@synkro-sh/cli 1.7.60 → 1.7.62

package/dist/bootstrap.js

@@ -15,11 +15,1316 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// cli/telemetry/metaCache.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+import { randomUUID } from "crypto";
+function ensureDir() {
+  if (!existsSync(SYNKRO_DIR)) {
+    mkdirSync(SYNKRO_DIR, { recursive: true, mode: 448 });
+  }
+}
+function readMetaCache() {
+  if (cached) return cached;
+  let meta = { ...DEFAULTS };
+  if (existsSync(META_PATH)) {
+    try {
+      const raw = readFileSync(META_PATH, "utf-8");
+      const parsed = JSON.parse(raw);
+      if (parsed && typeof parsed === "object") {
+        meta = { ...DEFAULTS, ...parsed };
+      }
+    } catch {
+    }
+  }
+  if (!meta.install_id) {
+    meta.install_id = randomUUID();
+    writeMetaCache(meta);
+  }
+  cached = meta;
+  return cached;
+}
+function writeMetaCache(meta) {
+  try {
+    ensureDir();
+    const tmp = `${META_PATH}.tmp`;
+    writeFileSync(tmp, JSON.stringify(meta, null, 2), { mode: 384 });
+    renameSync(tmp, META_PATH);
+    cached = { ...meta };
+  } catch {
+  }
+}
+function patchMetaCache(patch) {
+  const current = readMetaCache();
+  const next = { ...current, ...patch };
+  writeMetaCache(next);
+  return next;
+}
+var SYNKRO_DIR, META_PATH, DEFAULTS, cached;
+var init_metaCache = __esm({
+  "cli/telemetry/metaCache.ts"() {
+    "use strict";
+    SYNKRO_DIR = join(homedir(), ".synkro");
+    META_PATH = join(SYNKRO_DIR, "telemetry-meta.json");
+    DEFAULTS = {
+      install_id: "",
+      enabled: true,
+      remote_flush_enabled: true
+    };
+    cached = null;
+  }
+});
+
+// cli/telemetry/identity.ts
+import { createHash } from "crypto";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { homedir as homedir2, hostname, platform } from "os";
+import { join as join2 } from "path";
+function decodeJwtPayload(token) {
+  const parts = token.split(".");
+  if (parts.length < 2) return null;
+  try {
+    const json = Buffer.from(parts[1], "base64url").toString("utf-8");
+    const parsed = JSON.parse(json);
+    if (parsed && typeof parsed === "object") return parsed;
+    return null;
+  } catch {
+    return null;
+  }
+}
+function loadCredentialsIdentity() {
+  if (!existsSync2(CREDS_PATH)) return {};
+  let raw;
+  try {
+    raw = readFileSync2(CREDS_PATH, "utf-8");
+  } catch {
+    return {};
+  }
+  let creds;
+  try {
+    creds = JSON.parse(raw);
+  } catch {
+    return {};
+  }
+  const out = {};
+  if (creds.user_id) out.user_id = creds.user_id;
+  if (creds.org_id) out.org_id = creds.org_id;
+  if (creds.email) out.email = creds.email;
+  if (creds.access_token && (!out.user_id || !out.org_id || !out.email)) {
+    const claims = decodeJwtPayload(creds.access_token);
+    if (claims) {
+      if (!out.user_id && claims.sub) out.user_id = claims.sub;
+      if (!out.org_id && claims.org_id) out.org_id = claims.org_id;
+      if (!out.email && claims.email) out.email = claims.email;
+    }
+  }
+  return out;
+}
+function hostnameHash() {
+  try {
+    return createHash("sha256").update(hostname()).digest("hex").slice(0, 16);
+  } catch {
+    return "";
+  }
+}
+function getIdentity() {
+  if (cached2) return cached2;
+  let cliVersion = "0.0.0";
+  try {
+    cliVersion = "1.7.62";
+  } catch {
+  }
+  const creds = loadCredentialsIdentity();
+  const meta = readMetaCache();
+  cached2 = {
+    install_id: meta.install_id,
+    user_id: creds.user_id,
+    org_id: creds.org_id,
+    email: creds.email,
+    cli_version: cliVersion,
+    platform: platform(),
+    hostname_hash: hostnameHash(),
+    node_version: process.version
+  };
+  return cached2;
+}
+var CREDS_PATH, cached2;
+var init_identity = __esm({
+  "cli/telemetry/identity.ts"() {
+    "use strict";
+    init_metaCache();
+    CREDS_PATH = process.env.SYNKRO_CREDENTIALS_PATH || join2(homedir2(), ".synkro", "credentials.json");
+    cached2 = null;
+  }
+});
+
+// cli/telemetry/emit.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { execFileSync } from "child_process";
+import { appendFileSync, existsSync as existsSync3, mkdirSync as mkdirSync2 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join3 } from "path";
+function deriveGit(cwd) {
+  const cached4 = gitCache.get(cwd);
+  if (cached4) return cached4;
+  const info = { branch: null, sha: null };
+  try {
+    const branch = execFileSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+      cwd,
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 500,
+      encoding: "utf-8"
+    }).trim();
+    if (branch) info.branch = branch;
+  } catch {
+  }
+  try {
+    const sha = execFileSync("git", ["rev-parse", "HEAD"], {
+      cwd,
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 500,
+      encoding: "utf-8"
+    }).trim();
+    if (sha) info.sha = sha;
+  } catch {
+  }
+  gitCache.set(cwd, info);
+  return info;
+}
+function ensureDir2() {
+  if (!existsSync3(SYNKRO_DIR2)) {
+    mkdirSync2(SYNKRO_DIR2, { recursive: true, mode: 448 });
+  }
+}
+function redactContext(context) {
+  if (!context || typeof context !== "object" || Array.isArray(context)) return context;
+  const c = context;
+  if (!("reasoning" in c) && !("raw_response" in c) && typeof c.reason !== "string") return context;
+  const out = { ...c };
+  delete out.reasoning;
+  delete out.raw_response;
+  if (typeof out.reason === "string" && out.reason.length > REASON_CODE_MAX) {
+    out.reason = out.reason.slice(0, REASON_CODE_MAX);
+  }
+  return out;
+}
+function emit(eventType, context, opts) {
+  try {
+    const meta = readMetaCache();
+    if (!meta.enabled) return;
+    const identity = getIdentity();
+    const cwd = opts?.cwd ?? process.cwd();
+    const git = deriveGit(cwd);
+    const emitter = process.env.SYNKRO_TELEMETRY_EMITTER || "bootstrap";
+    const row = {
+      client_event_id: randomUUID2(),
+      event_type: eventType,
+      occurred_at: (/* @__PURE__ */ new Date()).toISOString(),
+      install_id: identity.install_id,
+      user_id: identity.user_id ?? null,
+      org_id: identity.org_id ?? null,
+      email: identity.email ?? null,
+      cli_version: identity.cli_version,
+      emitter,
+      agent_kind: opts?.agent_kind ?? null,
+      cc_session_id: opts?.cc_session_id ?? null,
+      cc_tool_use_id: opts?.cc_tool_use_id ?? null,
+      cc_turn_id: opts?.cc_turn_id ?? null,
+      cc_model: opts?.cc_model ?? null,
+      permission_mode: opts?.permission_mode ?? null,
+      cwd,
+      repo: opts?.repo ?? null,
+      git_branch: git.branch,
+      git_sha: git.sha,
+      policy_name: opts?.policy_name ?? null,
+      capture_depth: opts?.capture_depth ?? null,
+      platform: identity.platform,
+      hostname_hash: identity.hostname_hash || null,
+      node_version: identity.node_version,
+      context: redactContext(context)
+    };
+    ensureDir2();
+    appendFileSync(PENDING_PATH, JSON.stringify(row) + "\n", { mode: 384 });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[synkro] telemetry emit(${eventType}) failed: ${msg}
+`);
+  }
+}
+var SYNKRO_DIR2, PENDING_PATH, gitCache, REASON_CODE_MAX;
+var init_emit = __esm({
+  "cli/telemetry/emit.ts"() {
+    "use strict";
+    init_identity();
+    init_metaCache();
+    SYNKRO_DIR2 = join3(homedir3(), ".synkro");
+    PENDING_PATH = join3(SYNKRO_DIR2, "telemetry-pending.jsonl");
+    gitCache = /* @__PURE__ */ new Map();
+    REASON_CODE_MAX = 200;
+  }
+});
+
+// cli/telemetry/db.ts
+var db_exports = {};
+__export(db_exports, {
+  closeDb: () => closeDb,
+  connectDb: () => connectDb,
+  resetDbForTests: () => resetDbForTests
+});
+import postgres from "postgres";
+async function connectDb() {
+  if (cached3) return cached3;
+  if (initFailedAt && Date.now() - initFailedAt < INIT_RETRY_MS) return null;
+  try {
+    const sql = postgres({
+      host: PGLITE_HOST,
+      port: PGLITE_PORT,
+      username: PGLITE_USER,
+      database: PGLITE_DB,
+      // max:1 mirrors synkro-server — PGlite is single-threaded; multiple
+      // sockets just queue at the multiplexer.
+      max: 1,
+      connect_timeout: 2,
+      idle_timeout: 30,
+      onnotice: () => {
+      }
+    });
+    await sql`SELECT 1`;
+    cached3 = sql;
+    initFailedAt = 0;
+    if (!migrated) await runMigrations(sql);
+    return cached3;
+  } catch (err) {
+    initFailedAt = Date.now();
+    if (process.env.SYNKRO_TELEMETRY_DEBUG === "1") {
+      const msg = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`[synkro] telemetry pglite unreachable at ${PGLITE_HOST}:${PGLITE_PORT}: ${msg}
+`);
+    }
+    return null;
+  }
+}
+async function runMigrations(sql) {
+  try {
+    await sql.unsafe(MIGRATION_V1);
+    const rows = await sql`SELECT v FROM telemetry_meta WHERE k = 'schema_version'`;
+    const current = rows.length ? Number(rows[0].v) : 0;
+    if (current !== SCHEMA_VERSION) {
+      await sql`
+        INSERT INTO telemetry_meta (k, v) VALUES ('schema_version', ${String(SCHEMA_VERSION)})
+        ON CONFLICT (k) DO UPDATE SET v = EXCLUDED.v
+      `;
+    }
+    migrated = true;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[synkro] telemetry migration failed: ${msg}
+`);
+  }
+}
+async function closeDb() {
+  if (!cached3) return;
+  try {
+    await cached3.end({ timeout: 1 });
+  } catch {
+  }
+  cached3 = null;
+}
+function resetDbForTests() {
+  cached3 = null;
+  initFailedAt = 0;
+  migrated = false;
+}
+var PGLITE_HOST, PGLITE_PORT, PGLITE_USER, PGLITE_DB, SCHEMA_VERSION, cached3, migrated, INIT_RETRY_MS, initFailedAt, MIGRATION_V1;
+var init_db = __esm({
+  "cli/telemetry/db.ts"() {
+    "use strict";
+    PGLITE_HOST = process.env.SYNKRO_PGLITE_HOST || "127.0.0.1";
+    PGLITE_PORT = parseInt(
+      process.env.SYNKRO_PGLITE_PORT || process.env.SYNKRO_HOST_PGLITE_PORT || "15433",
+      10
+    );
+    PGLITE_USER = process.env.SYNKRO_PGLITE_USER || "postgres";
+    PGLITE_DB = process.env.SYNKRO_PGLITE_DB || "postgres";
+    SCHEMA_VERSION = 1;
+    cached3 = null;
+    migrated = false;
+    INIT_RETRY_MS = 3e4;
+    initFailedAt = 0;
+    MIGRATION_V1 = `
+  CREATE TABLE IF NOT EXISTS telemetry_events (
+    id                 BIGSERIAL PRIMARY KEY,
+    client_event_id    TEXT NOT NULL UNIQUE,
+
+    event_type         TEXT NOT NULL,
+    occurred_at        TIMESTAMPTZ NOT NULL,
+
+    install_id         TEXT NOT NULL,
+    user_id            TEXT,
+    org_id             TEXT,
+    email              TEXT,
+
+    cli_version        TEXT NOT NULL,
+    emitter            TEXT NOT NULL,
+
+    agent_kind         TEXT,
+    cc_session_id      TEXT,
+    cc_tool_use_id     TEXT,
+    cc_turn_id         TEXT,
+    cc_model           TEXT,
+    permission_mode    TEXT,
+
+    cwd                TEXT,
+    repo               TEXT,
+    git_branch         TEXT,
+    git_sha            TEXT,
+
+    policy_name        TEXT,
+    capture_depth      TEXT,
+
+    platform           TEXT NOT NULL,
+    hostname_hash      TEXT,
+    node_version       TEXT,
+
+    context            JSONB NOT NULL
+  );
+
+  CREATE INDEX IF NOT EXISTS telemetry_events_by_type_time
+    ON telemetry_events (event_type, occurred_at DESC);
+  CREATE INDEX IF NOT EXISTS telemetry_events_by_session
+    ON telemetry_events (cc_session_id, occurred_at) WHERE cc_session_id IS NOT NULL;
+
+  CREATE TABLE IF NOT EXISTS telemetry_meta (
+    k TEXT PRIMARY KEY,
+    v TEXT NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS sessions_command_history (
+    id          BIGSERIAL PRIMARY KEY,
+    command     TEXT NOT NULL,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT now()
+  );
+
+  CREATE TABLE IF NOT EXISTS sessions_project_keys (
+    slug          TEXT PRIMARY KEY,
+    project_id    TEXT NOT NULL,
+    project_name  TEXT NOT NULL,
+    api_key       TEXT NOT NULL,
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT now()
+  );
+`;
+  }
+});
+
+// cli/telemetry/drain.ts
+import { openSync, closeSync, fstatSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2, appendFileSync as appendFileSync2, unlinkSync, mkdirSync as mkdirSync3, renameSync as renameSync2, existsSync as existsSync4 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join4 } from "path";
+function ensureDir3() {
+  if (!existsSync4(SYNKRO_DIR3)) mkdirSync3(SYNKRO_DIR3, { recursive: true, mode: 448 });
+}
+function acquireQueueLock() {
+  ensureDir3();
+  try {
+    return openSync(QUEUE_LOCK, "wx");
+  } catch {
+    let fd;
+    try {
+      fd = openSync(QUEUE_LOCK, "r");
+    } catch {
+      try {
+        return openSync(QUEUE_LOCK, "wx");
+      } catch {
+        return null;
+      }
+    }
+    let stale = false;
+    try {
+      stale = Date.now() - fstatSync(fd).mtimeMs > STALE_LOCK_MS;
+    } catch {
+    }
+    try {
+      closeSync(fd);
+    } catch {
+    }
+    if (!stale) return null;
+    try {
+      unlinkSync(QUEUE_LOCK);
+    } catch {
+    }
+    try {
+      return openSync(QUEUE_LOCK, "wx");
+    } catch {
+      return null;
+    }
+  }
+}
+function releaseQueueLock(fd) {
+  try {
+    closeSync(fd);
+  } catch {
+  }
+  try {
+    unlinkSync(QUEUE_LOCK);
+  } catch {
+  }
+}
+function parseQueueFile(path) {
+  if (!existsSync4(path)) return { rows: [], malformed: 0 };
+  let raw;
+  try {
+    raw = readFileSync3(path, "utf-8");
+  } catch {
+    return { rows: [], malformed: 0 };
+  }
+  if (!raw) return { rows: [], malformed: 0 };
+  const rows = [];
+  let malformed = 0;
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      const r = JSON.parse(line);
+      if (r && r.client_event_id && r.event_type) rows.push(r);
+      else malformed++;
+    } catch {
+      malformed++;
+    }
+  }
+  return { rows, malformed };
+}
+function readQueue() {
+  return parseQueueFile(PENDING_PATH);
+}
+function rewriteQueue(rows) {
+  ensureDir3();
+  const body = rows.length ? rows.map((r) => JSON.stringify(r)).join("\n") + "\n" : "";
+  const tmp = `${PENDING_PATH}.tmp`;
+  try {
+    writeFileSync2(tmp, body, { mode: 384 });
+    renameSync2(tmp, PENDING_PATH);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[synkro] telemetry queue rewrite failed: ${msg}
+`);
+  }
+}
+function recoverProcessing() {
+  if (!existsSync4(PROCESSING_PATH)) return;
+  ensureDir3();
+  let body;
+  try {
+    body = readFileSync3(PROCESSING_PATH, "utf-8");
+  } catch {
+    return;
+  }
+  try {
+    if (body.trim()) appendFileSync2(PENDING_PATH, body.endsWith("\n") ? body : body + "\n", { mode: 384 });
+    unlinkSync(PROCESSING_PATH);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[synkro] telemetry queue recovery failed: ${msg}
+`);
+  }
+}
+function rotateQueueForProcessing() {
+  ensureDir3();
+  if (!existsSync4(PENDING_PATH)) return { rows: [], malformed: 0 };
+  try {
+    renameSync2(PENDING_PATH, PROCESSING_PATH);
+  } catch {
+    return { rows: [], malformed: 0 };
+  }
+  const { rows, malformed } = parseQueueFile(PROCESSING_PATH);
+  if (rows.length > MAX_QUEUE_ROWS) {
+    const dropped = rows.length - MAX_QUEUE_ROWS;
+    process.stderr.write(`[synkro] telemetry queue over ${MAX_QUEUE_ROWS}-row cap: dropping ${dropped} oldest event(s)
+`);
+    return { rows: rows.slice(dropped), malformed };
+  }
+  return { rows, malformed };
+}
+function finalizeProcessing(survivors) {
+  if (survivors.length) {
+    ensureDir3();
+    const body = survivors.map((r) => JSON.stringify(r)).join("\n") + "\n";
+    try {
+      appendFileSync2(PENDING_PATH, body, { mode: 384 });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`[synkro] telemetry survivor re-append failed: ${msg}
+`);
+      return;
+    }
+  }
+  try {
+    unlinkSync(PROCESSING_PATH);
+  } catch {
+  }
+}
+async function insertEvents(sql, rows, mirroredIds) {
+  let inserted = 0;
+  for (let i = 0; i < rows.length; i += CHUNK) {
+    const batch = rows.slice(i, i + CHUNK);
+    const payload = batch.map((r) => ({
+      client_event_id: r.client_event_id,
+      event_type: r.event_type,
+      occurred_at: r.occurred_at,
+      install_id: r.install_id,
+      user_id: r.user_id,
+      org_id: r.org_id,
+      email: r.email,
+      cli_version: r.cli_version,
+      emitter: r.emitter,
+      agent_kind: r.agent_kind,
+      cc_session_id: r.cc_session_id,
+      cc_tool_use_id: r.cc_tool_use_id,
+      cc_turn_id: r.cc_turn_id,
+      cc_model: r.cc_model,
+      permission_mode: r.permission_mode,
+      cwd: r.cwd,
+      repo: r.repo,
+      git_branch: r.git_branch,
+      git_sha: r.git_sha,
+      policy_name: r.policy_name,
+      capture_depth: r.capture_depth,
+      platform: r.platform,
+      hostname_hash: r.hostname_hash,
+      node_version: r.node_version,
+      // Pass the object, NOT a pre-stringified string: postgres.js JSON-encodes
+      // jsonb-bound values itself; stringifying would double-encode into a jsonb
+      // string scalar (context->>'k' would then return null for every key).
+      // Cast narrows `unknown ?? {}` (which TS widens to the universal `{}`) to a
+      // concrete JSON object so postgres.js's helper accepts it as a jsonb value.
+      context: r.context ?? {}
+    }));
+    try {
+      const res = await sql`
+        INSERT INTO telemetry_events ${sql(
+        payload,
+        "client_event_id",
+        "event_type",
+        "occurred_at",
+        "install_id",
+        "user_id",
+        "org_id",
+        "email",
+        "cli_version",
+        "emitter",
+        "agent_kind",
+        "cc_session_id",
+        "cc_tool_use_id",
+        "cc_turn_id",
+        "cc_model",
+        "permission_mode",
+        "cwd",
+        "repo",
+        "git_branch",
+        "git_sha",
+        "policy_name",
+        "capture_depth",
+        "platform",
+        "hostname_hash",
+        "node_version",
+        "context"
+      )}
+        ON CONFLICT (client_event_id) DO NOTHING
+      `;
+      inserted += res.count ?? batch.length;
+      if (mirroredIds) for (const r of batch) mirroredIds.add(r.client_event_id);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`[synkro] telemetry local mirror chunk failed (skipped ${batch.length}): ${msg}
+`);
+    }
+  }
+  return inserted;
+}
+async function drainToPglite() {
+  const { rows } = readQueue();
+  if (rows.length === 0) return { ok: true, ingested: 0, pending: 0, reason: "no_pending" };
+  const sql = await connectDb();
+  if (!sql) return { ok: false, ingested: 0, pending: rows.length, reason: "db_unavailable" };
+  try {
+    const ingested = await insertEvents(sql, rows);
+    patchMetaCache({ last_drained_at: (/* @__PURE__ */ new Date()).toISOString() });
+    return { ok: true, ingested, pending: rows.length };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { ok: false, ingested: 0, pending: rows.length, reason: "error", error: msg };
+  }
+}
+var SYNKRO_DIR3, QUEUE_LOCK, PROCESSING_PATH, CHUNK, STALE_LOCK_MS, MAX_QUEUE_ROWS;
+var init_drain = __esm({
+  "cli/telemetry/drain.ts"() {
+    "use strict";
+    init_db();
+    init_emit();
+    init_metaCache();
+    SYNKRO_DIR3 = join4(homedir4(), ".synkro");
+    QUEUE_LOCK = join4(SYNKRO_DIR3, ".telemetry-queue.lock");
+    PROCESSING_PATH = `${PENDING_PATH}.processing`;
+    CHUNK = 500;
+    STALE_LOCK_MS = 6e4;
+    MAX_QUEUE_ROWS = 5e4;
+  }
+});
+
+// cli/telemetry/optout.ts
+import { chmodSync, existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join5 } from "path";
+function sanitize(raw, maxLen = 256) {
+  return raw.replace(/[^\x20-\x7E]/g, "").slice(0, maxLen);
+}
+function shellQuoteSingle(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function writeConfigEnvFlag(key, value) {
+  const safe = sanitize(value, 8);
+  const line = `${key}=${shellQuoteSingle(safe)}`;
+  let content = "";
+  if (existsSync5(CONFIG_PATH)) {
+    try {
+      content = readFileSync4(CONFIG_PATH, "utf-8");
+    } catch {
+      content = "";
+    }
+  }
+  const re = new RegExp(`^${key}=.*$`, "m");
+  if (re.test(content)) {
+    content = content.replace(re, line);
+  } else {
+    if (content.length > 0 && !content.endsWith("\n")) content += "\n";
+    content += `${line}
+`;
+  }
+  try {
+    writeFileSync3(CONFIG_PATH, content, "utf-8");
+    try {
+      chmodSync(CONFIG_PATH, 384);
+    } catch {
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[synkro] telemetry config write failed: ${msg}
+`);
+  }
+}
+async function getTelemetryState() {
+  const meta = readMetaCache();
+  return {
+    enabled: meta.enabled,
+    remoteFlushEnabled: meta.remote_flush_enabled
+  };
+}
+function getTelemetryStateSync() {
+  const meta = readMetaCache();
+  return {
+    enabled: meta.enabled,
+    remoteFlushEnabled: meta.remote_flush_enabled
+  };
+}
+async function setTelemetryState(opts) {
+  const current = await getTelemetryState();
+  const patch = {};
+  if (opts.enabled !== void 0 && opts.enabled !== current.enabled) {
+    emit("config_change", {
+      setting: "telemetry_enabled",
+      from: current.enabled ? "yes" : "no",
+      to: opts.enabled ? "yes" : "no",
+      source: "cli"
+    });
+    patch.enabled = opts.enabled;
+    writeConfigEnvFlag(KEY_ENABLED, opts.enabled ? "yes" : "no");
+  }
+  if (opts.remoteFlushEnabled !== void 0 && opts.remoteFlushEnabled !== current.remoteFlushEnabled) {
+    emit("config_change", {
+      setting: "remote_flush_enabled",
+      from: current.remoteFlushEnabled ? "yes" : "no",
+      to: opts.remoteFlushEnabled ? "yes" : "no",
+      source: "cli"
+    });
+    patch.remote_flush_enabled = opts.remoteFlushEnabled;
+    writeConfigEnvFlag(KEY_REMOTE, opts.remoteFlushEnabled ? "yes" : "no");
+  }
+  if (Object.keys(patch).length > 0) patchMetaCache(patch);
+}
+var SYNKRO_DIR4, CONFIG_PATH, KEY_ENABLED, KEY_REMOTE;
+var init_optout = __esm({
+  "cli/telemetry/optout.ts"() {
+    "use strict";
+    init_emit();
+    init_metaCache();
+    SYNKRO_DIR4 = join5(homedir5(), ".synkro");
+    CONFIG_PATH = join5(SYNKRO_DIR4, "config.env");
+    KEY_ENABLED = "SYNKRO_TELEMETRY_ENABLED";
+    KEY_REMOTE = "SYNKRO_TELEMETRY_REMOTE_FLUSH";
+  }
+});
+
+// cli/telemetry/wire.ts
+function isUnrecoverable(status) {
+  return UNRECOVERABLE_STATUSES.includes(status);
+}
+function batchBySizeAndCount(rows, sizeOf, opts) {
+  const limit = opts?.limit ?? BATCH_LIMIT;
+  const maxBytes = opts?.maxBytes ?? BATCH_BYTES;
+  const batches = [];
+  let cur = [];
+  let bytes = 0;
+  for (const r of rows) {
+    const sz = sizeOf(r);
+    if (cur.length > 0 && (cur.length >= limit || bytes + sz > maxBytes)) {
+      batches.push(cur);
+      cur = [];
+      bytes = 0;
+    }
+    cur.push(r);
+    bytes += sz;
+  }
+  if (cur.length) batches.push(cur);
+  return batches;
+}
+var TELEMETRY_FLUSH_PATH, BATCH_LIMIT, BATCH_BYTES, REQUEST_TIMEOUT_MS, TELEMETRY_BODY_MAX, UNRECOVERABLE_STATUSES;
+var init_wire = __esm({
+  "cli/telemetry/wire.ts"() {
+    "use strict";
+    TELEMETRY_FLUSH_PATH = "/api/v1/telemetry/flush";
+    BATCH_LIMIT = 200;
+    BATCH_BYTES = 1024 * 1024;
+    REQUEST_TIMEOUT_MS = 15e3;
+    TELEMETRY_BODY_MAX = 4 * 1024 * 1024;
+    UNRECOVERABLE_STATUSES = [400, 413, 422];
+  }
+});
+
+// cli/telemetry/flush.ts
+var flush_exports = {};
+__export(flush_exports, {
+  flush: () => flush,
+  flushDetached: () => flushDetached
+});
+import { spawn } from "child_process";
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join6 } from "path";
+function readConfigEnv() {
+  if (!existsSync6(CONFIG_PATH2)) return {};
+  const out = {};
+  let raw;
+  try {
+    raw = readFileSync5(CONFIG_PATH2, "utf-8");
+  } catch {
+    return {};
+  }
+  for (const line of raw.split("\n")) {
+    const t = line.trim();
+    if (!t || t.startsWith("#")) continue;
+    const eq = t.indexOf("=");
+    if (eq <= 0) continue;
+    const k = t.slice(0, eq).trim();
+    let v = t.slice(eq + 1).trim();
+    if (v.startsWith("'") && v.endsWith("'") || v.startsWith('"') && v.endsWith('"')) v = v.slice(1, -1);
+    out[k] = v;
+  }
+  return out;
+}
+function isLocalhost(host) {
+  return host === "localhost" || host === "127.0.0.1" || host === "::1";
+}
+function isGatewayHostAllowed(host) {
+  const h = host.toLowerCase();
+  return isLocalhost(h) || h === "synkro.sh" || h.endsWith(".synkro.sh");
+}
+function resolveGatewayUrl() {
+  const cfg = readConfigEnv();
+  const raw = (cfg.SYNKRO_GATEWAY_URL || process.env.SYNKRO_GATEWAY_URL || "").trim();
+  if (!raw) return DEFAULT_GATEWAY;
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    return DEFAULT_GATEWAY;
+  }
+  if (!isGatewayHostAllowed(u.hostname)) return DEFAULT_GATEWAY;
+  if (u.protocol === "https:") return raw.replace(/\/$/, "");
+  if (u.protocol === "http:" && isLocalhost(u.hostname)) return raw.replace(/\/$/, "");
+  return DEFAULT_GATEWAY;
+}
+function loadJwt() {
+  if ((process.env.SYNKRO_STORAGE_MODE || "") === "cloud") {
+    try {
+      const mcp = readFileSync5(join6(SYNKRO_DIR5, ".mcp-jwt"), "utf-8").trim();
+      if (mcp) return mcp;
+    } catch {
+    }
+  }
+  try {
+    if (!existsSync6(CREDS_PATH2)) return null;
+    const creds = JSON.parse(readFileSync5(CREDS_PATH2, "utf-8"));
+    return creds.access_token || null;
+  } catch {
+    return null;
+  }
+}
+function rowToWire(r) {
+  return {
+    client_event_id: r.client_event_id,
+    event_type: r.event_type,
+    occurred_at: r.occurred_at,
+    install_id: r.install_id,
+    user_id: r.user_id,
+    org_id: r.org_id,
+    email: r.email,
+    cli_version: r.cli_version,
+    emitter: r.emitter,
+    agent_kind: r.agent_kind,
+    cc_session_id: r.cc_session_id,
+    cc_tool_use_id: r.cc_tool_use_id,
+    cc_turn_id: r.cc_turn_id,
+    cc_model: r.cc_model,
+    permission_mode: r.permission_mode,
+    cwd: r.cwd,
+    repo: r.repo,
+    git_branch: r.git_branch,
+    git_sha: r.git_sha,
+    policy_name: r.policy_name,
+    capture_depth: r.capture_depth,
+    platform: r.platform,
+    hostname_hash: r.hostname_hash,
+    node_version: r.node_version,
+    context: r.context ?? {}
+  };
+}
+function batchRows(rows) {
+  return batchBySizeAndCount(rows, (r) => JSON.stringify(rowToWire(r)).length);
+}
+async function flush(opts) {
+  const state = await getTelemetryState();
+  if (!state.enabled) return { sent: 0, failed: 0, mirrored: 0, skipped_reason: "disabled" };
+  const lockFd = acquireQueueLock();
+  if (lockFd === null) return { sent: 0, failed: 0, mirrored: 0, skipped_reason: "locked" };
+  try {
+    recoverProcessing();
+    const { rows } = rotateQueueForProcessing();
+    if (rows.length === 0) {
+      finalizeProcessing([]);
+      return { sent: 0, failed: 0, mirrored: 0, skipped_reason: "no_pending" };
+    }
+    const jwt2 = loadJwt();
+    const remoteEnabled = state.remoteFlushEnabled && !!jwt2;
+    const meta = readMetaCache();
+    let throttled = false;
+    if (!opts?.force && meta.last_flush_ok_at) {
+      const ms = Date.parse(meta.last_flush_ok_at);
+      if (Number.isFinite(ms) && Date.now() - ms < THROTTLE_MS) throttled = true;
+    }
+    const doRemote = remoteEnabled && !throttled;
+    const sql = await connectDb();
+    const pgliteMirrored = /* @__PURE__ */ new Set();
+    let mirrored = 0;
+    if (sql) {
+      try {
+        mirrored = await insertEvents(sql, rows, pgliteMirrored);
+      } catch (err) {
+        const m = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`[synkro] telemetry local mirror failed: ${m}
+`);
+      }
+    }
+    const remoteResolved = /* @__PURE__ */ new Set();
+    let sent = 0;
+    let remoteErr = "";
+    if (doRemote) {
+      const endpoint = `${resolveGatewayUrl()}${TELEMETRY_FLUSH_PATH}`;
+      const identity = getIdentity();
+      for (const batch of batchRows(rows)) {
+        const body = JSON.stringify({
+          install_id: identity.install_id,
+          cli_version: identity.cli_version,
+          platform: identity.platform,
+          events: batch.map(rowToWire)
+        });
+        let resp = null;
+        try {
+          resp = await fetch(endpoint, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", "Authorization": `Bearer ${jwt2}` },
+            body,
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+          });
+        } catch (err) {
+          remoteErr = err instanceof Error ? err.message : String(err);
+          break;
+        }
+        if (resp.ok) {
+          for (const r of batch) remoteResolved.add(r.client_event_id);
+          sent += batch.length;
+        } else if (isUnrecoverable(resp.status)) {
+          for (const r of batch) remoteResolved.add(r.client_event_id);
+          remoteErr = `HTTP ${resp.status} (dropped ${batch.length})`;
+          process.stderr.write(`[synkro] telemetry flush dropped ${batch.length} unrecoverable event(s): ${remoteErr}
+`);
+        } else {
+          remoteErr = `HTTP ${resp.status}`;
+          break;
+        }
+      }
+    }
+    const survivors = rows.filter(
+      (r) => remoteEnabled ? !remoteResolved.has(r.client_event_id) : !pgliteMirrored.has(r.client_event_id)
+    );
+    finalizeProcessing(survivors);
+    if (doRemote) {
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const patch = { last_flush_at: now };
+      if (sent > 0) patch.last_flush_ok_at = now;
+      if (remoteErr) patch.last_flush_error = remoteErr;
+      patchMetaCache(patch);
+    }
+    const failed = survivors.length;
+    let skipped;
+    if (!doRemote) skipped = remoteEnabled ? "throttled" : state.remoteFlushEnabled ? "no_jwt" : "remote_disabled";
+    return { sent, failed, mirrored, skipped_reason: skipped };
+  } finally {
+    releaseQueueLock(lockFd);
+  }
+}
+function flushDetached() {
+  if (process.env.SYNKRO_TELEMETRY_DETACHED === "1") return;
+  try {
+    const node = process.execPath;
+    const script = process.argv[1];
+    if (!script) return;
+    const child = spawn(node, [script, "telemetry", "flush", "--detached"], {
+      stdio: "ignore",
+      detached: true,
+      env: { ...process.env, SYNKRO_TELEMETRY_EMITTER: "flush-detached", SYNKRO_TELEMETRY_DETACHED: "1" }
+    });
+    child.unref();
+  } catch {
+  }
+}
+var SYNKRO_DIR5, CONFIG_PATH2, CREDS_PATH2, THROTTLE_MS, DEFAULT_GATEWAY;
+var init_flush = __esm({
+  "cli/telemetry/flush.ts"() {
+    "use strict";
+    init_db();
+    init_drain();
+    init_identity();
+    init_optout();
+    init_metaCache();
+    init_wire();
+    SYNKRO_DIR5 = join6(homedir6(), ".synkro");
+    CONFIG_PATH2 = join6(SYNKRO_DIR5, "config.env");
+    CREDS_PATH2 = process.env.SYNKRO_CREDENTIALS_PATH || join6(SYNKRO_DIR5, "credentials.json");
+    THROTTLE_MS = 6e4;
+    DEFAULT_GATEWAY = "https://api.synkro.sh";
+  }
+});
+
+// cli/telemetry/stats.ts
+import { existsSync as existsSync7, readFileSync as readFileSync6, statSync, writeFileSync as writeFileSync4 } from "fs";
+function countPending() {
+  if (!existsSync7(PENDING_PATH)) return 0;
+  try {
+    const raw = readFileSync6(PENDING_PATH, "utf-8");
+    if (!raw) return 0;
+    let n = 0;
+    for (const line of raw.split("\n")) if (line.trim()) n++;
+    return n;
+  } catch {
+    return 0;
+  }
+}
+async function getStats() {
+  const identity = getIdentity();
+  const state = await getTelemetryState();
+  await drainToPglite();
+  const meta = readMetaCache();
+  const base = {
+    total_events: 0,
+    pending_local: countPending(),
+    by_type: {},
+    pglite_reachable: false,
+    install_id: identity.install_id,
+    enabled: state.enabled,
+    remote_flush_enabled: state.remoteFlushEnabled,
+    last_drained_at: meta.last_drained_at,
+    // Flush state lives in metaCache, so it's available even with no pglite.
+    last_flush_at: meta.last_flush_at,
+    last_flush_ok_at: meta.last_flush_ok_at,
+    last_flush_error: meta.last_flush_error
+  };
+  const sql = await connectDb();
+  if (!sql) return base;
+  base.pglite_reachable = true;
+  try {
+    const total = await sql`SELECT COUNT(*)::int AS c FROM telemetry_events`;
+    base.total_events = Number(total[0]?.c ?? 0);
+    const types = await sql`
+      SELECT event_type, COUNT(*)::int AS c
+      FROM telemetry_events
+      GROUP BY event_type
+      ORDER BY c DESC
+    `;
+    for (const row of types) base.by_type[String(row.event_type)] = Number(row.c);
+    const newest = await sql`
+      SELECT occurred_at FROM telemetry_events ORDER BY occurred_at DESC LIMIT 1
+    `;
+    if (newest.length) base.newest = new Date(newest[0].occurred_at).toISOString();
+  } catch {
+  }
+  return base;
+}
+async function tail(opts = {}) {
+  await drainToPglite();
+  const sql = await connectDb();
+  if (!sql) return [];
+  const limit = Math.max(1, Math.min(opts.limit ?? 20, 1e3));
+  try {
+    if (opts.eventType && opts.sessionId) {
+      return await sql`
+        SELECT * FROM telemetry_events
+        WHERE event_type = ${opts.eventType}
+          AND cc_session_id = ${opts.sessionId}
+        ORDER BY occurred_at DESC LIMIT ${limit}
+      `;
+    }
+    if (opts.eventType) {
+      return await sql`
+        SELECT * FROM telemetry_events
+        WHERE event_type = ${opts.eventType}
+        ORDER BY occurred_at DESC LIMIT ${limit}
+      `;
+    }
+    if (opts.sessionId) {
+      return await sql`
+        SELECT * FROM telemetry_events
+        WHERE cc_session_id = ${opts.sessionId}
+        ORDER BY occurred_at DESC LIMIT ${limit}
+      `;
+    }
+    return await sql`
+      SELECT * FROM telemetry_events
+      ORDER BY occurred_at DESC LIMIT ${limit}
+    `;
+  } catch {
+    return [];
+  }
+}
+async function exportEvents(path) {
+  await drainToPglite();
+  const sql = await connectDb();
+  if (!sql) {
+    writeFileSync4(path, "", "utf-8");
+    return;
+  }
+  const lines = [];
+  try {
+    const rows = await sql`SELECT * FROM telemetry_events ORDER BY occurred_at ASC`;
+    for (const row of rows) {
+      lines.push(JSON.stringify(row));
+    }
+  } catch {
+  }
+  writeFileSync4(path, lines.join("\n") + (lines.length > 0 ? "\n" : ""), "utf-8");
+}
+function pendingFileSize() {
+  try {
+    return existsSync7(PENDING_PATH) ? statSync(PENDING_PATH).size : 0;
+  } catch {
+    return 0;
+  }
+}
+var init_stats = __esm({
+  "cli/telemetry/stats.ts"() {
+    "use strict";
+    init_db();
+    init_drain();
+    init_emit();
+    init_identity();
+    init_optout();
+    init_metaCache();
+  }
+});
+
+// cli/telemetry/purge.ts
+import { existsSync as existsSync8, readFileSync as readFileSync7, unlinkSync as unlinkSync2 } from "fs";
+import { randomUUID as randomUUID3 } from "crypto";
+function unlinkPendingCount() {
+  if (!existsSync8(PENDING_PATH)) return 0;
+  let n = 0;
+  try {
+    const raw = readFileSync7(PENDING_PATH, "utf-8");
+    for (const line of raw.split("\n")) if (line.trim()) n++;
+  } catch {
+  }
+  try {
+    unlinkSync2(PENDING_PATH);
+  } catch {
+  }
+  return n;
+}
+async function purge(opts = {}) {
+  const keep = opts.keepInstallId ?? true;
+  const pending = unlinkPendingCount();
+  const sql = await connectDb();
+  if (!sql) {
+    if (!keep) {
+      patchMetaCache({ install_id: randomUUID3() });
+    }
+    return {
+      removed_events: pending,
+      removed_meta: !keep,
+      removed_pending: pending,
+      pglite_reachable: false
+    };
+  }
+  let removedEvents = 0;
+  try {
+    const [{ c }] = await sql`SELECT COUNT(*)::int AS c FROM telemetry_events`;
+    removedEvents = Number(c ?? 0);
+    await sql`TRUNCATE TABLE telemetry_events RESTART IDENTITY`;
+  } catch {
+  }
+  let removedMeta = false;
+  try {
+    if (keep) {
+      const meta = readMetaCache();
+      await sql`DELETE FROM telemetry_meta WHERE k NOT IN ('schema_version')`;
+      await sql`
+        INSERT INTO telemetry_meta (k, v) VALUES ('install_id', ${meta.install_id})
+        ON CONFLICT (k) DO UPDATE SET v = EXCLUDED.v
+      `;
+      removedMeta = true;
+    } else {
+      const newId = randomUUID3();
+      await sql`DELETE FROM telemetry_meta WHERE k NOT IN ('schema_version')`;
+      await sql`
+        INSERT INTO telemetry_meta (k, v) VALUES ('install_id', ${newId})
+        ON CONFLICT (k) DO UPDATE SET v = EXCLUDED.v
+      `;
+      patchMetaCache({ install_id: newId });
+      removedMeta = true;
+    }
+  } catch {
+  }
+  return {
+    removed_events: removedEvents,
+    removed_meta: removedMeta,
+    removed_pending: pending,
+    pglite_reachable: true
+  };
+}
+var init_purge = __esm({
+  "cli/telemetry/purge.ts"() {
+    "use strict";
+    init_db();
+    init_emit();
+    init_metaCache();
+  }
+});
+
+// cli/telemetry/client.ts
+import { randomUUID as randomUUID4 } from "crypto";
+var TelemetryClient, telemetry;
+var init_client = __esm({
+  "cli/telemetry/client.ts"() {
+    "use strict";
+    TelemetryClient = class {
+      async track(_eventType, _data) {
+        return randomUUID4();
+      }
+      async createPreferencePair(_data) {
+        return randomUUID4();
+      }
+      async updatePreferencePair(_id, _acceptedState) {
+      }
+    };
+    telemetry = new TelemetryClient();
+  }
+});
+
+// cli/telemetry/export.ts
+import { writeFileSync as writeFileSync5 } from "fs";
+async function exportPreferencePairs(outputPath) {
+  writeFileSync5(outputPath, "");
+  return 0;
+}
+async function exportCompletions(outputPath) {
+  writeFileSync5(outputPath, "");
+  return 0;
+}
+async function getTelemetryStats() {
+  return {
+    totalEvents: 0,
+    totalPreferencePairs: 0,
+    completePreferencePairs: 0,
+    pipelineCompletions: 0
+  };
+}
+var init_export = __esm({
+  "cli/telemetry/export.ts"() {
+    "use strict";
+  }
+});
+
+// cli/telemetry/index.ts
+var telemetry_exports = {};
+__export(telemetry_exports, {
+  PENDING_PATH: () => PENDING_PATH,
+  acquireQueueLock: () => acquireQueueLock,
+  closeDb: () => closeDb,
+  connectDb: () => connectDb,
+  drainToPglite: () => drainToPglite,
+  emit: () => emit,
+  exportCompletions: () => exportCompletions,
+  exportEvents: () => exportEvents,
+  exportPreferencePairs: () => exportPreferencePairs,
+  flush: () => flush,
+  flushDetached: () => flushDetached,
+  getIdentity: () => getIdentity,
+  getStats: () => getStats,
+  getTelemetryState: () => getTelemetryState,
+  getTelemetryStateSync: () => getTelemetryStateSync,
+  getTelemetryStats: () => getTelemetryStats,
+  insertEvents: () => insertEvents,
+  patchMetaCache: () => patchMetaCache,
+  pendingFileSize: () => pendingFileSize,
+  purge: () => purge,
+  readMetaCache: () => readMetaCache,
+  readQueue: () => readQueue,
+  releaseQueueLock: () => releaseQueueLock,
+  rewriteQueue: () => rewriteQueue,
+  setTelemetryState: () => setTelemetryState,
+  tail: () => tail,
+  telemetry: () => telemetry,
+  writeMetaCache: () => writeMetaCache
+});
+var init_telemetry = __esm({
+  "cli/telemetry/index.ts"() {
+    "use strict";
+    init_emit();
+    init_identity();
+    init_db();
+    init_drain();
+    init_optout();
+    init_flush();
+    init_stats();
+    init_purge();
+    init_metaCache();
+    init_client();
+    init_export();
+  }
+});
+
 // cli/installer/agentDetect.ts
-import { existsSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
-import { execFileSync, execSync } from "child_process";
+import { existsSync as existsSync9 } from "fs";
+import { homedir as homedir7 } from "os";
+import { join as join7 } from "path";
+import { execFileSync as execFileSync2, execSync } from "child_process";
 function which(cmd2) {
   try {
     const result = execSync(`which ${cmd2}`, { encoding: "utf-8" }).trim();
@@ -30,7 +1335,7 @@ function which(cmd2) {
 }
 function getVersion(cmd2) {
   try {
-    const result = execFileSync(cmd2, ["--version"], { encoding: "utf-8", timeout: 5e3 }).trim();
+    const result = execFileSync2(cmd2, ["--version"], { encoding: "utf-8", timeout: 5e3 }).trim();
     const line = result.split("\n")[0];
     return line.replace(/\s*\(Claude Code\)/, "");
   } catch {
@@ -39,23 +1344,23 @@ function getVersion(cmd2) {
 }
 function detectAgents() {
   const agents = [];
-  const home = homedir();
+  const home = homedir7();
   const claudeBinary = which("claude");
-  const claudeConfigDir = join(home, ".claude");
+  const claudeConfigDir = join7(home, ".claude");
   if (claudeBinary) {
     agents.push({
       kind: "claude_code",
       name: "Claude Code",
       binaryPath: claudeBinary,
       configDir: claudeConfigDir,
-      settingsPath: join(claudeConfigDir, "settings.json"),
+      settingsPath: join7(claudeConfigDir, "settings.json"),
       version: getVersion("claude")
     });
   }
   const cursorBinary = which("cursor");
-  const cursorConfigDir = join(home, ".cursor");
-  const cursorApp = process.platform === "darwin" && existsSync("/Applications/Cursor.app");
-  if (cursorBinary || cursorApp || existsSync(cursorConfigDir)) {
+  const cursorConfigDir = join7(home, ".cursor");
+  const cursorApp = process.platform === "darwin" && existsSync9("/Applications/Cursor.app");
+  if (cursorBinary || cursorApp || existsSync9(cursorConfigDir)) {
     let version;
     if (cursorBinary) {
       version = getVersion("cursor");
@@ -71,7 +1376,7 @@ function detectAgents() {
       name: "Cursor",
       binaryPath: cursorBinary,
       configDir: cursorConfigDir,
-      settingsPath: join(cursorConfigDir, "hooks.json"),
+      settingsPath: join7(cursorConfigDir, "hooks.json"),
       version
     });
   }
@@ -84,22 +1389,22 @@ var init_agentDetect = __esm({
 });
 
