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3, renameSync as renameSync3, mkdirSync as mkdirSync3 } from "fs";
 import { homedir as homedir3 } from "os";
 import { dirname as dirname3, join as join2 } from "path";
+import { spawnSync } from "child_process";
+import { randomBytes } from "crypto";
 function readClaudeJson() {
   if (!existsSync3(CC_CONFIG_PATH)) return {};
   try {
@@ -630,7 +632,69 @@ function uninstallCursorMcpConfig() {
   writeCursorMcpJsonAtomic(config);
   return true;
 }
-var SYNKRO_MARKER3, SYNKRO_SERVER_NAME, CC_CONFIG_PATH, CURSOR_MCP_PATH;
+function resolveBunBin() {
+  const r = spawnSync("which", ["bun"], { encoding: "utf-8", timeout: 5e3 });
+  const resolved = (r.stdout || "").split("\n")[0].trim();
+  if (resolved) return resolved;
+  for (const p of ["/opt/homebrew/bin/bun", "/usr/local/bin/bun", join2(homedir3(), ".bun", "bin", "bun")]) {
+    if (existsSync3(p)) return p;
+  }
+  return "bun";
+}
+function readDesktopJson() {
+  if (!existsSync3(CLAUDE_DESKTOP_CONFIG_PATH)) return {};
+  try {
+    return JSON.parse(readFileSync3(CLAUDE_DESKTOP_CONFIG_PATH, "utf-8"));
+  } catch (err) {
+    throw new Error(`Failed to parse ${CLAUDE_DESKTOP_CONFIG_PATH}: ${err.message}`);
+  }
+}
+function writeDesktopJsonAtomic(config) {
+  mkdirSync3(dirname3(CLAUDE_DESKTOP_CONFIG_PATH), { recursive: true });
+  const tmpPath = `${CLAUDE_DESKTOP_CONFIG_PATH}.synkro.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  writeFileSync3(tmpPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  renameSync3(tmpPath, CLAUDE_DESKTOP_CONFIG_PATH);
+}
+function installClaudeDesktopMcpConfig() {
+  if (!existsSync3(MCP_STDIO_PROXY_PATH)) {
+    return {
+      ok: false,
+      path: CLAUDE_DESKTOP_CONFIG_PATH,
+      proxy: MCP_STDIO_PROXY_PATH,
+      reason: "stdio proxy not found \u2014 run `synkro install` first"
+    };
+  }
+  const config = readDesktopJson();
+  config.mcpServers = config.mcpServers ?? {};
+  for (const [name, entry] of Object.entries(config.mcpServers)) {
+    if (entry?.[SYNKRO_MARKER3] === true) delete config.mcpServers[name];
+  }
+  config.mcpServers[SYNKRO_SERVER_NAME] = {
+    command: resolveBunBin(),
+    args: ["run", MCP_STDIO_PROXY_PATH],
+    env: { SYNKRO_MCP_PORT: process.env.SYNKRO_MCP_PORT || "18931" },
+    [SYNKRO_MARKER3]: true
+  };
+  writeDesktopJsonAtomic(config);
+  return { ok: true, path: CLAUDE_DESKTOP_CONFIG_PATH, proxy: MCP_STDIO_PROXY_PATH };
+}
+function uninstallClaudeDesktopMcpConfig() {
+  if (!existsSync3(CLAUDE_DESKTOP_CONFIG_PATH)) return false;
+  const config = readDesktopJson();
+  if (!config.mcpServers || Object.keys(config.mcpServers).length === 0) return false;
+  let removed = false;
+  for (const [name, entry] of Object.entries(config.mcpServers)) {
+    if (entry?.[SYNKRO_MARKER3] === true) {
+      delete config.mcpServers[name];
+      removed = true;
+    }
+  }
+  if (!removed) return false;
+  if (Object.keys(config.mcpServers).length === 0) delete config.mcpServers;
+  writeDesktopJsonAtomic(config);
+  return true;
+}
+var SYNKRO_MARKER3, SYNKRO_SERVER_NAME, CC_CONFIG_PATH, CURSOR_MCP_PATH, CLAUDE_DESKTOP_CONFIG_PATH, MCP_STDIO_PROXY_PATH;
 var init_mcpConfig = __esm({
   "cli/installer/mcpConfig.ts"() {
     "use strict";
@@ -638,6 +702,14 @@ var init_mcpConfig = __esm({
     SYNKRO_SERVER_NAME = "synkro-guardrails";
     CC_CONFIG_PATH = join2(homedir3(), ".claude.json");
     CURSOR_MCP_PATH = join2(homedir3(), ".cursor", "mcp.json");
+    CLAUDE_DESKTOP_CONFIG_PATH = join2(
+      homedir3(),
+      "Library",
+      "Application Support",
+      "Claude",
+      "claude_desktop_config.json"
+    );
+    MCP_STDIO_PROXY_PATH = join2(homedir3(), ".synkro", "hooks", "mcp-stdio-proxy.ts");
   }
 });
 
@@ -1595,6 +1667,28 @@ async function cloudGrade(surface: string, prompt: string, jwt: string, timeoutM
   return String(data.verdict || '');
 }
 
+// Cloud-container grading \u2014 the org's grader runs on Cloudflare Containers. Same
+// request/response shape as channelGrade (the host-host Worker forwards verbatim
+// to the org's dispatcher /submit), but to the hosted ingress with the gateway
+// JWT (the Worker derives the org from the token and routes to that org's
+// container). Any non-2xx throws so the caller's catch fails open.
+const CONTAINERS_URL = process.env.SYNKRO_CONTAINERS_URL || 'https://containers.synkro.sh';
+async function hostedGrade(role: GradeRole, prompt: string, jwt: string, timeoutMs = 24000, agentKind: AgentKind = 'claude_code'): Promise<string> {
+  const resp = await fetch(CONTAINERS_URL + '/grade/submit', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
+    body: JSON.stringify({ role, payload: prompt, content: prompt, agent_kind: agentKind }),
+    signal: AbortSignal.timeout(timeoutMs),
+  });
+  if (!resp.ok) {
+    const text = await resp.text().catch(() => '');
+    throw new Error('hosted grade ' + resp.status + ': ' + text.slice(0, 200));
+  }
+  const data = await resp.json() as { result?: string; error?: string };
+  if (data.error) throw new Error(data.error);
+  return String(data.result || '');
+}
+
 // Default 24s \u2014 MUST stay below the CC hook timeout (30s for edit/bash/cwe in
 // ccHookConfig.ts) so the AbortSignal fires and the caller's catch fails open
 // cleanly. If this matches or exceeds the CC budget, CC force-kills the bun
@@ -1603,6 +1697,11 @@ async function cloudGrade(surface: string, prompt: string, jwt: string, timeoutM
 export async function localGrade(surface: string, prompt: string, timeoutMs = 24000, agentKind: AgentKind = 'claude_code'): Promise<string> {
   const jwt = loadJwt();
   if (!jwt) throw new Error('NO_JWT');
+  // Cloud-container: the grader runs on Cloudflare Containers \u2014 route to the
+  // hosted ingress instead of the local channel. Same prompt + parseVerdict.
+  if (process.env.SYNKRO_DEPLOY_LOCATION === 'cloud') {
+    return hostedGrade(ROLE_MAP[surface] || 'grade-edit', prompt, jwt, timeoutMs, agentKind);
+  }
   // BYOK grading mode routes the grade through an LLM API instead of the
   // on-device channel worker pool. The grader prompt + parseVerdict are shared.
   if ((process.env.SYNKRO_GRADING_MODE || 'local') === 'byok') {
@@ -1618,6 +1717,9 @@ export async function localGrade(surface: string, prompt: string, timeoutMs = 24
 export async function localGradeCwe(prompt: string, agentKind: AgentKind = 'claude_code', timeoutMs = 24000): Promise<string> {
   const jwt = loadJwt();
   if (!jwt) throw new Error('NO_JWT');
+  if (process.env.SYNKRO_DEPLOY_LOCATION === 'cloud') {
+    return hostedGrade('grade-cwe', prompt, jwt, timeoutMs, agentKind);
+  }
   return channelGrade('grade-cwe', prompt, jwt, 18930, timeoutMs, agentKind);
 }
 
@@ -7491,7 +7593,7 @@ echo ""
 wait $MITM_PID
 `;
 }
-async function runClaudeDesktopTap() {
+async function runClaudeDesktopTap(opts = {}) {
   if (process.platform !== "darwin") {
     console.log("  Claude Desktop observability is macOS-only \u2014 skipped.");
     return;
@@ -7505,6 +7607,20 @@ async function runClaudeDesktopTap() {
     console.log("  Could not read local auth token (~/.synkro/.mcp-jwt). Run `synkro install` first.");
     return;
   }
+  if (opts.backfill) {
+    console.log("  History backfill enabled \u2014 importing past conversations once this session.");
+  }
+  try {
+    const mcp = installClaudeDesktopMcpConfig();
+    if (mcp.ok) {
+      console.log(`  \u2713 Synkro standards MCP registered in Claude Desktop`);
+      console.log(`    (${mcp.path}) \u2014 restart Claude Desktop to load the synkro-guardrails tools.`);
+    } else {
+      console.log(`  \u26A0 Claude Desktop MCP not registered: ${mcp.reason}`);
+    }
+  } catch (err) {
+    console.log(`  \u26A0 Could not register Claude Desktop MCP: ${err.message}`);
+  }
   const cdRoot = join5(homedir5(), ".synkro", "cd-sessions");
   mkdirSync6(cdRoot, { recursive: true });
   const sessionDir = mkdtempSync(join5(cdRoot, "synkro-cd-"));
@@ -7516,7 +7632,7 @@ async function runClaudeDesktopTap() {
   await new Promise((resolve4) => {
     const child = spawn("bash", [runnerPath], {
       stdio: "inherit",
-      env: { ...process.env, SYNKRO_CAPTURE_URL: CAPTURE_URL, SYNKRO_SCAN_URL: SCAN_URL, SYNKRO_SCAN_TURN_URL: SCAN_TURN_URL, SYNKRO_DLP_POLICY_URL: DLP_POLICY_URL, SYNKRO_TAP_TOKEN: token, SYNKRO_TAP_TOKEN_FILE: JWT_PATH }
+      env: { ...process.env, SYNKRO_CAPTURE_URL: CAPTURE_URL, SYNKRO_SCAN_URL: SCAN_URL, SYNKRO_SCAN_TURN_URL: SCAN_TURN_URL, SYNKRO_DLP_POLICY_URL: DLP_POLICY_URL, SYNKRO_TURN_VERDICTS_URL: TURN_VERDICTS_URL, SYNKRO_TURN_VERDICT_URL: TURN_VERDICT_URL, SYNKRO_MCP_EVENT_URL: MCP_EVENT_URL, SYNKRO_TAP_TOKEN: token, SYNKRO_TAP_TOKEN_FILE: JWT_PATH, SYNKRO_CD_BACKFILL: opts.backfill ? "1" : "" }
     });
     const forward = (sig) => {
       try {
@@ -7533,23 +7649,39 @@ async function runClaudeDesktopTap() {
     });
   });
 }
-var CAPTURE_URL, SCAN_URL, SCAN_TURN_URL, DLP_POLICY_URL, JWT_PATH, ADDON_PY, MCP_PROXY_PY, MCP_PATCH_PY;
+var CAPTURE_URL, SCAN_URL, SCAN_TURN_URL, DLP_POLICY_URL, TURN_VERDICTS_URL, TURN_VERDICT_URL, MCP_EVENT_URL, JWT_PATH, ADDON_PY, MCP_PROXY_PY, MCP_PATCH_PY;
 var init_claudeDesktopTap = __esm({
   "cli/installer/claudeDesktopTap.ts"() {
     "use strict";
+    init_mcpConfig();
     CAPTURE_URL = "http://127.0.0.1:18931/api/local/capture";
     SCAN_URL = "http://127.0.0.1:18931/api/local/scan-upload";
     SCAN_TURN_URL = "http://127.0.0.1:18931/api/local/scan-turn";
     DLP_POLICY_URL = "http://127.0.0.1:18931/api/local/dlp-policy";
+    TURN_VERDICTS_URL = "http://127.0.0.1:18931/api/local/turn-verdicts";
+    TURN_VERDICT_URL = "http://127.0.0.1:18931/api/local/turn-verdict";
+    MCP_EVENT_URL = "http://127.0.0.1:18931/api/local/mcp/event";
     JWT_PATH = join5(homedir5(), ".synkro", ".mcp-jwt");
-    ADDON_PY = `import os, json, threading, urllib.request, urllib.error, re, base64
+    ADDON_PY = `import os, json, threading, urllib.request, urllib.error, re, base64, time, hashlib
 from mitmproxy import http
 
-CAPTURE_URL = os.environ.get("SYNKRO_CAPTURE_URL", "")
+def _safe_url(u):
+    # CWE-918: these URLs come from the environment the installer sets \u2014 accept ONLY
+    # the loopback container endpoints, never an arbitrary host from a tampered env.
+    return u if (u.startswith("http://127.0.0.1:") or u.startswith("http://localhost:")) else ""
+
+CAPTURE_URL = _safe_url(os.environ.get("SYNKRO_CAPTURE_URL", ""))
 TOKEN = os.environ.get("SYNKRO_TAP_TOKEN", "")
-SCAN_URL = os.environ.get("SYNKRO_SCAN_URL", "")
-SCAN_TURN_URL = os.environ.get("SYNKRO_SCAN_TURN_URL", "")
-POLICY_URL = os.environ.get("SYNKRO_DLP_POLICY_URL", "")
+SCAN_URL = _safe_url(os.environ.get("SYNKRO_SCAN_URL", ""))
+SCAN_TURN_URL = _safe_url(os.environ.get("SYNKRO_SCAN_TURN_URL", ""))
+POLICY_URL = _safe_url(os.environ.get("SYNKRO_DLP_POLICY_URL", ""))
+TURN_VERDICTS_URL = _safe_url(os.environ.get("SYNKRO_TURN_VERDICTS_URL", ""))
+TURN_VERDICT_URL = _safe_url(os.environ.get("SYNKRO_TURN_VERDICT_URL", ""))
+MCP_EVENT_URL = _safe_url(os.environ.get("SYNKRO_MCP_EVENT_URL", ""))
+# History backfill is OPT-IN: only when the user runs synkro claude-desktop with
+# --backfill. Otherwise importing past conversations on every tap launch is wasted
+# work (and re-floods the feed). When set, it also bypasses the 12h throttle marker.
+BACKFILL_ENABLED = os.environ.get("SYNKRO_CD_BACKFILL", "") == "1"
 # Token file path \u2014 the SERVER_TOKEN rotates whenever the container is recreated,
 # so we re-read it from disk on a 401 instead of needing a tap restart.
 TOKEN_FILE = os.environ.get("SYNKRO_TAP_TOKEN_FILE", "")
@@ -7615,6 +7747,151 @@ def _fmt_tool_name(raw):
         pass
     return raw
 
+def _map_full_conversation(all_msgs):
+    # Full conversation [{role, content, tool_calls?}] + 'tool' result messages, in
+    # order, for the session-log tables (the Session Timeline card on the event page).
+    # Lighter than the per-turn capture: role + text + tool_calls + tool results.
+    out = []
+    for msg in all_msgs:
+        sender = msg.get("sender", "")
+        role = "user" if sender == "human" else "assistant"
+        blocks = msg.get("content", [])
+        texts = []; tcs = []; results = []
+        if isinstance(blocks, list):
+            for b in blocks:
+                if isinstance(b, str): texts.append(b); continue
+                if not isinstance(b, dict): continue
+                bt = b.get("type", "")
+                if bt == "text":
+                    texts.append(b.get("text", ""))
+                elif bt == "tool_use" or bt == "server_tool_use":
+                    tcs.append({"name": _fmt_tool_name(b.get("name", "")), "id": b.get("id", ""), "arguments": json.dumps(b.get("input", {}))[:2000]})
+                elif bt.endswith("_tool_result") or bt == "tool_result":
+                    rc = b.get("content", "")
+                    if isinstance(rc, list):
+                        rc = " | ".join(str(x.get("text") or x.get("content") or "") for x in rc if isinstance(x, dict))
+                    if rc and str(rc).strip():
+                        results.append({"role": "tool", "content": str(rc)[:8000], "name": _fmt_tool_name(b.get("name", ""))})
+        elif isinstance(blocks, str):
+            texts.append(blocks)
+        content = " ".join(t for t in texts if t).strip()
+        if content or tcs:
+            e = {"role": role, "content": content}
+            if tcs: e["tool_calls"] = tcs
+            out.append(e)
+        for r in results: out.append(r)
+        if len(out) >= 2000: break
+    return out
+
+def _emit_mcp_event(server, tool, ev_type, eid, convo_id=""):
+    # Post a Claude Desktop connector (MCP) lifecycle/tool_call event to the same
+    # mcp_events store the CC/Cursor mcp-gate writes, so Desktop connectors show on
+    # the MCP Servers page. eid is deterministic so re-captures dedupe (server
+    # ON CONFLICT DO NOTHING). Fire-and-forget; never blocks the proxied request.
+    if not (MCP_EVENT_URL and TOKEN and server): return
+    try:
+        payload = json.dumps({
+            "event_id": eid,
+            "session_id": (str(convo_id)[:80] or None),
+            "server_name": str(server)[:120],
+            "event_type": ev_type,
+            "tool_name": (str(tool)[:120] if tool else None),
+            "decision": ("allowed" if ev_type == "tool_call" else None),
+            "repo": "claude-desktop",
+        }).encode("utf-8")
+        _post_json(MCP_EVENT_URL, payload, 5)
+    except Exception:
+        pass
+
+# \u2500\u2500 History backfill \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+# One-time pull of the user's past claude.ai conversations into the local store, so
+# the dashboard shows full Desktop history (like CC's transcript import) \u2014 not just
+# turns tapped live. Auth (session cookie + org uuid) is captured from a live request
+# and kept IN MEMORY (never written to disk). Store-only: backfilled turns are not
+# graded (backfill=True). Runs at most once per 12h via a timestamp marker.
+#
+# SSRF (CWE-918): the only host we ever fetch is claude.ai, and org/conversation ids
+# must be UUID-shaped \u2014 both validated before any URL is built, so no untrusted value
+# can redirect the fetch to an arbitrary host/path.
+_backfill_lock = threading.Lock()
+_backfill_started = False
+_BACKFILL_MARKER = os.path.expanduser("~/.synkro/.cd-backfill-done")
+
+def _is_claude_host(h):
+    return h == "claude.ai" or (isinstance(h, str) and h.endswith(".claude.ai"))
+
+def _is_uuidish(s):
+    return bool(re.match(r"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$", s or ""))
+
+def _http_get(url, headers, timeout=25):
+    req = urllib.request.Request(url, headers=headers, method="GET")
+    with urllib.request.urlopen(req, timeout=timeout) as resp:
+        return resp.read()
+
+def _post_backfill_convo(convo, cid):
+    all_msgs = convo.get("chat_messages", [])
+    if not all_msgs: return
+    model = convo.get("model") or "claude-unknown"
+    if not model.startswith("claude-"): model = "claude-" + model
+    session_messages = _map_full_conversation(all_msgs)
+    if not session_messages: return
+    msgs = []
+    for e in session_messages:
+        mm = {"role": e.get("role", "user"), "content": e.get("content", "")}
+        if e.get("tool_calls"): mm["tool_calls"] = e["tool_calls"]
+        msgs.append(mm)
+    # Real conversation timestamp (last activity, fallback created) so the server
+    # stamps created_at to when the convo HAPPENED \u2014 not "now". Without this every
+    # backfill run re-stamps all history to the present and floods it to the top of
+    # the feed. Must be ISO8601; the server re-validates and only honors it for
+    # backfill rows.
+    cts = ""
+    for k in ("updated_at", "created_at"):
+        v = convo.get(k) if isinstance(convo, dict) else None
+        if isinstance(v, str) and re.match(r"^d{4}-d{2}-d{2}T", v):
+            cts = v; break
+    data = {"request": {"model": model, "messages": msgs[-200:]}, "conversation_id": cid,
+            "session_messages": session_messages, "turn_id": "cdbf_" + cid, "backfill": True}
+    if cts: data["event_ts"] = cts
+    _post_json(CAPTURE_URL, json.dumps(data).encode("utf-8"), 8)
+
+def _backfill(host, org, cookie):
+    if not (_is_claude_host(host) and _is_uuidish(org)): return  # defence in depth
+    base = "https://" + host
+    headers = {"Cookie": cookie, "Accept": "application/json", "User-Agent": "synkro-tap"}
+    try:
+        convos = json.loads(_http_get(base + "/api/organizations/" + org + "/chat_conversations?limit=200", headers, 25))
+        if not isinstance(convos, list): return
+    except Exception:
+        with _backfill_lock:
+            globals()["_backfill_started"] = False  # allow a later request to retry
+        return
+    print("[synkro] backfill: importing up to " + str(min(len(convos), 200)) + " conversations")
+    n = 0
+    for c in convos[:200]:
+        cid = c.get("uuid", "") if isinstance(c, dict) else ""
+        if not _is_uuidish(cid): continue
+        try:
+            convo = json.loads(_http_get(base + "/api/organizations/" + org + "/chat_conversations/" + cid + "?tree=True&rendering_mode=messages&render_all_tools=true", headers, 25))
+            _post_backfill_convo(convo, cid)
+            n += 1
+        except Exception:
+            pass
+        time.sleep(0.6)
+    try: open(_BACKFILL_MARKER, "w").write(str(int(time.time())))
+    except Exception: pass
+    print("[synkro] backfill done: " + str(n) + " conversations imported")
+
+def _maybe_backfill(host, org, cookie):
+    # Opt-in only: skip entirely unless the user launched with --backfill.
+    if not BACKFILL_ENABLED: return
+    if not (_is_claude_host(host) and _is_uuidish(org) and cookie and CAPTURE_URL and TOKEN): return
+    with _backfill_lock:
+        global _backfill_started
+        if _backfill_started: return
+        _backfill_started = True
+    threading.Thread(target=_backfill, args=(host, org, cookie), daemon=True).start()
+
 # \u2500\u2500 M3 live-hold state \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 # Whether to HOLD connector turns (buffer the live completion until graded).
 # Fetched once from the server: True only when a BLOCK-mode rule exists (+ not
@@ -7705,10 +7982,12 @@ def _extract_sse_text(body):
                     if isinstance(x, dict) and isinstance(x.get("text"), str): parts.append(x["text"]); total += len(x["text"])
     return ("".join(parts)[:2000000], tool)
 
-def _neutralize_sse(body, notice):
-    # Rewrite a buffered completion SSE: blank every text/content field (inject the
-    # notice into the FIRST text delta), leaving all structural events intact so
-    # Claude Desktop still renders a valid \u2014 but content-free \u2014 turn.
+def _neutralize_body(body, notice):
+    # Buffered BLOCK render of a COMPLETE response: replace the answer with the notice
+    # (first text delta, rest blanked), blank text/content content_blocks (incl. the
+    # retrieved doc), leave tool_use + thinking + every structural event intact (the
+    # tree GET scrubs thinking durably). Rewriting a WHOLE buffered body \u2014 not the
+    # live stream \u2014 is what avoids the "couldn't finish" fragility.
     out = []
     injected = [False]
     for line in body.split("\\n"):
@@ -7719,7 +7998,7 @@ def _neutralize_sse(body, notice):
             out.append(line); continue
         changed = False
         d = obj.get("delta")
-        if isinstance(d, dict) and isinstance(d.get("text"), str):
+        if isinstance(d, dict) and d.get("type") == "text_delta" and isinstance(d.get("text"), str):
             d["text"] = (notice if not injected[0] else "")
             injected[0] = True; changed = True
         cb = obj.get("content_block")
@@ -7731,6 +8010,304 @@ def _neutralize_sse(body, notice):
         out.append(("data: " + json.dumps(obj)) if changed else line)
     return "\\n".join(out)
 
+# Per-conversation DLP verdict cached by the held completion so the tree GET reuses
+# it (durable scrub) instead of re-grading. Bounded (CWE-400), lock-guarded (CWE-362).
+_turn_verdicts = {}
+_tv_lock = threading.Lock()
+
+def _cache_turn_verdict(cid, verdict):
+    if not cid: return
+    with _tv_lock:
+        if len(_turn_verdicts) > 200: _turn_verdicts.clear()
+        _turn_verdicts[cid] = verdict
+
+def _pop_turn_verdict(cid):
+    with _tv_lock:
+        return _turn_verdicts.pop(cid, None)
+
+# \u2500\u2500 Per-turn durable verdict helpers (PGLite-backed via local endpoints) \u2500\u2500\u2500\u2500\u2500\u2500
+def _msg_blocks(msg):
+    b = msg.get("content", [])
+    return b if isinstance(b, list) else []
+
+def _msg_key(msg):
+    # Stable per-turn id. Prefer the message uuid; fall back to a content hash so the
+    # verdict still keys consistently across reopens even if uuid is ever absent.
+    u = msg.get("uuid") or msg.get("id")
+    if isinstance(u, str) and u:
+        return u
+    try:
+        raw = json.dumps(msg.get("content", ""), sort_keys=True).encode("utf-8", "replace")
+        return "h:" + hashlib.sha256(raw).hexdigest()[:40]
+    except Exception:
+        return ""
+
+def _msg_is_connector(msg):
+    # A turn that pulled content via a connector \u2192 has a tool_result block (the doc).
+    for b in _msg_blocks(msg):
+        if isinstance(b, dict) and (b.get("type", "") == "tool_result" or b.get("type", "").endswith("_tool_result")):
+            return True
+    return False
+
+def _msg_grade_payload(msg):
+    # Extract (assistant_text, tool_result_text, connector) from a message's blocks.
+    texts = []; tools = []; connector = ""
+    for b in _msg_blocks(msg):
+        if isinstance(b, str):
+            texts.append(b); continue
+        if not isinstance(b, dict):
+            continue
+        bt = b.get("type", "")
+        if bt == "text":
+            texts.append(b.get("text", "") or "")
+        elif bt == "tool_use" or bt == "server_tool_use":
+            nm = b.get("name", "") or ""
+            if nm and not connector:
+                connector = nm.split(":")[0] if ":" in nm else nm
+        elif bt == "tool_result" or bt.endswith("_tool_result"):
+            rc = b.get("content", "")
+            if isinstance(rc, list):
+                for x in rc:
+                    if isinstance(x, dict):
+                        if isinstance(x.get("text"), str): tools.append(x["text"])
+                        elif x.get("content"): tools.append(str(x.get("content")))
+            elif isinstance(rc, str):
+                tools.append(rc)
+            ic = b.get("integration_name") or b.get("name") or ""
+            if ic and not connector:
+                connector = ic
+    return ("\\n".join(texts), "\\n".join(tools), connector)
+
+def _get_turn_verdicts(uuids):
+    # Batch lookup of durable verdicts from PGLite (one round-trip). {uuid: {blocked,reason}}.
+    if not (TURN_VERDICTS_URL and TOKEN and uuids):
+        return {}
+    try:
+        resp = _post_json(TURN_VERDICTS_URL, json.dumps({"uuids": uuids[:500]}).encode("utf-8"), 8)
+        if resp:
+            o = json.loads(resp.decode("utf-8", "replace"))
+            v = o.get("verdicts")
+            return v if isinstance(v, dict) else {}
+    except Exception as e:
+        print("[synkro] verdict lookup error: " + str(e))
+    return {}
+
+def _put_turn_verdict(uuid, convo_id, blocked, reason):
+    # Persist one graded turn (fire-and-forget, off the tree-GET critical path).
+    if not (TURN_VERDICT_URL and TOKEN and uuid):
+        return
+    def _send():
+        try:
+            _post_json(TURN_VERDICT_URL, json.dumps({"message_uuid": uuid, "convo_id": convo_id, "blocked": bool(blocked), "reason": reason or ""}).encode("utf-8"), 8)
+        except Exception as e:
+            print("[synkro] verdict persist error: " + str(e))
+    threading.Thread(target=_send, daemon=True).start()
+
+def _intent_before(all_msgs, idx):
+    # Most recent human message text before idx \u2014 the turn's user intent for grading.
+    for j in range(idx - 1, -1, -1):
+        if all_msgs[j].get("sender") == "human":
+            for b in _msg_blocks(all_msgs[j]):
+                if isinstance(b, dict) and b.get("type") == "text": return (b.get("text") or "")[:2000]
+                if isinstance(b, str): return b[:2000]
+            return ""
+    return ""
+
+def _apply_turn_verdicts(all_msgs, convo_id):
+    # WHOLE-CONVERSATION per-turn DLP scrub. Mutates all_msgs in place: replaces every
+    # BLOCKED assistant turn's content with the notice. Returns True if anything was
+    # blocked. Verdicts are durable (PGLite via the local endpoints); each connector
+    # turn (a tool_result is present) is graded once on a miss then persisted; pure-chat
+    # turns are skipped. Scrubs EVERY blocked turn \u2014 not just the latest \u2014 so a follow-up
+    # can never resurrect an earlier blocked turn. Fail-OPEN.
+    asst_idx = [i for i in range(len(all_msgs)) if all_msgs[i].get("sender") != "human"]
+    keys = {i: _msg_key(all_msgs[i]) for i in asst_idx}
+    ids = [k for k in keys.values() if k]
+    verdicts = _get_turn_verdicts(ids) if ids else {}
+    do_grade = _should_hold() and SCAN_TURN_URL and TOKEN
+    any_blocked = False
+    for i in asst_idx:
+        key = keys.get(i, "")
+        v = verdicts.get(key) if key else None
+        if v is None and do_grade and key and _msg_is_connector(all_msgs[i]):
+            text, tools, connector = _msg_grade_payload(all_msgs[i])
+            if tools.strip() or text.strip():
+                scan_msgs = [
+                    {"role": "user", "content": _intent_before(all_msgs, i), "name": ""},
+                    {"role": "tool", "content": tools[:500000], "name": connector[:200]},
+                    {"role": "assistant", "content": text[:8000], "name": ""},
+                ]
+                reason = _scan_turn_call(convo_id, scan_msgs, connector)
+                v = {"blocked": reason is not None, "reason": reason or ""}
+                _put_turn_verdict(key, convo_id, v["blocked"], v["reason"])
+        if v and v.get("blocked"):
+            all_msgs[i]["content"] = [{"type": "text", "text": "[Blocked by Synkro] " + (v.get("reason") or "restricted data")}]
+            any_blocked = True
+    return any_blocked
+
+def _feed_answer(chunk, st):
+    # Accumulate the assistant's ANSWER text (text_delta) as the held stream flows,
+    # using a carry for SSE lines split across chunks. The answer reveals the doc's
+    # classification, so once enough has arrived we grade it for an early verdict.
+    txt = st["carry"] + chunk
+    lines = txt.split("\\n")
+    st["carry"] = lines[-1][-100000:]  # bound carried partial line (CWE-400)
+    for ln in lines[:-1]:
+        if not ln.startswith("data: "):
+            continue
+        try:
+            obj = json.loads(ln[6:])
+        except Exception:
+            continue
+        d = obj.get("delta")
+        if isinstance(d, dict) and d.get("type") == "text_delta" and isinstance(d.get("text"), str):
+            if len(st["answer"]) < 200000:  # bound (CWE-400)
+                st["answer"] += d["text"]
+
+def _grade_worker(st, ans):
+    # Runs in a BACKGROUND THREAD (off mitmproxy's event loop). The urllib grade
+    # releases the GIL during I/O, so the loop keeps flushing keep-alive pings.
+    # CWE-362: ans is a snapshot PASSED BY the loop thread (the sole writer of
+    # st["answer"]) at thread-creation \u2014 the worker never reads shared mutable
+    # st["answer"], so there is no data race. It writes only verdict/graded, which the
+    # loop reads AFTER graded.is_set() provides the happens-before barrier.
+    try:
+        ans = ans[:200000]
+        reason = _scan_turn_call(st["cid"], [{"role": "assistant", "content": ans, "name": ""}], "") if ans.strip() else None
+    except Exception:
+        reason = None
+    st["verdict"] = {"block": reason is not None, "reason": reason or ""}
+    _cache_turn_verdict(st["cid"], st["verdict"])
+    st["graded"].set()
+
+def _classify_frame(fr):
+    # Inspect one CRLF SSE frame's data line \u2192 'tool_use_start' | 'text_start' | 'other'
+    # based on the content_block_start type. Used to find where the FINAL answer begins.
+    for ln in fr.split("\\r\\n"):
+        if ln.startswith("data: "):
+            try:
+                o = json.loads(ln[6:])
+            except Exception:
+                return "other"
+            if o.get("type") == "content_block_start":
+                cb = o.get("content_block")
+                if isinstance(cb, dict):
+                    t = cb.get("type")
+                    if t == "tool_use":
+                        return "tool_use_start"
+                    if t == "text":
+                        return "text_start"
+            return "other"
+    return "other"
+
+def _frame_answer_text(fr, st):
+    # Accumulate text_delta text from a HELD frame into st["answer"] (for the grade).
+    for ln in fr.split("\\r\\n"):
+        if ln.startswith("data: "):
+            try:
+                d = json.loads(ln[6:]).get("delta")
+            except Exception:
+                continue
+            if isinstance(d, dict) and d.get("type") == "text_delta" and isinstance(d.get("text"), str):
+                if len(st["answer"]) < 200000:  # CWE-400 bound
+                    st["answer"] += d["text"]
+
+def _block_held(frames, notice):
+    # Frame-aware, CRLF-PRESERVING block render of the held final-answer frames: replace
+    # the answer's text_delta(s) (first\u2192notice, rest\u2192"") and leave every structural frame
+    # (content_block_stop / message_delta / message_stop) intact so the message still
+    # finalizes cleanly. Operates per-frame on \\r\\n lines \u2192 no \\n/\\r\\n mixing, so the
+    # framing stays byte-clean (the thing _neutralize_body's \\n split would have broken).
+    inj = [False]
+    out = []
+    for fr in frames:
+        nl = []
+        for ln in fr.split("\\r\\n"):
+            if ln.startswith("data: "):
+                try:
+                    o = json.loads(ln[6:])
+                    d = o.get("delta")
+                    if isinstance(d, dict) and d.get("type") == "text_delta" and isinstance(d.get("text"), str):
+                        o["delta"]["text"] = notice if not inj[0] else ""
+                        inj[0] = True
+                        ln = "data: " + json.dumps(o)
+                except Exception:
+                    pass
+            nl.append(ln)
+        out.append("\\r\\n".join(nl))
+    return ("\\r\\n\\r\\n".join(out) + "\\r\\n\\r\\n") if out else ""
+
+def _make_hold_stream(cid):
+    # Pass-through-until-FINAL-ANSWER hold for the claude.ai completion (CRLF SSE; frames
+    # split by \\r\\n\\r\\n). A connector turn is: thinking \u2192 text(preamble) \u2192 tool_use \u2192
+    # tool_result \u2192 \u2026 \u2192 text(ANSWER). Only the FINAL answer is in the user's face, so we
+    # STREAM every earlier frame VERBATIM (natural thinking/search activity + tool chips,
+    # zero mutation) and HOLD only the final answer \u2014 the text block that opens AFTER a
+    # tool_use \u2014 through message_stop. Buffer it (no leak), grade off-thread, heartbeat to
+    # keep Desktop alive, then emit the real answer (clean) or a frame-aware block rewrite
+    # (restricted). CWE-362: the grade thread gets an immutable answer snapshot; the
+    # verdict returns via the Event barrier; the loop is the sole writer of held/answer.
+    st = {"cid": cid, "carry": "", "holding": False, "seen_tool": False,
+          "held": [], "held_size": 0, "answer": "", "started": False, "meta": _new_scan_state(),
+          "graded": threading.Event(), "verdict": {"block": False, "reason": ""}}
+    def _hold(data, _st=st):
+        if data:
+            txt = _st["carry"] + data.decode("utf-8", "replace")
+            frames = txt.split("\\r\\n\\r\\n")
+            _st["carry"] = frames[-1][-200000:]   # CWE-400 bounded carry (last partial frame)
+            out = []
+            for fr in frames[:-1]:
+                for ln in fr.split("\\r\\n"):
+                    _scan_sse_line(ln, _st["meta"])   # governance metadata, all frames
+                if not _st["holding"]:
+                    k = _classify_frame(fr)
+                    if k == "tool_use_start":
+                        _st["seen_tool"] = True
+                    if k == "text_start" and _st["seen_tool"]:
+                        _st["holding"] = True          # the FINAL answer begins here \u2192 hold from now
+                    else:
+                        out.append(fr)                 # thinking / preamble / tool_use / tool_result \u2192 verbatim
+                        continue
+                if _st["held_size"] < 8000000:         # CWE-400 bound before append
+                    _st["held"].append(fr); _st["held_size"] += len(fr)
+                _frame_answer_text(fr, _st)
+            if _st["holding"] and not _st["started"] and len(_st["answer"]) >= 1200:
+                _st["started"] = True
+                threading.Thread(target=_grade_worker, args=(_st, _st["answer"][:200000]), daemon=True).start()
+            if out:
+                return ("\\r\\n\\r\\n".join(out) + "\\r\\n\\r\\n").encode("utf-8")  # stream activity verbatim
+            return b": synkro\\n\\n"   # answer held \u2192 heartbeat (keeps Desktop alive, PROVEN)
+        # upstream ended
+        m = _st["meta"]
+        if (m["usage"] or m["sources"] or m["citations"]) and _st["cid"]:
+            with _sse_lock:
+                _sse_meta[_st["cid"]] = {"usage": m["usage"], "sources": m["sources"], "citations": m["citations"]}
+        if not _st["holding"]:   # no final-answer block detected \u2014 everything already streamed
+            return _st["carry"].encode("utf-8") if _st["carry"] else b""
+        if _st["carry"]:
+            _st["held"].append(_st["carry"]); _frame_answer_text(_st["carry"], _st); _st["carry"] = ""
+        if not _st["started"] and _st["answer"].strip():  # short answer never hit the 1200 trigger
+            _st["started"] = True
+            threading.Thread(target=_grade_worker, args=(_st, _st["answer"][:200000]), daemon=True).start()
+        held_frames = list(_st["held"])
+        def _grade_window(_st2=_st, _frames=held_frames):
+            waited = 0.0
+            while not _st2["graded"].is_set() and waited < 60.0:
+                yield b": synkro\\n\\n"   # heartbeat WHILE grading \u2014 keeps Desktop alive (PROVEN)
+                time.sleep(0.5)
+                waited += 0.5
+            v = _st2["verdict"]
+            if _st2["graded"].is_set() and v["block"]:
+                print("[synkro] HELD+BLOCKED live (reason=" + v["reason"][:60] + ")")
+                yield _block_held(_frames, "[Blocked by Synkro] " + v["reason"]).encode("utf-8")
+            elif _st2["graded"].is_set():
+                yield ("\\r\\n\\r\\n".join(_frames) + "\\r\\n\\r\\n").encode("utf-8")  # clean \u2192 real answer
+            else:  # grade never landed in 60s \u2014 never leak; tree GET backstop finalizes
+                print("[synkro] hold: grade timeout \u2192 placeholder + tree-GET backstop")
+                yield _block_held(_frames, "[Synkro is reviewing this response\u2026]").encode("utf-8")
+        return _grade_window()
+    return _hold
+
 class SynkroTap:
     def request(self, flow):
         # \u2500\u2500 Upload DLP gate \u2500\u2500 Scan file uploads BEFORE they reach claude.ai and
@@ -7785,9 +8362,16 @@ class SynkroTap:
             return
         if verdict.get("block"):
             reason = str(verdict.get("reason", "Blocked by Synkro policy"))[:300]
+            msg = "Blocked by Synkro: " + reason
+            # Return a TERMINAL 400 (invalid_request_error), NOT 403. Claude Desktop's
+            # upload client treats 403 as transient/auth and auto-RETRIES it \u2014 that's the
+            # loop the user sees. A 400 invalid_request_error is non-retryable (the SDK/UI
+            # only retry 408/409/429/5xx), so the client stops and surfaces the message.
+            # Anthropic's standard error envelope ({"type":"error","error":{...}}) is what
+            # the UI knows how to render, so the user sees the reason instead of a spinner.
             flow.response = http.Response.make(
-                403,
-                json.dumps({"error": {"type": "blocked_by_synkro", "message": "Blocked by Synkro: " + reason}}).encode(),
+                400,
+                json.dumps({"type": "error", "error": {"type": "invalid_request_error", "message": msg}}).encode(),
                 {"Content-Type": "application/json"},
             )
             print("[synkro] BLOCKED upload (size=" + str(payload.get("size", 0)) + " rule=" + str(verdict.get("ruleId", "")) + ")")
@@ -7795,13 +8379,14 @@ class SynkroTap:
             print("[synkro] upload scanned -> allow (size=" + str(payload.get("size", 0)) + ")")
 
     def responseheaders(self, flow):
-        # Buffer the small conversation-tree GET (parsed for the dashboard).
-        # For the completion POST, TAP the SSE chunk-by-chunk and pass each
-        # through unchanged \u2014 Claude Desktop keeps streaming normally while we
-        # accumulate a bounded copy for the raw diagnostic dump. Everything else
-        # streams untouched.
+        # The answer the user watches TYPE OUT comes from claude.ai's completion \u2014 THAT
+        # is the stream we HOLD (buffer + heartbeat \u2192 no leak, no disconnect; see
+        # _make_hold_stream). a-api.anthropic.com is a background call that doesn't carry
+        # the answer, so it streams through untouched (default below). The tree GET is
+        # buffered for the dashboard + the durable block scrub.
         r = flow.request
-        if "claude.ai" in (r.pretty_host or "") and "chat_conversations" in r.path:
+        host = r.pretty_host or ""
+        if "claude.ai" in host and "chat_conversations" in r.path:
             if r.method == "GET" and "tree" in r.pretty_url:
                 return
             if r.method == "POST" and "completion" in r.path:
@@ -7809,16 +8394,12 @@ class SynkroTap:
                 cid = cm.group(1) if cm else ""
                 with _mcp_lock:
                     has_servers = len(_mcp_registry) > 0
-                # M3 LIVE HOLD: only when a BLOCK-mode rule exists AND connectors are
-                # connected, BUFFER the whole completion (leave .stream unset) so
-                # response() can grade it and neutralize restricted content BEFORE the
-                # user sees a single token. Audit-only / no-connector turns skip this
-                # entirely and stream as before \u2014 zero added latency.
+                # HOLD when a BLOCK-mode rule exists AND connectors are connected \u2014 buffer
+                # the answer, grade off-thread, heartbeat through the grade, emit the verdict.
                 if has_servers and _should_hold():
-                    flow.metadata["synkro_hold_cid"] = cid
+                    flow.response.stream = _make_hold_stream(cid)
                     return
-                # Streaming path (unchanged behaviour): tap chunk-by-chunk, extract
-                # governance metadata only, never buffer the body. Audit stays async.
+                # Otherwise just TAP for governance metadata (no hold; audit stays async).
                 st = _new_scan_state()
                 def _tap(data, _st=st, _cid=cid):
                     if data:
@@ -7845,36 +8426,6 @@ class SynkroTap:
     def response(self, flow):
         r = flow.request
         if "claude.ai" not in (r.pretty_host or ""): return
-        # \u2500\u2500 M3: a HELD completion (buffered for inline grading) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-        # We have the full SSE body now. Re-derive governance metadata (same as the
-        # streaming path), then \u2014 if the turn used a tool/connector \u2014 grade it
-        # SYNCHRONOUSLY and, on a block, NEUTRALIZE the response so the user never
-        # sees the restricted content. Verdict is cached for the tree GET to reuse.
-        hold_cid = (flow.metadata.get("synkro_hold_cid") if hasattr(flow, "metadata") else None)
-        if hold_cid is not None and "completion" in r.path and flow.response:
-            try:
-                body = flow.response.get_text() or ""
-            except Exception:
-                body = ""
-            st = _new_scan_state()
-            for ln in body.split("\\n"):
-                _scan_sse_line(ln, st)
-            if (st["usage"] or st["sources"] or st["citations"]) and hold_cid:
-                with _sse_lock:
-                    _sse_meta[hold_cid] = {"usage": st["usage"], "sources": st["sources"], "citations": st["citations"]}
-            text, has_tool = _extract_sse_text(body)
-            if has_tool:
-                # The turn used a connector \u2014 HOLD the live view: replace the streamed
-                # content with a "reviewing" placeholder so the user never sees the raw
-                # response. The tree GET is the SINGLE grader and renders the final
-                # state (real content if clean, block notice if restricted) \u2014 so there
-                # is exactly one full-document grade per turn (no double-grade race).
-                try:
-                    flow.response.text = _neutralize_sse(body, REVIEWING_NOTICE)
-                    print("[synkro] HELD completion -> reviewing placeholder")
-                except Exception as e:
-                    print("[synkro] hold placeholder failed (fail-open): " + str(e))
-            return
         # MCP server registry from the bootstrap SSE stream.
         if "mcp" in r.path and "bootstrap" in r.path and flow.response:
             try:
@@ -7897,6 +8448,12 @@ class SynkroTap:
                         _mcp_registry.clear()
                         _mcp_registry.update(servers)
                     print("[synkro] MCP servers: " + str(len(servers)))
+                    # Surface each connector on the MCP Servers page (connect/disconnect).
+                    for sid, s in servers.items():
+                        nm = s.get("name", "")
+                        if nm:
+                            ev = "connect" if s.get("connected") else "disconnect"
+                            _emit_mcp_event(nm, "", ev, "cdmcp_" + ev + "_" + str(sid))
             except Exception:
                 pass
             return
@@ -7906,6 +8463,12 @@ class SynkroTap:
         except: return
         m = re.search(r"chat_conversations/([0-9a-fA-F-]+)", r.path)
         convo_id = m.group(1) if m else ""
+        # One-time history backfill using THIS request's session auth (in-memory only).
+        try:
+            _om = re.search(r"/organizations/([0-9a-fA-F-]+)/", r.path)
+            _maybe_backfill(r.pretty_host, _om.group(1) if _om else "", r.headers.get("cookie", "") or r.headers.get("Cookie", ""))
+        except Exception:
+            pass
         model = convo.get("model", "unknown")
         settings = convo.get("settings") or {}
         emt = settings.get("enabled_mcp_tools")
@@ -7938,7 +8501,14 @@ class SynkroTap:
                     elif bt == "thinking":
                         thinking += b.get("thinking", "") or b.get("text", "")
                     elif bt == "tool_use" or bt == "server_tool_use":
-                        tool_calls.append({"name": _fmt_tool_name(b.get("name", "")), "id": b.get("id", ""), "arguments": json.dumps(b.get("input", {}))})
+                        _nm = _fmt_tool_name(b.get("name", ""))
+                        tool_calls.append({"name": _nm, "id": b.get("id", ""), "arguments": json.dumps(b.get("input", {}))})
+                        # A "Server:tool" name means a hosted MCP connector ran \u2192 log it
+                        # on the MCP Servers page (":" only present for registry matches,
+                        # so built-in tools like web_search are excluded).
+                        if ":" in _nm:
+                            _srv, _, _tl = _nm.partition(":")
+                            _emit_mcp_event(_srv, _tl, "tool_call", "cdmcp_tc_" + (b.get("id", "") or hashlib.sha256((convo_id + _nm).encode()).hexdigest()[:24]), convo_id)
                     elif bt.endswith("_tool_result") or bt == "tool_result":
                         rc = b.get("content", "")
                         if isinstance(rc, list):
@@ -7975,6 +8545,16 @@ class SynkroTap:
                 messages.append({"role": "user", "content": text})
         if not messages: return
         data = {"request": {"model": model, "messages": messages}, "conversation_id": convo_id}
+        # Full conversation for the session-log tables (Session Timeline card).
+        data["session_messages"] = _map_full_conversation(all_msgs)
+        # PER-TURN key: the current turn's assistant message id (same key used for
+        # dlp_turn_verdicts). Lets the server store each turn as its OWN event so a
+        # blocked turn isn't overwritten/deleted by a later passing turn.
+        turn_id = ""
+        for _m in reversed(chat):
+            if _m.get("sender") != "human":
+                turn_id = _msg_key(_m); break
+        if turn_id: data["turn_id"] = turn_id
         meta = {}
         if platform: meta["platform"] = platform
         if web_search_on: meta["web_search_enabled"] = True
@@ -7992,32 +8572,14 @@ class SynkroTap:
         nsrc = len((sm or {}).get("sources") or [])
         print("[synkro] captured chat (msgs=" + str(len(messages)) + " tools=" + str(ntools) + " sources=" + str(nsrc) + " model=" + model + ")")
 
-        # \u2500\u2500 Tier-2 connector DLP gate \u2500\u2500 If this turn pulled content via an MCP
-        # connector, scan it SYNCHRONOUSLY against blocking org rules. On a block
-        # verdict we HOLD this tree GET (the authoritative render) until the verdict
-        # and then SCRUB the turn from the tree the renderer sees \u2014 the employee
-        # never sees the restricted content. The REAL content is still captured
-        # below for audit (record-everything-even-when-blocked). Fail-OPEN.
-        blocked_reason = None
-        has_connector = any(m.get("role") == "tool" and m.get("content") for m in messages)
-        # SINGLE grader: the held completion only shows a "reviewing" placeholder, so
-        # the tree GET is the one and only place a turn is graded \u2014 exactly one
-        # full-document grade per turn (no double-grade). Gated on a BLOCK-mode rule
-        # existing; audit-only orgs (_should_hold False) skip this and stay async.
-        if _should_hold() and SCAN_TURN_URL and TOKEN and has_connector:
-            # CWE-20/CWE-400: bounded, shape-validated payload (<=200 msgs, <=2MB).
-            scan_msgs = []
-            budget = 2000000
-            for m in messages[:200]:
-                if budget <= 0: break
-                c = str(m.get("content", ""))[:min(500000, budget)]
-                budget -= len(c)
-                scan_msgs.append({"role": str(m.get("role", "user"))[:20], "content": c, "name": str(m.get("name", ""))[:200]})
-            connector = ""
-            for m in scan_msgs:
-                if m["role"] == "tool" and m["name"]:
-                    nm = m["name"]; connector = (nm.split(":")[0] if ":" in nm else nm); break
-            blocked_reason = _scan_turn_call(convo_id, scan_msgs, connector)
+        # \u2500\u2500 Tier-2 connector DLP gate (WHOLE-CONVERSATION, per-turn, PERSISTENT) \u2500\u2500
+        # Scrub every blocked assistant turn (durable PGLite verdicts; connector turns
+        # graded once on miss). See _apply_turn_verdicts. Fail-OPEN on any error.
+        try:
+            any_blocked = _apply_turn_verdicts(all_msgs, convo_id)
+        except Exception as e:
+            any_blocked = False
+            print("[synkro] turn-verdict scrub error (fail-open): " + str(e))
 
         # Capture the REAL content for audit regardless of the block decision.
         def send(_d=data):
@@ -8027,17 +8589,11 @@ class SynkroTap:
                 print("[synkro] capture error: " + str(e))
         threading.Thread(target=send, daemon=True).start()
 
-        # Block the rendered view: replace this turn's assistant message content in
-        # the tree (everything after the last human turn) with a Synkro notice, so
-        # the restricted content + any model output derived from it is never shown.
-        if blocked_reason is not None:
-            notice = "[Blocked by Synkro] " + blocked_reason
-            for i in range(last_human + 1, len(all_msgs)):
-                if all_msgs[i].get("sender") != "human":
-                    all_msgs[i]["content"] = [{"type": "text", "text": notice}]
+        # Re-serialize the tree so the renderer never sees any blocked turn's content.
+        if any_blocked:
             try:
                 flow.response.text = json.dumps(convo)
-                print("[synkro] BLOCKED turn view (reason=" + blocked_reason[:80] + ")")
+                print("[synkro] BLOCKED turn view (whole-convo per-turn, durable)")
             except Exception as e:
                 print("[synkro] block scrub failed (fail-open): " + str(e))
 
@@ -8221,16 +8777,16 @@ __export(macKeychain_exports, {
   writeCursorApiKey: () => writeCursorApiKey,
   writeRefreshAgent: () => writeRefreshAgent
 });
-import { existsSync as existsSync8, mkdirSync as mkdirSync7, writeFileSync as writeFileSync7, chmodSync, readFileSync as readFileSync6, statSync } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync7, writeFileSync as writeFileSync7, chmodSync, readFileSync as readFileSync6 } from "fs";
 import { homedir as homedir6, platform as platform2 } from "os";
 import { join as join6 } from "path";
-import { spawnSync } from "child_process";
+import { spawnSync as spawnSync2 } from "child_process";
 function needsKeychainBridge() {
   return platform2() === "darwin";
 }
 function readKeychainCreds() {
   if (platform2() !== "darwin") return null;
-  const r = spawnSync("security", ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-w"], {
+  const r = spawnSync2("security", ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-w"], {
     encoding: "utf-8",
     timeout: 5e3
   });
@@ -8243,7 +8799,14 @@ function exportKeychainCreds() {
   if (!blob) return null;
   mkdirSync7(CLAUDE_CREDS_DIR, { recursive: true });
   chmodSync(CLAUDE_CREDS_DIR, 448);
-  writeFileSync7(CLAUDE_CREDS_FILE, blob, "utf-8");
+  let changed = true;
+  try {
+    if (existsSync8(CLAUDE_CREDS_FILE)) {
+      changed = readFileSync6(CLAUDE_CREDS_FILE, "utf-8") !== blob;
+    }
+  } catch {
+  }
+  if (changed) writeFileSync7(CLAUDE_CREDS_FILE, blob, "utf-8");
   chmodSync(CLAUDE_CREDS_FILE, 384);
   return CLAUDE_CREDS_FILE;
 }
@@ -8286,18 +8849,49 @@ async function validateCursorApiKey() {
 function credsAreStale() {
   if (!existsSync8(CLAUDE_CREDS_FILE)) return true;
   try {
-    const ageMs = Date.now() - statSync(CLAUDE_CREDS_FILE).mtimeMs;
-    return ageMs > REFRESH_INTERVAL_SECONDS * 1e3;
+    const raw = readFileSync6(CLAUDE_CREDS_FILE, "utf-8");
+    const exp = JSON.parse(raw)?.claudeAiOauth?.expiresAt ?? 0;
+    if (!exp) return true;
+    return Date.now() >= exp - REFRESH_EXPIRY_BUFFER_SECONDS * 1e3;
   } catch {
     return true;
   }
 }
+function xmlEscape(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
 function writeRefreshAgent(synkroBinPath) {
   if (platform2() !== "darwin") {
     throw new KeychainExportError("writeRefreshAgent is darwin-only");
   }
   mkdirSync7(join6(homedir6(), "Library", "LaunchAgents"), { recursive: true });
-  const shellCmd = `export PATH="/opt/homebrew/bin:/usr/local/bin:$PATH" && { "${synkroBinPath}" local-cc refresh-creds || synkro local-cc refresh-creds; }`;
+  mkdirSync7(SYNKRO_DIR, { recursive: true });
+  const script = `#!/bin/bash
+# Generated by synkro (writeRefreshAgent). Expiry-aware Claude creds refresher.
+# SYNKRO_BIN / SYNKRO_CF are injected by launchd as environment data \u2014 never
+# interpolated into this script \u2014 so there is no shell-injection surface.
+export PATH="/opt/homebrew/bin:/usr/local/bin:$PATH"
+prev=""
+while true; do
+  { "$SYNKRO_BIN" local-cc refresh-creds || synkro local-cc refresh-creds; } >/dev/null 2>&1
+  exp=$(sed -n 's/.*"expiresAt"[: ]*\\([0-9]\\{10,\\}\\).*/\\1/p' "$SYNKRO_CF" 2>/dev/null | head -1)
+  now=$(date +%s)
+  if [ -n "$exp" ]; then
+    delay=$(( exp/1000 - now - ${REFRESH_EXPIRY_BUFFER_SECONDS} ))
+  else
+    delay=${MIN_REFRESH_INTERVAL_SECONDS}
+  fi
+  [ "$delay" -lt ${MIN_REFRESH_INTERVAL_SECONDS} ] && delay=${MIN_REFRESH_INTERVAL_SECONDS}
+  [ "$delay" -gt ${MAX_REFRESH_INTERVAL_SECONDS} ] && delay=${MAX_REFRESH_INTERVAL_SECONDS}
+  if [ "$exp" != "$prev" ]; then
+    echo "[$(date '+%Y-%m-%dT%H:%M:%S')] claude creds refreshed (expiresAt=\${exp:-none}); next check in \${delay}s"
+    prev="$exp"
+  fi
+  sleep "$delay"
+done
+`;
+  writeFileSync7(REFRESH_SCRIPT, script, "utf-8");
+  chmodSync(REFRESH_SCRIPT, 448);
   const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -8307,17 +8901,25 @@ function writeRefreshAgent(synkroBinPath) {
   <key>ProgramArguments</key>
   <array>
     <string>/bin/bash</string>
-    <string>-c</string>
-    <string>${shellCmd}</string>
+    <string>${xmlEscape(REFRESH_SCRIPT)}</string>
   </array>
-  <key>StartInterval</key>
-  <integer>${REFRESH_INTERVAL_SECONDS}</integer>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>SYNKRO_BIN</key>
+    <string>${xmlEscape(synkroBinPath)}</string>
+    <key>SYNKRO_CF</key>
+    <string>${xmlEscape(CLAUDE_CREDS_FILE)}</string>
+  </dict>
+  <key>KeepAlive</key>
+  <true/>
   <key>RunAtLoad</key>
   <true/>
+  <key>ThrottleInterval</key>
+  <integer>${MIN_REFRESH_INTERVAL_SECONDS}</integer>
   <key>StandardErrorPath</key>
-  <string>${join6(SYNKRO_DIR, "claude-creds-refresh.log")}</string>
+  <string>${xmlEscape(REFRESH_LOG)}</string>
   <key>StandardOutPath</key>
-  <string>${join6(SYNKRO_DIR, "claude-creds-refresh.log")}</string>
+  <string>${xmlEscape(REFRESH_LOG)}</string>
 </dict>
 </plist>
 `;
@@ -8326,11 +8928,11 @@ function writeRefreshAgent(synkroBinPath) {
 }
 function loadRefreshAgent() {
   if (platform2() !== "darwin") return;
-  spawnSync("launchctl", ["bootout", `gui/${process.getuid?.() ?? 501}`, LAUNCHD_PLIST], {
+  spawnSync2("launchctl", ["bootout", `gui/${process.getuid?.() ?? 501}`, LAUNCHD_PLIST], {
     encoding: "utf-8",
     timeout: 5e3
   });
-  const r = spawnSync("launchctl", ["bootstrap", `gui/${process.getuid?.() ?? 501}`, LAUNCHD_PLIST], {
+  const r = spawnSync2("launchctl", ["bootstrap", `gui/${process.getuid?.() ?? 501}`, LAUNCHD_PLIST], {
     encoding: "utf-8",
     timeout: 5e3
   });
@@ -8342,14 +8944,14 @@ function loadRefreshAgent() {
 }
 function uninstallRefreshAgent() {
   if (platform2() !== "darwin") return;
-  spawnSync("launchctl", ["bootout", `gui/${process.getuid?.() ?? 501}`, LAUNCHD_PLIST], {
+  spawnSync2("launchctl", ["bootout", `gui/${process.getuid?.() ?? 501}`, LAUNCHD_PLIST], {
     encoding: "utf-8",
     timeout: 5e3
   });
   try {
-    if (existsSync8(LAUNCHD_PLIST)) {
-      __require("fs").unlinkSync(LAUNCHD_PLIST);
-    }
+    const fs = __require("fs");
+    if (existsSync8(LAUNCHD_PLIST)) fs.unlinkSync(LAUNCHD_PLIST);
+    if (existsSync8(REFRESH_SCRIPT)) fs.unlinkSync(REFRESH_SCRIPT);
   } catch {
   }
 }
@@ -8364,7 +8966,7 @@ function readExportedCreds() {
     return null;
   }
 }
-var SYNKRO_DIR, CLAUDE_CREDS_DIR, CLAUDE_CREDS_FILE, CURSOR_CREDS_DIR, CURSOR_API_KEY_FILE, KEYCHAIN_SERVICE, LAUNCHD_LABEL, LAUNCHD_PLIST, REFRESH_INTERVAL_SECONDS, KeychainExportError;
+var SYNKRO_DIR, CLAUDE_CREDS_DIR, CLAUDE_CREDS_FILE, CURSOR_CREDS_DIR, CURSOR_API_KEY_FILE, KEYCHAIN_SERVICE, LAUNCHD_LABEL, LAUNCHD_PLIST, REFRESH_SCRIPT, REFRESH_LOG, REFRESH_EXPIRY_BUFFER_SECONDS, MIN_REFRESH_INTERVAL_SECONDS, MAX_REFRESH_INTERVAL_SECONDS, KeychainExportError;
 var init_macKeychain = __esm({
   "cli/local-cc/macKeychain.ts"() {
     "use strict";
@@ -8376,7 +8978,11 @@ var init_macKeychain = __esm({
     KEYCHAIN_SERVICE = "Claude Code-credentials";
     LAUNCHD_LABEL = "com.synkro.cli.claude-creds-refresh";
     LAUNCHD_PLIST = join6(homedir6(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
-    REFRESH_INTERVAL_SECONDS = 45 * 60;
+    REFRESH_SCRIPT = join6(SYNKRO_DIR, "claude-creds-refresh-loop.sh");
+    REFRESH_LOG = join6(SYNKRO_DIR, "claude-creds-refresh.log");
+    REFRESH_EXPIRY_BUFFER_SECONDS = 120;
+    MIN_REFRESH_INTERVAL_SECONDS = 30;
+    MAX_REFRESH_INTERVAL_SECONDS = 5 * 60;
     KeychainExportError = class extends Error {
       constructor(message, cause) {
         super(message);
@@ -8415,7 +9021,7 @@ __export(dockerInstall_exports, {
 import { copyFileSync, existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync7, readdirSync as readdirSync2 } from "fs";
 import { homedir as homedir7 } from "os";
 import { join as join7 } from "path";
-import { execSync as execSync4, spawnSync as spawnSync2 } from "child_process";
+import { execSync as execSync4, spawnSync as spawnSync3 } from "child_process";
 function splitWorkers(total, providers) {
   const t = Math.max(0, Math.floor(total));
   const hasClaude = providers.includes("claude_code");
@@ -8574,7 +9180,7 @@ function imageTag() {
   return registry ? `${registry.replace(/\/+$/, "")}/${tag.replace(/^.*\//, "")}` : tag;
 }
 function assertDockerAvailable() {
-  const v = spawnSync2("docker", ["version", "--format", "{{.Server.Version}}"], {
+  const v = spawnSync3("docker", ["version", "--format", "{{.Server.Version}}"], {
     encoding: "utf-8",
     timeout: 5e3
   });
@@ -8589,12 +9195,12 @@ function claudeCredsHostDir() {
   return join7(homedir7(), ".claude");
 }
 function resolveSynkroBin() {
-  const which2 = spawnSync2("which", ["synkro"], { encoding: "utf-8", timeout: 5e3 });
+  const which2 = spawnSync3("which", ["synkro"], { encoding: "utf-8", timeout: 5e3 });
   const resolved = (which2.stdout || "").split("\n")[0].trim();
   return resolved || "synkro";
 }
 function sweepHostPglite() {
-  const ps = spawnSync2("ps", ["-eo", "pid,command"], { encoding: "utf-8", timeout: 5e3 });
+  const ps = spawnSync3("ps", ["-eo", "pid,command"], { encoding: "utf-8", timeout: 5e3 });
   if (ps.status !== 0) return;
   const targets = [];
   for (const line of (ps.stdout || "").split("\n")) {
@@ -8624,7 +9230,7 @@ function sweepHostPglite() {
       }
     });
     if (alive.length === 0) return;
-    spawnSync2("sleep", ["0.2"], { timeout: 1e3 });
+    spawnSync3("sleep", ["0.2"], { timeout: 1e3 });
   }
   for (const pid of targets) {
     try {
@@ -8676,13 +9282,13 @@ async function dockerInstall(opts = {}) {
   } else {
     mkdirSync8(join7(homedir7(), ".claude"), { recursive: true });
   }
-  const imageExistsLocally = () => spawnSync2("docker", ["image", "inspect", image], { stdio: "ignore", timeout: 3e4 }).status === 0;
+  const imageExistsLocally = () => spawnSync3("docker", ["image", "inspect", image], { stdio: "ignore", timeout: 3e4 }).status === 0;
   const skipPull = process.env.SYNKRO_SKIP_PULL === "1" || process.env.SYNKRO_SKIP_PULL === "true";
   if (skipPull && imageExistsLocally()) {
     console.log(`  Using local image ${image} (SYNKRO_SKIP_PULL set \u2014 pull skipped).`);
   } else {
     console.log(`  Pulling ${image}...`);
-    const pull = spawnSync2("docker", ["pull", image], { encoding: "utf-8", stdio: "inherit", timeout: 6e5 });
+    const pull = spawnSync3("docker", ["pull", image], { encoding: "utf-8", stdio: "inherit", timeout: 6e5 });
     if (pull.status !== 0) {
       if (imageExistsLocally()) {
         console.warn(`  \u26A0 docker pull ${image} failed \u2014 falling back to the existing local image.`);
@@ -8696,7 +9302,7 @@ async function dockerInstall(opts = {}) {
     console.log("  Stopping existing container gracefully...");
     await dockerSafeStop();
   }
-  spawnSync2("docker", ["rm", CONTAINER_NAME], { encoding: "utf-8", timeout: 3e4 });
+  spawnSync3("docker", ["rm", CONTAINER_NAME], { encoding: "utf-8", timeout: 3e4 });
   sweepHostPglite();
   const credsDir = claudeCredsHostDir();
   const args2 = [
@@ -8754,7 +9360,7 @@ async function dockerInstall(opts = {}) {
     ...process.env.SYNKRO_EMAIL ? ["-e", `SYNKRO_EMAIL=${process.env.SYNKRO_EMAIL}`] : [],
     image
   ];
-  const run = spawnSync2("docker", args2, { encoding: "utf-8", stdio: "inherit", timeout: 6e4 });
+  const run = spawnSync3("docker", args2, { encoding: "utf-8", stdio: "inherit", timeout: 6e4 });
   if (run.status !== 0) {
     throw new DockerInstallError(`docker run failed (image ${image})`);
   }
@@ -8790,11 +9396,11 @@ async function waitForWorkersReady(timeoutMs = 6e4) {
   return false;
 }
 function dockerRemove() {
-  spawnSync2("docker", ["rm", CONTAINER_NAME], { encoding: "utf-8", timeout: 3e4 });
+  spawnSync3("docker", ["rm", CONTAINER_NAME], { encoding: "utf-8", timeout: 3e4 });
 }
 function dockerStop() {
-  spawnSync2("docker", ["stop", "--timeout=30", CONTAINER_NAME], { encoding: "utf-8", timeout: 45e3 });
-  spawnSync2("docker", ["rm", CONTAINER_NAME], { encoding: "utf-8", timeout: 3e4 });
+  spawnSync3("docker", ["stop", "--timeout=30", CONTAINER_NAME], { encoding: "utf-8", timeout: 45e3 });
+  spawnSync3("docker", ["rm", CONTAINER_NAME], { encoding: "utf-8", timeout: 3e4 });
 }
 async function dockerUpdate(opts = {}) {
   if (dockerStatus().running) {
@@ -8804,7 +9410,7 @@ async function dockerUpdate(opts = {}) {
   await dockerInstall(opts);
 }
 function dockerStatus() {
-  const r = spawnSync2("docker", ["inspect", "--format", "{{.State.Status}}", CONTAINER_NAME], {
+  const r = spawnSync3("docker", ["inspect", "--format", "{{.State.Status}}", CONTAINER_NAME], {
     encoding: "utf-8",
     timeout: 5e3
   });
@@ -8817,7 +9423,7 @@ function dockerStatus() {
   };
 }
 function readContainerConfig() {
-  const r = spawnSync2("docker", ["inspect", "--format", "{{json .Config.Env}}", CONTAINER_NAME], {
+  const r = spawnSync3("docker", ["inspect", "--format", "{{json .Config.Env}}", CONTAINER_NAME], {
     encoding: "utf-8",
     timeout: 5e3
   });
@@ -8871,11 +9477,11 @@ async function dockerSafeStop() {
     console.warn(`  \u26A0 Snapshot request failed: ${snapshot.error}. Proceeding with stop.`);
   }
   console.log("  Stopping container (30s grace for CHECKPOINT + WAL flush)...");
-  const stop = spawnSync2("docker", ["stop", "--timeout=30", CONTAINER_NAME], {
+  const stop = spawnSync3("docker", ["stop", "--timeout=30", CONTAINER_NAME], {
     encoding: "utf-8",
     timeout: 45e3
   });
-  const inspect = spawnSync2("docker", ["inspect", "--format", "{{.State.ExitCode}}", CONTAINER_NAME], {
+  const inspect = spawnSync3("docker", ["inspect", "--format", "{{.State.ExitCode}}", CONTAINER_NAME], {
     encoding: "utf-8",
     timeout: 5e3
   });
@@ -8899,7 +9505,7 @@ async function dockerSafeStart() {
     console.log("  Container is already running.");
     return { ok: true, pgdataState: "running" };
   }
-  const exists = spawnSync2("docker", ["inspect", "--format", "{{.State.Status}}", CONTAINER_NAME], {
+  const exists = spawnSync3("docker", ["inspect", "--format", "{{.State.Status}}", CONTAINER_NAME], {
     encoding: "utf-8",
     timeout: 5e3
   });
@@ -8919,7 +9525,7 @@ async function dockerSafeStart() {
     mkdirSync8(PGDATA_PATH, { recursive: true });
   }
   console.log("  Starting container...");
-  const start = spawnSync2("docker", ["start", CONTAINER_NAME], {
+  const start = spawnSync3("docker", ["start", CONTAINER_NAME], {
     encoding: "utf-8",
     timeout: 3e4
   });
@@ -8987,6 +9593,56 @@ var init_dockerInstall = __esm({
   }
 });
 
+// cli/local-cc/setupToken.ts
+import { spawn as nodeSpawn } from "child_process";
+import { readFileSync as readFileSync8, unlinkSync as unlinkSync3 } from "fs";
+import { homedir as homedir8, platform as platform3 } from "os";
+import { join as join8 } from "path";
+function captureClaudeSetupToken() {
+  const tmpFile = join8(SYNKRO_DIR3, `token-capture-${Date.now()}.raw`);
+  const isMac = platform3() === "darwin";
+  const bin = "script";
+  const args2 = isMac ? ["-q", tmpFile, "claude", "setup-token"] : ["-qec", "claude setup-token", tmpFile];
+  return new Promise((resolve4, reject) => {
+    const proc = nodeSpawn(bin, args2, { stdio: "inherit" });
+    proc.on("error", (err) => reject(new Error(`Failed to spawn claude setup-token: ${err.message}`)));
+    proc.on("close", (code) => {
+      let raw = "";
+      try {
+        raw = readFileSync8(tmpFile, "utf-8");
+      } catch (e) {
+        reject(new Error(`Could not read script output file: ${e.message}`));
+        return;
+      }
+      try {
+        unlinkSync3(tmpFile);
+      } catch {
+      }
+      if (code !== 0) {
+        reject(new Error(`claude setup-token exited with code ${code}`));
+        return;
+      }
+      const yellowRe = /\x1B\[38;2;255;193;7m([^\x1B]*)/g;
+      let yellow = "";
+      let m;
+      while ((m = yellowRe.exec(raw)) !== null) yellow += m[1];
+      const token = yellow.replace(/\s/g, "").match(/sk-ant-oat01-[A-Za-z0-9_-]+/);
+      if (!token) {
+        reject(new Error(`Could not find token in claude setup-token output (file=${raw.length}b, yellow=${yellow.length}b)`));
+        return;
+      }
+      resolve4(token[0]);
+    });
+  });
+}
+var SYNKRO_DIR3;
+var init_setupToken = __esm({
+  "cli/local-cc/setupToken.ts"() {
+    "use strict";
+    SYNKRO_DIR3 = join8(homedir8(), ".synkro");
+  }
+});
+
 // cli/commands/setupGithub.ts
 var setupGithub_exports = {};
 __export(setupGithub_exports, {
@@ -8995,15 +9651,15 @@ __export(setupGithub_exports, {
 });
 import { createInterface as createInterface2 } from "readline/promises";
 import { stdin as input, stdout as output } from "process";
-import { execSync as execSync5, spawn as nodeSpawn } from "child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync8, unlinkSync as unlinkSync3 } from "fs";
-import { homedir as homedir8, platform as platform3 } from "os";
-import { join as join8 } from "path";
+import { execSync as execSync5 } from "child_process";
+import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
+import { homedir as homedir9, platform as platform4 } from "os";
+import { join as join9 } from "path";
 import { execFile as execFile2 } from "child_process";
 function readConfig() {
   if (!existsSync10(CONFIG_PATH)) return {};
   const out = {};
-  for (const line of readFileSync8(CONFIG_PATH, "utf-8").split("\n")) {
+  for (const line of readFileSync9(CONFIG_PATH, "utf-8").split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#")) continue;
     const eq = t.indexOf("=");
@@ -9040,7 +9696,7 @@ async function prompt(rl, q, opts = {}) {
   return await rl.question(q);
 }
 function openBrowser3(url) {
-  const os = platform3();
+  const os = platform4();
   let bin;
   let args2;
   switch (os) {
@@ -9063,42 +9719,6 @@ function openBrowser3(url) {
 function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
-function captureClaudeSetupToken() {
-  const tmpFile = join8(SYNKRO_DIR3, `token-capture-${Date.now()}.raw`);
-  return new Promise((resolve4, reject) => {
-    const proc = nodeSpawn("script", ["-q", tmpFile, "claude", "setup-token"], {
-      stdio: "inherit"
-    });
-    proc.on("error", (err) => reject(new Error(`Failed to spawn claude setup-token: ${err.message}`)));
-    proc.on("close", (code) => {
-      let raw = "";
-      try {
-        raw = readFileSync8(tmpFile, "utf-8");
-      } catch (e) {
-        reject(new Error(`Could not read script output file: ${e.message}`));
-        return;
-      }
-      try {
-        unlinkSync3(tmpFile);
-      } catch {
-      }
-      if (code !== 0) {
-        reject(new Error(`claude setup-token exited with code ${code}`));
-        return;
-      }
-      const yellowRe = /\x1B\[38;2;255;193;7m([^\x1B]*)/g;
-      let yellow = "";
-      let m;
-      while ((m = yellowRe.exec(raw)) !== null) yellow += m[1];
-      const token = yellow.replace(/\s/g, "").match(/sk-ant-oat01-[A-Za-z0-9_-]+/);
-      if (!token) {
-        reject(new Error(`Could not find token in claude setup-token output (file=${raw.length}b, yellow=${yellow.length}b)`));
-        return;
-      }
-      resolve4(token[0]);
-    });
-  });
-}
 async function apiCall(gatewayUrl, jwt2, path, opts = {}) {
   const resp = await fetch(`${gatewayUrl}${path}`, {
     ...opts,
@@ -9339,14 +9959,15 @@ Will push secrets to ${selected.length} repo(s):`);
   console.log(`Secrets pushed: ${SECRET_NAMES.CLAUDE_OAUTH}, ${SECRET_NAMES.SYNKRO_API_KEY}`);
   console.log("Open a PR on any selected repo to trigger your first Synkro scan.");
 }
-var SYNKRO_DIR3, CONFIG_PATH;
+var SYNKRO_DIR4, CONFIG_PATH;
 var init_setupGithub = __esm({
   "cli/commands/setupGithub.ts"() {
     "use strict";
     init_githubSetup();
     init_stub();
-    SYNKRO_DIR3 = join8(homedir8(), ".synkro");
-    CONFIG_PATH = join8(SYNKRO_DIR3, "config.env");
+    init_setupToken();
+    SYNKRO_DIR4 = join9(homedir9(), ".synkro");
+    CONFIG_PATH = join9(SYNKRO_DIR4, "config.env");
   }
 });
 
@@ -9360,16 +9981,16 @@ __export(install_exports, {
   syncSkillFiles: () => syncSkillFiles,
   writeHookScripts: () => writeHookScripts
 });
-import { existsSync as existsSync11, mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, chmodSync as chmodSync2, readFileSync as readFileSync9, readdirSync as readdirSync3, unlinkSync as unlinkSync4, statSync as statSync2 } from "fs";
-import { homedir as homedir9 } from "os";
-import { join as join9 } from "path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, chmodSync as chmodSync2, readFileSync as readFileSync10, readdirSync as readdirSync3, unlinkSync as unlinkSync4, statSync } from "fs";
+import { homedir as homedir10 } from "os";
+import { join as join10 } from "path";
 import { execSync as execSync6 } from "child_process";
 import { createInterface as createInterface3 } from "readline";
 function resolvePersistedHookMode() {
   if (process.env.SYNKRO_HOOK_MODE === "full") return "full";
   if (process.env.SYNKRO_HOOK_MODE === "stub") return "stub";
   try {
-    const env = readFileSync9(CONFIG_PATH2, "utf-8");
+    const env = readFileSync10(CONFIG_PATH2, "utf-8");
     if (/^SYNKRO_HOOK_MODE=['"]?full['"]?\s*$/m.test(env)) return "full";
   } catch {
   }
@@ -9389,6 +10010,7 @@ function parseArgs(argv) {
     else if (a === "--no-mcp") opts.noMcp = true;
     else if (a === "--force" || a === "-f") opts.force = true;
     else if (a === "--link-repo") opts.linkRepo = true;
+    else if (a === "--byok-gateway") opts.byokGateway = true;
     else if (a === "--stub" || a === "--mode=stub") opts.hookMode = "stub";
     else if (a === "--legacy" || a === "--mode=full") opts.hookMode = "full";
   }
@@ -9461,25 +10083,12 @@ async function promptCursorApiKey(opts) {
     console.log("  \u26A0 Skipped \u2014 Cursor workers will be idle. Re-run install or pass --cursor-api-key=\u2026 later.");
   }
 }
-async function promptGradingMode() {
-  if (!process.stdin.isTTY) return "local";
-  const rl = createInterface3({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve4) => {
-    rl.question(
-      "Where should grading run?\n  local \u2014 on this machine, via the Synkro container (default)\n  byok  \u2014 via an LLM API using your own provider key\nChoose [local] / byok: ",
-      (answer) => {
-        rl.close();
-        resolve4(answer.trim().toLowerCase() === "byok" ? "byok" : "local");
-      }
-    );
-  });
-}
-async function promptStorageMode() {
+async function promptDeployLocation() {
   if (!process.stdin.isTTY) return "local";
   const rl = createInterface3({ input: process.stdin, output: process.stdout });
   return new Promise((resolve4) => {
     rl.question(
-      "Where should telemetry be stored?\n  local \u2014 on this machine only (default)\n  cloud \u2014 sent to Synkro cloud\nChoose [local] / cloud: ",
+      "Where should Synkro run?\n  local \u2014 a grading container on this machine (Docker) (default)\n  cloud \u2014 a private container hosted by Synkro (Cloudflare)\nBoth use your own Claude key. Choose [local] / cloud: ",
       (answer) => {
         rl.close();
         resolve4(answer.trim().toLowerCase() === "cloud" ? "cloud" : "local");
@@ -9518,36 +10127,36 @@ coding patterns and the dashboard shows full history. (Y/n) `
   }
 }
 function ensureSynkroDir() {
-  mkdirSync9(SYNKRO_DIR4, { recursive: true });
+  mkdirSync9(SYNKRO_DIR5, { recursive: true });
   mkdirSync9(HOOKS_DIR, { recursive: true });
   mkdirSync9(BIN_DIR, { recursive: true });
   mkdirSync9(OFFSETS_DIR, { recursive: true });
-  mkdirSync9(join9(SYNKRO_DIR4, "sessions"), { recursive: true });
+  mkdirSync9(join10(SYNKRO_DIR5, "sessions"), { recursive: true });
 }
 function writeHookScripts(mode = "stub") {
-  const installExtractCorePath = join9(HOOKS_DIR, "installExtractCore.ts");
-  const bashScriptPath = join9(HOOKS_DIR, "cc-bash-judge.ts");
-  const bashFollowupScriptPath = join9(HOOKS_DIR, "cc-bash-followup.ts");
-  const editPrecheckScriptPath = join9(HOOKS_DIR, "cc-edit-precheck.ts");
-  const cwePrecheckScriptPath = join9(HOOKS_DIR, "cc-cwe-precheck.ts");
-  const cvePrecheckScriptPath = join9(HOOKS_DIR, "cc-cve-precheck.ts");
-  const planJudgeScriptPath = join9(HOOKS_DIR, "cc-plan-judge.ts");
-  const agentJudgeScriptPath = join9(HOOKS_DIR, "cc-agent-judge.ts");
-  const stopSummaryScriptPath = join9(HOOKS_DIR, "cc-stop-summary.ts");
-  const sessionStartScriptPath = join9(HOOKS_DIR, "cc-session-start.ts");
-  const transcriptSyncScriptPath = join9(HOOKS_DIR, "cc-transcript-sync.ts");
-  const userPromptSubmitScriptPath = join9(HOOKS_DIR, "cc-user-prompt-submit.ts");
-  const commonScriptPath = join9(HOOKS_DIR, "_synkro-common.ts");
-  const commonBashScriptPath = join9(HOOKS_DIR, "_synkro-common.sh");
-  const installScanScriptPath = join9(HOOKS_DIR, "cc-install-scan.ts");
-  const cursorBashJudgePath = join9(HOOKS_DIR, "cursor-bash-judge.ts");
-  const cursorEditCapturePath = join9(HOOKS_DIR, "cursor-edit-capture.ts");
-  const cursorAgentCapturePath = join9(HOOKS_DIR, "cursor-agent-capture.ts");
-  const mcpStdioProxyPath = join9(HOOKS_DIR, "mcp-stdio-proxy.ts");
-  const taskActivateIntentScriptPath = join9(HOOKS_DIR, "cc-task-activate-intent.ts");
-  const mcpGateScriptPath = join9(HOOKS_DIR, "cc-mcp-gate.ts");
+  const installExtractCorePath = join10(HOOKS_DIR, "installExtractCore.ts");
+  const bashScriptPath = join10(HOOKS_DIR, "cc-bash-judge.ts");
+  const bashFollowupScriptPath = join10(HOOKS_DIR, "cc-bash-followup.ts");
+  const editPrecheckScriptPath = join10(HOOKS_DIR, "cc-edit-precheck.ts");
+  const cwePrecheckScriptPath = join10(HOOKS_DIR, "cc-cwe-precheck.ts");
+  const cvePrecheckScriptPath = join10(HOOKS_DIR, "cc-cve-precheck.ts");
+  const planJudgeScriptPath = join10(HOOKS_DIR, "cc-plan-judge.ts");
+  const agentJudgeScriptPath = join10(HOOKS_DIR, "cc-agent-judge.ts");
+  const stopSummaryScriptPath = join10(HOOKS_DIR, "cc-stop-summary.ts");
+  const sessionStartScriptPath = join10(HOOKS_DIR, "cc-session-start.ts");
+  const transcriptSyncScriptPath = join10(HOOKS_DIR, "cc-transcript-sync.ts");
+  const userPromptSubmitScriptPath = join10(HOOKS_DIR, "cc-user-prompt-submit.ts");
+  const commonScriptPath = join10(HOOKS_DIR, "_synkro-common.ts");
+  const commonBashScriptPath = join10(HOOKS_DIR, "_synkro-common.sh");
+  const installScanScriptPath = join10(HOOKS_DIR, "cc-install-scan.ts");
+  const cursorBashJudgePath = join10(HOOKS_DIR, "cursor-bash-judge.ts");
+  const cursorEditCapturePath = join10(HOOKS_DIR, "cursor-edit-capture.ts");
+  const cursorAgentCapturePath = join10(HOOKS_DIR, "cursor-agent-capture.ts");
+  const mcpStdioProxyPath = join10(HOOKS_DIR, "mcp-stdio-proxy.ts");
+  const taskActivateIntentScriptPath = join10(HOOKS_DIR, "cc-task-activate-intent.ts");
+  const mcpGateScriptPath = join10(HOOKS_DIR, "cc-mcp-gate.ts");
   if (mode === "stub") {
-    const stubCommonPath = join9(HOOKS_DIR, "_synkro-stub-common.ts");
+    const stubCommonPath = join10(HOOKS_DIR, "_synkro-stub-common.ts");
     const stubFiles = [
       [stubCommonPath, STUB_COMMON_TS],
       [bashScriptPath, STUB_BASH_JUDGE_TS],
@@ -9576,7 +10185,7 @@ function writeHookScripts(mode = "stub") {
     chmodSync2(mcpStdioProxyPath, 493);
     for (const stale of ["_synkro-common.ts", "_synkro-common.sh", "installExtractCore.ts"]) {
       try {
-        unlinkSync4(join9(HOOKS_DIR, stale));
+        unlinkSync4(join10(HOOKS_DIR, stale));
       } catch {
       }
     }
@@ -9643,7 +10252,7 @@ function writeHookScripts(mode = "stub") {
   chmodSync2(taskActivateIntentScriptPath, 493);
   chmodSync2(mcpGateScriptPath, 493);
   try {
-    unlinkSync4(join9(HOOKS_DIR, "_synkro-stub-common.ts"));
+    unlinkSync4(join10(HOOKS_DIR, "_synkro-stub-common.ts"));
   } catch {
   }
   return {
@@ -9679,7 +10288,7 @@ function resolveSynkroBundle() {
   return null;
 }
 function writeConfigEnv(opts) {
-  const credsPath = join9(SYNKRO_DIR4, "credentials.json");
+  const credsPath = join10(SYNKRO_DIR5, "credentials.json");
   const safeGateway = sanitizeConfigValue(opts.gatewayUrl);
   const safeUserId = sanitizeConfigValue(opts.userId);
   const safeOrgId = sanitizeConfigValue(opts.orgId);
@@ -9695,7 +10304,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.57")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.59")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -9709,17 +10318,66 @@ function writeConfigEnv(opts) {
   lines.push(`SYNKRO_DEPLOYMENT_MODE=${shellQuoteSingle(safeMode)}`);
   lines.push(`SYNKRO_GRADING_MODE=${shellQuoteSingle(sanitizeConfigValue(opts.gradingMode ?? "local", 16))}`);
   lines.push(`SYNKRO_STORAGE_MODE=${shellQuoteSingle(sanitizeConfigValue(opts.storageMode ?? "local", 16))}`);
+  lines.push(`SYNKRO_DEPLOY_LOCATION=${shellQuoteSingle(sanitizeConfigValue(opts.deployLocation ?? "local", 16))}`);
   lines.push(`SYNKRO_HOOK_MODE=${shellQuoteSingle(sanitizeConfigValue(opts.hookMode ?? "stub", 8))}`);
   lines.push("");
   writeFileSync8(CONFIG_PATH2, lines.join("\n"), "utf-8");
   chmodSync2(CONFIG_PATH2, 384);
 }
+async function provisionCloudContainer(opts) {
+  let setupToken;
+  try {
+    console.log("  Authorize your Claude key for the hosted Synkro worker \u2014");
+    console.log("  a browser window will open for approval...\n");
+    setupToken = await captureClaudeSetupToken();
+  } catch (err) {
+    console.error(`  \u2717 Could not capture Claude setup-token: ${err.message}`);
+    console.error("    Cloud needs a Claude setup-token. Run `claude setup-token` manually, then re-run install.");
+    process.exit(1);
+  }
+  const repo = detectGitRepo2() || void 0;
+  const harness = [];
+  if (opts.hasClaudeCode) harness.push("claude-code");
+  if (opts.hasCursor) harness.push("cursor");
+  const total = parseInt(process.env.SYNKRO_WORKERS_PER_POOL || "8", 10);
+  try {
+    const resp = await fetch(`${opts.gatewayUrl}/api/v1/cli/cloud-provision`, {
+      method: "POST",
+      headers: { "Authorization": `Bearer ${opts.jwt}`, "Content-Type": "application/json" },
+      body: JSON.stringify({
+        org_id: opts.orgId,
+        user_id: opts.userId,
+        email: opts.email,
+        harness,
+        claude_workers: total,
+        cursor_workers: 0,
+        connected_repo: repo,
+        ruleset: readFullSynkroFile()?.ruleset || "default",
+        setup_token: setupToken
+        // never logged; gateway stores it as the org secret
+      })
+    });
+    if (!resp.ok) {
+      const t = await resp.text().catch(() => "");
+      throw new Error(`cloud-provision failed (${resp.status}): ${t.slice(0, 200)}`);
+    }
+    const out = await resp.json().catch(() => ({}));
+    console.log(`  \u2713 cloud container provisioned${out.container_id ? ` (${out.container_id})` : ""}`);
+    console.log();
+  } catch (err) {
+    console.error(`  \u2717 Cloud provisioning failed: ${err.message}`);
+    console.error("    Hooks + MCP are installed; re-run `synkro install` \u2192 cloud to retry.");
+    console.log();
+  } finally {
+    setupToken = "";
+  }
+}
 function resolveDeploymentMode() {
   const envOverride = process.env.SYNKRO_DEPLOYMENT_MODE?.toLowerCase();
   if (envOverride === "bare-host" || envOverride === "docker") return envOverride;
   try {
     if (existsSync11(CONFIG_PATH2)) {
-      const m = readFileSync9(CONFIG_PATH2, "utf-8").match(/^SYNKRO_DEPLOYMENT_MODE='([^']*)'/m);
+      const m = readFileSync10(CONFIG_PATH2, "utf-8").match(/^SYNKRO_DEPLOYMENT_MODE='([^']*)'/m);
       const val = m?.[1]?.toLowerCase();
       if (val === "bare-host" || val === "docker") return val;
     }
@@ -9746,16 +10404,16 @@ function collectLocalMetadata(includeClaudeCode = true) {
     meta.cc_version = execSync6("claude --version", { encoding: "utf-8", timeout: 5e3 }).trim().split("\n")[0];
   } catch {
   }
-  const claudeDir = join9(homedir9(), ".claude");
+  const claudeDir = join10(homedir10(), ".claude");
   try {
-    const settings = JSON.parse(readFileSync9(join9(claudeDir, "settings.json"), "utf-8"));
+    const settings = JSON.parse(readFileSync10(join10(claudeDir, "settings.json"), "utf-8"));
     const plugins = Object.keys(settings.enabledPlugins ?? {}).filter((k) => settings.enabledPlugins[k]);
     if (plugins.length) meta.enabled_plugins = plugins;
     if (settings.permissions?.defaultMode) meta.permissions_mode = settings.permissions.defaultMode;
   } catch {
   }
   try {
-    const mcpCache = JSON.parse(readFileSync9(join9(claudeDir, "mcp-needs-auth-cache.json"), "utf-8"));
+    const mcpCache = JSON.parse(readFileSync10(join10(claudeDir, "mcp-needs-auth-cache.json"), "utf-8"));
     const mcpNames = Object.keys(mcpCache);
     if (mcpNames.length) meta.mcp_servers = mcpNames;
   } catch {
@@ -9767,10 +10425,10 @@ function collectLocalMetadata(includeClaudeCode = true) {
   } catch {
   }
   try {
-    const sessionsDir = join9(claudeDir, "sessions");
+    const sessionsDir = join10(claudeDir, "sessions");
     const files = readdirSync3(sessionsDir).filter((f) => f.endsWith(".json")).slice(-5);
     for (const f of files) {
-      const s = JSON.parse(readFileSync9(join9(sessionsDir, f), "utf-8"));
+      const s = JSON.parse(readFileSync10(join10(sessionsDir, f), "utf-8"));
       if (s.version) {
         meta.cc_version = meta.cc_version || s.version;
         break;
@@ -9878,6 +10536,7 @@ async function installCommand(opts = {}) {
   let agents;
   let gradingMode;
   let storageMode;
+  let deployLocation = "local";
   let transcriptCC = false;
   let transcriptCursor = false;
   if (existingSynkro) {
@@ -9887,8 +10546,9 @@ async function installCommand(opts = {}) {
       (a) => a.kind === "claude_code" && wantCC || a.kind === "cursor" && wantCursor
     );
     if (agents.length === 0 && detected.length > 0) agents = detected;
+    deployLocation = existingSynkro.grader.location === "cloud" ? "cloud" : "local";
     gradingMode = existingSynkro.grader.mode === "byok" ? "byok" : "local";
-    storageMode = "local";
+    storageMode = deployLocation === "cloud" ? "cloud" : "local";
     console.log(`Using .synkro config:`);
     for (const w of existingSynkro.warnings) console.warn(`  \u26A0 ${w}`);
     console.log(`  harness: ${existingSynkro.harness.join(", ")}`);
@@ -9912,15 +10572,20 @@ async function installCommand(opts = {}) {
       console.log(`Installing hooks for: ${agents.map((a) => a.name).join(", ")}
 `);
     }
-    gradingMode = await promptGradingMode();
-    storageMode = await promptStorageMode();
-    console.log(`  grading: ${gradingMode}    storage: ${storageMode}
+    if (opts.byokGateway) {
+      gradingMode = "byok";
+      storageMode = "cloud";
+      deployLocation = "local";
+      console.log("  deploy: legacy BYOK-gateway grading (no container)\n");
+    } else {
+      deployLocation = await promptDeployLocation();
+      gradingMode = "local";
+      storageMode = deployLocation === "cloud" ? "cloud" : "local";
+      console.log(`  deploy: ${deployLocation}
 `);
-    if (gradingMode === "byok") {
-      console.log("  BYOK grading uses your own provider key \u2014 register one in the");
-      console.log("  dashboard under Settings \u2192 Provider Keys if you have not already.\n");
     }
   }
+  const target = deployLocation === "cloud" ? "cloud-container" : opts.byokGateway || gradingMode === "byok" ? "gateway-byok" : "local-docker";
   {
     const wantCC = agents.some((a) => a.kind === "claude_code");
     const wantCursor = agents.some((a) => a.kind === "cursor");
@@ -9945,9 +10610,9 @@ async function installCommand(opts = {}) {
   const scripts = writeHookScripts(hookMode);
   console.log("Wrote hook scripts to ~/.synkro/hooks/\n");
   for (const mode of ["edit", "bash"]) {
-    const pidFile = join9(SYNKRO_DIR4, "daemon", mode, "daemon.pid");
+    const pidFile = join10(SYNKRO_DIR5, "daemon", mode, "daemon.pid");
     try {
-      const pid = parseInt(readFileSync9(pidFile, "utf-8").trim(), 10);
+      const pid = parseInt(readFileSync10(pidFile, "utf-8").trim(), 10);
       if (pid > 0) {
         process.kill(pid, "SIGTERM");
         console.log(`Stopped stale ${mode} grader daemon (pid ${pid})`);
@@ -10012,10 +10677,11 @@ async function installCommand(opts = {}) {
   } catch {
   }
   const profile = await fetchUserProfile(gatewayUrl, token, hasClaudeCode);
-  const cloudOnly = gradingMode === "byok" && storageMode === "cloud";
-  const useLocalMcp = !cloudOnly;
-  if (cloudOnly) {
-    console.log("Cloud-only setup (BYOK grading + cloud storage) \u2014 skipping the local container.\n");
+  const useLocalMcp = target === "local-docker";
+  if (target === "cloud-container") {
+    console.log("Cloud setup \u2014 Synkro will provision a private hosted container for your org.\n");
+  } else if (target === "gateway-byok") {
+    console.log("Cloud-only setup (BYOK grading via gateway) \u2014 skipping the local container.\n");
   }
   if (hasClaudeCode && !opts.noMcp) {
     if (useLocalMcp) {
@@ -10029,7 +10695,7 @@ async function installCommand(opts = {}) {
         if (mintResp.ok) {
           const minted = await mintResp.json();
           mcpJwt = minted.token;
-          writeFileSync8(join9(SYNKRO_DIR4, ".mcp-jwt"), mcpJwt + "\n", { mode: 384 });
+          writeFileSync8(join10(SYNKRO_DIR5, ".mcp-jwt"), mcpJwt + "\n", { mode: 384 });
         } else {
           console.warn("  \u26A0 Could not mint MCP token \u2014 local server will reject requests until re-installed.");
         }
@@ -10057,7 +10723,7 @@ async function installCommand(opts = {}) {
           throw new Error(`mcp-token mint failed (${mintResp.status}): ${errText.slice(0, 200)}`);
         }
         const minted = await mintResp.json();
-        writeFileSync8(join9(SYNKRO_DIR4, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
+        writeFileSync8(join10(SYNKRO_DIR5, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
         const mcp = installMcpConfig({ gatewayUrl, bearerToken: minted.token });
         console.log(`Registered Synkro guardrails MCP server in ${mcp.path}`);
         console.log(`  url:        ${mcp.url}`);
@@ -10074,7 +10740,7 @@ async function installCommand(opts = {}) {
   if (hasCursor && !opts.noMcp) {
     try {
       if (useLocalMcp) {
-        const jwtPath = join9(SYNKRO_DIR4, ".mcp-jwt");
+        const jwtPath = join10(SYNKRO_DIR5, ".mcp-jwt");
         if (!existsSync11(jwtPath)) {
           const mintResp = await fetch(`${gatewayUrl}/api/v1/cli/mcp-token`, {
             method: "POST",
@@ -10103,7 +10769,7 @@ async function installCommand(opts = {}) {
           throw new Error(`mcp-token mint failed (${mintResp.status}): ${errText.slice(0, 200)}`);
         }
         const minted = await mintResp.json();
-        writeFileSync8(join9(SYNKRO_DIR4, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
+        writeFileSync8(join10(SYNKRO_DIR5, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
         const mcp = installCursorMcpConfig({ gatewayUrl, bearerToken: minted.token });
         console.log(`Registered Synkro guardrails MCP server in ${mcp.path}`);
         console.log(`  url:        ${mcp.url}`);
@@ -10116,7 +10782,7 @@ async function installCommand(opts = {}) {
   }
   const synkroBundle = resolveSynkroBundle();
   const persistedMode = resolveDeploymentMode();
-  writeConfigEnv({ gatewayUrl, userId, orgId, email, tier: profile.tier, inference: profile.inference, synkroBin: synkroBundle, transcriptConsent, localInference: profile.localInference, deploymentMode: persistedMode, gradingMode, storageMode, hookMode });
+  writeConfigEnv({ gatewayUrl, userId, orgId, email, tier: profile.tier, inference: profile.inference, synkroBin: synkroBundle, transcriptConsent, localInference: profile.localInference, deploymentMode: persistedMode, gradingMode, storageMode, deployLocation, hookMode });
   console.log(`Wrote config to ${CONFIG_PATH2}`);
   console.log(`  inference: ${profile.inference} (server-side grading)`);
   if (profile.localInference) console.log(`  local inference: enabled (gradingProvider=claude-code)`);
@@ -10128,7 +10794,7 @@ async function installCommand(opts = {}) {
   } catch (err) {
     console.warn(`  \u26A0 Could not cache judge prompts: ${err.message}`);
   }
-  writeSynkroFileIfMissing({ hasClaudeCode, hasCursor, gradingMode });
+  writeSynkroFileIfMissing({ hasClaudeCode, hasCursor, gradingMode, deployLocation });
   console.log();
   if (useLocalMcp) {
     const { assertDockerAvailable: assertDockerAvailable2 } = await Promise.resolve().then(() => (init_dockerInstall(), dockerInstall_exports));
@@ -10179,7 +10845,7 @@ async function installCommand(opts = {}) {
     const ready = await waitForContainerReady(6e4);
     if (ready) {
       console.log("  \u2713 container ready");
-      const mcpJwt = readFileSync9(join9(SYNKRO_DIR4, ".mcp-jwt"), "utf-8").trim();
+      const mcpJwt = readFileSync10(join10(SYNKRO_DIR5, ".mcp-jwt"), "utf-8").trim();
       try {
         const ingestResp = await fetch(`http://127.0.0.1:${hostMcpPort}/api/ingest`, {
           method: "POST",
@@ -10209,6 +10875,8 @@ async function installCommand(opts = {}) {
       process.exit(1);
     }
     console.log();
+  } else if (target === "cloud-container") {
+    await provisionCloudContainer({ gatewayUrl, jwt: token, orgId, userId, email, hasClaudeCode, hasCursor });
   }
   if (transcriptConsent) {
     const repo = detectGitRepo2();
@@ -10217,7 +10885,7 @@ async function installCommand(opts = {}) {
         try {
           let mcpToken = "";
           try {
-            mcpToken = readFileSync9(join9(SYNKRO_DIR4, ".mcp-jwt"), "utf-8").trim();
+            mcpToken = readFileSync10(join10(SYNKRO_DIR5, ".mcp-jwt"), "utf-8").trim();
           } catch {
           }
           if (mcpToken) {
@@ -10345,11 +11013,11 @@ function writeSynkroFileIfMissing(opts) {
   try {
     const root = execSync6("git rev-parse --show-toplevel", { encoding: "utf-8", timeout: 3e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
     if (!root) return;
-    if (root === homedir9()) return;
-    const fp = join9(root, "synkro.toml");
+    if (root === homedir10()) return;
+    const fp = join10(root, "synkro.toml");
     let hasFile = false;
     try {
-      hasFile = statSync2(fp).isFile();
+      hasFile = statSync(fp).isFile();
     } catch {
     }
     if (hasFile) {
@@ -10377,6 +11045,7 @@ function writeSynkroFileIfMissing(opts) {
       "skills = []",
       "",
       "[grader]",
+      `location = "${opts.deployLocation || "local"}"`,
       `pool = "${pool}"`,
       `mode = "${mode}"`,
       "",
@@ -10394,9 +11063,9 @@ function readFullSynkroFile() {
   try {
     const root = execSync6("git rev-parse --show-toplevel", { encoding: "utf-8", timeout: 3e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
     if (!root) return null;
-    const fp = join9(root, "synkro.toml");
+    const fp = join10(root, "synkro.toml");
     if (!existsSync11(fp)) return null;
-    const parsed = parseSynkroToml2(readFileSync9(fp, "utf-8"));
+    const parsed = parseSynkroToml2(readFileSync10(fp, "utf-8"));
     const valid = ["claude-code", "cursor"];
     const harness = Array.isArray(parsed.harness) ? parsed.harness.filter((h) => valid.includes(h)) : ["claude-code", "cursor"];
     const resolved = resolveGraderPool(parsed);
@@ -10404,7 +11073,8 @@ function readFullSynkroFile() {
       harness: harness.length > 0 ? harness : ["claude-code", "cursor"],
       grader: {
         pool: resolved.pool,
-        mode: ["local", "byok"].includes(parsed.grader?.mode) ? parsed.grader.mode : "local"
+        mode: ["local", "byok"].includes(parsed.grader?.mode) ? parsed.grader.mode : "local",
+        location: parsed.grader?.location === "cloud" ? "cloud" : "local"
       },
       workers: {
         ...resolved.claudeWorkers != null ? { claude: resolved.claudeWorkers } : {},
@@ -10432,7 +11102,7 @@ function reconcileHarness() {
   console.log(`synkro.toml: harness=[${sf.harness.join(", ")}] pool=${poolLabel(sf.grader.pool)} mode=${sf.grader.mode}`);
   const scripts = writeHookScripts(resolvePersistedHookMode());
   console.log("Wrote hook scripts to ~/.synkro/hooks/");
-  const ccSettings = join9(homedir9(), ".claude", "settings.json");
+  const ccSettings = join10(homedir10(), ".claude", "settings.json");
   if (wantCC) {
     installCCHooks(ccSettings, {
       bashJudgeScriptPath: scripts.bashScript,
@@ -10452,7 +11122,7 @@ function reconcileHarness() {
     });
     console.log("  \u2713 Claude Code hooks registered");
     try {
-      const mcpJwt = readFileSync9(join9(SYNKRO_DIR4, ".mcp-jwt"), "utf-8").trim();
+      const mcpJwt = readFileSync10(join10(SYNKRO_DIR5, ".mcp-jwt"), "utf-8").trim();
       if (mcpJwt) {
         installMcpConfig({ gatewayUrl: "", bearerToken: mcpJwt, local: true });
         console.log("  \u2713 Claude Code MCP registered");
@@ -10462,8 +11132,9 @@ function reconcileHarness() {
   } else {
     if (uninstallCCHooks(ccSettings)) console.log("  \u2717 Claude Code hooks removed");
     if (uninstallMcpConfig()) console.log("  \u2717 Claude Code MCP removed");
+    if (uninstallClaudeDesktopMcpConfig()) console.log("  \u2717 Claude Desktop MCP removed");
   }
-  const cursorHooks = join9(homedir9(), ".cursor", "hooks.json");
+  const cursorHooks = join10(homedir10(), ".cursor", "hooks.json");
   if (wantCursor) {
     installCursorHooks(cursorHooks, {
       bashJudgeScriptPath: scripts.cursorBashJudgeScript,
@@ -10517,7 +11188,7 @@ async function syncSkillFiles() {
   if (resolved.length === 0) return;
   const mcpPort = process.env.SYNKRO_MCP_PORT || "18931";
   const tasks = resolved.map((fp) => {
-    const content = readFileSync9(fp, "utf-8");
+    const content = readFileSync10(fp, "utf-8");
     const source = `skill:${fp.split("/").pop()}`;
     if (!content.trim()) {
       console.log(`  \u2298 skill ${source}: empty file, skipped`);
@@ -10563,7 +11234,7 @@ function detectGitRepo2() {
 function getClaudeProjectsFolder() {
   const cwd = process.cwd();
   const sanitized = "-" + cwd.replace(/\//g, "-");
-  const projectsDir = join9(homedir9(), ".claude", "projects", sanitized);
+  const projectsDir = join10(homedir10(), ".claude", "projects", sanitized);
   return existsSync11(projectsDir) ? projectsDir : null;
 }
 function extractSessionInsights(projectsDir) {
@@ -10571,9 +11242,9 @@ function extractSessionInsights(projectsDir) {
   const files = readdirSync3(projectsDir).filter((f) => f.endsWith(".jsonl"));
   for (const file of files) {
     const sessionId = file.replace(".jsonl", "");
-    const filePath = join9(projectsDir, file);
+    const filePath = join10(projectsDir, file);
     try {
-      const content = readFileSync9(filePath, "utf-8");
+      const content = readFileSync10(filePath, "utf-8");
       const lines = content.split("\n").filter(Boolean);
       for (let i = 0; i < lines.length; i++) {
         try {
@@ -10652,14 +11323,14 @@ function cursorProjectSlug(workspaceRoot) {
   return workspaceRoot.replace(/^[/]+/, "").replace(/[^a-zA-Z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function getCursorTranscriptsDir() {
-  const dir = join9(homedir9(), ".cursor", "projects", cursorProjectSlug(process.cwd()), "agent-transcripts");
+  const dir = join10(homedir10(), ".cursor", "projects", cursorProjectSlug(process.cwd()), "agent-transcripts");
   return existsSync11(dir) ? dir : null;
 }
 function isSafeConvId(id) {
   return /^[A-Za-z0-9_-]+$/.test(id);
 }
 function parseCursorTranscriptFile(filePath) {
-  const content = readFileSync9(filePath, "utf-8");
+  const content = readFileSync10(filePath, "utf-8");
   const lines = content.split("\n").filter(Boolean);
   const messages = [];
   for (let i = 0; i < lines.length; i++) {
@@ -10691,7 +11362,7 @@ async function syncCursorTranscriptsLocal(mcpPort, mcpToken, repo) {
   for (let i = 0; i < convDirs.length; i++) {
     const convId = convDirs[i];
     if (!isSafeConvId(convId)) continue;
-    const filePath = join9(dir, convId, `${convId}.jsonl`);
+    const filePath = join10(dir, convId, `${convId}.jsonl`);
     if (!existsSync11(filePath)) continue;
     try {
       const all = parseCursorTranscriptFile(filePath);
@@ -10714,8 +11385,8 @@ async function syncCursorTranscriptsLocal(mcpPort, mcpToken, repo) {
       process.stdout.write(`\r  Progress: ${i + 1}/${convDirs.length} sessions (${totalMessages} messages embedded)   `);
     }
     try {
-      const lc = readFileSync9(filePath, "utf-8").split("\n").filter(Boolean).length;
-      writeFileSync8(join9(OFFSETS_DIR, convId), String(lc), "utf-8");
+      const lc = readFileSync10(filePath, "utf-8").split("\n").filter(Boolean).length;
+      writeFileSync8(join10(OFFSETS_DIR, convId), String(lc), "utf-8");
     } catch {
     }
   }
@@ -10723,7 +11394,7 @@ async function syncCursorTranscriptsLocal(mcpPort, mcpToken, repo) {
   return { sessions: totalSessions, messages: totalMessages };
 }
 function parseTranscriptFile(filePath) {
-  const content = readFileSync9(filePath, "utf-8");
+  const content = readFileSync10(filePath, "utf-8");
   const lines = content.split("\n").filter(Boolean);
   const messages = [];
   for (let i = 0; i < lines.length; i++) {
@@ -10771,7 +11442,7 @@ async function syncTranscriptsLocal(mcpPort, mcpToken, repo) {
   for (let i = 0; i < files.length; i++) {
     const file = files[i];
     const sessionId = file.replace(".jsonl", "");
-    const filePath = join9(projectsDir, file);
+    const filePath = join10(projectsDir, file);
     try {
       const allMessages = parseTranscriptFile(filePath);
       const messages = allMessages.length > 500 ? allMessages.slice(-500) : allMessages;
@@ -10793,9 +11464,9 @@ async function syncTranscriptsLocal(mcpPort, mcpToken, repo) {
       process.stdout.write(`\r  Progress: ${i + 1}/${files.length} sessions (${totalMessages} messages embedded)   `);
     }
     try {
-      const content = readFileSync9(join9(projectsDir, file), "utf-8");
+      const content = readFileSync10(join10(projectsDir, file), "utf-8");
       const lineCount = content.split("\n").filter(Boolean).length;
-      writeFileSync8(join9(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
+      writeFileSync8(join10(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
     } catch {
     }
   }
@@ -10816,7 +11487,7 @@ async function syncTranscriptsBulk(gatewayUrl, token, repo) {
     const sessions = [];
     for (const file of batch) {
       const sessionId = file.replace(".jsonl", "");
-      const filePath = join9(projectsDir, file);
+      const filePath = join10(projectsDir, file);
       try {
         const allMessages = parseTranscriptFile(filePath);
         const messages = allMessages.length > maxMessagesPerSession ? allMessages.slice(-maxMessagesPerSession) : allMessages;
@@ -10845,18 +11516,18 @@ async function syncTranscriptsBulk(gatewayUrl, token, repo) {
     }
     for (const file of batch) {
       const sessionId = file.replace(".jsonl", "");
-      const filePath = join9(projectsDir, file);
+      const filePath = join10(projectsDir, file);
       try {
-        const content = readFileSync9(filePath, "utf-8");
+        const content = readFileSync10(filePath, "utf-8");
         const lineCount = content.split("\n").filter(Boolean).length;
-        writeFileSync8(join9(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
+        writeFileSync8(join10(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
       } catch {
       }
     }
   }
   return { sessions: totalSessions, messages: totalMessages };
 }
-var SYNKRO_DIR4, HOOKS_DIR, BIN_DIR, CONFIG_PATH2, MCP_STDIO_PROXY_SRC, OFFSETS_DIR;
+var SYNKRO_DIR5, HOOKS_DIR, BIN_DIR, CONFIG_PATH2, MCP_STDIO_PROXY_SRC, OFFSETS_DIR;
 var init_install = __esm({
   "cli/commands/install.ts"() {
     "use strict";
@@ -10874,10 +11545,11 @@ var init_install = __esm({
     init_promptFetcher();
     init_claudeDesktopTap();
     init_dockerInstall();
-    SYNKRO_DIR4 = join9(homedir9(), ".synkro");
-    HOOKS_DIR = join9(SYNKRO_DIR4, "hooks");
-    BIN_DIR = join9(SYNKRO_DIR4, "bin");
-    CONFIG_PATH2 = join9(SYNKRO_DIR4, "config.env");
+    init_setupToken();
+    SYNKRO_DIR5 = join10(homedir10(), ".synkro");
+    HOOKS_DIR = join10(SYNKRO_DIR5, "hooks");
+    BIN_DIR = join10(SYNKRO_DIR5, "bin");
+    CONFIG_PATH2 = join10(SYNKRO_DIR5, "config.env");
     MCP_STDIO_PROXY_SRC = `#!/usr/bin/env bun
 import { readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
@@ -10988,15 +11660,15 @@ rl.on('line', async (line) => {
   }
 });
 `;
-    OFFSETS_DIR = join9(SYNKRO_DIR4, ".transcript-offsets");
+    OFFSETS_DIR = join10(SYNKRO_DIR5, ".transcript-offsets");
   }
 });
 
 // cli/local-cc/install.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync10, writeFileSync as writeFileSync9, readFileSync as readFileSync10, chmodSync as chmodSync3, copyFileSync as copyFileSync2, renameSync as renameSync4, unlinkSync as unlinkSync5, openSync, fsyncSync, closeSync } from "fs";
-import { join as join10 } from "path";
-import { homedir as homedir10 } from "os";
-import { spawnSync as spawnSync4 } from "child_process";
+import { existsSync as existsSync12, mkdirSync as mkdirSync10, writeFileSync as writeFileSync9, readFileSync as readFileSync11, chmodSync as chmodSync3, copyFileSync as copyFileSync2, renameSync as renameSync4, unlinkSync as unlinkSync5, openSync, fsyncSync, closeSync } from "fs";
+import { join as join11 } from "path";
+import { homedir as homedir11 } from "os";
+import { spawnSync as spawnSync5 } from "child_process";
 function writePluginFiles() {
   for (const c of CHANNELS) {
     mkdirSync10(c.sessionDir, { recursive: true });
@@ -11016,7 +11688,7 @@ function writePluginFiles() {
 }
 function runBunInstall() {
   for (const c of CHANNELS) {
-    const r = spawnSync4("bun", ["install", "--silent"], {
+    const r = spawnSync5("bun", ["install", "--silent"], {
       cwd: c.sessionDir,
       encoding: "utf-8",
       timeout: 12e4
@@ -11032,7 +11704,7 @@ function safelyMutateClaudeJson(mutator) {
   if (!existsSync12(CLAUDE_JSON_PATH)) {
     return;
   }
-  const originalText = readFileSync10(CLAUDE_JSON_PATH, "utf-8");
+  const originalText = readFileSync11(CLAUDE_JSON_PATH, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(originalText);
@@ -11132,15 +11804,15 @@ function patchClaudeJson() {
   });
 }
 function installLocalCC() {
-  let bunCheck = spawnSync4("bun", ["--version"], { encoding: "utf-8" });
+  let bunCheck = spawnSync5("bun", ["--version"], { encoding: "utf-8" });
   if (bunCheck.status !== 0) {
     if (process.platform === "darwin") {
       console.log("  Installing bun via brew...");
-      const brewR = spawnSync4("brew", ["install", "oven-sh/bun/bun"], { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
+      const brewR = spawnSync5("brew", ["install", "oven-sh/bun/bun"], { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
       if (brewR.status !== 0) {
         throw new LocalCCInstallError("bun auto-install failed. Install manually: curl -fsSL https://bun.sh/install | bash");
       }
-      bunCheck = spawnSync4("bun", ["--version"], { encoding: "utf-8" });
+      bunCheck = spawnSync5("bun", ["--version"], { encoding: "utf-8" });
       if (bunCheck.status !== 0) {
         throw new LocalCCInstallError("bun installed but not found on PATH. Restart your terminal and re-run install.");
       }
@@ -11174,42 +11846,42 @@ var CLAUDE_JSON_BACKUP_PATH, SESSION_DIR, PLUGIN_PATH, PLUGIN_PKG_PATH, PLUGIN_S
 var init_install2 = __esm({
   "cli/local-cc/install.ts"() {
     "use strict";
-    CLAUDE_JSON_BACKUP_PATH = join10(homedir10(), ".claude.json.synkro-bak");
-    SESSION_DIR = join10(homedir10(), ".synkro", "cc_sessions");
-    PLUGIN_PATH = join10(SESSION_DIR, "synkro-channel.ts");
-    PLUGIN_PKG_PATH = join10(SESSION_DIR, "package.json");
-    PLUGIN_SETTINGS_DIR = join10(SESSION_DIR, ".claude");
-    PLUGIN_SETTINGS_PATH = join10(PLUGIN_SETTINGS_DIR, "settings.json");
-    PROJECT_MCP_PATH = join10(SESSION_DIR, ".mcp.json");
-    CLAUDE_JSON_PATH = join10(homedir10(), ".claude.json");
-    RUN_SCRIPT_PATH = join10(SESSION_DIR, "run-claude.sh");
+    CLAUDE_JSON_BACKUP_PATH = join11(homedir11(), ".claude.json.synkro-bak");
+    SESSION_DIR = join11(homedir11(), ".synkro", "cc_sessions");
+    PLUGIN_PATH = join11(SESSION_DIR, "synkro-channel.ts");
+    PLUGIN_PKG_PATH = join11(SESSION_DIR, "package.json");
+    PLUGIN_SETTINGS_DIR = join11(SESSION_DIR, ".claude");
+    PLUGIN_SETTINGS_PATH = join11(PLUGIN_SETTINGS_DIR, "settings.json");
+    PROJECT_MCP_PATH = join11(SESSION_DIR, ".mcp.json");
+    CLAUDE_JSON_PATH = join11(homedir11(), ".claude.json");
+    RUN_SCRIPT_PATH = join11(SESSION_DIR, "run-claude.sh");
     TMUX_SESSION_NAME = "synkro-local-cc";
     CHANNEL_1_PORT = 8941;
-    SESSION_DIR_2 = join10(homedir10(), ".synkro", "cc_sessions_2");
-    PLUGIN_PATH_2 = join10(SESSION_DIR_2, "synkro-channel.ts");
-    PLUGIN_PKG_PATH_2 = join10(SESSION_DIR_2, "package.json");
-    PLUGIN_SETTINGS_DIR_2 = join10(SESSION_DIR_2, ".claude");
-    PLUGIN_SETTINGS_PATH_2 = join10(PLUGIN_SETTINGS_DIR_2, "settings.json");
-    PROJECT_MCP_PATH_2 = join10(SESSION_DIR_2, ".mcp.json");
-    RUN_SCRIPT_PATH_2 = join10(SESSION_DIR_2, "run-claude.sh");
+    SESSION_DIR_2 = join11(homedir11(), ".synkro", "cc_sessions_2");
+    PLUGIN_PATH_2 = join11(SESSION_DIR_2, "synkro-channel.ts");
+    PLUGIN_PKG_PATH_2 = join11(SESSION_DIR_2, "package.json");
+    PLUGIN_SETTINGS_DIR_2 = join11(SESSION_DIR_2, ".claude");
+    PLUGIN_SETTINGS_PATH_2 = join11(PLUGIN_SETTINGS_DIR_2, "settings.json");
+    PROJECT_MCP_PATH_2 = join11(SESSION_DIR_2, ".mcp.json");
+    RUN_SCRIPT_PATH_2 = join11(SESSION_DIR_2, "run-claude.sh");
     TMUX_SESSION_NAME_2 = "synkro-local-cc-2";
     CHANNEL_2_PORT = 8951;
-    SESSION_DIR_3 = join10(homedir10(), ".synkro", "cc_sessions_3");
-    PLUGIN_PATH_3 = join10(SESSION_DIR_3, "synkro-channel.ts");
-    PLUGIN_PKG_PATH_3 = join10(SESSION_DIR_3, "package.json");
-    PLUGIN_SETTINGS_DIR_3 = join10(SESSION_DIR_3, ".claude");
-    PLUGIN_SETTINGS_PATH_3 = join10(PLUGIN_SETTINGS_DIR_3, "settings.json");
-    PROJECT_MCP_PATH_3 = join10(SESSION_DIR_3, ".mcp.json");
-    RUN_SCRIPT_PATH_3 = join10(SESSION_DIR_3, "run-claude.sh");
+    SESSION_DIR_3 = join11(homedir11(), ".synkro", "cc_sessions_3");
+    PLUGIN_PATH_3 = join11(SESSION_DIR_3, "synkro-channel.ts");
+    PLUGIN_PKG_PATH_3 = join11(SESSION_DIR_3, "package.json");
+    PLUGIN_SETTINGS_DIR_3 = join11(SESSION_DIR_3, ".claude");
+    PLUGIN_SETTINGS_PATH_3 = join11(PLUGIN_SETTINGS_DIR_3, "settings.json");
+    PROJECT_MCP_PATH_3 = join11(SESSION_DIR_3, ".mcp.json");
+    RUN_SCRIPT_PATH_3 = join11(SESSION_DIR_3, "run-claude.sh");
     TMUX_SESSION_NAME_3 = "synkro-local-cc-3";
     CHANNEL_3_PORT = 8942;
-    SESSION_DIR_4 = join10(homedir10(), ".synkro", "cc_sessions_4");
-    PLUGIN_PATH_4 = join10(SESSION_DIR_4, "synkro-channel.ts");
-    PLUGIN_PKG_PATH_4 = join10(SESSION_DIR_4, "package.json");
-    PLUGIN_SETTINGS_DIR_4 = join10(SESSION_DIR_4, ".claude");
-    PLUGIN_SETTINGS_PATH_4 = join10(PLUGIN_SETTINGS_DIR_4, "settings.json");
-    PROJECT_MCP_PATH_4 = join10(SESSION_DIR_4, ".mcp.json");
-    RUN_SCRIPT_PATH_4 = join10(SESSION_DIR_4, "run-claude.sh");
+    SESSION_DIR_4 = join11(homedir11(), ".synkro", "cc_sessions_4");
+    PLUGIN_PATH_4 = join11(SESSION_DIR_4, "synkro-channel.ts");
+    PLUGIN_PKG_PATH_4 = join11(SESSION_DIR_4, "package.json");
+    PLUGIN_SETTINGS_DIR_4 = join11(SESSION_DIR_4, ".claude");
+    PLUGIN_SETTINGS_PATH_4 = join11(PLUGIN_SETTINGS_DIR_4, "settings.json");
+    PROJECT_MCP_PATH_4 = join11(SESSION_DIR_4, ".mcp.json");
+    RUN_SCRIPT_PATH_4 = join11(SESSION_DIR_4, "run-claude.sh");
     TMUX_SESSION_NAME_4 = "synkro-local-cc-4";
     CHANNEL_4_PORT = 8952;
     RUN_SCRIPT_SOURCE = `#!/usr/bin/env bash
@@ -11484,9 +12156,9 @@ __export(disconnect_exports, {
   disconnectCommand: () => disconnectCommand
 });
 import { existsSync as existsSync13, rmSync, readdirSync as readdirSync4 } from "fs";
-import { homedir as homedir11 } from "os";
-import { join as join11 } from "path";
-import { spawnSync as spawnSync5 } from "child_process";
+import { homedir as homedir12 } from "os";
+import { join as join12 } from "path";
+import { spawnSync as spawnSync6 } from "child_process";
 import { createInterface as createInterface4 } from "readline";
 async function tearDownLocalCC() {
   const docker = dockerStatus();
@@ -11500,7 +12172,7 @@ async function tearDownLocalCC() {
   console.log("\u2713 removed synkro-server container");
   try {
     const image = imageTag();
-    const r = spawnSync5("docker", ["rmi", "-f", image], { encoding: "utf-8", timeout: 3e4 });
+    const r = spawnSync6("docker", ["rmi", "-f", image], { encoding: "utf-8", timeout: 3e4 });
     console.log(r.status === 0 ? `\u2713 removed Docker image ${image}` : "\xB7 no Docker image to remove");
   } catch {
   }
@@ -11559,15 +12231,19 @@ async function disconnectCommand(args2 = []) {
     const cursorMcpRemoved = uninstallCursorMcpConfig();
     console.log(`${cursorMcpRemoved ? "\u2713" : "\xB7"} MCP guardrails (Cursor): ${cursorMcpRemoved ? "removed from ~/.cursor/mcp.json" : "no entry found"}`);
   }
-  if (existsSync13(SYNKRO_DIR5)) {
+  {
+    const desktopMcpRemoved = uninstallClaudeDesktopMcpConfig();
+    console.log(`${desktopMcpRemoved ? "\u2713" : "\xB7"} MCP guardrails (Claude Desktop): ${desktopMcpRemoved ? "removed from claude_desktop_config.json" : "no entry found"}`);
+  }
+  if (existsSync13(SYNKRO_DIR6)) {
     if (purge) {
-      rmSync(SYNKRO_DIR5, { recursive: true, force: true });
-      console.log(`\u2713 wiped ${SYNKRO_DIR5} entirely \u2014 including all scan data and backups`);
+      rmSync(SYNKRO_DIR6, { recursive: true, force: true });
+      console.log(`\u2713 wiped ${SYNKRO_DIR6} entirely \u2014 including all scan data and backups`);
     } else {
-      const keep = /* @__PURE__ */ new Set([join11(SYNKRO_DIR5, "pgdata"), join11(SYNKRO_DIR5, "pgdata-backups")]);
+      const keep = /* @__PURE__ */ new Set([join12(SYNKRO_DIR6, "pgdata"), join12(SYNKRO_DIR6, "pgdata-backups")]);
       const preserved = [];
-      for (const entry of readdirSync4(SYNKRO_DIR5)) {
-        const full = join11(SYNKRO_DIR5, entry);
+      for (const entry of readdirSync4(SYNKRO_DIR6)) {
+        const full = join12(SYNKRO_DIR6, entry);
         if (keep.has(full)) {
           preserved.push(entry);
           continue;
@@ -11575,18 +12251,18 @@ async function disconnectCommand(args2 = []) {
         rmSync(full, { recursive: true, force: true });
       }
       if (preserved.length > 0) {
-        console.log(`\u2713 removed Synkro config from ${SYNKRO_DIR5} (kept your scan data: ${preserved.join(", ")})`);
+        console.log(`\u2713 removed Synkro config from ${SYNKRO_DIR6} (kept your scan data: ${preserved.join(", ")})`);
         console.log("  run `synkro uninstall --purge` to delete that too");
       } else {
-        console.log(`\u2713 removed ${SYNKRO_DIR5}`);
+        console.log(`\u2713 removed ${SYNKRO_DIR6}`);
       }
     }
   } else {
-    console.log(`\xB7 ${SYNKRO_DIR5} already gone`);
+    console.log(`\xB7 ${SYNKRO_DIR6} already gone`);
   }
   console.log(purge ? "\nSynkro fully removed \u2014 this machine is clean, as if it was never installed." : "\nSynkro uninstalled. Your scan data is preserved.");
 }
-var SYNKRO_DIR5;
+var SYNKRO_DIR6;
 var init_disconnect = __esm({
   "cli/commands/disconnect.ts"() {
     "use strict";
@@ -11597,14 +12273,14 @@ var init_disconnect = __esm({
     init_install2();
     init_dockerInstall();
     init_macKeychain();
-    SYNKRO_DIR5 = join11(homedir11(), ".synkro");
+    SYNKRO_DIR6 = join12(homedir12(), ".synkro");
   }
 });
 
 // cli/local-cc/turnLog.ts
-import { appendFileSync, existsSync as existsSync14, mkdirSync as mkdirSync11, openSync as openSync2, readFileSync as readFileSync11, readSync, closeSync as closeSync2, statSync as statSync3, watchFile, unwatchFile } from "fs";
-import { dirname as dirname6, join as join12 } from "path";
-import { homedir as homedir12 } from "os";
+import { appendFileSync, existsSync as existsSync14, mkdirSync as mkdirSync11, openSync as openSync2, readFileSync as readFileSync12, readSync, closeSync as closeSync2, statSync as statSync2, watchFile, unwatchFile } from "fs";
+import { dirname as dirname6, join as join13 } from "path";
+import { homedir as homedir13 } from "os";
 function truncate(s, max = PREVIEW_MAX) {
   if (s.length <= max) return s;
   return s.slice(0, max) + "\u2026 [+" + (s.length - max) + " chars]";
@@ -11642,9 +12318,9 @@ function appendTurn(args2) {
 function readRecentTurns(n = 20) {
   if (!existsSync14(TURN_LOG_PATH)) return [];
   try {
-    const size = statSync3(TURN_LOG_PATH).size;
+    const size = statSync2(TURN_LOG_PATH).size;
     if (size === 0) return [];
-    const text = readFileSync11(TURN_LOG_PATH, "utf-8");
+    const text = readFileSync12(TURN_LOG_PATH, "utf-8");
     const lines = text.split("\n").filter(Boolean);
     const lastN = lines.slice(-n).reverse();
     return lastN.map((line) => {
@@ -11668,7 +12344,7 @@ function followTurns(onEntry) {
   }
   let lastSize = (() => {
     try {
-      return statSync3(TURN_LOG_PATH).size;
+      return statSync2(TURN_LOG_PATH).size;
     } catch {
       return 0;
     }
@@ -11723,7 +12399,7 @@ var TURN_LOG_PATH, PREVIEW_MAX;
 var init_turnLog = __esm({
   "cli/local-cc/turnLog.ts"() {
     "use strict";
-    TURN_LOG_PATH = join12(homedir12(), ".synkro", "cc_sessions", "turns.log");
+    TURN_LOG_PATH = join13(homedir13(), ".synkro", "cc_sessions", "turns.log");
     PREVIEW_MAX = 400;
   }
 });
@@ -11872,19 +12548,19 @@ var init_grade = __esm({
 });
 
 // cli/local-cc/pueue.ts
-import { execFileSync as execFileSync3, spawnSync as spawnSync6, spawn as spawn2 } from "child_process";
-import { homedir as homedir13 } from "os";
-import { join as join13 } from "path";
+import { execFileSync as execFileSync3, spawnSync as spawnSync7, spawn as spawn2 } from "child_process";
+import { homedir as homedir14 } from "os";
+import { join as join14 } from "path";
 import { connect as connect2 } from "net";
 function pueueAvailable() {
-  const r = spawnSync6("pueue", ["--version"], { encoding: "utf-8" });
+  const r = spawnSync7("pueue", ["--version"], { encoding: "utf-8" });
   if (r.status !== 0) {
     throw new PueueError("pueue CLI not found on PATH. Install pueue (https://github.com/Nukesor/pueue) and start `pueued`.");
   }
 }
 function statusJson() {
   pueueAvailable();
-  const r = spawnSync6("pueue", ["status", "--json"], { encoding: "utf-8" });
+  const r = spawnSync7("pueue", ["status", "--json"], { encoding: "utf-8" });
   if (r.status !== 0) {
     throw new PueueError(`pueue status failed: ${r.stderr || r.stdout || "unknown error"} \u2014 is pueued running?`);
   }
@@ -11929,18 +12605,18 @@ function startTask(opts = {}) {
   let existing = findTask(ch);
   while (existing) {
     if (existing.status === "Running" || existing.status === "Queued") {
-      spawnSync6("tmux", ["kill-session", "-t", `=${ch.tmuxSession}`], { encoding: "utf-8" });
-      spawnSync6("pueue", ["kill", String(existing.id)], { encoding: "utf-8" });
+      spawnSync7("tmux", ["kill-session", "-t", `=${ch.tmuxSession}`], { encoding: "utf-8" });
+      spawnSync7("pueue", ["kill", String(existing.id)], { encoding: "utf-8" });
       for (let i = 0; i < 10; i++) {
         const check = findTask(ch);
         if (!check || check.id !== existing.id || check.status !== "Running" && check.status !== "Queued") break;
-        spawnSync6("sleep", ["0.5"], { encoding: "utf-8" });
+        spawnSync7("sleep", ["0.5"], { encoding: "utf-8" });
       }
     }
-    spawnSync6("pueue", ["remove", String(existing.id)], { encoding: "utf-8" });
+    spawnSync7("pueue", ["remove", String(existing.id)], { encoding: "utf-8" });
     existing = findTask(ch);
   }
-  const runScript = join13(cwd, "run-claude.sh");
+  const runScript = join14(cwd, "run-claude.sh");
   const args2 = [
     "add",
     "--label",
@@ -11951,7 +12627,7 @@ function startTask(opts = {}) {
     "bash",
     runScript
   ];
-  const r = spawnSync6("pueue", args2, { encoding: "utf-8" });
+  const r = spawnSync7("pueue", args2, { encoding: "utf-8" });
   if (r.status !== 0) {
     throw new PueueError(`pueue add failed: ${r.stderr || r.stdout}`);
   }
@@ -11962,25 +12638,25 @@ function startTask(opts = {}) {
   return created;
 }
 function stopTask(channel = CHANNEL_PRIMARY) {
-  spawnSync6("tmux", ["kill-session", "-t", `=${channel.tmuxSession}`], { encoding: "utf-8" });
+  spawnSync7("tmux", ["kill-session", "-t", `=${channel.tmuxSession}`], { encoding: "utf-8" });
   let t = findTask(channel);
   while (t) {
     if (t.status === "Running" || t.status === "Queued") {
-      spawnSync6("pueue", ["kill", String(t.id)], { encoding: "utf-8" });
+      spawnSync7("pueue", ["kill", String(t.id)], { encoding: "utf-8" });
       for (let i = 0; i < 10; i++) {
         const check = findTask(channel);
         if (!check || check.id !== t.id || check.status !== "Running" && check.status !== "Queued") break;
-        spawnSync6("sleep", ["0.5"], { encoding: "utf-8" });
+        spawnSync7("sleep", ["0.5"], { encoding: "utf-8" });
       }
     }
-    spawnSync6("pueue", ["remove", String(t.id)], { encoding: "utf-8" });
+    spawnSync7("pueue", ["remove", String(t.id)], { encoding: "utf-8" });
     t = findTask(channel);
   }
 }
 function tailLogs(lines = 80, channel = CHANNEL_PRIMARY) {
   const t = findTask(channel);
   if (!t) return `(no ${channel.taskLabel} task)`;
-  const r = spawnSync6("pueue", ["log", "--lines", String(lines), String(t.id)], { encoding: "utf-8" });
+  const r = spawnSync7("pueue", ["log", "--lines", String(lines), String(t.id)], { encoding: "utf-8" });
   return r.stdout || r.stderr || "(no output)";
 }
 function ensureRunning(opts = {}) {
@@ -12005,8 +12681,8 @@ function probePort(host, port, timeoutMs = 500) {
   });
 }
 function tmuxDismissPrompts(tmuxSession = TMUX_SESSION) {
-  spawnSync6("tmux", ["send-keys", "-t", tmuxSession, "1"], { encoding: "utf-8" });
-  spawnSync6("tmux", ["send-keys", "-t", tmuxSession, "Enter"], { encoding: "utf-8" });
+  spawnSync7("tmux", ["send-keys", "-t", tmuxSession, "1"], { encoding: "utf-8" });
+  spawnSync7("tmux", ["send-keys", "-t", tmuxSession, "Enter"], { encoding: "utf-8" });
 }
 async function waitForChannelReady(port, timeoutMs = 6e4, host = "127.0.0.1", tmuxSession = TMUX_SESSION) {
   const deadline = Date.now() + timeoutMs;
@@ -12018,46 +12694,46 @@ async function waitForChannelReady(port, timeoutMs = 6e4, host = "127.0.0.1", tm
   return probePort(host, port);
 }
 function brewInstall(pkg) {
-  const brew = spawnSync6("brew", ["--version"], { encoding: "utf-8" });
+  const brew = spawnSync7("brew", ["--version"], { encoding: "utf-8" });
   if (brew.status !== 0) return false;
   console.log(`  Installing ${pkg} via brew...`);
-  const r = spawnSync6("brew", ["install", pkg], { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
+  const r = spawnSync7("brew", ["install", pkg], { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
   return r.status === 0;
 }
 function assertPueueInstalled() {
-  let r = spawnSync6("pueue", ["--version"], { encoding: "utf-8" });
+  let r = spawnSync7("pueue", ["--version"], { encoding: "utf-8" });
   if (r.status !== 0) {
     if (process.platform === "darwin" && brewInstall("pueue")) {
-      r = spawnSync6("pueue", ["--version"], { encoding: "utf-8" });
+      r = spawnSync7("pueue", ["--version"], { encoding: "utf-8" });
       if (r.status !== 0) throw new PueueError("pueue install succeeded but binary not found on PATH.");
     } else {
       throw new PueueError("pueue not found. Install it: brew install pueue (macOS) or https://github.com/Nukesor/pueue");
     }
   }
-  const status = spawnSync6("pueue", ["status", "--json"], { encoding: "utf-8", timeout: 5e3 });
+  const status = spawnSync7("pueue", ["status", "--json"], { encoding: "utf-8", timeout: 5e3 });
   if (status.status !== 0) {
     console.log("  Starting pueued daemon...");
     const child = spawn2("pueued", ["-d"], { stdio: "ignore", detached: true });
     child.unref();
-    spawnSync6("sleep", ["1"]);
-    const retry = spawnSync6("pueue", ["status", "--json"], { encoding: "utf-8", timeout: 5e3 });
+    spawnSync7("sleep", ["1"]);
+    const retry = spawnSync7("pueue", ["status", "--json"], { encoding: "utf-8", timeout: 5e3 });
     if (retry.status !== 0) {
       throw new PueueError("pueue daemon not reachable after starting pueued. Check `pueued` manually.");
     }
   }
-  spawnSync6("pueue", ["parallel", "2"], { encoding: "utf-8" });
+  spawnSync7("pueue", ["parallel", "2"], { encoding: "utf-8" });
 }
 function assertClaudeInstalled() {
-  const r = spawnSync6("claude", ["--version"], { encoding: "utf-8" });
+  const r = spawnSync7("claude", ["--version"], { encoding: "utf-8" });
   if (r.status !== 0) {
     throw new PueueError("claude CLI not found on PATH. Install Claude Code first: https://docs.claude.com/claude-code");
   }
 }
 function assertTmuxInstalled() {
-  let r = spawnSync6("tmux", ["-V"], { encoding: "utf-8" });
+  let r = spawnSync7("tmux", ["-V"], { encoding: "utf-8" });
   if (r.status !== 0) {
     if (process.platform === "darwin" && brewInstall("tmux")) {
-      r = spawnSync6("tmux", ["-V"], { encoding: "utf-8" });
+      r = spawnSync7("tmux", ["-V"], { encoding: "utf-8" });
       if (r.status !== 0) throw new PueueError("tmux install succeeded but binary not found on PATH.");
     } else {
       throw new PueueError("tmux not found. Install it: brew install tmux (macOS) or apt install tmux (Linux)");
@@ -12070,12 +12746,12 @@ var init_pueue = __esm({
     "use strict";
     TASK_LABEL = "synkro-local-cc";
     TMUX_SESSION = "synkro-local-cc";
-    SESSION_DIR2 = join13(homedir13(), ".synkro", "cc_sessions");
+    SESSION_DIR2 = join14(homedir14(), ".synkro", "cc_sessions");
     TASK_LABEL_2 = "synkro-local-cc-2";
     TMUX_SESSION_2 = "synkro-local-cc-2";
-    SESSION_DIR_22 = join13(homedir13(), ".synkro", "cc_sessions_2");
-    SESSION_DIR_32 = join13(homedir13(), ".synkro", "cc_sessions_3");
-    SESSION_DIR_42 = join13(homedir13(), ".synkro", "cc_sessions_4");
+    SESSION_DIR_22 = join14(homedir14(), ".synkro", "cc_sessions_2");
+    SESSION_DIR_32 = join14(homedir14(), ".synkro", "cc_sessions_3");
+    SESSION_DIR_42 = join14(homedir14(), ".synkro", "cc_sessions_4");
     PueueError = class extends Error {
       constructor(message, cause) {
         super(message);
@@ -12090,13 +12766,13 @@ var init_pueue = __esm({
 });
 
 // cli/local-cc/settings.ts
-import { existsSync as existsSync15, readFileSync as readFileSync12 } from "fs";
-import { homedir as homedir14 } from "os";
-import { join as join14 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync13 } from "fs";
+import { homedir as homedir15 } from "os";
+import { join as join15 } from "path";
 function isLocalCCEnabled() {
   if (!existsSync15(CONFIG_PATH3)) return false;
   try {
-    const content = readFileSync12(CONFIG_PATH3, "utf-8");
+    const content = readFileSync13(CONFIG_PATH3, "utf-8");
     const match = content.match(/^SYNKRO_LOCAL_INFERENCE='([^']*)'/m);
     return match?.[1] === "yes";
   } catch {
@@ -12107,7 +12783,7 @@ var CONFIG_PATH3;
 var init_settings = __esm({
   "cli/local-cc/settings.ts"() {
     "use strict";
-    CONFIG_PATH3 = join14(homedir14(), ".synkro", "config.env");
+    CONFIG_PATH3 = join15(homedir15(), ".synkro", "config.env");
   }
 });
 
@@ -12116,11 +12792,11 @@ var localCc_exports = {};
 __export(localCc_exports, {
   localCcCommand: () => localCcCommand
 });
-import { spawnSync as spawnSync7 } from "child_process";
-import { homedir as homedir15 } from "os";
-import { join as join15 } from "path";
+import { spawnSync as spawnSync8 } from "child_process";
+import { homedir as homedir16 } from "os";
+import { join as join16 } from "path";
 import { readFileSync as fsReadFileSync, existsSync as fsExistsSync } from "fs";
-import { existsSync as existsSync16, readFileSync as readFileSync13, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync14, writeFileSync as writeFileSync10 } from "fs";
 function deploymentMode() {
   const env = (process.env.SYNKRO_DEPLOYMENT_MODE || "").toLowerCase();
   if (env === "docker") return "docker";
@@ -12227,14 +12903,14 @@ TROUBLESHOOTING
 }
 function readGatewayUrl() {
   if (existsSync16(CONFIG_PATH4)) {
-    const m = readFileSync13(CONFIG_PATH4, "utf-8").match(/^SYNKRO_GATEWAY_URL='([^']*)'/m);
+    const m = readFileSync14(CONFIG_PATH4, "utf-8").match(/^SYNKRO_GATEWAY_URL='([^']*)'/m);
     if (m) return m[1];
   }
   return "https://api.synkro.sh";
 }
 function updateLocalInferenceFlag(enabled) {
   if (!existsSync16(CONFIG_PATH4)) return;
-  let content = readFileSync13(CONFIG_PATH4, "utf-8");
+  let content = readFileSync14(CONFIG_PATH4, "utf-8");
   const flag = enabled ? "yes" : "no";
   if (content.includes("SYNKRO_LOCAL_INFERENCE=")) {
     content = content.replace(/^SYNKRO_LOCAL_INFERENCE='[^']*'/m, `SYNKRO_LOCAL_INFERENCE='${flag}'`);
@@ -12297,7 +12973,7 @@ async function cmdStatus() {
   }
   const ch1Up = await isChannelAvailable();
   console.log(`Channel 1 ${CHANNEL_HOST}:${CHANNEL_PORT}: ${ch1Up ? "reachable" : "unreachable"}`);
-  const tmux1 = spawnSync7("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME}`], { encoding: "utf-8" });
+  const tmux1 = spawnSync8("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME}`], { encoding: "utf-8" });
   console.log(`tmux '${TMUX_SESSION_NAME}': ${tmux1.status === 0 ? "live" : "absent"}`);
   const t2 = findTask(CHANNEL_SECONDARY);
   if (!t2) {
@@ -12307,7 +12983,7 @@ async function cmdStatus() {
   }
   const ch2Up = await isChannelAvailable(CHANNEL_2_PORT);
   console.log(`Channel 2 ${CHANNEL_HOST}:${CHANNEL_2_PORT}: ${ch2Up ? "reachable" : "unreachable"}`);
-  const tmux2 = spawnSync7("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME_2}`], { encoding: "utf-8" });
+  const tmux2 = spawnSync8("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME_2}`], { encoding: "utf-8" });
   console.log(`tmux '${TMUX_SESSION_NAME_2}': ${tmux2.status === 0 ? "live" : "absent"}`);
 }
 async function cmdEnable() {
@@ -12513,7 +13189,7 @@ function cmdLogs(rest) {
       }
       return "200";
     })();
-    spawnSync7("docker", ["logs", "--tail", tailArg, ...followFlag, "synkro-server"], { stdio: "inherit" });
+    spawnSync8("docker", ["logs", "--tail", tailArg, ...followFlag, "synkro-server"], { stdio: "inherit" });
     return;
   }
   for (const arg of rest) {
@@ -12561,7 +13237,7 @@ function cmdLogs(rest) {
 function cmdAttach(rest) {
   assertTmuxInstalled();
   const readonly = rest.some((a) => a === "--readonly" || a === "-r");
-  const has = spawnSync7("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME}`], { encoding: "utf-8" });
+  const has = spawnSync8("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME}`], { encoding: "utf-8" });
   if (has.status !== 0) {
     console.error(`No tmux session '${TMUX_SESSION_NAME}' running. Start it with: synkro local-cc start`);
     process.exit(1);
@@ -12574,7 +13250,7 @@ function cmdAttach(rest) {
   console.log("Detach with Ctrl-B then D. (Do not press Ctrl-C \u2014 that would interrupt claude.)");
   console.log();
   const args2 = readonly ? ["attach-session", "-r", "-t", TMUX_SESSION_NAME] : ["attach-session", "-t", TMUX_SESSION_NAME];
-  const r = spawnSync7("tmux", args2, { stdio: "inherit" });
+  const r = spawnSync8("tmux", args2, { stdio: "inherit" });
   process.exit(r.status ?? 0);
 }
 async function cmdTest() {
@@ -12673,8 +13349,8 @@ var init_localCc = __esm({
     init_install();
     init_client();
     init_stub();
-    SYNKRO_CONFIG_PATH = join15(homedir15(), ".synkro", "config.env");
-    CONFIG_PATH4 = join15(homedir15(), ".synkro", "config.env");
+    SYNKRO_CONFIG_PATH = join16(homedir16(), ".synkro", "config.env");
+    CONFIG_PATH4 = join16(homedir16(), ".synkro", "config.env");
   }
 });
 
@@ -12785,13 +13461,13 @@ var config_exports = {};
 __export(config_exports, {
   configCommand: () => configCommand
 });
-import { readFileSync as readFileSync14, writeFileSync as writeFileSync11, existsSync as existsSync17 } from "fs";
-import { join as join16 } from "path";
-import { homedir as homedir16 } from "os";
+import { readFileSync as readFileSync15, writeFileSync as writeFileSync11, existsSync as existsSync17 } from "fs";
+import { join as join17 } from "path";
+import { homedir as homedir17 } from "os";
 function readConfigEnv() {
   if (!existsSync17(CONFIG_PATH5)) return {};
   const out = {};
-  for (const line of readFileSync14(CONFIG_PATH5, "utf-8").split("\n")) {
+  for (const line of readFileSync15(CONFIG_PATH5, "utf-8").split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#")) continue;
     const eq = t.indexOf("=");
@@ -12804,7 +13480,7 @@ function updateConfigValue(key, value) {
     console.error("No config found. Run `synkro install` first.");
     process.exit(1);
   }
-  const lines = readFileSync14(CONFIG_PATH5, "utf-8").split("\n");
+  const lines = readFileSync15(CONFIG_PATH5, "utf-8").split("\n");
   const pattern = new RegExp(`^${key}=`);
   let found = false;
   const updated = lines.map((line) => {
@@ -12920,25 +13596,25 @@ To change:`);
   updateConfigValue("SYNKRO_INFERENCE", inferenceValue);
   console.log(`\u2713 Inference set to '${inferenceValue}'.`);
 }
-var SYNKRO_DIR6, CONFIG_PATH5;
+var SYNKRO_DIR7, CONFIG_PATH5;
 var init_config = __esm({
   "cli/commands/config.ts"() {
     "use strict";
     init_stub();
-    SYNKRO_DIR6 = join16(homedir16(), ".synkro");
-    CONFIG_PATH5 = join16(SYNKRO_DIR6, "config.env");
+    SYNKRO_DIR7 = join17(homedir17(), ".synkro");
+    CONFIG_PATH5 = join17(SYNKRO_DIR7, "config.env");
   }
 });
 
 // cli/bootstrap.js
-import { readFileSync as readFileSync15, existsSync as existsSync18 } from "fs";
+import { readFileSync as readFileSync16, existsSync as existsSync18 } from "fs";
 import { resolve as resolve3 } from "path";
 var envCandidates = [
   resolve3(process.env.HOME ?? "", ".synkro", "config.env")
 ];
 for (const envPath of envCandidates) {
   if (!existsSync18(envPath)) continue;
-  const envContent = readFileSync15(envPath, "utf-8");
+  const envContent = readFileSync16(envPath, "utf-8");
   for (const line of envContent.split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -12953,7 +13629,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.57");
+  console.log("1.6.59");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents
@@ -13067,7 +13743,7 @@ async function main() {
     }
     case "claude-desktop": {
       const { runClaudeDesktopTap: runClaudeDesktopTap2 } = await Promise.resolve().then(() => (init_claudeDesktopTap(), claudeDesktopTap_exports));
-      await runClaudeDesktopTap2();
+      await runClaudeDesktopTap2({ backfill: subArgs.includes("--backfill") });
       break;
     }
     default: {