@synkro-sh/cli 1.7.86 → 1.7.87

package/dist/bootstrap.js

@@ -147,7 +147,7 @@ function getIdentity() {
   if (cached2) return cached2;
   let cliVersion = "0.0.0";
   try {
-    cliVersion = "1.7.86";
+    cliVersion = "1.7.87";
   } catch {
   }
   const creds = loadCredentialsIdentity();
@@ -2500,7 +2500,7 @@ function telemCreds(): TelemCreds {
 }
 
 interface HookEmitOpts {
-  agent_kind?: 'claude_code' | 'cursor';
+  agent_kind?: 'claude_code' | 'cursor' | 'codex';
   cc_session_id?: string;
   cc_tool_use_id?: string;
   cc_model?: string;
@@ -5490,19 +5490,24 @@ import { join as join14 } from "path";
 import { execSync as execSync3, spawnSync as spawnSync3 } from "child_process";
 function splitWorkers(total, providers) {
   const t = Math.max(0, Math.floor(total));
-  const hasClaude = providers.includes("claude_code");
-  const hasCursor = providers.includes("cursor");
-  if (hasClaude && hasCursor) {
-    const cursorWorkers = Math.floor(t / 2);
-    return { claudeWorkers: t - cursorWorkers, cursorWorkers };
-  }
-  if (hasCursor) return { claudeWorkers: 0, cursorWorkers: t };
-  return { claudeWorkers: t, cursorWorkers: 0 };
+  const selected = ["claude_code", "cursor", "codex"].filter((provider) => providers.includes(provider));
+  const active = selected.length > 0 ? selected : ["claude_code"];
+  const base = Math.floor(t / active.length);
+  let remainder = t % active.length;
+  const counts = { claudeWorkers: 0, cursorWorkers: 0, codexWorkers: 0 };
+  for (const provider of active) {
+    const count = base + (remainder-- > 0 ? 1 : 0);
+    if (provider === "claude_code") counts.claudeWorkers = count;
+    else if (provider === "cursor") counts.cursorWorkers = count;
+    else counts.codexWorkers = count;
+  }
+  return counts;
 }
 function normalizeProvider(p) {
   const v = p.trim().toLowerCase();
   if (v === "claude" || v === "claude-code" || v === "claude_code" || v === "cc") return "claude_code";
   if (v === "cursor") return "cursor";
+  if (v === "codex" || v === "openai-codex" || v === "openai_codex") return "codex";
   return null;
 }
 function resolveGraderPool(parsed) {
@@ -5516,8 +5521,9 @@ function resolveGraderPool(parsed) {
       const np = normalizeProvider(k);
       if (np === "claude_code") counts.claude_code = Math.max(0, Math.floor(v));
       else if (np === "cursor") counts.cursor = Math.max(0, Math.floor(v));
+      else if (np === "codex") counts.codex = Math.max(0, Math.floor(v));
       else if (flagUnknown) {
-        warnings.push(`synkro.toml: ${where}.${k} is not a known provider (use claude-code or cursor) \u2014 ignored`);
+        warnings.push(`synkro.toml: ${where}.${k} is not a known provider (use claude-code, cursor, or codex) \u2014 ignored`);
       }
     }
   };
@@ -5528,10 +5534,10 @@ function resolveGraderPool(parsed) {
   if (rawPool != null && rawPool !== "auto") {
     const np = normalizeProvider(String(rawPool));
     if (np) pool = np;
-    else warnings.push(`synkro.toml: grader.pool="${rawPool}" is not recognized (use auto | claude-code | cursor) \u2014 falling back to auto`);
+    else warnings.push(`synkro.toml: grader.pool="${rawPool}" is not recognized (use auto | claude-code | cursor | codex) \u2014 falling back to auto`);
   }
-  if (counts.claude_code != null || counts.cursor != null) {
-    return { claudeWorkers: counts.claude_code, cursorWorkers: counts.cursor, pool, warnings };
+  if (counts.claude_code != null || counts.cursor != null || counts.codex != null) {
+    return { claudeWorkers: counts.claude_code, cursorWorkers: counts.cursor, codexWorkers: counts.codex, pool, warnings };
   }
   return { pool, warnings };
 }
@@ -5624,15 +5630,18 @@ function resolveWorkerConfig(rest) {
   if (provs.length === 0) {
     const sc = readSynkroFileConfig();
     for (const w of sc.warnings) console.warn(`  \u26A0 ${w}`);
-    if (sc.claudeWorkers != null || sc.cursorWorkers != null) {
+    if (sc.claudeWorkers != null || sc.cursorWorkers != null || sc.codexWorkers != null) {
       const cw = sc.claudeWorkers || 0;
       const curw = sc.cursorWorkers || 0;
-      if (cw + curw > 0) return { claudeWorkers: cw, cursorWorkers: curw, explicit };
+      const codw = sc.codexWorkers || 0;
+      if (cw + curw + codw > 0) return { claudeWorkers: cw, cursorWorkers: curw, codexWorkers: codw, explicit };
     }
     if (sc.pool === "cursor") {
       provs = ["cursor"];
     } else if (sc.pool === "claude_code") {
       provs = ["claude_code"];
+    } else if (sc.pool === "codex") {
+      provs = ["codex"];
     } else {
       provs = detectAgents().map((a) => a.kind);
       if (provs.length === 0) provs = ["claude_code"];
@@ -5710,7 +5719,14 @@ async function dockerInstall(opts = {}) {
   const image = imageTag();
   const claudeWorkers = opts.claudeWorkers ?? opts.workersPerPool ?? 8;
   const cursorWorkers = opts.cursorWorkers ?? 0;
-  const totalWorkers = claudeWorkers + cursorWorkers;
+  const codexWorkers = opts.codexWorkers ?? 0;
+  const totalWorkers = claudeWorkers + cursorWorkers + codexWorkers;
+  const codexHomeDir = opts.codexHomeDir ?? join14(SYNKRO_DIR7, "codex-local-session");
+  if (codexWorkers > 0 && !existsSync19(join14(codexHomeDir, "auth.json"))) {
+    throw new DockerInstallError(
+      "Codex grader credentials are missing. Re-run `synkro install` to authorize an isolated Codex session."
+    );
+  }
   mkdirSync12(PGDATA_PATH, { recursive: true });
   mkdirSync12(BACKUP_DIR, { recursive: true });
   mkdirSync12(CLAUDE_HOST_STATE_DIR, { recursive: true });
@@ -5806,12 +5822,15 @@ async function dockerInstall(opts = {}) {
     // Cursor creds — mounted RW so the in-container refresher can rotate the
     // access token in place. Only mounted when the install includes Cursor.
     ...cursorWorkers > 0 ? ["-v", `${CURSOR_CREDS_DIR}:/home/synkro/.cursor-creds:rw`] : [],
+    ...codexWorkers > 0 ? ["-v", `${codexHomeDir}:/home/synkro/.codex:rw`] : [],
     "-e",
     `WORKERS_PER_POOL=${totalWorkers}`,
     "-e",
     `CLAUDE_WORKERS=${claudeWorkers}`,
     "-e",
     `CURSOR_WORKERS=${cursorWorkers}`,
+    "-e",
+    `CODEX_WORKERS=${codexWorkers}`,
     // Pass through the batch-size lever if the operator set it. Defaults
     // inside the container to 5; clamped to [1, 20] by synkro-server.ts.
     ...process.env.SYNKRO_MAX_BATCH_SIZE ? ["-e", `SYNKRO_MAX_BATCH_SIZE=${process.env.SYNKRO_MAX_BATCH_SIZE}`] : [],
@@ -5929,6 +5948,7 @@ function readContainerConfig() {
   return {
     claudeWorkers: num(get("CLAUDE_WORKERS")),
     cursorWorkers: num(get("CURSOR_WORKERS")),
+    codexWorkers: num(get("CODEX_WORKERS")),
     connectedRepo: get("SYNKRO_CONNECTED_REPO") || void 0
   };
 }
@@ -6165,6 +6185,119 @@ var init_setupToken = __esm({
   }
 });
 
+// cli/local-cc/codexCloudSetup.ts
+import { spawn as nodeSpawn2, spawnSync as spawnSync4 } from "child_process";
+import { readFileSync as readFileSync18, writeFileSync as writeFileSync14, mkdirSync as mkdirSync13, rmSync, existsSync as existsSync20 } from "fs";
+import { homedir as homedir18 } from "os";
+import { join as join16 } from "path";
+function findCodexBinary() {
+  if (process.env.SYNKRO_CODEX_BIN) return process.env.SYNKRO_CODEX_BIN;
+  const r = spawnSync4("which", ["codex"], { encoding: "utf-8" });
+  const p = (r.stdout || "").trim().split("\n")[0];
+  return p || null;
+}
+function runCodexLogin(codexBin, codexHome) {
+  mkdirSync13(codexHome, { recursive: true, mode: 448 });
+  writeFileSync14(join16(codexHome, "config.toml"), 'cli_auth_credentials_store = "file"\n', { mode: 384 });
+  return new Promise((resolve6, reject) => {
+    const proc = nodeSpawn2(codexBin, ["login"], {
+      stdio: "inherit",
+      env: { ...process.env, CODEX_HOME: codexHome }
+    });
+    proc.on("error", (err) => reject(new Error(`failed to spawn codex login: ${err.message}`)));
+    proc.on("close", (code) => code === 0 ? resolve6() : reject(new Error(`codex login exited with code ${code}`)));
+  });
+}
+async function setupCodexCloud(gatewayUrl, bearerToken, onStatus) {
+  try {
+    const status = await fetch(`${gatewayUrl.replace(/\/+$/, "")}/codex/status`, {
+      headers: { Authorization: `Bearer ${bearerToken}` }
+    });
+    const body = await status.json().catch(() => ({}));
+    if (status.ok && body.connected) {
+      onStatus?.("\u2713 Existing Codex cloud session is connected.");
+      return { ok: true };
+    }
+  } catch {
+  }
+  const codexBin = findCodexBinary();
+  if (!codexBin) {
+    return { ok: false, error: "Codex CLI not found on PATH. Install Codex (https://developers.openai.com/codex), then re-run `synkro install`. (Set SYNKRO_CODEX_BIN to override the binary path.)" };
+  }
+  onStatus?.("Opening your browser to authorize your Codex subscription for Synkro Cloud\u2026");
+  try {
+    await runCodexLogin(codexBin, CODEX_CLOUD_HOME);
+  } catch (e) {
+    return { ok: false, error: `Codex login failed: ${e.message}` };
+  }
+  const authPath = join16(CODEX_CLOUD_HOME, "auth.json");
+  if (!existsSync20(authPath)) {
+    return { ok: false, error: "codex login completed but no auth.json was written \u2014 did the browser approval finish?" };
+  }
+  let auth;
+  try {
+    auth = JSON.parse(readFileSync18(authPath, "utf-8"));
+  } catch (e) {
+    return { ok: false, error: `could not read codex auth.json: ${e.message}` };
+  }
+  if (!auth || typeof auth !== "object" || !auth.tokens?.refresh_token) {
+    return { ok: false, error: "codex auth.json has no refresh token \u2014 cloud refresh would fail. Re-run login." };
+  }
+  onStatus?.("Connecting your Codex session to Synkro Cloud\u2026");
+  let resp;
+  try {
+    resp = await fetch(`${gatewayUrl.replace(/\/+$/, "")}/codex/seed`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${bearerToken}` },
+      body: JSON.stringify({ auth })
+    });
+  } catch (e) {
+    return { ok: false, error: `failed to reach Synkro API: ${e.message}` };
+  }
+  if (!resp.ok) {
+    const detail = await resp.text().catch(() => "");
+    return { ok: false, error: `seed rejected (${resp.status}): ${detail.slice(0, 200)}` };
+  }
+  try {
+    rmSync(CODEX_CLOUD_HOME, { recursive: true, force: true });
+  } catch {
+  }
+  onStatus?.("\u2713 Codex subscription connected to Synkro Cloud.");
+  return { ok: true };
+}
+async function setupCodexLocal(onStatus) {
+  const codexBin = findCodexBinary();
+  if (!codexBin) {
+    return { ok: false, error: "Codex CLI not found on PATH. Install Codex, then re-run `synkro install`." };
+  }
+  const authPath = join16(CODEX_LOCAL_HOME, "auth.json");
+  if (!existsSync20(authPath)) {
+    onStatus?.("Opening your browser to authorize an isolated Codex session for the local grader\u2026");
+    try {
+      await runCodexLogin(codexBin, CODEX_LOCAL_HOME);
+    } catch (e) {
+      return { ok: false, error: `Codex login failed: ${e.message}` };
+    }
+  }
+  try {
+    const auth = JSON.parse(readFileSync18(authPath, "utf-8"));
+    if (!auth.tokens?.refresh_token) throw new Error("auth.json has no refresh token");
+  } catch (e) {
+    return { ok: false, error: `Codex local grader auth is invalid: ${e.message}` };
+  }
+  onStatus?.("\u2713 Codex session ready for the local grader.");
+  return { ok: true, home: CODEX_LOCAL_HOME };
+}
+var SYNKRO_DIR9, CODEX_CLOUD_HOME, CODEX_LOCAL_HOME;
+var init_codexCloudSetup = __esm({
+  "cli/local-cc/codexCloudSetup.ts"() {
+    "use strict";
+    SYNKRO_DIR9 = join16(homedir18(), ".synkro");
+    CODEX_CLOUD_HOME = join16(SYNKRO_DIR9, "codex-cloud-session");
+    CODEX_LOCAL_HOME = join16(SYNKRO_DIR9, "codex-local-session");
+  }
+});
+
 // cli/local-cc/ptyShim.ts
 var ptyShim_exports = {};
 __export(ptyShim_exports, {
@@ -6181,26 +6314,26 @@ __export(ptyShim_exports, {
   uninstallPtyShim: () => uninstallPtyShim
 });
 import {
-  existsSync as existsSync20,
-  mkdirSync as mkdirSync13,
-  writeFileSync as writeFileSync14,
+  existsSync as existsSync21,
+  mkdirSync as mkdirSync14,
+  writeFileSync as writeFileSync15,
   chmodSync as chmodSync3,
-  readFileSync as readFileSync18,
-  rmSync,
+  readFileSync as readFileSync19,
+  rmSync as rmSync2,
   realpathSync,
   symlinkSync,
   lstatSync,
   readdirSync as readdirSync3
 } from "fs";
-import { homedir as homedir18 } from "os";
-import { join as join16 } from "path";
-import { spawnSync as spawnSync4, spawn as spawn3 } from "child_process";
+import { homedir as homedir19 } from "os";
+import { join as join17 } from "path";
+import { spawnSync as spawnSync5, spawn as spawn3 } from "child_process";
 function rcFiles() {
-  const h = homedir18();
-  return [join16(h, ".zshrc"), join16(h, ".bashrc"), join16(h, ".bash_profile")];
+  const h = homedir19();
+  return [join17(h, ".zshrc"), join17(h, ".bashrc"), join17(h, ".bash_profile")];
 }
 function resolveRealClaude() {
-  const r = spawnSync4("bash", ["-lc", `PATH="$(printf '%s' "$PATH" | sed "s#$HOME/.synkro/bin:##g")" command -v claude`], { encoding: "utf-8" });
+  const r = spawnSync5("bash", ["-lc", `PATH="$(printf '%s' "$PATH" | sed "s#$HOME/.synkro/bin:##g")" command -v claude`], { encoding: "utf-8" });
   const p = (r.stdout || "").trim();
   if (p) {
     try {
@@ -6209,8 +6342,8 @@ function resolveRealClaude() {
       return p;
     }
   }
-  for (const c of [join16(homedir18(), ".local", "bin", "claude"), "/usr/local/bin/claude", "/opt/homebrew/bin/claude"]) {
-    if (existsSync20(c)) {
+  for (const c of [join17(homedir19(), ".local", "bin", "claude"), "/usr/local/bin/claude", "/opt/homebrew/bin/claude"]) {
+    if (existsSync21(c)) {
       try {
         return realpathSync(c);
       } catch {
@@ -6221,11 +6354,11 @@ function resolveRealClaude() {
   return "claude";
 }
 function findClaudeLink() {
-  const r = spawnSync4("bash", ["-lc", `PATH="$(printf '%s' "$PATH" | sed "s#$HOME/.synkro/bin:##g")" command -v claude`], { encoding: "utf-8" });
+  const r = spawnSync5("bash", ["-lc", `PATH="$(printf '%s' "$PATH" | sed "s#$HOME/.synkro/bin:##g")" command -v claude`], { encoding: "utf-8" });
   let linkPath = (r.stdout || "").trim();
   if (!linkPath) {
-    const c = join16(homedir18(), ".local", "bin", "claude");
-    if (existsSync20(c)) linkPath = c;
+    const c = join17(homedir19(), ".local", "bin", "claude");
+    if (existsSync21(c)) linkPath = c;
     else return null;
   }
   if (linkPath === SHIM_PATH) return null;
@@ -6238,7 +6371,7 @@ function findClaudeLink() {
 }
 function isOurShim(path) {
   try {
-    return readFileSync18(path, "utf-8").slice(0, 300).includes("Synkro pty shim");
+    return readFileSync19(path, "utf-8").slice(0, 300).includes("Synkro pty shim");
   } catch {
     return false;
   }
@@ -6251,7 +6384,7 @@ function shadowClaude() {
   }
   const { linkPath, realTarget } = found;
   if (isOurShim(linkPath)) {
-    console.log(`    \xB7 ${linkPath.replace(homedir18(), "~")} already shadowed`);
+    console.log(`    \xB7 ${linkPath.replace(homedir19(), "~")} already shadowed`);
     return;
   }
   let wasSymlink = false;
@@ -6261,14 +6394,14 @@ function shadowClaude() {
   }
   const state = { linkPath, realTarget, wasSymlink };
   try {
-    writeFileSync14(SHADOW_STATE_FILE, JSON.stringify(state), "utf-8");
+    writeFileSync15(SHADOW_STATE_FILE, JSON.stringify(state), "utf-8");
   } catch {
   }
   try {
-    rmSync(linkPath, { force: true });
-    writeFileSync14(linkPath, SHIM_SOURCE.replace("__BAKED_CLAUDE__", realTarget), "utf-8");
+    rmSync2(linkPath, { force: true });
+    writeFileSync15(linkPath, SHIM_SOURCE.replace("__BAKED_CLAUDE__", realTarget), "utf-8");
     chmodSync3(linkPath, 493);
-    console.log(`    \u2713 shadowed ${linkPath.replace(homedir18(), "~")} \u2192 shim (real: ${realTarget.replace(homedir18(), "~")})`);
+    console.log(`    \u2713 shadowed ${linkPath.replace(homedir19(), "~")} \u2192 shim (real: ${realTarget.replace(homedir19(), "~")})`);
   } catch (e) {
     console.warn(`    \u26A0 could not shadow ${linkPath}: ${e.message}`);
   }
@@ -6276,16 +6409,16 @@ function shadowClaude() {
 function unshadowClaude() {
   let state;
   try {
-    state = JSON.parse(readFileSync18(SHADOW_STATE_FILE, "utf-8"));
+    state = JSON.parse(readFileSync19(SHADOW_STATE_FILE, "utf-8"));
   } catch {
     return;
   }
   if (!state?.linkPath) return;
   try {
-    if (existsSync20(state.linkPath) && !isOurShim(state.linkPath)) return;
-    rmSync(state.linkPath, { force: true });
+    if (existsSync21(state.linkPath) && !isOurShim(state.linkPath)) return;
+    rmSync2(state.linkPath, { force: true });
     symlinkSync(state.realTarget, state.linkPath);
-    console.log(`\u2713 restored ${state.linkPath.replace(homedir18(), "~")} \u2192 ${state.realTarget.replace(homedir18(), "~")}`);
+    console.log(`\u2713 restored ${state.linkPath.replace(homedir19(), "~")} \u2192 ${state.realTarget.replace(homedir19(), "~")}`);
   } catch (e) {
     console.warn(`  \u26A0 could not restore claude: ${e.message} \u2014 run: ln -sf ${state.realTarget} ${state.linkPath}`);
   }
@@ -6293,16 +6426,16 @@ function unshadowClaude() {
 function addPathBlock() {
   const touched = [];
   for (const rc of rcFiles()) {
-    if (!existsSync20(rc) && rc.endsWith(".bash_profile")) continue;
+    if (!existsSync21(rc) && rc.endsWith(".bash_profile")) continue;
     let body = "";
     try {
-      body = readFileSync18(rc, "utf-8");
+      body = readFileSync19(rc, "utf-8");
     } catch {
     }
     const cleaned = stripBlock(body);
     const next = cleaned.replace(/\n*$/, "") + (cleaned ? "\n\n" : "") + RC_BLOCK + "\n";
     try {
-      writeFileSync14(rc, next, "utf-8");
+      writeFileSync15(rc, next, "utf-8");
       touched.push(rc);
     } catch {
     }
@@ -6318,15 +6451,15 @@ function escapeRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function installPtyShim() {
-  mkdirSync13(SHIM_BIN_DIR, { recursive: true });
-  mkdirSync13(PTY_STATE_DIR, { recursive: true });
+  mkdirSync14(SHIM_BIN_DIR, { recursive: true });
+  mkdirSync14(PTY_STATE_DIR, { recursive: true });
   const real = resolveRealClaude();
-  writeFileSync14(SHIM_PATH, SHIM_SOURCE.replace("__BAKED_CLAUDE__", real), "utf-8");
+  writeFileSync15(SHIM_PATH, SHIM_SOURCE.replace("__BAKED_CLAUDE__", real), "utf-8");
   chmodSync3(SHIM_PATH, 493);
   const touched = addPathBlock();
   console.log(`  \u2713 pty routing shim installed (real claude: ${real})`);
   shadowClaude();
-  if (touched.length) console.log(`    added ~/.synkro/bin to PATH in: ${touched.map((t) => t.replace(homedir18(), "~")).join(", ")}`);
+  if (touched.length) console.log(`    added ~/.synkro/bin to PATH in: ${touched.map((t) => t.replace(homedir19(), "~")).join(", ")}`);
 }
 function uninstallPtyShim() {
   try {
@@ -6334,30 +6467,30 @@ function uninstallPtyShim() {
   } catch {
   }
   try {
-    const ls = spawnSync4("tmux", ["ls", "-F", "#{session_name}"], { encoding: "utf-8" });
+    const ls = spawnSync5("tmux", ["ls", "-F", "#{session_name}"], { encoding: "utf-8" });
     for (const s of (ls.stdout || "").split("\n")) {
-      if (s.startsWith(SHIM_SESSION_PREFIX)) spawnSync4("tmux", ["kill-session", "-t", `=${s}`], { encoding: "utf-8" });
+      if (s.startsWith(SHIM_SESSION_PREFIX)) spawnSync5("tmux", ["kill-session", "-t", `=${s}`], { encoding: "utf-8" });
     }
   } catch {
   }
   const cleaned = [];
   for (const rc of rcFiles()) {
-    if (!existsSync20(rc)) continue;
+    if (!existsSync21(rc)) continue;
     try {
-      const body = readFileSync18(rc, "utf-8");
+      const body = readFileSync19(rc, "utf-8");
       if (body.includes(RC_BEGIN)) {
-        writeFileSync14(rc, stripBlock(body).replace(/\n{3,}/g, "\n\n"), "utf-8");
-        cleaned.push(rc.replace(homedir18(), "~"));
+        writeFileSync15(rc, stripBlock(body).replace(/\n{3,}/g, "\n\n"), "utf-8");
+        cleaned.push(rc.replace(homedir19(), "~"));
       }
     } catch {
     }
   }
   try {
-    rmSync(SHIM_BIN_DIR, { recursive: true, force: true });
+    rmSync2(SHIM_BIN_DIR, { recursive: true, force: true });
   } catch {
   }
   try {
-    rmSync(PTY_STATE_DIR, { recursive: true, force: true });
+    rmSync2(PTY_STATE_DIR, { recursive: true, force: true });
   } catch {
   }
   console.log(`\u2713 removed pty routing shim${cleaned.length ? ` (cleaned PATH in: ${cleaned.join(", ")})` : ""}`);
@@ -6379,12 +6512,12 @@ function listSessions(opts = {}) {
   const out = [];
   for (const f of files) {
     try {
-      const r = JSON.parse(readFileSync18(join16(SESSIONS_DIR, f), "utf-8"));
+      const r = JSON.parse(readFileSync19(join17(SESSIONS_DIR, f), "utf-8"));
       if (!r || !r.session_id) continue;
       if (liveOnly) {
         const s = r.tmux_session;
         if (!s || !isOurSession(s)) continue;
-        if (spawnSync4("tmux", ["has-session", "-t", `=${s}`], { encoding: "utf-8" }).status !== 0) continue;
+        if (spawnSync5("tmux", ["has-session", "-t", `=${s}`], { encoding: "utf-8" }).status !== 0) continue;
       }
       out.push(r);
     } catch {
@@ -6398,7 +6531,7 @@ function currentTmuxSession() {
   try {
     const pane = process.env.TMUX_PANE || "";
     const args2 = pane ? ["display-message", "-p", "-t", pane, "#{session_name}"] : ["display-message", "-p", "#{session_name}"];
-    const r = spawnSync4("tmux", args2, { encoding: "utf-8" });
+    const r = spawnSync5("tmux", args2, { encoding: "utf-8" });
     if (r.status === 0) return (r.stdout || "").trim();
   } catch {
   }
@@ -6408,7 +6541,7 @@ function resolveTargetSession(override) {
   const own = currentTmuxSession();
   const fromFile = (() => {
     try {
-      return readFileSync18(ACTIVE_SESSION_FILE, "utf-8").trim();
+      return readFileSync19(ACTIVE_SESSION_FILE, "utf-8").trim();
     } catch {
       return "";
     }
@@ -6429,14 +6562,14 @@ function injectModel(model, sessionOverride) {
     console.error(`synkro route: refusing suspicious session token: ${session}`);
     return false;
   }
-  if (spawnSync4("tmux", ["has-session", "-t", `=${session}`], { encoding: "utf-8" }).status !== 0) return false;
-  const sendKeys = (...a) => spawnSync4("tmux", ["send-keys", "-t", session, ...a], { encoding: "utf-8" });
+  if (spawnSync5("tmux", ["has-session", "-t", `=${session}`], { encoding: "utf-8" }).status !== 0) return false;
+  const sendKeys = (...a) => spawnSync5("tmux", ["send-keys", "-t", session, ...a], { encoding: "utf-8" });
   sendKeys("Escape");
   sendKeys("-l", `/model ${model}`);
   sendKeys("Enter");
-  const pidFile = join16(PTY_STATE_DIR, `poll-${session}.pid`);
+  const pidFile = join17(PTY_STATE_DIR, `poll-${session}.pid`);
   try {
-    mkdirSync13(PTY_STATE_DIR, { recursive: true });
+    mkdirSync14(PTY_STATE_DIR, { recursive: true });
   } catch {
   }
   const poll = `old=$(cat '${pidFile}' 2>/dev/null); if [ -n "$old" ]; then kill "$old" 2>/dev/null; fi; rm -f '${pidFile}'; set -o noclobber; echo $$ > '${pidFile}' 2>/dev/null || exit 1; set +o noclobber; trap 'rm -f "${pidFile}"' EXIT; for i in $(seq 1 40); do if tmux capture-pane -t ${session} -p -S -25 2>/dev/null | grep -qiE 'switch model|yes, switch'; then tmux send-keys -t ${session} -l '1'; sleep 0.1; tmux send-keys -t ${session} Enter; break; fi; sleep 0.1; done`;
@@ -6444,17 +6577,17 @@ function injectModel(model, sessionOverride) {
   child.unref();
   return true;
 }
-var SYNKRO_DIR9, SHIM_BIN_DIR, SHIM_PATH, PTY_STATE_DIR, ACTIVE_SESSION_FILE, SHADOW_STATE_FILE, SESSIONS_DIR, SHIM_SESSION_PREFIX, RC_BEGIN, RC_END, RC_BLOCK, SHIM_SOURCE;
+var SYNKRO_DIR10, SHIM_BIN_DIR, SHIM_PATH, PTY_STATE_DIR, ACTIVE_SESSION_FILE, SHADOW_STATE_FILE, SESSIONS_DIR, SHIM_SESSION_PREFIX, RC_BEGIN, RC_END, RC_BLOCK, SHIM_SOURCE;
 var init_ptyShim = __esm({
   "cli/local-cc/ptyShim.ts"() {
     "use strict";
-    SYNKRO_DIR9 = join16(homedir18(), ".synkro");
-    SHIM_BIN_DIR = join16(SYNKRO_DIR9, "bin");
-    SHIM_PATH = join16(SHIM_BIN_DIR, "claude");
-    PTY_STATE_DIR = join16(SYNKRO_DIR9, "pty");
-    ACTIVE_SESSION_FILE = join16(PTY_STATE_DIR, "active");
-    SHADOW_STATE_FILE = join16(PTY_STATE_DIR, "shadow.json");
-    SESSIONS_DIR = join16(PTY_STATE_DIR, "sessions");
+    SYNKRO_DIR10 = join17(homedir19(), ".synkro");
+    SHIM_BIN_DIR = join17(SYNKRO_DIR10, "bin");
+    SHIM_PATH = join17(SHIM_BIN_DIR, "claude");
+    PTY_STATE_DIR = join17(SYNKRO_DIR10, "pty");
+    ACTIVE_SESSION_FILE = join17(PTY_STATE_DIR, "active");
+    SHADOW_STATE_FILE = join17(PTY_STATE_DIR, "shadow.json");
+    SESSIONS_DIR = join17(PTY_STATE_DIR, "sessions");
     SHIM_SESSION_PREFIX = "synkro-cc-";
     RC_BEGIN = "# >>> synkro pty shim (managed \u2014 do not edit) >>>";
     RC_END = "# <<< synkro pty shim <<<";
@@ -6527,9 +6660,9 @@ __export(install_exports, {
   syncSkillFiles: () => syncSkillFiles,
   writeHookScripts: () => writeHookScripts
 });
-import { existsSync as existsSync21, mkdirSync as mkdirSync14, writeFileSync as writeFileSync15, chmodSync as chmodSync4, readFileSync as readFileSync19, readdirSync as readdirSync4, unlinkSync as unlinkSync7, statSync as statSync2 } from "fs";
-import { homedir as homedir19 } from "os";
-import { join as join17, isAbsolute, resolve as resolve4 } from "path";
+import { existsSync as existsSync22, mkdirSync as mkdirSync15, writeFileSync as writeFileSync16, chmodSync as chmodSync4, readFileSync as readFileSync20, readdirSync as readdirSync4, unlinkSync as unlinkSync7, statSync as statSync2 } from "fs";
+import { homedir as homedir20 } from "os";
+import { join as join18, isAbsolute, resolve as resolve4 } from "path";
 import { execSync as execSync4, spawn as spawn4 } from "child_process";
 import { createInterface as createInterface2 } from "readline";
 import { createHash as createHash2 } from "crypto";
@@ -6625,7 +6758,7 @@ async function promptDeployLocation(current = "local") {
       `Where should Synkro run?
   local \u2014 a grading container on this machine (Docker)
   cloud \u2014 a private container hosted by Synkro
-Both use your own Claude key. Choose [${current}] / ${other}: `,
+Each worker uses the account credentials you authorize. Choose [${current}] / ${other}: `,
       (answer) => {
         rl.close();
         const a = answer.trim().toLowerCase();
@@ -6656,38 +6789,38 @@ async function promptTranscriptSources(wantCC, wantCursor, wantCodex) {
   }
 }
 function ensureSynkroDir() {
-  mkdirSync14(SYNKRO_DIR10, { recursive: true });
-  mkdirSync14(HOOKS_DIR, { recursive: true });
-  mkdirSync14(BIN_DIR, { recursive: true });
-  mkdirSync14(OFFSETS_DIR, { recursive: true });
-  mkdirSync14(join17(SYNKRO_DIR10, "sessions"), { recursive: true });
+  mkdirSync15(SYNKRO_DIR11, { recursive: true });
+  mkdirSync15(HOOKS_DIR, { recursive: true });
+  mkdirSync15(BIN_DIR, { recursive: true });
+  mkdirSync15(OFFSETS_DIR, { recursive: true });
+  mkdirSync15(join18(SYNKRO_DIR11, "sessions"), { recursive: true });
 }
 function writeHookScripts() {
-  const installExtractCorePath = join17(HOOKS_DIR, "installExtractCore.ts");
-  const bashScriptPath = join17(HOOKS_DIR, "cc-bash-judge.ts");
-  const skillJudgeScriptPath = join17(HOOKS_DIR, "cc-skill-judge.ts");
-  const cursorSkillJudgePath = join17(HOOKS_DIR, "cursor-skill-judge.ts");
-  const bashFollowupScriptPath = join17(HOOKS_DIR, "cc-bash-followup.ts");
-  const editPrecheckScriptPath = join17(HOOKS_DIR, "cc-edit-precheck.ts");
-  const cwePrecheckScriptPath = join17(HOOKS_DIR, "cc-cwe-precheck.ts");
-  const cvePrecheckScriptPath = join17(HOOKS_DIR, "cc-cve-precheck.ts");
-  const planJudgeScriptPath = join17(HOOKS_DIR, "cc-plan-judge.ts");
-  const agentJudgeScriptPath = join17(HOOKS_DIR, "cc-agent-judge.ts");
-  const stopSummaryScriptPath = join17(HOOKS_DIR, "cc-stop-summary.ts");
-  const sessionStartScriptPath = join17(HOOKS_DIR, "cc-session-start.ts");
-  const transcriptSyncScriptPath = join17(HOOKS_DIR, "cc-transcript-sync.ts");
-  const userPromptSubmitScriptPath = join17(HOOKS_DIR, "cc-user-prompt-submit.ts");
-  const promptRouteScriptPath = join17(HOOKS_DIR, "cc-prompt-route.ts");
-  const commonScriptPath = join17(HOOKS_DIR, "_synkro-common.ts");
-  const commonBashScriptPath = join17(HOOKS_DIR, "_synkro-common.sh");
-  const installScanScriptPath = join17(HOOKS_DIR, "cc-install-scan.ts");
-  const cursorBashJudgePath = join17(HOOKS_DIR, "cursor-bash-judge.ts");
-  const cursorEditCapturePath = join17(HOOKS_DIR, "cursor-edit-capture.ts");
-  const cursorAgentCapturePath = join17(HOOKS_DIR, "cursor-agent-capture.ts");
-  const mcpStdioProxyPath = join17(HOOKS_DIR, "mcp-stdio-proxy.ts");
-  const taskActivateIntentScriptPath = join17(HOOKS_DIR, "cc-task-activate-intent.ts");
-  const mcpGateScriptPath = join17(HOOKS_DIR, "cc-mcp-gate.ts");
-  const stubCommonPath = join17(HOOKS_DIR, "_synkro-stub-common.ts");
+  const installExtractCorePath = join18(HOOKS_DIR, "installExtractCore.ts");
+  const bashScriptPath = join18(HOOKS_DIR, "cc-bash-judge.ts");
+  const skillJudgeScriptPath = join18(HOOKS_DIR, "cc-skill-judge.ts");
+  const cursorSkillJudgePath = join18(HOOKS_DIR, "cursor-skill-judge.ts");
+  const bashFollowupScriptPath = join18(HOOKS_DIR, "cc-bash-followup.ts");
+  const editPrecheckScriptPath = join18(HOOKS_DIR, "cc-edit-precheck.ts");
+  const cwePrecheckScriptPath = join18(HOOKS_DIR, "cc-cwe-precheck.ts");
+  const cvePrecheckScriptPath = join18(HOOKS_DIR, "cc-cve-precheck.ts");
+  const planJudgeScriptPath = join18(HOOKS_DIR, "cc-plan-judge.ts");
+  const agentJudgeScriptPath = join18(HOOKS_DIR, "cc-agent-judge.ts");
+  const stopSummaryScriptPath = join18(HOOKS_DIR, "cc-stop-summary.ts");
+  const sessionStartScriptPath = join18(HOOKS_DIR, "cc-session-start.ts");
+  const transcriptSyncScriptPath = join18(HOOKS_DIR, "cc-transcript-sync.ts");
+  const userPromptSubmitScriptPath = join18(HOOKS_DIR, "cc-user-prompt-submit.ts");
+  const promptRouteScriptPath = join18(HOOKS_DIR, "cc-prompt-route.ts");
+  const commonScriptPath = join18(HOOKS_DIR, "_synkro-common.ts");
+  const commonBashScriptPath = join18(HOOKS_DIR, "_synkro-common.sh");
+  const installScanScriptPath = join18(HOOKS_DIR, "cc-install-scan.ts");
+  const cursorBashJudgePath = join18(HOOKS_DIR, "cursor-bash-judge.ts");
+  const cursorEditCapturePath = join18(HOOKS_DIR, "cursor-edit-capture.ts");
+  const cursorAgentCapturePath = join18(HOOKS_DIR, "cursor-agent-capture.ts");
+  const mcpStdioProxyPath = join18(HOOKS_DIR, "mcp-stdio-proxy.ts");
+  const taskActivateIntentScriptPath = join18(HOOKS_DIR, "cc-task-activate-intent.ts");
+  const mcpGateScriptPath = join18(HOOKS_DIR, "cc-mcp-gate.ts");
+  const stubCommonPath = join18(HOOKS_DIR, "_synkro-stub-common.ts");
   const stubFiles = [
     [stubCommonPath, STUB_COMMON_TS],
     [bashScriptPath, STUB_BASH_JUDGE_TS],
@@ -6712,14 +6845,14 @@ function writeHookScripts() {
     [cursorAgentCapturePath, STUB_CURSOR_AGENT_CAPTURE_TS]
   ];
   for (const [p, content] of stubFiles) {
-    writeFileSync15(p, content, "utf-8");
+    writeFileSync16(p, content, "utf-8");
     chmodSync4(p, 493);
   }
-  writeFileSync15(mcpStdioProxyPath, MCP_STDIO_PROXY_SRC, "utf-8");
+  writeFileSync16(mcpStdioProxyPath, MCP_STDIO_PROXY_SRC, "utf-8");
   chmodSync4(mcpStdioProxyPath, 493);
   for (const stale of ["_synkro-common.ts", "_synkro-common.sh", "installExtractCore.ts"]) {
     try {
-      unlinkSync7(join17(HOOKS_DIR, stale));
+      unlinkSync7(join18(HOOKS_DIR, stale));
     } catch {
     }
   }
@@ -6755,11 +6888,11 @@ function shellQuoteSingle2(value) {
 }
 function resolveSynkroBundle() {
   const scriptPath = process.argv[1];
-  if (scriptPath && existsSync21(scriptPath)) return scriptPath;
+  if (scriptPath && existsSync22(scriptPath)) return scriptPath;
   return null;
 }
 function writeConfigEnv(opts) {
-  const credsPath = join17(SYNKRO_DIR10, "credentials.json");
+  const credsPath = join18(SYNKRO_DIR11, "credentials.json");
   const safeGateway = sanitizeConfigValue(opts.gatewayUrl);
   const safeUserId = sanitizeConfigValue(opts.userId);
   const safeOrgId = sanitizeConfigValue(opts.orgId);
@@ -6775,7 +6908,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle2(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle2(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle2(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle2("1.7.86")}`
+    `SYNKRO_VERSION=${shellQuoteSingle2("1.7.87")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle2(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle2(safeUserId)}`);
@@ -6795,12 +6928,12 @@ function writeConfigEnv(opts) {
   lines.push(`SYNKRO_DEPLOY_LOCATION=${shellQuoteSingle2(sanitizeConfigValue(opts.deployLocation ?? "local", 16))}`);
   lines.push(`SYNKRO_HOOK_MODE=${shellQuoteSingle2(sanitizeConfigValue(opts.hookMode ?? "stub", 8))}`);
   lines.push("");
-  writeFileSync15(CONFIG_PATH4, lines.join("\n"), "utf-8");
+  writeFileSync16(CONFIG_PATH4, lines.join("\n"), "utf-8");
   chmodSync4(CONFIG_PATH4, 384);
 }
 function persistedTranscriptConsent(source) {
   try {
-    const env = readFileSync19(CONFIG_PATH4, "utf-8");
+    const env = readFileSync20(CONFIG_PATH4, "utf-8");
     const specific = env.match(new RegExp(`^SYNKRO_TRANSCRIPT_CONSENT_${source}='(yes|no)'`, "m"));
     if (specific) return specific[1] === "yes";
     if (source !== "CODEX") {
@@ -6823,7 +6956,7 @@ async function getOrMintCloudToken(gatewayUrl) {
   assertGatewayAllowed(gatewayUrl);
   let stored = "";
   try {
-    stored = readFileSync19(CLOUD_JWT_PATH, "utf-8").trim();
+    stored = readFileSync20(CLOUD_JWT_PATH, "utf-8").trim();
   } catch {
   }
   if (stored && !jwtExpired(stored)) return stored;
@@ -6839,25 +6972,49 @@ async function getOrMintCloudToken(gatewayUrl) {
     throw new Error(`cloud-token mint failed (${resp.status}): ${t.slice(0, 200)}`);
   }
   const { token } = await resp.json();
-  writeFileSync15(CLOUD_JWT_PATH, token + "\n", { mode: 384 });
+  writeFileSync16(CLOUD_JWT_PATH, token + "\n", { mode: 384 });
   return token;
 }
 async function provisionCloudContainer(opts) {
-  let setupToken;
-  try {
-    console.log("  Authorize your Claude key for the hosted Synkro worker \u2014");
-    console.log("  a browser window will open for approval...\n");
-    setupToken = await captureClaudeSetupToken();
-  } catch (err) {
-    console.error(`  \u2717 Could not capture Claude setup-token: ${err.message}`);
-    console.error("    Cloud needs a Claude setup-token. Run `claude setup-token` manually, then re-run install.");
-    process.exit(1);
+  const sf = readFullSynkroFile();
+  const envWorkers = parseInt(process.env.SYNKRO_WORKERS_PER_POOL || "", 10);
+  const totalWorkers = Number.isFinite(envWorkers) && envWorkers > 0 ? envWorkers : 4;
+  let claudeWorkers = 0;
+  let cursorWorkers = 0;
+  let codexWorkers = 0;
+  if (sf && (sf.workers.claude != null || sf.workers.cursor != null || sf.workers.codex != null)) {
+    claudeWorkers = Math.max(0, Math.floor(sf.workers.claude || 0));
+    cursorWorkers = Math.max(0, Math.floor(sf.workers.cursor || 0));
+    codexWorkers = Math.max(0, Math.floor(sf.workers.codex || 0));
+  } else {
+    const providers = [];
+    if (sf?.grader.pool && sf.grader.pool !== "auto") providers.push(sf.grader.pool);
+    else {
+      if (opts.hasClaudeCode) providers.push("claude_code");
+      if (opts.hasCursor) providers.push("cursor");
+      if (opts.hasCodex) providers.push("codex");
+    }
+    ({ claudeWorkers, cursorWorkers, codexWorkers } = splitWorkers(totalWorkers, providers));
+  }
+  if (claudeWorkers + cursorWorkers + codexWorkers === 0) codexWorkers = totalWorkers;
+  const selectedKind = codexWorkers > 0 && claudeWorkers === 0 && cursorWorkers === 0 ? "codex" : cursorWorkers > 0 && claudeWorkers === 0 ? "cursor" : "claude_code";
+  let setupToken = "";
+  if (claudeWorkers > 0) {
+    try {
+      console.log("  Authorize your Claude account for the hosted Claude worker \u2014");
+      console.log("  a browser window will open for approval...\n");
+      setupToken = await captureClaudeSetupToken();
+    } catch (err) {
+      console.error(`  \u2717 Could not capture Claude setup-token: ${err.message}`);
+      console.error("    Run `claude setup-token` manually, then re-run install.");
+      process.exit(1);
+    }
   }
-  console.log("  Validating Claude token...");
+  if (setupToken) console.log("  Validating Claude token...");
   let validated = false;
   let authRejected = null;
   let lastErr = "";
-  for (let attempt = 1; attempt <= 2 && !validated; attempt++) {
+  for (let attempt = 1; setupToken && attempt <= 2 && !validated; attempt++) {
     try {
       const out = execSync4('claude --print --output-format json "say ok"', {
         env: { ...process.env, CLAUDE_CODE_OAUTH_TOKEN: setupToken },
@@ -6883,22 +7040,19 @@ async function provisionCloudContainer(opts) {
   }
   if (validated) {
     console.log("  \u2713 Claude token validated.\n");
-  } else {
+  } else if (setupToken) {
     console.warn(`  \u26A0 Couldn't confirm the token locally in time (${lastErr.slice(0, 50)}).`);
     console.warn("    Proceeding \u2014 the cloud smoke-grade below verifies it end-to-end in the container.\n");
   }
   const repo = detectGitRepo2() || void 0;
-  const sf = readFullSynkroFile();
   const harness = [];
   if (opts.hasClaudeCode) harness.push("claude-code");
   if (opts.hasCursor) harness.push("cursor");
-  const envWorkers = parseInt(process.env.SYNKRO_WORKERS_PER_POOL || "", 10);
-  const total = sf?.workers?.claude && sf.workers.claude > 0 ? sf.workers.claude : Number.isFinite(envWorkers) && envWorkers > 0 ? envWorkers : 4;
-  const cursorTotal = sf?.workers?.cursor && sf.workers.cursor > 0 ? sf.workers.cursor : 0;
+  if (opts.hasCodex) harness.push("codex");
   let cursorApiKey = "";
-  if (cursorTotal > 0) {
+  if (cursorWorkers > 0) {
     try {
-      cursorApiKey = readFileSync19(join17(SYNKRO_DIR10, "cursor-creds", "api-key"), "utf-8").trim();
+      cursorApiKey = readFileSync20(join18(SYNKRO_DIR11, "cursor-creds", "api-key"), "utf-8").trim();
     } catch {
     }
   }
@@ -6908,6 +7062,13 @@ async function provisionCloudContainer(opts) {
   } catch (e) {
     console.warn(`  (cloud token unavailable, using session token: ${e.message})`);
   }
+  if (codexWorkers > 0) {
+    const codex = await setupCodexCloud(opts.gatewayUrl, opts.jwt, (message) => console.log(`  ${message}`));
+    if (!codex.ok) {
+      console.error(`  \u2717 ${codex.error || "Codex cloud authorization failed"}`);
+      process.exit(1);
+    }
+  }
   try {
     const resp = await fetch(`${opts.gatewayUrl}/api/v1/cli/cloud-provision`, {
       method: "POST",
@@ -6917,8 +7078,9 @@ async function provisionCloudContainer(opts) {
         user_id: opts.userId,
         email: opts.email,
         harness,
-        claude_workers: total,
-        cursor_workers: cursorTotal,
+        claude_workers: claudeWorkers,
+        cursor_workers: cursorWorkers,
+        codex_workers: codexWorkers,
         cursor_api_key: cursorApiKey,
         // never logged; gateway stores it as the org secret
         connected_repo: repo,
@@ -6933,11 +7095,25 @@ async function provisionCloudContainer(opts) {
     }
     const out = await resp.json().catch(() => ({}));
     console.log(`  \u2713 cloud container provisioned${out.container_id ? ` (${out.container_id})` : ""}`);
+    const containerBase = (process.env.SYNKRO_CONTAINERS_URL || "https://api.synkro.sh").replace(/\/$/, "");
+    try {
+      const recycle = await fetch(`${containerBase}/recycle`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${opts.jwt}` },
+        signal: AbortSignal.timeout(3e4)
+      });
+      if (recycle.ok) console.log("  \u2713 cloud grader recycled onto the new pool");
+      else console.warn(`  \u26A0 cloud grader recycle returned HTTP ${recycle.status}; warmup will retry the current container`);
+    } catch {
+      console.warn("  \u26A0 cloud grader recycle was unreachable; warmup will retry");
+    }
     console.log();
+    return selectedKind;
   } catch (err) {
     console.error(`  \u2717 Cloud provisioning failed: ${err.message}`);
     console.error("    Hooks + MCP are installed; re-run `synkro install` \u2192 cloud to retry.");
     console.log();
+    throw err;
   } finally {
     setupToken = "";
   }
@@ -6978,17 +7154,21 @@ async function printWorkerDebug(base, jwt2) {
     console.warn("    (could not fetch worker debug)\n");
   }
 }
-async function verifyCloudGrader(jwt2) {
+async function verifyCloudGrader(jwt2, requestedKind) {
   const base = (process.env.SYNKRO_CONTAINERS_URL || "https://api.synkro.sh").replace(/\/$/, "");
   console.log("  Warming the cloud grader (booting container + checking workers)...");
   const deadline = Date.now() + 18e4;
   let healthy = 0;
+  let agentKind = requestedKind || "claude_code";
   while (Date.now() < deadline) {
     try {
       const r = await fetch(`${base}/diag`, { headers: { Authorization: `Bearer ${jwt2}` }, signal: AbortSignal.timeout(6e4) });
       if (r.ok) {
         const j = await r.json();
-        healthy = j.claude_code?.healthy ?? 0;
+        if (!requestedKind) {
+          agentKind = ["codex", "cursor", "claude_code"].find((kind) => (j[kind]?.healthy ?? 0) > 0) || "claude_code";
+        }
+        healthy = j[agentKind]?.healthy ?? 0;
         if (healthy >= 1) break;
       }
     } catch {
@@ -7000,7 +7180,7 @@ async function verifyCloudGrader(jwt2) {
     console.warn("    Grading is NOT verified \u2014 check the container or re-run `synkro install`.\n");
     return false;
   }
-  console.log(`  \u2713 ${healthy} Claude worker(s) healthy`);
+  console.log(`  \u2713 ${healthy} ${poolLabel(agentKind)} worker(s) healthy`);
   console.log("  Running smoke grade (a worker scores a known-risky edit; up to 120s)...");
   const started = Date.now();
   const ticker = setInterval(() => {
@@ -7016,7 +7196,7 @@ async function verifyCloudGrader(jwt2) {
     const r = await fetch(`${base}/grade/submit`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt2}`, "Content-Type": "application/json" },
-      body: JSON.stringify({ role: "grade-edit", payload: probe, content: probe, agent_kind: "claude_code" }),
+      body: JSON.stringify({ role: "grade-edit", payload: probe, content: probe, agent_kind: agentKind }),
       signal: AbortSignal.timeout(12e4)
     });
     stopTicker();
@@ -7055,8 +7235,8 @@ async function verifyCloudGrader(jwt2) {
 }
 function readPersistedDeployLocation() {
   try {
-    if (existsSync21(CONFIG_PATH4)) {
-      const m = readFileSync19(CONFIG_PATH4, "utf-8").match(/^SYNKRO_DEPLOY_LOCATION='([^']*)'/m);
+    if (existsSync22(CONFIG_PATH4)) {
+      const m = readFileSync20(CONFIG_PATH4, "utf-8").match(/^SYNKRO_DEPLOY_LOCATION='([^']*)'/m);
       if (m?.[1] === "cloud") return "cloud";
     }
   } catch {
@@ -7064,8 +7244,8 @@ function readPersistedDeployLocation() {
   return "local";
 }
 function updateConfigEnvLocation(location) {
-  if (!existsSync21(CONFIG_PATH4)) return;
-  let env = readFileSync19(CONFIG_PATH4, "utf-8");
+  if (!existsSync22(CONFIG_PATH4)) return;
+  let env = readFileSync20(CONFIG_PATH4, "utf-8");
   const set = (k, v) => {
     const re = new RegExp(`^${k}=.*$`, "m");
     const line = `${k}='${v}'`;
@@ -7073,14 +7253,14 @@ function updateConfigEnvLocation(location) {
   };
   set("SYNKRO_DEPLOY_LOCATION", location);
   set("SYNKRO_STORAGE_MODE", location === "cloud" ? "cloud" : "local");
-  writeFileSync15(CONFIG_PATH4, env, "utf-8");
+  writeFileSync16(CONFIG_PATH4, env, "utf-8");
   chmodSync4(CONFIG_PATH4, 384);
 }
 async function applyMcpConfig(opts) {
   if (!opts.hasClaudeCode && !opts.hasCursor && !opts.hasCodex) return;
   let mcpJwt2 = "";
   try {
-    mcpJwt2 = readFileSync19(join17(SYNKRO_DIR10, ".mcp-jwt"), "utf-8").trim();
+    mcpJwt2 = readFileSync20(join18(SYNKRO_DIR11, ".mcp-jwt"), "utf-8").trim();
   } catch {
   }
   if (!mcpJwt2) {
@@ -7172,10 +7352,10 @@ Deploy location: ${current || "(none)"} \u2192 ${desired}
       email = info.email;
     } catch {
     }
-    await provisionCloudContainer({ gatewayUrl, jwt: token, orgId, userId, email, hasClaudeCode, hasCursor });
+    const agentKind = await provisionCloudContainer({ gatewayUrl, jwt: token, orgId, userId, email, hasClaudeCode, hasCursor, hasCodex });
     updateConfigEnvLocation("cloud");
     await applyMcpConfig({ gatewayUrl, jwt: token, hasClaudeCode, hasCursor, hasCodex, local: false });
-    await verifyCloudGrader(token);
+    await verifyCloudGrader(token, agentKind);
     console.log("  \u2713 grading + rules/MCP now served from Synkro Cloud\n");
   } else {
     updateConfigEnvLocation("local");
@@ -7210,8 +7390,8 @@ function resolveDeploymentMode() {
   const envOverride = process.env.SYNKRO_DEPLOYMENT_MODE?.toLowerCase();
   if (envOverride === "bare-host" || envOverride === "docker") return envOverride;
   try {
-    if (existsSync21(CONFIG_PATH4)) {
-      const m = readFileSync19(CONFIG_PATH4, "utf-8").match(/^SYNKRO_DEPLOYMENT_MODE='([^']*)'/m);
+    if (existsSync22(CONFIG_PATH4)) {
+      const m = readFileSync20(CONFIG_PATH4, "utf-8").match(/^SYNKRO_DEPLOYMENT_MODE='([^']*)'/m);
       const val = m?.[1]?.toLowerCase();
       if (val === "bare-host" || val === "docker") return val;
     }
@@ -7238,16 +7418,16 @@ function collectLocalMetadata(includeClaudeCode = true) {
     meta.cc_version = execSync4("claude --version", { encoding: "utf-8", timeout: 5e3 }).trim().split("\n")[0];
   } catch {
   }
-  const claudeDir = join17(homedir19(), ".claude");
+  const claudeDir = join18(homedir20(), ".claude");
   try {
-    const settings = JSON.parse(readFileSync19(join17(claudeDir, "settings.json"), "utf-8"));
+    const settings = JSON.parse(readFileSync20(join18(claudeDir, "settings.json"), "utf-8"));
     const plugins = Object.keys(settings.enabledPlugins ?? {}).filter((k) => settings.enabledPlugins[k]);
     if (plugins.length) meta.enabled_plugins = plugins;
     if (settings.permissions?.defaultMode) meta.permissions_mode = settings.permissions.defaultMode;
   } catch {
   }
   try {
-    const mcpCache = JSON.parse(readFileSync19(join17(claudeDir, "mcp-needs-auth-cache.json"), "utf-8"));
+    const mcpCache = JSON.parse(readFileSync20(join18(claudeDir, "mcp-needs-auth-cache.json"), "utf-8"));
     const mcpNames = Object.keys(mcpCache);
     if (mcpNames.length) meta.mcp_servers = mcpNames;
   } catch {
@@ -7259,10 +7439,10 @@ function collectLocalMetadata(includeClaudeCode = true) {
   } catch {
   }
   try {
-    const sessionsDir = join17(claudeDir, "sessions");
+    const sessionsDir = join18(claudeDir, "sessions");
     const files = readdirSync4(sessionsDir).filter((f) => f.endsWith(".json")).slice(-5);
     for (const f of files) {
-      const s = JSON.parse(readFileSync19(join17(sessionsDir, f), "utf-8"));
+      const s = JSON.parse(readFileSync20(join18(sessionsDir, f), "utf-8"));
       if (s.version) {
         meta.cc_version = meta.cc_version || s.version;
         break;
@@ -7464,7 +7644,7 @@ async function installCommand(opts = {}) {
   await setTelemetryState({ enabled: true, remoteFlushEnabled: telemetryConsent });
   emit("install", {
     phase: "started",
-    cli_version_to: "1.7.86",
+    cli_version_to: "1.7.87",
     agents_detected: agents.map((a) => a.kind),
     with_github: false,
     with_local_cc: false,
@@ -7476,9 +7656,9 @@ async function installCommand(opts = {}) {
   const scripts = writeHookScripts();
   console.log("Wrote hook scripts to ~/.synkro/hooks/\n");
   for (const mode of ["edit", "bash"]) {
-    const pidFile = join17(SYNKRO_DIR10, "daemon", mode, "daemon.pid");
+    const pidFile = join18(SYNKRO_DIR11, "daemon", mode, "daemon.pid");
     try {
-      const pid = parseInt(readFileSync19(pidFile, "utf-8").trim(), 10);
+      const pid = parseInt(readFileSync20(pidFile, "utf-8").trim(), 10);
       if (pid > 0) {
         process.kill(pid, "SIGTERM");
         console.log(`Stopped stale ${mode} grader daemon (pid ${pid})`);
@@ -7596,7 +7776,7 @@ async function installCommand(opts = {}) {
         if (mintResp.ok) {
           const minted = await mintResp.json();
           mcpJwt2 = minted.token;
-          writeFileSync15(join17(SYNKRO_DIR10, ".mcp-jwt"), mcpJwt2 + "\n", { mode: 384 });
+          writeFileSync16(join18(SYNKRO_DIR11, ".mcp-jwt"), mcpJwt2 + "\n", { mode: 384 });
         } else {
           console.warn("  \u26A0 Could not mint MCP token \u2014 local server will reject requests until re-installed.");
         }
@@ -7624,7 +7804,7 @@ async function installCommand(opts = {}) {
           throw new Error(`mcp-token mint failed (${mintResp.status}): ${errText.slice(0, 200)}`);
         }
         const minted = await mintResp.json();
-        writeFileSync15(join17(SYNKRO_DIR10, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
+        writeFileSync16(join18(SYNKRO_DIR11, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
         const mcp = installMcpConfig({ gatewayUrl, bearerToken: minted.token });
         console.log(`Registered Synkro guardrails MCP server in ${mcp.path}`);
         console.log(`  url:        ${mcp.url}`);
@@ -7646,8 +7826,8 @@ async function installCommand(opts = {}) {
   if (hasCursor && !opts.noMcp) {
     try {
       if (useLocalMcp) {
-        const jwtPath = join17(SYNKRO_DIR10, ".mcp-jwt");
-        if (!existsSync21(jwtPath)) {
+        const jwtPath = join18(SYNKRO_DIR11, ".mcp-jwt");
+        if (!existsSync22(jwtPath)) {
           const mintResp = await fetch(`${gatewayUrl}/api/v1/cli/mcp-token`, {
             method: "POST",
             headers: { "Authorization": `Bearer ${token}`, "Content-Type": "application/json" },
@@ -7655,7 +7835,7 @@ async function installCommand(opts = {}) {
           });
           if (mintResp.ok) {
             const minted = await mintResp.json();
-            writeFileSync15(jwtPath, minted.token + "\n", { mode: 384 });
+            writeFileSync16(jwtPath, minted.token + "\n", { mode: 384 });
           }
         }
         const mcp = installCursorMcpConfig({ gatewayUrl, bearerToken: "", local: true });
@@ -7675,7 +7855,7 @@ async function installCommand(opts = {}) {
           throw new Error(`mcp-token mint failed (${mintResp.status}): ${errText.slice(0, 200)}`);
         }
         const minted = await mintResp.json();
-        writeFileSync15(join17(SYNKRO_DIR10, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
+        writeFileSync16(join18(SYNKRO_DIR11, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
         const mcp = installCursorMcpConfig({ gatewayUrl, bearerToken: minted.token });
         console.log(`Registered Synkro guardrails MCP server in ${mcp.path}`);
         console.log(`  url:        ${mcp.url}`);
@@ -7688,10 +7868,10 @@ async function installCommand(opts = {}) {
   }
   if (hasCodex && !opts.noMcp) {
     try {
-      const jwtPath = join17(SYNKRO_DIR10, ".mcp-jwt");
+      const jwtPath = join18(SYNKRO_DIR11, ".mcp-jwt");
       let mcpJwt2 = "";
       try {
-        mcpJwt2 = readFileSync19(jwtPath, "utf-8").trim();
+        mcpJwt2 = readFileSync20(jwtPath, "utf-8").trim();
       } catch {
       }
       if (!mcpJwt2) {
@@ -7709,7 +7889,7 @@ async function installCommand(opts = {}) {
         }
         const minted = await mintResp.json();
         mcpJwt2 = minted.token;
-        writeFileSync15(jwtPath, mcpJwt2 + "\n", { mode: 384 });
+        writeFileSync16(jwtPath, mcpJwt2 + "\n", { mode: 384 });
       }
       const mcp = installCodexMcpConfig({
         gatewayUrl,
@@ -7756,7 +7936,7 @@ async function installCommand(opts = {}) {
     }
     const pool = sfp?.grader?.pool || "auto";
     if (pool === "cursor") return true;
-    if (pool === "claude_code") return false;
+    if (pool === "claude_code" || pool === "codex") return false;
     return hasCursor;
   })();
   if (useLocalMcp) {
@@ -7776,14 +7956,17 @@ async function installCommand(opts = {}) {
     for (const w of sf?.warnings || []) console.warn(`  \u26A0 ${w}`);
     let claudeWorkers;
     let cursorWorkers;
-    if (sf && (sf.workers.claude != null || sf.workers.cursor != null)) {
+    let codexWorkers;
+    if (sf && (sf.workers.claude != null || sf.workers.cursor != null || sf.workers.codex != null)) {
       claudeWorkers = Math.max(0, Math.floor(sf.workers.claude || 0));
       cursorWorkers = Math.max(0, Math.floor(sf.workers.cursor || 0));
-      if (claudeWorkers + cursorWorkers === 0) {
+      codexWorkers = Math.max(0, Math.floor(sf.workers.codex || 0));
+      if (claudeWorkers + cursorWorkers + codexWorkers === 0) {
         claudeWorkers = 0;
-        cursorWorkers = 8;
+        cursorWorkers = 0;
+        codexWorkers = 8;
       }
-      console.log(`  synkro.toml: explicit workers \u2014 ${claudeWorkers} claude + ${cursorWorkers} cursor`);
+      console.log(`  synkro.toml: explicit workers \u2014 ${claudeWorkers} claude + ${cursorWorkers} cursor + ${codexWorkers} codex`);
     } else {
       const totalWorkers = parseInt(process.env.SYNKRO_WORKERS_PER_POOL || "8", 10);
       const synkroFilePool = sf?.grader?.pool || "auto";
@@ -7792,23 +7975,35 @@ async function installCommand(opts = {}) {
         providers = ["cursor"];
       } else if (synkroFilePool === "claude_code") {
         providers = ["claude_code"];
+      } else if (synkroFilePool === "codex") {
+        providers = ["codex"];
       } else {
         if (hasClaudeCode) providers.push("claude_code");
         if (hasCursor) providers.push("cursor");
+        if (hasCodex) providers.push("codex");
       }
-      ({ claudeWorkers, cursorWorkers } = splitWorkers(totalWorkers, providers));
+      ({ claudeWorkers, cursorWorkers, codexWorkers } = splitWorkers(totalWorkers, providers));
       if (synkroFilePool !== "auto") console.log(`  synkro.toml: grader pool set to ${poolLabel(synkroFilePool)}`);
     }
-    console.log(`  worker pool: ${claudeWorkers} claude + ${cursorWorkers} cursor`);
+    let codexHomeDir;
+    if (codexWorkers > 0) {
+      const codexSetup = await setupCodexLocal((message) => console.log(`  ${message}`));
+      if (!codexSetup.ok || !codexSetup.home) {
+        console.error(`  \u2717 ${codexSetup.error || "Codex grader authorization failed"}`);
+        process.exit(1);
+      }
+      codexHomeDir = codexSetup.home;
+    }
+    console.log(`  worker pool: ${claudeWorkers} claude + ${cursorWorkers} cursor + ${codexWorkers} codex`);
     const connectedRepo = detectGitRepo2() || void 0;
-    const { image, hostMcpPort, hostGraderPort, hostCwePort, hostPglitePort } = await dockerInstall({ claudeWorkers, cursorWorkers, connectedRepo });
+    const { image, hostMcpPort, hostGraderPort, hostCwePort, hostPglitePort } = await dockerInstall({ claudeWorkers, cursorWorkers, codexWorkers, codexHomeDir, connectedRepo });
     console.log(`  \u2713 pulled ${image}`);
     console.log(`  container started \u2014 MCP=${hostMcpPort} general=${hostGraderPort} CWE=${hostCwePort} pglite=${hostPglitePort}`);
     console.log("  waiting for container to be ready...");
     const ready = await waitForContainerReady(6e4);
     if (ready) {
       console.log("  \u2713 container ready");
-      const mcpJwt2 = readFileSync19(join17(SYNKRO_DIR10, ".mcp-jwt"), "utf-8").trim();
+      const mcpJwt2 = readFileSync20(join18(SYNKRO_DIR11, ".mcp-jwt"), "utf-8").trim();
       try {
         const ingestResp = await fetch(`http://127.0.0.1:${hostMcpPort}/api/ingest`, {
           method: "POST",
@@ -7841,8 +8036,8 @@ async function installCommand(opts = {}) {
     console.log();
   } else if (target === "cloud-container") {
     if (graderUsesCursor) await promptCursorApiKey(opts);
-    await provisionCloudContainer({ gatewayUrl, jwt: token, orgId, userId, email, hasClaudeCode, hasCursor });
-    cloudGradeOk = await verifyCloudGrader(token);
+    const agentKind = await provisionCloudContainer({ gatewayUrl, jwt: token, orgId, userId, email, hasClaudeCode, hasCursor, hasCodex });
+    cloudGradeOk = await verifyCloudGrader(token, agentKind);
   }
   if (transcriptConsent) {
     const repo = detectGitRepo2();
@@ -7851,7 +8046,7 @@ async function installCommand(opts = {}) {
         try {
           let mcpToken = "";
           try {
-            mcpToken = readFileSync19(join17(SYNKRO_DIR10, ".mcp-jwt"), "utf-8").trim();
+            mcpToken = readFileSync20(join18(SYNKRO_DIR11, ".mcp-jwt"), "utf-8").trim();
           } catch {
           }
           if (mcpToken) {
@@ -8019,8 +8214,8 @@ function writeSynkroFileIfMissing(opts) {
   try {
     const root = execSync4("git rev-parse --show-toplevel", { encoding: "utf-8", timeout: 3e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
     if (!root) return;
-    if (root === homedir19()) return;
-    const fp = join17(root, "synkro.toml");
+    if (root === homedir20()) return;
+    const fp = join18(root, "synkro.toml");
     let hasFile = false;
     try {
       hasFile = statSync2(fp).isFile();
@@ -8032,15 +8227,10 @@ function writeSynkroFileIfMissing(opts) {
     }
     let pool = "auto";
     const harness = [];
-    if (opts.hasClaudeCode) {
-      harness.push("claude-code");
-      if (!opts.hasCursor) pool = "claude";
-    }
-    if (opts.hasCursor) {
-      harness.push("cursor");
-      if (!opts.hasClaudeCode) pool = "cursor";
-    }
+    if (opts.hasClaudeCode) harness.push("claude-code");
+    if (opts.hasCursor) harness.push("cursor");
     if (opts.hasCodex) harness.push("codex");
+    if (harness.length === 1) pool = harness[0] === "claude-code" ? "claude-code" : harness[0];
     const mode = opts.gradingMode === "byok" ? "byok" : "local";
     const toml = [
       "version = 1",
@@ -8057,7 +8247,7 @@ function writeSynkroFileIfMissing(opts) {
       "cve = true",
       ""
     ].join("\n");
-    writeFileSync15(fp, toml, "utf-8");
+    writeFileSync16(fp, toml, "utf-8");
     console.log(`  synkro.toml: wrote ${fp} (pool=${pool}, mode=${mode})`);
   } catch {
   }
@@ -8065,12 +8255,12 @@ function writeSynkroFileIfMissing(opts) {
 function updateSynkroTomlLocation(location) {
   try {
     const root = execSync4("git rev-parse --show-toplevel", { encoding: "utf-8", timeout: 3e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
-    if (!root || root === homedir19()) return;
-    const fp = join17(root, "synkro.toml");
+    if (!root || root === homedir20()) return;
+    const fp = join18(root, "synkro.toml");
     let txt = "";
     try {
       if (!statSync2(fp).isFile()) return;
-      txt = readFileSync19(fp, "utf-8");
+      txt = readFileSync20(fp, "utf-8");
     } catch {
       return;
     }
@@ -8078,7 +8268,7 @@ function updateSynkroTomlLocation(location) {
     if (!re.test(txt)) return;
     const next = txt.replace(re, `$1"${location}"`);
     if (next !== txt) {
-      writeFileSync15(fp, next, "utf-8");
+      writeFileSync16(fp, next, "utf-8");
       console.log(`  synkro.toml: [grader] location = "${location}"`);
     }
   } catch {
@@ -8088,9 +8278,9 @@ function readFullSynkroFile() {
   try {
     const root = execSync4("git rev-parse --show-toplevel", { encoding: "utf-8", timeout: 3e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
     if (!root) return null;
-    const fp = join17(root, "synkro.toml");
-    if (!existsSync21(fp)) return null;
-    const parsed = parseSynkroToml2(readFileSync19(fp, "utf-8"));
+    const fp = join18(root, "synkro.toml");
+    if (!existsSync22(fp)) return null;
+    const parsed = parseSynkroToml2(readFileSync20(fp, "utf-8"));
     const valid = ["claude-code", "cursor", "codex"];
     const harness = Array.isArray(parsed.harness) ? parsed.harness.filter((h) => valid.includes(h)) : ["claude-code", "cursor"];
     const resolved = resolveGraderPool(parsed);
@@ -8103,7 +8293,8 @@ function readFullSynkroFile() {
       },
       workers: {
         ...resolved.claudeWorkers != null ? { claude: resolved.claudeWorkers } : {},
-        ...resolved.cursorWorkers != null ? { cursor: resolved.cursorWorkers } : {}
+        ...resolved.cursorWorkers != null ? { cursor: resolved.cursorWorkers } : {},
+        ...resolved.codexWorkers != null ? { codex: resolved.codexWorkers } : {}
       },
       warnings: resolved.warnings,
       ruleset: parsed.ruleset || "default",
@@ -8129,7 +8320,7 @@ function reconcileHarness() {
   console.log(`synkro.toml: harness=[${sf.harness.join(", ")}] pool=${poolLabel(sf.grader.pool)} mode=${sf.grader.mode}`);
   const scripts = writeHookScripts();
   console.log("Wrote hook scripts to ~/.synkro/hooks/");
-  const ccSettings = join17(homedir19(), ".claude", "settings.json");
+  const ccSettings = join18(homedir20(), ".claude", "settings.json");
   if (wantCC) {
     installCCHooks(ccSettings, {
       bashJudgeScriptPath: scripts.bashScript,
@@ -8152,7 +8343,7 @@ function reconcileHarness() {
     });
     console.log("  \u2713 Claude Code hooks registered");
     try {
-      const mcpJwt2 = readFileSync19(join17(SYNKRO_DIR10, ".mcp-jwt"), "utf-8").trim();
+      const mcpJwt2 = readFileSync20(join18(SYNKRO_DIR11, ".mcp-jwt"), "utf-8").trim();
       if (mcpJwt2) {
         installMcpConfig({ gatewayUrl: "", bearerToken: mcpJwt2, local: true });
         console.log("  \u2713 Claude Code MCP registered");
@@ -8164,7 +8355,7 @@ function reconcileHarness() {
     if (uninstallMcpConfig()) console.log("  \u2717 Claude Code MCP removed");
     if (uninstallClaudeDesktopMcpConfig()) console.log("  \u2717 Claude Desktop MCP removed");
   }
-  const cursorHooks = join17(homedir19(), ".cursor", "hooks.json");
+  const cursorHooks = join18(homedir20(), ".cursor", "hooks.json");
   if (wantCursor) {
     installCursorHooks(cursorHooks, {
       bashJudgeScriptPath: scripts.cursorBashJudgeScript,
@@ -8195,7 +8386,7 @@ function reconcileHarness() {
     if (uninstallCursorHooks(cursorHooks)) console.log("  \u2717 Cursor hooks removed");
     if (uninstallCursorMcpConfig()) console.log("  \u2717 Cursor MCP removed");
   }
-  const codexHooks = join17(process.env.CODEX_HOME || join17(homedir19(), ".codex"), "hooks.json");
+  const codexHooks = join18(process.env.CODEX_HOME || join18(homedir20(), ".codex"), "hooks.json");
   if (wantCodex) {
     installCodexHooks(codexHooks, {
       bashJudgeScriptPath: scripts.bashScript,
@@ -8226,10 +8417,11 @@ function reconcileHarness() {
     if (uninstallCodexHooks(codexHooks)) console.log("  \u2717 Codex hooks removed");
     if (uninstallCodexMcpConfig()) console.log("  \u2717 Codex MCP removed");
   }
-  if (sf.workers.claude != null || sf.workers.cursor != null) {
+  if (sf.workers.claude != null || sf.workers.cursor != null || sf.workers.codex != null) {
     const cw = Math.max(0, Math.floor(sf.workers.claude || 0));
     const curw = Math.max(0, Math.floor(sf.workers.cursor || 0));
-    if (cw + curw > 0) return { claudeWorkers: cw, cursorWorkers: curw };
+    const codw = Math.max(0, Math.floor(sf.workers.codex || 0));
+    if (cw + curw + codw > 0) return { claudeWorkers: cw, cursorWorkers: curw, codexWorkers: codw };
   }
   const total = parseInt(process.env.SYNKRO_WORKERS_PER_POOL || "8", 10);
   const providers = [];
@@ -8237,9 +8429,12 @@ function reconcileHarness() {
     providers.push("cursor");
   } else if (sf.grader.pool === "claude_code") {
     providers.push("claude_code");
+  } else if (sf.grader.pool === "codex") {
+    providers.push("codex");
   } else {
     if (wantCC) providers.push("claude_code");
     if (wantCursor) providers.push("cursor");
+    if (wantCodex) providers.push("codex");
   }
   if (providers.length === 0) providers.push("claude_code");
   return splitWorkers(total, providers);
@@ -8279,7 +8474,7 @@ async function syncSkillFiles() {
   if (resolved.length === 0) return;
   const mcpPort = process.env.SYNKRO_MCP_PORT || "18931";
   const tasks = resolved.map((fp) => {
-    const content = readFileSync19(fp, "utf-8");
+    const content = readFileSync20(fp, "utf-8");
     const source = `skill:${fp.split("/").pop()}`;
     if (!content.trim()) {
       console.log(`  \u2298 skill ${source}: empty file, skipped`);
@@ -8300,15 +8495,15 @@ function discoverSkillFiles(repoRoot2, excludeHashes, ingestedHashes, ingestedNa
   const roots = [];
   const add = (p) => {
     try {
-      if (p && existsSync21(p) && statSync2(p).isDirectory()) roots.push(p);
+      if (p && existsSync22(p) && statSync2(p).isDirectory()) roots.push(p);
     } catch {
     }
   };
-  add(join17(homedir19(), ".claude", "skills"));
-  add(join17(homedir19(), ".agents", "skills"));
+  add(join18(homedir20(), ".claude", "skills"));
+  add(join18(homedir20(), ".agents", "skills"));
   if (repoRoot2) {
-    add(join17(repoRoot2, ".claude", "skills"));
-    add(join17(repoRoot2, ".agents", "skills"));
+    add(join18(repoRoot2, ".claude", "skills"));
+    add(join18(repoRoot2, ".agents", "skills"));
   }
   const out = [];
   const seen = /* @__PURE__ */ new Set();
@@ -8319,7 +8514,7 @@ function discoverSkillFiles(repoRoot2, excludeHashes, ingestedHashes, ingestedNa
     try {
       const st = statSync2(file);
       if (!st.isFile() || st.size > 2e5) return;
-      content = readFileSync19(file, "utf-8");
+      content = readFileSync20(file, "utf-8");
     } catch {
       return;
     }
@@ -8339,7 +8534,7 @@ function discoverSkillFiles(repoRoot2, excludeHashes, ingestedHashes, ingestedNa
     }
     for (const entry of entries) {
       if (entry.startsWith(".")) continue;
-      const full = join17(root, entry);
+      const full = join18(root, entry);
       let st;
       try {
         st = statSync2(full);
@@ -8347,8 +8542,8 @@ function discoverSkillFiles(repoRoot2, excludeHashes, ingestedHashes, ingestedNa
         continue;
       }
       if (st.isDirectory()) {
-        const skillMd = join17(full, "SKILL.md");
-        if (existsSync21(skillMd)) consider(skillMd, entry);
+        const skillMd = join18(full, "SKILL.md");
+        if (existsSync22(skillMd)) consider(skillMd, entry);
       } else if (/\.mdx?$/i.test(entry) && entry.toUpperCase() !== "README.MD") {
         consider(full, entry.replace(/\.mdx?$/i, ""));
       }
@@ -8397,7 +8592,7 @@ async function discoverAndIngestSkills() {
     if (sf?.skills?.length) {
       for (const fp of resolveSkillPaths(sf.skills, sf._repoRoot)) {
         try {
-          excludeHashes.add(createHash2("sha256").update(readFileSync19(fp, "utf-8")).digest("hex"));
+          excludeHashes.add(createHash2("sha256").update(readFileSync20(fp, "utf-8")).digest("hex"));
         } catch {
         }
       }
@@ -8428,13 +8623,13 @@ async function discoverAndIngestSkills() {
     const setHash = discoverySetHash(selectable);
     let prev = "";
     try {
-      prev = readFileSync19(SKILLS_DISCOVERED_PATH, "utf-8").trim();
+      prev = readFileSync20(SKILLS_DISCOVERED_PATH, "utf-8").trim();
     } catch {
     }
     if (prev === setHash) return;
     const picks = await promptSkillDiscovery(found);
     try {
-      writeFileSync15(SKILLS_DISCOVERED_PATH, setHash);
+      writeFileSync16(SKILLS_DISCOVERED_PATH, setHash);
     } catch {
     }
     if (picks.length === 0) {
@@ -8473,9 +8668,9 @@ function ensureReachabilityGitHook() {
     const root = run("git rev-parse --show-toplevel");
     if (!root) return null;
     let hooksDir = run("git config --get core.hooksPath");
-    hooksDir = hooksDir ? isAbsolute(hooksDir) ? hooksDir : join17(root, hooksDir) : join17(root, ".git", "hooks");
-    if (!existsSync21(hooksDir)) mkdirSync14(hooksDir, { recursive: true });
-    const hookPath = join17(hooksDir, "post-commit");
+    hooksDir = hooksDir ? isAbsolute(hooksDir) ? hooksDir : join18(root, hooksDir) : join18(root, ".git", "hooks");
+    if (!existsSync22(hooksDir)) mkdirSync15(hooksDir, { recursive: true });
+    const hookPath = join18(hooksDir, "post-commit");
     const resolvedBin = resolveSynkroBinPath();
     const invoke = resolvedBin ? `"${resolvedBin}" reachability-scan --quiet` : "true";
     const START = "# >>> synkro reachability (managed) >>>";
@@ -8488,14 +8683,14 @@ function ensureReachabilityGitHook() {
       END
     ].join("\n");
     const esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    if (!existsSync21(hookPath)) {
-      writeFileSync15(hookPath, "#!/bin/sh\n" + block + "\n", { mode: 493 });
+    if (!existsSync22(hookPath)) {
+      writeFileSync16(hookPath, "#!/bin/sh\n" + block + "\n", { mode: 493 });
       return "installed";
     }
-    let cur = readFileSync19(hookPath, "utf-8");
+    let cur = readFileSync20(hookPath, "utf-8");
     if (cur.includes(START)) {
       cur = cur.replace(new RegExp(esc(START) + "[\\s\\S]*?" + esc(END), "m"), block);
-      writeFileSync15(hookPath, cur);
+      writeFileSync16(hookPath, cur);
       try {
         chmodSync4(hookPath, 493);
       } catch {
@@ -8503,7 +8698,7 @@ function ensureReachabilityGitHook() {
       return "updated";
     }
     const sep = cur.endsWith("\n") ? "" : "\n";
-    writeFileSync15(hookPath, cur + sep + "\n" + block + "\n");
+    writeFileSync16(hookPath, cur + sep + "\n" + block + "\n");
     try {
       chmodSync4(hookPath, 493);
     } catch {
@@ -8531,17 +8726,17 @@ function detectGitRepo2() {
 function getClaudeProjectsFolder() {
   const cwd = process.cwd();
   const sanitized = "-" + cwd.replace(/\//g, "-");
-  const projectsDir = join17(homedir19(), ".claude", "projects", sanitized);
-  return existsSync21(projectsDir) ? projectsDir : null;
+  const projectsDir = join18(homedir20(), ".claude", "projects", sanitized);
+  return existsSync22(projectsDir) ? projectsDir : null;
 }
 function extractSessionInsights(projectsDir) {
   const insights = [];
   const files = readdirSync4(projectsDir).filter((f) => f.endsWith(".jsonl"));
   for (const file of files) {
     const sessionId = file.replace(".jsonl", "");
-    const filePath = join17(projectsDir, file);
+    const filePath = join18(projectsDir, file);
     try {
-      const content = readFileSync19(filePath, "utf-8");
+      const content = readFileSync20(filePath, "utf-8");
       const lines = content.split("\n").filter(Boolean);
       for (let i = 0; i < lines.length; i++) {
         try {
@@ -8617,17 +8812,17 @@ function extractTextContent(content) {
   return "";
 }
 function getCodexTranscriptFiles(repo) {
-  const sessionsDir = join17(process.env.CODEX_HOME || join17(homedir19(), ".codex"), "sessions");
-  if (!existsSync21(sessionsDir)) return [];
+  const sessionsDir = join18(process.env.CODEX_HOME || join18(homedir20(), ".codex"), "sessions");
+  if (!existsSync22(sessionsDir)) return [];
   let relative = [];
   try {
     relative = readdirSync4(sessionsDir, { recursive: true, encoding: "utf-8" });
   } catch {
     return [];
   }
-  return relative.filter((p) => p.endsWith(".jsonl")).map((p) => join17(sessionsDir, p)).filter((filePath) => {
+  return relative.filter((p) => p.endsWith(".jsonl")).map((p) => join18(sessionsDir, p)).filter((filePath) => {
     try {
-      const first = readFileSync19(filePath, "utf-8").split("\n", 1)[0];
+      const first = readFileSync20(filePath, "utf-8").split("\n", 1)[0];
       const meta = JSON.parse(first);
       const cwd = typeof meta?.payload?.cwd === "string" ? resolve4(meta.payload.cwd) : "";
       const root = resolve4(repo);
@@ -8638,7 +8833,7 @@ function getCodexTranscriptFiles(repo) {
   });
 }
 function parseCodexTranscriptFile(filePath) {
-  const lines = readFileSync19(filePath, "utf-8").split("\n").filter(Boolean);
+  const lines = readFileSync20(filePath, "utf-8").split("\n").filter(Boolean);
   let sessionId = "";
   let model = "";
   const messages = [];
@@ -8693,7 +8888,7 @@ async function syncCodexTranscriptsLocal(mcpPort, mcpToken, repo) {
         totalSessions++;
         totalMessages += result.ingested ?? messages.length;
       }
-      writeFileSync15(join17(OFFSETS_DIR, parsed.sessionId), String(readFileSync19(files[i], "utf-8").split("\n").filter(Boolean).length), "utf-8");
+      writeFileSync16(join18(OFFSETS_DIR, parsed.sessionId), String(readFileSync20(files[i], "utf-8").split("\n").filter(Boolean).length), "utf-8");
     } catch {
     }
     if ((i + 1) % 10 === 0 || i === files.length - 1) {
@@ -8707,14 +8902,14 @@ function cursorProjectSlug(workspaceRoot) {
   return workspaceRoot.replace(/^[/]+/, "").replace(/[^a-zA-Z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function getCursorTranscriptsDir() {
-  const dir = join17(homedir19(), ".cursor", "projects", cursorProjectSlug(process.cwd()), "agent-transcripts");
-  return existsSync21(dir) ? dir : null;
+  const dir = join18(homedir20(), ".cursor", "projects", cursorProjectSlug(process.cwd()), "agent-transcripts");
+  return existsSync22(dir) ? dir : null;
 }
 function isSafeConvId(id) {
   return /^[A-Za-z0-9_-]+$/.test(id);
 }
 function parseCursorTranscriptFile(filePath) {
-  const content = readFileSync19(filePath, "utf-8");
+  const content = readFileSync20(filePath, "utf-8");
   const lines = content.split("\n").filter(Boolean);
   const messages = [];
   for (let i = 0; i < lines.length; i++) {
@@ -8746,8 +8941,8 @@ async function syncCursorTranscriptsLocal(mcpPort, mcpToken, repo) {
   for (let i = 0; i < convDirs.length; i++) {
     const convId = convDirs[i];
     if (!isSafeConvId(convId)) continue;
-    const filePath = join17(dir, convId, `${convId}.jsonl`);
-    if (!existsSync21(filePath)) continue;
+    const filePath = join18(dir, convId, `${convId}.jsonl`);
+    if (!existsSync22(filePath)) continue;
     try {
       const all = parseCursorTranscriptFile(filePath);
       const messages = all.length > 500 ? all.slice(-500) : all;
@@ -8769,8 +8964,8 @@ async function syncCursorTranscriptsLocal(mcpPort, mcpToken, repo) {
       process.stdout.write(`\r  Progress: ${i + 1}/${convDirs.length} sessions (${totalMessages} messages embedded)   `);
     }
     try {
-      const lc = readFileSync19(filePath, "utf-8").split("\n").filter(Boolean).length;
-      writeFileSync15(join17(OFFSETS_DIR, convId), String(lc), "utf-8");
+      const lc = readFileSync20(filePath, "utf-8").split("\n").filter(Boolean).length;
+      writeFileSync16(join18(OFFSETS_DIR, convId), String(lc), "utf-8");
     } catch {
     }
   }
@@ -8778,7 +8973,7 @@ async function syncCursorTranscriptsLocal(mcpPort, mcpToken, repo) {
   return { sessions: totalSessions, messages: totalMessages };
 }
 function parseTranscriptFile(filePath) {
-  const content = readFileSync19(filePath, "utf-8");
+  const content = readFileSync20(filePath, "utf-8");
   const lines = content.split("\n").filter(Boolean);
   const messages = [];
   for (let i = 0; i < lines.length; i++) {
@@ -8826,7 +9021,7 @@ async function syncTranscriptsLocal(mcpPort, mcpToken, repo) {
   for (let i = 0; i < files.length; i++) {
     const file = files[i];
     const sessionId = file.replace(".jsonl", "");
-    const filePath = join17(projectsDir, file);
+    const filePath = join18(projectsDir, file);
     try {
       const allMessages = parseTranscriptFile(filePath);
       const messages = allMessages.length > 500 ? allMessages.slice(-500) : allMessages;
@@ -8848,9 +9043,9 @@ async function syncTranscriptsLocal(mcpPort, mcpToken, repo) {
       process.stdout.write(`\r  Progress: ${i + 1}/${files.length} sessions (${totalMessages} messages embedded)   `);
     }
     try {
-      const content = readFileSync19(join17(projectsDir, file), "utf-8");
+      const content = readFileSync20(join18(projectsDir, file), "utf-8");
       const lineCount = content.split("\n").filter(Boolean).length;
-      writeFileSync15(join17(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
+      writeFileSync16(join18(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
     } catch {
     }
   }
@@ -8871,7 +9066,7 @@ async function syncTranscriptsBulk(gatewayUrl, token, repo) {
     const sessions = [];
     for (const file of batch) {
       const sessionId = file.replace(".jsonl", "");
-      const filePath = join17(projectsDir, file);
+      const filePath = join18(projectsDir, file);
       try {
         const allMessages = parseTranscriptFile(filePath);
         const messages = allMessages.length > maxMessagesPerSession ? allMessages.slice(-maxMessagesPerSession) : allMessages;
@@ -8900,11 +9095,11 @@ async function syncTranscriptsBulk(gatewayUrl, token, repo) {
     }
     for (const file of batch) {
       const sessionId = file.replace(".jsonl", "");
-      const filePath = join17(projectsDir, file);
+      const filePath = join18(projectsDir, file);
       try {
-        const content = readFileSync19(filePath, "utf-8");
+        const content = readFileSync20(filePath, "utf-8");
         const lineCount = content.split("\n").filter(Boolean).length;
-        writeFileSync15(join17(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
+        writeFileSync16(join18(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
       } catch {
       }
     }
@@ -8944,7 +9139,7 @@ async function syncCodexTranscriptsBulk(gatewayUrl, token, repo) {
       try {
         const parsed = parseCodexTranscriptFile(filePath);
         if (parsed.sessionId) {
-          writeFileSync15(join17(OFFSETS_DIR, parsed.sessionId), String(readFileSync19(filePath, "utf-8").split("\n").filter(Boolean).length), "utf-8");
+          writeFileSync16(join18(OFFSETS_DIR, parsed.sessionId), String(readFileSync20(filePath, "utf-8").split("\n").filter(Boolean).length), "utf-8");
         }
       } catch {
       }
@@ -8952,7 +9147,7 @@ async function syncCodexTranscriptsBulk(gatewayUrl, token, repo) {
   }
   return { sessions: totalSessions, messages: totalMessages };
 }
-var SYNKRO_DIR10, HOOKS_DIR, BIN_DIR, CONFIG_PATH4, MCP_STDIO_PROXY_SRC, OFFSETS_DIR, CLOUD_JWT_PATH, SKILLS_DISCOVERED_PATH;
+var SYNKRO_DIR11, HOOKS_DIR, BIN_DIR, CONFIG_PATH4, MCP_STDIO_PROXY_SRC, OFFSETS_DIR, CLOUD_JWT_PATH, SKILLS_DISCOVERED_PATH;
 var init_install = __esm({
   "cli/commands/install.ts"() {
     "use strict";
@@ -8972,11 +9167,12 @@ var init_install = __esm({
     init_claudeDesktopTap();
     init_dockerInstall();
     init_setupToken();
+    init_codexCloudSetup();
     init_ptyShim();
-    SYNKRO_DIR10 = join17(homedir19(), ".synkro");
-    HOOKS_DIR = join17(SYNKRO_DIR10, "hooks");
-    BIN_DIR = join17(SYNKRO_DIR10, "bin");
-    CONFIG_PATH4 = join17(SYNKRO_DIR10, "config.env");
+    SYNKRO_DIR11 = join18(homedir20(), ".synkro");
+    HOOKS_DIR = join18(SYNKRO_DIR11, "hooks");
+    BIN_DIR = join18(SYNKRO_DIR11, "bin");
+    CONFIG_PATH4 = join18(SYNKRO_DIR11, "config.env");
     MCP_STDIO_PROXY_SRC = `#!/usr/bin/env bun
 import { readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
@@ -9087,23 +9283,23 @@ rl.on('line', async (line) => {
   }
 });
 `;
-    OFFSETS_DIR = join17(SYNKRO_DIR10, ".transcript-offsets");
-    CLOUD_JWT_PATH = join17(SYNKRO_DIR10, ".cloud-jwt");
-    SKILLS_DISCOVERED_PATH = join17(SYNKRO_DIR10, ".skills-discovered");
+    OFFSETS_DIR = join18(SYNKRO_DIR11, ".transcript-offsets");
+    CLOUD_JWT_PATH = join18(SYNKRO_DIR11, ".cloud-jwt");
+    SKILLS_DISCOVERED_PATH = join18(SYNKRO_DIR11, ".skills-discovered");
   }
 });
 
 // cli/local-cc/install.ts
-import { existsSync as existsSync22, mkdirSync as mkdirSync15, writeFileSync as writeFileSync16, readFileSync as readFileSync20, chmodSync as chmodSync5, copyFileSync as copyFileSync2, renameSync as renameSync7, unlinkSync as unlinkSync8, openSync as openSync2, fsyncSync, closeSync as closeSync2 } from "fs";
-import { join as join18 } from "path";
-import { homedir as homedir20 } from "os";
-import { spawnSync as spawnSync6 } from "child_process";
+import { existsSync as existsSync23, mkdirSync as mkdirSync16, writeFileSync as writeFileSync17, readFileSync as readFileSync21, chmodSync as chmodSync5, copyFileSync as copyFileSync2, renameSync as renameSync7, unlinkSync as unlinkSync8, openSync as openSync2, fsyncSync, closeSync as closeSync2 } from "fs";
+import { join as join19 } from "path";
+import { homedir as homedir21 } from "os";
+import { spawnSync as spawnSync7 } from "child_process";
 function writePluginFiles() {
   for (const c of CHANNELS) {
-    mkdirSync15(c.sessionDir, { recursive: true });
-    mkdirSync15(c.pluginSettingsDir, { recursive: true });
-    writeFileSync16(c.pluginPkgPath, PLUGIN_PACKAGE_JSON, "utf-8");
-    writeFileSync16(
+    mkdirSync16(c.sessionDir, { recursive: true });
+    mkdirSync16(c.pluginSettingsDir, { recursive: true });
+    writeFileSync17(c.pluginPkgPath, PLUGIN_PACKAGE_JSON, "utf-8");
+    writeFileSync17(
       c.pluginSettingsPath,
       JSON.stringify({
         fastMode: true,
@@ -9118,13 +9314,13 @@ function writePluginFiles() {
       }, null, 2) + "\n",
       "utf-8"
     );
-    writeFileSync16(c.runScriptPath, c.runScriptSource, "utf-8");
+    writeFileSync17(c.runScriptPath, c.runScriptSource, "utf-8");
     chmodSync5(c.runScriptPath, 493);
   }
 }
 function runBunInstall() {
   for (const c of CHANNELS) {
-    const r = spawnSync6("bun", ["install", "--silent"], {
+    const r = spawnSync7("bun", ["install", "--silent"], {
       cwd: c.sessionDir,
       encoding: "utf-8",
       timeout: 12e4
@@ -9137,10 +9333,10 @@ function runBunInstall() {
   }
 }
 function safelyMutateClaudeJson(mutator) {
-  if (!existsSync22(CLAUDE_JSON_PATH)) {
+  if (!existsSync23(CLAUDE_JSON_PATH)) {
     return;
   }
-  const originalText = readFileSync20(CLAUDE_JSON_PATH, "utf-8");
+  const originalText = readFileSync21(CLAUDE_JSON_PATH, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(originalText);
@@ -9172,7 +9368,7 @@ function safelyMutateClaudeJson(mutator) {
   copyFileSync2(CLAUDE_JSON_PATH, CLAUDE_JSON_BACKUP_PATH);
   const tmpPath = `${CLAUDE_JSON_PATH}.synkro-tmp.${process.pid}`;
   try {
-    writeFileSync16(tmpPath, newText, "utf-8");
+    writeFileSync17(tmpPath, newText, "utf-8");
     const fd = openSync2(tmpPath, "r");
     try {
       fsyncSync(fd);
@@ -9205,7 +9401,7 @@ function writeProjectMcpJson() {
         }
       }
     };
-    writeFileSync16(c.projectMcpPath, JSON.stringify(mcp, null, 2) + "\n", "utf-8");
+    writeFileSync17(c.projectMcpPath, JSON.stringify(mcp, null, 2) + "\n", "utf-8");
   }
 }
 function patchClaudeJson() {
@@ -9240,15 +9436,15 @@ function patchClaudeJson() {
   });
 }
 function installLocalCC() {
-  let bunCheck = spawnSync6("bun", ["--version"], { encoding: "utf-8" });
+  let bunCheck = spawnSync7("bun", ["--version"], { encoding: "utf-8" });
   if (bunCheck.status !== 0) {
     if (process.platform === "darwin") {
       console.log("  Installing bun via brew...");
-      const brewR = spawnSync6("brew", ["install", "oven-sh/bun/bun"], { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
+      const brewR = spawnSync7("brew", ["install", "oven-sh/bun/bun"], { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
       if (brewR.status !== 0) {
         throw new LocalCCInstallError("bun auto-install failed. Install manually: curl -fsSL https://bun.sh/install | bash");
       }
-      bunCheck = spawnSync6("bun", ["--version"], { encoding: "utf-8" });
+      bunCheck = spawnSync7("bun", ["--version"], { encoding: "utf-8" });
       if (bunCheck.status !== 0) {
         throw new LocalCCInstallError("bun installed but not found on PATH. Restart your terminal and re-run install.");
       }
@@ -9282,42 +9478,42 @@ var CLAUDE_JSON_BACKUP_PATH, SESSION_DIR, PLUGIN_PATH, PLUGIN_PKG_PATH, PLUGIN_S
 var init_install2 = __esm({
   "cli/local-cc/install.ts"() {
     "use strict";
-    CLAUDE_JSON_BACKUP_PATH = join18(homedir20(), ".claude.json.synkro-bak");
-    SESSION_DIR = join18(homedir20(), ".synkro", "cc_sessions");
-    PLUGIN_PATH = join18(SESSION_DIR, "synkro-channel.ts");
-    PLUGIN_PKG_PATH = join18(SESSION_DIR, "package.json");
-    PLUGIN_SETTINGS_DIR = join18(SESSION_DIR, ".claude");
-    PLUGIN_SETTINGS_PATH = join18(PLUGIN_SETTINGS_DIR, "settings.json");
-    PROJECT_MCP_PATH = join18(SESSION_DIR, ".mcp.json");
-    CLAUDE_JSON_PATH = join18(homedir20(), ".claude.json");
-    RUN_SCRIPT_PATH = join18(SESSION_DIR, "run-claude.sh");
+    CLAUDE_JSON_BACKUP_PATH = join19(homedir21(), ".claude.json.synkro-bak");
+    SESSION_DIR = join19(homedir21(), ".synkro", "cc_sessions");
+    PLUGIN_PATH = join19(SESSION_DIR, "synkro-channel.ts");
+    PLUGIN_PKG_PATH = join19(SESSION_DIR, "package.json");
+    PLUGIN_SETTINGS_DIR = join19(SESSION_DIR, ".claude");
+    PLUGIN_SETTINGS_PATH = join19(PLUGIN_SETTINGS_DIR, "settings.json");
+    PROJECT_MCP_PATH = join19(SESSION_DIR, ".mcp.json");
+    CLAUDE_JSON_PATH = join19(homedir21(), ".claude.json");
+    RUN_SCRIPT_PATH = join19(SESSION_DIR, "run-claude.sh");
     TMUX_SESSION_NAME = "synkro-local-cc";
     CHANNEL_1_PORT = 8941;
-    SESSION_DIR_2 = join18(homedir20(), ".synkro", "cc_sessions_2");
-    PLUGIN_PATH_2 = join18(SESSION_DIR_2, "synkro-channel.ts");
-    PLUGIN_PKG_PATH_2 = join18(SESSION_DIR_2, "package.json");
-    PLUGIN_SETTINGS_DIR_2 = join18(SESSION_DIR_2, ".claude");
-    PLUGIN_SETTINGS_PATH_2 = join18(PLUGIN_SETTINGS_DIR_2, "settings.json");
-    PROJECT_MCP_PATH_2 = join18(SESSION_DIR_2, ".mcp.json");
-    RUN_SCRIPT_PATH_2 = join18(SESSION_DIR_2, "run-claude.sh");
+    SESSION_DIR_2 = join19(homedir21(), ".synkro", "cc_sessions_2");
+    PLUGIN_PATH_2 = join19(SESSION_DIR_2, "synkro-channel.ts");
+    PLUGIN_PKG_PATH_2 = join19(SESSION_DIR_2, "package.json");
+    PLUGIN_SETTINGS_DIR_2 = join19(SESSION_DIR_2, ".claude");
+    PLUGIN_SETTINGS_PATH_2 = join19(PLUGIN_SETTINGS_DIR_2, "settings.json");
+    PROJECT_MCP_PATH_2 = join19(SESSION_DIR_2, ".mcp.json");
+    RUN_SCRIPT_PATH_2 = join19(SESSION_DIR_2, "run-claude.sh");
     TMUX_SESSION_NAME_2 = "synkro-local-cc-2";
     CHANNEL_2_PORT = 8951;
-    SESSION_DIR_3 = join18(homedir20(), ".synkro", "cc_sessions_3");
-    PLUGIN_PATH_3 = join18(SESSION_DIR_3, "synkro-channel.ts");
-    PLUGIN_PKG_PATH_3 = join18(SESSION_DIR_3, "package.json");
-    PLUGIN_SETTINGS_DIR_3 = join18(SESSION_DIR_3, ".claude");
-    PLUGIN_SETTINGS_PATH_3 = join18(PLUGIN_SETTINGS_DIR_3, "settings.json");
-    PROJECT_MCP_PATH_3 = join18(SESSION_DIR_3, ".mcp.json");
-    RUN_SCRIPT_PATH_3 = join18(SESSION_DIR_3, "run-claude.sh");
+    SESSION_DIR_3 = join19(homedir21(), ".synkro", "cc_sessions_3");
+    PLUGIN_PATH_3 = join19(SESSION_DIR_3, "synkro-channel.ts");
+    PLUGIN_PKG_PATH_3 = join19(SESSION_DIR_3, "package.json");
+    PLUGIN_SETTINGS_DIR_3 = join19(SESSION_DIR_3, ".claude");
+    PLUGIN_SETTINGS_PATH_3 = join19(PLUGIN_SETTINGS_DIR_3, "settings.json");
+    PROJECT_MCP_PATH_3 = join19(SESSION_DIR_3, ".mcp.json");
+    RUN_SCRIPT_PATH_3 = join19(SESSION_DIR_3, "run-claude.sh");
     TMUX_SESSION_NAME_3 = "synkro-local-cc-3";
     CHANNEL_3_PORT = 8942;
-    SESSION_DIR_4 = join18(homedir20(), ".synkro", "cc_sessions_4");
-    PLUGIN_PATH_4 = join18(SESSION_DIR_4, "synkro-channel.ts");
-    PLUGIN_PKG_PATH_4 = join18(SESSION_DIR_4, "package.json");
-    PLUGIN_SETTINGS_DIR_4 = join18(SESSION_DIR_4, ".claude");
-    PLUGIN_SETTINGS_PATH_4 = join18(PLUGIN_SETTINGS_DIR_4, "settings.json");
-    PROJECT_MCP_PATH_4 = join18(SESSION_DIR_4, ".mcp.json");
-    RUN_SCRIPT_PATH_4 = join18(SESSION_DIR_4, "run-claude.sh");
+    SESSION_DIR_4 = join19(homedir21(), ".synkro", "cc_sessions_4");
+    PLUGIN_PATH_4 = join19(SESSION_DIR_4, "synkro-channel.ts");
+    PLUGIN_PKG_PATH_4 = join19(SESSION_DIR_4, "package.json");
+    PLUGIN_SETTINGS_DIR_4 = join19(SESSION_DIR_4, ".claude");
+    PLUGIN_SETTINGS_PATH_4 = join19(PLUGIN_SETTINGS_DIR_4, "settings.json");
+    PROJECT_MCP_PATH_4 = join19(SESSION_DIR_4, ".mcp.json");
+    RUN_SCRIPT_PATH_4 = join19(SESSION_DIR_4, "run-claude.sh");
     TMUX_SESSION_NAME_4 = "synkro-local-cc-4";
     CHANNEL_4_PORT = 8952;
     RUN_SCRIPT_SOURCE = `#!/usr/bin/env bash
@@ -9591,10 +9787,10 @@ var disconnect_exports = {};
 __export(disconnect_exports, {
   disconnectCommand: () => disconnectCommand
 });
-import { existsSync as existsSync23, rmSync as rmSync2, readdirSync as readdirSync5 } from "fs";
-import { homedir as homedir21 } from "os";
-import { join as join19 } from "path";
-import { spawnSync as spawnSync7 } from "child_process";
+import { existsSync as existsSync24, rmSync as rmSync3, readdirSync as readdirSync5 } from "fs";
+import { homedir as homedir22 } from "os";
+import { join as join20 } from "path";
+import { spawnSync as spawnSync8 } from "child_process";
 import { createInterface as createInterface3 } from "readline";
 async function tearDownLocalCC() {
   const docker = dockerStatus();
@@ -9608,7 +9804,7 @@ async function tearDownLocalCC() {
   console.log("\u2713 removed synkro-server container");
   try {
     const image = imageTag();
-    const r = spawnSync7("docker", ["rmi", "-f", image], { encoding: "utf-8", timeout: 3e4 });
+    const r = spawnSync8("docker", ["rmi", "-f", image], { encoding: "utf-8", timeout: 3e4 });
     console.log(r.status === 0 ? `\u2713 removed Docker image ${image}` : "\xB7 no Docker image to remove");
   } catch {
   }
@@ -9694,7 +9890,7 @@ async function disconnectCommand(args2 = [], opts = {}) {
     if (desktopMcpRemoved) removed.mcp = true;
     console.log(`${desktopMcpRemoved ? "\u2713" : "\xB7"} MCP guardrails (Claude Desktop): ${desktopMcpRemoved ? "removed from claude_desktop_config.json" : "no entry found"}`);
   }
-  if (existsSync23(SYNKRO_DIR11)) {
+  if (existsSync24(SYNKRO_DIR12)) {
     if (purge2) {
       emit("uninstall", {
         flavor,
@@ -9703,41 +9899,41 @@ async function disconnectCommand(args2 = [], opts = {}) {
         duration_ms: Date.now() - startedAt
       });
       await flush({ force: true });
-      rmSync2(SYNKRO_DIR11, { recursive: true, force: true });
+      rmSync3(SYNKRO_DIR12, { recursive: true, force: true });
       removed.config = true;
-      console.log(`\u2713 wiped ${SYNKRO_DIR11} entirely \u2014 including all scan data and backups`);
+      console.log(`\u2713 wiped ${SYNKRO_DIR12} entirely \u2014 including all scan data and backups`);
     } else {
       const keep = /* @__PURE__ */ new Set([
-        join19(SYNKRO_DIR11, "pgdata"),
-        join19(SYNKRO_DIR11, "pgdata-backups"),
-        join19(SYNKRO_DIR11, ".transcript-offsets")
+        join20(SYNKRO_DIR12, "pgdata"),
+        join20(SYNKRO_DIR12, "pgdata-backups"),
+        join20(SYNKRO_DIR12, ".transcript-offsets")
       ]);
       const preserved = [];
-      for (const entry of readdirSync5(SYNKRO_DIR11)) {
-        const full = join19(SYNKRO_DIR11, entry);
+      for (const entry of readdirSync5(SYNKRO_DIR12)) {
+        const full = join20(SYNKRO_DIR12, entry);
         if (keep.has(full)) {
           preserved.push(entry);
           continue;
         }
-        rmSync2(full, { recursive: true, force: true });
+        rmSync3(full, { recursive: true, force: true });
       }
       removed.config = true;
       if (preserved.length > 0) {
-        console.log(`\u2713 removed Synkro config from ${SYNKRO_DIR11} (kept your scan data: ${preserved.join(", ")})`);
+        console.log(`\u2713 removed Synkro config from ${SYNKRO_DIR12} (kept your scan data: ${preserved.join(", ")})`);
         console.log("  run `synkro uninstall --purge` to delete that too");
       } else {
-        console.log(`\u2713 removed ${SYNKRO_DIR11}`);
+        console.log(`\u2713 removed ${SYNKRO_DIR12}`);
       }
     }
   } else {
-    console.log(`\xB7 ${SYNKRO_DIR11} already gone`);
+    console.log(`\xB7 ${SYNKRO_DIR12} already gone`);
   }
   if (!purge2) {
     emit("uninstall", { flavor, purge: purge2, removed, duration_ms: Date.now() - startedAt });
   }
   console.log(purge2 ? "\nSynkro fully removed \u2014 this machine is clean, as if it was never installed." : "\nSynkro uninstalled. Your scan data is preserved.");
 }
-var SYNKRO_DIR11;
+var SYNKRO_DIR12;
 var init_disconnect = __esm({
   "cli/commands/disconnect.ts"() {
     "use strict";
@@ -9752,14 +9948,14 @@ var init_disconnect = __esm({
     init_dockerInstall();
     init_macKeychain();
     init_telemetry();
-    SYNKRO_DIR11 = join19(homedir21(), ".synkro");
+    SYNKRO_DIR12 = join20(homedir22(), ".synkro");
   }
 });
 
 // cli/local-cc/turnLog.ts
-import { appendFileSync as appendFileSync3, existsSync as existsSync24, mkdirSync as mkdirSync16, openSync as openSync3, readFileSync as readFileSync21, readSync, closeSync as closeSync3, statSync as statSync3, watchFile, unwatchFile } from "fs";
-import { dirname as dirname7, join as join20 } from "path";
-import { homedir as homedir22 } from "os";
+import { appendFileSync as appendFileSync3, existsSync as existsSync25, mkdirSync as mkdirSync17, openSync as openSync3, readFileSync as readFileSync22, readSync, closeSync as closeSync3, statSync as statSync3, watchFile, unwatchFile } from "fs";
+import { dirname as dirname7, join as join21 } from "path";
+import { homedir as homedir23 } from "os";
 function truncate(s, max = PREVIEW_MAX) {
   if (s.length <= max) return s;
   return s.slice(0, max) + "\u2026 [+" + (s.length - max) + " chars]";
@@ -9779,7 +9975,7 @@ function extractSeverity(result) {
 }
 function appendTurn(args2) {
   try {
-    mkdirSync16(dirname7(TURN_LOG_PATH), { recursive: true });
+    mkdirSync17(dirname7(TURN_LOG_PATH), { recursive: true });
     const entry = {
       ts: new Date(args2.startedAt).toISOString(),
       role: args2.role,
@@ -9795,11 +9991,11 @@ function appendTurn(args2) {
   }
 }
 function readRecentTurns(n = 20) {
-  if (!existsSync24(TURN_LOG_PATH)) return [];
+  if (!existsSync25(TURN_LOG_PATH)) return [];
   try {
     const size = statSync3(TURN_LOG_PATH).size;
     if (size === 0) return [];
-    const text = readFileSync21(TURN_LOG_PATH, "utf-8");
+    const text = readFileSync22(TURN_LOG_PATH, "utf-8");
     const lines = text.split("\n").filter(Boolean);
     const lastN = lines.slice(-n).reverse();
     return lastN.map((line) => {
@@ -9815,8 +10011,8 @@ function readRecentTurns(n = 20) {
 }
 function followTurns(onEntry) {
   try {
-    mkdirSync16(dirname7(TURN_LOG_PATH), { recursive: true });
-    if (!existsSync24(TURN_LOG_PATH)) {
+    mkdirSync17(dirname7(TURN_LOG_PATH), { recursive: true });
+    if (!existsSync25(TURN_LOG_PATH)) {
       appendFileSync3(TURN_LOG_PATH, "", "utf-8");
     }
   } catch {
@@ -9878,7 +10074,7 @@ var TURN_LOG_PATH, PREVIEW_MAX;
 var init_turnLog = __esm({
   "cli/local-cc/turnLog.ts"() {
     "use strict";
-    TURN_LOG_PATH = join20(homedir22(), ".synkro", "cc_sessions", "turns.log");
+    TURN_LOG_PATH = join21(homedir23(), ".synkro", "cc_sessions", "turns.log");
     PREVIEW_MAX = 400;
   }
 });
@@ -10032,8 +10228,8 @@ __export(scanPr_exports, {
   scanPrCommand: () => scanPrCommand
 });
 import { execSync as execSync5, spawn as spawn5 } from "child_process";
-import { readFileSync as readFileSync22, existsSync as existsSync25 } from "fs";
-import { join as join21 } from "path";
+import { readFileSync as readFileSync23, existsSync as existsSync26 } from "fs";
+import { join as join22 } from "path";
 function parseMatchSpec(condition) {
   if (!condition.startsWith("match_spec:")) return null;
   try {
@@ -10512,10 +10708,10 @@ function shouldFail(findings, threshold) {
   return findings.some((f) => order.indexOf(f.severity) >= thresholdIdx);
 }
 function readRepoDeps() {
-  const pkgPath = join21(process.cwd(), "package.json");
-  if (!existsSync25(pkgPath)) return {};
+  const pkgPath = join22(process.cwd(), "package.json");
+  if (!existsSync26(pkgPath)) return {};
   try {
-    const pkg = JSON.parse(readFileSync22(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync23(pkgPath, "utf-8"));
     return { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
   } catch {
     return {};
@@ -10759,15 +10955,15 @@ var routeDecide_exports = {};
 __export(routeDecide_exports, {
   routeDecide: () => routeDecide
 });
-import { readFileSync as readFileSync23, writeFileSync as writeFileSync17 } from "fs";
-import { homedir as homedir23 } from "os";
-import { join as join22 } from "path";
+import { readFileSync as readFileSync24, writeFileSync as writeFileSync18 } from "fs";
+import { homedir as homedir24 } from "os";
+import { join as join23 } from "path";
 function safeSid(sid) {
   return sid.replace(/[^A-Za-z0-9_-]/g, "_");
 }
 function loadMcpJwt() {
   try {
-    return readFileSync23(join22(SYNKRO_DIR12, ".mcp-jwt"), "utf-8").trim();
+    return readFileSync24(join23(SYNKRO_DIR13, ".mcp-jwt"), "utf-8").trim();
   } catch {
     return "";
   }
@@ -10777,7 +10973,7 @@ async function routeDecide(sessionId) {
   const sid = safeSid(sessionId);
   let prompt = "";
   try {
-    const rec = JSON.parse(readFileSync23(join22(SESSIONS_DIR2, sid + ".json"), "utf-8"));
+    const rec = JSON.parse(readFileSync24(join23(SESSIONS_DIR2, sid + ".json"), "utf-8"));
     prompt = String(rec.last_prompt || "").trim();
   } catch {
     return;
@@ -10800,29 +10996,29 @@ async function routeDecide(sessionId) {
     return;
   }
   if (!model || !VALID_MODELS.has(model)) return;
-  const lastFile = join22(PTY_DIR, "route-last-" + sid);
+  const lastFile = join23(PTY_DIR, "route-last-" + sid);
   let last = "";
   try {
-    last = readFileSync23(lastFile, "utf-8").trim();
+    last = readFileSync24(lastFile, "utf-8").trim();
   } catch {
   }
   if (model === last) return;
   try {
-    writeFileSync17(lastFile, model);
+    writeFileSync18(lastFile, model);
   } catch {
   }
   try {
-    writeFileSync17(join22(PTY_DIR, "route-" + sid), model);
+    writeFileSync18(join23(PTY_DIR, "route-" + sid), model);
   } catch {
   }
 }
-var SYNKRO_DIR12, PTY_DIR, SESSIONS_DIR2, VALID_MODELS, GRADER_HOST_PORT;
+var SYNKRO_DIR13, PTY_DIR, SESSIONS_DIR2, VALID_MODELS, GRADER_HOST_PORT;
 var init_routeDecide = __esm({
   "cli/local-cc/routeDecide.ts"() {
     "use strict";
-    SYNKRO_DIR12 = join22(homedir23(), ".synkro");
-    PTY_DIR = join22(SYNKRO_DIR12, "pty");
-    SESSIONS_DIR2 = join22(PTY_DIR, "sessions");
+    SYNKRO_DIR13 = join23(homedir24(), ".synkro");
+    PTY_DIR = join23(SYNKRO_DIR13, "pty");
+    SESSIONS_DIR2 = join23(PTY_DIR, "sessions");
     VALID_MODELS = /* @__PURE__ */ new Set(["claude-haiku-4-5", "claude-sonnet-5", "claude-opus-4-8"]);
     GRADER_HOST_PORT = process.env.SYNKRO_GRADER_HOST_PORT || "18929";
   }
@@ -10833,10 +11029,10 @@ var routeOrchestrate_exports = {};
 __export(routeOrchestrate_exports, {
   routeAndResubmit: () => routeAndResubmit
 });
-import { readFileSync as readFileSync24, writeFileSync as writeFileSync18 } from "fs";
-import { homedir as homedir24 } from "os";
-import { join as join23 } from "path";
-import { spawnSync as spawnSync8 } from "child_process";
+import { readFileSync as readFileSync25, writeFileSync as writeFileSync19 } from "fs";
+import { homedir as homedir25 } from "os";
+import { join as join24 } from "path";
+import { spawnSync as spawnSync9 } from "child_process";
 function safeSid2(sid) {
   return sid.replace(/[^A-Za-z0-9_-]/g, "_");
 }
@@ -10845,7 +11041,7 @@ function safeSession(s) {
 }
 function loadMcpJwt2() {
   try {
-    return readFileSync24(join23(SYNKRO_DIR13, ".mcp-jwt"), "utf-8").trim();
+    return readFileSync25(join24(SYNKRO_DIR14, ".mcp-jwt"), "utf-8").trim();
   } catch {
     return "";
   }
@@ -10871,7 +11067,7 @@ async function classifyTask(prompt) {
 }
 function lastRoutedModel(sid) {
   try {
-    const v = readFileSync24(join23(PTY_DIR2, "route-last-" + sid), "utf-8").trim();
+    const v = readFileSync25(join24(PTY_DIR2, "route-last-" + sid), "utf-8").trim();
     return VALID_MODELS2.has(v) ? v : "";
   } catch {
     return "";
@@ -10881,12 +11077,12 @@ function resolveSession(sid, tmuxSession) {
   const candidates = [];
   if (tmuxSession) candidates.push(tmuxSession);
   try {
-    const rec = JSON.parse(readFileSync24(join23(SESSIONS_DIR3, safeSid2(sid) + ".json"), "utf-8"));
+    const rec = JSON.parse(readFileSync25(join24(SESSIONS_DIR3, safeSid2(sid) + ".json"), "utf-8"));
     if (rec.tmux_session) candidates.push(rec.tmux_session);
   } catch {
   }
   try {
-    candidates.push(readFileSync24(ACTIVE_SESSION_FILE2, "utf-8").trim());
+    candidates.push(readFileSync25(ACTIVE_SESSION_FILE2, "utf-8").trim());
   } catch {
   }
   for (const c of candidates) if (c && safeSession(c)) return c;
@@ -10898,12 +11094,12 @@ async function routeAndResubmit(sessionId, task, tmuxSession, forceModel) {
   const sid = safeSid2(sessionId);
   const session = resolveSession(sid, tmuxSession);
   if (!session) return;
-  if (spawnSync8("tmux", ["has-session", "-t", `=${session}`], { encoding: "utf-8" }).status !== 0) return;
+  if (spawnSync9("tmux", ["has-session", "-t", `=${session}`], { encoding: "utf-8" }).status !== 0) return;
   const current = lastRoutedModel(sid);
   const picked = forceModel && VALID_MODELS2.has(forceModel) ? forceModel : await classifyTask(trimmed);
   const doSwap = !!picked && picked !== "keep" && picked !== current;
-  const sk = (...a) => spawnSync8("tmux", ["send-keys", "-t", session, ...a], { encoding: "utf-8" });
-  const capture = () => spawnSync8("tmux", ["capture-pane", "-t", session, "-p", "-S", "-25"], { encoding: "utf-8" }).stdout || "";
+  const sk = (...a) => spawnSync9("tmux", ["send-keys", "-t", session, ...a], { encoding: "utf-8" });
+  const capture = () => spawnSync9("tmux", ["capture-pane", "-t", session, "-p", "-S", "-25"], { encoding: "utf-8" }).stdout || "";
   await wait(400);
   if (doSwap) {
     sk("C-u");
@@ -10921,29 +11117,29 @@ async function routeAndResubmit(sessionId, task, tmuxSession, forceModel) {
     }
     await wait(500);
     try {
-      writeFileSync18(join23(PTY_DIR2, "route-last-" + sid), picked);
+      writeFileSync19(join24(PTY_DIR2, "route-last-" + sid), picked);
     } catch {
     }
   }
   try {
-    writeFileSync18(join23(PTY_DIR2, "route-guard-" + sid), "1");
+    writeFileSync19(join24(PTY_DIR2, "route-guard-" + sid), "1");
   } catch {
   }
   sk("C-u");
   await wait(80);
-  spawnSync8("tmux", ["set-buffer", "-b", "synkro-route", trimmed], { encoding: "utf-8" });
-  spawnSync8("tmux", ["paste-buffer", "-t", session, "-b", "synkro-route", "-d"], { encoding: "utf-8" });
+  spawnSync9("tmux", ["set-buffer", "-b", "synkro-route", trimmed], { encoding: "utf-8" });
+  spawnSync9("tmux", ["paste-buffer", "-t", session, "-b", "synkro-route", "-d"], { encoding: "utf-8" });
   await wait(120);
   sk("Enter");
 }
-var SYNKRO_DIR13, PTY_DIR2, SESSIONS_DIR3, ACTIVE_SESSION_FILE2, VALID_MODELS2, GRADER_HOST_PORT2, wait;
+var SYNKRO_DIR14, PTY_DIR2, SESSIONS_DIR3, ACTIVE_SESSION_FILE2, VALID_MODELS2, GRADER_HOST_PORT2, wait;
 var init_routeOrchestrate = __esm({
   "cli/local-cc/routeOrchestrate.ts"() {
     "use strict";
-    SYNKRO_DIR13 = join23(homedir24(), ".synkro");
-    PTY_DIR2 = join23(SYNKRO_DIR13, "pty");
-    SESSIONS_DIR3 = join23(PTY_DIR2, "sessions");
-    ACTIVE_SESSION_FILE2 = join23(PTY_DIR2, "active");
+    SYNKRO_DIR14 = join24(homedir25(), ".synkro");
+    PTY_DIR2 = join24(SYNKRO_DIR14, "pty");
+    SESSIONS_DIR3 = join24(PTY_DIR2, "sessions");
+    ACTIVE_SESSION_FILE2 = join24(PTY_DIR2, "active");
     VALID_MODELS2 = /* @__PURE__ */ new Set(["claude-haiku-4-5", "claude-sonnet-5", "claude-opus-4-8"]);
     GRADER_HOST_PORT2 = process.env.SYNKRO_GRADER_HOST_PORT || "18929";
     wait = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -10955,14 +11151,14 @@ var routingToggle_exports = {};
 __export(routingToggle_exports, {
   routingCommand: () => routingCommand
 });
-import { writeFileSync as writeFileSync19, unlinkSync as unlinkSync9, existsSync as existsSync26, readdirSync as readdirSync6 } from "fs";
-import { homedir as homedir25 } from "os";
-import { join as join24 } from "path";
+import { writeFileSync as writeFileSync20, unlinkSync as unlinkSync9, existsSync as existsSync27, readdirSync as readdirSync6 } from "fs";
+import { homedir as homedir26 } from "os";
+import { join as join25 } from "path";
 function safeSid3(sid) {
   return sid.replace(/[^A-Za-z0-9_-]/g, "_");
 }
 function markerFor(session) {
-  return session ? join24(PTY_DIR3, "routing-on-" + safeSid3(session)) : join24(PTY_DIR3, "routing-on");
+  return session ? join25(PTY_DIR3, "routing-on-" + safeSid3(session)) : join25(PTY_DIR3, "routing-on");
 }
 function routingCommand(args2) {
   const sub = (args2[0] || "status").trim();
@@ -10971,7 +11167,7 @@ function routingCommand(args2) {
   if (si >= 0 && args2[si + 1]) session = args2[si + 1].trim();
   if (sub === "on") {
     try {
-      writeFileSync19(markerFor(session), "1");
+      writeFileSync20(markerFor(session), "1");
     } catch (e) {
       console.error("routing on failed:", String(e));
       return;
@@ -10983,7 +11179,7 @@ function routingCommand(args2) {
   if (sub === "off") {
     let removed = 0;
     if (session) {
-      if (existsSync26(markerFor(session))) {
+      if (existsSync27(markerFor(session))) {
         try {
           unlinkSync9(markerFor(session));
           removed++;
@@ -10994,7 +11190,7 @@ function routingCommand(args2) {
       for (const f of safeList()) {
         if (f === "routing-on" || f.startsWith("routing-on-")) {
           try {
-            unlinkSync9(join24(PTY_DIR3, f));
+            unlinkSync9(join25(PTY_DIR3, f));
             removed++;
           } catch {
           }
@@ -11026,24 +11222,24 @@ var PTY_DIR3;
 var init_routingToggle = __esm({
   "cli/local-cc/routingToggle.ts"() {
     "use strict";
-    PTY_DIR3 = join24(homedir25(), ".synkro", "pty");
+    PTY_DIR3 = join25(homedir26(), ".synkro", "pty");
   }
 });
 
 // cli/local-cc/pueue.ts
-import { execFileSync as execFileSync4, spawnSync as spawnSync9, spawn as spawn6 } from "child_process";
-import { homedir as homedir26 } from "os";
-import { join as join25 } from "path";
+import { execFileSync as execFileSync4, spawnSync as spawnSync10, spawn as spawn6 } from "child_process";
+import { homedir as homedir27 } from "os";
+import { join as join26 } from "path";
 import { connect as connect2 } from "net";
 function pueueAvailable() {
-  const r = spawnSync9("pueue", ["--version"], { encoding: "utf-8" });
+  const r = spawnSync10("pueue", ["--version"], { encoding: "utf-8" });
   if (r.status !== 0) {
     throw new PueueError("pueue CLI not found on PATH. Install pueue (https://github.com/Nukesor/pueue) and start `pueued`.");
   }
 }
 function statusJson() {
   pueueAvailable();
-  const r = spawnSync9("pueue", ["status", "--json"], { encoding: "utf-8" });
+  const r = spawnSync10("pueue", ["status", "--json"], { encoding: "utf-8" });
   if (r.status !== 0) {
     throw new PueueError(`pueue status failed: ${r.stderr || r.stdout || "unknown error"} \u2014 is pueued running?`);
   }
@@ -11088,18 +11284,18 @@ function startTask(opts = {}) {
   let existing = findTask(ch);
   while (existing) {
     if (existing.status === "Running" || existing.status === "Queued") {
-      spawnSync9("tmux", ["kill-session", "-t", `=${ch.tmuxSession}`], { encoding: "utf-8" });
-      spawnSync9("pueue", ["kill", String(existing.id)], { encoding: "utf-8" });
+      spawnSync10("tmux", ["kill-session", "-t", `=${ch.tmuxSession}`], { encoding: "utf-8" });
+      spawnSync10("pueue", ["kill", String(existing.id)], { encoding: "utf-8" });
       for (let i = 0; i < 10; i++) {
         const check = findTask(ch);
         if (!check || check.id !== existing.id || check.status !== "Running" && check.status !== "Queued") break;
-        spawnSync9("sleep", ["0.5"], { encoding: "utf-8" });
+        spawnSync10("sleep", ["0.5"], { encoding: "utf-8" });
       }
     }
-    spawnSync9("pueue", ["remove", String(existing.id)], { encoding: "utf-8" });
+    spawnSync10("pueue", ["remove", String(existing.id)], { encoding: "utf-8" });
     existing = findTask(ch);
   }
-  const runScript = join25(cwd, "run-claude.sh");
+  const runScript = join26(cwd, "run-claude.sh");
   const args2 = [
     "add",
     "--label",
@@ -11110,7 +11306,7 @@ function startTask(opts = {}) {
     "bash",
     runScript
   ];
-  const r = spawnSync9("pueue", args2, { encoding: "utf-8" });
+  const r = spawnSync10("pueue", args2, { encoding: "utf-8" });
   if (r.status !== 0) {
     throw new PueueError(`pueue add failed: ${r.stderr || r.stdout}`);
   }
@@ -11121,25 +11317,25 @@ function startTask(opts = {}) {
   return created;
 }
 function stopTask(channel = CHANNEL_PRIMARY) {
-  spawnSync9("tmux", ["kill-session", "-t", `=${channel.tmuxSession}`], { encoding: "utf-8" });
+  spawnSync10("tmux", ["kill-session", "-t", `=${channel.tmuxSession}`], { encoding: "utf-8" });
   let t = findTask(channel);
   while (t) {
     if (t.status === "Running" || t.status === "Queued") {
-      spawnSync9("pueue", ["kill", String(t.id)], { encoding: "utf-8" });
+      spawnSync10("pueue", ["kill", String(t.id)], { encoding: "utf-8" });
       for (let i = 0; i < 10; i++) {
         const check = findTask(channel);
         if (!check || check.id !== t.id || check.status !== "Running" && check.status !== "Queued") break;
-        spawnSync9("sleep", ["0.5"], { encoding: "utf-8" });
+        spawnSync10("sleep", ["0.5"], { encoding: "utf-8" });
       }
     }
-    spawnSync9("pueue", ["remove", String(t.id)], { encoding: "utf-8" });
+    spawnSync10("pueue", ["remove", String(t.id)], { encoding: "utf-8" });
     t = findTask(channel);
   }
 }
 function tailLogs(lines = 80, channel = CHANNEL_PRIMARY) {
   const t = findTask(channel);
   if (!t) return `(no ${channel.taskLabel} task)`;
-  const r = spawnSync9("pueue", ["log", "--lines", String(lines), String(t.id)], { encoding: "utf-8" });
+  const r = spawnSync10("pueue", ["log", "--lines", String(lines), String(t.id)], { encoding: "utf-8" });
   return r.stdout || r.stderr || "(no output)";
 }
 function ensureRunning(opts = {}) {
@@ -11164,8 +11360,8 @@ function probePort(host, port, timeoutMs = 500) {
   });
 }
 function tmuxDismissPrompts(tmuxSession = TMUX_SESSION) {
-  spawnSync9("tmux", ["send-keys", "-t", tmuxSession, "1"], { encoding: "utf-8" });
-  spawnSync9("tmux", ["send-keys", "-t", tmuxSession, "Enter"], { encoding: "utf-8" });
+  spawnSync10("tmux", ["send-keys", "-t", tmuxSession, "1"], { encoding: "utf-8" });
+  spawnSync10("tmux", ["send-keys", "-t", tmuxSession, "Enter"], { encoding: "utf-8" });
 }
 async function waitForChannelReady(port, timeoutMs = 6e4, host = "127.0.0.1", tmuxSession = TMUX_SESSION) {
   const deadline = Date.now() + timeoutMs;
@@ -11177,46 +11373,46 @@ async function waitForChannelReady(port, timeoutMs = 6e4, host = "127.0.0.1", tm
   return probePort(host, port);
 }
 function brewInstall(pkg) {
-  const brew = spawnSync9("brew", ["--version"], { encoding: "utf-8" });
+  const brew = spawnSync10("brew", ["--version"], { encoding: "utf-8" });
   if (brew.status !== 0) return false;
   console.log(`  Installing ${pkg} via brew...`);
-  const r = spawnSync9("brew", ["install", pkg], { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
+  const r = spawnSync10("brew", ["install", pkg], { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
   return r.status === 0;
 }
 function assertPueueInstalled() {
-  let r = spawnSync9("pueue", ["--version"], { encoding: "utf-8" });
+  let r = spawnSync10("pueue", ["--version"], { encoding: "utf-8" });
   if (r.status !== 0) {
     if (process.platform === "darwin" && brewInstall("pueue")) {
-      r = spawnSync9("pueue", ["--version"], { encoding: "utf-8" });
+      r = spawnSync10("pueue", ["--version"], { encoding: "utf-8" });
       if (r.status !== 0) throw new PueueError("pueue install succeeded but binary not found on PATH.");
     } else {
       throw new PueueError("pueue not found. Install it: brew install pueue (macOS) or https://github.com/Nukesor/pueue");
     }
   }
-  const status = spawnSync9("pueue", ["status", "--json"], { encoding: "utf-8", timeout: 5e3 });
+  const status = spawnSync10("pueue", ["status", "--json"], { encoding: "utf-8", timeout: 5e3 });
   if (status.status !== 0) {
     console.log("  Starting pueued daemon...");
     const child = spawn6("pueued", ["-d"], { stdio: "ignore", detached: true });
     child.unref();
-    spawnSync9("sleep", ["1"]);
-    const retry = spawnSync9("pueue", ["status", "--json"], { encoding: "utf-8", timeout: 5e3 });
+    spawnSync10("sleep", ["1"]);
+    const retry = spawnSync10("pueue", ["status", "--json"], { encoding: "utf-8", timeout: 5e3 });
     if (retry.status !== 0) {
       throw new PueueError("pueue daemon not reachable after starting pueued. Check `pueued` manually.");
     }
   }
-  spawnSync9("pueue", ["parallel", "2"], { encoding: "utf-8" });
+  spawnSync10("pueue", ["parallel", "2"], { encoding: "utf-8" });
 }
 function assertClaudeInstalled() {
-  const r = spawnSync9("claude", ["--version"], { encoding: "utf-8" });
+  const r = spawnSync10("claude", ["--version"], { encoding: "utf-8" });
   if (r.status !== 0) {
     throw new PueueError("claude CLI not found on PATH. Install Claude Code first: https://docs.claude.com/claude-code");
   }
 }
 function assertTmuxInstalled() {
-  let r = spawnSync9("tmux", ["-V"], { encoding: "utf-8" });
+  let r = spawnSync10("tmux", ["-V"], { encoding: "utf-8" });
   if (r.status !== 0) {
     if (process.platform === "darwin" && brewInstall("tmux")) {
-      r = spawnSync9("tmux", ["-V"], { encoding: "utf-8" });
+      r = spawnSync10("tmux", ["-V"], { encoding: "utf-8" });
       if (r.status !== 0) throw new PueueError("tmux install succeeded but binary not found on PATH.");
     } else {
       throw new PueueError("tmux not found. Install it: brew install tmux (macOS) or apt install tmux (Linux)");
@@ -11229,12 +11425,12 @@ var init_pueue = __esm({
     "use strict";
     TASK_LABEL = "synkro-local-cc";
     TMUX_SESSION = "synkro-local-cc";
-    SESSION_DIR2 = join25(homedir26(), ".synkro", "cc_sessions");
+    SESSION_DIR2 = join26(homedir27(), ".synkro", "cc_sessions");
     TASK_LABEL_2 = "synkro-local-cc-2";
     TMUX_SESSION_2 = "synkro-local-cc-2";
-    SESSION_DIR_22 = join25(homedir26(), ".synkro", "cc_sessions_2");
-    SESSION_DIR_32 = join25(homedir26(), ".synkro", "cc_sessions_3");
-    SESSION_DIR_42 = join25(homedir26(), ".synkro", "cc_sessions_4");
+    SESSION_DIR_22 = join26(homedir27(), ".synkro", "cc_sessions_2");
+    SESSION_DIR_32 = join26(homedir27(), ".synkro", "cc_sessions_3");
+    SESSION_DIR_42 = join26(homedir27(), ".synkro", "cc_sessions_4");
     PueueError = class extends Error {
       constructor(message, cause) {
         super(message);
@@ -11249,13 +11445,13 @@ var init_pueue = __esm({
 });
 
 // cli/local-cc/settings.ts
-import { existsSync as existsSync27, readFileSync as readFileSync25 } from "fs";
-import { homedir as homedir27 } from "os";
-import { join as join26 } from "path";
+import { existsSync as existsSync28, readFileSync as readFileSync26 } from "fs";
+import { homedir as homedir28 } from "os";
+import { join as join27 } from "path";
 function isLocalCCEnabled() {
-  if (!existsSync27(CONFIG_PATH5)) return false;
+  if (!existsSync28(CONFIG_PATH5)) return false;
   try {
-    const content = readFileSync25(CONFIG_PATH5, "utf-8");
+    const content = readFileSync26(CONFIG_PATH5, "utf-8");
     const match = content.match(/^SYNKRO_LOCAL_INFERENCE='([^']*)'/m);
     return match?.[1] === "yes";
   } catch {
@@ -11266,7 +11462,7 @@ var CONFIG_PATH5;
 var init_settings = __esm({
   "cli/local-cc/settings.ts"() {
     "use strict";
-    CONFIG_PATH5 = join26(homedir27(), ".synkro", "config.env");
+    CONFIG_PATH5 = join27(homedir28(), ".synkro", "config.env");
   }
 });
 
@@ -11275,11 +11471,11 @@ var localCc_exports = {};
 __export(localCc_exports, {
   localCcCommand: () => localCcCommand
 });
-import { spawnSync as spawnSync10 } from "child_process";
-import { homedir as homedir28 } from "os";
-import { join as join27 } from "path";
+import { spawnSync as spawnSync11 } from "child_process";
+import { homedir as homedir29 } from "os";
+import { join as join28 } from "path";
 import { readFileSync as fsReadFileSync, existsSync as fsExistsSync } from "fs";
-import { existsSync as existsSync28, readFileSync as readFileSync26, writeFileSync as writeFileSync20 } from "fs";
+import { existsSync as existsSync29, readFileSync as readFileSync27, writeFileSync as writeFileSync21 } from "fs";
 function deploymentMode() {
   const env = (process.env.SYNKRO_DEPLOYMENT_MODE || "").toLowerCase();
   if (env === "docker") return "docker";
@@ -11385,15 +11581,15 @@ TROUBLESHOOTING
 `);
 }
 function readGatewayUrl() {
-  if (existsSync28(CONFIG_PATH6)) {
-    const m = readFileSync26(CONFIG_PATH6, "utf-8").match(/^SYNKRO_GATEWAY_URL='([^']*)'/m);
+  if (existsSync29(CONFIG_PATH6)) {
+    const m = readFileSync27(CONFIG_PATH6, "utf-8").match(/^SYNKRO_GATEWAY_URL='([^']*)'/m);
     if (m) return m[1];
   }
   return "https://api.synkro.sh";
 }
 function updateLocalInferenceFlag(enabled) {
-  if (!existsSync28(CONFIG_PATH6)) return;
-  let content = readFileSync26(CONFIG_PATH6, "utf-8");
+  if (!existsSync29(CONFIG_PATH6)) return;
+  let content = readFileSync27(CONFIG_PATH6, "utf-8");
   const flag = enabled ? "yes" : "no";
   if (content.includes("SYNKRO_LOCAL_INFERENCE=")) {
     content = content.replace(/^SYNKRO_LOCAL_INFERENCE='[^']*'/m, `SYNKRO_LOCAL_INFERENCE='${flag}'`);
@@ -11402,7 +11598,7 @@ function updateLocalInferenceFlag(enabled) {
 SYNKRO_LOCAL_INFERENCE='${flag}'
 `;
   }
-  writeFileSync20(CONFIG_PATH6, content, "utf-8");
+  writeFileSync21(CONFIG_PATH6, content, "utf-8");
 }
 async function setServerGradingProvider(provider) {
   await ensureValidToken();
@@ -11456,7 +11652,7 @@ async function cmdStatus() {
   }
   const ch1Up = await isChannelAvailable();
   console.log(`Channel 1 ${CHANNEL_HOST}:${CHANNEL_PORT}: ${ch1Up ? "reachable" : "unreachable"}`);
-  const tmux1 = spawnSync10("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME}`], { encoding: "utf-8" });
+  const tmux1 = spawnSync11("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME}`], { encoding: "utf-8" });
   console.log(`tmux '${TMUX_SESSION_NAME}': ${tmux1.status === 0 ? "live" : "absent"}`);
   const t2 = findTask(CHANNEL_SECONDARY);
   if (!t2) {
@@ -11466,7 +11662,7 @@ async function cmdStatus() {
   }
   const ch2Up = await isChannelAvailable(CHANNEL_2_PORT);
   console.log(`Channel 2 ${CHANNEL_HOST}:${CHANNEL_2_PORT}: ${ch2Up ? "reachable" : "unreachable"}`);
-  const tmux2 = spawnSync10("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME_2}`], { encoding: "utf-8" });
+  const tmux2 = spawnSync11("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME_2}`], { encoding: "utf-8" });
   console.log(`tmux '${TMUX_SESSION_NAME_2}': ${tmux2.status === 0 ? "live" : "absent"}`);
 }
 async function cmdEnable() {
@@ -11523,9 +11719,9 @@ async function warmChannels(ready1, ready2) {
 async function cmdStart(rest = []) {
   if (inDockerMode()) {
     if (rest.length > 0) {
-      const { claudeWorkers, cursorWorkers } = resolveWorkerConfig(rest);
-      console.log(`Starting synkro-server container (${claudeWorkers} claude + ${cursorWorkers} cursor)...`);
-      await dockerUpdate({ claudeWorkers, cursorWorkers });
+      const { claudeWorkers, cursorWorkers, codexWorkers } = resolveWorkerConfig(rest);
+      console.log(`Starting synkro-server container (${claudeWorkers} claude + ${cursorWorkers} cursor + ${codexWorkers} codex)...`);
+      await dockerUpdate({ claudeWorkers, cursorWorkers, codexWorkers });
       const ready3 = await waitForContainerReady(6e4);
       console.log(ready3 ? "\u2713 container ready" : "\u26A0 container did not pass /healthz within 60s");
       return;
@@ -11571,18 +11767,19 @@ async function cmdRestart(rest = []) {
     const { explicit } = resolveWorkerConfig(rest);
     let claudeWorkers;
     let cursorWorkers;
+    let codexWorkers;
     if (explicit) {
-      ({ claudeWorkers, cursorWorkers } = resolveWorkerConfig(rest));
+      ({ claudeWorkers, cursorWorkers, codexWorkers } = resolveWorkerConfig(rest));
     } else {
       const reconciled = reconcileHarness();
       if (reconciled) {
-        ({ claudeWorkers, cursorWorkers } = reconciled);
+        ({ claudeWorkers, cursorWorkers, codexWorkers } = reconciled);
       } else {
-        ({ claudeWorkers, cursorWorkers } = resolveWorkerConfig(rest));
+        ({ claudeWorkers, cursorWorkers, codexWorkers } = resolveWorkerConfig(rest));
       }
     }
-    console.log(`Restarting synkro-server container (${claudeWorkers} claude + ${cursorWorkers} cursor, pulling latest image)...`);
-    await dockerUpdate({ claudeWorkers, cursorWorkers });
+    console.log(`Restarting synkro-server container (${claudeWorkers} claude + ${cursorWorkers} cursor + ${codexWorkers} codex, pulling latest image)...`);
+    await dockerUpdate({ claudeWorkers, cursorWorkers, codexWorkers });
     const ready = await waitForContainerReady(6e4);
     console.log(ready ? "\u2713 container ready" : "\u26A0 container did not pass /healthz within 60s");
     if (ready) {
@@ -11672,7 +11869,7 @@ function cmdLogs(rest) {
       }
       return "200";
     })();
-    spawnSync10("docker", ["logs", "--tail", tailArg, ...followFlag, "synkro-server"], { stdio: "inherit" });
+    spawnSync11("docker", ["logs", "--tail", tailArg, ...followFlag, "synkro-server"], { stdio: "inherit" });
     return;
   }
   for (const arg of rest) {
@@ -11720,7 +11917,7 @@ function cmdLogs(rest) {
 function cmdAttach(rest) {
   assertTmuxInstalled();
   const readonly = rest.some((a) => a === "--readonly" || a === "-r");
-  const has = spawnSync10("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME}`], { encoding: "utf-8" });
+  const has = spawnSync11("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME}`], { encoding: "utf-8" });
   if (has.status !== 0) {
     console.error(`No tmux session '${TMUX_SESSION_NAME}' running. Start it with: synkro local-cc start`);
     process.exit(1);
@@ -11733,7 +11930,7 @@ function cmdAttach(rest) {
   console.log("Detach with Ctrl-B then D. (Do not press Ctrl-C \u2014 that would interrupt claude.)");
   console.log();
   const args2 = readonly ? ["attach-session", "-r", "-t", TMUX_SESSION_NAME] : ["attach-session", "-t", TMUX_SESSION_NAME];
-  const r = spawnSync10("tmux", args2, { stdio: "inherit" });
+  const r = spawnSync11("tmux", args2, { stdio: "inherit" });
   process.exit(r.status ?? 0);
 }
 async function cmdTest() {
@@ -11834,8 +12031,8 @@ var init_localCc = __esm({
     init_install();
     init_client2();
     init_stub();
-    SYNKRO_CONFIG_PATH = join27(homedir28(), ".synkro", "config.env");
-    CONFIG_PATH6 = join27(homedir28(), ".synkro", "config.env");
+    SYNKRO_CONFIG_PATH = join28(homedir29(), ".synkro", "config.env");
+    CONFIG_PATH6 = join28(homedir29(), ".synkro", "config.env");
   }
 });
 
@@ -11844,14 +12041,14 @@ var import_exports = {};
 __export(import_exports, {
   importCommand: () => importCommand
 });
-import { existsSync as existsSync29, readFileSync as readFileSync27, readdirSync as readdirSync7 } from "fs";
-import { homedir as homedir29 } from "os";
-import { join as join28 } from "path";
+import { existsSync as existsSync30, readFileSync as readFileSync28, readdirSync as readdirSync7 } from "fs";
+import { homedir as homedir30 } from "os";
+import { join as join29 } from "path";
 import { execSync as execSync6 } from "child_process";
 import { createInterface as createInterface4 } from "readline";
 function readMcpJwt() {
   try {
-    return readFileSync27(join28(homedir29(), ".synkro", ".mcp-jwt"), "utf-8").trim();
+    return readFileSync28(join29(homedir30(), ".synkro", ".mcp-jwt"), "utf-8").trim();
   } catch {
     return "";
   }
@@ -11859,7 +12056,7 @@ function readMcpJwt() {
 function readConfigEnv2() {
   const out = {};
   try {
-    for (const line of readFileSync27(CONFIG_PATH7, "utf-8").split("\n")) {
+    for (const line of readFileSync28(CONFIG_PATH7, "utf-8").split("\n")) {
       const t = line.trim();
       if (!t || t.startsWith("#")) continue;
       const eq = t.indexOf("=");
@@ -11871,8 +12068,8 @@ function readConfigEnv2() {
 }
 function projectsFolder() {
   const sanitized = process.cwd().replace(/\//g, "-");
-  const dir = join28(homedir29(), ".claude", "projects", sanitized);
-  return existsSync29(dir) ? dir : null;
+  const dir = join29(homedir30(), ".claude", "projects", sanitized);
+  return existsSync30(dir) ? dir : null;
 }
 function repoName() {
   try {
@@ -11911,7 +12108,7 @@ function extractToolResultText(content, e) {
   return t;
 }
 function parseSession(filePath, sessionId) {
-  const lines = readFileSync27(filePath, "utf-8").split("\n").filter(Boolean);
+  const lines = readFileSync28(filePath, "utf-8").split("\n").filter(Boolean);
   const messages = [];
   const actions = [];
   let step = 0;
@@ -11991,7 +12188,7 @@ async function importCommand() {
       return;
     }
   }
-  const sessions = files.map((f) => parseSession(join28(dir, f), f.replace(".jsonl", ""))).filter((s) => s.messages.length > 0);
+  const sessions = files.map((f) => parseSession(join29(dir, f), f.replace(".jsonl", ""))).filter((s) => s.messages.length > 0);
   const totalMsgs = sessions.reduce((n, s) => n + s.messages.length, 0);
   let ok = 0, fail = 0;
   if (isCloud) {
@@ -12066,7 +12263,7 @@ var init_import = __esm({
   "cli/commands/import.ts"() {
     "use strict";
     init_stub();
-    CONFIG_PATH7 = join28(homedir29(), ".synkro", "config.env");
+    CONFIG_PATH7 = join29(homedir30(), ".synkro", "config.env");
   }
 });
 
@@ -12108,10 +12305,10 @@ var init_packVerify = __esm({
 });
 
 // cli/installer/lockfile.ts
-import { existsSync as existsSync30, readFileSync as readFileSync28, writeFileSync as writeFileSync21 } from "fs";
-import { join as join29 } from "path";
+import { existsSync as existsSync31, readFileSync as readFileSync29, writeFileSync as writeFileSync22 } from "fs";
+import { join as join30 } from "path";
 function lockPath(repoRoot2) {
-  return join29(repoRoot2, LOCK_FILE);
+  return join30(repoRoot2, LOCK_FILE);
 }
 function writeLockfile(repoRoot2, entries) {
   const sorted = [...entries].sort((a, b) => a.ref.localeCompare(b.ref));
@@ -12129,7 +12326,7 @@ function writeLockfile(repoRoot2, entries) {
       ""
     ])
   ].join("\n");
-  writeFileSync21(lockPath(repoRoot2), body, "utf-8");
+  writeFileSync22(lockPath(repoRoot2), body, "utf-8");
 }
 var LOCK_FILE;
 var init_lockfile = __esm({
@@ -12144,9 +12341,9 @@ var sync_exports = {};
 __export(sync_exports, {
   syncCommand: () => syncCommand
 });
-import { existsSync as existsSync31, mkdirSync as mkdirSync17, readdirSync as readdirSync8, rmSync as rmSync3, writeFileSync as writeFileSync22 } from "fs";
-import { homedir as homedir30 } from "os";
-import { join as join30 } from "path";
+import { existsSync as existsSync32, mkdirSync as mkdirSync18, readdirSync as readdirSync8, rmSync as rmSync4, writeFileSync as writeFileSync23 } from "fs";
+import { homedir as homedir31 } from "os";
+import { join as join31 } from "path";
 function cacheKey(ref, version) {
   return ref.replace(/\//g, "__").replace(/[^\w.@-]/g, "_") + "@" + version + ".json";
 }
@@ -12177,8 +12374,8 @@ async function syncCommand(_args = []) {
   }
   const gateway = (process.env.SYNKRO_GATEWAY_URL || "https://api.synkro.sh").replace(/\/$/, "");
   const cloud = process.env.SYNKRO_DEPLOY_LOCATION === "cloud";
-  const cacheDir = join30(homedir30(), ".synkro", "cache", "packs");
-  if (!cloud) mkdirSync17(cacheDir, { recursive: true });
+  const cacheDir = join31(homedir31(), ".synkro", "cache", "packs");
+  if (!cloud) mkdirSync18(cacheDir, { recursive: true });
   console.log(`Syncing ${refs.length} standard(s) from the registry\u2026`);
   const lock = [];
   const keptCacheFiles = /* @__PURE__ */ new Set();
@@ -12206,7 +12403,7 @@ async function syncCommand(_args = []) {
     if (!cloud) {
       const fname = cacheKey(ref, data.version);
       keptCacheFiles.add(fname);
-      writeFileSync22(join30(cacheDir, fname), JSON.stringify({
+      writeFileSync23(join31(cacheDir, fname), JSON.stringify({
         ref,
         version: data.version,
         digest: data.digest,
@@ -12218,11 +12415,11 @@ async function syncCommand(_args = []) {
     const ruleCount = Array.isArray(pack.rules) ? pack.rules.length : 0;
     console.log(`  \u2713 ${ref}:${data.version} \u2014 verified (${ruleCount} rule${ruleCount === 1 ? "" : "s"})`);
   }
-  if (!cloud && existsSync31(cacheDir)) {
+  if (!cloud && existsSync32(cacheDir)) {
     for (const f of readdirSync8(cacheDir)) {
       if (f.endsWith(".json") && !keptCacheFiles.has(f)) {
         try {
-          rmSync3(join30(cacheDir, f));
+          rmSync4(join31(cacheDir, f));
         } catch {
         }
       }
@@ -12251,13 +12448,13 @@ var whoami_exports = {};
 __export(whoami_exports, {
   whoamiCommand: () => whoamiCommand
 });
-import { readFileSync as readFileSync29, existsSync as existsSync32 } from "fs";
-import { join as join31 } from "path";
-import { homedir as homedir31 } from "os";
+import { readFileSync as readFileSync30, existsSync as existsSync33 } from "fs";
+import { join as join32 } from "path";
+import { homedir as homedir32 } from "os";
 function readConfigEnv3() {
-  if (!existsSync32(CONFIG_PATH8)) return {};
+  if (!existsSync33(CONFIG_PATH8)) return {};
   const out = {};
-  for (const line of readFileSync29(CONFIG_PATH8, "utf-8").split("\n")) {
+  for (const line of readFileSync30(CONFIG_PATH8, "utf-8").split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#")) continue;
     const eq = t.indexOf("=");
@@ -12267,8 +12464,8 @@ function readConfigEnv3() {
 }
 function jwtStatus() {
   try {
-    if (!existsSync32(JWT_PATH2)) return { status: "none" };
-    const jwt2 = readFileSync29(JWT_PATH2, "utf-8").trim();
+    if (!existsSync33(JWT_PATH2)) return { status: "none" };
+    const jwt2 = readFileSync30(JWT_PATH2, "utf-8").trim();
     if (!jwt2) return { status: "none" };
     const payload = jwt2.split(".")[1];
     if (!payload) return { status: "valid" };
@@ -12326,13 +12523,13 @@ async function whoamiCommand(args2 = []) {
   console.log("synkro identity");
   for (const [k, v] of rows) console.log(`  ${k.padEnd(width)}  ${v}`);
 }
-var SYNKRO_DIR14, CONFIG_PATH8, JWT_PATH2, GRADING_LABEL;
+var SYNKRO_DIR15, CONFIG_PATH8, JWT_PATH2, GRADING_LABEL;
 var init_whoami = __esm({
   "cli/commands/whoami.ts"() {
     "use strict";
-    SYNKRO_DIR14 = join31(homedir31(), ".synkro");
-    CONFIG_PATH8 = join31(SYNKRO_DIR14, "config.env");
-    JWT_PATH2 = join31(SYNKRO_DIR14, ".mcp-jwt");
+    SYNKRO_DIR15 = join32(homedir32(), ".synkro");
+    CONFIG_PATH8 = join32(SYNKRO_DIR15, "config.env");
+    JWT_PATH2 = join32(SYNKRO_DIR15, ".mcp-jwt");
     GRADING_LABEL = {
       local: "on-device worker pool",
       cloud: "Synkro Cloud worker pool",
@@ -12377,12 +12574,12 @@ __export(linear_exports, {
   formatLinks: () => formatLinks,
   linearCommand: () => linearCommand
 });
-import { readFileSync as readFileSync30 } from "fs";
-import { homedir as homedir32 } from "os";
-import { join as join32 } from "path";
+import { readFileSync as readFileSync31 } from "fs";
+import { homedir as homedir33 } from "os";
+import { join as join33 } from "path";
 function mcpJwt() {
   try {
-    return readFileSync30(join32(SYNKRO_DIR15, ".mcp-jwt"), "utf-8").trim();
+    return readFileSync31(join33(SYNKRO_DIR16, ".mcp-jwt"), "utf-8").trim();
   } catch {
     return "";
   }
@@ -12417,11 +12614,11 @@ async function linearCommand(_args = []) {
   }
   console.log(formatLinks(links));
 }
-var SYNKRO_DIR15, PORT2, BASE;
+var SYNKRO_DIR16, PORT2, BASE;
 var init_linear = __esm({
   "cli/commands/linear.ts"() {
     "use strict";
-    SYNKRO_DIR15 = join32(homedir32(), ".synkro");
+    SYNKRO_DIR16 = join33(homedir33(), ".synkro");
     PORT2 = process.env.SYNKRO_MCP_PORT || "18931";
     BASE = `http://127.0.0.1:${PORT2}`;
   }
@@ -12429,7 +12626,7 @@ var init_linear = __esm({
 
 // cli/scanning/cveReachability.ts
 import { parse } from "@babel/parser";
-import { readFileSync as readFileSync31 } from "fs";
+import { readFileSync as readFileSync32 } from "fs";
 function walk(node, visit) {
   if (!node || typeof node.type !== "string") return;
   visit(node);
@@ -12570,10 +12767,10 @@ var init_cveReachability = __esm({
 });
 
 // cli/reachability/reachabilityScan.ts
-import { spawnSync as spawnSync11, execFileSync as execFileSync5 } from "child_process";
-import { readFileSync as readFileSync32, writeFileSync as writeFileSync23, existsSync as existsSync33, readdirSync as readdirSync9 } from "fs";
-import { join as join33 } from "path";
-import { homedir as homedir33 } from "os";
+import { spawnSync as spawnSync12, execFileSync as execFileSync5 } from "child_process";
+import { readFileSync as readFileSync33, writeFileSync as writeFileSync24, existsSync as existsSync34, readdirSync as readdirSync9 } from "fs";
+import { join as join34 } from "path";
+import { homedir as homedir34 } from "os";
 import { createRequire } from "module";
 function walkSourceFiles(repoRoot2, maxFiles = 4e3, maxBytes = 5e5) {
   const SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", "coverage", ".next", ".turbo", "out", ".cache", ".synkro", ".claude", "vendor", "__tests__", "test-results"]);
@@ -12590,7 +12787,7 @@ function walkSourceFiles(repoRoot2, maxFiles = 4e3, maxBytes = 5e5) {
     }
     for (const e of ents) {
       if (files.length >= maxFiles) break;
-      const full = join33(dir, e.name);
+      const full = join34(dir, e.name);
       if (e.isDirectory()) {
         if (!SKIP.has(e.name) && !e.name.startsWith(".")) stack.push(full);
         continue;
@@ -12598,7 +12795,7 @@ function walkSourceFiles(repoRoot2, maxFiles = 4e3, maxBytes = 5e5) {
       if (!EXT.test(e.name) || e.name.endsWith(".d.ts")) continue;
       const rel = full.startsWith(repoRoot2 + "/") ? full.slice(repoRoot2.length + 1) : full;
       try {
-        const content = readFileSync32(full, "utf8");
+        const content = readFileSync33(full, "utf8");
         if (content.length <= maxBytes) files.push({ path: rel, content });
       } catch {
       }
@@ -12617,12 +12814,12 @@ function cleanVersion(spec) {
 function gatherManifestVersions(repoRoot2) {
   const out = {};
   const dirs = [repoRoot2];
-  const pkgsDir = join33(repoRoot2, "packages");
-  if (existsSync33(pkgsDir)) {
+  const pkgsDir = join34(repoRoot2, "packages");
+  if (existsSync34(pkgsDir)) {
     try {
       for (const d of readdirSync9(pkgsDir)) {
-        const pd = join33(pkgsDir, d);
-        if (existsSync33(join33(pd, "package.json"))) dirs.push(pd);
+        const pd = join34(pkgsDir, d);
+        if (existsSync34(join34(pd, "package.json"))) dirs.push(pd);
       }
     } catch {
     }
@@ -12631,7 +12828,7 @@ function gatherManifestVersions(repoRoot2) {
   for (const dir of dirs) {
     let pkg;
     try {
-      pkg = JSON.parse(readFileSync32(join33(dir, "package.json"), "utf8"));
+      pkg = JSON.parse(readFileSync33(join34(dir, "package.json"), "utf8"));
     } catch {
       continue;
     }
@@ -12651,28 +12848,28 @@ function findJelly(repoRoot2) {
   try {
     const pkgJson = require2.resolve("@cs-au-dk/jelly/package.json");
     const dir = pkgJson.slice(0, pkgJson.length - "package.json".length);
-    const pkg = JSON.parse(readFileSync32(pkgJson, "utf8"));
+    const pkg = JSON.parse(readFileSync33(pkgJson, "utf8"));
     const bin = typeof pkg.bin === "string" ? pkg.bin : pkg.bin && (pkg.bin.jelly || pkg.bin[Object.keys(pkg.bin)[0]]);
     if (bin) {
-      const p = join33(dir, bin);
-      if (existsSync33(p)) return p;
+      const p = join34(dir, bin);
+      if (existsSync34(p)) return p;
     }
   } catch {
   }
   for (const base of [repoRoot2, process.cwd()]) {
-    const b = join33(base, "node_modules", ".bin", "jelly");
-    if (existsSync33(b)) return b;
+    const b = join34(base, "node_modules", ".bin", "jelly");
+    if (existsSync34(b)) return b;
   }
   return null;
 }
 function findEntries(repoRoot2) {
   const dirs = [repoRoot2];
-  const pkgsDir = join33(repoRoot2, "packages");
-  if (existsSync33(pkgsDir)) {
+  const pkgsDir = join34(repoRoot2, "packages");
+  if (existsSync34(pkgsDir)) {
     try {
       for (const d of readdirSync9(pkgsDir)) {
-        const pd = join33(pkgsDir, d);
-        if (existsSync33(join33(pd, "package.json"))) dirs.push(pd);
+        const pd = join34(pkgsDir, d);
+        if (existsSync34(join34(pd, "package.json"))) dirs.push(pd);
       }
     } catch {
     }
@@ -12680,12 +12877,12 @@ function findEntries(repoRoot2) {
   const entries = [];
   for (const dir of dirs) {
     try {
-      const pkg = JSON.parse(readFileSync32(join33(dir, "package.json"), "utf8"));
+      const pkg = JSON.parse(readFileSync33(join34(dir, "package.json"), "utf8"));
       const cands = [pkg.source, pkg.module, pkg.main, "src/index.ts", "src/index.js", "src/main.ts", "src/server.ts", "index.ts", "index.js"];
       for (const c of cands) {
         if (typeof c !== "string") continue;
-        const f = join33(dir, c);
-        if (existsSync33(f)) {
+        const f = join34(dir, c);
+        if (existsSync34(f)) {
           entries.push(f);
           break;
         }
@@ -12718,9 +12915,9 @@ function parseApiUsage(log) {
 }
 function runReachabilityScan(repoRoot2, opts = {}) {
   const commit = currentCommit(repoRoot2);
-  if (!opts.force && commit && existsSync33(REACHABILITY_PATH)) {
+  if (!opts.force && commit && existsSync34(REACHABILITY_PATH)) {
     try {
-      const prev = JSON.parse(readFileSync32(REACHABILITY_PATH, "utf8"));
+      const prev = JSON.parse(readFileSync33(REACHABILITY_PATH, "utf8"));
       if (prev.commit === commit) return { ok: true, cached: true, packages: Object.keys(prev.packages || {}).length };
     } catch {
     }
@@ -12771,7 +12968,7 @@ function runReachabilityScan(repoRoot2, opts = {}) {
   if (jelly) {
     const entries = findEntries(repoRoot2);
     if (entries.length > 0) {
-      const r = spawnSync11(
+      const r = spawnSync12(
         process.execPath,
         [jelly, "-b", repoRoot2, "--api-usage", ...entries],
         { encoding: "utf8", timeout: opts.timeoutMs ?? 18e4, maxBuffer: 2e8 }
@@ -12809,7 +13006,7 @@ function runReachabilityScan(repoRoot2, opts = {}) {
   if (Object.keys(packages).length === 0) return { ok: false, reason: "no package usage found (no jelly output, no AST imports)" };
   const file = { generatedAt: (/* @__PURE__ */ new Date()).toISOString(), commit, tool, packages, versions: gatherManifestVersions(repoRoot2) };
   try {
-    writeFileSync23(REACHABILITY_PATH, JSON.stringify(file, null, 2));
+    writeFileSync24(REACHABILITY_PATH, JSON.stringify(file, null, 2));
   } catch (e) {
     return { ok: false, reason: "write failed: " + String(e.message || e) };
   }
@@ -12821,7 +13018,7 @@ var init_reachabilityScan = __esm({
     "use strict";
     init_cveReachability();
     require2 = createRequire(import.meta.url);
-    REACHABILITY_PATH = join33(homedir33(), ".synkro", "reachability.json");
+    REACHABILITY_PATH = join34(homedir34(), ".synkro", "reachability.json");
   }
 });
 
@@ -12830,15 +13027,15 @@ var reachabilityScan_exports = {};
 __export(reachabilityScan_exports, {
   reachabilityScanCommand: () => reachabilityScanCommand
 });
-import { readFileSync as readFileSync33, existsSync as existsSync34 } from "fs";
-import { join as join34 } from "path";
-import { homedir as homedir34 } from "os";
+import { readFileSync as readFileSync34, existsSync as existsSync35 } from "fs";
+import { join as join35 } from "path";
+import { homedir as homedir35 } from "os";
 import { execFileSync as execFileSync6 } from "child_process";
 function readConfigEnv4() {
-  const p = join34(SYNKRO_DIR16, "config.env");
-  if (!existsSync34(p)) return {};
+  const p = join35(SYNKRO_DIR17, "config.env");
+  if (!existsSync35(p)) return {};
   const out = {};
-  for (const line of readFileSync33(p, "utf-8").split("\n")) {
+  for (const line of readFileSync34(p, "utf-8").split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#")) continue;
     const eq = t.indexOf("=");
@@ -12870,11 +13067,11 @@ async function pushToCloud(cfg, repo) {
   while (gwBase.endsWith("/")) gwBase = gwBase.slice(0, -1);
   let jwt2 = "";
   try {
-    jwt2 = readFileSync33(join34(SYNKRO_DIR16, ".mcp-jwt"), "utf-8").trim();
+    jwt2 = readFileSync34(join35(SYNKRO_DIR17, ".mcp-jwt"), "utf-8").trim();
   } catch {
   }
-  if (!jwt2 || !existsSync34(REACHABILITY_PATH)) return;
-  const body = readFileSync33(REACHABILITY_PATH, "utf-8");
+  if (!jwt2 || !existsSync35(REACHABILITY_PATH)) return;
+  const body = readFileSync34(REACHABILITY_PATH, "utf-8");
   try {
     const resp = await fetch(gwBase + "/api/v1/reachability?repo=" + encodeURIComponent(repo), {
       method: "POST",
@@ -12901,12 +13098,12 @@ async function reachabilityScanCommand(args2 = []) {
   const isCloud = cfg.SYNKRO_DEPLOY_LOCATION === "cloud" || cfg.SYNKRO_STORAGE_MODE === "cloud";
   if (isCloud) await pushToCloud(cfg, cfg.SYNKRO_CONNECTED_REPO || repoSlug(root));
 }
-var SYNKRO_DIR16;
+var SYNKRO_DIR17;
 var init_reachabilityScan2 = __esm({
   "cli/commands/reachabilityScan.ts"() {
     "use strict";
     init_reachabilityScan();
-    SYNKRO_DIR16 = join34(homedir34(), ".synkro");
+    SYNKRO_DIR17 = join35(homedir35(), ".synkro");
   }
 });
 
@@ -12935,9 +13132,9 @@ async function startCommand(rest = []) {
   assertDockerAvailable();
   const cfg = resolveWorkerConfig(rest);
   if (cfg.explicit) {
-    console.log(`Synkro: starting server (${cfg.claudeWorkers} claude + ${cfg.cursorWorkers} cursor)
+    console.log(`Synkro: starting server (${cfg.claudeWorkers} claude + ${cfg.cursorWorkers} cursor + ${cfg.codexWorkers} codex)
 `);
-    await dockerUpdate({ claudeWorkers: cfg.claudeWorkers, cursorWorkers: cfg.cursorWorkers, connectedRepo: resolveConnectedRepo() });
+    await dockerUpdate({ claudeWorkers: cfg.claudeWorkers, cursorWorkers: cfg.cursorWorkers, codexWorkers: cfg.codexWorkers, connectedRepo: resolveConnectedRepo() });
     const ready = await waitForContainerReady(6e4);
     if (!ready) {
       console.error("\n\u26A0 container did not pass /healthz within 60s");
@@ -12964,10 +13161,11 @@ async function updateCommand() {
   }
   const claudeWorkers = cfg.claudeWorkers ?? 8;
   const cursorWorkers = cfg.cursorWorkers ?? 0;
+  const codexWorkers = cfg.codexWorkers ?? 0;
   console.log("Synkro: updating to the latest container image");
-  console.log(`  preserving pool: ${claudeWorkers} claude + ${cursorWorkers} cursor worker(s)
+  console.log(`  preserving pool: ${claudeWorkers} claude + ${cursorWorkers} cursor + ${codexWorkers} codex worker(s)
 `);
-  await dockerUpdate({ claudeWorkers, cursorWorkers, connectedRepo: resolveConnectedRepo() });
+  await dockerUpdate({ claudeWorkers, cursorWorkers, codexWorkers, connectedRepo: resolveConnectedRepo() });
   const ready = await waitForContainerReady(9e4);
   if (!ready) {
     console.error("\n\u26A0 container did not pass its health check within 90s \u2014 check: docker logs synkro-server");
@@ -12991,16 +13189,18 @@ async function restartCommand(rest = []) {
   const cfg = resolveWorkerConfig(rest);
   let claudeWorkers = cfg.claudeWorkers;
   let cursorWorkers = cfg.cursorWorkers;
+  let codexWorkers = cfg.codexWorkers;
   if (!cfg.explicit) {
     const reconciled = reconcileHarness();
     if (reconciled) {
       claudeWorkers = reconciled.claudeWorkers;
       cursorWorkers = reconciled.cursorWorkers;
+      codexWorkers = reconciled.codexWorkers;
     }
   }
-  console.log(`Synkro: restarting server (${claudeWorkers} claude + ${cursorWorkers} cursor)
+  console.log(`Synkro: restarting server (${claudeWorkers} claude + ${cursorWorkers} cursor + ${codexWorkers} codex)
 `);
-  await dockerUpdate({ claudeWorkers, cursorWorkers, connectedRepo: resolveConnectedRepo() });
+  await dockerUpdate({ claudeWorkers, cursorWorkers, codexWorkers, connectedRepo: resolveConnectedRepo() });
   const ready = await waitForContainerReady(6e4);
   if (!ready) {
     console.error("\n\u26A0 container did not pass /healthz within 60s");
@@ -13028,13 +13228,13 @@ var config_exports = {};
 __export(config_exports, {
   configCommand: () => configCommand
 });
-import { readFileSync as readFileSync34, writeFileSync as writeFileSync24, existsSync as existsSync35 } from "fs";
-import { join as join35 } from "path";
-import { homedir as homedir35 } from "os";
+import { readFileSync as readFileSync35, writeFileSync as writeFileSync25, existsSync as existsSync36 } from "fs";
+import { join as join36 } from "path";
+import { homedir as homedir36 } from "os";
 function readConfigEnv5() {
-  if (!existsSync35(CONFIG_PATH9)) return {};
+  if (!existsSync36(CONFIG_PATH9)) return {};
   const out = {};
-  for (const line of readFileSync34(CONFIG_PATH9, "utf-8").split("\n")) {
+  for (const line of readFileSync35(CONFIG_PATH9, "utf-8").split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#")) continue;
     const eq = t.indexOf("=");
@@ -13043,11 +13243,11 @@ function readConfigEnv5() {
   return out;
 }
 function updateConfigValue(key, value) {
-  if (!existsSync35(CONFIG_PATH9)) {
+  if (!existsSync36(CONFIG_PATH9)) {
     console.error("No config found. Run `synkro install` first.");
     process.exit(1);
   }
-  const lines = readFileSync34(CONFIG_PATH9, "utf-8").split("\n");
+  const lines = readFileSync35(CONFIG_PATH9, "utf-8").split("\n");
   const pattern = new RegExp(`^${key}=`);
   let found = false;
   const updated = lines.map((line) => {
@@ -13058,7 +13258,7 @@ function updateConfigValue(key, value) {
     return line;
   });
   if (!found) updated.splice(updated.length - 1, 0, `${key}='${value}'`);
-  writeFileSync24(CONFIG_PATH9, updated.join("\n"), "utf-8");
+  writeFileSync25(CONFIG_PATH9, updated.join("\n"), "utf-8");
 }
 function resolveInferenceMode(cfg) {
   if ((cfg.SYNKRO_GRADING_MODE || "local") === "byok") return "byok";
@@ -13210,14 +13410,14 @@ To change:`);
   }
   if (inferenceValue !== "cloud") await reconcileContainer();
 }
-var SYNKRO_DIR17, CONFIG_PATH9;
+var SYNKRO_DIR18, CONFIG_PATH9;
 var init_config = __esm({
   "cli/commands/config.ts"() {
     "use strict";
     init_stub();
     init_optout();
-    SYNKRO_DIR17 = join35(homedir35(), ".synkro");
-    CONFIG_PATH9 = join35(SYNKRO_DIR17, "config.env");
+    SYNKRO_DIR18 = join36(homedir36(), ".synkro");
+    CONFIG_PATH9 = join36(SYNKRO_DIR18, "config.env");
   }
 });
 
@@ -13406,14 +13606,14 @@ Usage:
 });
 
 // cli/bootstrap.js
-import { readFileSync as readFileSync35, existsSync as existsSync36 } from "fs";
+import { readFileSync as readFileSync36, existsSync as existsSync37 } from "fs";
 import { resolve as resolve5 } from "path";
 var envCandidates = [
   resolve5(process.env.HOME ?? "", ".synkro", "config.env")
 ];
 for (const envPath of envCandidates) {
-  if (!existsSync36(envPath)) continue;
-  const envContent = readFileSync35(envPath, "utf-8");
+  if (!existsSync37(envPath)) continue;
+  const envContent = readFileSync36(envPath, "utf-8");
   for (const line of envContent.split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -13430,7 +13630,7 @@ var subArgs = args.slice(1);
 var isDetachedChild = process.env.SYNKRO_TELEMETRY_DETACHED === "1";
 var FLUSH_SKIP = /* @__PURE__ */ new Set(["grade", "version", "--version", "-v", "help", "--help", "-h", ""]);
 function printVersion() {
-  console.log("1.7.86");
+  console.log("1.7.87");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents