@synkro-sh/cli 1.7.64 → 1.7.66

package/dist/bootstrap.js

@@ -132,7 +132,7 @@ function getIdentity() {
   if (cached2) return cached2;
   let cliVersion = "0.0.0";
   try {
-    cliVersion = "1.7.64";
+    cliVersion = "1.7.66";
   } catch {
   }
   const creds = loadCredentialsIdentity();
@@ -2252,7 +2252,13 @@ function loadMcpJwt(): string {
 
 let _cfgCache: Record<string, string> | null = null;
 function cfgVal(key: string): string {
-  if (process.env[key]) return process.env[key] as string;
+  // ~/.synkro/config.env (written by "synkro install") is AUTHORITATIVE for the keys it
+  // defines. This hook runs under bun, which AUTO-LOADS a .env/.env.local from the repo
+  // cwd into process.env — so a repo's own dev vars (e.g. SYNKRO_GATEWAY_URL=localhost for a
+  // local "wrangler dev") would otherwise hijack the installed config and silently redirect
+  // cloud grades to a dead gateway (fail-open, "nothing fires"). So read config.env FIRST and
+  // only fall back to process.env for keys config.env doesn't set (e.g. SYNKRO_HOOK_FORMAT,
+  // which is passed on the cursor hook command, never written to config.env).
   if (!_cfgCache) {
     _cfgCache = {};
     try {
@@ -2263,7 +2269,8 @@ function cfgVal(key: string): string {
       }
     } catch {}
   }
-  return _cfgCache[key] || '';
+  if (_cfgCache[key]) return _cfgCache[key];
+  return process.env[key] || '';
 }
 function deployIsCloud(): boolean { return cfgVal('SYNKRO_DEPLOY_LOCATION') === 'cloud'; }
 
@@ -5863,87 +5870,6 @@ var init_setupToken = __esm({
   }
 });
 
-// cli/local-cc/codexCloudSetup.ts
-var codexCloudSetup_exports = {};
-__export(codexCloudSetup_exports, {
-  setupCodexCloud: () => setupCodexCloud
-});
-import { spawn as nodeSpawn2, spawnSync as spawnSync4 } from "child_process";
-import { readFileSync as readFileSync16, mkdirSync as mkdirSync12, rmSync, existsSync as existsSync19 } from "fs";
-import { homedir as homedir16 } from "os";
-import { join as join16 } from "path";
-function findCodexBinary() {
-  if (process.env.SYNKRO_CODEX_BIN) return process.env.SYNKRO_CODEX_BIN;
-  const r = spawnSync4("which", ["codex"], { encoding: "utf-8" });
-  const p = (r.stdout || "").trim().split("\n")[0];
-  return p || null;
-}
-function runCodexLogin(codexBin) {
-  mkdirSync12(CODEX_CLOUD_HOME, { recursive: true, mode: 448 });
-  return new Promise((resolve4, reject) => {
-    const proc = nodeSpawn2(codexBin, ["login"], {
-      stdio: "inherit",
-      env: { ...process.env, CODEX_HOME: CODEX_CLOUD_HOME }
-    });
-    proc.on("error", (err) => reject(new Error(`failed to spawn codex login: ${err.message}`)));
-    proc.on("close", (code) => code === 0 ? resolve4() : reject(new Error(`codex login exited with code ${code}`)));
-  });
-}
-async function setupCodexCloud(gatewayUrl, bearerToken, onStatus) {
-  const codexBin = findCodexBinary();
-  if (!codexBin) {
-    return { ok: false, error: "Codex CLI not found on PATH. Install Codex (https://developers.openai.com/codex), then re-run `synkro install`. (Set SYNKRO_CODEX_BIN to override the binary path.)" };
-  }
-  onStatus?.("Opening your browser to authorize your Codex subscription for Synkro Cloud\u2026");
-  try {
-    await runCodexLogin(codexBin);
-  } catch (e) {
-    return { ok: false, error: `Codex login failed: ${e.message}` };
-  }
-  const authPath = join16(CODEX_CLOUD_HOME, "auth.json");
-  if (!existsSync19(authPath)) {
-    return { ok: false, error: "codex login completed but no auth.json was written \u2014 did the browser approval finish?" };
-  }
-  let auth;
-  try {
-    auth = JSON.parse(readFileSync16(authPath, "utf-8"));
-  } catch (e) {
-    return { ok: false, error: `could not read codex auth.json: ${e.message}` };
-  }
-  if (!auth || typeof auth !== "object" || !auth.tokens?.refresh_token) {
-    return { ok: false, error: "codex auth.json has no refresh token \u2014 cloud refresh would fail. Re-run login." };
-  }
-  onStatus?.("Connecting your Codex session to Synkro Cloud\u2026");
-  let resp;
-  try {
-    resp = await fetch(`${gatewayUrl.replace(/\/+$/, "")}/codex/seed`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", Authorization: `Bearer ${bearerToken}` },
-      body: JSON.stringify({ auth })
-    });
-  } catch (e) {
-    return { ok: false, error: `failed to reach Synkro API: ${e.message}` };
-  }
-  if (!resp.ok) {
-    const detail = await resp.text().catch(() => "");
-    return { ok: false, error: `seed rejected (${resp.status}): ${detail.slice(0, 200)}` };
-  }
-  try {
-    rmSync(CODEX_CLOUD_HOME, { recursive: true, force: true });
-  } catch {
-  }
-  onStatus?.("\u2713 Codex subscription connected to Synkro Cloud.");
-  return { ok: true };
-}
-var SYNKRO_DIR9, CODEX_CLOUD_HOME;
-var init_codexCloudSetup = __esm({
-  "cli/local-cc/codexCloudSetup.ts"() {
-    "use strict";
-    SYNKRO_DIR9 = join16(homedir16(), ".synkro");
-    CODEX_CLOUD_HOME = join16(SYNKRO_DIR9, "codex-cloud-session");
-  }
-});
-
 // cli/commands/setupGithub.ts
 var setupGithub_exports = {};
 __export(setupGithub_exports, {
@@ -5953,14 +5879,14 @@ __export(setupGithub_exports, {
 import { createInterface as createInterface2 } from "readline/promises";
 import { stdin as input, stdout as output } from "process";
 import { execSync as execSync5 } from "child_process";
-import { existsSync as existsSync20, readFileSync as readFileSync17 } from "fs";
-import { homedir as homedir17, platform as platform5 } from "os";
-import { join as join17 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync16 } from "fs";
+import { homedir as homedir16, platform as platform5 } from "os";
+import { join as join16 } from "path";
 import { execFile as execFile2 } from "child_process";
 function readConfig() {
-  if (!existsSync20(CONFIG_PATH3)) return {};
+  if (!existsSync19(CONFIG_PATH3)) return {};
   const out = {};
-  for (const line of readFileSync17(CONFIG_PATH3, "utf-8").split("\n")) {
+  for (const line of readFileSync16(CONFIG_PATH3, "utf-8").split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#")) continue;
     const eq = t.indexOf("=");
@@ -6260,15 +6186,15 @@ Will push secrets to ${selected.length} repo(s):`);
   console.log(`Secrets pushed: ${SECRET_NAMES.CLAUDE_OAUTH}, ${SECRET_NAMES.SYNKRO_API_KEY}`);
   console.log("Open a PR on any selected repo to trigger your first Synkro scan.");
 }
-var SYNKRO_DIR10, CONFIG_PATH3;
+var SYNKRO_DIR9, CONFIG_PATH3;
 var init_setupGithub = __esm({
   "cli/commands/setupGithub.ts"() {
     "use strict";
     init_githubSetup();
     init_stub();
     init_setupToken();
-    SYNKRO_DIR10 = join17(homedir17(), ".synkro");
-    CONFIG_PATH3 = join17(SYNKRO_DIR10, "config.env");
+    SYNKRO_DIR9 = join16(homedir16(), ".synkro");
+    CONFIG_PATH3 = join16(SYNKRO_DIR9, "config.env");
   }
 });
 