 // cli/installer/ccHookConfig.ts
-import { existsSync as existsSync2, readFileSync, writeFileSync, renameSync, mkdirSync } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync6, renameSync as renameSync3, mkdirSync as mkdirSync4 } from "fs";
 import { dirname } from "path";
 function readSettings(path) {
-  if (!existsSync2(path)) return {};
+  if (!existsSync10(path)) return {};
   try {
-    const raw = readFileSync(path, "utf-8");
+    const raw = readFileSync8(path, "utf-8");
     return JSON.parse(raw);
   } catch (err) {
     throw new Error(`Failed to parse ${path}: ${err.message}`);
   }
 }
 function writeSettingsAtomic(path, settings) {
-  mkdirSync(dirname(path), { recursive: true });
+  mkdirSync4(dirname(path), { recursive: true });
   const tmpPath = `${path}.synkro.tmp`;
-  writeFileSync(tmpPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
-  renameSync(tmpPath, path);
+  writeFileSync6(tmpPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
+  renameSync3(tmpPath, path);
 }
 function isSynkroEntry(entry) {
   if (entry?.[SYNKRO_MARKER]) return true;
@@ -290,7 +1595,7 @@ function installCCHooks(settingsPath, config) {
   writeSettingsAtomic(settingsPath, settings);
 }
 function uninstallCCHooks(settingsPath) {
-  if (!existsSync2(settingsPath)) return false;
+  if (!existsSync10(settingsPath)) return false;
   const settings = readSettings(settingsPath);
   if (!settings.hooks) return false;
   const events = ["PreToolUse", "PostToolUse", "SessionEnd", "SessionStart", "Stop", "UserPromptSubmit"];
@@ -322,9 +1627,9 @@ var init_ccHookConfig = __esm({
 });
 
 // cli/installer/cursorHookConfig.ts
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, renameSync as renameSync2, mkdirSync as mkdirSync2 } from "fs";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync7, renameSync as renameSync4, mkdirSync as mkdirSync5 } from "fs";
 import { dirname as dirname2, resolve, normalize } from "path";
-import { homedir as homedir2 } from "os";
+import { homedir as homedir8 } from "os";
 function shellQuote(s) {
   return "'" + s.replace(/'/g, "'\\''") + "'";
 }
@@ -344,7 +1649,7 @@ function validateHooksPath(path) {
 function readHooksFile(rawPath) {
   const safePath = validateHooksPath(rawPath);
   try {
-    const raw = readFileSync2(safePath, "utf-8");
+    const raw = readFileSync9(safePath, "utf-8");
     return JSON.parse(raw);
   } catch (err) {
     if (err?.code === "ENOENT") return { version: 1, hooks: {} };
@@ -353,10 +1658,10 @@ function readHooksFile(rawPath) {
 }
 function writeHooksFileAtomic(rawPath, data) {
   const safePath = validateHooksPath(rawPath);
-  mkdirSync2(dirname2(safePath), { recursive: true });
+  mkdirSync5(dirname2(safePath), { recursive: true });
   const tmpPath = `${safePath}.synkro.tmp`;
-  writeFileSync2(tmpPath, JSON.stringify(data, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
-  renameSync2(tmpPath, safePath);
+  writeFileSync7(tmpPath, JSON.stringify(data, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
+  renameSync4(tmpPath, safePath);
 }
 function isSynkroEntry2(entry) {
   if (entry?.[SYNKRO_MARKER2]) return true;
@@ -525,8 +1830,8 @@ var init_cursorHookConfig = __esm({
     "use strict";
     SYNKRO_MARKER2 = "__synkro_managed__";
     ALLOWED_PARENT_DIRS = [
-      resolve(homedir2(), ".cursor"),
-      resolve(homedir2(), ".config", "cursor")
+      resolve(homedir8(), ".cursor"),
+      resolve(homedir8(), ".config", "cursor")
     ];
     ALL_EVENTS = [
       "sessionStart",
@@ -546,25 +1851,25 @@ var init_cursorHookConfig = __esm({
 });
 
 // cli/installer/mcpConfig.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3, renameSync as renameSync3, mkdirSync as mkdirSync3 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname3, join as join2 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync10, writeFileSync as writeFileSync8, renameSync as renameSync5, mkdirSync as mkdirSync6 } from "fs";
+import { homedir as homedir9 } from "os";
+import { dirname as dirname3, join as join8 } from "path";
 import { spawnSync } from "child_process";
 import { randomBytes } from "crypto";
 function readClaudeJson() {
-  if (!existsSync3(CC_CONFIG_PATH)) return {};
+  if (!existsSync11(CC_CONFIG_PATH)) return {};
   try {
-    const raw = readFileSync3(CC_CONFIG_PATH, "utf-8");
+    const raw = readFileSync10(CC_CONFIG_PATH, "utf-8");
     return JSON.parse(raw);
   } catch (err) {
     throw new Error(`Failed to parse ${CC_CONFIG_PATH}: ${err.message}`);
   }
 }
 function writeClaudeJsonAtomic(config) {
-  mkdirSync3(dirname3(CC_CONFIG_PATH), { recursive: true });
+  mkdirSync6(dirname3(CC_CONFIG_PATH), { recursive: true });
   const tmpPath = `${CC_CONFIG_PATH}.synkro.tmp`;
-  writeFileSync3(tmpPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
-  renameSync3(tmpPath, CC_CONFIG_PATH);
+  writeFileSync8(tmpPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  renameSync5(tmpPath, CC_CONFIG_PATH);
 }
 function installMcpConfig(opts) {
   const config = readClaudeJson();
@@ -573,7 +1878,7 @@ function installMcpConfig(opts) {
     if (entry?.[SYNKRO_MARKER3] === true) delete config.mcpServers[name];
   }
   if (opts.local) {
-    const proxyScript = join2(homedir3(), ".synkro", "hooks", "mcp-stdio-proxy.ts");
+    const proxyScript = join8(homedir9(), ".synkro", "hooks", "mcp-stdio-proxy.ts");
     config.mcpServers[SYNKRO_SERVER_NAME] = {
       type: "stdio",
       command: "bun",
@@ -594,7 +1899,7 @@ function installMcpConfig(opts) {
   return { path: CC_CONFIG_PATH, url };
 }
 function uninstallMcpConfig() {
-  if (!existsSync3(CC_CONFIG_PATH)) return false;
+  if (!existsSync11(CC_CONFIG_PATH)) return false;
   const config = readClaudeJson();
   if (!config.mcpServers || Object.keys(config.mcpServers).length === 0) return false;
   let removed = false;
@@ -610,19 +1915,19 @@ function uninstallMcpConfig() {
   return true;
 }
 function readCursorMcpJson() {
-  if (!existsSync3(CURSOR_MCP_PATH)) return {};
+  if (!existsSync11(CURSOR_MCP_PATH)) return {};
   try {
-    const raw = readFileSync3(CURSOR_MCP_PATH, "utf-8");
+    const raw = readFileSync10(CURSOR_MCP_PATH, "utf-8");
     return JSON.parse(raw);
   } catch (err) {
     throw new Error(`Failed to parse ${CURSOR_MCP_PATH}: ${err.message}`);
   }
 }
 function writeCursorMcpJsonAtomic(config) {
-  mkdirSync3(dirname3(CURSOR_MCP_PATH), { recursive: true });
+  mkdirSync6(dirname3(CURSOR_MCP_PATH), { recursive: true });
   const tmpPath = `${CURSOR_MCP_PATH}.synkro.tmp`;
-  writeFileSync3(tmpPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
-  renameSync3(tmpPath, CURSOR_MCP_PATH);
+  writeFileSync8(tmpPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  renameSync5(tmpPath, CURSOR_MCP_PATH);
 }
 function installCursorMcpConfig(opts) {
   const config = readCursorMcpJson();
@@ -633,10 +1938,10 @@ function installCursorMcpConfig(opts) {
   if (opts.local) {
     const port = process.env.SYNKRO_MCP_PORT || "18931";
     const url2 = `http://127.0.0.1:${port}/`;
-    const jwtPath = join2(homedir3(), ".synkro", ".mcp-jwt");
+    const jwtPath = join8(homedir9(), ".synkro", ".mcp-jwt");
     let jwt2 = "";
     try {
-      jwt2 = readFileSync3(jwtPath, "utf-8").trim();
+      jwt2 = readFileSync10(jwtPath, "utf-8").trim();
     } catch {
     }
     config.mcpServers[SYNKRO_SERVER_NAME] = {
@@ -657,7 +1962,7 @@ function installCursorMcpConfig(opts) {
   return { path: CURSOR_MCP_PATH, url };
 }
 function uninstallCursorMcpConfig() {
-  if (!existsSync3(CURSOR_MCP_PATH)) return false;
+  if (!existsSync11(CURSOR_MCP_PATH)) return false;
   const config = readCursorMcpJson();
   if (!config.mcpServers || Object.keys(config.mcpServers).length === 0) return false;
   let removed = false;
@@ -676,27 +1981,27 @@ function resolveBunBin() {
   const r = spawnSync("which", ["bun"], { encoding: "utf-8", timeout: 5e3 });
   const resolved = (r.stdout || "").split("\n")[0].trim();
   if (resolved) return resolved;
-  for (const p of ["/opt/homebrew/bin/bun", "/usr/local/bin/bun", join2(homedir3(), ".bun", "bin", "bun")]) {
-    if (existsSync3(p)) return p;
+  for (const p of ["/opt/homebrew/bin/bun", "/usr/local/bin/bun", join8(homedir9(), ".bun", "bin", "bun")]) {
+    if (existsSync11(p)) return p;
   }
   return "bun";
 }
 function readDesktopJson() {
-  if (!existsSync3(CLAUDE_DESKTOP_CONFIG_PATH)) return {};
+  if (!existsSync11(CLAUDE_DESKTOP_CONFIG_PATH)) return {};
   try {
-    return JSON.parse(readFileSync3(CLAUDE_DESKTOP_CONFIG_PATH, "utf-8"));
+    return JSON.parse(readFileSync10(CLAUDE_DESKTOP_CONFIG_PATH, "utf-8"));
   } catch (err) {
     throw new Error(`Failed to parse ${CLAUDE_DESKTOP_CONFIG_PATH}: ${err.message}`);
   }
 }
 function writeDesktopJsonAtomic(config) {
-  mkdirSync3(dirname3(CLAUDE_DESKTOP_CONFIG_PATH), { recursive: true });
+  mkdirSync6(dirname3(CLAUDE_DESKTOP_CONFIG_PATH), { recursive: true });
   const tmpPath = `${CLAUDE_DESKTOP_CONFIG_PATH}.synkro.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
-  writeFileSync3(tmpPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
-  renameSync3(tmpPath, CLAUDE_DESKTOP_CONFIG_PATH);
+  writeFileSync8(tmpPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  renameSync5(tmpPath, CLAUDE_DESKTOP_CONFIG_PATH);
 }
 function installClaudeDesktopMcpConfig() {
-  if (!existsSync3(MCP_STDIO_PROXY_PATH)) {
+  if (!existsSync11(MCP_STDIO_PROXY_PATH)) {
     return {
       ok: false,
       path: CLAUDE_DESKTOP_CONFIG_PATH,
@@ -719,7 +2024,7 @@ function installClaudeDesktopMcpConfig() {
   return { ok: true, path: CLAUDE_DESKTOP_CONFIG_PATH, proxy: MCP_STDIO_PROXY_PATH };
 }
 function uninstallClaudeDesktopMcpConfig() {
-  if (!existsSync3(CLAUDE_DESKTOP_CONFIG_PATH)) return false;
+  if (!existsSync11(CLAUDE_DESKTOP_CONFIG_PATH)) return false;
   const config = readDesktopJson();
   if (!config.mcpServers || Object.keys(config.mcpServers).length === 0) return false;
   let removed = false;
@@ -740,24 +2045,24 @@ var init_mcpConfig = __esm({
     "use strict";
     SYNKRO_MARKER3 = "__synkro_managed__";
     SYNKRO_SERVER_NAME = "synkro-guardrails";
-    CC_CONFIG_PATH = join2(homedir3(), ".claude.json");
-    CURSOR_MCP_PATH = join2(homedir3(), ".cursor", "mcp.json");
-    CLAUDE_DESKTOP_CONFIG_PATH = join2(
-      homedir3(),
+    CC_CONFIG_PATH = join8(homedir9(), ".claude.json");
+    CURSOR_MCP_PATH = join8(homedir9(), ".cursor", "mcp.json");
+    CLAUDE_DESKTOP_CONFIG_PATH = join8(
+      homedir9(),
       "Library",
       "Application Support",
       "Claude",
       "claude_desktop_config.json"
     );
-    MCP_STDIO_PROXY_PATH = join2(homedir3(), ".synkro", "hooks", "mcp-stdio-proxy.ts");
+    MCP_STDIO_PROXY_PATH = join8(homedir9(), ".synkro", "hooks", "mcp-stdio-proxy.ts");
   }
 });
 
 // cli/installer/skillParser.ts
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync12 } from "fs";
 import { resolve as resolve2 } from "path";
 function resolveSkillPaths(skills, repoRoot) {
-  return skills.filter((s) => s.endsWith(".md")).map((s) => resolve2(repoRoot, s)).filter((p) => existsSync4(p));
+  return skills.filter((s) => s.endsWith(".md")).map((s) => resolve2(repoRoot, s)).filter((p) => existsSync12(p));
 }
 var init_skillParser = __esm({
   "cli/installer/skillParser.ts"() {
@@ -773,14 +2078,133 @@ var STUB_COMMON_TS, STUB_EDIT_PRECHECK_TS, STUB_CWE_PRECHECK_TS, STUB_CVE_PRECHE
 var init_hookScriptsTs = __esm({
   "cli/installer/hookScriptsTs.ts"() {
     "use strict";
-    STUB_COMMON_TS = String.raw`import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'node:fs';
+    STUB_COMMON_TS = String.raw`import { existsSync, readFileSync, mkdirSync, writeFileSync, appendFileSync, statSync, openSync, readSync, closeSync } from 'node:fs';
 import { execSync } from 'node:child_process';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
+import { randomUUID, createHash } from 'node:crypto';
 
 const HOME = homedir();
 const PORT = process.env.SYNKRO_MCP_PORT || '18931';
 
+// ─── Telemetry: sync JSONL append, drained later by the CLI binary ──────────
+// Matches packages/cli/cli/telemetry/emit.ts. Inlined here so each bun hook
+// is self-contained (no path-relative import to a sibling module that may not
+// exist post-install). Writes to the same ~/.synkro/telemetry-pending.jsonl
+// the CLI binary appends to; ON CONFLICT in drain.ts dedupes.
+const PENDING_JSONL = join(HOME, '.synkro', 'telemetry-pending.jsonl');
+const META_JSON = join(HOME, '.synkro', 'telemetry-meta.json');
+const CREDS_JSON = join(HOME, '.synkro', 'credentials.json');
+
+interface TelemMeta { install_id?: string; enabled?: boolean }
+let _telemMetaCache: TelemMeta | null = null;
+function telemMeta(): TelemMeta {
+  if (_telemMetaCache) return _telemMetaCache;
+  try {
+    _telemMetaCache = JSON.parse(readFileSync(META_JSON, 'utf-8')) as TelemMeta;
+  } catch { _telemMetaCache = {}; }
+  return _telemMetaCache;
+}
+
+interface TelemCreds { user_id?: string; org_id?: string; email?: string }
+let _telemCredsCache: TelemCreds | null = null;
+function telemCreds(): TelemCreds {
+  if (_telemCredsCache) return _telemCredsCache;
+  try {
+    const c = JSON.parse(readFileSync(CREDS_JSON, 'utf-8')) as TelemCreds;
+    _telemCredsCache = { user_id: c.user_id, org_id: c.org_id, email: c.email };
+  } catch { _telemCredsCache = {}; }
+  return _telemCredsCache;
+}
+
+interface HookEmitOpts {
+  agent_kind?: 'claude_code' | 'cursor';
+  cc_session_id?: string;
+  cc_tool_use_id?: string;
+  cc_model?: string;
+  permission_mode?: string;
+  cwd?: string;
+  repo?: string;
+}
+
+export function hookEmit(eventType: string, context: unknown, opts: HookEmitOpts = {}): void {
+  try {
+    const meta = telemMeta();
+    if (meta.enabled === false) return;
+    // Never ship rows with an empty install_id — they can't be attributed. An
+    // absent meta file means the CLI hasn't bootstrapped telemetry yet; skip
+    // rather than emit an orphan row (the CLI metaCache mints the id on install).
+    if (!meta.install_id) return;
+    const creds = telemCreds();
+    const row = {
+      client_event_id: randomUUID(),
+      event_type: eventType,
+      occurred_at: new Date().toISOString(),
+      install_id: meta.install_id,
+      user_id: creds.user_id ?? null,
+      org_id: creds.org_id ?? null,
+      email: creds.email ?? null,
+      cli_version: process.env.SYNKRO_VERSION || '',
+      emitter: process.env.SYNKRO_TELEMETRY_EMITTER || 'hook',
+      agent_kind: opts.agent_kind ?? null,
+      cc_session_id: opts.cc_session_id ?? null,
+      cc_tool_use_id: opts.cc_tool_use_id ?? null,
+      cc_turn_id: null,
+      cc_model: opts.cc_model ?? null,
+      permission_mode: opts.permission_mode ?? null,
+      cwd: opts.cwd ?? null,
+      repo: opts.repo ?? null,
+      git_branch: null,
+      git_sha: null,
+      policy_name: null,
+      capture_depth: null,
+      platform: process.platform,
+      hostname_hash: null,
+      node_version: process.version || '',
+      context,
+    };
+    try { mkdirSync(join(HOME, '.synkro'), { recursive: true }); } catch {}
+    appendFileSync(PENDING_JSONL, JSON.stringify(row) + '\n');
+  } catch { /* never let telemetry block a hook */ }
+}
+
+// Surface name → telemetry event type. One-shot lookup for the runStub wrap.
+function eventForSurface(surface: string): { type: string; sessionPhase?: 'start' | 'end' } {
+  switch (surface) {
+    case 'session-start': return { type: 'session_lifecycle', sessionPhase: 'start' };
+    case 'stop-summary': return { type: 'session_lifecycle', sessionPhase: 'end' };
+    case 'prompt-submit': return { type: 'human_interaction' };
+    case 'bash-followup': return { type: 'human_interaction' };
+    case 'mcp-gate': return { type: 'mcp_tool_use' };
+    case 'plan-judge': return { type: 'plan_review_result' };
+    case 'transcript-sync': return { type: 'tool_call' };
+    default: return { type: 'tool_call' };
+  }
+}
+
+// Inspect the verdict text returned by the local server to derive a coarse
+// verdict for the telemetry row. Both CC and Cursor return JSON; we parse
+// lightly and ignore failures (default 'pass').
+function parseVerdict(text: string, harness: string): 'pass' | 'deny' | 'allow' | 'warning' | 'error' | 'ask' {
+  if (!text) return 'pass';
+  try {
+    const j = JSON.parse(text);
+    if (harness === 'cursor') {
+      const p = j?.permission;
+      if (p === 'deny') return 'deny';
+      if (p === 'allow') return 'allow';
+      return 'pass';
+    }
+    const dec = j?.hookSpecificOutput?.permissionDecision;
+    if (dec === 'deny') return 'deny';
+    // 'ask' is a consent prompt, NOT a block — keep it distinct so it doesn't
+    // manufacture spurious violation rows (only genuine deny/block violates).
+    if (dec === 'ask') return 'ask';
+    if (dec === 'allow') return 'allow';
+    return 'pass';
+  } catch { return 'pass'; }
+}
+
 function loadMcpJwt(): string {
   try { return readFileSync(join(HOME, '.synkro', '.mcp-jwt'), 'utf-8').trim(); } catch { return ''; }
 }
@@ -883,14 +2307,28 @@ interface StubOpts {
 
 export async function runStub(surface: string, opts: StubOpts = {}): Promise<void> {
   const harness = isCursor(opts.harness) ? 'cursor' : 'cc';
+  const startedAt = Date.now();
+  process.env.SYNKRO_TELEMETRY_EMITTER = process.env.SYNKRO_TELEMETRY_EMITTER || ('hook:' + surface);
+  let telemPayload: any = null;
+  let telemCwd = '';
+  let telemSessionId = '';
   try {
     const input = await readStdin();
     if (!input.trim()) { out(failOpen(harness)); return; }
     const payload = JSON.parse(input);
+    telemPayload = payload;
+    telemCwd = (typeof payload?.cwd === 'string' ? payload.cwd : '') || '';
+    telemSessionId = String(payload?.session_id || payload?.conversation_id || '');
 
     // Cloud MCP enforcement: the gate can't reach the local server, so decide
-    // against the org policy directly. Fail-open inside cloudMcpGate.
-    if (surface === 'mcp-gate' && deployIsCloud()) { out(await cloudMcpGate(payload, harness)); return; }
+    // against the org policy directly. Fail-open inside cloudMcpGate. Emit the
+    // same mcp_tool_use (+ violation on block) the local path does, for parity.
+    if (surface === 'mcp-gate' && deployIsCloud()) {
+      const cloudResp = await cloudMcpGate(payload, harness);
+      out(cloudResp);
+      emitStubTelemetry(surface, harness, payload, cloudResp, Date.now() - startedAt, telemCwd, telemSessionId);
+      return;
+    }
 
     const workspaceRoots = Array.isArray(payload.workspace_roots) ? payload.workspace_roots : [];
     const cwd = (typeof payload.cwd === 'string' && payload.cwd) || workspaceRoots[0] || '';
@@ -906,6 +2344,22 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
       try { synkroFileText = readFileSync(join(root, 'synkro.toml'), 'utf-8'); } catch {}
     }
     if (!synkroFileText) {
+      // Repo not onboarded — emit a minimal tool_call so usage analytics still
+      // sees the hook fire, then short-circuit. No verdict, no command body.
+      // transcript-sync is a background sync, not a tool invocation — omit it so
+      // it doesn't inflate tool_call counts. No model derivation on this hot path.
+      if (surface !== 'transcript-sync') {
+        hookEmit('tool_call', {
+          tool_name: String(payload?.tool_name || ''),
+          hook_event: surface === 'bash-followup' ? 'PostToolUse' : 'PreToolUse',
+          tool_input: {},
+          verdict: 'pass',
+          route: 'local',
+          route_fallback_reason: 'repo_not_onboarded',
+          silent: false,
+          duration_ms: Date.now() - startedAt,
+        }, telemPayloadOpts(payload, harness, telemCwd, telemSessionId));
+      }
       if (opts.telemetry) { out(failOpen(harness)); return; }
       const hint = noSynkroHint(sessionId);
       if (!hint) { out(failOpen(harness)); return; }
@@ -985,9 +2439,228 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
       } catch (e) { /* connection refused / timeout → retry below */ }
       if (i < attempts - 1) await new Promise((r) => setTimeout(r, 500 * (i + 1)));
     }
-    out(text || failOpen(harness));
-  } catch {
+    const responseText = text || failOpen(harness);
+    out(responseText);
+    emitStubTelemetry(surface, harness, telemPayload, responseText, Date.now() - startedAt, telemCwd, telemSessionId);
+  } catch (err) {
     out(failOpen(harness));
+    const msg = err instanceof Error ? err.message : String(err);
+    const stack = err instanceof Error ? (err.stack || '') : '';
+    hookEmit('error', {
+      category: 'hook_runtime',
+      code: 'STUB_RUNSTUB_THREW',
+      message: msg.slice(0, 4096),
+      stack: stack.slice(0, 16384),
+      emitter_context: 'runStub:' + surface,
+    }, telemPayloadOpts(telemPayload, harness, telemCwd, telemSessionId));
+  }
+}
+
+// ─── Bounded transcript tail read + model derivation ────────────────────────
+// The CC model lives in the LAST assistant message, always near the end of the
+// transcript. Read at most the last 200KB off disk instead of slurping+splitting
+// the whole file (transcripts reach 100s of MB → O(n^2) per session on the
+// verdict hot path). Only ever called on the ACTIVE path, never when dormant.
+const TRANSCRIPT_TAIL_BYTES = 200000;
+function readTranscriptTail(path: string): string {
+  try {
+    const size = statSync(path).size;
+    if (size <= TRANSCRIPT_TAIL_BYTES) return readFileSync(path, 'utf-8');
+    const fd = openSync(path, 'r');
+    try {
+      const buf = Buffer.allocUnsafe(TRANSCRIPT_TAIL_BYTES);
+      const n = readSync(fd, buf, 0, TRANSCRIPT_TAIL_BYTES, size - TRANSCRIPT_TAIL_BYTES);
+      return buf.subarray(0, n).toString('utf-8');
+    } finally { closeSync(fd); }
+  } catch { return ''; }
+}
+function deriveCcModel(payload: any): string {
+  const tp = (payload && payload.transcript_path) || '';
+  if (!tp || !existsSync(tp)) return '';
+  const lines = readTranscriptTail(tp).split('\n');
+  for (let i = lines.length - 1; i >= 0; i--) {
+    if (!lines[i].includes('"type":"assistant"')) continue;
+    try {
+      const obj = JSON.parse(lines[i]);
+      if (obj?.message?.model) return String(obj.message.model);
+    } catch { /* torn line (tail may start mid-record) — skip, keep scanning */ }
+  }
+  return '';
+}
+
+// ─── Telemetry payload hygiene: scrub + byte-cap + summarize ────────────────
+// Self-contained port of _synkro-common's scrubSecrets — stub mode DELETES
+// _synkro-common.ts, so the stub cannot import it. Same hard-secret patterns +
+// credential key/value redaction; the entropy heuristic is omitted since these
+// rows never carry file bodies and every field is additionally byte-capped.
+const TE_SECRET_PATTERNS: Array<{ type: string; re: RegExp }> = [
+  { type: 'anthropic-key', re: /sk-ant-[A-Za-z0-9_-]{24,}/g },
+  { type: 'openai-key', re: /sk-(?:proj-)?[A-Za-z0-9]{32,}/g },
+  { type: 'aws-access-key', re: /AKIA[0-9A-Z]{16}/g },
+  { type: 'github-token', re: /gh[posru]_[A-Za-z0-9]{36,}/g },
+  { type: 'google-api-key', re: /AIza[0-9A-Za-z_-]{35}/g },
+  { type: 'slack-token', re: /xox[baprs]-[0-9A-Za-z-]{10,}/g },
+  { type: 'stripe-key', re: /[rs]k_(?:live|test)_[A-Za-z0-9]{20,}/g },
+  { type: 'jwt', re: /eyJ[A-Za-z0-9_-]{10,}[.][A-Za-z0-9_-]{10,}[.][A-Za-z0-9_-]{10,}/g },
+  { type: 'private-key', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
+  { type: 'bearer-token', re: /[Bb]earer[ ]+[A-Za-z0-9._-]{20,}/g },
+];
+function isPlaceholderSecret(v: string): boolean {
+  if (/[$<>{}]/.test(v)) return true;
+  const tail = v.replace(/^(sk-ant-|[rs]k_(?:live|test)_|sk-|AKIA|gh[posru]_|AIza|xox[baprs]-|Bearer[ ]+)/, '');
+  return /^(x+|0+|a+|placeholder|example|changeme|your[-_a-z0-9]*|dummy|test|fake|redacted|sample)$/i.test(tail);
+}
+function scrubSecrets(text: string): string {
+  if (!text) return text;
+  let out = text;
+  for (const { type, re } of TE_SECRET_PATTERNS) {
+    out = out.replace(re, (m) => isPlaceholderSecret(m) ? m : '<redacted:' + type + '>');
+  }
+  out = out.replace(/((?:password|passwd|secret|api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|private[_-]?key)["' ]*[=:][ ]*["']?)([^ "'\n]{12,})/gi, (full, pfx, val) => {
+    if (/[$<>{}]/.test(val)) return full;
+    return pfx + '<redacted:credential>';
+  });
+  return out;
+}
+// Byte-cap (not char-cap): multi-byte content must not push a JSONL row past the
+// ~4KB append-atomicity window, above which concurrent hook appends tear.
+function cap(s: string, maxBytes: number): string {
+  if (!s) return s;
+  if (Buffer.byteLength(s, 'utf-8') <= maxBytes) return s;
+  let out = s.slice(0, maxBytes);
+  while (out && Buffer.byteLength(out, 'utf-8') > maxBytes) out = out.slice(0, -1);
+  return out;
+}
+// Field byte budgets. A row's fixed envelope (ids, timestamps, cwd, model) runs
+// ~0.8-1.2KB, so no single free-text field may approach 4KB or the whole JSONL
+// row overruns the append-atomicity window. These leave margin even together.
+const TE_CMD_CAP = 1200;
+const TE_REASON_CAP = 800;
+const TE_EXCERPT_CAP = 1200;
+const TE_PROMPT_CAP = 2400;
+// Never embed a raw tool_input — Write/Edit carry whole file bodies, Bash the raw
+// command, so verbatim rows exfiltrate secrets AND overrun the 4KB row budget.
+// Emit a fixed-size fingerprint: tool name, top-level keys, serialized byte
+// length, short content hash. Bash is the one surface where the command text is
+// itself the signal, so include it scrubbed + byte-capped when asked.
+function toolInputSummary(toolName: string, toolInput: any, includeCommand: boolean): Record<string, any> {
+  let ser = '';
+  try { ser = JSON.stringify(toolInput == null ? {} : toolInput); } catch { ser = String(toolInput); }
+  const isObj = !!toolInput && typeof toolInput === 'object' && !Array.isArray(toolInput);
+  const summary: Record<string, any> = {
+    tool_name: toolName || undefined,
+    keys: isObj ? Object.keys(toolInput).slice(0, 24) : [],
+    bytes: Buffer.byteLength(ser, 'utf-8'),
+    hash: createHash('sha256').update(ser).digest('hex').slice(0, 12),
+  };
+  if (includeCommand && isObj && typeof toolInput.command === 'string' && toolInput.command) {
+    summary.command = cap(scrubSecrets(toolInput.command), TE_CMD_CAP);
+  }
+  return summary;
+}
+
+// cc_model is derived by the caller (bounded tail read) and passed in; this stays
+// allocation-only so the dormant hot path never touches the transcript.
+function telemPayloadOpts(payload: any, harness: string, cwd: string, sessionId: string, ccModel?: string): any {
+  return {
+    agent_kind: harness === 'cursor' ? 'cursor' : 'claude_code',
+    cc_session_id: sessionId || undefined,
+    cc_tool_use_id: payload?.tool_use_id ? String(payload.tool_use_id) : undefined,
+    cc_model: ccModel || undefined,
+    permission_mode: payload?.permission_mode ? String(payload.permission_mode) : undefined,
+    cwd: cwd || undefined,
+  };
+}
+
+function emitStubTelemetry(
+  surface: string, harness: string, payload: any, responseText: string,
+  durationMs: number, cwd: string, sessionId: string,
+): void {
+  // transcript-sync is a background sync, not a tool invocation — no tool_call
+  // row (keeps tool_call counts accurate); its usage lands via session_lifecycle.
+  // Bail before any transcript read so it stays cheap.
+  if (surface === 'transcript-sync') return;
+
+  const opts = telemPayloadOpts(payload, harness, cwd, sessionId, deriveCcModel(payload));
+  const verdict = parseVerdict(responseText, harness);
+  const meta = eventForSurface(surface);
+
+  if (meta.sessionPhase === 'start') {
+    hookEmit('session_lifecycle', {
+      phase: 'start', route: 'local-cc', channel_port: Number(PORT) || 18931,
+      channel_reachable: true, open_findings: 0,
+      transcript_path: payload?.transcript_path || undefined,
+    }, opts);
+    return;
+  }
+  if (meta.sessionPhase === 'end') {
+    hookEmit('session_lifecycle', {
+      phase: 'end', route: 'local-cc', channel_port: Number(PORT) || 18931,
+      channel_reachable: true, open_findings: 0,
+      transcript_path: payload?.transcript_path || undefined,
+    }, opts);
+    return;
+  }
+  if (meta.type === 'human_interaction') {
+    const kind = surface === 'prompt-submit' ? 'prompt_submit' : 'consent_consume';
+    const promptText = surface === 'prompt-submit'
+      ? cap(String(payload?.prompt || payload?.message || payload?.content || ''), TE_PROMPT_CAP)
+      : undefined;
+    hookEmit('human_interaction', { kind, prompt_text: promptText }, opts);
+    return;
+  }
+  if (meta.type === 'mcp_tool_use') {
+    const toolName = String(payload?.tool_name || payload?.tool || '');
+    hookEmit('mcp_tool_use', {
+      tool_name: toolName,
+      args_summary: toolInputSummary(toolName, payload?.tool_input, true),
+      duration_ms: durationMs,
+      success: verdict !== 'deny' && verdict !== 'error',
+    }, opts);
+    if (verdict === 'deny') {
+      hookEmit('violation', {
+        hook_type: 'bash', rule_id: '', rule_mode: 'blocking', severity: 'high',
+        category: 'mcp_governance', reason: 'mcp_blocked',
+        rules_checked: [], violated_rules: [],
+        command: cap(scrubSecrets(toolName), TE_CMD_CAP),
+        tool_name: toolName, hook_event: 'PreToolUse', tool_input: toolInputSummary(toolName, payload?.tool_input, false),
+        verdict: 'block', route: 'local', silent: false, duration_ms: durationMs,
+      }, opts);
+    }
+    return;
+  }
+  if (meta.type === 'plan_review_result') {
+    hookEmit('plan_review_result', {
+      verdict: verdict === 'deny' ? 'advisory' : 'clean',
+      reason: '', plan_excerpt: cap(scrubSecrets(String(payload?.tool_input?.plan || '')), TE_EXCERPT_CAP),
+      rule_ids_relevant: [], route: 'local',
+    }, opts);
+    return;
+  }
+  // Default: tool_call. Add a violation row ONLY on a genuine denial ('ask' is a
+  // consent prompt, not a block). tool_input is summarized, never embedded raw.
+  const toolName = String(payload?.tool_name || '');
+  hookEmit('tool_call', {
+    tool_name: toolName,
+    hook_event: surface === 'bash-followup' ? 'PostToolUse' : 'PreToolUse',
+    tool_input: toolInputSummary(toolName, payload?.tool_input, true),
+    verdict, route: 'local', silent: false, duration_ms: durationMs,
+  }, opts);
+  if (verdict === 'deny') {
+    let hookType: 'bash' | 'edit' | 'plan' | 'cve_scan' | 'cwe_scan' = 'bash';
+    if (surface === 'edit-precheck') hookType = 'edit';
+    else if (surface === 'cwe-precheck') hookType = 'cwe_scan';
+    else if (surface === 'cve-precheck') hookType = 'cve_scan';
+    else if (surface === 'plan-judge') hookType = 'plan';
+    hookEmit('violation', {
+      hook_type: hookType,
+      rule_id: '', rule_mode: 'blocking', severity: 'high', category: 'policy',
+      reason: cap('server-denied', TE_REASON_CAP),
+      rules_checked: [], violated_rules: [],
+      command: cap(scrubSecrets(String(payload?.tool_input?.command || filePathFromToolInput(payload?.tool_input) || '')), TE_CMD_CAP),
+      tool_name: toolName, hook_event: 'PreToolUse', tool_input: toolInputSummary(toolName, payload?.tool_input, false),
+      verdict: 'block', route: 'local', silent: false, duration_ms: durationMs,
+    }, opts);
   }
 }
 `;
@@ -1048,13 +2721,13 @@ __export(stub_exports, {
   saveCredentials: () => saveCredentials
 });
 import { createServer } from "http";
-import { writeFileSync as writeFileSync4, readFileSync as readFileSync4, existsSync as existsSync5, mkdirSync as mkdirSync4, unlinkSync as unlinkSync2 } from "fs";
-import { homedir as homedir4, platform } from "os";
-import { join as join3, dirname as dirname4 } from "path";
+import { writeFileSync as writeFileSync9, readFileSync as readFileSync11, existsSync as existsSync13, mkdirSync as mkdirSync7, unlinkSync as unlinkSync4 } from "fs";
+import { homedir as homedir10, platform as platform2 } from "os";
+import { join as join9, dirname as dirname4 } from "path";
 import { execFile } from "child_process";
 import jwt from "jsonwebtoken";
 function openBrowser(url) {
-  const os = platform();
+  const os = platform2();
   let bin;
   let args2;
   switch (os) {
@@ -1079,17 +2752,17 @@ function openBrowser(url) {
 }
 function saveCredentials(data) {
   const dir = dirname4(AUTH_FILE);
-  if (!existsSync5(dir)) {
-    mkdirSync4(dir, { recursive: true, mode: 448 });
+  if (!existsSync13(dir)) {
+    mkdirSync7(dir, { recursive: true, mode: 448 });
   }
-  writeFileSync4(AUTH_FILE, JSON.stringify(data, null, 2), { mode: 384 });
+  writeFileSync9(AUTH_FILE, JSON.stringify(data, null, 2), { mode: 384 });
 }
 function loadCredentials() {
-  if (!existsSync5(AUTH_FILE)) {
+  if (!existsSync13(AUTH_FILE)) {
     return null;
   }
   try {
-    const content = readFileSync4(AUTH_FILE, "utf8");
+    const content = readFileSync11(AUTH_FILE, "utf8");
     return JSON.parse(content);
   } catch (error) {
     return null;
@@ -1223,22 +2896,22 @@ function createCallbackServer() {
   });
 }
 async function authenticate(onStatus) {
-  const emit = onStatus || (() => {
+  const emit2 = onStatus || (() => {
   });
   try {
-    emit({ phase: "starting" });
+    emit2({ phase: "starting" });
     const serverPromise = createCallbackServer();
     const authUrl = `${SYNKRO_WEB_AUTH_URL}/cli-auth?port=${PORT}`;
     openBrowser(authUrl);
-    emit({ phase: "browser-opened", url: authUrl });
-    emit({ phase: "waiting" });
+    emit2({ phase: "browser-opened", url: authUrl });
+    emit2({ phase: "waiting" });
     const data = await serverPromise;
-    emit({ phase: "success" });
+    emit2({ phase: "success" });
     saveCredentials(data);
     return data;
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    emit({ phase: "error", message });
+    emit2({ phase: "error", message });
     return null;
   }
 }
@@ -1344,8 +3017,8 @@ async function ensureValidToken() {
   return true;
 }
 function clearCredentials() {
-  if (existsSync5(AUTH_FILE)) {
-    unlinkSync2(AUTH_FILE);
+  if (existsSync13(AUTH_FILE)) {
+    unlinkSync4(AUTH_FILE);
   }
 }
 async function getSecrets(userId, integrationId) {
@@ -1364,7 +3037,7 @@ var init_stub = __esm({
     PORT = 8100;
     RAW_WEB_AUTH_URL = process.env.SYNKRO_WEB_AUTH_URL;
     SYNKRO_WEB_AUTH_URL = RAW_WEB_AUTH_URL && /^https?:\/\//.test(RAW_WEB_AUTH_URL) ? RAW_WEB_AUTH_URL : "https://app.synkro.sh";
-    AUTH_FILE = process.env.SYNKRO_AUTH_FILE || join3(homedir4(), ".synkro", "credentials.json");
+    AUTH_FILE = process.env.SYNKRO_AUTH_FILE || join9(homedir10(), ".synkro", "credentials.json");
     RAW_API_URL = process.env.SYNKRO_CRUD_URL || process.env.SYNKRO_API_URL;
     SYNKRO_API_URL = RAW_API_URL && /^https?:\/\//.test(RAW_API_URL) ? RAW_API_URL : "https://api.synkro.sh";
     ERROR_HTML = `
@@ -1524,9 +3197,9 @@ jobs:
 });
 
 // cli/installer/githubSetup.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync8, writeFileSync as writeFileSync10 } from "fs";
 import { execSync as execSync2 } from "child_process";
-import { join as join4 } from "path";
+import { join as join10 } from "path";
 function ghSecretSet(token, owner, repo, name, value) {
   execSync2(`gh secret set ${name} --repo ${owner}/${repo} --body -`, {
     input: value,
@@ -1572,17 +3245,17 @@ async function pushSecretsToRepo(opts, owner, repo, secrets) {
   ghSecretSet(opts.token, owner, repo, "SYNKRO_API_KEY", secrets.synkroApiKey);
 }
 function writeWorkflowFile(repoRootPath) {
-  const workflowDir = join4(repoRootPath, ".github", "workflows");
-  mkdirSync5(workflowDir, { recursive: true });
-  const workflowFile = join4(workflowDir, "synkro.yml");
-  writeFileSync5(workflowFile, SYNKRO_WORKFLOW_YAML, "utf-8");
+  const workflowDir = join10(repoRootPath, ".github", "workflows");
+  mkdirSync8(workflowDir, { recursive: true });
+  const workflowFile = join10(workflowDir, "synkro.yml");
+  writeFileSync10(workflowFile, SYNKRO_WORKFLOW_YAML, "utf-8");
   return workflowFile;
 }
 function findGitRoot(startCwd) {
   let cur = startCwd;
   while (cur && cur !== "/") {
-    if (existsSync6(join4(cur, ".git"))) return cur;
-    const parent = join4(cur, "..");
+    if (existsSync14(join10(cur, ".git"))) return cur;
+    const parent = join10(cur, "..");
     if (parent === cur) break;
     cur = parent;
   }
@@ -1602,7 +3275,7 @@ var init_githubSetup = __esm({
 });
 
 // cli/commands/repoConnect.ts
-import { execSync as execSync3, execFileSync as execFileSync2 } from "child_process";
+import { execSync as execSync3, execFileSync as execFileSync3 } from "child_process";
 import { readdirSync } from "fs";
 import { createServer as createServer2 } from "http";
 import { createInterface } from "readline";
@@ -1626,7 +3299,7 @@ function detectSubdirRepos() {
     for (const entry of entries) {
       if (!entry.isDirectory() || entry.name.startsWith(".")) continue;
       try {
-        const remoteUrl = execFileSync2("git", ["-C", entry.name, "remote", "get-url", "origin"], {
+        const remoteUrl = execFileSync3("git", ["-C", entry.name, "remote", "get-url", "origin"], {
           encoding: "utf-8",
           timeout: 5e3,
           stdio: ["pipe", "pipe", "pipe"]
@@ -1931,12 +3604,12 @@ __export(claudeDesktopTap_exports, {
   claudeDesktopInstalled: () => claudeDesktopInstalled,
   runClaudeDesktopTap: () => runClaudeDesktopTap
 });
-import { spawn } from "child_process";
-import { writeFileSync as writeFileSync6, mkdtempSync, mkdirSync as mkdirSync6, readFileSync as readFileSync5, existsSync as existsSync7 } from "fs";
-import { join as join5 } from "path";
-import { homedir as homedir5 } from "os";
+import { spawn as spawn2 } from "child_process";
+import { writeFileSync as writeFileSync11, mkdtempSync, mkdirSync as mkdirSync9, readFileSync as readFileSync12, existsSync as existsSync15 } from "fs";
+import { join as join11 } from "path";
+import { homedir as homedir11 } from "os";
 function claudeDesktopInstalled() {
-  return process.platform === "darwin" && existsSync7("/Applications/Claude.app/Contents/MacOS/Claude");
+  return process.platform === "darwin" && existsSync15("/Applications/Claude.app/Contents/MacOS/Claude");
 }
 function buildRunner(sessionDir) {
   return `#!/bin/bash
@@ -2050,7 +3723,7 @@ async function runClaudeDesktopTap(opts = {}) {
   }
   let token = "";
   try {
-    token = readFileSync5(JWT_PATH, "utf-8").trim();
+    token = readFileSync12(JWT_PATH, "utf-8").trim();
   } catch {
   }
   if (!token) {
@@ -2071,16 +3744,16 @@ async function runClaudeDesktopTap(opts = {}) {
   } catch (err) {
     console.log(`  \u26A0 Could not register Claude Desktop MCP: ${err.message}`);
   }
-  const cdRoot = join5(homedir5(), ".synkro", "cd-sessions");
-  mkdirSync6(cdRoot, { recursive: true });
-  const sessionDir = mkdtempSync(join5(cdRoot, "synkro-cd-"));
-  writeFileSync6(join5(sessionDir, "tap.py"), ADDON_PY, "utf-8");
-  writeFileSync6(join5(sessionDir, "mcp_proxy.py"), MCP_PROXY_PY, { mode: 493 });
-  writeFileSync6(join5(sessionDir, "mcp_patch.py"), MCP_PATCH_PY, "utf-8");
-  const runnerPath = join5(sessionDir, "run.sh");
-  writeFileSync6(runnerPath, buildRunner(sessionDir), { mode: 493 });
+  const cdRoot = join11(homedir11(), ".synkro", "cd-sessions");
+  mkdirSync9(cdRoot, { recursive: true });
+  const sessionDir = mkdtempSync(join11(cdRoot, "synkro-cd-"));
+  writeFileSync11(join11(sessionDir, "tap.py"), ADDON_PY, "utf-8");
+  writeFileSync11(join11(sessionDir, "mcp_proxy.py"), MCP_PROXY_PY, { mode: 493 });
+  writeFileSync11(join11(sessionDir, "mcp_patch.py"), MCP_PATCH_PY, "utf-8");
+  const runnerPath = join11(sessionDir, "run.sh");
+  writeFileSync11(runnerPath, buildRunner(sessionDir), { mode: 493 });
   await new Promise((resolve4) => {
-    const child = spawn("bash", [runnerPath], {
+    const child = spawn2("bash", [runnerPath], {
       stdio: "inherit",
       env: { ...process.env, SYNKRO_CAPTURE_URL: CAPTURE_URL, SYNKRO_SCAN_URL: SCAN_URL, SYNKRO_SCAN_TURN_URL: SCAN_TURN_URL, SYNKRO_DLP_POLICY_URL: DLP_POLICY_URL, SYNKRO_TURN_VERDICTS_URL: TURN_VERDICTS_URL, SYNKRO_TURN_VERDICT_URL: TURN_VERDICT_URL, SYNKRO_MCP_EVENT_URL: MCP_EVENT_URL, SYNKRO_TAP_TOKEN: token, SYNKRO_TAP_TOKEN_FILE: JWT_PATH, SYNKRO_CD_BACKFILL: opts.backfill ? "1" : "" }
     });
@@ -2111,7 +3784,7 @@ var init_claudeDesktopTap = __esm({
     TURN_VERDICTS_URL = "http://127.0.0.1:18931/api/local/turn-verdicts";
     TURN_VERDICT_URL = "http://127.0.0.1:18931/api/local/turn-verdict";
     MCP_EVENT_URL = "http://127.0.0.1:18931/api/local/mcp/event";
-    JWT_PATH = join5(homedir5(), ".synkro", ".mcp-jwt");
+    JWT_PATH = join11(homedir11(), ".synkro", ".mcp-jwt");
     ADDON_PY = `import os, json, threading, urllib.request, urllib.error, re, base64, time, hashlib
 from mitmproxy import http
 
@@ -3213,7 +4886,7 @@ __export(macKeychain_exports, {
   CURSOR_API_KEY_FILE: () => CURSOR_API_KEY_FILE,
   CURSOR_CREDS_DIR: () => CURSOR_CREDS_DIR,
   KeychainExportError: () => KeychainExportError,
-  SYNKRO_DIR: () => SYNKRO_DIR,
+  SYNKRO_DIR: () => SYNKRO_DIR6,
   credsAreStale: () => credsAreStale,
   cursorApiKeyConfigured: () => cursorApiKeyConfigured,
   exportKeychainCreds: () => exportKeychainCreds,
@@ -3227,15 +4900,15 @@ __export(macKeychain_exports, {
   writeCursorApiKey: () => writeCursorApiKey,
   writeRefreshAgent: () => writeRefreshAgent
 });
-import { existsSync as existsSync8, mkdirSync as mkdirSync7, writeFileSync as writeFileSync7, chmodSync, readFileSync as readFileSync6 } from "fs";
-import { homedir as homedir6, platform as platform2 } from "os";
-import { join as join6 } from "path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync10, writeFileSync as writeFileSync12, chmodSync as chmodSync2, readFileSync as readFileSync13 } from "fs";
+import { homedir as homedir12, platform as platform3 } from "os";
+import { join as join12 } from "path";
 import { spawnSync as spawnSync2 } from "child_process";
 function needsKeychainBridge() {
-  return platform2() === "darwin";
+  return platform3() === "darwin";
 }
 function readKeychainCreds() {
-  if (platform2() !== "darwin") return null;
+  if (platform3() !== "darwin") return null;
   const r = spawnSync2("security", ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-w"], {
     encoding: "utf-8",
     timeout: 5e3
@@ -3247,22 +4920,22 @@ function readKeychainCreds() {
 function exportKeychainCreds() {
   const blob = readKeychainCreds();
   if (!blob) return null;
-  mkdirSync7(CLAUDE_CREDS_DIR, { recursive: true });
-  chmodSync(CLAUDE_CREDS_DIR, 448);
+  mkdirSync10(CLAUDE_CREDS_DIR, { recursive: true });
+  chmodSync2(CLAUDE_CREDS_DIR, 448);
   let changed = true;
   try {
-    if (existsSync8(CLAUDE_CREDS_FILE)) {
-      changed = readFileSync6(CLAUDE_CREDS_FILE, "utf-8") !== blob;
+    if (existsSync16(CLAUDE_CREDS_FILE)) {
+      changed = readFileSync13(CLAUDE_CREDS_FILE, "utf-8") !== blob;
     }
   } catch {
   }
-  if (changed) writeFileSync7(CLAUDE_CREDS_FILE, blob, "utf-8");
-  chmodSync(CLAUDE_CREDS_FILE, 384);
+  if (changed) writeFileSync12(CLAUDE_CREDS_FILE, blob, "utf-8");
+  chmodSync2(CLAUDE_CREDS_FILE, 384);
   return CLAUDE_CREDS_FILE;
 }
 function cursorApiKeyConfigured() {
   try {
-    return existsSync8(CURSOR_API_KEY_FILE) && readFileSync6(CURSOR_API_KEY_FILE, "utf-8").trim().length > 0;
+    return existsSync16(CURSOR_API_KEY_FILE) && readFileSync13(CURSOR_API_KEY_FILE, "utf-8").trim().length > 0;
   } catch {
     return false;
   }
@@ -3270,15 +4943,15 @@ function cursorApiKeyConfigured() {
 function writeCursorApiKey(key) {
   const trimmed = key.trim();
   if (!trimmed) return;
-  mkdirSync7(CURSOR_CREDS_DIR, { recursive: true });
-  chmodSync(CURSOR_CREDS_DIR, 448);
-  writeFileSync7(CURSOR_API_KEY_FILE, trimmed, "utf-8");
-  chmodSync(CURSOR_API_KEY_FILE, 384);
+  mkdirSync10(CURSOR_CREDS_DIR, { recursive: true });
+  chmodSync2(CURSOR_CREDS_DIR, 448);
+  writeFileSync12(CURSOR_API_KEY_FILE, trimmed, "utf-8");
+  chmodSync2(CURSOR_API_KEY_FILE, 384);
 }
 async function validateCursorApiKey() {
   let key;
   try {
-    key = readFileSync6(CURSOR_API_KEY_FILE, "utf-8").trim();
+    key = readFileSync13(CURSOR_API_KEY_FILE, "utf-8").trim();
   } catch {
     return null;
   }
@@ -3297,9 +4970,9 @@ async function validateCursorApiKey() {
   }
 }
 function credsAreStale() {
-  if (!existsSync8(CLAUDE_CREDS_FILE)) return true;
+  if (!existsSync16(CLAUDE_CREDS_FILE)) return true;
   try {
-    const raw = readFileSync6(CLAUDE_CREDS_FILE, "utf-8");
+    const raw = readFileSync13(CLAUDE_CREDS_FILE, "utf-8");
     const exp = JSON.parse(raw)?.claudeAiOauth?.expiresAt ?? 0;
     if (!exp) return true;
     return Date.now() >= exp - REFRESH_EXPIRY_BUFFER_SECONDS * 1e3;
@@ -3311,11 +4984,11 @@ function xmlEscape(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
 }
 function writeRefreshAgent(synkroBinPath) {
-  if (platform2() !== "darwin") {
+  if (platform3() !== "darwin") {
     throw new KeychainExportError("writeRefreshAgent is darwin-only");
   }
-  mkdirSync7(join6(homedir6(), "Library", "LaunchAgents"), { recursive: true });
-  mkdirSync7(SYNKRO_DIR, { recursive: true });
+  mkdirSync10(join12(homedir12(), "Library", "LaunchAgents"), { recursive: true });
+  mkdirSync10(SYNKRO_DIR6, { recursive: true });
   const script = `#!/bin/bash
 # Generated by synkro (writeRefreshAgent). Expiry-aware Claude creds refresher.
 # SYNKRO_BIN / SYNKRO_CF are injected by launchd as environment data \u2014 never
@@ -3340,8 +5013,8 @@ while true; do
   sleep "$delay"
 done
 `;
-  writeFileSync7(REFRESH_SCRIPT, script, "utf-8");
-  chmodSync(REFRESH_SCRIPT, 448);
+  writeFileSync12(REFRESH_SCRIPT, script, "utf-8");
+  chmodSync2(REFRESH_SCRIPT, 448);
   const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -3373,11 +5046,11 @@ done
 </dict>
 </plist>
 `;
-  writeFileSync7(LAUNCHD_PLIST, plist, "utf-8");
+  writeFileSync12(LAUNCHD_PLIST, plist, "utf-8");
   return LAUNCHD_PLIST;
 }
 function loadRefreshAgent() {
-  if (platform2() !== "darwin") return;
+  if (platform3() !== "darwin") return;
   spawnSync2("launchctl", ["bootout", `gui/${process.getuid?.() ?? 501}`, LAUNCHD_PLIST], {
     encoding: "utf-8",
     timeout: 5e3
@@ -3393,15 +5066,15 @@ function loadRefreshAgent() {
   }
 }
 function uninstallRefreshAgent() {
-  if (platform2() !== "darwin") return;
+  if (platform3() !== "darwin") return;
   spawnSync2("launchctl", ["bootout", `gui/${process.getuid?.() ?? 501}`, LAUNCHD_PLIST], {
     encoding: "utf-8",
     timeout: 5e3
   });
   try {
     const fs = __require("fs");
-    if (existsSync8(LAUNCHD_PLIST)) fs.unlinkSync(LAUNCHD_PLIST);
-    if (existsSync8(REFRESH_SCRIPT)) fs.unlinkSync(REFRESH_SCRIPT);
+    if (existsSync16(LAUNCHD_PLIST)) fs.unlinkSync(LAUNCHD_PLIST);
+    if (existsSync16(REFRESH_SCRIPT)) fs.unlinkSync(REFRESH_SCRIPT);
   } catch {
   }
 }
@@ -3411,25 +5084,25 @@ function refreshCreds() {
 }
 function readExportedCreds() {
   try {
-    return readFileSync6(CLAUDE_CREDS_FILE, "utf-8");
+    return readFileSync13(CLAUDE_CREDS_FILE, "utf-8");
   } catch {
     return null;
   }
 }
-var SYNKRO_DIR, CLAUDE_CREDS_DIR, CLAUDE_CREDS_FILE, CURSOR_CREDS_DIR, CURSOR_API_KEY_FILE, KEYCHAIN_SERVICE, LAUNCHD_LABEL, LAUNCHD_PLIST, REFRESH_SCRIPT, REFRESH_LOG, REFRESH_EXPIRY_BUFFER_SECONDS, MIN_REFRESH_INTERVAL_SECONDS, MAX_REFRESH_INTERVAL_SECONDS, KeychainExportError;
+var SYNKRO_DIR6, CLAUDE_CREDS_DIR, CLAUDE_CREDS_FILE, CURSOR_CREDS_DIR, CURSOR_API_KEY_FILE, KEYCHAIN_SERVICE, LAUNCHD_LABEL, LAUNCHD_PLIST, REFRESH_SCRIPT, REFRESH_LOG, REFRESH_EXPIRY_BUFFER_SECONDS, MIN_REFRESH_INTERVAL_SECONDS, MAX_REFRESH_INTERVAL_SECONDS, KeychainExportError;
 var init_macKeychain = __esm({
   "cli/local-cc/macKeychain.ts"() {
     "use strict";
-    SYNKRO_DIR = join6(homedir6(), ".synkro");
-    CLAUDE_CREDS_DIR = join6(SYNKRO_DIR, "claude-creds");
-    CLAUDE_CREDS_FILE = join6(CLAUDE_CREDS_DIR, ".credentials.json");
-    CURSOR_CREDS_DIR = join6(SYNKRO_DIR, "cursor-creds");
-    CURSOR_API_KEY_FILE = join6(CURSOR_CREDS_DIR, "api-key");
+    SYNKRO_DIR6 = join12(homedir12(), ".synkro");
+    CLAUDE_CREDS_DIR = join12(SYNKRO_DIR6, "claude-creds");
+    CLAUDE_CREDS_FILE = join12(CLAUDE_CREDS_DIR, ".credentials.json");
+    CURSOR_CREDS_DIR = join12(SYNKRO_DIR6, "cursor-creds");
+    CURSOR_API_KEY_FILE = join12(CURSOR_CREDS_DIR, "api-key");
     KEYCHAIN_SERVICE = "Claude Code-credentials";
     LAUNCHD_LABEL = "com.synkro.cli.claude-creds-refresh";
-    LAUNCHD_PLIST = join6(homedir6(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
-    REFRESH_SCRIPT = join6(SYNKRO_DIR, "claude-creds-refresh-loop.sh");
-    REFRESH_LOG = join6(SYNKRO_DIR, "claude-creds-refresh.log");
+    LAUNCHD_PLIST = join12(homedir12(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+    REFRESH_SCRIPT = join12(SYNKRO_DIR6, "claude-creds-refresh-loop.sh");
+    REFRESH_LOG = join12(SYNKRO_DIR6, "claude-creds-refresh.log");
     REFRESH_EXPIRY_BUFFER_SECONDS = 120;
     MIN_REFRESH_INTERVAL_SECONDS = 30;
     MAX_REFRESH_INTERVAL_SECONDS = 5 * 60;
@@ -3448,7 +5121,7 @@ var init_macKeychain = __esm({
 var dockerInstall_exports = {};
 __export(dockerInstall_exports, {
   DockerInstallError: () => DockerInstallError,
-  SYNKRO_DIR: () => SYNKRO_DIR2,
+  SYNKRO_DIR: () => SYNKRO_DIR7,
   assertDockerAvailable: () => assertDockerAvailable,
   dockerInstall: () => dockerInstall,
   dockerRemove: () => dockerRemove,
@@ -3468,9 +5141,9 @@ __export(dockerInstall_exports, {
   waitForContainerReady: () => waitForContainerReady,
   waitForWorkersReady: () => waitForWorkersReady
 });
-import { copyFileSync, existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync7, readdirSync as readdirSync2 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join7 } from "path";
+import { copyFileSync, existsSync as existsSync17, mkdirSync as mkdirSync11, readFileSync as readFileSync14, readdirSync as readdirSync2 } from "fs";
+import { homedir as homedir13 } from "os";
+import { join as join13 } from "path";
 import { execSync as execSync4, spawnSync as spawnSync3 } from "child_process";
 function splitWorkers(total, providers) {
   const t = Math.max(0, Math.floor(total));
@@ -3565,9 +5238,9 @@ function readSynkroFileConfig() {
   try {
     const root = execSync4("git rev-parse --show-toplevel 2>/dev/null", { encoding: "utf-8", timeout: 3e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
     if (!root) return { pool: "auto", warnings: [] };
-    const fp = join7(root, "synkro.toml");
-    if (!existsSync9(fp)) return { pool: "auto", warnings: [] };
-    const parsed = parseSynkroToml(readFileSync7(fp, "utf-8"));
+    const fp = join13(root, "synkro.toml");
+    if (!existsSync17(fp)) return { pool: "auto", warnings: [] };
+    const parsed = parseSynkroToml(readFileSync14(fp, "utf-8"));
     return resolveGraderPool(parsed);
   } catch {
   }
@@ -3642,7 +5315,7 @@ function assertDockerAvailable() {
 }
 function claudeCredsHostDir() {
   if (needsKeychainBridge()) return CLAUDE_CREDS_DIR;
-  return join7(homedir7(), ".claude");
+  return join13(homedir13(), ".claude");
 }
 function resolveSynkroBin() {
   const which2 = spawnSync3("which", ["synkro"], { encoding: "utf-8", timeout: 5e3 });
@@ -3695,19 +5368,19 @@ async function dockerInstall(opts = {}) {
   const claudeWorkers = opts.claudeWorkers ?? opts.workersPerPool ?? 8;
   const cursorWorkers = opts.cursorWorkers ?? 0;
   const totalWorkers = claudeWorkers + cursorWorkers;
-  mkdirSync8(PGDATA_PATH, { recursive: true });
-  mkdirSync8(BACKUP_DIR, { recursive: true });
-  mkdirSync8(CLAUDE_HOST_STATE_DIR, { recursive: true });
-  const hostClaudeJson = join7(homedir7(), ".claude.json");
-  if (existsSync9(hostClaudeJson)) {
+  mkdirSync11(PGDATA_PATH, { recursive: true });
+  mkdirSync11(BACKUP_DIR, { recursive: true });
+  mkdirSync11(CLAUDE_HOST_STATE_DIR, { recursive: true });
+  const hostClaudeJson = join13(homedir13(), ".claude.json");
+  if (existsSync17(hostClaudeJson)) {
     copyFileSync(hostClaudeJson, CLAUDE_HOST_STATE_FILE);
   }
-  if (!existsSync9(MCP_JWT_PATH)) {
+  if (!existsSync17(MCP_JWT_PATH)) {
     throw new DockerInstallError(
       `MCP JWT missing at ${MCP_JWT_PATH}. The installer should mint this before calling dockerInstall.`
     );
   }
-  mkdirSync8(CURSOR_CREDS_DIR, { recursive: true });
+  mkdirSync11(CURSOR_CREDS_DIR, { recursive: true });
   if (needsKeychainBridge()) {
     const claudeCredsPath = exportKeychainCreds();
     if (!claudeCredsPath) {
@@ -3731,7 +5404,7 @@ async function dockerInstall(opts = {}) {
       console.warn(`    Plist written to ${plist} \u2014 load manually with launchctl bootstrap when ready.`);
     }
   } else {
-    mkdirSync8(join7(homedir7(), ".claude"), { recursive: true });
+    mkdirSync11(join13(homedir13(), ".claude"), { recursive: true });
   }
   const imageExistsLocally = () => spawnSync3("docker", ["image", "inspect", image], { stdio: "ignore", timeout: 3e4 }).status === 0;
   const skipPull = process.env.SYNKRO_SKIP_PULL === "1" || process.env.SYNKRO_SKIP_PULL === "true";
@@ -3780,11 +5453,11 @@ async function dockerInstall(opts = {}) {
     // sidesteps Docker Desktop for macOS's unreliable single-file bind mounts
     // (which previously left a dangling symlink that blocked container start).
     "-v",
-    `${SYNKRO_DIR2}:/data/synkro-host:ro`,
+    `${SYNKRO_DIR7}:/data/synkro-host:ro`,
     "-v",
     `${credsDir}:/home/synkro/.claude:rw`,
     "-v",
-    `${join7(homedir7(), ".claude")}:/data/claude-host:ro`,
+    `${join13(homedir13(), ".claude")}:/data/claude-host:ro`,
     "-v",
     `${CLAUDE_HOST_STATE_DIR}:/data/claude-host-state:ro`,
     // Cursor creds — mounted RW so the in-container refresher can rotate the
@@ -3814,6 +5487,16 @@ async function dockerInstall(opts = {}) {
     ...process.env.SYNKRO_ORG_ID ? ["-e", `SYNKRO_ORG_ID=${process.env.SYNKRO_ORG_ID}`] : [],
     ...process.env.SYNKRO_USER_ID ? ["-e", `SYNKRO_USER_ID=${process.env.SYNKRO_USER_ID}`] : [],
     ...process.env.SYNKRO_EMAIL ? ["-e", `SYNKRO_EMAIL=${process.env.SYNKRO_EMAIL}`] : [],
+    // Container-owned cloud telemetry flush (docker/telemetryCloudFlush.ts). The
+    // server drains the READ-ONLY host queue (already mounted at
+    // /data/synkro-host via the RO mount above — NO new mount) into its pglite
+    // and pushes unflushed rows to the D1 telemetry worker. The loop is gated on
+    // SYNKRO_TELEMETRY_URL and is harmless when there's nothing to flush, so we
+    // always set it (defaulting to the D1 worker). Override via env to redirect.
+    "-e",
+    `SYNKRO_TELEMETRY_URL=${process.env.SYNKRO_TELEMETRY_URL || "https://admin.synkro.sh"}`,
+    "-e",
+    "SYNKRO_TELEMETRY_QUEUE=/data/synkro-host/telemetry-pending.jsonl",
     image
   ];
   const run = spawnSync3("docker", args2, { encoding: "utf-8", stdio: "inherit", timeout: 6e4 });
@@ -3969,7 +5652,7 @@ async function dockerSafeStart() {
     return { ok: false, pgdataState: "no_container", error: "No synkro-server container found. Run `synkro install` first." };
   }
   const pgCheck = checkPgdata();
-  if (existsSync9(PGDATA_PATH) && readdirSync2(PGDATA_PATH).length > 0) {
+  if (existsSync17(PGDATA_PATH) && readdirSync2(PGDATA_PATH).length > 0) {
     if (pgCheck.healthy) {
       console.log(`  pgdata: existing data found \u2014 ${pgCheck.details}`);
     } else {
@@ -3978,7 +5661,7 @@ async function dockerSafeStart() {
     }
   } else {
     console.log("  pgdata: no existing data \u2014 fresh start.");
-    mkdirSync8(PGDATA_PATH, { recursive: true });
+    mkdirSync11(PGDATA_PATH, { recursive: true });
   }
   console.log("  Starting container...");
   const start = spawnSync3("docker", ["start", CONTAINER_NAME], {
@@ -4009,7 +5692,7 @@ async function dockerSafeRestart() {
   return { ok: startResult.ok, stop: stopResult, start: startResult };
 }
 function checkPgdata() {
-  if (!existsSync9(PGDATA_PATH)) return { healthy: false, details: "pgdata directory does not exist" };
+  if (!existsSync17(PGDATA_PATH)) return { healthy: false, details: "pgdata directory does not exist" };
   const entries = readdirSync2(PGDATA_PATH);
   if (entries.length === 0) return { healthy: true, details: "empty (fresh start)" };
   const hasPidFile = entries.includes("postmaster.pid");
@@ -4020,17 +5703,17 @@ function checkPgdata() {
   if (!hasPgControl) return { healthy: false, details: "pg_control/global directory missing" };
   return { healthy: true, details: `${entries.length} entries, WAL present, no stale PID` };
 }
-var SYNKRO_DIR2, MCP_JWT_PATH, PGDATA_PATH, CLAUDE_HOST_STATE_DIR, CLAUDE_HOST_STATE_FILE, HOST_MCP_PORT, HOST_GRADER_PORT, HOST_CWE_PORT, HOST_PGLITE_PORT, CONTAINER_NAME, DEFAULT_IMAGE, DockerInstallError, BACKUP_DIR;
+var SYNKRO_DIR7, MCP_JWT_PATH, PGDATA_PATH, CLAUDE_HOST_STATE_DIR, CLAUDE_HOST_STATE_FILE, HOST_MCP_PORT, HOST_GRADER_PORT, HOST_CWE_PORT, HOST_PGLITE_PORT, CONTAINER_NAME, DEFAULT_IMAGE, DockerInstallError, BACKUP_DIR;
 var init_dockerInstall = __esm({
   "cli/local-cc/dockerInstall.ts"() {
     "use strict";
     init_agentDetect();
     init_macKeychain();
-    SYNKRO_DIR2 = join7(homedir7(), ".synkro");
-    MCP_JWT_PATH = join7(SYNKRO_DIR2, ".mcp-jwt");
-    PGDATA_PATH = join7(SYNKRO_DIR2, "pgdata");
-    CLAUDE_HOST_STATE_DIR = join7(SYNKRO_DIR2, "claude-host-state");
-    CLAUDE_HOST_STATE_FILE = join7(CLAUDE_HOST_STATE_DIR, ".claude.json");
+    SYNKRO_DIR7 = join13(homedir13(), ".synkro");
+    MCP_JWT_PATH = join13(SYNKRO_DIR7, ".mcp-jwt");
+    PGDATA_PATH = join13(SYNKRO_DIR7, "pgdata");
+    CLAUDE_HOST_STATE_DIR = join13(SYNKRO_DIR7, "claude-host-state");
+    CLAUDE_HOST_STATE_FILE = join13(CLAUDE_HOST_STATE_DIR, ".claude.json");
     HOST_MCP_PORT = parseInt(process.env.SYNKRO_HOST_MCP_PORT || "18931", 10);
     HOST_GRADER_PORT = parseInt(process.env.SYNKRO_HOST_GRADER_PORT || "18929", 10);
     HOST_CWE_PORT = parseInt(process.env.SYNKRO_HOST_CWE_PORT || "18930", 10);
@@ -4045,18 +5728,18 @@ var init_dockerInstall = __esm({
       }
       cause;
     };
-    BACKUP_DIR = join7(SYNKRO_DIR2, "pgdata-backups");
+    BACKUP_DIR = join13(SYNKRO_DIR7, "pgdata-backups");
   }
 });
 
 // cli/local-cc/setupToken.ts
 import { spawn as nodeSpawn } from "child_process";
-import { readFileSync as readFileSync8, unlinkSync as unlinkSync3 } from "fs";
-import { homedir as homedir8, platform as platform3 } from "os";
-import { join as join8 } from "path";
+import { readFileSync as readFileSync15, unlinkSync as unlinkSync5 } from "fs";
+import { homedir as homedir14, platform as platform4 } from "os";
+import { join as join14 } from "path";
 function captureClaudeSetupToken() {
-  const tmpFile = join8(SYNKRO_DIR3, `token-capture-${Date.now()}.raw`);
-  const isMac = platform3() === "darwin";
+  const tmpFile = join14(SYNKRO_DIR8, `token-capture-${Date.now()}.raw`);
+  const isMac = platform4() === "darwin";
   const bin = "script";
   const args2 = isMac ? ["-q", tmpFile, "claude", "setup-token"] : ["-qec", "claude setup-token", tmpFile];
   const OAUTH_HINT = 'The browser approval did not return a token. This usually means claude.ai rejected the OAuth request (its "Authorization failed \u2014 Unsupported media type" page), most often because a browser extension (Grammarly, ad/script blockers, AI-assistant toolbars) stripped the request headers, or you approved on the wrong Claude account. Fix: retry in a clean incognito window with extensions disabled, and approve on the Claude account you want the cloud workers to use.';
@@ -4069,13 +5752,13 @@ function captureClaudeSetupToken() {
     proc.on("close", (code) => {
       let raw = "";
       try {
-        raw = readFileSync8(tmpFile, "utf-8");
+        raw = readFileSync15(tmpFile, "utf-8");
       } catch (e) {
         reject(new Error(`Could not read script output file: ${e.message}`));
         return;
       }
       try {
-        unlinkSync3(tmpFile);
+        unlinkSync5(tmpFile);
       } catch {
       }
       if (code !== 0) {
@@ -4131,11 +5814,11 @@ function captureClaudeSetupToken() {
     });
   });
 }
-var SYNKRO_DIR3;
+var SYNKRO_DIR8;
 var init_setupToken = __esm({
   "cli/local-cc/setupToken.ts"() {
     "use strict";
-    SYNKRO_DIR3 = join8(homedir8(), ".synkro");
+    SYNKRO_DIR8 = join14(homedir14(), ".synkro");
   }
 });
 
@@ -4145,9 +5828,9 @@ __export(codexCloudSetup_exports, {
   setupCodexCloud: () => setupCodexCloud
 });
 import { spawn as nodeSpawn2, spawnSync as spawnSync4 } from "child_process";
-import { readFileSync as readFileSync9, mkdirSync as mkdirSync9, rmSync, existsSync as existsSync10 } from "fs";
-import { homedir as homedir9 } from "os";
-import { join as join9 } from "path";
+import { readFileSync as readFileSync16, mkdirSync as mkdirSync12, rmSync, existsSync as existsSync18 } from "fs";
+import { homedir as homedir15 } from "os";
+import { join as join15 } from "path";
 function findCodexBinary() {
   if (process.env.SYNKRO_CODEX_BIN) return process.env.SYNKRO_CODEX_BIN;
   const r = spawnSync4("which", ["codex"], { encoding: "utf-8" });
@@ -4155,7 +5838,7 @@ function findCodexBinary() {
   return p || null;
 }
 function runCodexLogin(codexBin) {
-  mkdirSync9(CODEX_CLOUD_HOME, { recursive: true, mode: 448 });
+  mkdirSync12(CODEX_CLOUD_HOME, { recursive: true, mode: 448 });
   return new Promise((resolve4, reject) => {
     const proc = nodeSpawn2(codexBin, ["login"], {
       stdio: "inherit",
@@ -4176,13 +5859,13 @@ async function setupCodexCloud(gatewayUrl, bearerToken, onStatus) {
   } catch (e) {
     return { ok: false, error: `Codex login failed: ${e.message}` };
   }
-  const authPath = join9(CODEX_CLOUD_HOME, "auth.json");
-  if (!existsSync10(authPath)) {
+  const authPath = join15(CODEX_CLOUD_HOME, "auth.json");
+  if (!existsSync18(authPath)) {
     return { ok: false, error: "codex login completed but no auth.json was written \u2014 did the browser approval finish?" };
   }
   let auth;
   try {
-    auth = JSON.parse(readFileSync9(authPath, "utf-8"));
+    auth = JSON.parse(readFileSync16(authPath, "utf-8"));
   } catch (e) {
     return { ok: false, error: `could not read codex auth.json: ${e.message}` };
   }
@@ -4211,12 +5894,12 @@ async function setupCodexCloud(gatewayUrl, bearerToken, onStatus) {
   onStatus?.("\u2713 Codex subscription connected to Synkro Cloud.");
   return { ok: true };
 }
-var SYNKRO_DIR4, CODEX_CLOUD_HOME;
+var SYNKRO_DIR9, CODEX_CLOUD_HOME;
 var init_codexCloudSetup = __esm({
   "cli/local-cc/codexCloudSetup.ts"() {
     "use strict";
-    SYNKRO_DIR4 = join9(homedir9(), ".synkro");
-    CODEX_CLOUD_HOME = join9(SYNKRO_DIR4, "codex-cloud-session");
+    SYNKRO_DIR9 = join15(homedir15(), ".synkro");
+    CODEX_CLOUD_HOME = join15(SYNKRO_DIR9, "codex-cloud-session");
   }
 });
 
@@ -4229,14 +5912,14 @@ __export(setupGithub_exports, {
 import { createInterface as createInterface2 } from "readline/promises";
 import { stdin as input, stdout as output } from "process";
 import { execSync as execSync5 } from "child_process";
-import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
-import { homedir as homedir10, platform as platform4 } from "os";
-import { join as join10 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync17 } from "fs";
+import { homedir as homedir16, platform as platform5 } from "os";
+import { join as join16 } from "path";
 import { execFile as execFile2 } from "child_process";
 function readConfig() {
-  if (!existsSync11(CONFIG_PATH)) return {};
+  if (!existsSync19(CONFIG_PATH3)) return {};
   const out = {};
-  for (const line of readFileSync10(CONFIG_PATH, "utf-8").split("\n")) {
+  for (const line of readFileSync17(CONFIG_PATH3, "utf-8").split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#")) continue;
     const eq = t.indexOf("=");
@@ -4273,7 +5956,7 @@ async function prompt(rl, q, opts = {}) {
   return await rl.question(q);
 }
 function openBrowser3(url) {
-  const os = platform4();
+  const os = platform5();
   let bin;
   let args2;
   switch (os) {
@@ -4536,15 +6219,15 @@ Will push secrets to ${selected.length} repo(s):`);
   console.log(`Secrets pushed: ${SECRET_NAMES.CLAUDE_OAUTH}, ${SECRET_NAMES.SYNKRO_API_KEY}`);
   console.log("Open a PR on any selected repo to trigger your first Synkro scan.");
 }
-var SYNKRO_DIR5, CONFIG_PATH;
+var SYNKRO_DIR10, CONFIG_PATH3;
 var init_setupGithub = __esm({
   "cli/commands/setupGithub.ts"() {
     "use strict";
     init_githubSetup();
     init_stub();
     init_setupToken();
-    SYNKRO_DIR5 = join10(homedir10(), ".synkro");
-    CONFIG_PATH = join10(SYNKRO_DIR5, "config.env");
+    SYNKRO_DIR10 = join16(homedir16(), ".synkro");
+    CONFIG_PATH3 = join16(SYNKRO_DIR10, "config.env");
   }
 });
 
@@ -4563,12 +6246,12 @@ __export(install_exports, {
   syncSkillFiles: () => syncSkillFiles,
   writeHookScripts: () => writeHookScripts
 });
-import { existsSync as existsSync12, mkdirSync as mkdirSync10, writeFileSync as writeFileSync8, chmodSync as chmodSync2, readFileSync as readFileSync11, readdirSync as readdirSync3, unlinkSync as unlinkSync4, statSync } from "fs";
-import { homedir as homedir11 } from "os";
-import { join as join11 } from "path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync13, writeFileSync as writeFileSync13, chmodSync as chmodSync3, readFileSync as readFileSync18, readdirSync as readdirSync3, unlinkSync as unlinkSync6, statSync as statSync2 } from "fs";
+import { homedir as homedir17 } from "os";
+import { join as join17 } from "path";
 import { execSync as execSync6 } from "child_process";
 import { createInterface as createInterface3 } from "readline";
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 function resolvePersistedHookMode() {
   return "stub";
 }
@@ -4710,37 +6393,37 @@ async function promptCodexCloudSetup() {
   });
 }
 function ensureSynkroDir() {
-  mkdirSync10(SYNKRO_DIR6, { recursive: true });
-  mkdirSync10(HOOKS_DIR, { recursive: true });
-  mkdirSync10(BIN_DIR, { recursive: true });
-  mkdirSync10(OFFSETS_DIR, { recursive: true });
-  mkdirSync10(join11(SYNKRO_DIR6, "sessions"), { recursive: true });
+  mkdirSync13(SYNKRO_DIR11, { recursive: true });
+  mkdirSync13(HOOKS_DIR, { recursive: true });
+  mkdirSync13(BIN_DIR, { recursive: true });
+  mkdirSync13(OFFSETS_DIR, { recursive: true });
+  mkdirSync13(join17(SYNKRO_DIR11, "sessions"), { recursive: true });
 }
 function writeHookScripts() {
-  const installExtractCorePath = join11(HOOKS_DIR, "installExtractCore.ts");
-  const bashScriptPath = join11(HOOKS_DIR, "cc-bash-judge.ts");
-  const skillJudgeScriptPath = join11(HOOKS_DIR, "cc-skill-judge.ts");
-  const cursorSkillJudgePath = join11(HOOKS_DIR, "cursor-skill-judge.ts");
-  const bashFollowupScriptPath = join11(HOOKS_DIR, "cc-bash-followup.ts");
-  const editPrecheckScriptPath = join11(HOOKS_DIR, "cc-edit-precheck.ts");
-  const cwePrecheckScriptPath = join11(HOOKS_DIR, "cc-cwe-precheck.ts");
-  const cvePrecheckScriptPath = join11(HOOKS_DIR, "cc-cve-precheck.ts");
-  const planJudgeScriptPath = join11(HOOKS_DIR, "cc-plan-judge.ts");
-  const agentJudgeScriptPath = join11(HOOKS_DIR, "cc-agent-judge.ts");
-  const stopSummaryScriptPath = join11(HOOKS_DIR, "cc-stop-summary.ts");
-  const sessionStartScriptPath = join11(HOOKS_DIR, "cc-session-start.ts");
-  const transcriptSyncScriptPath = join11(HOOKS_DIR, "cc-transcript-sync.ts");
-  const userPromptSubmitScriptPath = join11(HOOKS_DIR, "cc-user-prompt-submit.ts");
-  const commonScriptPath = join11(HOOKS_DIR, "_synkro-common.ts");
-  const commonBashScriptPath = join11(HOOKS_DIR, "_synkro-common.sh");
-  const installScanScriptPath = join11(HOOKS_DIR, "cc-install-scan.ts");
-  const cursorBashJudgePath = join11(HOOKS_DIR, "cursor-bash-judge.ts");
-  const cursorEditCapturePath = join11(HOOKS_DIR, "cursor-edit-capture.ts");
-  const cursorAgentCapturePath = join11(HOOKS_DIR, "cursor-agent-capture.ts");
-  const mcpStdioProxyPath = join11(HOOKS_DIR, "mcp-stdio-proxy.ts");
-  const taskActivateIntentScriptPath = join11(HOOKS_DIR, "cc-task-activate-intent.ts");
-  const mcpGateScriptPath = join11(HOOKS_DIR, "cc-mcp-gate.ts");
-  const stubCommonPath = join11(HOOKS_DIR, "_synkro-stub-common.ts");
+  const installExtractCorePath = join17(HOOKS_DIR, "installExtractCore.ts");
+  const bashScriptPath = join17(HOOKS_DIR, "cc-bash-judge.ts");
+  const skillJudgeScriptPath = join17(HOOKS_DIR, "cc-skill-judge.ts");
+  const cursorSkillJudgePath = join17(HOOKS_DIR, "cursor-skill-judge.ts");
+  const bashFollowupScriptPath = join17(HOOKS_DIR, "cc-bash-followup.ts");
+  const editPrecheckScriptPath = join17(HOOKS_DIR, "cc-edit-precheck.ts");
+  const cwePrecheckScriptPath = join17(HOOKS_DIR, "cc-cwe-precheck.ts");
+  const cvePrecheckScriptPath = join17(HOOKS_DIR, "cc-cve-precheck.ts");
+  const planJudgeScriptPath = join17(HOOKS_DIR, "cc-plan-judge.ts");
+  const agentJudgeScriptPath = join17(HOOKS_DIR, "cc-agent-judge.ts");
+  const stopSummaryScriptPath = join17(HOOKS_DIR, "cc-stop-summary.ts");
+  const sessionStartScriptPath = join17(HOOKS_DIR, "cc-session-start.ts");
+  const transcriptSyncScriptPath = join17(HOOKS_DIR, "cc-transcript-sync.ts");
+  const userPromptSubmitScriptPath = join17(HOOKS_DIR, "cc-user-prompt-submit.ts");
+  const commonScriptPath = join17(HOOKS_DIR, "_synkro-common.ts");
+  const commonBashScriptPath = join17(HOOKS_DIR, "_synkro-common.sh");
+  const installScanScriptPath = join17(HOOKS_DIR, "cc-install-scan.ts");
+  const cursorBashJudgePath = join17(HOOKS_DIR, "cursor-bash-judge.ts");
+  const cursorEditCapturePath = join17(HOOKS_DIR, "cursor-edit-capture.ts");
+  const cursorAgentCapturePath = join17(HOOKS_DIR, "cursor-agent-capture.ts");
+  const mcpStdioProxyPath = join17(HOOKS_DIR, "mcp-stdio-proxy.ts");
+  const taskActivateIntentScriptPath = join17(HOOKS_DIR, "cc-task-activate-intent.ts");
+  const mcpGateScriptPath = join17(HOOKS_DIR, "cc-mcp-gate.ts");
+  const stubCommonPath = join17(HOOKS_DIR, "_synkro-stub-common.ts");
   const stubFiles = [
     [stubCommonPath, STUB_COMMON_TS],
     [bashScriptPath, STUB_BASH_JUDGE_TS],
@@ -4764,14 +6447,14 @@ function writeHookScripts() {
     [cursorAgentCapturePath, STUB_CURSOR_AGENT_CAPTURE_TS]
   ];
   for (const [p, content] of stubFiles) {
-    writeFileSync8(p, content, "utf-8");
-    chmodSync2(p, 493);
+    writeFileSync13(p, content, "utf-8");
+    chmodSync3(p, 493);
   }
-  writeFileSync8(mcpStdioProxyPath, MCP_STDIO_PROXY_SRC, "utf-8");
-  chmodSync2(mcpStdioProxyPath, 493);
+  writeFileSync13(mcpStdioProxyPath, MCP_STDIO_PROXY_SRC, "utf-8");
+  chmodSync3(mcpStdioProxyPath, 493);
   for (const stale of ["_synkro-common.ts", "_synkro-common.sh", "installExtractCore.ts"]) {
     try {
-      unlinkSync4(join11(HOOKS_DIR, stale));
+      unlinkSync6(join17(HOOKS_DIR, stale));
     } catch {
     }
   }
@@ -4801,16 +6484,16 @@ function sanitizeConfigValue(raw, maxLen = 256) {
   if (!raw) return "";
   return raw.replace(/[^\x20-\x7E]/g, "").slice(0, maxLen);
 }
-function shellQuoteSingle(value) {
+function shellQuoteSingle2(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
 function resolveSynkroBundle() {
   const scriptPath = process.argv[1];
-  if (scriptPath && existsSync12(scriptPath)) return scriptPath;
+  if (scriptPath && existsSync20(scriptPath)) return scriptPath;
   return null;
 }
 function writeConfigEnv(opts) {
-  const credsPath = join11(SYNKRO_DIR6, "credentials.json");
+  const credsPath = join17(SYNKRO_DIR11, "credentials.json");
   const safeGateway = sanitizeConfigValue(opts.gatewayUrl);
   const safeUserId = sanitizeConfigValue(opts.userId);
   const safeOrgId = sanitizeConfigValue(opts.orgId);
@@ -4822,29 +6505,29 @@ function writeConfigEnv(opts) {
     "# Synkro CLI config (managed by synkro install)",
     "# JWT auth \u2014 the hook scripts read SYNKRO_CREDENTIALS_PATH at runtime",
     "# and send Authorization: Bearer <access_token> on every gateway call.",
-    `SYNKRO_GATEWAY_URL=${shellQuoteSingle(safeGateway)}`,
-    `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
-    `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
-    `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.7.60")}`
+    `SYNKRO_GATEWAY_URL=${shellQuoteSingle2(safeGateway)}`,
+    `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle2(credsPath)}`,
+    `SYNKRO_TIER=${shellQuoteSingle2(safeTier)}`,
+    `SYNKRO_INFERENCE=${shellQuoteSingle2(safeInference)}`,
+    `SYNKRO_VERSION=${shellQuoteSingle2("1.7.62")}`
   ];
-  if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
-  if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
-  if (safeOrgId) lines.push(`SYNKRO_ORG_ID=${shellQuoteSingle(safeOrgId)}`);
-  if (safeEmail) lines.push(`SYNKRO_EMAIL=${shellQuoteSingle(safeEmail)}`);
+  if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle2(safeSynkroBin)}`);
+  if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle2(safeUserId)}`);
+  if (safeOrgId) lines.push(`SYNKRO_ORG_ID=${shellQuoteSingle2(safeOrgId)}`);
+  if (safeEmail) lines.push(`SYNKRO_EMAIL=${shellQuoteSingle2(safeEmail)}`);
   if (opts.transcriptConsent !== void 0) {
-    lines.push(`SYNKRO_TRANSCRIPT_CONSENT=${shellQuoteSingle(opts.transcriptConsent ? "yes" : "no")}`);
+    lines.push(`SYNKRO_TRANSCRIPT_CONSENT=${shellQuoteSingle2(opts.transcriptConsent ? "yes" : "no")}`);
   }
-  lines.push(`SYNKRO_LOCAL_INFERENCE=${shellQuoteSingle(opts.localInference ? "yes" : "no")}`);
+  lines.push(`SYNKRO_LOCAL_INFERENCE=${shellQuoteSingle2(opts.localInference ? "yes" : "no")}`);
   const safeMode = sanitizeConfigValue(opts.deploymentMode ?? "docker", 16);
-  lines.push(`SYNKRO_DEPLOYMENT_MODE=${shellQuoteSingle(safeMode)}`);
-  lines.push(`SYNKRO_GRADING_MODE=${shellQuoteSingle(sanitizeConfigValue(opts.gradingMode ?? "local", 16))}`);
-  lines.push(`SYNKRO_STORAGE_MODE=${shellQuoteSingle(sanitizeConfigValue(opts.storageMode ?? "local", 16))}`);
-  lines.push(`SYNKRO_DEPLOY_LOCATION=${shellQuoteSingle(sanitizeConfigValue(opts.deployLocation ?? "local", 16))}`);
-  lines.push(`SYNKRO_HOOK_MODE=${shellQuoteSingle(sanitizeConfigValue(opts.hookMode ?? "stub", 8))}`);
+  lines.push(`SYNKRO_DEPLOYMENT_MODE=${shellQuoteSingle2(safeMode)}`);
+  lines.push(`SYNKRO_GRADING_MODE=${shellQuoteSingle2(sanitizeConfigValue(opts.gradingMode ?? "local", 16))}`);
+  lines.push(`SYNKRO_STORAGE_MODE=${shellQuoteSingle2(sanitizeConfigValue(opts.storageMode ?? "local", 16))}`);
+  lines.push(`SYNKRO_DEPLOY_LOCATION=${shellQuoteSingle2(sanitizeConfigValue(opts.deployLocation ?? "local", 16))}`);
+  lines.push(`SYNKRO_HOOK_MODE=${shellQuoteSingle2(sanitizeConfigValue(opts.hookMode ?? "stub", 8))}`);
   lines.push("");
-  writeFileSync8(CONFIG_PATH2, lines.join("\n"), "utf-8");
-  chmodSync2(CONFIG_PATH2, 384);
+  writeFileSync13(CONFIG_PATH4, lines.join("\n"), "utf-8");
+  chmodSync3(CONFIG_PATH4, 384);
 }
 function jwtExpired(token) {
   try {
@@ -4859,7 +6542,7 @@ async function getOrMintCloudToken(gatewayUrl) {
   assertGatewayAllowed(gatewayUrl);
   let stored = "";
   try {
-    stored = readFileSync11(CLOUD_JWT_PATH, "utf-8").trim();
+    stored = readFileSync18(CLOUD_JWT_PATH, "utf-8").trim();
   } catch {
   }
   if (stored && !jwtExpired(stored)) return stored;
@@ -4875,7 +6558,7 @@ async function getOrMintCloudToken(gatewayUrl) {
     throw new Error(`cloud-token mint failed (${resp.status}): ${t.slice(0, 200)}`);
   }
   const { token } = await resp.json();
-  writeFileSync8(CLOUD_JWT_PATH, token + "\n", { mode: 384 });
+  writeFileSync13(CLOUD_JWT_PATH, token + "\n", { mode: 384 });
   return token;
 }
 async function provisionCloudContainer(opts) {
@@ -4918,7 +6601,7 @@ async function provisionCloudContainer(opts) {
   let cursorApiKey = "";
   if (cursorTotal > 0) {
     try {
-      cursorApiKey = readFileSync11(join11(SYNKRO_DIR6, "cursor-creds", "api-key"), "utf-8").trim();
+      cursorApiKey = readFileSync18(join17(SYNKRO_DIR11, "cursor-creds", "api-key"), "utf-8").trim();
     } catch {
     }
   }
@@ -5075,8 +6758,8 @@ async function verifyCloudGrader(jwt2) {
 }
 function readPersistedDeployLocation() {
   try {
-    if (existsSync12(CONFIG_PATH2)) {
-      const m = readFileSync11(CONFIG_PATH2, "utf-8").match(/^SYNKRO_DEPLOY_LOCATION='([^']*)'/m);
+    if (existsSync20(CONFIG_PATH4)) {
+      const m = readFileSync18(CONFIG_PATH4, "utf-8").match(/^SYNKRO_DEPLOY_LOCATION='([^']*)'/m);
       if (m?.[1] === "cloud") return "cloud";
     }
   } catch {
@@ -5084,8 +6767,8 @@ function readPersistedDeployLocation() {
   return "local";
 }
 function updateConfigEnvLocation(location) {
-  if (!existsSync12(CONFIG_PATH2)) return;
-  let env = readFileSync11(CONFIG_PATH2, "utf-8");
+  if (!existsSync20(CONFIG_PATH4)) return;
+  let env = readFileSync18(CONFIG_PATH4, "utf-8");
   const set = (k, v) => {
     const re = new RegExp(`^${k}=.*$`, "m");
     const line = `${k}='${v}'`;
@@ -5093,14 +6776,14 @@ function updateConfigEnvLocation(location) {
   };
   set("SYNKRO_DEPLOY_LOCATION", location);
   set("SYNKRO_STORAGE_MODE", location === "cloud" ? "cloud" : "local");
-  writeFileSync8(CONFIG_PATH2, env, "utf-8");
-  chmodSync2(CONFIG_PATH2, 384);
+  writeFileSync13(CONFIG_PATH4, env, "utf-8");
+  chmodSync3(CONFIG_PATH4, 384);
 }
 async function applyMcpConfig(opts) {
   if (!opts.hasClaudeCode && !opts.hasCursor) return;
   let mcpJwt = "";
   try {
-    mcpJwt = readFileSync11(join11(SYNKRO_DIR6, ".mcp-jwt"), "utf-8").trim();
+    mcpJwt = readFileSync18(join17(SYNKRO_DIR11, ".mcp-jwt"), "utf-8").trim();
   } catch {
   }
   if (!mcpJwt) {
@@ -5218,8 +6901,8 @@ function resolveDeploymentMode() {
   const envOverride = process.env.SYNKRO_DEPLOYMENT_MODE?.toLowerCase();
   if (envOverride === "bare-host" || envOverride === "docker") return envOverride;
   try {
-    if (existsSync12(CONFIG_PATH2)) {
-      const m = readFileSync11(CONFIG_PATH2, "utf-8").match(/^SYNKRO_DEPLOYMENT_MODE='([^']*)'/m);
+    if (existsSync20(CONFIG_PATH4)) {
+      const m = readFileSync18(CONFIG_PATH4, "utf-8").match(/^SYNKRO_DEPLOYMENT_MODE='([^']*)'/m);
       const val = m?.[1]?.toLowerCase();
       if (val === "bare-host" || val === "docker") return val;
     }
@@ -5246,16 +6929,16 @@ function collectLocalMetadata(includeClaudeCode = true) {
     meta.cc_version = execSync6("claude --version", { encoding: "utf-8", timeout: 5e3 }).trim().split("\n")[0];
   } catch {
   }
-  const claudeDir = join11(homedir11(), ".claude");
+  const claudeDir = join17(homedir17(), ".claude");
   try {
-    const settings = JSON.parse(readFileSync11(join11(claudeDir, "settings.json"), "utf-8"));
+    const settings = JSON.parse(readFileSync18(join17(claudeDir, "settings.json"), "utf-8"));
     const plugins = Object.keys(settings.enabledPlugins ?? {}).filter((k) => settings.enabledPlugins[k]);
     if (plugins.length) meta.enabled_plugins = plugins;
     if (settings.permissions?.defaultMode) meta.permissions_mode = settings.permissions.defaultMode;
   } catch {
   }
   try {
-    const mcpCache = JSON.parse(readFileSync11(join11(claudeDir, "mcp-needs-auth-cache.json"), "utf-8"));
+    const mcpCache = JSON.parse(readFileSync18(join17(claudeDir, "mcp-needs-auth-cache.json"), "utf-8"));
     const mcpNames = Object.keys(mcpCache);
     if (mcpNames.length) meta.mcp_servers = mcpNames;
   } catch {
@@ -5267,10 +6950,10 @@ function collectLocalMetadata(includeClaudeCode = true) {
   } catch {
   }
   try {
-    const sessionsDir = join11(claudeDir, "sessions");
+    const sessionsDir = join17(claudeDir, "sessions");
     const files = readdirSync3(sessionsDir).filter((f) => f.endsWith(".json")).slice(-5);
     for (const f of files) {
-      const s = JSON.parse(readFileSync11(join11(sessionsDir, f), "utf-8"));
+      const s = JSON.parse(readFileSync18(join17(sessionsDir, f), "utf-8"));
       if (s.version) {
         meta.cc_version = meta.cc_version || s.version;
         break;
@@ -5316,15 +6999,30 @@ function assertGatewayAllowed(gatewayUrl) {
   if (proto !== "http:" && proto !== "https:") {
     throw new Error(`Gateway URL must be http(s); got ${proto}`);
   }
-  const isLocalhost = host === "localhost" || host === "127.0.0.1" || host === "::1";
+  const isLocalhost2 = host === "localhost" || host === "127.0.0.1" || host === "::1";
   const isSynkro = host === "synkro.sh" || host.endsWith(".synkro.sh");
-  if (proto === "http:" && !isLocalhost) {
+  if (proto === "http:" && !isLocalhost2) {
     throw new Error(`Gateway URL must be HTTPS for non-localhost hosts; got ${gatewayUrl}`);
   }
-  if (!isLocalhost && !isSynkro) {
+  if (!isLocalhost2 && !isSynkro) {
     throw new Error(`Gateway host not in allowlist (synkro.sh or *.synkro.sh): ${host}`);
   }
 }
+async function promptTelemetryConsent() {
+  if (!process.stdin.isTTY) return true;
+  const rl = createInterface3({ input: process.stdin, output: process.stdout });
+  try {
+    const a = await new Promise(
+      (res) => rl.question(
+        "Allow Synkro to send local product analytics (events, timings, rule activity)\nto our gateway? You can inspect data locally with `synkro telemetry stats`. (Y/n) ",
+        (ans) => res(ans.trim().toLowerCase())
+      )
+    );
+    return a === "" || a === "y" || a === "yes";
+  } finally {
+    rl.close();
+  }
+}
 async function installCommand(opts = {}) {
   if (!detectGitRepo2()) {
     console.error("Synkro must be installed inside a git repository.");
@@ -5447,14 +7145,25 @@ async function installCommand(opts = {}) {
     }
   }
   const transcriptConsent = transcriptCC || transcriptCursor;
+  const telemetryConsent = await promptTelemetryConsent();
+  await setTelemetryState({ enabled: true, remoteFlushEnabled: telemetryConsent });
+  emit("install", {
+    phase: "started",
+    cli_version_to: "1.7.62",
+    agents_detected: agents.map((a) => a.kind),
+    with_github: false,
+    with_local_cc: false,
+    with_transcript_consent: transcriptConsent,
+    duration_ms: 0
+  });
   ensureSynkroDir();
   const hookMode = opts.hookMode || resolvePersistedHookMode();
   const scripts = writeHookScripts();
   console.log("Wrote hook scripts to ~/.synkro/hooks/\n");
   for (const mode of ["edit", "bash"]) {
-    const pidFile = join11(SYNKRO_DIR6, "daemon", mode, "daemon.pid");
+    const pidFile = join17(SYNKRO_DIR11, "daemon", mode, "daemon.pid");
     try {
-      const pid = parseInt(readFileSync11(pidFile, "utf-8").trim(), 10);
+      const pid = parseInt(readFileSync18(pidFile, "utf-8").trim(), 10);
       if (pid > 0) {
         process.kill(pid, "SIGTERM");
         console.log(`Stopped stale ${mode} grader daemon (pid ${pid})`);
@@ -5539,7 +7248,7 @@ async function installCommand(opts = {}) {
         if (mintResp.ok) {
           const minted = await mintResp.json();
           mcpJwt = minted.token;
-          writeFileSync8(join11(SYNKRO_DIR6, ".mcp-jwt"), mcpJwt + "\n", { mode: 384 });
+          writeFileSync13(join17(SYNKRO_DIR11, ".mcp-jwt"), mcpJwt + "\n", { mode: 384 });
         } else {
           console.warn("  \u26A0 Could not mint MCP token \u2014 local server will reject requests until re-installed.");
         }
@@ -5567,7 +7276,7 @@ async function installCommand(opts = {}) {
           throw new Error(`mcp-token mint failed (${mintResp.status}): ${errText.slice(0, 200)}`);
         }
         const minted = await mintResp.json();
-        writeFileSync8(join11(SYNKRO_DIR6, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
+        writeFileSync13(join17(SYNKRO_DIR11, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
         const mcp = installMcpConfig({ gatewayUrl, bearerToken: minted.token });
         console.log(`Registered Synkro guardrails MCP server in ${mcp.path}`);
         console.log(`  url:        ${mcp.url}`);
@@ -5584,8 +7293,8 @@ async function installCommand(opts = {}) {
   if (hasCursor && !opts.noMcp) {
     try {
       if (useLocalMcp) {
-        const jwtPath = join11(SYNKRO_DIR6, ".mcp-jwt");
-        if (!existsSync12(jwtPath)) {
+        const jwtPath = join17(SYNKRO_DIR11, ".mcp-jwt");
+        if (!existsSync20(jwtPath)) {
           const mintResp = await fetch(`${gatewayUrl}/api/v1/cli/mcp-token`, {
             method: "POST",
             headers: { "Authorization": `Bearer ${token}`, "Content-Type": "application/json" },
@@ -5593,7 +7302,7 @@ async function installCommand(opts = {}) {
           });
           if (mintResp.ok) {
             const minted = await mintResp.json();
-            writeFileSync8(jwtPath, minted.token + "\n", { mode: 384 });
+            writeFileSync13(jwtPath, minted.token + "\n", { mode: 384 });
           }
         }
         const mcp = installCursorMcpConfig({ gatewayUrl, bearerToken: "", local: true });
@@ -5613,7 +7322,7 @@ async function installCommand(opts = {}) {
           throw new Error(`mcp-token mint failed (${mintResp.status}): ${errText.slice(0, 200)}`);
         }
         const minted = await mintResp.json();
-        writeFileSync8(join11(SYNKRO_DIR6, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
+        writeFileSync13(join17(SYNKRO_DIR11, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
         const mcp = installCursorMcpConfig({ gatewayUrl, bearerToken: minted.token });
         console.log(`Registered Synkro guardrails MCP server in ${mcp.path}`);
         console.log(`  url:        ${mcp.url}`);
@@ -5627,7 +7336,7 @@ async function installCommand(opts = {}) {
   const synkroBundle = resolveSynkroBundle();
   const persistedMode = resolveDeploymentMode();
   writeConfigEnv({ gatewayUrl, userId, orgId, email, tier: profile.tier, inference: profile.inference, synkroBin: synkroBundle, transcriptConsent, localInference: profile.localInference, deploymentMode: persistedMode, gradingMode, storageMode, deployLocation, hookMode });
-  console.log(`Wrote config to ${CONFIG_PATH2}`);
+  console.log(`Wrote config to ${CONFIG_PATH4}`);
   console.log(`  inference: ${profile.inference} (server-side grading)`);
   if (profile.localInference) console.log(`  local inference: enabled (gradingProvider=claude-code)`);
   if (synkroBundle) console.log(`  SYNKRO_CLI_BIN=${synkroBundle}`);
@@ -5706,7 +7415,7 @@ async function installCommand(opts = {}) {
     const ready = await waitForContainerReady(6e4);
     if (ready) {
       console.log("  \u2713 container ready");
-      const mcpJwt = readFileSync11(join11(SYNKRO_DIR6, ".mcp-jwt"), "utf-8").trim();
+      const mcpJwt = readFileSync18(join17(SYNKRO_DIR11, ".mcp-jwt"), "utf-8").trim();
       try {
         const ingestResp = await fetch(`http://127.0.0.1:${hostMcpPort}/api/ingest`, {
           method: "POST",
@@ -5754,7 +7463,7 @@ async function installCommand(opts = {}) {
         try {
           let mcpToken = "";
           try {
-            mcpToken = readFileSync11(join11(SYNKRO_DIR6, ".mcp-jwt"), "utf-8").trim();
+            mcpToken = readFileSync18(join17(SYNKRO_DIR11, ".mcp-jwt"), "utf-8").trim();
           } catch {
           }
           if (mcpToken) {
@@ -5890,11 +7599,11 @@ function writeSynkroFileIfMissing(opts) {
   try {
     const root = execSync6("git rev-parse --show-toplevel", { encoding: "utf-8", timeout: 3e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
     if (!root) return;
-    if (root === homedir11()) return;
-    const fp = join11(root, "synkro.toml");
+    if (root === homedir17()) return;
+    const fp = join17(root, "synkro.toml");
     let hasFile = false;
     try {
-      hasFile = statSync(fp).isFile();
+      hasFile = statSync2(fp).isFile();
     } catch {
     }
     if (hasFile) {
@@ -5927,7 +7636,7 @@ function writeSynkroFileIfMissing(opts) {
       "cve = true",
       ""
     ].join("\n");
-    writeFileSync8(fp, toml, "utf-8");
+    writeFileSync13(fp, toml, "utf-8");
     console.log(`  synkro.toml: wrote ${fp} (pool=${pool}, mode=${mode})`);
   } catch {
   }
@@ -5936,9 +7645,9 @@ function readFullSynkroFile() {
   try {
     const root = execSync6("git rev-parse --show-toplevel", { encoding: "utf-8", timeout: 3e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
     if (!root) return null;
-    const fp = join11(root, "synkro.toml");
-    if (!existsSync12(fp)) return null;
-    const parsed = parseSynkroToml2(readFileSync11(fp, "utf-8"));
+    const fp = join17(root, "synkro.toml");
+    if (!existsSync20(fp)) return null;
+    const parsed = parseSynkroToml2(readFileSync18(fp, "utf-8"));
     const valid = ["claude-code", "cursor"];
     const harness = Array.isArray(parsed.harness) ? parsed.harness.filter((h) => valid.includes(h)) : ["claude-code", "cursor"];
     const resolved = resolveGraderPool(parsed);
@@ -5976,7 +7685,7 @@ function reconcileHarness() {
   console.log(`synkro.toml: harness=[${sf.harness.join(", ")}] pool=${poolLabel(sf.grader.pool)} mode=${sf.grader.mode}`);
   const scripts = writeHookScripts();
   console.log("Wrote hook scripts to ~/.synkro/hooks/");
-  const ccSettings = join11(homedir11(), ".claude", "settings.json");
+  const ccSettings = join17(homedir17(), ".claude", "settings.json");
   if (wantCC) {
     installCCHooks(ccSettings, {
       bashJudgeScriptPath: scripts.bashScript,
@@ -5997,7 +7706,7 @@ function reconcileHarness() {
     });
     console.log("  \u2713 Claude Code hooks registered");
     try {
-      const mcpJwt = readFileSync11(join11(SYNKRO_DIR6, ".mcp-jwt"), "utf-8").trim();
+      const mcpJwt = readFileSync18(join17(SYNKRO_DIR11, ".mcp-jwt"), "utf-8").trim();
       if (mcpJwt) {
         installMcpConfig({ gatewayUrl: "", bearerToken: mcpJwt, local: true });
         console.log("  \u2713 Claude Code MCP registered");
@@ -6009,7 +7718,7 @@ function reconcileHarness() {
     if (uninstallMcpConfig()) console.log("  \u2717 Claude Code MCP removed");
     if (uninstallClaudeDesktopMcpConfig()) console.log("  \u2717 Claude Desktop MCP removed");
   }
-  const cursorHooks = join11(homedir11(), ".cursor", "hooks.json");
+  const cursorHooks = join17(homedir17(), ".cursor", "hooks.json");
   if (wantCursor) {
     installCursorHooks(cursorHooks, {
       bashJudgeScriptPath: scripts.cursorBashJudgeScript,
@@ -6092,7 +7801,7 @@ async function syncSkillFiles() {
   if (resolved.length === 0) return;
   const mcpPort = process.env.SYNKRO_MCP_PORT || "18931";
   const tasks = resolved.map((fp) => {
-    const content = readFileSync11(fp, "utf-8");
+    const content = readFileSync18(fp, "utf-8");
     const source = `skill:${fp.split("/").pop()}`;
     if (!content.trim()) {
       console.log(`  \u2298 skill ${source}: empty file, skipped`);
@@ -6113,15 +7822,15 @@ function discoverSkillFiles(repoRoot, excludeHashes, ingestedHashes, ingestedNam
   const roots = [];
   const add = (p) => {
     try {
-      if (p && existsSync12(p) && statSync(p).isDirectory()) roots.push(p);
+      if (p && existsSync20(p) && statSync2(p).isDirectory()) roots.push(p);
     } catch {
     }
   };
-  add(join11(homedir11(), ".claude", "skills"));
-  add(join11(homedir11(), ".agents", "skills"));
+  add(join17(homedir17(), ".claude", "skills"));
+  add(join17(homedir17(), ".agents", "skills"));
   if (repoRoot) {
-    add(join11(repoRoot, ".claude", "skills"));
-    add(join11(repoRoot, ".agents", "skills"));
+    add(join17(repoRoot, ".claude", "skills"));
+    add(join17(repoRoot, ".agents", "skills"));
   }
   const out = [];
   const seen = /* @__PURE__ */ new Set();
@@ -6130,14 +7839,14 @@ function discoverSkillFiles(repoRoot, excludeHashes, ingestedHashes, ingestedNam
     if (out.length >= MAX) return;
     let content = "";
     try {
-      const st = statSync(file);
+      const st = statSync2(file);
       if (!st.isFile() || st.size > 2e5) return;
-      content = readFileSync11(file, "utf-8");
+      content = readFileSync18(file, "utf-8");
     } catch {
       return;
     }
     if (!content.trim()) return;
-    const hash = createHash("sha256").update(content).digest("hex");
+    const hash = createHash2("sha256").update(content).digest("hex");
     if (seen.has(hash) || excludeHashes.has(hash)) return;
     seen.add(hash);
     const ingested = ingestedHashes.has(hash) || ingestedNames.has(normSkillName(name));
@@ -6152,16 +7861,16 @@ function discoverSkillFiles(repoRoot, excludeHashes, ingestedHashes, ingestedNam
     }
     for (const entry of entries) {
       if (entry.startsWith(".")) continue;
-      const full = join11(root, entry);
+      const full = join17(root, entry);
       let st;
       try {
-        st = statSync(full);
+        st = statSync2(full);
       } catch {
         continue;
       }
       if (st.isDirectory()) {
-        const skillMd = join11(full, "SKILL.md");
-        if (existsSync12(skillMd)) consider(skillMd, entry);
+        const skillMd = join17(full, "SKILL.md");
+        if (existsSync20(skillMd)) consider(skillMd, entry);
       } else if (/\.mdx?$/i.test(entry) && entry.toUpperCase() !== "README.MD") {
         consider(full, entry.replace(/\.mdx?$/i, ""));
       }
@@ -6170,7 +7879,7 @@ function discoverSkillFiles(repoRoot, excludeHashes, ingestedHashes, ingestedNam
   return out;
 }
 function discoverySetHash(found) {
-  return createHash("sha256").update(found.map((f) => f.hash).sort().join(",")).digest("hex");
+  return createHash2("sha256").update(found.map((f) => f.hash).sort().join(",")).digest("hex");
 }
 async function promptSkillDiscovery(found) {
   if (!process.stdin.isTTY || found.length === 0) return [];
@@ -6210,7 +7919,7 @@ async function discoverAndIngestSkills() {
     if (sf?.skills?.length) {
       for (const fp of resolveSkillPaths(sf.skills, sf._repoRoot)) {
         try {
-          excludeHashes.add(createHash("sha256").update(readFileSync11(fp, "utf-8")).digest("hex"));
+          excludeHashes.add(createHash2("sha256").update(readFileSync18(fp, "utf-8")).digest("hex"));
         } catch {
         }
       }
@@ -6241,13 +7950,13 @@ async function discoverAndIngestSkills() {
     const setHash = discoverySetHash(selectable);
     let prev = "";
     try {
-      prev = readFileSync11(SKILLS_DISCOVERED_PATH, "utf-8").trim();
+      prev = readFileSync18(SKILLS_DISCOVERED_PATH, "utf-8").trim();
     } catch {
     }
     if (prev === setHash) return;
     const picks = await promptSkillDiscovery(found);
     try {
-      writeFileSync8(SKILLS_DISCOVERED_PATH, setHash);
+      writeFileSync13(SKILLS_DISCOVERED_PATH, setHash);
     } catch {
     }
     if (picks.length === 0) {
@@ -6281,17 +7990,17 @@ function detectGitRepo2() {
 function getClaudeProjectsFolder() {
   const cwd = process.cwd();
   const sanitized = "-" + cwd.replace(/\//g, "-");
-  const projectsDir = join11(homedir11(), ".claude", "projects", sanitized);
-  return existsSync12(projectsDir) ? projectsDir : null;
+  const projectsDir = join17(homedir17(), ".claude", "projects", sanitized);
+  return existsSync20(projectsDir) ? projectsDir : null;
 }
 function extractSessionInsights(projectsDir) {
   const insights = [];
   const files = readdirSync3(projectsDir).filter((f) => f.endsWith(".jsonl"));
   for (const file of files) {
     const sessionId = file.replace(".jsonl", "");
-    const filePath = join11(projectsDir, file);
+    const filePath = join17(projectsDir, file);
     try {
-      const content = readFileSync11(filePath, "utf-8");
+      const content = readFileSync18(filePath, "utf-8");
       const lines = content.split("\n").filter(Boolean);
       for (let i = 0; i < lines.length; i++) {
         try {
@@ -6370,14 +8079,14 @@ function cursorProjectSlug(workspaceRoot) {
   return workspaceRoot.replace(/^[/]+/, "").replace(/[^a-zA-Z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function getCursorTranscriptsDir() {
-  const dir = join11(homedir11(), ".cursor", "projects", cursorProjectSlug(process.cwd()), "agent-transcripts");
-  return existsSync12(dir) ? dir : null;
+  const dir = join17(homedir17(), ".cursor", "projects", cursorProjectSlug(process.cwd()), "agent-transcripts");
+  return existsSync20(dir) ? dir : null;
 }
 function isSafeConvId(id) {
   return /^[A-Za-z0-9_-]+$/.test(id);
 }
 function parseCursorTranscriptFile(filePath) {
-  const content = readFileSync11(filePath, "utf-8");
+  const content = readFileSync18(filePath, "utf-8");
   const lines = content.split("\n").filter(Boolean);
   const messages = [];
   for (let i = 0; i < lines.length; i++) {
@@ -6409,8 +8118,8 @@ async function syncCursorTranscriptsLocal(mcpPort, mcpToken, repo) {
   for (let i = 0; i < convDirs.length; i++) {
     const convId = convDirs[i];
     if (!isSafeConvId(convId)) continue;
-    const filePath = join11(dir, convId, `${convId}.jsonl`);
-    if (!existsSync12(filePath)) continue;
+    const filePath = join17(dir, convId, `${convId}.jsonl`);
+    if (!existsSync20(filePath)) continue;
     try {
       const all = parseCursorTranscriptFile(filePath);
       const messages = all.length > 500 ? all.slice(-500) : all;
@@ -6432,8 +8141,8 @@ async function syncCursorTranscriptsLocal(mcpPort, mcpToken, repo) {
       process.stdout.write(`\r  Progress: ${i + 1}/${convDirs.length} sessions (${totalMessages} messages embedded)   `);
     }
     try {
-      const lc = readFileSync11(filePath, "utf-8").split("\n").filter(Boolean).length;
-      writeFileSync8(join11(OFFSETS_DIR, convId), String(lc), "utf-8");
+      const lc = readFileSync18(filePath, "utf-8").split("\n").filter(Boolean).length;
+      writeFileSync13(join17(OFFSETS_DIR, convId), String(lc), "utf-8");
     } catch {
     }
   }
@@ -6441,7 +8150,7 @@ async function syncCursorTranscriptsLocal(mcpPort, mcpToken, repo) {
   return { sessions: totalSessions, messages: totalMessages };
 }
 function parseTranscriptFile(filePath) {
-  const content = readFileSync11(filePath, "utf-8");
+  const content = readFileSync18(filePath, "utf-8");
   const lines = content.split("\n").filter(Boolean);
   const messages = [];
   for (let i = 0; i < lines.length; i++) {
@@ -6489,7 +8198,7 @@ async function syncTranscriptsLocal(mcpPort, mcpToken, repo) {
   for (let i = 0; i < files.length; i++) {
     const file = files[i];
     const sessionId = file.replace(".jsonl", "");
-    const filePath = join11(projectsDir, file);
+    const filePath = join17(projectsDir, file);
     try {
       const allMessages = parseTranscriptFile(filePath);
       const messages = allMessages.length > 500 ? allMessages.slice(-500) : allMessages;
@@ -6511,9 +8220,9 @@ async function syncTranscriptsLocal(mcpPort, mcpToken, repo) {
       process.stdout.write(`\r  Progress: ${i + 1}/${files.length} sessions (${totalMessages} messages embedded)   `);
     }
     try {
-      const content = readFileSync11(join11(projectsDir, file), "utf-8");
+      const content = readFileSync18(join17(projectsDir, file), "utf-8");
       const lineCount = content.split("\n").filter(Boolean).length;
-      writeFileSync8(join11(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
+      writeFileSync13(join17(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
     } catch {
     }
   }
@@ -6534,7 +8243,7 @@ async function syncTranscriptsBulk(gatewayUrl, token, repo) {
     const sessions = [];
     for (const file of batch) {
       const sessionId = file.replace(".jsonl", "");
-      const filePath = join11(projectsDir, file);
+      const filePath = join17(projectsDir, file);
       try {
         const allMessages = parseTranscriptFile(filePath);
         const messages = allMessages.length > maxMessagesPerSession ? allMessages.slice(-maxMessagesPerSession) : allMessages;
@@ -6563,18 +8272,18 @@ async function syncTranscriptsBulk(gatewayUrl, token, repo) {
     }
     for (const file of batch) {
       const sessionId = file.replace(".jsonl", "");
-      const filePath = join11(projectsDir, file);
+      const filePath = join17(projectsDir, file);
       try {
-        const content = readFileSync11(filePath, "utf-8");
+        const content = readFileSync18(filePath, "utf-8");
         const lineCount = content.split("\n").filter(Boolean).length;
-        writeFileSync8(join11(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
+        writeFileSync13(join17(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
       } catch {
       }
     }
   }
   return { sessions: totalSessions, messages: totalMessages };
 }
-var SYNKRO_DIR6, HOOKS_DIR, BIN_DIR, CONFIG_PATH2, MCP_STDIO_PROXY_SRC, OFFSETS_DIR, CLOUD_JWT_PATH, SKILLS_DISCOVERED_PATH;
+var SYNKRO_DIR11, HOOKS_DIR, BIN_DIR, CONFIG_PATH4, MCP_STDIO_PROXY_SRC, OFFSETS_DIR, CLOUD_JWT_PATH, SKILLS_DISCOVERED_PATH;
 var init_install = __esm({
   "cli/commands/install.ts"() {
     "use strict";
@@ -6583,6 +8292,7 @@ var init_install = __esm({
     init_cursorHookConfig();
     init_mcpConfig();
     init_skillParser();
+    init_telemetry();
     init_hookScriptsTs();
     init_stub();
     init_repoConnect();
@@ -6591,10 +8301,10 @@ var init_install = __esm({
     init_claudeDesktopTap();
     init_dockerInstall();
     init_setupToken();
-    SYNKRO_DIR6 = join11(homedir11(), ".synkro");
-    HOOKS_DIR = join11(SYNKRO_DIR6, "hooks");
-    BIN_DIR = join11(SYNKRO_DIR6, "bin");
-    CONFIG_PATH2 = join11(SYNKRO_DIR6, "config.env");
+    SYNKRO_DIR11 = join17(homedir17(), ".synkro");
+    HOOKS_DIR = join17(SYNKRO_DIR11, "hooks");
+    BIN_DIR = join17(SYNKRO_DIR11, "bin");
+    CONFIG_PATH4 = join17(SYNKRO_DIR11, "config.env");
     MCP_STDIO_PROXY_SRC = `#!/usr/bin/env bun
 import { readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
@@ -6705,23 +8415,23 @@ rl.on('line', async (line) => {
   }
 });
 `;
-    OFFSETS_DIR = join11(SYNKRO_DIR6, ".transcript-offsets");
-    CLOUD_JWT_PATH = join11(SYNKRO_DIR6, ".cloud-jwt");
-    SKILLS_DISCOVERED_PATH = join11(SYNKRO_DIR6, ".skills-discovered");
+    OFFSETS_DIR = join17(SYNKRO_DIR11, ".transcript-offsets");
+    CLOUD_JWT_PATH = join17(SYNKRO_DIR11, ".cloud-jwt");
+    SKILLS_DISCOVERED_PATH = join17(SYNKRO_DIR11, ".skills-discovered");
   }
 });
 
 // cli/local-cc/install.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync11, writeFileSync as writeFileSync9, readFileSync as readFileSync12, chmodSync as chmodSync3, copyFileSync as copyFileSync2, renameSync as renameSync4, unlinkSync as unlinkSync5, openSync, fsyncSync, closeSync } from "fs";
-import { join as join12 } from "path";
-import { homedir as homedir12 } from "os";
+import { existsSync as existsSync21, mkdirSync as mkdirSync14, writeFileSync as writeFileSync14, readFileSync as readFileSync19, chmodSync as chmodSync4, copyFileSync as copyFileSync2, renameSync as renameSync6, unlinkSync as unlinkSync7, openSync as openSync2, fsyncSync, closeSync as closeSync2 } from "fs";
+import { join as join18 } from "path";
+import { homedir as homedir18 } from "os";
 import { spawnSync as spawnSync6 } from "child_process";
 function writePluginFiles() {
   for (const c of CHANNELS) {
-    mkdirSync11(c.sessionDir, { recursive: true });
-    mkdirSync11(c.pluginSettingsDir, { recursive: true });
-    writeFileSync9(c.pluginPkgPath, PLUGIN_PACKAGE_JSON, "utf-8");
-    writeFileSync9(
+    mkdirSync14(c.sessionDir, { recursive: true });
+    mkdirSync14(c.pluginSettingsDir, { recursive: true });
+    writeFileSync14(c.pluginPkgPath, PLUGIN_PACKAGE_JSON, "utf-8");
+    writeFileSync14(
       c.pluginSettingsPath,
       JSON.stringify({
         fastMode: true,
@@ -6736,8 +8446,8 @@ function writePluginFiles() {
       }, null, 2) + "\n",
       "utf-8"
     );
-    writeFileSync9(c.runScriptPath, c.runScriptSource, "utf-8");
-    chmodSync3(c.runScriptPath, 493);
+    writeFileSync14(c.runScriptPath, c.runScriptSource, "utf-8");
+    chmodSync4(c.runScriptPath, 493);
   }
 }
 function runBunInstall() {
@@ -6755,10 +8465,10 @@ function runBunInstall() {
   }
 }
 function safelyMutateClaudeJson(mutator) {
-  if (!existsSync13(CLAUDE_JSON_PATH)) {
+  if (!existsSync21(CLAUDE_JSON_PATH)) {
     return;
   }
-  const originalText = readFileSync12(CLAUDE_JSON_PATH, "utf-8");
+  const originalText = readFileSync19(CLAUDE_JSON_PATH, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(originalText);
@@ -6790,17 +8500,17 @@ function safelyMutateClaudeJson(mutator) {
   copyFileSync2(CLAUDE_JSON_PATH, CLAUDE_JSON_BACKUP_PATH);
   const tmpPath = `${CLAUDE_JSON_PATH}.synkro-tmp.${process.pid}`;
   try {
-    writeFileSync9(tmpPath, newText, "utf-8");
-    const fd = openSync(tmpPath, "r");
+    writeFileSync14(tmpPath, newText, "utf-8");
+    const fd = openSync2(tmpPath, "r");
     try {
       fsyncSync(fd);
     } finally {
-      closeSync(fd);
+      closeSync2(fd);
     }
-    renameSync4(tmpPath, CLAUDE_JSON_PATH);
+    renameSync6(tmpPath, CLAUDE_JSON_PATH);
   } catch (err) {
     try {
-      unlinkSync5(tmpPath);
+      unlinkSync7(tmpPath);
     } catch {
     }
     try {
@@ -6823,7 +8533,7 @@ function writeProjectMcpJson() {
         }
       }
     };
-    writeFileSync9(c.projectMcpPath, JSON.stringify(mcp, null, 2) + "\n", "utf-8");
+    writeFileSync14(c.projectMcpPath, JSON.stringify(mcp, null, 2) + "\n", "utf-8");
   }
 }
 function patchClaudeJson() {
@@ -6900,42 +8610,42 @@ var CLAUDE_JSON_BACKUP_PATH, SESSION_DIR, PLUGIN_PATH, PLUGIN_PKG_PATH, PLUGIN_S
 var init_install2 = __esm({
   "cli/local-cc/install.ts"() {
     "use strict";
-    CLAUDE_JSON_BACKUP_PATH = join12(homedir12(), ".claude.json.synkro-bak");
-    SESSION_DIR = join12(homedir12(), ".synkro", "cc_sessions");
-    PLUGIN_PATH = join12(SESSION_DIR, "synkro-channel.ts");
-    PLUGIN_PKG_PATH = join12(SESSION_DIR, "package.json");
-    PLUGIN_SETTINGS_DIR = join12(SESSION_DIR, ".claude");
-    PLUGIN_SETTINGS_PATH = join12(PLUGIN_SETTINGS_DIR, "settings.json");
-    PROJECT_MCP_PATH = join12(SESSION_DIR, ".mcp.json");
-    CLAUDE_JSON_PATH = join12(homedir12(), ".claude.json");
-    RUN_SCRIPT_PATH = join12(SESSION_DIR, "run-claude.sh");
+    CLAUDE_JSON_BACKUP_PATH = join18(homedir18(), ".claude.json.synkro-bak");
+    SESSION_DIR = join18(homedir18(), ".synkro", "cc_sessions");
+    PLUGIN_PATH = join18(SESSION_DIR, "synkro-channel.ts");
+    PLUGIN_PKG_PATH = join18(SESSION_DIR, "package.json");
+    PLUGIN_SETTINGS_DIR = join18(SESSION_DIR, ".claude");
+    PLUGIN_SETTINGS_PATH = join18(PLUGIN_SETTINGS_DIR, "settings.json");
+    PROJECT_MCP_PATH = join18(SESSION_DIR, ".mcp.json");
+    CLAUDE_JSON_PATH = join18(homedir18(), ".claude.json");
+    RUN_SCRIPT_PATH = join18(SESSION_DIR, "run-claude.sh");
     TMUX_SESSION_NAME = "synkro-local-cc";
     CHANNEL_1_PORT = 8941;
-    SESSION_DIR_2 = join12(homedir12(), ".synkro", "cc_sessions_2");
-    PLUGIN_PATH_2 = join12(SESSION_DIR_2, "synkro-channel.ts");
-    PLUGIN_PKG_PATH_2 = join12(SESSION_DIR_2, "package.json");
-    PLUGIN_SETTINGS_DIR_2 = join12(SESSION_DIR_2, ".claude");
-    PLUGIN_SETTINGS_PATH_2 = join12(PLUGIN_SETTINGS_DIR_2, "settings.json");
-    PROJECT_MCP_PATH_2 = join12(SESSION_DIR_2, ".mcp.json");
-    RUN_SCRIPT_PATH_2 = join12(SESSION_DIR_2, "run-claude.sh");
+    SESSION_DIR_2 = join18(homedir18(), ".synkro", "cc_sessions_2");
+    PLUGIN_PATH_2 = join18(SESSION_DIR_2, "synkro-channel.ts");
+    PLUGIN_PKG_PATH_2 = join18(SESSION_DIR_2, "package.json");
+    PLUGIN_SETTINGS_DIR_2 = join18(SESSION_DIR_2, ".claude");
+    PLUGIN_SETTINGS_PATH_2 = join18(PLUGIN_SETTINGS_DIR_2, "settings.json");
+    PROJECT_MCP_PATH_2 = join18(SESSION_DIR_2, ".mcp.json");
+    RUN_SCRIPT_PATH_2 = join18(SESSION_DIR_2, "run-claude.sh");
     TMUX_SESSION_NAME_2 = "synkro-local-cc-2";
     CHANNEL_2_PORT = 8951;
-    SESSION_DIR_3 = join12(homedir12(), ".synkro", "cc_sessions_3");
-    PLUGIN_PATH_3 = join12(SESSION_DIR_3, "synkro-channel.ts");
-    PLUGIN_PKG_PATH_3 = join12(SESSION_DIR_3, "package.json");
-    PLUGIN_SETTINGS_DIR_3 = join12(SESSION_DIR_3, ".claude");
-    PLUGIN_SETTINGS_PATH_3 = join12(PLUGIN_SETTINGS_DIR_3, "settings.json");
-    PROJECT_MCP_PATH_3 = join12(SESSION_DIR_3, ".mcp.json");
-    RUN_SCRIPT_PATH_3 = join12(SESSION_DIR_3, "run-claude.sh");
+    SESSION_DIR_3 = join18(homedir18(), ".synkro", "cc_sessions_3");
+    PLUGIN_PATH_3 = join18(SESSION_DIR_3, "synkro-channel.ts");
+    PLUGIN_PKG_PATH_3 = join18(SESSION_DIR_3, "package.json");
+    PLUGIN_SETTINGS_DIR_3 = join18(SESSION_DIR_3, ".claude");
+    PLUGIN_SETTINGS_PATH_3 = join18(PLUGIN_SETTINGS_DIR_3, "settings.json");
+    PROJECT_MCP_PATH_3 = join18(SESSION_DIR_3, ".mcp.json");
+    RUN_SCRIPT_PATH_3 = join18(SESSION_DIR_3, "run-claude.sh");
     TMUX_SESSION_NAME_3 = "synkro-local-cc-3";
     CHANNEL_3_PORT = 8942;
-    SESSION_DIR_4 = join12(homedir12(), ".synkro", "cc_sessions_4");
-    PLUGIN_PATH_4 = join12(SESSION_DIR_4, "synkro-channel.ts");
-    PLUGIN_PKG_PATH_4 = join12(SESSION_DIR_4, "package.json");
-    PLUGIN_SETTINGS_DIR_4 = join12(SESSION_DIR_4, ".claude");
-    PLUGIN_SETTINGS_PATH_4 = join12(PLUGIN_SETTINGS_DIR_4, "settings.json");
-    PROJECT_MCP_PATH_4 = join12(SESSION_DIR_4, ".mcp.json");
-    RUN_SCRIPT_PATH_4 = join12(SESSION_DIR_4, "run-claude.sh");
+    SESSION_DIR_4 = join18(homedir18(), ".synkro", "cc_sessions_4");
+    PLUGIN_PATH_4 = join18(SESSION_DIR_4, "synkro-channel.ts");
+    PLUGIN_PKG_PATH_4 = join18(SESSION_DIR_4, "package.json");
+    PLUGIN_SETTINGS_DIR_4 = join18(SESSION_DIR_4, ".claude");
+    PLUGIN_SETTINGS_PATH_4 = join18(PLUGIN_SETTINGS_DIR_4, "settings.json");
+    PROJECT_MCP_PATH_4 = join18(SESSION_DIR_4, ".mcp.json");
+    RUN_SCRIPT_PATH_4 = join18(SESSION_DIR_4, "run-claude.sh");
     TMUX_SESSION_NAME_4 = "synkro-local-cc-4";
     CHANNEL_4_PORT = 8952;
     RUN_SCRIPT_SOURCE = `#!/usr/bin/env bash
@@ -7209,9 +8919,9 @@ var disconnect_exports = {};
 __export(disconnect_exports, {
   disconnectCommand: () => disconnectCommand
 });
-import { existsSync as existsSync14, rmSync as rmSync2, readdirSync as readdirSync4 } from "fs";
-import { homedir as homedir13 } from "os";
-import { join as join13 } from "path";
+import { existsSync as existsSync22, rmSync as rmSync2, readdirSync as readdirSync4 } from "fs";
+import { homedir as homedir19 } from "os";
+import { join as join19 } from "path";
 import { spawnSync as spawnSync7 } from "child_process";
 import { createInterface as createInterface4 } from "readline";
 async function tearDownLocalCC() {
@@ -7257,9 +8967,12 @@ function confirmPurge() {
     });
   });
 }
-async function disconnectCommand(args2 = []) {
-  const purge = args2.includes("--purge");
-  if (purge && !await confirmPurge()) {
+async function disconnectCommand(args2 = [], opts = {}) {
+  const purge2 = args2.includes("--purge");
+  const flavor = opts.flavor ?? (process.argv[2] === "uninstall" ? "uninstall" : "disconnect");
+  const startedAt = Date.now();
+  const removed = { hooks: false, mcp: false, config: false, telemetry_db: false };
+  if (purge2 && !await confirmPurge()) {
     console.log("\nAborted \u2014 nothing was removed.");
     return;
   }
@@ -7270,57 +8983,74 @@ async function disconnectCommand(args2 = []) {
   for (const agent of agents) {
     if (agent.kind === "claude_code") {
       sawClaudeCode = true;
-      const removed = uninstallCCHooks(agent.settingsPath);
-      console.log(`${removed ? "\u2713" : "\xB7"} ${agent.name}: ${removed ? "removed Synkro hook entries" : "no Synkro hooks found"}`);
+      const r = uninstallCCHooks(agent.settingsPath);
+      if (r) removed.hooks = true;
+      console.log(`${r ? "\u2713" : "\xB7"} ${agent.name}: ${r ? "removed Synkro hook entries" : "no Synkro hooks found"}`);
     } else if (agent.kind === "cursor") {
-      const removed = uninstallCursorHooks(agent.settingsPath);
-      console.log(`${removed ? "\u2713" : "\xB7"} ${agent.name}: ${removed ? "removed Synkro hook entries" : "no Synkro hooks found"}`);
+      const r = uninstallCursorHooks(agent.settingsPath);
+      if (r) removed.hooks = true;
+      console.log(`${r ? "\u2713" : "\xB7"} ${agent.name}: ${r ? "removed Synkro hook entries" : "no Synkro hooks found"}`);
     }
   }
   if (sawClaudeCode) {
     const mcpRemoved = uninstallMcpConfig();
+    if (mcpRemoved) removed.mcp = true;
     console.log(`${mcpRemoved ? "\u2713" : "\xB7"} MCP guardrails (CC): ${mcpRemoved ? "removed from ~/.claude.json" : "no entry found"}`);
   }
   {
     const cursorMcpRemoved = uninstallCursorMcpConfig();
+    if (cursorMcpRemoved) removed.mcp = true;
     console.log(`${cursorMcpRemoved ? "\u2713" : "\xB7"} MCP guardrails (Cursor): ${cursorMcpRemoved ? "removed from ~/.cursor/mcp.json" : "no entry found"}`);
   }
   {
     const desktopMcpRemoved = uninstallClaudeDesktopMcpConfig();
+    if (desktopMcpRemoved) removed.mcp = true;
     console.log(`${desktopMcpRemoved ? "\u2713" : "\xB7"} MCP guardrails (Claude Desktop): ${desktopMcpRemoved ? "removed from claude_desktop_config.json" : "no entry found"}`);
   }
-  if (existsSync14(SYNKRO_DIR7)) {
-    if (purge) {
-      rmSync2(SYNKRO_DIR7, { recursive: true, force: true });
-      console.log(`\u2713 wiped ${SYNKRO_DIR7} entirely \u2014 including all scan data and backups`);
+  if (existsSync22(SYNKRO_DIR12)) {
+    if (purge2) {
+      emit("uninstall", {
+        flavor,
+        purge: purge2,
+        removed: { ...removed, config: true },
+        duration_ms: Date.now() - startedAt
+      });
+      await flush({ force: true });
+      rmSync2(SYNKRO_DIR12, { recursive: true, force: true });
+      removed.config = true;
+      console.log(`\u2713 wiped ${SYNKRO_DIR12} entirely \u2014 including all scan data and backups`);
     } else {
       const keep = /* @__PURE__ */ new Set([
-        join13(SYNKRO_DIR7, "pgdata"),
-        join13(SYNKRO_DIR7, "pgdata-backups"),
-        join13(SYNKRO_DIR7, ".transcript-offsets")
+        join19(SYNKRO_DIR12, "pgdata"),
+        join19(SYNKRO_DIR12, "pgdata-backups"),
+        join19(SYNKRO_DIR12, ".transcript-offsets")
       ]);
       const preserved = [];
-      for (const entry of readdirSync4(SYNKRO_DIR7)) {
-        const full = join13(SYNKRO_DIR7, entry);
+      for (const entry of readdirSync4(SYNKRO_DIR12)) {
+        const full = join19(SYNKRO_DIR12, entry);
         if (keep.has(full)) {
           preserved.push(entry);
           continue;
         }
         rmSync2(full, { recursive: true, force: true });
       }
+      removed.config = true;
       if (preserved.length > 0) {
-        console.log(`\u2713 removed Synkro config from ${SYNKRO_DIR7} (kept your scan data: ${preserved.join(", ")})`);
+        console.log(`\u2713 removed Synkro config from ${SYNKRO_DIR12} (kept your scan data: ${preserved.join(", ")})`);
         console.log("  run `synkro uninstall --purge` to delete that too");
       } else {
-        console.log(`\u2713 removed ${SYNKRO_DIR7}`);
+        console.log(`\u2713 removed ${SYNKRO_DIR12}`);
       }
     }
   } else {
-    console.log(`\xB7 ${SYNKRO_DIR7} already gone`);
+    console.log(`\xB7 ${SYNKRO_DIR12} already gone`);
   }
-  console.log(purge ? "\nSynkro fully removed \u2014 this machine is clean, as if it was never installed." : "\nSynkro uninstalled. Your scan data is preserved.");
+  if (!purge2) {
+    emit("uninstall", { flavor, purge: purge2, removed, duration_ms: Date.now() - startedAt });
+  }
+  console.log(purge2 ? "\nSynkro fully removed \u2014 this machine is clean, as if it was never installed." : "\nSynkro uninstalled. Your scan data is preserved.");
 }
-var SYNKRO_DIR7;
+var SYNKRO_DIR12;
 var init_disconnect = __esm({
   "cli/commands/disconnect.ts"() {
     "use strict";
@@ -7331,14 +9061,15 @@ var init_disconnect = __esm({
     init_install2();
     init_dockerInstall();
     init_macKeychain();
-    SYNKRO_DIR7 = join13(homedir13(), ".synkro");
+    init_telemetry();
+    SYNKRO_DIR12 = join19(homedir19(), ".synkro");
   }
 });
 
 // cli/local-cc/turnLog.ts
-import { appendFileSync, existsSync as existsSync15, mkdirSync as mkdirSync12, openSync as openSync2, readFileSync as readFileSync13, readSync, closeSync as closeSync2, statSync as statSync2, watchFile, unwatchFile } from "fs";
-import { dirname as dirname6, join as join14 } from "path";
-import { homedir as homedir14 } from "os";
+import { appendFileSync as appendFileSync3, existsSync as existsSync23, mkdirSync as mkdirSync15, openSync as openSync3, readFileSync as readFileSync20, readSync, closeSync as closeSync3, statSync as statSync3, watchFile, unwatchFile } from "fs";
+import { dirname as dirname6, join as join20 } from "path";
+import { homedir as homedir20 } from "os";
 function truncate(s, max = PREVIEW_MAX) {
   if (s.length <= max) return s;
   return s.slice(0, max) + "\u2026 [+" + (s.length - max) + " chars]";
@@ -7358,7 +9089,7 @@ function extractSeverity(result) {
 }
 function appendTurn(args2) {
   try {
-    mkdirSync12(dirname6(TURN_LOG_PATH), { recursive: true });
+    mkdirSync15(dirname6(TURN_LOG_PATH), { recursive: true });
     const entry = {
       ts: new Date(args2.startedAt).toISOString(),
       role: args2.role,
@@ -7369,16 +9100,16 @@ function appendTurn(args2) {
       severity: args2.result ? extractSeverity(args2.result) : void 0,
       error: args2.error
     };
-    appendFileSync(TURN_LOG_PATH, JSON.stringify(entry) + "\n", "utf-8");
+    appendFileSync3(TURN_LOG_PATH, JSON.stringify(entry) + "\n", "utf-8");
   } catch {
   }
 }
 function readRecentTurns(n = 20) {
-  if (!existsSync15(TURN_LOG_PATH)) return [];
+  if (!existsSync23(TURN_LOG_PATH)) return [];
   try {
-    const size = statSync2(TURN_LOG_PATH).size;
+    const size = statSync3(TURN_LOG_PATH).size;
     if (size === 0) return [];
-    const text = readFileSync13(TURN_LOG_PATH, "utf-8");
+    const text = readFileSync20(TURN_LOG_PATH, "utf-8");
     const lines = text.split("\n").filter(Boolean);
     const lastN = lines.slice(-n).reverse();
     return lastN.map((line) => {
@@ -7394,15 +9125,15 @@ function readRecentTurns(n = 20) {
 }
 function followTurns(onEntry) {
   try {
-    mkdirSync12(dirname6(TURN_LOG_PATH), { recursive: true });
-    if (!existsSync15(TURN_LOG_PATH)) {
-      appendFileSync(TURN_LOG_PATH, "", "utf-8");
+    mkdirSync15(dirname6(TURN_LOG_PATH), { recursive: true });
+    if (!existsSync23(TURN_LOG_PATH)) {
+      appendFileSync3(TURN_LOG_PATH, "", "utf-8");
     }
   } catch {
   }
   let lastSize = (() => {
     try {
-      return statSync2(TURN_LOG_PATH).size;
+      return statSync3(TURN_LOG_PATH).size;
     } catch {
       return 0;
     }
@@ -7412,7 +9143,7 @@ function followTurns(onEntry) {
     if (to <= from) return;
     let fd = null;
     try {
-      fd = openSync2(TURN_LOG_PATH, "r");
+      fd = openSync3(TURN_LOG_PATH, "r");
       const len = to - from;
       const buf = Buffer.alloc(len);
       readSync(fd, buf, 0, len, from);
@@ -7435,7 +9166,7 @@ function followTurns(onEntry) {
     } finally {
       if (fd !== null) {
         try {
-          closeSync2(fd);
+          closeSync3(fd);
         } catch {
         }
       }
@@ -7457,7 +9188,7 @@ var TURN_LOG_PATH, PREVIEW_MAX;
 var init_turnLog = __esm({
   "cli/local-cc/turnLog.ts"() {
     "use strict";
-    TURN_LOG_PATH = join14(homedir14(), ".synkro", "cc_sessions", "turns.log");
+    TURN_LOG_PATH = join20(homedir20(), ".synkro", "cc_sessions", "turns.log");
     PREVIEW_MAX = 400;
   }
 });
@@ -7538,7 +9269,7 @@ function isChannelAvailable(port = CHANNEL_PORT, timeoutMs = 500) {
   });
 }
 var CHANNEL_HOST, CHANNEL_PORT, DEFAULT_TIMEOUT_MS, LocalCCError;
-var init_client = __esm({
+var init_client2 = __esm({
   "cli/local-cc/client.ts"() {
     "use strict";
     init_turnLog();
@@ -7601,14 +9332,14 @@ async function gradeCommand(args2) {
 var init_grade = __esm({
   "cli/commands/grade.ts"() {
     "use strict";
-    init_client();
+    init_client2();
   }
 });
 
 // cli/local-cc/pueue.ts
-import { execFileSync as execFileSync3, spawnSync as spawnSync8, spawn as spawn2 } from "child_process";
-import { homedir as homedir15 } from "os";
-import { join as join15 } from "path";
+import { execFileSync as execFileSync4, spawnSync as spawnSync8, spawn as spawn3 } from "child_process";
+import { homedir as homedir21 } from "os";
+import { join as join21 } from "path";
 import { connect as connect2 } from "net";
 function pueueAvailable() {
   const r = spawnSync8("pueue", ["--version"], { encoding: "utf-8" });
@@ -7674,7 +9405,7 @@ function startTask(opts = {}) {
     spawnSync8("pueue", ["remove", String(existing.id)], { encoding: "utf-8" });
     existing = findTask(ch);
   }
-  const runScript = join15(cwd, "run-claude.sh");
+  const runScript = join21(cwd, "run-claude.sh");
   const args2 = [
     "add",
     "--label",
@@ -7771,7 +9502,7 @@ function assertPueueInstalled() {
   const status = spawnSync8("pueue", ["status", "--json"], { encoding: "utf-8", timeout: 5e3 });
   if (status.status !== 0) {
     console.log("  Starting pueued daemon...");
-    const child = spawn2("pueued", ["-d"], { stdio: "ignore", detached: true });
+    const child = spawn3("pueued", ["-d"], { stdio: "ignore", detached: true });
     child.unref();
     spawnSync8("sleep", ["1"]);
     const retry = spawnSync8("pueue", ["status", "--json"], { encoding: "utf-8", timeout: 5e3 });
@@ -7804,12 +9535,12 @@ var init_pueue = __esm({
     "use strict";
     TASK_LABEL = "synkro-local-cc";
     TMUX_SESSION = "synkro-local-cc";
-    SESSION_DIR2 = join15(homedir15(), ".synkro", "cc_sessions");
+    SESSION_DIR2 = join21(homedir21(), ".synkro", "cc_sessions");
     TASK_LABEL_2 = "synkro-local-cc-2";
     TMUX_SESSION_2 = "synkro-local-cc-2";
-    SESSION_DIR_22 = join15(homedir15(), ".synkro", "cc_sessions_2");
-    SESSION_DIR_32 = join15(homedir15(), ".synkro", "cc_sessions_3");
-    SESSION_DIR_42 = join15(homedir15(), ".synkro", "cc_sessions_4");
+    SESSION_DIR_22 = join21(homedir21(), ".synkro", "cc_sessions_2");
+    SESSION_DIR_32 = join21(homedir21(), ".synkro", "cc_sessions_3");
+    SESSION_DIR_42 = join21(homedir21(), ".synkro", "cc_sessions_4");
     PueueError = class extends Error {
       constructor(message, cause) {
         super(message);
@@ -7824,24 +9555,24 @@ var init_pueue = __esm({
 });
 
 // cli/local-cc/settings.ts
-import { existsSync as existsSync16, readFileSync as readFileSync14 } from "fs";
-import { homedir as homedir16 } from "os";
-import { join as join16 } from "path";
+import { existsSync as existsSync24, readFileSync as readFileSync21 } from "fs";
+import { homedir as homedir22 } from "os";
+import { join as join22 } from "path";
 function isLocalCCEnabled() {
-  if (!existsSync16(CONFIG_PATH3)) return false;
+  if (!existsSync24(CONFIG_PATH5)) return false;
   try {
-    const content = readFileSync14(CONFIG_PATH3, "utf-8");
+    const content = readFileSync21(CONFIG_PATH5, "utf-8");
     const match = content.match(/^SYNKRO_LOCAL_INFERENCE='([^']*)'/m);
     return match?.[1] === "yes";
   } catch {
     return false;
   }
 }
-var CONFIG_PATH3;
+var CONFIG_PATH5;
 var init_settings = __esm({
   "cli/local-cc/settings.ts"() {
     "use strict";
-    CONFIG_PATH3 = join16(homedir16(), ".synkro", "config.env");
+    CONFIG_PATH5 = join22(homedir22(), ".synkro", "config.env");
   }
 });
 
@@ -7851,10 +9582,10 @@ __export(localCc_exports, {
   localCcCommand: () => localCcCommand
 });
 import { spawnSync as spawnSync9 } from "child_process";
-import { homedir as homedir17 } from "os";
-import { join as join17 } from "path";
+import { homedir as homedir23 } from "os";
+import { join as join23 } from "path";
 import { readFileSync as fsReadFileSync, existsSync as fsExistsSync } from "fs";
-import { existsSync as existsSync17, readFileSync as readFileSync15, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync25, readFileSync as readFileSync22, writeFileSync as writeFileSync15 } from "fs";
 function deploymentMode() {
   const env = (process.env.SYNKRO_DEPLOYMENT_MODE || "").toLowerCase();
   if (env === "docker") return "docker";
@@ -7960,15 +9691,15 @@ TROUBLESHOOTING
 `);
 }
 function readGatewayUrl() {
-  if (existsSync17(CONFIG_PATH4)) {
-    const m = readFileSync15(CONFIG_PATH4, "utf-8").match(/^SYNKRO_GATEWAY_URL='([^']*)'/m);
+  if (existsSync25(CONFIG_PATH6)) {
+    const m = readFileSync22(CONFIG_PATH6, "utf-8").match(/^SYNKRO_GATEWAY_URL='([^']*)'/m);
     if (m) return m[1];
   }
   return "https://api.synkro.sh";
 }
 function updateLocalInferenceFlag(enabled) {
-  if (!existsSync17(CONFIG_PATH4)) return;
-  let content = readFileSync15(CONFIG_PATH4, "utf-8");
+  if (!existsSync25(CONFIG_PATH6)) return;
+  let content = readFileSync22(CONFIG_PATH6, "utf-8");
   const flag = enabled ? "yes" : "no";
   if (content.includes("SYNKRO_LOCAL_INFERENCE=")) {
     content = content.replace(/^SYNKRO_LOCAL_INFERENCE='[^']*'/m, `SYNKRO_LOCAL_INFERENCE='${flag}'`);
@@ -7977,7 +9708,7 @@ function updateLocalInferenceFlag(enabled) {
 SYNKRO_LOCAL_INFERENCE='${flag}'
 `;
   }
-  writeFileSync10(CONFIG_PATH4, content, "utf-8");
+  writeFileSync15(CONFIG_PATH6, content, "utf-8");
 }
 async function setServerGradingProvider(provider) {
   await ensureValidToken();
@@ -8396,7 +10127,7 @@ async function localCcCommand(args2) {
     process.exit(1);
   }
 }
-var SYNKRO_CONFIG_PATH, CONFIG_PATH4;
+var SYNKRO_CONFIG_PATH, CONFIG_PATH6;
 var init_localCc = __esm({
   "cli/commands/localCc.ts"() {
     "use strict";
@@ -8407,10 +10138,10 @@ var init_localCc = __esm({
     init_macKeychain();
     init_dockerInstall();
     init_install();
-    init_client();
+    init_client2();
     init_stub();
-    SYNKRO_CONFIG_PATH = join17(homedir17(), ".synkro", "config.env");
-    CONFIG_PATH4 = join17(homedir17(), ".synkro", "config.env");
+    SYNKRO_CONFIG_PATH = join23(homedir23(), ".synkro", "config.env");
+    CONFIG_PATH6 = join23(homedir23(), ".synkro", "config.env");
   }
 });
 
@@ -8419,15 +10150,15 @@ var import_exports = {};
 __export(import_exports, {
   importCommand: () => importCommand
 });
-import { existsSync as existsSync18, readFileSync as readFileSync16, readdirSync as readdirSync5 } from "fs";
-import { homedir as homedir18 } from "os";
-import { join as join18 } from "path";
+import { existsSync as existsSync26, readFileSync as readFileSync23, readdirSync as readdirSync5 } from "fs";
+import { homedir as homedir24 } from "os";
+import { join as join24 } from "path";
 import { execSync as execSync7 } from "child_process";
 import { createInterface as createInterface5 } from "readline";
-function readConfigEnv() {
+function readConfigEnv2() {
   const out = {};
   try {
-    for (const line of readFileSync16(CONFIG_PATH5, "utf-8").split("\n")) {
+    for (const line of readFileSync23(CONFIG_PATH7, "utf-8").split("\n")) {
       const t = line.trim();
       if (!t || t.startsWith("#")) continue;
       const eq = t.indexOf("=");
@@ -8439,8 +10170,8 @@ function readConfigEnv() {
 }
 function projectsFolder() {
   const sanitized = process.cwd().replace(/\//g, "-");
-  const dir = join18(homedir18(), ".claude", "projects", sanitized);
-  return existsSync18(dir) ? dir : null;
+  const dir = join24(homedir24(), ".claude", "projects", sanitized);
+  return existsSync26(dir) ? dir : null;
 }
 function repoName() {
   try {
@@ -8463,7 +10194,7 @@ function extractText(content) {
   return "";
 }
 function parseSession(filePath, sessionId) {
-  const lines = readFileSync16(filePath, "utf-8").split("\n").filter(Boolean);
+  const lines = readFileSync23(filePath, "utf-8").split("\n").filter(Boolean);
   const messages = [];
   const actions = [];
   let step = 0;
@@ -8515,7 +10246,7 @@ function ask2(q) {
   }));
 }
 async function importCommand() {
-  const config = readConfigEnv();
+  const config = readConfigEnv2();
   const isCloud = config.SYNKRO_DEPLOY_LOCATION === "cloud" || config.SYNKRO_STORAGE_MODE === "cloud";
   const repo = repoName();
   const dir = projectsFolder();
@@ -8536,7 +10267,7 @@ async function importCommand() {
       return;
     }
   }
-  const sessions = files.map((f) => parseSession(join18(dir, f), f.replace(".jsonl", ""))).filter((s) => s.messages.length > 0);
+  const sessions = files.map((f) => parseSession(join24(dir, f), f.replace(".jsonl", ""))).filter((s) => s.messages.length > 0);
   const totalMsgs = sessions.reduce((n, s) => n + s.messages.length, 0);
   let ok = 0, fail = 0;
   if (isCloud) {
@@ -8591,12 +10322,12 @@ async function importCommand() {
   console.log(`
 \u2713 Imported ${ok} session(s) (${totalMsgs} messages)${fail ? `, ${fail} failed` : ""}.`);
 }
-var CONFIG_PATH5;
+var CONFIG_PATH7;
 var init_import = __esm({
   "cli/commands/import.ts"() {
     "use strict";
     init_stub();
-    CONFIG_PATH5 = join18(homedir18(), ".synkro", "config.env");
+    CONFIG_PATH7 = join24(homedir24(), ".synkro", "config.env");
   }
 });
 
@@ -8638,10 +10369,10 @@ var init_packVerify = __esm({
 });
 
 // cli/installer/lockfile.ts
-import { existsSync as existsSync19, readFileSync as readFileSync17, writeFileSync as writeFileSync11 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync27, readFileSync as readFileSync24, writeFileSync as writeFileSync16 } from "fs";
+import { join as join25 } from "path";
 function lockPath(repoRoot) {
-  return join19(repoRoot, LOCK_FILE);
+  return join25(repoRoot, LOCK_FILE);
 }
 function writeLockfile(repoRoot, entries) {
   const sorted = [...entries].sort((a, b) => a.ref.localeCompare(b.ref));
@@ -8659,7 +10390,7 @@ function writeLockfile(repoRoot, entries) {
       ""
     ])
   ].join("\n");
-  writeFileSync11(lockPath(repoRoot), body, "utf-8");
+  writeFileSync16(lockPath(repoRoot), body, "utf-8");
 }
 var LOCK_FILE;
 var init_lockfile = __esm({
@@ -8674,9 +10405,9 @@ var sync_exports = {};
 __export(sync_exports, {
   syncCommand: () => syncCommand
 });
-import { existsSync as existsSync20, mkdirSync as mkdirSync13, readdirSync as readdirSync6, rmSync as rmSync3, writeFileSync as writeFileSync12 } from "fs";
-import { homedir as homedir19 } from "os";
-import { join as join20 } from "path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync16, readdirSync as readdirSync6, rmSync as rmSync3, writeFileSync as writeFileSync17 } from "fs";
+import { homedir as homedir25 } from "os";
+import { join as join26 } from "path";
 function cacheKey(ref, version) {
   return ref.replace(/\//g, "__").replace(/[^\w.@-]/g, "_") + "@" + version + ".json";
 }
@@ -8707,8 +10438,8 @@ async function syncCommand(_args = []) {
   }
   const gateway = (process.env.SYNKRO_GATEWAY_URL || "https://api.synkro.sh").replace(/\/$/, "");
   const cloud = process.env.SYNKRO_DEPLOY_LOCATION === "cloud";
-  const cacheDir = join20(homedir19(), ".synkro", "cache", "packs");
-  if (!cloud) mkdirSync13(cacheDir, { recursive: true });
+  const cacheDir = join26(homedir25(), ".synkro", "cache", "packs");
+  if (!cloud) mkdirSync16(cacheDir, { recursive: true });
   console.log(`Syncing ${refs.length} standard(s) from the registry\u2026`);
   const lock = [];
   const keptCacheFiles = /* @__PURE__ */ new Set();
@@ -8736,7 +10467,7 @@ async function syncCommand(_args = []) {
     if (!cloud) {
       const fname = cacheKey(ref, data.version);
       keptCacheFiles.add(fname);
-      writeFileSync12(join20(cacheDir, fname), JSON.stringify({
+      writeFileSync17(join26(cacheDir, fname), JSON.stringify({
         ref,
         version: data.version,
         digest: data.digest,
@@ -8748,11 +10479,11 @@ async function syncCommand(_args = []) {
     const ruleCount = Array.isArray(pack.rules) ? pack.rules.length : 0;
     console.log(`  \u2713 ${ref}:${data.version} \u2014 verified (${ruleCount} rule${ruleCount === 1 ? "" : "s"})`);
   }
-  if (!cloud && existsSync20(cacheDir)) {
+  if (!cloud && existsSync28(cacheDir)) {
     for (const f of readdirSync6(cacheDir)) {
       if (f.endsWith(".json") && !keptCacheFiles.has(f)) {
         try {
-          rmSync3(join20(cacheDir, f));
+          rmSync3(join26(cacheDir, f));
         } catch {
         }
       }
@@ -8888,13 +10619,13 @@ var config_exports = {};
 __export(config_exports, {
   configCommand: () => configCommand
 });
-import { readFileSync as readFileSync18, writeFileSync as writeFileSync13, existsSync as existsSync21 } from "fs";
-import { join as join21 } from "path";
-import { homedir as homedir20 } from "os";
-function readConfigEnv2() {
-  if (!existsSync21(CONFIG_PATH6)) return {};
+import { readFileSync as readFileSync25, writeFileSync as writeFileSync18, existsSync as existsSync29 } from "fs";
+import { join as join27 } from "path";
+import { homedir as homedir26 } from "os";
+function readConfigEnv3() {
+  if (!existsSync29(CONFIG_PATH8)) return {};
   const out = {};
-  for (const line of readFileSync18(CONFIG_PATH6, "utf-8").split("\n")) {
+  for (const line of readFileSync25(CONFIG_PATH8, "utf-8").split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#")) continue;
     const eq = t.indexOf("=");
@@ -8903,11 +10634,11 @@ function readConfigEnv2() {
   return out;
 }
 function updateConfigValue(key, value) {
-  if (!existsSync21(CONFIG_PATH6)) {
+  if (!existsSync29(CONFIG_PATH8)) {
     console.error("No config found. Run `synkro install` first.");
     process.exit(1);
   }
-  const lines = readFileSync18(CONFIG_PATH6, "utf-8").split("\n");
+  const lines = readFileSync25(CONFIG_PATH8, "utf-8").split("\n");
   const pattern = new RegExp(`^${key}=`);
   let found = false;
   const updated = lines.map((line) => {
@@ -8918,7 +10649,7 @@ function updateConfigValue(key, value) {
     return line;
   });
   if (!found) updated.splice(updated.length - 1, 0, `${key}='${value}'`);
-  writeFileSync13(CONFIG_PATH6, updated.join("\n"), "utf-8");
+  writeFileSync18(CONFIG_PATH8, updated.join("\n"), "utf-8");
 }
 function resolveInferenceMode(cfg) {
   if ((cfg.SYNKRO_GRADING_MODE || "local") === "byok") return "byok";
@@ -8926,7 +10657,7 @@ function resolveInferenceMode(cfg) {
   return "local";
 }
 async function reconcileContainer() {
-  const cfg = readConfigEnv2();
+  const cfg = readConfigEnv3();
   const cloudOnly = (cfg.SYNKRO_GRADING_MODE || "local") === "byok" && (cfg.SYNKRO_STORAGE_MODE || "local") === "cloud";
   try {
     const { dockerInstall: dockerInstall2, dockerSafeStop: dockerSafeStop2, readContainerConfig: readContainerConfig2, assertDockerAvailable: assertDockerAvailable2, waitForContainerReady: waitForContainerReady2 } = await Promise.resolve().then(() => (init_dockerInstall(), dockerInstall_exports));
@@ -8950,7 +10681,7 @@ async function reconcileContainer() {
 }
 async function configCommand(args2) {
   if (args2.length === 0) {
-    const config2 = readConfigEnv2();
+    const config2 = readConfigEnv3();
     console.log("Synkro config:\n");
     console.log(`  inference:  ${resolveInferenceMode(config2)}`);
     console.log(`  storage:    ${config2.SYNKRO_STORAGE_MODE || "local"}`);
@@ -8981,6 +10712,31 @@ To change:`);
     await reconcileContainer();
     return;
   }
+  if (args2[0] === "telemetry") {
+    const rest = args2.slice(1);
+    if (rest.length === 0) {
+      const s = await getTelemetryState();
+      const label = !s.enabled ? "OFF" : s.remoteFlushEnabled ? "ON" : "local-only";
+      console.log(`Telemetry: ${label}`);
+      return;
+    }
+    if (rest.length !== 1 || !["--on", "--off", "--local-only"].includes(rest[0])) {
+      console.error("Usage: synkro config telemetry [--on|--off|--local-only]");
+      process.exit(1);
+    }
+    const flag = rest[0];
+    if (flag === "--on") {
+      await setTelemetryState({ enabled: true, remoteFlushEnabled: true });
+      console.log("Telemetry: ON");
+    } else if (flag === "--off") {
+      await setTelemetryState({ enabled: false, remoteFlushEnabled: false });
+      console.log("Telemetry: OFF");
+    } else {
+      await setTelemetryState({ enabled: true, remoteFlushEnabled: false });
+      console.log("Telemetry: local-only");
+    }
+    return;
+  }
   if (args2[0] === "storage") {
     const value = args2[1];
     if (value !== "local" && value !== "cloud") {
@@ -9006,7 +10762,7 @@ To change:`);
     process.exit(1);
   }
   const token = getAccessToken();
-  const config = readConfigEnv2();
+  const config = readConfigEnv3();
   const gatewayUrl = (config.SYNKRO_GATEWAY_URL || "https://api.synkro.sh").replace(/\/$/, "");
   try {
     const resp = await fetch(`${gatewayUrl}/api/v1/cli/me`, {
@@ -9045,25 +10801,210 @@ To change:`);
   }
   if (inferenceValue !== "cloud") await reconcileContainer();
 }
-var SYNKRO_DIR8, CONFIG_PATH6;
+var SYNKRO_DIR13, CONFIG_PATH8;
 var init_config = __esm({
   "cli/commands/config.ts"() {
     "use strict";
     init_stub();
-    SYNKRO_DIR8 = join21(homedir20(), ".synkro");
-    CONFIG_PATH6 = join21(SYNKRO_DIR8, "config.env");
+    init_optout();
+    SYNKRO_DIR13 = join27(homedir26(), ".synkro");
+    CONFIG_PATH8 = join27(SYNKRO_DIR13, "config.env");
+  }
+});
+
+// cli/commands/telemetry.ts
+var telemetry_exports2 = {};
+__export(telemetry_exports2, {
+  telemetryCommand: () => telemetryCommand
+});
+import { createInterface as createInterface6 } from "readline";
+function parseFlag(args2, name) {
+  const prefix = `--${name}=`;
+  for (const a of args2) if (a.startsWith(prefix)) return a.slice(prefix.length);
+  const idx = args2.indexOf(`--${name}`);
+  if (idx >= 0 && idx + 1 < args2.length && !args2[idx + 1].startsWith("--")) {
+    return args2[idx + 1];
+  }
+  return void 0;
+}
+function hasFlag(args2, name) {
+  return args2.includes(`--${name}`);
+}
+function truncate2(s, max) {
+  if (s.length <= max) return s;
+  return s.slice(0, max) + `\u2026 (+${s.length - max} chars)`;
+}
+async function printStats() {
+  const s = await getStats();
+  console.log("Telemetry:");
+  console.log(`  install_id:          ${s.install_id}`);
+  console.log(`  enabled:             ${s.enabled ? "yes" : "no"}`);
+  console.log(`  remote_flush:        ${s.remote_flush_enabled ? "yes" : "no"}`);
+  console.log(`  pglite (local):      ${s.pglite_reachable ? "reachable" : "none (cloud mode \u2014 query central for totals)"}`);
+  console.log(`  local mirror events: ${s.total_events}`);
+  console.log(`  pending (queue):     ${s.pending_local}`);
+  if (s.newest) console.log(`  newest event:        ${s.newest}`);
+  if (s.last_drained_at) console.log(`  last local drain:    ${s.last_drained_at}`);
+  if (s.last_flush_at) console.log(`  last flush attempt:  ${s.last_flush_at}`);
+  if (s.last_flush_ok_at) console.log(`  last flush success:  ${s.last_flush_ok_at}`);
+  if (s.last_flush_error) console.log(`  last flush error:    ${s.last_flush_error}`);
+  const types = Object.entries(s.by_type);
+  if (types.length > 0) {
+    console.log(`  by type:`);
+    for (const [name, count] of types) {
+      console.log(`    ${name.padEnd(22)} ${count}`);
+    }
+  }
+}
+async function printTail(args2) {
+  const opts = {};
+  const limitRaw = parseFlag(args2, "limit");
+  if (limitRaw) {
+    const n = Number.parseInt(limitRaw, 10);
+    if (Number.isFinite(n) && n > 0) opts.limit = n;
+  }
+  const typeRaw = parseFlag(args2, "type");
+  if (typeRaw) opts.eventType = typeRaw;
+  const sessionRaw = parseFlag(args2, "session");
+  if (sessionRaw) opts.sessionId = sessionRaw;
+  const rows = await tail(opts);
+  if (rows.length === 0) {
+    console.log("(no events \u2014 run `synkro start` if the container is down so JSONL pending events can drain)");
+    return;
+  }
+  for (const row of rows) {
+    const session = row.cc_session_id ? ` session=${String(row.cc_session_id).slice(0, 8)}` : "";
+    const ts = typeof row.occurred_at === "string" ? row.occurred_at : new Date(row.occurred_at).toISOString();
+    console.log(`  ${ts}  ${row.event_type.padEnd(20)} ${row.emitter}${session}`);
+    const contextStr = typeof row.context === "string" ? row.context : JSON.stringify(row.context);
+    console.log(`     context: ${truncate2(contextStr, 200)}`);
+  }
+}
+async function runFlush(args2) {
+  const force = hasFlag(args2, "force");
+  const r = await flush({ force });
+  const parts = [`remote sent: ${r.sent}`, `queued (kept): ${r.failed}`, `local mirror: ${r.mirrored}`];
+  if (r.skipped_reason) parts.push(`remote skipped (${r.skipped_reason})`);
+  console.log(parts.join(", "));
+}
+async function runExport(args2) {
+  const path = args2[0];
+  if (!path) {
+    console.error("usage: synkro telemetry export <path>");
+    process.exit(1);
+  }
+  await exportEvents(path);
+  console.log(`wrote ${path}`);
+}
+function confirmYesNo(question) {
+  if (!process.stdin.isTTY) return Promise.resolve(false);
+  return new Promise((resolve4) => {
+    const rl = createInterface6({ input: process.stdin, output: process.stdout });
+    rl.question(`${question} (y/N): `, (answer) => {
+      rl.close();
+      const t = answer.trim().toLowerCase();
+      resolve4(t === "y" || t === "yes");
+    });
+  });
+}
+async function runPurge(args2) {
+  const keepInstallId = hasFlag(args2, "keep-install-id");
+  const skipPrompt = hasFlag(args2, "yes") || hasFlag(args2, "y");
+  if (!skipPrompt) {
+    const msg = keepInstallId ? "Wipe all local telemetry events (keeping your install_id)?" : "Wipe all local telemetry events AND reset install_id?";
+    const ok = await confirmYesNo(msg);
+    if (!ok) {
+      console.log("aborted");
+      return;
+    }
+  }
+  const result = await purge({ keepInstallId });
+  if (!result.pglite_reachable) {
+    console.log(`removed ${result.removed_pending} pending event(s) from local queue (container down \u2014 pglite events untouched)`);
+    return;
+  }
+  console.log(`removed ${result.removed_events} pglite event(s) + ${result.removed_pending} pending; meta ${result.removed_meta ? "reset" : "unchanged"}`);
+}
+async function telemetryCommand(args2) {
+  const sub = args2[0];
+  const rest = args2.slice(1);
+  switch (sub) {
+    case "stats":
+      await printStats();
+      return;
+    case "tail":
+      await printTail(rest);
+      return;
+    case "flush":
+      await runFlush(rest);
+      return;
+    case "export":
+      await runExport(rest);
+      return;
+    case "purge":
+      await runPurge(rest);
+      return;
+    case "on":
+      await setTelemetryState({ enabled: true, remoteFlushEnabled: true });
+      console.log("telemetry: on (collection + remote flush enabled)");
+      return;
+    case "off":
+      await setTelemetryState({ enabled: false, remoteFlushEnabled: false });
+      console.log("telemetry: off (no collection, no remote flush)");
+      return;
+    case "local-only":
+      await setTelemetryState({ enabled: true, remoteFlushEnabled: false });
+      console.log("telemetry: local-only (collection on, remote flush off)");
+      return;
+    case void 0:
+    case "":
+    case "help":
+    case "--help":
+    case "-h":
+      console.log(HELP);
+      return;
+    default:
+      console.error(`Unknown subcommand: ${sub}`);
+      console.log(HELP);
+      process.exit(1);
+  }
+}
+var HELP;
+var init_telemetry2 = __esm({
+  "cli/commands/telemetry.ts"() {
+    "use strict";
+    init_flush();
+    init_purge();
+    init_stats();
+    init_optout();
+    HELP = `synkro telemetry \u2014 inspect or flush local telemetry events
+
+Usage:
+  synkro telemetry stats                   show counts, queue depth, last flush
+  synkro telemetry tail [opts]             print recent events (most recent first)
+      --limit=N        max rows (default 20)
+      --type=X         filter by event_type
+      --session=Y      filter by cc_session_id
+  synkro telemetry flush [--force]         ship unflushed events now (bypass throttle)
+  synkro telemetry export <path>           dump every event as NDJSON to <path>
+  synkro telemetry purge [--keep-install-id] [--yes]
+                                           wipe local events; --keep-install-id keeps your install_id
+  synkro telemetry on                      enable collection AND remote flush
+  synkro telemetry off                     disable collection entirely
+  synkro telemetry local-only              collect locally, never flush remotely
+`;
   }
 });
 
 // cli/bootstrap.js
-import { readFileSync as readFileSync19, existsSync as existsSync22 } from "fs";
+import { readFileSync as readFileSync26, existsSync as existsSync30 } from "fs";
 import { resolve as resolve3 } from "path";
 var envCandidates = [
   resolve3(process.env.HOME ?? "", ".synkro", "config.env")
 ];
 for (const envPath of envCandidates) {
-  if (!existsSync22(envPath)) continue;
-  const envContent = readFileSync19(envPath, "utf-8");
+  if (!existsSync30(envPath)) continue;
+  const envContent = readFileSync26(envPath, "utf-8");
   for (const line of envContent.split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -9077,8 +11018,10 @@ for (const envPath of envCandidates) {
 var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
+var isDetachedChild = process.env.SYNKRO_TELEMETRY_DETACHED === "1";
+var FLUSH_SKIP = /* @__PURE__ */ new Set(["grade", "version", "--version", "-v", "help", "--help", "-h", ""]);
 function printVersion() {
-  console.log("1.7.60");
+  console.log("1.7.62");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents
@@ -9095,6 +11038,7 @@ Commands:
   update                 Pull the latest container image and safely restart
   config                 Show or change grading + storage modes
   claude-desktop         Monitor Claude Desktop conversations (local, macOS)
+  telemetry <sub>        Inspect or flush local telemetry events
   version                Show version
 
   config:
@@ -9113,6 +11057,21 @@ Quick start:
 `);
 }
 async function main() {
+  let emit2 = null;
+  try {
+    ({ emit: emit2 } = await Promise.resolve().then(() => (init_telemetry(), telemetry_exports)));
+  } catch {
+  }
+  if (emit2 && !isDetachedChild && cmd !== "grade") {
+    try {
+      emit2("cli_invocation", {
+        argv: process.argv.slice(2),
+        subcommand: cmd || "help",
+        cwd: process.cwd()
+      });
+    } catch {
+    }
+  }
   switch (cmd) {
     case "install": {
       const { installCommand: installCommand2, parseArgs: parseArgs2 } = await Promise.resolve().then(() => (init_install(), install_exports));
@@ -9205,6 +11164,11 @@ async function main() {
       await runClaudeDesktopTap2({ backfill: subArgs.includes("--backfill") });
       break;
     }
+    case "telemetry": {
+      const { telemetryCommand: telemetryCommand2 } = await Promise.resolve().then(() => (init_telemetry2(), telemetry_exports2));
+      await telemetryCommand2(subArgs);
+      break;
+    }
     default: {
       console.error(`Unknown command: ${cmd}`);
       printHelp2();
@@ -9212,8 +11176,50 @@ async function main() {
     }
   }
 }
-main().catch((err) => {
+async function postDispatchFlush() {
+  if (FLUSH_SKIP.has(cmd)) return;
+  try {
+    const { flushDetached: flushDetached2 } = await Promise.resolve().then(() => (init_flush(), flush_exports));
+    flushDetached2();
+  } catch {
+  }
+}
+async function shutdown(code) {
+  try {
+    const { closeDb: closeDb2 } = await Promise.resolve().then(() => (init_db(), db_exports));
+    await closeDb2();
+  } catch {
+  }
+  process.exitCode = code;
+  const force = setTimeout(() => {
+    let pending = 0;
+    const done = () => {
+      if (--pending === 0) process.exit(code);
+    };
+    for (const stream of [process.stdout, process.stderr]) {
+      if (stream.writableLength > 0) {
+        pending++;
+        stream.once("drain", done);
+      }
+    }
+    if (pending === 0) process.exit(code);
+  }, 200);
+  force.unref();
+}
+main().then(() => postDispatchFlush()).then(() => shutdown(0)).catch(async (err) => {
+  try {
+    const { emit: emit2 } = await Promise.resolve().then(() => (init_telemetry(), telemetry_exports));
+    emit2("error", {
+      category: "unknown",
+      code: err && err.code || "UNKNOWN",
+      message: String(err && err.message ? err.message : err),
+      stack: err && err.stack || "",
+      emitter_context: "bootstrap:" + (cmd || "unknown")
+    });
+  } catch {
+  }
+  await postDispatchFlush();
   console.error(err);
-  process.exit(1);
+  await shutdown(1);
 });
 //# sourceMappingURL=bootstrap.js.map