@@ -6287,9 +6213,9 @@ __export(install_exports, {
   syncSkillFiles: () => syncSkillFiles,
   writeHookScripts: () => writeHookScripts
 });
-import { existsSync as existsSync21, mkdirSync as mkdirSync13, writeFileSync as writeFileSync13, chmodSync as chmodSync3, readFileSync as readFileSync18, readdirSync as readdirSync3, unlinkSync as unlinkSync6, statSync as statSync2 } from "fs";
-import { homedir as homedir18 } from "os";
-import { join as join18 } from "path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync12, writeFileSync as writeFileSync13, chmodSync as chmodSync3, readFileSync as readFileSync17, readdirSync as readdirSync3, unlinkSync as unlinkSync6, statSync as statSync2 } from "fs";
+import { homedir as homedir17 } from "os";
+import { join as join17 } from "path";
 import { execSync as execSync6 } from "child_process";
 import { createInterface as createInterface3 } from "readline";
 import { createHash as createHash2 } from "crypto";
@@ -6376,15 +6302,20 @@ async function promptCursorApiKey(opts) {
     console.log("  \u26A0 Skipped \u2014 Cursor workers will be idle. Re-run install or pass --cursor-api-key=\u2026 later.");
   }
 }
-async function promptDeployLocation() {
-  if (!process.stdin.isTTY) return "local";
+async function promptDeployLocation(current = "local") {
+  if (!process.stdin.isTTY) return current;
+  const other = current === "cloud" ? "local" : "cloud";
   const rl = createInterface3({ input: process.stdin, output: process.stdout });
   return new Promise((resolve4) => {
     rl.question(
-      "Where should Synkro run?\n  local \u2014 a grading container on this machine (Docker) (default)\n  cloud \u2014 a private container hosted by Synkro (Cloudflare)\nBoth use your own Claude key. Choose [local] / cloud: ",
+      `Where should Synkro run?
+  local \u2014 a grading container on this machine (Docker)
+  cloud \u2014 a private container hosted by Synkro (Cloudflare)
+Both use your own Claude key. Choose [${current}] / ${other}: `,
       (answer) => {
         rl.close();
-        resolve4(answer.trim().toLowerCase() === "cloud" ? "cloud" : "local");
+        const a = answer.trim().toLowerCase();
+        resolve4(a === "cloud" ? "cloud" : a === "local" ? "local" : current);
       }
     );
   });
@@ -6419,52 +6350,38 @@ coding patterns and the dashboard shows full history. (Y/n) `
     rl.close();
   }
 }
-async function promptCodexCloudSetup() {
-  if (!process.stdin.isTTY) return false;
-  const rl = createInterface3({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve4) => {
-    rl.question(
-      "Connect a Codex (ChatGPT subscription) session for cloud grading? This opens a\nbrowser to authorize; your subscription is stored securely and refreshed for you. (y/N) ",
-      (answer) => {
-        rl.close();
-        const a = answer.trim().toLowerCase();
-        resolve4(a === "y" || a === "yes");
-      }
-    );
-  });
-}
 function ensureSynkroDir() {
-  mkdirSync13(SYNKRO_DIR11, { recursive: true });
-  mkdirSync13(HOOKS_DIR, { recursive: true });
-  mkdirSync13(BIN_DIR, { recursive: true });
-  mkdirSync13(OFFSETS_DIR, { recursive: true });
-  mkdirSync13(join18(SYNKRO_DIR11, "sessions"), { recursive: true });
+  mkdirSync12(SYNKRO_DIR10, { recursive: true });
+  mkdirSync12(HOOKS_DIR, { recursive: true });
+  mkdirSync12(BIN_DIR, { recursive: true });
+  mkdirSync12(OFFSETS_DIR, { recursive: true });
+  mkdirSync12(join17(SYNKRO_DIR10, "sessions"), { recursive: true });
 }
 function writeHookScripts() {
-  const installExtractCorePath = join18(HOOKS_DIR, "installExtractCore.ts");
-  const bashScriptPath = join18(HOOKS_DIR, "cc-bash-judge.ts");
-  const skillJudgeScriptPath = join18(HOOKS_DIR, "cc-skill-judge.ts");
-  const cursorSkillJudgePath = join18(HOOKS_DIR, "cursor-skill-judge.ts");
-  const bashFollowupScriptPath = join18(HOOKS_DIR, "cc-bash-followup.ts");
-  const editPrecheckScriptPath = join18(HOOKS_DIR, "cc-edit-precheck.ts");
-  const cwePrecheckScriptPath = join18(HOOKS_DIR, "cc-cwe-precheck.ts");
-  const cvePrecheckScriptPath = join18(HOOKS_DIR, "cc-cve-precheck.ts");
-  const planJudgeScriptPath = join18(HOOKS_DIR, "cc-plan-judge.ts");
-  const agentJudgeScriptPath = join18(HOOKS_DIR, "cc-agent-judge.ts");
-  const stopSummaryScriptPath = join18(HOOKS_DIR, "cc-stop-summary.ts");
-  const sessionStartScriptPath = join18(HOOKS_DIR, "cc-session-start.ts");
-  const transcriptSyncScriptPath = join18(HOOKS_DIR, "cc-transcript-sync.ts");
-  const userPromptSubmitScriptPath = join18(HOOKS_DIR, "cc-user-prompt-submit.ts");
-  const commonScriptPath = join18(HOOKS_DIR, "_synkro-common.ts");
-  const commonBashScriptPath = join18(HOOKS_DIR, "_synkro-common.sh");
-  const installScanScriptPath = join18(HOOKS_DIR, "cc-install-scan.ts");
-  const cursorBashJudgePath = join18(HOOKS_DIR, "cursor-bash-judge.ts");
-  const cursorEditCapturePath = join18(HOOKS_DIR, "cursor-edit-capture.ts");
-  const cursorAgentCapturePath = join18(HOOKS_DIR, "cursor-agent-capture.ts");
-  const mcpStdioProxyPath = join18(HOOKS_DIR, "mcp-stdio-proxy.ts");
-  const taskActivateIntentScriptPath = join18(HOOKS_DIR, "cc-task-activate-intent.ts");
-  const mcpGateScriptPath = join18(HOOKS_DIR, "cc-mcp-gate.ts");
-  const stubCommonPath = join18(HOOKS_DIR, "_synkro-stub-common.ts");
+  const installExtractCorePath = join17(HOOKS_DIR, "installExtractCore.ts");
+  const bashScriptPath = join17(HOOKS_DIR, "cc-bash-judge.ts");
+  const skillJudgeScriptPath = join17(HOOKS_DIR, "cc-skill-judge.ts");
+  const cursorSkillJudgePath = join17(HOOKS_DIR, "cursor-skill-judge.ts");
+  const bashFollowupScriptPath = join17(HOOKS_DIR, "cc-bash-followup.ts");
+  const editPrecheckScriptPath = join17(HOOKS_DIR, "cc-edit-precheck.ts");
+  const cwePrecheckScriptPath = join17(HOOKS_DIR, "cc-cwe-precheck.ts");
+  const cvePrecheckScriptPath = join17(HOOKS_DIR, "cc-cve-precheck.ts");
+  const planJudgeScriptPath = join17(HOOKS_DIR, "cc-plan-judge.ts");
+  const agentJudgeScriptPath = join17(HOOKS_DIR, "cc-agent-judge.ts");
+  const stopSummaryScriptPath = join17(HOOKS_DIR, "cc-stop-summary.ts");
+  const sessionStartScriptPath = join17(HOOKS_DIR, "cc-session-start.ts");
+  const transcriptSyncScriptPath = join17(HOOKS_DIR, "cc-transcript-sync.ts");
+  const userPromptSubmitScriptPath = join17(HOOKS_DIR, "cc-user-prompt-submit.ts");
+  const commonScriptPath = join17(HOOKS_DIR, "_synkro-common.ts");
+  const commonBashScriptPath = join17(HOOKS_DIR, "_synkro-common.sh");
+  const installScanScriptPath = join17(HOOKS_DIR, "cc-install-scan.ts");
+  const cursorBashJudgePath = join17(HOOKS_DIR, "cursor-bash-judge.ts");
+  const cursorEditCapturePath = join17(HOOKS_DIR, "cursor-edit-capture.ts");
+  const cursorAgentCapturePath = join17(HOOKS_DIR, "cursor-agent-capture.ts");
+  const mcpStdioProxyPath = join17(HOOKS_DIR, "mcp-stdio-proxy.ts");
+  const taskActivateIntentScriptPath = join17(HOOKS_DIR, "cc-task-activate-intent.ts");
+  const mcpGateScriptPath = join17(HOOKS_DIR, "cc-mcp-gate.ts");
+  const stubCommonPath = join17(HOOKS_DIR, "_synkro-stub-common.ts");
   const stubFiles = [
     [stubCommonPath, STUB_COMMON_TS],
     [bashScriptPath, STUB_BASH_JUDGE_TS],
@@ -6495,7 +6412,7 @@ function writeHookScripts() {
   chmodSync3(mcpStdioProxyPath, 493);
   for (const stale of ["_synkro-common.ts", "_synkro-common.sh", "installExtractCore.ts"]) {
     try {
-      unlinkSync6(join18(HOOKS_DIR, stale));
+      unlinkSync6(join17(HOOKS_DIR, stale));
     } catch {
     }
   }
@@ -6530,11 +6447,11 @@ function shellQuoteSingle2(value) {
 }
 function resolveSynkroBundle() {
   const scriptPath = process.argv[1];
-  if (scriptPath && existsSync21(scriptPath)) return scriptPath;
+  if (scriptPath && existsSync20(scriptPath)) return scriptPath;
   return null;
 }
 function writeConfigEnv(opts) {
-  const credsPath = join18(SYNKRO_DIR11, "credentials.json");
+  const credsPath = join17(SYNKRO_DIR10, "credentials.json");
   const safeGateway = sanitizeConfigValue(opts.gatewayUrl);
   const safeUserId = sanitizeConfigValue(opts.userId);
   const safeOrgId = sanitizeConfigValue(opts.orgId);
@@ -6550,7 +6467,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle2(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle2(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle2(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle2("1.7.64")}`
+    `SYNKRO_VERSION=${shellQuoteSingle2("1.7.66")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle2(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle2(safeUserId)}`);
@@ -6583,7 +6500,7 @@ async function getOrMintCloudToken(gatewayUrl) {
   assertGatewayAllowed(gatewayUrl);
   let stored = "";
   try {
-    stored = readFileSync18(CLOUD_JWT_PATH, "utf-8").trim();
+    stored = readFileSync17(CLOUD_JWT_PATH, "utf-8").trim();
   } catch {
   }
   if (stored && !jwtExpired(stored)) return stored;
@@ -6614,23 +6531,39 @@ async function provisionCloudContainer(opts) {
     process.exit(1);
   }
   console.log("  Validating Claude token...");
-  try {
-    const out = execSync6('claude --print --output-format json "say ok"', {
-      env: { ...process.env, CLAUDE_CODE_OAUTH_TOKEN: setupToken },
-      encoding: "utf-8",
-      timeout: 3e4,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    const result = JSON.parse(out);
-    if (result.is_error) throw new Error(result.result || "auth failed");
-    console.log("  \u2713 Claude token validated.\n");
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(`  \u2717 Claude token failed validation: ${msg}`);
-    console.error("    The captured token can't authenticate (truncated capture, wrong account, or no API credits).");
-    console.error("    Re-run install to re-authorize \u2014 nothing was stored.");
+  let validated = false;
+  let authRejected = null;
+  let lastErr = "";
+  for (let attempt = 1; attempt <= 2 && !validated; attempt++) {
+    try {
+      const out = execSync6('claude --print --output-format json "say ok"', {
+        env: { ...process.env, CLAUDE_CODE_OAUTH_TOKEN: setupToken },
+        encoding: "utf-8",
+        timeout: 6e4,
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      const result = JSON.parse(out);
+      if (result.is_error) {
+        authRejected = result.result || "auth failed";
+        break;
+      }
+      validated = true;
+    } catch (err) {
+      lastErr = err instanceof Error ? err.message : String(err);
+      if (attempt < 2) console.log(`  \u23F3 validation slow (${lastErr.slice(0, 30)}\u2026) \u2014 retrying once...`);
+    }
+  }
+  if (authRejected) {
+    console.error(`  \u2717 Claude token rejected: ${authRejected}`);
+    console.error("    Re-run install to re-authorize (wrong account or no API credits) \u2014 nothing was stored.");
     process.exit(1);
   }
+  if (validated) {
+    console.log("  \u2713 Claude token validated.\n");
+  } else {
+    console.warn(`  \u26A0 Couldn't confirm the token locally in time (${lastErr.slice(0, 50)}).`);
+    console.warn("    Proceeding \u2014 the cloud smoke-grade below verifies it end-to-end in the container.\n");
+  }
   const repo = detectGitRepo2() || void 0;
   const sf = readFullSynkroFile();
   const harness = [];
@@ -6642,7 +6575,7 @@ async function provisionCloudContainer(opts) {
   let cursorApiKey = "";
   if (cursorTotal > 0) {
     try {
-      cursorApiKey = readFileSync18(join18(SYNKRO_DIR11, "cursor-creds", "api-key"), "utf-8").trim();
+      cursorApiKey = readFileSync17(join17(SYNKRO_DIR10, "cursor-creds", "api-key"), "utf-8").trim();
     } catch {
     }
   }
@@ -6799,8 +6732,8 @@ async function verifyCloudGrader(jwt2) {
 }
 function readPersistedDeployLocation() {
   try {
-    if (existsSync21(CONFIG_PATH4)) {
-      const m = readFileSync18(CONFIG_PATH4, "utf-8").match(/^SYNKRO_DEPLOY_LOCATION='([^']*)'/m);
+    if (existsSync20(CONFIG_PATH4)) {
+      const m = readFileSync17(CONFIG_PATH4, "utf-8").match(/^SYNKRO_DEPLOY_LOCATION='([^']*)'/m);
       if (m?.[1] === "cloud") return "cloud";
     }
   } catch {
@@ -6808,8 +6741,8 @@ function readPersistedDeployLocation() {
   return "local";
 }
 function updateConfigEnvLocation(location) {
-  if (!existsSync21(CONFIG_PATH4)) return;
-  let env = readFileSync18(CONFIG_PATH4, "utf-8");
+  if (!existsSync20(CONFIG_PATH4)) return;
+  let env = readFileSync17(CONFIG_PATH4, "utf-8");
   const set = (k, v) => {
     const re = new RegExp(`^${k}=.*$`, "m");
     const line = `${k}='${v}'`;
@@ -6824,7 +6757,7 @@ async function applyMcpConfig(opts) {
   if (!opts.hasClaudeCode && !opts.hasCursor) return;
   let mcpJwt = "";
   try {
-    mcpJwt = readFileSync18(join18(SYNKRO_DIR11, ".mcp-jwt"), "utf-8").trim();
+    mcpJwt = readFileSync17(join17(SYNKRO_DIR10, ".mcp-jwt"), "utf-8").trim();
   } catch {
   }
   if (!mcpJwt) {
@@ -6859,13 +6792,15 @@ async function applyMcpConfig(opts) {
 }
 async function reconcileDeployLocation() {
   const sf = readFullSynkroFile();
-  const desired = sf?.grader.location === "cloud" ? "cloud" : "local";
+  const tomlLoc = sf?.grader.location === "cloud" ? "cloud" : "local";
   const current = readPersistedDeployLocation();
+  const desired = await promptDeployLocation(current || tomlLoc);
+  if (desired !== tomlLoc) updateSynkroTomlLocation(desired);
   if (desired === current) return { location: desired, changed: false };
   const hasClaudeCode = sf ? sf.harness.includes("claude-code") : true;
   const hasCursor = sf ? sf.harness.includes("cursor") : false;
   console.log(`
-synkro.toml: deploy location changed ${current} \u2192 ${desired}
+Deploy location: ${current || "(none)"} \u2192 ${desired}
 `);
   if (!isAuthenticated()) {
     console.log("  Opening browser for Synkro auth...");
@@ -6942,8 +6877,8 @@ function resolveDeploymentMode() {
   const envOverride = process.env.SYNKRO_DEPLOYMENT_MODE?.toLowerCase();
   if (envOverride === "bare-host" || envOverride === "docker") return envOverride;
   try {
-    if (existsSync21(CONFIG_PATH4)) {
-      const m = readFileSync18(CONFIG_PATH4, "utf-8").match(/^SYNKRO_DEPLOYMENT_MODE='([^']*)'/m);
+    if (existsSync20(CONFIG_PATH4)) {
+      const m = readFileSync17(CONFIG_PATH4, "utf-8").match(/^SYNKRO_DEPLOYMENT_MODE='([^']*)'/m);
       const val = m?.[1]?.toLowerCase();
       if (val === "bare-host" || val === "docker") return val;
     }
@@ -6970,16 +6905,16 @@ function collectLocalMetadata(includeClaudeCode = true) {
     meta.cc_version = execSync6("claude --version", { encoding: "utf-8", timeout: 5e3 }).trim().split("\n")[0];
   } catch {
   }
-  const claudeDir = join18(homedir18(), ".claude");
+  const claudeDir = join17(homedir17(), ".claude");
   try {
-    const settings = JSON.parse(readFileSync18(join18(claudeDir, "settings.json"), "utf-8"));
+    const settings = JSON.parse(readFileSync17(join17(claudeDir, "settings.json"), "utf-8"));
     const plugins = Object.keys(settings.enabledPlugins ?? {}).filter((k) => settings.enabledPlugins[k]);
     if (plugins.length) meta.enabled_plugins = plugins;
     if (settings.permissions?.defaultMode) meta.permissions_mode = settings.permissions.defaultMode;
   } catch {
   }
   try {
-    const mcpCache = JSON.parse(readFileSync18(join18(claudeDir, "mcp-needs-auth-cache.json"), "utf-8"));
+    const mcpCache = JSON.parse(readFileSync17(join17(claudeDir, "mcp-needs-auth-cache.json"), "utf-8"));
     const mcpNames = Object.keys(mcpCache);
     if (mcpNames.length) meta.mcp_servers = mcpNames;
   } catch {
@@ -6991,10 +6926,10 @@ function collectLocalMetadata(includeClaudeCode = true) {
   } catch {
   }
   try {
-    const sessionsDir = join18(claudeDir, "sessions");
+    const sessionsDir = join17(claudeDir, "sessions");
     const files = readdirSync3(sessionsDir).filter((f) => f.endsWith(".json")).slice(-5);
     for (const f of files) {
-      const s = JSON.parse(readFileSync18(join18(sessionsDir, f), "utf-8"));
+      const s = JSON.parse(readFileSync17(join17(sessionsDir, f), "utf-8"));
       if (s.version) {
         meta.cc_version = meta.cc_version || s.version;
         break;
@@ -7127,9 +7062,11 @@ async function installCommand(opts = {}) {
       (a) => a.kind === "claude_code" && wantCC || a.kind === "cursor" && wantCursor
     );
     if (agents.length === 0 && detected.length > 0) agents = detected;
-    deployLocation = existingSynkro.grader.location === "cloud" ? "cloud" : "local";
     gradingMode = existingSynkro.grader.mode === "byok" ? "byok" : "local";
+    const tomlLocation = existingSynkro.grader.location === "cloud" ? "cloud" : "local";
+    deployLocation = await promptDeployLocation(tomlLocation);
     storageMode = deployLocation === "cloud" ? "cloud" : "local";
+    if (deployLocation !== tomlLocation) updateSynkroTomlLocation(deployLocation);
     console.log(`Using .synkro config:`);
     for (const w of existingSynkro.warnings) console.warn(`  \u26A0 ${w}`);
     console.log(`  harness: ${existingSynkro.harness.join(", ")}`);
@@ -7190,7 +7127,7 @@ async function installCommand(opts = {}) {
   await setTelemetryState({ enabled: true, remoteFlushEnabled: telemetryConsent });
   emit("install", {
     phase: "started",
-    cli_version_to: "1.7.64",
+    cli_version_to: "1.7.66",
     agents_detected: agents.map((a) => a.kind),
     with_github: false,
     with_local_cc: false,
@@ -7202,9 +7139,9 @@ async function installCommand(opts = {}) {
   const scripts = writeHookScripts();
   console.log("Wrote hook scripts to ~/.synkro/hooks/\n");
   for (const mode of ["edit", "bash"]) {
-    const pidFile = join18(SYNKRO_DIR11, "daemon", mode, "daemon.pid");
+    const pidFile = join17(SYNKRO_DIR10, "daemon", mode, "daemon.pid");
     try {
-      const pid = parseInt(readFileSync18(pidFile, "utf-8").trim(), 10);
+      const pid = parseInt(readFileSync17(pidFile, "utf-8").trim(), 10);
       if (pid > 0) {
         process.kill(pid, "SIGTERM");
         console.log(`Stopped stale ${mode} grader daemon (pid ${pid})`);
@@ -7289,7 +7226,7 @@ async function installCommand(opts = {}) {
         if (mintResp.ok) {
           const minted = await mintResp.json();
           mcpJwt = minted.token;
-          writeFileSync13(join18(SYNKRO_DIR11, ".mcp-jwt"), mcpJwt + "\n", { mode: 384 });
+          writeFileSync13(join17(SYNKRO_DIR10, ".mcp-jwt"), mcpJwt + "\n", { mode: 384 });
         } else {
           console.warn("  \u26A0 Could not mint MCP token \u2014 local server will reject requests until re-installed.");
         }
@@ -7317,7 +7254,7 @@ async function installCommand(opts = {}) {
           throw new Error(`mcp-token mint failed (${mintResp.status}): ${errText.slice(0, 200)}`);
         }
         const minted = await mintResp.json();
-        writeFileSync13(join18(SYNKRO_DIR11, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
+        writeFileSync13(join17(SYNKRO_DIR10, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
         const mcp = installMcpConfig({ gatewayUrl, bearerToken: minted.token });
         console.log(`Registered Synkro guardrails MCP server in ${mcp.path}`);
         console.log(`  url:        ${mcp.url}`);
@@ -7334,8 +7271,8 @@ async function installCommand(opts = {}) {
   if (hasCursor && !opts.noMcp) {
     try {
       if (useLocalMcp) {
-        const jwtPath = join18(SYNKRO_DIR11, ".mcp-jwt");
-        if (!existsSync21(jwtPath)) {
+        const jwtPath = join17(SYNKRO_DIR10, ".mcp-jwt");
+        if (!existsSync20(jwtPath)) {
           const mintResp = await fetch(`${gatewayUrl}/api/v1/cli/mcp-token`, {
             method: "POST",
             headers: { "Authorization": `Bearer ${token}`, "Content-Type": "application/json" },
@@ -7363,7 +7300,7 @@ async function installCommand(opts = {}) {
           throw new Error(`mcp-token mint failed (${mintResp.status}): ${errText.slice(0, 200)}`);
         }
         const minted = await mintResp.json();
-        writeFileSync13(join18(SYNKRO_DIR11, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
+        writeFileSync13(join17(SYNKRO_DIR10, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
         const mcp = installCursorMcpConfig({ gatewayUrl, bearerToken: minted.token });
         console.log(`Registered Synkro guardrails MCP server in ${mcp.path}`);
         console.log(`  url:        ${mcp.url}`);
@@ -7456,7 +7393,7 @@ async function installCommand(opts = {}) {
     const ready = await waitForContainerReady(6e4);
     if (ready) {
       console.log("  \u2713 container ready");
-      const mcpJwt = readFileSync18(join18(SYNKRO_DIR11, ".mcp-jwt"), "utf-8").trim();
+      const mcpJwt = readFileSync17(join17(SYNKRO_DIR10, ".mcp-jwt"), "utf-8").trim();
       try {
         const ingestResp = await fetch(`http://127.0.0.1:${hostMcpPort}/api/ingest`, {
           method: "POST",
@@ -7491,11 +7428,6 @@ async function installCommand(opts = {}) {
     if (graderUsesCursor) await promptCursorApiKey(opts);
     await provisionCloudContainer({ gatewayUrl, jwt: token, orgId, userId, email, hasClaudeCode, hasCursor });
     cloudGradeOk = await verifyCloudGrader(token);
-    if (await promptCodexCloudSetup()) {
-      const { setupCodexCloud: setupCodexCloud2 } = await Promise.resolve().then(() => (init_codexCloudSetup(), codexCloudSetup_exports));
-      const res = await setupCodexCloud2(gatewayUrl, token, (m) => console.log(`  ${m}`));
-      if (!res.ok) console.warn(`  \u26A0 Codex cloud setup skipped: ${res.error}`);
-    }
   }
   if (transcriptConsent) {
     const repo = detectGitRepo2();
@@ -7504,7 +7436,7 @@ async function installCommand(opts = {}) {
         try {
           let mcpToken = "";
           try {
-            mcpToken = readFileSync18(join18(SYNKRO_DIR11, ".mcp-jwt"), "utf-8").trim();
+            mcpToken = readFileSync17(join17(SYNKRO_DIR10, ".mcp-jwt"), "utf-8").trim();
           } catch {
           }
           if (mcpToken) {
@@ -7640,8 +7572,8 @@ function writeSynkroFileIfMissing(opts) {
   try {
     const root = execSync6("git rev-parse --show-toplevel", { encoding: "utf-8", timeout: 3e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
     if (!root) return;
-    if (root === homedir18()) return;
-    const fp = join18(root, "synkro.toml");
+    if (root === homedir17()) return;
+    const fp = join17(root, "synkro.toml");
     let hasFile = false;
     try {
       hasFile = statSync2(fp).isFile();
@@ -7682,13 +7614,35 @@ function writeSynkroFileIfMissing(opts) {
   } catch {
   }
 }
+function updateSynkroTomlLocation(location) {
+  try {
+    const root = execSync6("git rev-parse --show-toplevel", { encoding: "utf-8", timeout: 3e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
+    if (!root || root === homedir17()) return;
+    const fp = join17(root, "synkro.toml");
+    let txt = "";
+    try {
+      if (!statSync2(fp).isFile()) return;
+      txt = readFileSync17(fp, "utf-8");
+    } catch {
+      return;
+    }
+    const re = /^(\s*location\s*=\s*).*$/m;
+    if (!re.test(txt)) return;
+    const next = txt.replace(re, `$1"${location}"`);
+    if (next !== txt) {
+      writeFileSync13(fp, next, "utf-8");
+      console.log(`  synkro.toml: [grader] location = "${location}"`);
+    }
+  } catch {
+  }
+}
 function readFullSynkroFile() {
   try {
     const root = execSync6("git rev-parse --show-toplevel", { encoding: "utf-8", timeout: 3e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
     if (!root) return null;
-    const fp = join18(root, "synkro.toml");
-    if (!existsSync21(fp)) return null;
-    const parsed = parseSynkroToml2(readFileSync18(fp, "utf-8"));
+    const fp = join17(root, "synkro.toml");
+    if (!existsSync20(fp)) return null;
+    const parsed = parseSynkroToml2(readFileSync17(fp, "utf-8"));
     const valid = ["claude-code", "cursor"];
     const harness = Array.isArray(parsed.harness) ? parsed.harness.filter((h) => valid.includes(h)) : ["claude-code", "cursor"];
     const resolved = resolveGraderPool(parsed);
@@ -7726,7 +7680,7 @@ function reconcileHarness() {
   console.log(`synkro.toml: harness=[${sf.harness.join(", ")}] pool=${poolLabel(sf.grader.pool)} mode=${sf.grader.mode}`);
   const scripts = writeHookScripts();
   console.log("Wrote hook scripts to ~/.synkro/hooks/");
-  const ccSettings = join18(homedir18(), ".claude", "settings.json");
+  const ccSettings = join17(homedir17(), ".claude", "settings.json");
   if (wantCC) {
     installCCHooks(ccSettings, {
       bashJudgeScriptPath: scripts.bashScript,
@@ -7747,7 +7701,7 @@ function reconcileHarness() {
     });
     console.log("  \u2713 Claude Code hooks registered");
     try {
-      const mcpJwt = readFileSync18(join18(SYNKRO_DIR11, ".mcp-jwt"), "utf-8").trim();
+      const mcpJwt = readFileSync17(join17(SYNKRO_DIR10, ".mcp-jwt"), "utf-8").trim();
       if (mcpJwt) {
         installMcpConfig({ gatewayUrl: "", bearerToken: mcpJwt, local: true });
         console.log("  \u2713 Claude Code MCP registered");
@@ -7759,7 +7713,7 @@ function reconcileHarness() {
     if (uninstallMcpConfig()) console.log("  \u2717 Claude Code MCP removed");
     if (uninstallClaudeDesktopMcpConfig()) console.log("  \u2717 Claude Desktop MCP removed");
   }
-  const cursorHooks = join18(homedir18(), ".cursor", "hooks.json");
+  const cursorHooks = join17(homedir17(), ".cursor", "hooks.json");
   if (wantCursor) {
     installCursorHooks(cursorHooks, {
       bashJudgeScriptPath: scripts.cursorBashJudgeScript,
@@ -7842,7 +7796,7 @@ async function syncSkillFiles() {
   if (resolved.length === 0) return;
   const mcpPort = process.env.SYNKRO_MCP_PORT || "18931";
   const tasks = resolved.map((fp) => {
-    const content = readFileSync18(fp, "utf-8");
+    const content = readFileSync17(fp, "utf-8");
     const source = `skill:${fp.split("/").pop()}`;
     if (!content.trim()) {
       console.log(`  \u2298 skill ${source}: empty file, skipped`);
@@ -7863,15 +7817,15 @@ function discoverSkillFiles(repoRoot, excludeHashes, ingestedHashes, ingestedNam
   const roots = [];
   const add = (p) => {
     try {
-      if (p && existsSync21(p) && statSync2(p).isDirectory()) roots.push(p);
+      if (p && existsSync20(p) && statSync2(p).isDirectory()) roots.push(p);
     } catch {
     }
   };
-  add(join18(homedir18(), ".claude", "skills"));
-  add(join18(homedir18(), ".agents", "skills"));
+  add(join17(homedir17(), ".claude", "skills"));
+  add(join17(homedir17(), ".agents", "skills"));
   if (repoRoot) {
-    add(join18(repoRoot, ".claude", "skills"));
-    add(join18(repoRoot, ".agents", "skills"));
+    add(join17(repoRoot, ".claude", "skills"));
+    add(join17(repoRoot, ".agents", "skills"));
   }
   const out = [];
   const seen = /* @__PURE__ */ new Set();
@@ -7882,7 +7836,7 @@ function discoverSkillFiles(repoRoot, excludeHashes, ingestedHashes, ingestedNam
     try {
       const st = statSync2(file);
       if (!st.isFile() || st.size > 2e5) return;
-      content = readFileSync18(file, "utf-8");
+      content = readFileSync17(file, "utf-8");
     } catch {
       return;
     }
@@ -7902,7 +7856,7 @@ function discoverSkillFiles(repoRoot, excludeHashes, ingestedHashes, ingestedNam
     }
     for (const entry of entries) {
       if (entry.startsWith(".")) continue;
-      const full = join18(root, entry);
+      const full = join17(root, entry);
       let st;
       try {
         st = statSync2(full);
@@ -7910,8 +7864,8 @@ function discoverSkillFiles(repoRoot, excludeHashes, ingestedHashes, ingestedNam
         continue;
       }
       if (st.isDirectory()) {
-        const skillMd = join18(full, "SKILL.md");
-        if (existsSync21(skillMd)) consider(skillMd, entry);
+        const skillMd = join17(full, "SKILL.md");
+        if (existsSync20(skillMd)) consider(skillMd, entry);
       } else if (/\.mdx?$/i.test(entry) && entry.toUpperCase() !== "README.MD") {
         consider(full, entry.replace(/\.mdx?$/i, ""));
       }
@@ -7960,7 +7914,7 @@ async function discoverAndIngestSkills() {
     if (sf?.skills?.length) {
       for (const fp of resolveSkillPaths(sf.skills, sf._repoRoot)) {
         try {
-          excludeHashes.add(createHash2("sha256").update(readFileSync18(fp, "utf-8")).digest("hex"));
+          excludeHashes.add(createHash2("sha256").update(readFileSync17(fp, "utf-8")).digest("hex"));
         } catch {
         }
       }
@@ -7991,7 +7945,7 @@ async function discoverAndIngestSkills() {
     const setHash = discoverySetHash(selectable);
     let prev = "";
     try {
-      prev = readFileSync18(SKILLS_DISCOVERED_PATH, "utf-8").trim();
+      prev = readFileSync17(SKILLS_DISCOVERED_PATH, "utf-8").trim();
     } catch {
     }
     if (prev === setHash) return;
@@ -8031,17 +7985,17 @@ function detectGitRepo2() {
 function getClaudeProjectsFolder() {
   const cwd = process.cwd();
   const sanitized = "-" + cwd.replace(/\//g, "-");
-  const projectsDir = join18(homedir18(), ".claude", "projects", sanitized);
-  return existsSync21(projectsDir) ? projectsDir : null;
+  const projectsDir = join17(homedir17(), ".claude", "projects", sanitized);
+  return existsSync20(projectsDir) ? projectsDir : null;
 }
 function extractSessionInsights(projectsDir) {
   const insights = [];
   const files = readdirSync3(projectsDir).filter((f) => f.endsWith(".jsonl"));
   for (const file of files) {
     const sessionId = file.replace(".jsonl", "");
-    const filePath = join18(projectsDir, file);
+    const filePath = join17(projectsDir, file);
     try {
-      const content = readFileSync18(filePath, "utf-8");
+      const content = readFileSync17(filePath, "utf-8");
       const lines = content.split("\n").filter(Boolean);
       for (let i = 0; i < lines.length; i++) {
         try {
@@ -8120,14 +8074,14 @@ function cursorProjectSlug(workspaceRoot) {
   return workspaceRoot.replace(/^[/]+/, "").replace(/[^a-zA-Z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function getCursorTranscriptsDir() {
-  const dir = join18(homedir18(), ".cursor", "projects", cursorProjectSlug(process.cwd()), "agent-transcripts");
-  return existsSync21(dir) ? dir : null;
+  const dir = join17(homedir17(), ".cursor", "projects", cursorProjectSlug(process.cwd()), "agent-transcripts");
+  return existsSync20(dir) ? dir : null;
 }
 function isSafeConvId(id) {
   return /^[A-Za-z0-9_-]+$/.test(id);
 }
 function parseCursorTranscriptFile(filePath) {
-  const content = readFileSync18(filePath, "utf-8");
+  const content = readFileSync17(filePath, "utf-8");
   const lines = content.split("\n").filter(Boolean);
   const messages = [];
   for (let i = 0; i < lines.length; i++) {
@@ -8159,8 +8113,8 @@ async function syncCursorTranscriptsLocal(mcpPort, mcpToken, repo) {
   for (let i = 0; i < convDirs.length; i++) {
     const convId = convDirs[i];
     if (!isSafeConvId(convId)) continue;
-    const filePath = join18(dir, convId, `${convId}.jsonl`);
-    if (!existsSync21(filePath)) continue;
+    const filePath = join17(dir, convId, `${convId}.jsonl`);
+    if (!existsSync20(filePath)) continue;
     try {
       const all = parseCursorTranscriptFile(filePath);
       const messages = all.length > 500 ? all.slice(-500) : all;
@@ -8182,8 +8136,8 @@ async function syncCursorTranscriptsLocal(mcpPort, mcpToken, repo) {
       process.stdout.write(`\r  Progress: ${i + 1}/${convDirs.length} sessions (${totalMessages} messages embedded)   `);
     }
     try {
-      const lc = readFileSync18(filePath, "utf-8").split("\n").filter(Boolean).length;
-      writeFileSync13(join18(OFFSETS_DIR, convId), String(lc), "utf-8");
+      const lc = readFileSync17(filePath, "utf-8").split("\n").filter(Boolean).length;
+      writeFileSync13(join17(OFFSETS_DIR, convId), String(lc), "utf-8");
     } catch {
     }
   }
@@ -8191,7 +8145,7 @@ async function syncCursorTranscriptsLocal(mcpPort, mcpToken, repo) {
   return { sessions: totalSessions, messages: totalMessages };
 }
 function parseTranscriptFile(filePath) {
-  const content = readFileSync18(filePath, "utf-8");
+  const content = readFileSync17(filePath, "utf-8");
   const lines = content.split("\n").filter(Boolean);
   const messages = [];
   for (let i = 0; i < lines.length; i++) {
@@ -8239,7 +8193,7 @@ async function syncTranscriptsLocal(mcpPort, mcpToken, repo) {
   for (let i = 0; i < files.length; i++) {
     const file = files[i];
     const sessionId = file.replace(".jsonl", "");
-    const filePath = join18(projectsDir, file);
+    const filePath = join17(projectsDir, file);
     try {
       const allMessages = parseTranscriptFile(filePath);
       const messages = allMessages.length > 500 ? allMessages.slice(-500) : allMessages;
@@ -8261,9 +8215,9 @@ async function syncTranscriptsLocal(mcpPort, mcpToken, repo) {
       process.stdout.write(`\r  Progress: ${i + 1}/${files.length} sessions (${totalMessages} messages embedded)   `);
     }
     try {
-      const content = readFileSync18(join18(projectsDir, file), "utf-8");
+      const content = readFileSync17(join17(projectsDir, file), "utf-8");
       const lineCount = content.split("\n").filter(Boolean).length;
-      writeFileSync13(join18(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
+      writeFileSync13(join17(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
     } catch {
     }
   }
@@ -8284,7 +8238,7 @@ async function syncTranscriptsBulk(gatewayUrl, token, repo) {
     const sessions = [];
     for (const file of batch) {
       const sessionId = file.replace(".jsonl", "");
-      const filePath = join18(projectsDir, file);
+      const filePath = join17(projectsDir, file);
       try {
         const allMessages = parseTranscriptFile(filePath);
         const messages = allMessages.length > maxMessagesPerSession ? allMessages.slice(-maxMessagesPerSession) : allMessages;
@@ -8313,18 +8267,18 @@ async function syncTranscriptsBulk(gatewayUrl, token, repo) {
     }
     for (const file of batch) {
       const sessionId = file.replace(".jsonl", "");
-      const filePath = join18(projectsDir, file);
+      const filePath = join17(projectsDir, file);
       try {
-        const content = readFileSync18(filePath, "utf-8");
+        const content = readFileSync17(filePath, "utf-8");
         const lineCount = content.split("\n").filter(Boolean).length;
-        writeFileSync13(join18(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
+        writeFileSync13(join17(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
       } catch {
       }
     }
   }
   return { sessions: totalSessions, messages: totalMessages };
 }
-var SYNKRO_DIR11, HOOKS_DIR, BIN_DIR, CONFIG_PATH4, MCP_STDIO_PROXY_SRC, OFFSETS_DIR, CLOUD_JWT_PATH, SKILLS_DISCOVERED_PATH;
+var SYNKRO_DIR10, HOOKS_DIR, BIN_DIR, CONFIG_PATH4, MCP_STDIO_PROXY_SRC, OFFSETS_DIR, CLOUD_JWT_PATH, SKILLS_DISCOVERED_PATH;
 var init_install = __esm({
   "cli/commands/install.ts"() {
     "use strict";
@@ -8342,10 +8296,10 @@ var init_install = __esm({
     init_claudeDesktopTap();
     init_dockerInstall();
     init_setupToken();
-    SYNKRO_DIR11 = join18(homedir18(), ".synkro");
-    HOOKS_DIR = join18(SYNKRO_DIR11, "hooks");
-    BIN_DIR = join18(SYNKRO_DIR11, "bin");
-    CONFIG_PATH4 = join18(SYNKRO_DIR11, "config.env");
+    SYNKRO_DIR10 = join17(homedir17(), ".synkro");
+    HOOKS_DIR = join17(SYNKRO_DIR10, "hooks");
+    BIN_DIR = join17(SYNKRO_DIR10, "bin");
+    CONFIG_PATH4 = join17(SYNKRO_DIR10, "config.env");
     MCP_STDIO_PROXY_SRC = `#!/usr/bin/env bun
 import { readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
@@ -8456,21 +8410,21 @@ rl.on('line', async (line) => {
   }
 });
 `;
-    OFFSETS_DIR = join18(SYNKRO_DIR11, ".transcript-offsets");
-    CLOUD_JWT_PATH = join18(SYNKRO_DIR11, ".cloud-jwt");
-    SKILLS_DISCOVERED_PATH = join18(SYNKRO_DIR11, ".skills-discovered");
+    OFFSETS_DIR = join17(SYNKRO_DIR10, ".transcript-offsets");
+    CLOUD_JWT_PATH = join17(SYNKRO_DIR10, ".cloud-jwt");
+    SKILLS_DISCOVERED_PATH = join17(SYNKRO_DIR10, ".skills-discovered");
   }
 });
 
 // cli/local-cc/install.ts
-import { existsSync as existsSync22, mkdirSync as mkdirSync14, writeFileSync as writeFileSync14, readFileSync as readFileSync19, chmodSync as chmodSync4, copyFileSync as copyFileSync2, renameSync as renameSync6, unlinkSync as unlinkSync7, openSync as openSync2, fsyncSync, closeSync as closeSync2 } from "fs";
-import { join as join19 } from "path";
-import { homedir as homedir19 } from "os";
-import { spawnSync as spawnSync6 } from "child_process";
+import { existsSync as existsSync21, mkdirSync as mkdirSync13, writeFileSync as writeFileSync14, readFileSync as readFileSync18, chmodSync as chmodSync4, copyFileSync as copyFileSync2, renameSync as renameSync6, unlinkSync as unlinkSync7, openSync as openSync2, fsyncSync, closeSync as closeSync2 } from "fs";
+import { join as join18 } from "path";
+import { homedir as homedir18 } from "os";
+import { spawnSync as spawnSync5 } from "child_process";
 function writePluginFiles() {
   for (const c of CHANNELS) {
-    mkdirSync14(c.sessionDir, { recursive: true });
-    mkdirSync14(c.pluginSettingsDir, { recursive: true });
+    mkdirSync13(c.sessionDir, { recursive: true });
+    mkdirSync13(c.pluginSettingsDir, { recursive: true });
     writeFileSync14(c.pluginPkgPath, PLUGIN_PACKAGE_JSON, "utf-8");
     writeFileSync14(
       c.pluginSettingsPath,
@@ -8493,7 +8447,7 @@ function writePluginFiles() {
 }
 function runBunInstall() {
   for (const c of CHANNELS) {
-    const r = spawnSync6("bun", ["install", "--silent"], {
+    const r = spawnSync5("bun", ["install", "--silent"], {
       cwd: c.sessionDir,
       encoding: "utf-8",
       timeout: 12e4
@@ -8506,10 +8460,10 @@ function runBunInstall() {
   }
 }
 function safelyMutateClaudeJson(mutator) {
-  if (!existsSync22(CLAUDE_JSON_PATH)) {
+  if (!existsSync21(CLAUDE_JSON_PATH)) {
     return;
   }
-  const originalText = readFileSync19(CLAUDE_JSON_PATH, "utf-8");
+  const originalText = readFileSync18(CLAUDE_JSON_PATH, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(originalText);
@@ -8609,15 +8563,15 @@ function patchClaudeJson() {
   });
 }
 function installLocalCC() {
-  let bunCheck = spawnSync6("bun", ["--version"], { encoding: "utf-8" });
+  let bunCheck = spawnSync5("bun", ["--version"], { encoding: "utf-8" });
   if (bunCheck.status !== 0) {
     if (process.platform === "darwin") {
       console.log("  Installing bun via brew...");
-      const brewR = spawnSync6("brew", ["install", "oven-sh/bun/bun"], { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
+      const brewR = spawnSync5("brew", ["install", "oven-sh/bun/bun"], { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
       if (brewR.status !== 0) {
         throw new LocalCCInstallError("bun auto-install failed. Install manually: curl -fsSL https://bun.sh/install | bash");
       }
-      bunCheck = spawnSync6("bun", ["--version"], { encoding: "utf-8" });
+      bunCheck = spawnSync5("bun", ["--version"], { encoding: "utf-8" });
       if (bunCheck.status !== 0) {
         throw new LocalCCInstallError("bun installed but not found on PATH. Restart your terminal and re-run install.");
       }
@@ -8651,42 +8605,42 @@ var CLAUDE_JSON_BACKUP_PATH, SESSION_DIR, PLUGIN_PATH, PLUGIN_PKG_PATH, PLUGIN_S
 var init_install2 = __esm({
   "cli/local-cc/install.ts"() {
     "use strict";
-    CLAUDE_JSON_BACKUP_PATH = join19(homedir19(), ".claude.json.synkro-bak");
-    SESSION_DIR = join19(homedir19(), ".synkro", "cc_sessions");
-    PLUGIN_PATH = join19(SESSION_DIR, "synkro-channel.ts");
-    PLUGIN_PKG_PATH = join19(SESSION_DIR, "package.json");
-    PLUGIN_SETTINGS_DIR = join19(SESSION_DIR, ".claude");
-    PLUGIN_SETTINGS_PATH = join19(PLUGIN_SETTINGS_DIR, "settings.json");
-    PROJECT_MCP_PATH = join19(SESSION_DIR, ".mcp.json");
-    CLAUDE_JSON_PATH = join19(homedir19(), ".claude.json");
-    RUN_SCRIPT_PATH = join19(SESSION_DIR, "run-claude.sh");
+    CLAUDE_JSON_BACKUP_PATH = join18(homedir18(), ".claude.json.synkro-bak");
+    SESSION_DIR = join18(homedir18(), ".synkro", "cc_sessions");
+    PLUGIN_PATH = join18(SESSION_DIR, "synkro-channel.ts");
+    PLUGIN_PKG_PATH = join18(SESSION_DIR, "package.json");
+    PLUGIN_SETTINGS_DIR = join18(SESSION_DIR, ".claude");
+    PLUGIN_SETTINGS_PATH = join18(PLUGIN_SETTINGS_DIR, "settings.json");
+    PROJECT_MCP_PATH = join18(SESSION_DIR, ".mcp.json");
+    CLAUDE_JSON_PATH = join18(homedir18(), ".claude.json");
+    RUN_SCRIPT_PATH = join18(SESSION_DIR, "run-claude.sh");
     TMUX_SESSION_NAME = "synkro-local-cc";
     CHANNEL_1_PORT = 8941;
-    SESSION_DIR_2 = join19(homedir19(), ".synkro", "cc_sessions_2");
-    PLUGIN_PATH_2 = join19(SESSION_DIR_2, "synkro-channel.ts");
-    PLUGIN_PKG_PATH_2 = join19(SESSION_DIR_2, "package.json");
-    PLUGIN_SETTINGS_DIR_2 = join19(SESSION_DIR_2, ".claude");
-    PLUGIN_SETTINGS_PATH_2 = join19(PLUGIN_SETTINGS_DIR_2, "settings.json");
-    PROJECT_MCP_PATH_2 = join19(SESSION_DIR_2, ".mcp.json");
-    RUN_SCRIPT_PATH_2 = join19(SESSION_DIR_2, "run-claude.sh");
+    SESSION_DIR_2 = join18(homedir18(), ".synkro", "cc_sessions_2");
+    PLUGIN_PATH_2 = join18(SESSION_DIR_2, "synkro-channel.ts");
+    PLUGIN_PKG_PATH_2 = join18(SESSION_DIR_2, "package.json");
+    PLUGIN_SETTINGS_DIR_2 = join18(SESSION_DIR_2, ".claude");
+    PLUGIN_SETTINGS_PATH_2 = join18(PLUGIN_SETTINGS_DIR_2, "settings.json");
+    PROJECT_MCP_PATH_2 = join18(SESSION_DIR_2, ".mcp.json");
+    RUN_SCRIPT_PATH_2 = join18(SESSION_DIR_2, "run-claude.sh");
     TMUX_SESSION_NAME_2 = "synkro-local-cc-2";
     CHANNEL_2_PORT = 8951;
-    SESSION_DIR_3 = join19(homedir19(), ".synkro", "cc_sessions_3");
-    PLUGIN_PATH_3 = join19(SESSION_DIR_3, "synkro-channel.ts");
-    PLUGIN_PKG_PATH_3 = join19(SESSION_DIR_3, "package.json");
-    PLUGIN_SETTINGS_DIR_3 = join19(SESSION_DIR_3, ".claude");
-    PLUGIN_SETTINGS_PATH_3 = join19(PLUGIN_SETTINGS_DIR_3, "settings.json");
-    PROJECT_MCP_PATH_3 = join19(SESSION_DIR_3, ".mcp.json");
-    RUN_SCRIPT_PATH_3 = join19(SESSION_DIR_3, "run-claude.sh");
+    SESSION_DIR_3 = join18(homedir18(), ".synkro", "cc_sessions_3");
+    PLUGIN_PATH_3 = join18(SESSION_DIR_3, "synkro-channel.ts");
+    PLUGIN_PKG_PATH_3 = join18(SESSION_DIR_3, "package.json");
+    PLUGIN_SETTINGS_DIR_3 = join18(SESSION_DIR_3, ".claude");
+    PLUGIN_SETTINGS_PATH_3 = join18(PLUGIN_SETTINGS_DIR_3, "settings.json");
+    PROJECT_MCP_PATH_3 = join18(SESSION_DIR_3, ".mcp.json");
+    RUN_SCRIPT_PATH_3 = join18(SESSION_DIR_3, "run-claude.sh");
     TMUX_SESSION_NAME_3 = "synkro-local-cc-3";
     CHANNEL_3_PORT = 8942;
-    SESSION_DIR_4 = join19(homedir19(), ".synkro", "cc_sessions_4");
-    PLUGIN_PATH_4 = join19(SESSION_DIR_4, "synkro-channel.ts");
-    PLUGIN_PKG_PATH_4 = join19(SESSION_DIR_4, "package.json");
-    PLUGIN_SETTINGS_DIR_4 = join19(SESSION_DIR_4, ".claude");
-    PLUGIN_SETTINGS_PATH_4 = join19(PLUGIN_SETTINGS_DIR_4, "settings.json");
-    PROJECT_MCP_PATH_4 = join19(SESSION_DIR_4, ".mcp.json");
-    RUN_SCRIPT_PATH_4 = join19(SESSION_DIR_4, "run-claude.sh");
+    SESSION_DIR_4 = join18(homedir18(), ".synkro", "cc_sessions_4");
+    PLUGIN_PATH_4 = join18(SESSION_DIR_4, "synkro-channel.ts");
+    PLUGIN_PKG_PATH_4 = join18(SESSION_DIR_4, "package.json");
+    PLUGIN_SETTINGS_DIR_4 = join18(SESSION_DIR_4, ".claude");
+    PLUGIN_SETTINGS_PATH_4 = join18(PLUGIN_SETTINGS_DIR_4, "settings.json");
+    PROJECT_MCP_PATH_4 = join18(SESSION_DIR_4, ".mcp.json");
+    RUN_SCRIPT_PATH_4 = join18(SESSION_DIR_4, "run-claude.sh");
     TMUX_SESSION_NAME_4 = "synkro-local-cc-4";
     CHANNEL_4_PORT = 8952;
     RUN_SCRIPT_SOURCE = `#!/usr/bin/env bash
@@ -8960,10 +8914,10 @@ var disconnect_exports = {};
 __export(disconnect_exports, {
   disconnectCommand: () => disconnectCommand
 });
-import { existsSync as existsSync23, rmSync as rmSync2, readdirSync as readdirSync4 } from "fs";
-import { homedir as homedir20 } from "os";
-import { join as join20 } from "path";
-import { spawnSync as spawnSync7 } from "child_process";
+import { existsSync as existsSync22, rmSync, readdirSync as readdirSync4 } from "fs";
+import { homedir as homedir19 } from "os";
+import { join as join19 } from "path";
+import { spawnSync as spawnSync6 } from "child_process";
 import { createInterface as createInterface4 } from "readline";
 async function tearDownLocalCC() {
   const docker = dockerStatus();
@@ -8977,7 +8931,7 @@ async function tearDownLocalCC() {
   console.log("\u2713 removed synkro-server container");
   try {
     const image = imageTag();
-    const r = spawnSync7("docker", ["rmi", "-f", image], { encoding: "utf-8", timeout: 3e4 });
+    const r = spawnSync6("docker", ["rmi", "-f", image], { encoding: "utf-8", timeout: 3e4 });
     console.log(r.status === 0 ? `\u2713 removed Docker image ${image}` : "\xB7 no Docker image to remove");
   } catch {
   }
@@ -9048,7 +9002,7 @@ async function disconnectCommand(args2 = [], opts = {}) {
     if (desktopMcpRemoved) removed.mcp = true;
     console.log(`${desktopMcpRemoved ? "\u2713" : "\xB7"} MCP guardrails (Claude Desktop): ${desktopMcpRemoved ? "removed from claude_desktop_config.json" : "no entry found"}`);
   }
-  if (existsSync23(SYNKRO_DIR12)) {
+  if (existsSync22(SYNKRO_DIR11)) {
     if (purge2) {
       emit("uninstall", {
         flavor,
@@ -9057,41 +9011,41 @@ async function disconnectCommand(args2 = [], opts = {}) {
         duration_ms: Date.now() - startedAt
       });
       await flush({ force: true });
-      rmSync2(SYNKRO_DIR12, { recursive: true, force: true });
+      rmSync(SYNKRO_DIR11, { recursive: true, force: true });
       removed.config = true;
-      console.log(`\u2713 wiped ${SYNKRO_DIR12} entirely \u2014 including all scan data and backups`);
+      console.log(`\u2713 wiped ${SYNKRO_DIR11} entirely \u2014 including all scan data and backups`);
     } else {
       const keep = /* @__PURE__ */ new Set([
-        join20(SYNKRO_DIR12, "pgdata"),
-        join20(SYNKRO_DIR12, "pgdata-backups"),
-        join20(SYNKRO_DIR12, ".transcript-offsets")
+        join19(SYNKRO_DIR11, "pgdata"),
+        join19(SYNKRO_DIR11, "pgdata-backups"),
+        join19(SYNKRO_DIR11, ".transcript-offsets")
       ]);
       const preserved = [];
-      for (const entry of readdirSync4(SYNKRO_DIR12)) {
-        const full = join20(SYNKRO_DIR12, entry);
+      for (const entry of readdirSync4(SYNKRO_DIR11)) {
+        const full = join19(SYNKRO_DIR11, entry);
         if (keep.has(full)) {
           preserved.push(entry);
           continue;
         }
-        rmSync2(full, { recursive: true, force: true });
+        rmSync(full, { recursive: true, force: true });
       }
       removed.config = true;
       if (preserved.length > 0) {
-        console.log(`\u2713 removed Synkro config from ${SYNKRO_DIR12} (kept your scan data: ${preserved.join(", ")})`);
+        console.log(`\u2713 removed Synkro config from ${SYNKRO_DIR11} (kept your scan data: ${preserved.join(", ")})`);
         console.log("  run `synkro uninstall --purge` to delete that too");
       } else {
-        console.log(`\u2713 removed ${SYNKRO_DIR12}`);
+        console.log(`\u2713 removed ${SYNKRO_DIR11}`);
       }
     }
   } else {
-    console.log(`\xB7 ${SYNKRO_DIR12} already gone`);
+    console.log(`\xB7 ${SYNKRO_DIR11} already gone`);
   }
   if (!purge2) {
     emit("uninstall", { flavor, purge: purge2, removed, duration_ms: Date.now() - startedAt });
   }
   console.log(purge2 ? "\nSynkro fully removed \u2014 this machine is clean, as if it was never installed." : "\nSynkro uninstalled. Your scan data is preserved.");
 }
-var SYNKRO_DIR12;
+var SYNKRO_DIR11;
 var init_disconnect = __esm({
   "cli/commands/disconnect.ts"() {
     "use strict";
@@ -9103,14 +9057,14 @@ var init_disconnect = __esm({
     init_dockerInstall();
     init_macKeychain();
     init_telemetry();
-    SYNKRO_DIR12 = join20(homedir20(), ".synkro");
+    SYNKRO_DIR11 = join19(homedir19(), ".synkro");
   }
 });
 
 // cli/local-cc/turnLog.ts
-import { appendFileSync as appendFileSync3, existsSync as existsSync24, mkdirSync as mkdirSync15, openSync as openSync3, readFileSync as readFileSync20, readSync, closeSync as closeSync3, statSync as statSync3, watchFile, unwatchFile } from "fs";
-import { dirname as dirname6, join as join21 } from "path";
-import { homedir as homedir21 } from "os";
+import { appendFileSync as appendFileSync3, existsSync as existsSync23, mkdirSync as mkdirSync14, openSync as openSync3, readFileSync as readFileSync19, readSync, closeSync as closeSync3, statSync as statSync3, watchFile, unwatchFile } from "fs";
+import { dirname as dirname6, join as join20 } from "path";
+import { homedir as homedir20 } from "os";
 function truncate(s, max = PREVIEW_MAX) {
   if (s.length <= max) return s;
   return s.slice(0, max) + "\u2026 [+" + (s.length - max) + " chars]";
@@ -9130,7 +9084,7 @@ function extractSeverity(result) {
 }
 function appendTurn(args2) {
   try {
-    mkdirSync15(dirname6(TURN_LOG_PATH), { recursive: true });
+    mkdirSync14(dirname6(TURN_LOG_PATH), { recursive: true });
     const entry = {
       ts: new Date(args2.startedAt).toISOString(),
       role: args2.role,
@@ -9146,11 +9100,11 @@ function appendTurn(args2) {
   }
 }
 function readRecentTurns(n = 20) {
-  if (!existsSync24(TURN_LOG_PATH)) return [];
+  if (!existsSync23(TURN_LOG_PATH)) return [];
   try {
     const size = statSync3(TURN_LOG_PATH).size;
     if (size === 0) return [];
-    const text = readFileSync20(TURN_LOG_PATH, "utf-8");
+    const text = readFileSync19(TURN_LOG_PATH, "utf-8");
     const lines = text.split("\n").filter(Boolean);
     const lastN = lines.slice(-n).reverse();
     return lastN.map((line) => {
@@ -9166,8 +9120,8 @@ function readRecentTurns(n = 20) {
 }
 function followTurns(onEntry) {
   try {
-    mkdirSync15(dirname6(TURN_LOG_PATH), { recursive: true });
-    if (!existsSync24(TURN_LOG_PATH)) {
+    mkdirSync14(dirname6(TURN_LOG_PATH), { recursive: true });
+    if (!existsSync23(TURN_LOG_PATH)) {
       appendFileSync3(TURN_LOG_PATH, "", "utf-8");
     }
   } catch {
@@ -9229,7 +9183,7 @@ var TURN_LOG_PATH, PREVIEW_MAX;
 var init_turnLog = __esm({
   "cli/local-cc/turnLog.ts"() {
     "use strict";
-    TURN_LOG_PATH = join21(homedir21(), ".synkro", "cc_sessions", "turns.log");
+    TURN_LOG_PATH = join20(homedir20(), ".synkro", "cc_sessions", "turns.log");
     PREVIEW_MAX = 400;
   }
 });
@@ -9378,19 +9332,19 @@ var init_grade = __esm({
 });
 
 // cli/local-cc/pueue.ts
-import { execFileSync as execFileSync4, spawnSync as spawnSync8, spawn as spawn3 } from "child_process";
-import { homedir as homedir22 } from "os";
-import { join as join22 } from "path";
+import { execFileSync as execFileSync4, spawnSync as spawnSync7, spawn as spawn3 } from "child_process";
+import { homedir as homedir21 } from "os";
+import { join as join21 } from "path";
 import { connect as connect2 } from "net";
 function pueueAvailable() {
-  const r = spawnSync8("pueue", ["--version"], { encoding: "utf-8" });
+  const r = spawnSync7("pueue", ["--version"], { encoding: "utf-8" });
   if (r.status !== 0) {
     throw new PueueError("pueue CLI not found on PATH. Install pueue (https://github.com/Nukesor/pueue) and start `pueued`.");
   }
 }
 function statusJson() {
   pueueAvailable();
-  const r = spawnSync8("pueue", ["status", "--json"], { encoding: "utf-8" });
+  const r = spawnSync7("pueue", ["status", "--json"], { encoding: "utf-8" });
   if (r.status !== 0) {
     throw new PueueError(`pueue status failed: ${r.stderr || r.stdout || "unknown error"} \u2014 is pueued running?`);
   }
@@ -9435,18 +9389,18 @@ function startTask(opts = {}) {
   let existing = findTask(ch);
   while (existing) {
     if (existing.status === "Running" || existing.status === "Queued") {
-      spawnSync8("tmux", ["kill-session", "-t", `=${ch.tmuxSession}`], { encoding: "utf-8" });
-      spawnSync8("pueue", ["kill", String(existing.id)], { encoding: "utf-8" });
+      spawnSync7("tmux", ["kill-session", "-t", `=${ch.tmuxSession}`], { encoding: "utf-8" });
+      spawnSync7("pueue", ["kill", String(existing.id)], { encoding: "utf-8" });
       for (let i = 0; i < 10; i++) {
         const check = findTask(ch);
         if (!check || check.id !== existing.id || check.status !== "Running" && check.status !== "Queued") break;
-        spawnSync8("sleep", ["0.5"], { encoding: "utf-8" });
+        spawnSync7("sleep", ["0.5"], { encoding: "utf-8" });
       }
     }
-    spawnSync8("pueue", ["remove", String(existing.id)], { encoding: "utf-8" });
+    spawnSync7("pueue", ["remove", String(existing.id)], { encoding: "utf-8" });
     existing = findTask(ch);
   }
-  const runScript = join22(cwd, "run-claude.sh");
+  const runScript = join21(cwd, "run-claude.sh");
   const args2 = [
     "add",
     "--label",
@@ -9457,7 +9411,7 @@ function startTask(opts = {}) {
     "bash",
     runScript
   ];
-  const r = spawnSync8("pueue", args2, { encoding: "utf-8" });
+  const r = spawnSync7("pueue", args2, { encoding: "utf-8" });
   if (r.status !== 0) {
     throw new PueueError(`pueue add failed: ${r.stderr || r.stdout}`);
   }
@@ -9468,25 +9422,25 @@ function startTask(opts = {}) {
   return created;
 }
 function stopTask(channel = CHANNEL_PRIMARY) {
-  spawnSync8("tmux", ["kill-session", "-t", `=${channel.tmuxSession}`], { encoding: "utf-8" });
+  spawnSync7("tmux", ["kill-session", "-t", `=${channel.tmuxSession}`], { encoding: "utf-8" });
   let t = findTask(channel);
   while (t) {
     if (t.status === "Running" || t.status === "Queued") {
-      spawnSync8("pueue", ["kill", String(t.id)], { encoding: "utf-8" });
+      spawnSync7("pueue", ["kill", String(t.id)], { encoding: "utf-8" });
       for (let i = 0; i < 10; i++) {
         const check = findTask(channel);
         if (!check || check.id !== t.id || check.status !== "Running" && check.status !== "Queued") break;
-        spawnSync8("sleep", ["0.5"], { encoding: "utf-8" });
+        spawnSync7("sleep", ["0.5"], { encoding: "utf-8" });
       }
     }
-    spawnSync8("pueue", ["remove", String(t.id)], { encoding: "utf-8" });
+    spawnSync7("pueue", ["remove", String(t.id)], { encoding: "utf-8" });
     t = findTask(channel);
   }
 }
 function tailLogs(lines = 80, channel = CHANNEL_PRIMARY) {
   const t = findTask(channel);
   if (!t) return `(no ${channel.taskLabel} task)`;
-  const r = spawnSync8("pueue", ["log", "--lines", String(lines), String(t.id)], { encoding: "utf-8" });
+  const r = spawnSync7("pueue", ["log", "--lines", String(lines), String(t.id)], { encoding: "utf-8" });
   return r.stdout || r.stderr || "(no output)";
 }
 function ensureRunning(opts = {}) {
@@ -9511,8 +9465,8 @@ function probePort(host, port, timeoutMs = 500) {
   });
 }
 function tmuxDismissPrompts(tmuxSession = TMUX_SESSION) {
-  spawnSync8("tmux", ["send-keys", "-t", tmuxSession, "1"], { encoding: "utf-8" });
-  spawnSync8("tmux", ["send-keys", "-t", tmuxSession, "Enter"], { encoding: "utf-8" });
+  spawnSync7("tmux", ["send-keys", "-t", tmuxSession, "1"], { encoding: "utf-8" });
+  spawnSync7("tmux", ["send-keys", "-t", tmuxSession, "Enter"], { encoding: "utf-8" });
 }
 async function waitForChannelReady(port, timeoutMs = 6e4, host = "127.0.0.1", tmuxSession = TMUX_SESSION) {
   const deadline = Date.now() + timeoutMs;
@@ -9524,46 +9478,46 @@ async function waitForChannelReady(port, timeoutMs = 6e4, host = "127.0.0.1", tm
   return probePort(host, port);
 }
 function brewInstall(pkg) {
-  const brew = spawnSync8("brew", ["--version"], { encoding: "utf-8" });
+  const brew = spawnSync7("brew", ["--version"], { encoding: "utf-8" });
   if (brew.status !== 0) return false;
   console.log(`  Installing ${pkg} via brew...`);
-  const r = spawnSync8("brew", ["install", pkg], { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
+  const r = spawnSync7("brew", ["install", pkg], { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
   return r.status === 0;
 }
 function assertPueueInstalled() {
-  let r = spawnSync8("pueue", ["--version"], { encoding: "utf-8" });
+  let r = spawnSync7("pueue", ["--version"], { encoding: "utf-8" });
   if (r.status !== 0) {
     if (process.platform === "darwin" && brewInstall("pueue")) {
-      r = spawnSync8("pueue", ["--version"], { encoding: "utf-8" });
+      r = spawnSync7("pueue", ["--version"], { encoding: "utf-8" });
       if (r.status !== 0) throw new PueueError("pueue install succeeded but binary not found on PATH.");
     } else {
       throw new PueueError("pueue not found. Install it: brew install pueue (macOS) or https://github.com/Nukesor/pueue");
     }
   }
-  const status = spawnSync8("pueue", ["status", "--json"], { encoding: "utf-8", timeout: 5e3 });
+  const status = spawnSync7("pueue", ["status", "--json"], { encoding: "utf-8", timeout: 5e3 });
   if (status.status !== 0) {
     console.log("  Starting pueued daemon...");
     const child = spawn3("pueued", ["-d"], { stdio: "ignore", detached: true });
     child.unref();
-    spawnSync8("sleep", ["1"]);
-    const retry = spawnSync8("pueue", ["status", "--json"], { encoding: "utf-8", timeout: 5e3 });
+    spawnSync7("sleep", ["1"]);
+    const retry = spawnSync7("pueue", ["status", "--json"], { encoding: "utf-8", timeout: 5e3 });
     if (retry.status !== 0) {
       throw new PueueError("pueue daemon not reachable after starting pueued. Check `pueued` manually.");
     }
   }
-  spawnSync8("pueue", ["parallel", "2"], { encoding: "utf-8" });
+  spawnSync7("pueue", ["parallel", "2"], { encoding: "utf-8" });
 }
 function assertClaudeInstalled() {
-  const r = spawnSync8("claude", ["--version"], { encoding: "utf-8" });
+  const r = spawnSync7("claude", ["--version"], { encoding: "utf-8" });
   if (r.status !== 0) {
     throw new PueueError("claude CLI not found on PATH. Install Claude Code first: https://docs.claude.com/claude-code");
   }
 }
 function assertTmuxInstalled() {
-  let r = spawnSync8("tmux", ["-V"], { encoding: "utf-8" });
+  let r = spawnSync7("tmux", ["-V"], { encoding: "utf-8" });
   if (r.status !== 0) {
     if (process.platform === "darwin" && brewInstall("tmux")) {
-      r = spawnSync8("tmux", ["-V"], { encoding: "utf-8" });
+      r = spawnSync7("tmux", ["-V"], { encoding: "utf-8" });
       if (r.status !== 0) throw new PueueError("tmux install succeeded but binary not found on PATH.");
     } else {
       throw new PueueError("tmux not found. Install it: brew install tmux (macOS) or apt install tmux (Linux)");
@@ -9576,12 +9530,12 @@ var init_pueue = __esm({
     "use strict";
     TASK_LABEL = "synkro-local-cc";
     TMUX_SESSION = "synkro-local-cc";
-    SESSION_DIR2 = join22(homedir22(), ".synkro", "cc_sessions");
+    SESSION_DIR2 = join21(homedir21(), ".synkro", "cc_sessions");
     TASK_LABEL_2 = "synkro-local-cc-2";
     TMUX_SESSION_2 = "synkro-local-cc-2";
-    SESSION_DIR_22 = join22(homedir22(), ".synkro", "cc_sessions_2");
-    SESSION_DIR_32 = join22(homedir22(), ".synkro", "cc_sessions_3");
-    SESSION_DIR_42 = join22(homedir22(), ".synkro", "cc_sessions_4");
+    SESSION_DIR_22 = join21(homedir21(), ".synkro", "cc_sessions_2");
+    SESSION_DIR_32 = join21(homedir21(), ".synkro", "cc_sessions_3");
+    SESSION_DIR_42 = join21(homedir21(), ".synkro", "cc_sessions_4");
     PueueError = class extends Error {
       constructor(message, cause) {
         super(message);
@@ -9596,13 +9550,13 @@ var init_pueue = __esm({
 });
 
 // cli/local-cc/settings.ts
-import { existsSync as existsSync25, readFileSync as readFileSync21 } from "fs";
-import { homedir as homedir23 } from "os";
-import { join as join23 } from "path";
+import { existsSync as existsSync24, readFileSync as readFileSync20 } from "fs";
+import { homedir as homedir22 } from "os";
+import { join as join22 } from "path";
 function isLocalCCEnabled() {
-  if (!existsSync25(CONFIG_PATH5)) return false;
+  if (!existsSync24(CONFIG_PATH5)) return false;
   try {
-    const content = readFileSync21(CONFIG_PATH5, "utf-8");
+    const content = readFileSync20(CONFIG_PATH5, "utf-8");
     const match = content.match(/^SYNKRO_LOCAL_INFERENCE='([^']*)'/m);
     return match?.[1] === "yes";
   } catch {
@@ -9613,7 +9567,7 @@ var CONFIG_PATH5;
 var init_settings = __esm({
   "cli/local-cc/settings.ts"() {
     "use strict";
-    CONFIG_PATH5 = join23(homedir23(), ".synkro", "config.env");
+    CONFIG_PATH5 = join22(homedir22(), ".synkro", "config.env");
   }
 });
 
@@ -9622,11 +9576,11 @@ var localCc_exports = {};
 __export(localCc_exports, {
   localCcCommand: () => localCcCommand
 });
-import { spawnSync as spawnSync9 } from "child_process";
-import { homedir as homedir24 } from "os";
-import { join as join24 } from "path";
+import { spawnSync as spawnSync8 } from "child_process";
+import { homedir as homedir23 } from "os";
+import { join as join23 } from "path";
 import { readFileSync as fsReadFileSync, existsSync as fsExistsSync } from "fs";
-import { existsSync as existsSync26, readFileSync as readFileSync22, writeFileSync as writeFileSync15 } from "fs";
+import { existsSync as existsSync25, readFileSync as readFileSync21, writeFileSync as writeFileSync15 } from "fs";
 function deploymentMode() {
   const env = (process.env.SYNKRO_DEPLOYMENT_MODE || "").toLowerCase();
   if (env === "docker") return "docker";
@@ -9732,15 +9686,15 @@ TROUBLESHOOTING
 `);
 }
 function readGatewayUrl() {
-  if (existsSync26(CONFIG_PATH6)) {
-    const m = readFileSync22(CONFIG_PATH6, "utf-8").match(/^SYNKRO_GATEWAY_URL='([^']*)'/m);
+  if (existsSync25(CONFIG_PATH6)) {
+    const m = readFileSync21(CONFIG_PATH6, "utf-8").match(/^SYNKRO_GATEWAY_URL='([^']*)'/m);
     if (m) return m[1];
   }
   return "https://api.synkro.sh";
 }
 function updateLocalInferenceFlag(enabled) {
-  if (!existsSync26(CONFIG_PATH6)) return;
-  let content = readFileSync22(CONFIG_PATH6, "utf-8");
+  if (!existsSync25(CONFIG_PATH6)) return;
+  let content = readFileSync21(CONFIG_PATH6, "utf-8");
   const flag = enabled ? "yes" : "no";
   if (content.includes("SYNKRO_LOCAL_INFERENCE=")) {
     content = content.replace(/^SYNKRO_LOCAL_INFERENCE='[^']*'/m, `SYNKRO_LOCAL_INFERENCE='${flag}'`);
@@ -9803,7 +9757,7 @@ async function cmdStatus() {
   }
   const ch1Up = await isChannelAvailable();
   console.log(`Channel 1 ${CHANNEL_HOST}:${CHANNEL_PORT}: ${ch1Up ? "reachable" : "unreachable"}`);
-  const tmux1 = spawnSync9("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME}`], { encoding: "utf-8" });
+  const tmux1 = spawnSync8("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME}`], { encoding: "utf-8" });
   console.log(`tmux '${TMUX_SESSION_NAME}': ${tmux1.status === 0 ? "live" : "absent"}`);
   const t2 = findTask(CHANNEL_SECONDARY);
   if (!t2) {
@@ -9813,7 +9767,7 @@ async function cmdStatus() {
   }
   const ch2Up = await isChannelAvailable(CHANNEL_2_PORT);
   console.log(`Channel 2 ${CHANNEL_HOST}:${CHANNEL_2_PORT}: ${ch2Up ? "reachable" : "unreachable"}`);
-  const tmux2 = spawnSync9("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME_2}`], { encoding: "utf-8" });
+  const tmux2 = spawnSync8("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME_2}`], { encoding: "utf-8" });
   console.log(`tmux '${TMUX_SESSION_NAME_2}': ${tmux2.status === 0 ? "live" : "absent"}`);
 }
 async function cmdEnable() {
@@ -10019,7 +9973,7 @@ function cmdLogs(rest) {
       }
       return "200";
     })();
-    spawnSync9("docker", ["logs", "--tail", tailArg, ...followFlag, "synkro-server"], { stdio: "inherit" });
+    spawnSync8("docker", ["logs", "--tail", tailArg, ...followFlag, "synkro-server"], { stdio: "inherit" });
     return;
   }
   for (const arg of rest) {
@@ -10067,7 +10021,7 @@ function cmdLogs(rest) {
 function cmdAttach(rest) {
   assertTmuxInstalled();
   const readonly = rest.some((a) => a === "--readonly" || a === "-r");
-  const has = spawnSync9("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME}`], { encoding: "utf-8" });
+  const has = spawnSync8("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME}`], { encoding: "utf-8" });
   if (has.status !== 0) {
     console.error(`No tmux session '${TMUX_SESSION_NAME}' running. Start it with: synkro local-cc start`);
     process.exit(1);
@@ -10080,7 +10034,7 @@ function cmdAttach(rest) {
   console.log("Detach with Ctrl-B then D. (Do not press Ctrl-C \u2014 that would interrupt claude.)");
   console.log();
   const args2 = readonly ? ["attach-session", "-r", "-t", TMUX_SESSION_NAME] : ["attach-session", "-t", TMUX_SESSION_NAME];
-  const r = spawnSync9("tmux", args2, { stdio: "inherit" });
+  const r = spawnSync8("tmux", args2, { stdio: "inherit" });
   process.exit(r.status ?? 0);
 }
 async function cmdTest() {
@@ -10181,8 +10135,8 @@ var init_localCc = __esm({
     init_install();
     init_client2();
     init_stub();
-    SYNKRO_CONFIG_PATH = join24(homedir24(), ".synkro", "config.env");
-    CONFIG_PATH6 = join24(homedir24(), ".synkro", "config.env");
+    SYNKRO_CONFIG_PATH = join23(homedir23(), ".synkro", "config.env");
+    CONFIG_PATH6 = join23(homedir23(), ".synkro", "config.env");
   }
 });
 
@@ -10191,15 +10145,15 @@ var import_exports = {};
 __export(import_exports, {
   importCommand: () => importCommand
 });
-import { existsSync as existsSync27, readFileSync as readFileSync23, readdirSync as readdirSync5 } from "fs";
-import { homedir as homedir25 } from "os";
-import { join as join25 } from "path";
+import { existsSync as existsSync26, readFileSync as readFileSync22, readdirSync as readdirSync5 } from "fs";
+import { homedir as homedir24 } from "os";
+import { join as join24 } from "path";
 import { execSync as execSync7 } from "child_process";
 import { createInterface as createInterface5 } from "readline";
 function readConfigEnv2() {
   const out = {};
   try {
-    for (const line of readFileSync23(CONFIG_PATH7, "utf-8").split("\n")) {
+    for (const line of readFileSync22(CONFIG_PATH7, "utf-8").split("\n")) {
       const t = line.trim();
       if (!t || t.startsWith("#")) continue;
       const eq = t.indexOf("=");
@@ -10211,8 +10165,8 @@ function readConfigEnv2() {
 }
 function projectsFolder() {
   const sanitized = process.cwd().replace(/\//g, "-");
-  const dir = join25(homedir25(), ".claude", "projects", sanitized);
-  return existsSync27(dir) ? dir : null;
+  const dir = join24(homedir24(), ".claude", "projects", sanitized);
+  return existsSync26(dir) ? dir : null;
 }
 function repoName() {
   try {
@@ -10235,7 +10189,7 @@ function extractText(content) {
   return "";
 }
 function parseSession(filePath, sessionId) {
-  const lines = readFileSync23(filePath, "utf-8").split("\n").filter(Boolean);
+  const lines = readFileSync22(filePath, "utf-8").split("\n").filter(Boolean);
   const messages = [];
   const actions = [];
   let step = 0;
@@ -10308,7 +10262,7 @@ async function importCommand() {
       return;
     }
   }
-  const sessions = files.map((f) => parseSession(join25(dir, f), f.replace(".jsonl", ""))).filter((s) => s.messages.length > 0);
+  const sessions = files.map((f) => parseSession(join24(dir, f), f.replace(".jsonl", ""))).filter((s) => s.messages.length > 0);
   const totalMsgs = sessions.reduce((n, s) => n + s.messages.length, 0);
   let ok = 0, fail = 0;
   if (isCloud) {
@@ -10368,7 +10322,7 @@ var init_import = __esm({
   "cli/commands/import.ts"() {
     "use strict";
     init_stub();
-    CONFIG_PATH7 = join25(homedir25(), ".synkro", "config.env");
+    CONFIG_PATH7 = join24(homedir24(), ".synkro", "config.env");
   }
 });
 
@@ -10410,10 +10364,10 @@ var init_packVerify = __esm({
 });
 
 // cli/installer/lockfile.ts
-import { existsSync as existsSync28, readFileSync as readFileSync24, writeFileSync as writeFileSync16 } from "fs";
-import { join as join26 } from "path";
+import { existsSync as existsSync27, readFileSync as readFileSync23, writeFileSync as writeFileSync16 } from "fs";
+import { join as join25 } from "path";
 function lockPath(repoRoot) {
-  return join26(repoRoot, LOCK_FILE);
+  return join25(repoRoot, LOCK_FILE);
 }
 function writeLockfile(repoRoot, entries) {
   const sorted = [...entries].sort((a, b) => a.ref.localeCompare(b.ref));
@@ -10446,9 +10400,9 @@ var sync_exports = {};
 __export(sync_exports, {
   syncCommand: () => syncCommand
 });
-import { existsSync as existsSync29, mkdirSync as mkdirSync16, readdirSync as readdirSync6, rmSync as rmSync3, writeFileSync as writeFileSync17 } from "fs";
-import { homedir as homedir26 } from "os";
-import { join as join27 } from "path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync15, readdirSync as readdirSync6, rmSync as rmSync2, writeFileSync as writeFileSync17 } from "fs";
+import { homedir as homedir25 } from "os";
+import { join as join26 } from "path";
 function cacheKey(ref, version) {
   return ref.replace(/\//g, "__").replace(/[^\w.@-]/g, "_") + "@" + version + ".json";
 }
@@ -10479,8 +10433,8 @@ async function syncCommand(_args = []) {
   }
   const gateway = (process.env.SYNKRO_GATEWAY_URL || "https://api.synkro.sh").replace(/\/$/, "");
   const cloud = process.env.SYNKRO_DEPLOY_LOCATION === "cloud";
-  const cacheDir = join27(homedir26(), ".synkro", "cache", "packs");
-  if (!cloud) mkdirSync16(cacheDir, { recursive: true });
+  const cacheDir = join26(homedir25(), ".synkro", "cache", "packs");
+  if (!cloud) mkdirSync15(cacheDir, { recursive: true });
   console.log(`Syncing ${refs.length} standard(s) from the registry\u2026`);
   const lock = [];
   const keptCacheFiles = /* @__PURE__ */ new Set();
@@ -10508,7 +10462,7 @@ async function syncCommand(_args = []) {
     if (!cloud) {
       const fname = cacheKey(ref, data.version);
       keptCacheFiles.add(fname);
-      writeFileSync17(join27(cacheDir, fname), JSON.stringify({
+      writeFileSync17(join26(cacheDir, fname), JSON.stringify({
         ref,
         version: data.version,
         digest: data.digest,
@@ -10520,11 +10474,11 @@ async function syncCommand(_args = []) {
     const ruleCount = Array.isArray(pack.rules) ? pack.rules.length : 0;
     console.log(`  \u2713 ${ref}:${data.version} \u2014 verified (${ruleCount} rule${ruleCount === 1 ? "" : "s"})`);
   }
-  if (!cloud && existsSync29(cacheDir)) {
+  if (!cloud && existsSync28(cacheDir)) {
     for (const f of readdirSync6(cacheDir)) {
       if (f.endsWith(".json") && !keptCacheFiles.has(f)) {
         try {
-          rmSync3(join27(cacheDir, f));
+          rmSync2(join26(cacheDir, f));
         } catch {
         }
       }
@@ -10660,13 +10614,13 @@ var config_exports = {};
 __export(config_exports, {
   configCommand: () => configCommand
 });
-import { readFileSync as readFileSync25, writeFileSync as writeFileSync18, existsSync as existsSync30 } from "fs";
-import { join as join28 } from "path";
-import { homedir as homedir27 } from "os";
+import { readFileSync as readFileSync24, writeFileSync as writeFileSync18, existsSync as existsSync29 } from "fs";
+import { join as join27 } from "path";
+import { homedir as homedir26 } from "os";
 function readConfigEnv3() {
-  if (!existsSync30(CONFIG_PATH8)) return {};
+  if (!existsSync29(CONFIG_PATH8)) return {};
   const out = {};
-  for (const line of readFileSync25(CONFIG_PATH8, "utf-8").split("\n")) {
+  for (const line of readFileSync24(CONFIG_PATH8, "utf-8").split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#")) continue;
     const eq = t.indexOf("=");
@@ -10675,11 +10629,11 @@ function readConfigEnv3() {
   return out;
 }
 function updateConfigValue(key, value) {
-  if (!existsSync30(CONFIG_PATH8)) {
+  if (!existsSync29(CONFIG_PATH8)) {
     console.error("No config found. Run `synkro install` first.");
     process.exit(1);
   }
-  const lines = readFileSync25(CONFIG_PATH8, "utf-8").split("\n");
+  const lines = readFileSync24(CONFIG_PATH8, "utf-8").split("\n");
   const pattern = new RegExp(`^${key}=`);
   let found = false;
   const updated = lines.map((line) => {
@@ -10842,14 +10796,14 @@ To change:`);
   }
   if (inferenceValue !== "cloud") await reconcileContainer();
 }
-var SYNKRO_DIR13, CONFIG_PATH8;
+var SYNKRO_DIR12, CONFIG_PATH8;
 var init_config = __esm({
   "cli/commands/config.ts"() {
     "use strict";
     init_stub();
     init_optout();
-    SYNKRO_DIR13 = join28(homedir27(), ".synkro");
-    CONFIG_PATH8 = join28(SYNKRO_DIR13, "config.env");
+    SYNKRO_DIR12 = join27(homedir26(), ".synkro");
+    CONFIG_PATH8 = join27(SYNKRO_DIR12, "config.env");
   }
 });
 
@@ -11038,14 +10992,14 @@ Usage:
 });
 
 // cli/bootstrap.js
-import { readFileSync as readFileSync26, existsSync as existsSync31 } from "fs";
+import { readFileSync as readFileSync25, existsSync as existsSync30 } from "fs";
 import { resolve as resolve3 } from "path";
 var envCandidates = [
   resolve3(process.env.HOME ?? "", ".synkro", "config.env")
 ];
 for (const envPath of envCandidates) {
-  if (!existsSync31(envPath)) continue;
-  const envContent = readFileSync26(envPath, "utf-8");
+  if (!existsSync30(envPath)) continue;
+  const envContent = readFileSync25(envPath, "utf-8");
   for (const line of envContent.split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -11062,7 +11016,7 @@ var subArgs = args.slice(1);
 var isDetachedChild = process.env.SYNKRO_TELEMETRY_DETACHED === "1";
 var FLUSH_SKIP = /* @__PURE__ */ new Set(["grade", "version", "--version", "-v", "help", "--help", "-h", ""]);
 function printVersion() {
-  console.log("1.7.64");
+  console.log("1.7.66");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents