@synkro-sh/cli 1.7.88 → 1.7.90

package/dist/bootstrap.js

@@ -147,7 +147,7 @@ function getIdentity() {
   if (cached2) return cached2;
   let cliVersion = "0.0.0";
   try {
-    cliVersion = "1.7.88";
+    cliVersion = "1.7.90";
   } catch {
   }
   const creds = loadCredentialsIdentity();
@@ -283,6 +283,100 @@ var init_emit = __esm({
   }
 });
 
+// cli/telemetry/httpSql.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join4 } from "path";
+function quoteIdentifier(value) {
+  if (!/^[a-z_][a-z0-9_]*$/i.test(value)) throw new Error("invalid SQL identifier");
+  return `"${value}"`;
+}
+function shiftPlaceholders(text, offset) {
+  return text.replace(/\$(\d+)/g, (_, raw) => `$${Number(raw) + offset}`);
+}
+function bulkFragment(rows, columns) {
+  if (!rows.length || !columns.length) throw new Error("empty SQL helper");
+  const params = [];
+  const tuples = rows.map((row) => {
+    const placeholders = columns.map((column) => {
+      let value = row[column];
+      let cast = "";
+      if (column === "context" && typeof value === "object" && value !== null) {
+        value = JSON.stringify(value);
+        cast = "::jsonb";
+      }
+      params.push(value ?? null);
+      return `$${params.length}${cast}`;
+    });
+    return `(${placeholders.join(", ")})`;
+  });
+  return {
+    [FRAGMENT]: true,
+    text: `(${columns.map(quoteIdentifier).join(", ")}) VALUES ${tuples.join(", ")}`,
+    params
+  };
+}
+function createTelemetryHttpSql(options = {}) {
+  const port = options.port ?? Number.parseInt(process.env.SYNKRO_HOST_MCP_PORT || "18931", 10);
+  const endpoint = `http://127.0.0.1:${port}/api/local/telemetry/query`;
+  const token = options.token ?? readFileSync3(join4(homedir4(), ".synkro", ".mcp-jwt"), "utf-8").trim();
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const query = async (text, params = []) => {
+    const response = await fetchImpl(endpoint, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ text, params }),
+      signal: AbortSignal.timeout(3e4)
+    });
+    const payload = await response.json().catch(() => ({}));
+    if (!response.ok) throw new Error(payload.error || `local telemetry query failed (${response.status})`);
+    const rows = Array.isArray(payload.rows) ? payload.rows : [];
+    Object.defineProperty(rows, "count", {
+      value: Number(payload.count ?? rows.length),
+      enumerable: false,
+      configurable: true
+    });
+    return rows;
+  };
+  const sql = function(first, ...values) {
+    if (Array.isArray(first) && "raw" in first) {
+      const strings = first;
+      let text = strings[0];
+      const params = [];
+      for (let i = 0; i < values.length; i++) {
+        const value = values[i];
+        if (value && typeof value === "object" && value[FRAGMENT]) {
+          text += shiftPlaceholders(value.text, params.length);
+          params.push(...value.params);
+        } else {
+          params.push(value);
+          text += `$${params.length}`;
+        }
+        text += strings[i + 1];
+      }
+      return query(text, params);
+    }
+    if (Array.isArray(first)) {
+      return bulkFragment(first, values);
+    }
+    throw new Error("unsupported SQL invocation");
+  };
+  sql.unsafe = query;
+  sql.end = async () => {
+  };
+  return sql;
+}
+var FRAGMENT;
+var init_httpSql = __esm({
+  "cli/telemetry/httpSql.ts"() {
+    "use strict";
+    FRAGMENT = /* @__PURE__ */ Symbol("synkro-http-sql-fragment");
+  }
+});
+
 // cli/telemetry/db.ts
 var db_exports = {};
 __export(db_exports, {
@@ -290,24 +384,11 @@ __export(db_exports, {
   connectDb: () => connectDb,
   resetDbForTests: () => resetDbForTests
 });
-import postgres from "postgres";
 async function connectDb() {
   if (cached3) return cached3;
   if (initFailedAt && Date.now() - initFailedAt < INIT_RETRY_MS) return null;
   try {
-    const sql = postgres({
-      host: PGLITE_HOST,
-      port: PGLITE_PORT,
-      username: PGLITE_USER,
-      database: PGLITE_DB,
-      // max:1 mirrors synkro-server — PGlite is single-threaded; multiple
-      // sockets just queue at the multiplexer.
-      max: 1,
-      connect_timeout: 2,
-      idle_timeout: 30,
-      onnotice: () => {
-      }
-    });
+    const sql = createTelemetryHttpSql();
     await sql`SELECT 1`;
     cached3 = sql;
     initFailedAt = 0;
@@ -317,7 +398,7 @@ async function connectDb() {
     initFailedAt = Date.now();
     if (process.env.SYNKRO_TELEMETRY_DEBUG === "1") {
       const msg = err instanceof Error ? err.message : String(err);
-      process.stderr.write(`[synkro] telemetry pglite unreachable at ${PGLITE_HOST}:${PGLITE_PORT}: ${msg}
+      process.stderr.write(`[synkro] local telemetry API unreachable: ${msg}
 `);
     }
     return null;
@@ -354,17 +435,11 @@ function resetDbForTests() {
   initFailedAt = 0;
   migrated = false;
 }
-var PGLITE_HOST, PGLITE_PORT, PGLITE_USER, PGLITE_DB, SCHEMA_VERSION, cached3, migrated, INIT_RETRY_MS, initFailedAt, MIGRATION_V1;
+var SCHEMA_VERSION, cached3, migrated, INIT_RETRY_MS, initFailedAt, MIGRATION_V1;
 var init_db = __esm({
   "cli/telemetry/db.ts"() {
     "use strict";
-    PGLITE_HOST = process.env.SYNKRO_PGLITE_HOST || "127.0.0.1";
-    PGLITE_PORT = parseInt(
-      process.env.SYNKRO_PGLITE_PORT || process.env.SYNKRO_HOST_PGLITE_PORT || "15433",
-      10
-    );
-    PGLITE_USER = process.env.SYNKRO_PGLITE_USER || "postgres";
-    PGLITE_DB = process.env.SYNKRO_PGLITE_DB || "postgres";
+    init_httpSql();
     SCHEMA_VERSION = 1;
     cached3 = null;
     migrated = false;
@@ -438,9 +513,9 @@ var init_db = __esm({
 });
 
 // cli/telemetry/drain.ts
-import { openSync, closeSync, fstatSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2, appendFileSync as appendFileSync2, unlinkSync, mkdirSync as mkdirSync3, renameSync as renameSync2, existsSync as existsSync4 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join4 } from "path";
+import { openSync, closeSync, fstatSync, readFileSync as readFileSync4, writeFileSync as writeFileSync2, appendFileSync as appendFileSync2, unlinkSync, mkdirSync as mkdirSync3, renameSync as renameSync2, existsSync as existsSync4 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join5 } from "path";
 function ensureDir3() {
   if (!existsSync4(SYNKRO_DIR3)) mkdirSync3(SYNKRO_DIR3, { recursive: true, mode: 448 });
 }
@@ -494,7 +569,7 @@ function parseQueueFile(path) {
   if (!existsSync4(path)) return { rows: [], malformed: 0 };
   let raw;
   try {
-    raw = readFileSync3(path, "utf-8");
+    raw = readFileSync4(path, "utf-8");
   } catch {
     return { rows: [], malformed: 0 };
   }
@@ -534,7 +609,7 @@ function recoverProcessing() {
   ensureDir3();
   let body;
   try {
-    body = readFileSync3(PROCESSING_PATH, "utf-8");
+    body = readFileSync4(PROCESSING_PATH, "utf-8");
   } catch {
     return;
   }
@@ -663,39 +738,41 @@ async function insertEvents(sql, rows, mirroredIds) {
   return inserted;
 }
 async function drainToPglite() {
-  const { rows } = readQueue();
-  if (rows.length === 0) return { ok: true, ingested: 0, pending: 0, reason: "no_pending" };
+  const queued = readQueue().rows;
+  if (queued.length === 0) return { ok: true, ingested: 0, pending: 0, reason: "no_pending" };
+  const rows = queued.length > MIRROR_MAX_PER_DRAIN ? queued.slice(-MIRROR_MAX_PER_DRAIN) : queued;
   const sql = await connectDb();
-  if (!sql) return { ok: false, ingested: 0, pending: rows.length, reason: "db_unavailable" };
+  if (!sql) return { ok: false, ingested: 0, pending: queued.length, reason: "db_unavailable" };
   try {
     const ingested = await insertEvents(sql, rows);
     patchMetaCache({ last_drained_at: (/* @__PURE__ */ new Date()).toISOString() });
-    return { ok: true, ingested, pending: rows.length };
+    return { ok: true, ingested, pending: queued.length };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    return { ok: false, ingested: 0, pending: rows.length, reason: "error", error: msg };
+    return { ok: false, ingested: 0, pending: queued.length, reason: "error", error: msg };
   }
 }
-var SYNKRO_DIR3, QUEUE_LOCK, PROCESSING_PATH, CHUNK, STALE_LOCK_MS, MAX_QUEUE_ROWS;
+var SYNKRO_DIR3, QUEUE_LOCK, PROCESSING_PATH, CHUNK, MIRROR_MAX_PER_DRAIN, STALE_LOCK_MS, MAX_QUEUE_ROWS;
 var init_drain = __esm({
   "cli/telemetry/drain.ts"() {
     "use strict";
     init_db();
     init_emit();
     init_metaCache();
-    SYNKRO_DIR3 = join4(homedir4(), ".synkro");
-    QUEUE_LOCK = join4(SYNKRO_DIR3, ".telemetry-queue.lock");
+    SYNKRO_DIR3 = join5(homedir5(), ".synkro");
+    QUEUE_LOCK = join5(SYNKRO_DIR3, ".telemetry-queue.lock");
     PROCESSING_PATH = `${PENDING_PATH}.processing`;
     CHUNK = 500;
+    MIRROR_MAX_PER_DRAIN = 5e3;
     STALE_LOCK_MS = 6e4;
     MAX_QUEUE_ROWS = 5e4;
   }
 });
 
 // cli/telemetry/optout.ts
-import { chmodSync, existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join5 } from "path";
+import { chmodSync, existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join6 } from "path";
 function sanitize(raw, maxLen = 256) {
   return raw.replace(/[^\x20-\x7E]/g, "").slice(0, maxLen);
 }
@@ -708,7 +785,7 @@ function writeConfigEnvFlag(key, value) {
   let content = "";
   if (existsSync5(CONFIG_PATH2)) {
     try {
-      content = readFileSync4(CONFIG_PATH2, "utf-8");
+      content = readFileSync5(CONFIG_PATH2, "utf-8");
     } catch {
       content = "";
     }
@@ -778,8 +855,8 @@ var init_optout = __esm({
     "use strict";
     init_emit();
     init_metaCache();
-    SYNKRO_DIR4 = join5(homedir5(), ".synkro");
-    CONFIG_PATH2 = join5(SYNKRO_DIR4, "config.env");
+    SYNKRO_DIR4 = join6(homedir6(), ".synkro");
+    CONFIG_PATH2 = join6(SYNKRO_DIR4, "config.env");
     KEY_ENABLED = "SYNKRO_TELEMETRY_ENABLED";
     KEY_REMOTE = "SYNKRO_TELEMETRY_REMOTE_FLUSH";
   }
@@ -828,15 +905,15 @@ __export(flush_exports, {
   flushDetached: () => flushDetached
 });
 import { spawn } from "child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
-import { homedir as homedir6 } from "os";
-import { join as join6 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
+import { homedir as homedir7 } from "os";
+import { join as join7 } from "path";
 function readConfigEnv() {
   if (!existsSync6(CONFIG_PATH3)) return {};
   const out = {};
   let raw;
   try {
-    raw = readFileSync5(CONFIG_PATH3, "utf-8");
+    raw = readFileSync6(CONFIG_PATH3, "utf-8");
   } catch {
     return {};
   }
@@ -877,14 +954,14 @@ function resolveGatewayUrl() {
 function loadJwt() {
   if ((process.env.SYNKRO_STORAGE_MODE || "") === "cloud") {
     try {
-      const mcp = readFileSync5(join6(SYNKRO_DIR5, ".mcp-jwt"), "utf-8").trim();
+      const mcp = readFileSync6(join7(SYNKRO_DIR5, ".mcp-jwt"), "utf-8").trim();
       if (mcp) return mcp;
     } catch {
     }
   }
   try {
     if (!existsSync6(CREDS_PATH2)) return null;
-    const creds = JSON.parse(readFileSync5(CREDS_PATH2, "utf-8"));
+    const creds = JSON.parse(readFileSync6(CREDS_PATH2, "utf-8"));
     return creds.access_token || null;
   } catch {
     return null;
@@ -1039,20 +1116,20 @@ var init_flush = __esm({
     init_optout();
     init_metaCache();
     init_wire();
-    SYNKRO_DIR5 = join6(homedir6(), ".synkro");
-    CONFIG_PATH3 = join6(SYNKRO_DIR5, "config.env");
-    CREDS_PATH2 = process.env.SYNKRO_CREDENTIALS_PATH || join6(SYNKRO_DIR5, "credentials.json");
+    SYNKRO_DIR5 = join7(homedir7(), ".synkro");
+    CONFIG_PATH3 = join7(SYNKRO_DIR5, "config.env");
+    CREDS_PATH2 = process.env.SYNKRO_CREDENTIALS_PATH || join7(SYNKRO_DIR5, "credentials.json");
     THROTTLE_MS = 6e4;
     DEFAULT_GATEWAY = "https://api.synkro.sh";
   }
 });
 
 // cli/telemetry/stats.ts
-import { existsSync as existsSync7, readFileSync as readFileSync6, statSync, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync7, statSync, writeFileSync as writeFileSync4 } from "fs";
 function countPending() {
   if (!existsSync7(PENDING_PATH)) return 0;
   try {
-    const raw = readFileSync6(PENDING_PATH, "utf-8");
+    const raw = readFileSync7(PENDING_PATH, "utf-8");
     if (!raw) return 0;
     let n = 0;
     for (const line of raw.split("\n")) if (line.trim()) n++;
@@ -1174,13 +1251,13 @@ var init_stats = __esm({
 });
 
 // cli/telemetry/purge.ts
-import { existsSync as existsSync8, readFileSync as readFileSync7, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync8, unlinkSync as unlinkSync2 } from "fs";
 import { randomUUID as randomUUID3 } from "crypto";
 function unlinkPendingCount() {
   if (!existsSync8(PENDING_PATH)) return 0;
   let n = 0;
   try {
-    const raw = readFileSync7(PENDING_PATH, "utf-8");
+    const raw = readFileSync8(PENDING_PATH, "utf-8");
     for (const line of raw.split("\n")) if (line.trim()) n++;
   } catch {
   }
@@ -1345,8 +1422,8 @@ var init_telemetry = __esm({
 
 // cli/installer/agentDetect.ts
 import { existsSync as existsSync9 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join7 } from "path";
+import { homedir as homedir8 } from "os";
+import { join as join8 } from "path";
 import { execFileSync as execFileSync2, execSync } from "child_process";
 function which(cmd3) {
   try {
@@ -1367,21 +1444,21 @@ function getVersion(cmd3) {
 }
 function detectAgents() {
   const agents = [];
-  const home = homedir7();
+  const home = homedir8();
   const claudeBinary = which("claude");
-  const claudeConfigDir = join7(home, ".claude");
+  const claudeConfigDir = join8(home, ".claude");
   if (claudeBinary) {
     agents.push({
       kind: "claude_code",
       name: "Claude Code",
       binaryPath: claudeBinary,
       configDir: claudeConfigDir,
-      settingsPath: join7(claudeConfigDir, "settings.json"),
+      settingsPath: join8(claudeConfigDir, "settings.json"),
       version: getVersion("claude")
     });
   }
   const cursorBinary = which("cursor");
-  const cursorConfigDir = join7(home, ".cursor");
+  const cursorConfigDir = join8(home, ".cursor");
   const cursorApp = process.platform === "darwin" && existsSync9("/Applications/Cursor.app");
   if (cursorBinary || cursorApp || existsSync9(cursorConfigDir)) {
     let version;
@@ -1399,19 +1476,19 @@ function detectAgents() {
       name: "Cursor",
       binaryPath: cursorBinary,
       configDir: cursorConfigDir,
-      settingsPath: join7(cursorConfigDir, "hooks.json"),
+      settingsPath: join8(cursorConfigDir, "hooks.json"),
       version
     });
   }
   const codexBinary = which("codex");
-  const codexConfigDir = process.env.CODEX_HOME || join7(home, ".codex");
+  const codexConfigDir = process.env.CODEX_HOME || join8(home, ".codex");
   if (codexBinary || existsSync9(codexConfigDir)) {
     agents.push({
       kind: "codex",
       name: "Codex",
       binaryPath: codexBinary,
       configDir: codexConfigDir,
-      settingsPath: join7(codexConfigDir, "hooks.json"),
+      settingsPath: join8(codexConfigDir, "hooks.json"),
       version: codexBinary ? getVersion("codex") : void 0
     });
   }
@@ -1425,16 +1502,16 @@ var init_agentDetect = __esm({
 
 // cli/installer/platform.ts
 import { existsSync as existsSync10 } from "fs";
-import { homedir as homedir8 } from "os";
-import { join as join8 } from "path";
+import { homedir as homedir9 } from "os";
+import { join as join9 } from "path";
 import { spawnSync } from "child_process";
 function resolveBunBin() {
   const finder = IS_WINDOWS ? "where" : "which";
   const r = spawnSync(finder, ["bun"], { encoding: "utf-8", timeout: 5e3 });
   const resolved = (r.stdout || "").split(/\r?\n/).map((s) => s.trim()).find(Boolean);
   if (resolved) return resolved;
-  const home = process.env.USERPROFILE || homedir8();
-  const candidates = IS_WINDOWS ? [join8(home, ".bun", "bin", "bun.exe"), "C:\\Program Files\\bun\\bin\\bun.exe"] : ["/opt/homebrew/bin/bun", "/usr/local/bin/bun", join8(home, ".bun", "bin", "bun")];
+  const home = process.env.USERPROFILE || homedir9();
+  const candidates = IS_WINDOWS ? [join9(home, ".bun", "bin", "bun.exe"), "C:\\Program Files\\bun\\bin\\bun.exe"] : ["/opt/homebrew/bin/bun", "/usr/local/bin/bun", join9(home, ".bun", "bin", "bun")];
   for (const p of candidates) if (existsSync10(p)) return p;
   return IS_WINDOWS ? "bun.exe" : "bun";
 }
@@ -1458,12 +1535,12 @@ var init_platform = __esm({
 });
 
 // cli/installer/ccHookConfig.ts
-import { existsSync as existsSync11, readFileSync as readFileSync8, writeFileSync as writeFileSync6, renameSync as renameSync3, mkdirSync as mkdirSync4 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync9, writeFileSync as writeFileSync6, renameSync as renameSync3, mkdirSync as mkdirSync4 } from "fs";
 import { dirname } from "path";
 function readSettings(path) {
   if (!existsSync11(path)) return {};
   try {
-    const raw = readFileSync8(path, "utf-8");
+    const raw = readFileSync9(path, "utf-8");
     return JSON.parse(raw);
   } catch (err) {
     throw new Error(`Failed to parse ${path}: ${err.message}`);
@@ -1609,7 +1686,7 @@ function installCCHooks(settingsPath, config) {
   }
   if (config.taskActivateIntentScriptPath) {
     settings.hooks.PreToolUse.push({
-      matcher: "mcp__synkro-guardrails__activate_standard",
+      matcher: "mcp__synkro[-_]guardrails__activate_standard",
       hooks: [
         {
           type: "command",
@@ -1723,9 +1800,9 @@ var init_ccHookConfig = __esm({
 });
 
 // cli/installer/cursorHookConfig.ts
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync7, renameSync as renameSync4, mkdirSync as mkdirSync5 } from "fs";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync7, renameSync as renameSync4, mkdirSync as mkdirSync5 } from "fs";
 import { dirname as dirname2, resolve, normalize } from "path";
-import { homedir as homedir9 } from "os";
+import { homedir as homedir10 } from "os";
 function shellQuote(s) {
   return "'" + s.replace(/'/g, "'\\''") + "'";
 }
@@ -1745,7 +1822,7 @@ function validateHooksPath(path) {
 function readHooksFile(rawPath) {
   const safePath = validateHooksPath(rawPath);
   try {
-    const raw = readFileSync9(safePath, "utf-8");
+    const raw = readFileSync10(safePath, "utf-8");
     return JSON.parse(raw);
   } catch (err) {
     if (err?.code === "ENOENT") return { version: 1, hooks: {} };
@@ -1927,8 +2004,8 @@ var init_cursorHookConfig = __esm({
     init_platform();
     SYNKRO_MARKER2 = "__synkro_managed__";
     ALLOWED_PARENT_DIRS = [
-      resolve(homedir9(), ".cursor"),
-      resolve(homedir9(), ".config", "cursor")
+      resolve(homedir10(), ".cursor"),
+      resolve(homedir10(), ".config", "cursor")
     ];
     ALL_EVENTS = [
       "sessionStart",
@@ -1948,9 +2025,9 @@ var init_cursorHookConfig = __esm({
 });
 
 // cli/installer/codexHookConfig.ts
-import { existsSync as existsSync12, readFileSync as readFileSync10, writeFileSync as writeFileSync8, renameSync as renameSync5, mkdirSync as mkdirSync6 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync11, writeFileSync as writeFileSync8, renameSync as renameSync5, mkdirSync as mkdirSync6 } from "fs";
 import { dirname as dirname3, resolve as resolve2, normalize as normalize2 } from "path";
-import { homedir as homedir10 } from "os";
+import { homedir as homedir11 } from "os";
 function shellQuote2(s) {
   return "'" + s.replace(/'/g, "'\\''") + "'";
 }
@@ -1967,8 +2044,8 @@ function codexCmd(scriptPath) {
 function validateHooksPath2(path) {
   const resolved = resolve2(normalize2(path));
   const allowedParentDirs = [
-    resolve2(homedir10(), ".codex"),
-    resolve2(homedir10(), ".config", "codex"),
+    resolve2(homedir11(), ".codex"),
+    resolve2(homedir11(), ".config", "codex"),
     ...process.env.CODEX_HOME ? [resolve2(process.env.CODEX_HOME)] : []
   ];
   if (!allowedParentDirs.some((dir) => resolved.startsWith(dir + "/") || resolved === dir)) {
@@ -1980,7 +2057,7 @@ function readHooksFile2(rawPath) {
   const safePath = validateHooksPath2(rawPath);
   if (!existsSync12(safePath)) return { hooks: {} };
   try {
-    return JSON.parse(readFileSync10(safePath, "utf-8"));
+    return JSON.parse(readFileSync11(safePath, "utf-8"));
   } catch (err) {
     throw new Error(`Failed to parse ${safePath}: ${err.message}`);
   }
@@ -2026,15 +2103,25 @@ function installCodexHooks(hooksJsonPath, config) {
     cmd(config.cvePrecheckScriptPath, 15),
     ...config.skillJudgeScriptPath ? [cmd(config.skillJudgeScriptPath, 50)] : []
   ], M_EDIT);
+  push(h, "PostToolUse", [
+    cmd(config.editFollowupScriptPath, 30, "Recording edit")
+  ], M_EDIT);
   push(h, "PreToolUse", [cmd(config.agentJudgeScriptPath, 50)], M_AGENT);
   if (config.mcpGateScriptPath) push(h, "PreToolUse", [cmd(config.mcpGateScriptPath, 50)], M_MCP);
   if (config.taskActivateIntentScriptPath) push(h, "PreToolUse", [cmd(config.taskActivateIntentScriptPath, 5)], M_ACTIVATE);
+  if (config.taskActivateIntentScriptPath) push(h, "PermissionRequest", [cmd(config.taskActivateIntentScriptPath, 5)], M_ACTIVATE);
   push(h, "PostToolUse", [cmd(config.bashFollowupScriptPath, 10)], M_BASH);
   push(h, "UserPromptSubmit", [cmd(config.userPromptSubmitScriptPath, 5)]);
   if (config.promptRouteScriptPath) push(h, "UserPromptSubmit", [cmd(config.promptRouteScriptPath, 5)]);
   push(h, "SessionStart", [cmd(config.sessionStartScriptPath, 5)]);
+  push(h, "SubagentStart", [cmd(config.subagentStartScriptPath, 5)]);
+  if (!config.skipTranscriptSync) push(h, "SubagentStop", [cmd(config.subagentStopScriptPath, 5)]);
   push(h, "SessionEnd", [cmd(config.stopSummaryScriptPath, 3)]);
-  if (!config.skipTranscriptSync) push(h, "Stop", [cmd(config.transcriptSyncScriptPath, 3)]);
+  push(h, "Stop", [
+    cmd(config.cweStopScriptPath, 50, "Checking completed edits for weaknesses"),
+    cmd(config.cveStopScriptPath, 50, "Checking completed edits for vulnerabilities"),
+    ...!config.skipTranscriptSync ? [cmd(config.transcriptSyncScriptPath, 3)] : []
+  ]);
   writeHooksFileAtomic2(hooksJsonPath, file);
 }
 function uninstallCodexHooks(hooksJsonPath) {
@@ -2054,30 +2141,31 @@ function uninstallCodexHooks(hooksJsonPath) {
   writeHooksFileAtomic2(hooksJsonPath, file);
   return true;
 }
-var SYNKRO_MARKER3, M_BASH, M_EDIT, M_AGENT, M_MCP, M_ACTIVATE, ALL_EVENTS2;
+var SYNKRO_MARKER3, M_BASH, CODEX_EDIT_MATCHER, M_EDIT, M_AGENT, M_MCP, M_ACTIVATE, ALL_EVENTS2;
 var init_codexHookConfig = __esm({
   "cli/installer/codexHookConfig.ts"() {
     "use strict";
     init_platform();
     SYNKRO_MARKER3 = "__synkro_managed__";
     M_BASH = "Bash";
-    M_EDIT = "apply_patch|Edit|Write";
+    CODEX_EDIT_MATCHER = "^(?:apply_patch|ApplyPatch|Edit|Write|functions[._]apply_patch)$";
+    M_EDIT = CODEX_EDIT_MATCHER;
     M_AGENT = "Agent";
     M_MCP = "mcp__.*";
-    M_ACTIVATE = "mcp__synkro-guardrails__activate_standard";
-    ALL_EVENTS2 = ["PreToolUse", "PostToolUse", "UserPromptSubmit", "SessionStart", "SessionEnd", "Stop"];
+    M_ACTIVATE = "mcp__synkro[-_]guardrails__activate_standard";
+    ALL_EVENTS2 = ["PreToolUse", "PermissionRequest", "PostToolUse", "UserPromptSubmit", "SessionStart", "SessionEnd", "SubagentStart", "SubagentStop", "Stop"];
   }
 });
 
 // cli/installer/mcpConfig.ts
-import { existsSync as existsSync13, readFileSync as readFileSync11, writeFileSync as writeFileSync9, renameSync as renameSync6, mkdirSync as mkdirSync7 } from "fs";
-import { homedir as homedir11 } from "os";
-import { dirname as dirname4, join as join9 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync12, writeFileSync as writeFileSync9, renameSync as renameSync6, mkdirSync as mkdirSync7 } from "fs";
+import { homedir as homedir12 } from "os";
+import { dirname as dirname4, join as join10 } from "path";
 import { randomBytes } from "crypto";
 function readClaudeJson() {
   if (!existsSync13(CC_CONFIG_PATH)) return {};
   try {
-    const raw = readFileSync11(CC_CONFIG_PATH, "utf-8");
+    const raw = readFileSync12(CC_CONFIG_PATH, "utf-8");
     return JSON.parse(raw);
   } catch (err) {
     throw new Error(`Failed to parse ${CC_CONFIG_PATH}: ${err.message}`);
@@ -2096,7 +2184,7 @@ function installMcpConfig(opts) {
     if (entry?.[SYNKRO_MARKER4] === true) delete config.mcpServers[name];
   }
   if (opts.local) {
-    const proxyScript = join9(homedir11(), ".synkro", "hooks", "mcp-stdio-proxy.ts");
+    const proxyScript = join10(homedir12(), ".synkro", "hooks", "mcp-stdio-proxy.ts");
     config.mcpServers[SYNKRO_SERVER_NAME] = {
       type: "stdio",
       command: "bun",
@@ -2135,7 +2223,7 @@ function uninstallMcpConfig() {
 function readCursorMcpJson() {
   if (!existsSync13(CURSOR_MCP_PATH)) return {};
   try {
-    const raw = readFileSync11(CURSOR_MCP_PATH, "utf-8");
+    const raw = readFileSync12(CURSOR_MCP_PATH, "utf-8");
     return JSON.parse(raw);
   } catch (err) {
     throw new Error(`Failed to parse ${CURSOR_MCP_PATH}: ${err.message}`);
@@ -2156,10 +2244,10 @@ function installCursorMcpConfig(opts) {
   if (opts.local) {
     const port = process.env.SYNKRO_MCP_PORT || "18931";
     const url2 = `http://127.0.0.1:${port}/`;
-    const jwtPath = join9(homedir11(), ".synkro", ".mcp-jwt");
+    const jwtPath = join10(homedir12(), ".synkro", ".mcp-jwt");
     let jwt2 = "";
     try {
-      jwt2 = readFileSync11(jwtPath, "utf-8").trim();
+      jwt2 = readFileSync12(jwtPath, "utf-8").trim();
     } catch {
     }
     config.mcpServers[SYNKRO_SERVER_NAME] = {
@@ -2201,7 +2289,7 @@ function codexConfigPath(path) {
 function readCodexToml(path) {
   if (!existsSync13(path)) return "";
   try {
-    return readFileSync11(path, "utf-8");
+    return readFileSync12(path, "utf-8");
   } catch (err) {
     throw new Error(`Failed to read ${path}: ${err.message}`);
   }
@@ -2290,7 +2378,7 @@ function resolveBunBin2() {
 function readDesktopJson() {
   if (!existsSync13(CLAUDE_DESKTOP_CONFIG_PATH)) return {};
   try {
-    return JSON.parse(readFileSync11(CLAUDE_DESKTOP_CONFIG_PATH, "utf-8"));
+    return JSON.parse(readFileSync12(CLAUDE_DESKTOP_CONFIG_PATH, "utf-8"));
   } catch (err) {
     throw new Error(`Failed to parse ${CLAUDE_DESKTOP_CONFIG_PATH}: ${err.message}`);
   }
@@ -2347,31 +2435,31 @@ var init_mcpConfig = __esm({
     init_platform();
     SYNKRO_MARKER4 = "__synkro_managed__";
     SYNKRO_SERVER_NAME = "synkro-guardrails";
-    CC_CONFIG_PATH = join9(homedir11(), ".claude.json");
-    CURSOR_MCP_PATH = join9(homedir11(), ".cursor", "mcp.json");
-    CODEX_CONFIG_PATH = join9(process.env.CODEX_HOME || join9(homedir11(), ".codex"), "config.toml");
+    CC_CONFIG_PATH = join10(homedir12(), ".claude.json");
+    CURSOR_MCP_PATH = join10(homedir12(), ".cursor", "mcp.json");
+    CODEX_CONFIG_PATH = join10(process.env.CODEX_HOME || join10(homedir12(), ".codex"), "config.toml");
     CODEX_MCP_BEGIN = "# >>> synkro managed MCP: synkro-guardrails";
     CODEX_MCP_END = "# <<< synkro managed MCP: synkro-guardrails";
     CODEX_MCP_SECTION = 'mcp_servers."synkro-guardrails"';
-    CLAUDE_DESKTOP_CONFIG_PATH = join9(
-      homedir11(),
+    CLAUDE_DESKTOP_CONFIG_PATH = join10(
+      homedir12(),
       "Library",
       "Application Support",
       "Claude",
       "claude_desktop_config.json"
     );
-    MCP_STDIO_PROXY_PATH = join9(homedir11(), ".synkro", "hooks", "mcp-stdio-proxy.ts");
+    MCP_STDIO_PROXY_PATH = join10(homedir12(), ".synkro", "hooks", "mcp-stdio-proxy.ts");
   }
 });
 
 // cli/installer/synkroCommand.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync8, readFileSync as readFileSync12, writeFileSync as writeFileSync10, unlinkSync as unlinkSync4 } from "fs";
-import { homedir as homedir12 } from "os";
-import { join as join10 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync8, readFileSync as readFileSync13, writeFileSync as writeFileSync10, unlinkSync as unlinkSync4 } from "fs";
+import { homedir as homedir13 } from "os";
+import { join as join11 } from "path";
 function installSynkroCommand() {
   try {
     if (existsSync14(COMMAND_PATH)) {
-      const current = readFileSync12(COMMAND_PATH, "utf-8");
+      const current = readFileSync13(COMMAND_PATH, "utf-8");
       if (!current.includes(MARKER)) return null;
     }
     mkdirSync8(COMMANDS_DIR, { recursive: true });
@@ -2384,7 +2472,7 @@ function installSynkroCommand() {
 function uninstallSynkroCommand() {
   try {
     if (!existsSync14(COMMAND_PATH)) return false;
-    const current = readFileSync12(COMMAND_PATH, "utf-8");
+    const current = readFileSync13(COMMAND_PATH, "utf-8");
     if (!current.includes(MARKER)) return false;
     unlinkSync4(COMMAND_PATH);
     return true;
@@ -2397,8 +2485,8 @@ var init_synkroCommand = __esm({
   "cli/installer/synkroCommand.ts"() {
     "use strict";
     MARKER = "__synkro_managed__";
-    COMMANDS_DIR = join10(homedir12(), ".claude", "commands");
-    COMMAND_PATH = join10(COMMANDS_DIR, "synkro.md");
+    COMMANDS_DIR = join11(homedir13(), ".claude", "commands");
+    COMMAND_PATH = join11(COMMANDS_DIR, "synkro.md");
     COMMAND_BODY = `<!-- ${MARKER} -->
 ---
 description: Set up Synkro \u2014 create a starter rule set, review suggestions, and watch a live block
@@ -2456,14 +2544,14 @@ var init_skillParser = __esm({
 function stubHook(surface, optsLiteral) {
   return "#!/usr/bin/env bun\nimport { runStub } from './_synkro-stub-common.ts';\nrunStub(" + JSON.stringify(surface) + ", " + optsLiteral + ");\n";
 }
-var STUB_COMMON_TS, STUB_EDIT_PRECHECK_TS, STUB_CWE_PRECHECK_TS, STUB_CVE_PRECHECK_TS, STUB_BASH_JUDGE_TS, STUB_SKILL_JUDGE_TS, STUB_INSTALL_SCAN_TS, STUB_AGENT_JUDGE_TS, STUB_MCP_GATE_TS, STUB_PLAN_JUDGE_TS, STUB_STOP_SUMMARY_TS, STUB_SESSION_START_TS, STUB_TRANSCRIPT_SYNC_TS, STUB_USER_PROMPT_SUBMIT_TS, STUB_BASH_FOLLOWUP_TS, STUB_PROMPT_ROUTE_TS, STUB_TASK_ACTIVATE_INTENT_TS, STUB_CURSOR_BASH_JUDGE_TS, STUB_CURSOR_SKILL_JUDGE_TS, STUB_CURSOR_EDIT_CAPTURE_TS, STUB_CURSOR_AGENT_CAPTURE_TS;
+var STUB_COMMON_TS, STUB_EDIT_PRECHECK_TS, STUB_EDIT_FOLLOWUP_TS, STUB_CWE_PRECHECK_TS, STUB_CVE_PRECHECK_TS, STUB_BASH_JUDGE_TS, STUB_SKILL_JUDGE_TS, STUB_INSTALL_SCAN_TS, STUB_AGENT_JUDGE_TS, STUB_MCP_GATE_TS, STUB_PLAN_JUDGE_TS, STUB_STOP_SUMMARY_TS, STUB_SESSION_START_TS, STUB_TRANSCRIPT_SYNC_TS, STUB_CODEX_CWE_STOP_TS, STUB_CODEX_CVE_STOP_TS, STUB_SUBAGENT_START_TS, STUB_SUBAGENT_STOP_TS, STUB_USER_PROMPT_SUBMIT_TS, STUB_BASH_FOLLOWUP_TS, STUB_PROMPT_ROUTE_TS, STUB_TASK_ACTIVATE_INTENT_TS, STUB_CURSOR_BASH_JUDGE_TS, STUB_CURSOR_SKILL_JUDGE_TS, STUB_CURSOR_EDIT_CAPTURE_TS, STUB_CURSOR_AGENT_CAPTURE_TS;
 var init_hookScriptsTs = __esm({
   "cli/installer/hookScriptsTs.ts"() {
     "use strict";
-    STUB_COMMON_TS = String.raw`import { existsSync, readFileSync, mkdirSync, writeFileSync, appendFileSync, statSync, openSync, readSync, closeSync } from 'node:fs';
+    STUB_COMMON_TS = String.raw`import { existsSync, readFileSync, readdirSync, mkdirSync, writeFileSync, appendFileSync, statSync, realpathSync, openSync, readSync, closeSync } from 'node:fs';
 import { execSync } from 'node:child_process';
 import { homedir } from 'node:os';
-import { join, resolve, isAbsolute } from 'node:path';
+import { basename, join, resolve, relative, isAbsolute } from 'node:path';
 import { randomUUID, createHash } from 'node:crypto';
 
 const HOME = homedir();
@@ -2622,13 +2710,17 @@ async function cloudMcpGate(payload: any, harness: string): Promise<string> {
   try {
     const toolName = String(payload.tool_name || payload.tool || '');
     const parts = toolName.split('__');
-    const server = (parts.length >= 3 && parts[0] === 'mcp') ? parts[1] : '';
+    const input = payload.tool_input && typeof payload.tool_input === 'object' ? payload.tool_input : {};
+    const server = (parts.length >= 3 && parts[0] === 'mcp')
+      ? parts[1]
+      : String(payload.server_name || payload.serverName || payload.server || payload.mcp_server
+        || input.server_name || input.serverName || input.server || input.mcp_server || '');
     if (!server) return failOpen(harness);
     const base = (cfgVal('SYNKRO_GATEWAY_URL') || 'https://api.synkro.sh').replace(/\/+$/, '');
     const resp = await fetch(base + '/api/mcp/gate', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + loadMcpJwt() },
-      body: JSON.stringify({ server: server, tool: parts.slice(2).join('__') }),
+      body: JSON.stringify({ server: server, tool: parts.slice(2).join('__') || toolName, harness: harness }),
       signal: AbortSignal.timeout(5000),
     });
     if (!resp.ok) return failOpen(harness);
@@ -2664,6 +2756,28 @@ function failOpen(harness: string): string {
   return harness === 'cursor' ? '{"permission":"allow"}' : '{}';
 }
 
+/** Convert an existing security PreToolUse verdict into Codex's Stop contract. */
+export function codexStopResponse(responseText: string): string {
+  try {
+    const parsed = JSON.parse(responseText || '{}');
+    const specific = parsed?.hookSpecificOutput;
+    if (specific?.permissionDecision !== 'deny') return '{}';
+    const reason = String(
+      specific.permissionDecisionReason
+      || specific.additionalContext
+      || parsed.systemMessage
+      || 'A completed edit contains a CWE weakness. Fix it before stopping.',
+    );
+    return JSON.stringify({
+      decision: 'block',
+      reason,
+      ...(parsed.systemMessage ? { systemMessage: parsed.systemMessage } : {}),
+    });
+  } catch {
+    return '{}';
+  }
+}
+
 function out(s: string): void { try { process.stdout.write(s + '\n'); } catch {} }
 
 function gitRoot(cwd: string): string {
@@ -2725,48 +2839,327 @@ function gatherBaseContent(fp: string, ti: any): string | undefined {
   return '\n'.repeat(linesBefore) + full.slice(start, end);
 }
 
+function gatherPreEditContentFromPost(fp: string, toolName: string, ti: any, operation: string): string | undefined {
+  if (operation === 'add') return '';
+  if (operation === 'delete') {
+    const patch = String(ti?.patch || '');
+    const removed: string[] = [];
+    for (const line of patch.split('\n')) {
+      if (line.startsWith('*** ') || line.startsWith('@@')) continue;
+      if (line.startsWith('-')) removed.push(line.slice(1));
+    }
+    return removed.length ? removed.join('\n') : undefined;
+  }
+  let full = '';
+  try { full = readFileSync(fp, 'utf-8'); } catch { return undefined; }
+  if (toolName === 'Edit') {
+    const oldString = String(ti?.old_string || '');
+    const newString = String(ti?.new_string || '');
+    if (newString && full.includes(newString)) return full.replace(newString, oldString);
+    return undefined;
+  }
+  if (toolName === 'MultiEdit' && Array.isArray(ti?.edits)) {
+    let before = full;
+    for (const edit of [...ti.edits].reverse()) {
+      const oldString = String(edit?.old_string || '');
+      const newString = String(edit?.new_string || '');
+      if (!newString || !before.includes(newString)) return undefined;
+      before = before.replace(newString, oldString);
+    }
+    return before;
+  }
+  return full;
+}
+
 // Codex edits arrive as the apply_patch tool with the patch text in
 // tool_input.command (lines: "*** Update/Add/Delete File: PATH", then hunks where
 // "+" adds, "-" removes, " " is context). The edit hooks expect the CC shape
-// {file_path, old_string, new_string}; translate once so filePathFromToolInput,
-// editAnchorString, and gatherBaseContent all work unchanged. A patch spanning
-// more than one file or hunk cannot be reconstructed faithfully as one Edit, so
-// mark it for a clear deny-and-retry response instead of grading partial content.
+// {file_path, old_string, new_string}; translate every file and hunk into an
+// explicit edit batch so one apply_patch call never drops evidence.
 export function normalizeCodexApplyPatch(payload: any): void {
   try {
-    if (!/apply_patch/i.test(String((payload && payload.tool_name) || ''))) return;
+    if (!/^(?:apply_?patch|functions[._]apply_?patch)$/i.test(String((payload && payload.tool_name) || ''))) return;
     const ti = payload.tool_input;
     const patch = (ti && typeof ti === 'object')
       ? String(ti.command || ti.patch || ti.input || '')
       : (typeof ti === 'string' ? ti : '');
     if (!patch) return;
-    const files: string[] = [];
-    let hunkCount = 0;
-    const oldLines: string[] = [];
-    const newLines: string[] = [];
+    type Hunk = { oldLines: string[]; newLines: string[] };
+    type PatchFile = {
+      operation: 'Add' | 'Update' | 'Delete';
+      path: string;
+      moveTarget: string;
+      hunks: Hunk[];
+      fragment: string[];
+    };
+    const files: PatchFile[] = [];
+    let current: PatchFile | null = null;
+    let hunk: Hunk | null = null;
+    const flushHunk = () => {
+      if (current && hunk && (hunk.oldLines.length || hunk.newLines.length)) current.hunks.push(hunk);
+      hunk = null;
+    };
+    const flushFile = () => {
+      flushHunk();
+      if (current) files.push(current);
+      current = null;
+    };
     for (const ln of patch.split('\n')) {
       const mFile = ln.match(/^\*\*\*\s+(?:Update|Add|Delete)\s+File:\s+(.+?)\s*$/);
-      if (mFile) { files.push(mFile[1].trim()); continue; }
-      if (ln.indexOf('@@') === 0) { hunkCount++; continue; }
+      if (mFile) {
+        flushFile();
+        const operation = ln.match(/^\*\*\*\s+(Update|Add|Delete)\s+File:/)?.[1] as 'Add' | 'Update' | 'Delete';
+        current = {
+          operation,
+          path: mFile[1].trim(),
+          moveTarget: '',
+          hunks: [],
+          fragment: [ln],
+        };
+        continue;
+      }
+      if (!current) continue;
+      current.fragment.push(ln);
+      const mMove = ln.match(/^\*\*\*\s+Move to:\s+(.+?)\s*$/);
+      if (mMove) { current.moveTarget = mMove[1].trim(); continue; }
+      if (ln.indexOf('@@') === 0) {
+        flushHunk();
+        hunk = { oldLines: [], newLines: [] };
+        const anchor = ln.slice(2).trim();
+        if (anchor) { hunk.oldLines.push(anchor); hunk.newLines.push(anchor); }
+        continue;
+      }
       if (ln.indexOf('*** ') === 0) continue;
+      hunk = hunk || { oldLines: [], newLines: [] };
       const c = ln.charAt(0);
-      if (c === '+') newLines.push(ln.slice(1));
-      else if (c === '-') oldLines.push(ln.slice(1));
-      else if (c === ' ') { oldLines.push(ln.slice(1)); newLines.push(ln.slice(1)); }
+      if (c === '+') hunk.newLines.push(ln.slice(1));
+      else if (c === '-') hunk.oldLines.push(ln.slice(1));
+      else if (c === ' ') { hunk.oldLines.push(ln.slice(1)); hunk.newLines.push(ln.slice(1)); }
     }
-    if (files.length !== 1 || hunkCount > 1) {
+    flushFile();
+    if (!files.length) {
       payload.__synkro_codex_patch_error =
-        'Synkro needs Codex edits split into one file and one contiguous hunk. Retry this apply_patch as separate edits.';
+        'Synkro could not recover a file edit from this apply_patch payload.';
       return;
     }
-    if (!files[0]) return;
     const cwd = typeof payload.cwd === 'string' ? payload.cwd : '';
-    const filePath = !isAbsolute(files[0]) && cwd ? resolve(cwd, files[0]) : files[0];
-    payload.tool_name = 'Edit';
-    payload.tool_input = { file_path: filePath, old_string: oldLines.join('\n'), new_string: newLines.join('\n') };
+    const normalized = files.map((file) => {
+      const filePath = !isAbsolute(file.path) && cwd ? resolve(cwd, file.path) : file.path;
+      const patchFragment = file.fragment.join('\n');
+      if (file.operation === 'Add') {
+        return {
+          tool_name: 'Write',
+          tool_input: {
+            file_path: filePath,
+            content: file.hunks.flatMap((item) => item.newLines).join('\n'),
+            patch: patchFragment,
+          },
+          __synkro_codex_operation: 'add',
+        };
+      }
+      if (file.operation === 'Delete') {
+        return {
+          tool_name: 'Write',
+          tool_input: { file_path: filePath, content: '', patch: patchFragment },
+          __synkro_codex_operation: 'delete',
+        };
+      }
+      const edits = file.hunks.map((item) => ({
+        old_string: item.oldLines.join('\n'),
+        new_string: item.newLines.join('\n'),
+      }));
+      return {
+        tool_name: edits.length > 1 ? 'MultiEdit' : 'Edit',
+        tool_input: edits.length > 1
+          ? { file_path: filePath, edits, patch: patchFragment }
+          : { file_path: filePath, ...(edits[0] || { old_string: '', new_string: '' }), patch: patchFragment },
+        __synkro_codex_operation: file.moveTarget ? 'rename' : 'modify',
+        ...(file.moveTarget ? { __synkro_codex_move_target: file.moveTarget } : {}),
+      };
+    });
+    payload.__synkro_codex_edits = normalized;
+    Object.assign(payload, normalized[0]);
   } catch { /* leave payload untouched on any parse error */ }
 }
 
+type RecoveredCodexEdit = { payload: Record<string, any>; baseContent?: string };
+
+function completedCodexToolRecord(entry: any): any {
+  if (!entry || typeof entry !== 'object') return null;
+  if (entry.type === 'response_item' && entry.payload && typeof entry.payload === 'object') {
+    return entry.payload;
+  }
+  return entry.payload && typeof entry.payload === 'object' ? entry.payload : entry;
+}
+
+function completedCodexToolInput(record: any): any {
+  const raw = record?.input ?? record?.arguments ?? record?.command;
+  if (raw && typeof raw === 'object') return raw;
+  if (typeof raw !== 'string') return {};
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === 'object') return parsed;
+    if (typeof parsed === 'string') return { command: parsed };
+  } catch {}
+  return { command: raw };
+}
+
+function containedCodexEditPath(repoRoot: string, filePath: string): string {
+  if (!repoRoot || !filePath) return '';
+  try {
+    const lexicalRoot = resolve(repoRoot);
+    const realRoot = realpathSync(lexicalRoot);
+    const lexical = isAbsolute(filePath) ? resolve(filePath) : resolve(lexicalRoot, filePath);
+    const isContained = (rel: string): boolean =>
+      !!rel && rel !== '..' && !rel.startsWith('..' + '/') && !isAbsolute(rel);
+    // Accept an absolute path expressed through either the lexical repo alias
+    // (/var on macOS, a symlinked checkout) or its physical path, but always
+    // continue from the physical root so new and existing files share one
+    // canonical provenance path.
+    let rel = relative(lexicalRoot, lexical);
+    if (!isContained(rel)) {
+      rel = relative(realRoot, lexical);
+      if (!isContained(rel)) return '';
+    }
+    let candidate = resolve(realRoot, rel);
+    // realpathSync requires the leaf to exist. Walk to the nearest existing
+    // ancestor, resolve symlinks there, then append the missing suffix. This
+    // both canonicalizes new files and rejects a new leaf beneath an in-repo
+    // symlink that actually escapes the repository.
+    const missing: string[] = [];
+    let ancestor = candidate;
+    while (!existsSync(ancestor)) {
+      const parent = resolve(ancestor, '..');
+      if (parent === ancestor) return '';
+      missing.unshift(basename(ancestor));
+      ancestor = parent;
+    }
+    candidate = resolve(realpathSync(ancestor), ...missing);
+    const realRel = relative(realRoot, candidate);
+    if (!realRel || realRel.startsWith('..') || isAbsolute(realRel)) return '';
+    return existsSync(candidate) ? realpathSync(candidate) : candidate;
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * Recover completed Codex apply_patch calls from a bounded transcript tail.
+ * A tool call is evidence only after a matching tool output exists. Calls are
+ * expanded one event per file, restricted to the repo, and keyed by the stable
+ * Codex call id so replay is idempotent server-side.
+ */
+export function extractCompletedCodexPatchEdits(
+  transcript: string,
+  repoRoot: string,
+): RecoveredCodexEdit[] {
+  if (!transcript || !repoRoot) return [];
+  const calls = new Map<string, { record: any; timestamp: string }>();
+  const completed = new Set<string>();
+  for (const line of transcript.split('\n')) {
+    if (!line.trim()) continue;
+    let entry: any;
+    try { entry = JSON.parse(line); } catch { continue; }
+    const record = completedCodexToolRecord(entry);
+    const type = String(record?.type || '');
+    const callId = String(record?.call_id || record?.tool_call_id || record?.id || '');
+    if (!callId) continue;
+    if (type === 'custom_tool_call_output' || type === 'function_call_output') {
+      completed.add(callId);
+      continue;
+    }
+    if (type !== 'custom_tool_call' && type !== 'function_call') continue;
+    const name = String(record?.name || record?.tool_name || '');
+    if (!/^(?:apply_?patch|functions[._]apply_?patch)$/i.test(name)) continue;
+    calls.set(callId, {
+      record,
+      timestamp: String(entry?.timestamp || record?.timestamp || ''),
+    });
+  }
+
+  const results: RecoveredCodexEdit[] = [];
+  const seen = new Set<string>();
+  const candidates = [...calls.entries()].filter(([callId]) => completed.has(callId)).slice(-100);
+  for (const [callId, call] of candidates) {
+    const toolInput = completedCodexToolInput(call.record);
+    const patch = String(toolInput?.command || toolInput?.patch || toolInput?.input || '');
+    if (!patch || patch.length > 100000) continue;
+    const raw: any = {
+      cwd: repoRoot,
+      tool_name: String(call.record?.name || call.record?.tool_name || 'apply_patch'),
+      tool_input: toolInput,
+      tool_call_id: callId,
+      _ts: call.timestamp || undefined,
+    };
+    normalizeCodexApplyPatch(raw);
+    const edits = Array.isArray(raw.__synkro_codex_edits) ? raw.__synkro_codex_edits : [];
+    for (const edit of edits) {
+      if (results.length >= 50) return results;
+      const fp = containedCodexEditPath(repoRoot, filePathFromToolInput(edit?.tool_input));
+      if (!fp) continue;
+      const dedupeKey = callId + '\u0000' + fp;
+      if (seen.has(dedupeKey)) continue;
+      seen.add(dedupeKey);
+      const payload: any = {
+        cwd: repoRoot,
+        tool_name: edit.tool_name,
+        tool_input: { ...(edit.tool_input || {}), file_path: fp },
+        tool_call_id: callId,
+        _ts: call.timestamp || undefined,
+        __synkro_codex_operation: edit.__synkro_codex_operation,
+        __synkro_codex_move_target: edit.__synkro_codex_move_target,
+        __synkro_edit_source: 'transcript',
+      };
+      const baseContent = gatherPreEditContentFromPost(
+        fp,
+        String(payload.tool_name || ''),
+        payload.tool_input,
+        String(payload.__synkro_codex_operation || ''),
+      );
+      if (baseContent === undefined) continue;
+      results.push({
+        payload,
+        baseContent,
+      });
+    }
+  }
+  return results;
+}
+
+/**
+ * Recover only the latest completed apply_patch for each file in the current
+ * Codex turn. Stop hooks may fire repeatedly while an agent self-corrects, so
+ * scanning the latest on-disk state avoids re-blocking an earlier vulnerable
+ * patch after a later patch fixed it.
+ */
+export function extractCompletedCodexTurnPatchEdits(
+  transcript: string,
+  repoRoot: string,
+): RecoveredCodexEdit[] {
+  if (!transcript || !repoRoot) return [];
+  const lines = transcript.split('\n');
+  let latestUserLine = -1;
+  for (let index = 0; index < lines.length; index++) {
+    if (!lines[index].trim()) continue;
+    let entry: any;
+    try { entry = JSON.parse(lines[index]); } catch { continue; }
+    const canonicalUser = entry?.type === 'event_msg'
+      && entry?.payload?.type === 'user_message';
+    const compatibilityUser = entry?.type === 'response_item'
+      && entry?.payload?.type === 'message'
+      && entry?.payload?.role === 'user';
+    if (canonicalUser || compatibilityUser) latestUserLine = index;
+  }
+  const turnTranscript = lines.slice(latestUserLine + 1).join('\n');
+  const recovered = extractCompletedCodexPatchEdits(turnTranscript, repoRoot);
+  const latestByFile = new Map<string, RecoveredCodexEdit>();
+  for (const item of recovered) {
+    const filePath = filePathFromToolInput(item.payload?.tool_input);
+    if (filePath) latestByFile.set(filePath, item);
+  }
+  return [...latestByFile.values()];
+}
+
 interface StubOpts {
   needsFile?: boolean;
   needsTranscript?: boolean;
@@ -2776,6 +3169,119 @@ interface StubOpts {
   needsPlan?: boolean;
   telemetry?: boolean;
   harness?: string;
+  postEdit?: boolean;
+  /** Recover only this Codex turn's latest completed patch per file. */
+  codexTurnEdits?: boolean;
+  /** Translate a security PreToolUse deny into Codex's Stop block response. */
+  stopContract?: boolean;
+  /** Codex SubagentStart/SubagentStop report the parent as session_id and
+   *  the child as agent_id. Remap them to the ordinary child-session envelope. */
+  subagent?: boolean;
+}
+
+function isContainedFile(root: string, candidate: string): boolean {
+  try {
+    const rel = relative(root, candidate);
+    return !!rel && !rel.startsWith('..') && !isAbsolute(rel) && statSync(candidate).isFile();
+  } catch { return false; }
+}
+
+function safeCodexSessionId(value: string): boolean {
+  if (!value || value.length > 200) return false;
+  for (const ch of value) {
+    const code = ch.charCodeAt(0);
+    const alphaNumeric = (code >= 48 && code <= 57)
+      || (code >= 65 && code <= 90)
+      || (code >= 97 && code <= 122);
+    if (!alphaNumeric && ch !== '-' && ch !== '_') return false;
+  }
+  return true;
+}
+
+function readJsonlHeader(path: string): string {
+  let fd = -1;
+  try {
+    fd = openSync(path, 'r');
+    const buf = Buffer.alloc(16384);
+    const count = readSync(fd, buf, 0, buf.length, 0);
+    const head = buf.subarray(0, count).toString('utf-8');
+    const newline = head.indexOf('\n');
+    return newline >= 0 ? head.slice(0, newline) : head;
+  } catch { return ''; }
+  finally { if (fd >= 0) { try { closeSync(fd); } catch {} } }
+}
+
+/**
+ * Codex hook payloads identify the rollout by session_id but do not always send
+ * transcript_path. Resolve that ID only within CODEX_HOME/sessions (or the
+ * default ~/.codex/sessions), then cache the exact contained file so subsequent
+ * tool hooks do not recursively scan the rollout tree.
+ */
+export function resolveHookTranscriptPath(payload: any, harness: string, sessionId: string): string {
+  const explicit = [
+    payload?.transcript_path,
+    payload?.rollout_path,
+    payload?.session_path,
+  ].find((value) => typeof value === 'string' && value);
+  if (typeof explicit === 'string') return explicit;
+  if (harness !== 'codex' || !safeCodexSessionId(sessionId)) return '';
+
+  const homeRoots = [
+    process.env.CODEX_HOME ? resolve(process.env.CODEX_HOME) : '',
+    resolve(join(HOME, '.codex')),
+  ].filter((value, index, all) => !!value && all.indexOf(value) === index);
+  const sessionRoots = homeRoots.map((root) => join(root, 'sessions')).filter((root) => existsSync(root));
+  if (!sessionRoots.length) return '';
+
+  const cachePath = join(
+    HOME,
+    '.synkro',
+    'codex-transcript-' + createHash('sha256').update(sessionId).digest('hex').slice(0, 16),
+  );
+  try {
+    const cached = resolve(readFileSync(cachePath, 'utf-8').trim());
+    if (sessionRoots.some((root) => isContainedFile(root, cached))) return cached;
+  } catch {}
+
+  const candidates: string[] = [];
+  for (const root of sessionRoots) {
+    let entries: string[] = [];
+    try { entries = readdirSync(root, { recursive: true, encoding: 'utf-8' }) as string[]; } catch {}
+    for (const entry of entries) {
+      if (!entry.endsWith('.jsonl')) continue;
+      const candidate = resolve(join(root, entry));
+      if (isContainedFile(root, candidate)) candidates.push(candidate);
+    }
+  }
+
+  let found = candidates.find((candidate) => candidate.includes(sessionId)) || '';
+  if (!found) {
+    const recent = candidates
+      .map((candidate) => {
+        try { return { candidate, mtime: statSync(candidate).mtimeMs }; }
+        catch { return { candidate, mtime: 0 }; }
+      })
+      .sort((a, b) => b.mtime - a.mtime)
+      .slice(0, 100);
+    for (const item of recent) {
+      try {
+        const first = JSON.parse(readJsonlHeader(item.candidate));
+        const candidateId = String(first?.payload?.session_id || first?.payload?.id || '');
+        if (first?.type === 'session_meta' && candidateId === sessionId) {
+          found = item.candidate;
+          break;
+        }
+      } catch {}
+    }
+  }
+
+  if (found) {
+    try {
+      mkdirSync(join(HOME, '.synkro'), { recursive: true });
+      writeFileSync(cachePath, found, { encoding: 'utf-8', mode: 0o600 });
+    } catch {}
+  }
+  return found;
 }
 
 export async function runStub(surface: string, opts: StubOpts = {}): Promise<void> {
@@ -2792,6 +3298,17 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
     // Codex: rewrite apply_patch tool_input into the CC edit shape before any
     // surface reads it (edit/cwe/cve). No-op for CC/Cursor and non-edit tools.
     if (harness === 'codex') normalizeCodexApplyPatch(payload);
+    if (harness === 'codex' && opts.subagent) {
+      const parentSessionId = String(payload?.session_id || '');
+      const childSessionId = String(payload?.agent_id || '');
+      if (parentSessionId && childSessionId) {
+        payload.parent_session_id = parentSessionId;
+        payload.session_id = childSessionId;
+        if (!payload.transcript_path && payload.agent_transcript_path) {
+          payload.transcript_path = payload.agent_transcript_path;
+        }
+      }
+    }
     telemPayload = payload;
     telemCwd = (typeof payload?.cwd === 'string' ? payload.cwd : '') || '';
     telemSessionId = String(payload?.session_id || payload?.conversation_id || '');
@@ -2862,14 +3379,40 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
     const envelope: any = { payload, harness, cwd: root || cwd, sessionId, synkroFileText };
 
     if (opts.needsFile) {
-      const fp = filePathFromToolInput(payload.tool_input || {});
-      if (fp && existsSync(fp)) {
-        const bc = gatherBaseContent(fp, payload.tool_input || {});
-        if (bc !== undefined) envelope.baseContent = bc;
+      const normalizedEdits = harness === 'codex' && Array.isArray(payload.__synkro_codex_edits)
+        ? payload.__synkro_codex_edits
+        : [{ tool_name: payload.tool_name, tool_input: payload.tool_input }];
+      const editBatch = normalizedEdits.map((edit: any) => {
+        const childPayload = {
+          ...payload,
+          tool_name: edit.tool_name,
+          tool_input: edit.tool_input,
+          __synkro_codex_operation: edit.__synkro_codex_operation,
+          __synkro_codex_move_target: edit.__synkro_codex_move_target,
+        };
+        delete childPayload.__synkro_codex_edits;
+        const fp = filePathFromToolInput(childPayload.tool_input || {});
+        const canRead = fp && (existsSync(fp) || (opts.postEdit && childPayload.__synkro_codex_operation === 'add'));
+        const bc = canRead
+          ? (opts.postEdit
+              ? gatherPreEditContentFromPost(
+                  fp,
+                  String(childPayload.tool_name || ''),
+                  childPayload.tool_input || {},
+                  String(childPayload.__synkro_codex_operation || ''),
+                )
+              : gatherBaseContent(fp, childPayload.tool_input || {}))
+          : undefined;
+        return { payload: childPayload, ...(bc !== undefined ? { baseContent: bc } : {}) };
+      });
+      if (editBatch.length) {
+        envelope.editBatch = editBatch;
+        envelope.payload = editBatch[0].payload;
+        if (editBatch[0].baseContent !== undefined) envelope.baseContent = editBatch[0].baseContent;
       }
     }
     if (opts.needsTranscript) {
-      const tp = typeof payload.transcript_path === 'string' ? payload.transcript_path : '';
+      const tp = resolveHookTranscriptPath(payload, harness, sessionId);
       if (tp && existsSync(tp)) {
         try {
           const t = readFileSync(tp, 'utf-8');
@@ -2881,9 +3424,34 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
           // by ts, so we no longer depend on the whole file for absolute message indices.
           const cap = opts.fullTranscript ? 400000 : 200000;
           envelope.transcript = t.length <= cap ? t : t.slice(t.length - cap);
+          if (harness === 'codex') {
+            const recovered = opts.codexTurnEdits
+              ? extractCompletedCodexTurnPatchEdits(envelope.transcript, root || cwd)
+              : extractCompletedCodexPatchEdits(envelope.transcript, root || cwd);
+            if (recovered.length) {
+              envelope.transcriptEdits = recovered;
+              if (opts.codexTurnEdits) {
+                envelope.editBatch = recovered.map((item) => ({
+                  ...item,
+                  payload: {
+                    ...item.payload,
+                    __synkro_post_edit_enforcement: true,
+                  },
+                }));
+                envelope.payload = envelope.editBatch[0].payload;
+                envelope.baseContent = envelope.editBatch[0].baseContent;
+              }
+            }
+          }
         } catch {}
       }
     }
+    // No completed apply_patch in this turn means there is nothing for the
+    // fallback to scan. Stay silent and avoid touching the server/database.
+    if (opts.codexTurnEdits && (!Array.isArray(envelope.editBatch) || envelope.editBatch.length === 0)) {
+      out(failOpen(harness));
+      return;
+    }
     if (opts.needsPlan) {
       const ti = payload.tool_input || {};
       envelope.planText = String(ti.plan || ti.content || payload.plan || '');
@@ -2896,7 +3464,8 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
     // prompt-submit is the opposite: it's INTERACTIVE (blocks the user's prompt from
     // being sent) under a short 5s hook timeout, so it gets ONE short attempt (below)
     // and a tight per-attempt budget that fits inside 5s — never the 6s×3 telemetry path.
-    const timeoutMs = surface === 'bash-followup' ? 32000
+    const timeoutMs = surface === 'cwe-precheck' ? 48000
+      : surface === 'bash-followup' ? 32000
       : surface === 'prompt-submit' ? 3500
       : (opts.telemetry ? 6000 : 28000);
     // Cloud has no local container to reach. Post the SAME envelope to the org's grader
@@ -2937,7 +3506,10 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
       } catch (e) { /* connection refused / timeout → retry below */ }
       if (i < attempts - 1) await new Promise((r) => setTimeout(r, 500 * (i + 1)));
     }
-    const responseText = text || failOpen(harness);
+    const rawResponseText = text || failOpen(harness);
+    const responseText = opts.stopContract && harness === 'codex'
+      ? codexStopResponse(rawResponseText)
+      : rawResponseText;
     out(responseText);
     emitStubTelemetry(surface, harness, telemPayload, responseText, Date.now() - startedAt, telemCwd, telemSessionId);
   } catch (err) {
@@ -3061,8 +3633,16 @@ function toolInputSummary(toolName: string, toolInput: any, includeCommand: bool
 // cc_model is derived by the caller (bounded tail read) and passed in; this stays
 // allocation-only so the dormant hot path never touches the transcript.
 function telemPayloadOpts(payload: any, harness: string, cwd: string, sessionId: string, ccModel?: string): any {
+  const normalizedHarness = String(harness || '').trim().toLowerCase().replace(/[\\s-]+/g, '_');
+  const agentKind = normalizedHarness === 'cursor'
+    ? 'cursor'
+    : normalizedHarness === 'codex'
+      ? 'codex'
+      : normalizedHarness === 'cc' || normalizedHarness === 'claude_code'
+        ? 'claude_code'
+        : undefined;
   return {
-    agent_kind: harness === 'cursor' ? 'cursor' : harness === 'codex' ? 'codex' : 'claude_code',
+    agent_kind: agentKind,
     cc_session_id: sessionId || undefined,
     cc_tool_use_id: payload?.tool_use_id ? String(payload.tool_use_id) : undefined,
     cc_model: ccModel || undefined,
@@ -3164,6 +3744,7 @@ function emitStubTelemetry(
 }
 `;
     STUB_EDIT_PRECHECK_TS = stubHook("edit-precheck", "{ needsFile: true, needsTranscript: true }");
+    STUB_EDIT_FOLLOWUP_TS = stubHook("edit-followup", "{ needsFile: true, needsTranscript: true, postEdit: true }");
     STUB_CWE_PRECHECK_TS = stubHook("cwe-precheck", "{ needsFile: true, needsTranscript: true }");
     STUB_CVE_PRECHECK_TS = stubHook("cve-precheck", "{ needsFile: true, needsTranscript: true }");
     STUB_BASH_JUDGE_TS = stubHook("bash-judge", "{ needsTranscript: true }");
@@ -3175,6 +3756,10 @@ function emitStubTelemetry(
     STUB_STOP_SUMMARY_TS = stubHook("stop-summary", "{ needsTranscript: true, fullTranscript: true }");
     STUB_SESSION_START_TS = stubHook("session-start", "{ telemetry: true }");
     STUB_TRANSCRIPT_SYNC_TS = stubHook("transcript-sync", "{ needsTranscript: true, fullTranscript: true, telemetry: true }");
+    STUB_CODEX_CWE_STOP_TS = stubHook("cwe-precheck", "{ needsTranscript: true, fullTranscript: true, codexTurnEdits: true, stopContract: true }");
+    STUB_CODEX_CVE_STOP_TS = stubHook("cve-precheck", "{ needsTranscript: true, fullTranscript: true, codexTurnEdits: true, stopContract: true }");
+    STUB_SUBAGENT_START_TS = stubHook("subagent-start", "{ telemetry: true, subagent: true }");
+    STUB_SUBAGENT_STOP_TS = stubHook("subagent-stop", "{ needsTranscript: true, fullTranscript: true, telemetry: true, subagent: true }");
     STUB_USER_PROMPT_SUBMIT_TS = stubHook("prompt-submit", "{ telemetry: true }");
     STUB_BASH_FOLLOWUP_TS = stubHook("bash-followup", "{ telemetry: true }");
     STUB_PROMPT_ROUTE_TS = `#!/usr/bin/env bun
@@ -3307,7 +3892,7 @@ try {
         const resp = await fetch('http://127.0.0.1:' + (process.env.SYNKRO_GRADER_HOST_PORT || '18929') + '/submit', {
           method: 'POST',
           headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + mcpJwt() },
-          body: JSON.stringify({ role: 'route-classify', payload: t.slice(0, 1000), content: 'x', agent_kind: 'claude_code', hedge: false }),
+          body: JSON.stringify({ role: 'route-classify', payload: t.slice(0, 1000), content: 'x', hedge: false }),
           signal: AbortSignal.timeout(1000),
         });
         if (resp.ok) {
@@ -3346,8 +3931,14 @@ const PORT = process.env.SYNKRO_MCP_PORT || '18931';
 function mcpJwt(): string { try { return readFileSync(join(homedir(), '.synkro', '.mcp-jwt'), 'utf-8').trim(); } catch { return ''; } }
 const chunks: Buffer[] = [];
 for await (const chunk of process.stdin) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+let originalToolInput: Record<string, unknown> = {};
+let hookEventName = 'PreToolUse';
 try {
   const payload = JSON.parse(Buffer.concat(chunks).toString('utf-8') || '{}');
+  hookEventName = String(payload.hook_event_name || payload.hookEventName || 'PreToolUse');
+  if (payload.tool_input && typeof payload.tool_input === 'object' && !Array.isArray(payload.tool_input)) {
+    originalToolInput = payload.tool_input;
+  }
   await fetch('http://127.0.0.1:' + PORT + '/api/local/task-activate-intent', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + mcpJwt() },
@@ -3355,7 +3946,29 @@ try {
     signal: AbortSignal.timeout(5000),
   });
 } catch {}
-process.stdout.write('{}\\n');
+// PreToolUse enforcement and Codex's native approval are separate lifecycle
+// stages. The policy gate already allowed this exact activate_standard call;
+// approve its subsequent PermissionRequest so headless approval_policy=never
+// can execute it. This script is registered only for the activation matcher,
+// never as a blanket MCP approval hook.
+if (process.env.SYNKRO_HOOK_FORMAT === 'codex' && hookEventName === 'PermissionRequest') {
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: 'PermissionRequest',
+      decision: { behavior: 'allow' },
+    },
+  }) + '\\n');
+} else if (process.env.SYNKRO_HOOK_FORMAT === 'codex') {
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'allow',
+      updatedInput: originalToolInput,
+    },
+  }) + '\\n');
+} else {
+  process.stdout.write('{}\\n');
+}
 `;
     STUB_CURSOR_BASH_JUDGE_TS = stubHook("bash-judge", "{ needsTranscript: true, harness: 'cursor' }");
     STUB_CURSOR_SKILL_JUDGE_TS = stubHook("skill-judge", "{ needsFile: true, needsTranscript: true, harness: 'cursor' }");
@@ -3382,9 +3995,9 @@ __export(stub_exports, {
   saveCredentials: () => saveCredentials
 });
 import { createServer } from "http";
-import { writeFileSync as writeFileSync11, readFileSync as readFileSync13, existsSync as existsSync16, mkdirSync as mkdirSync9, unlinkSync as unlinkSync5 } from "fs";
-import { homedir as homedir13, platform as platform2 } from "os";
-import { join as join11, dirname as dirname5 } from "path";
+import { writeFileSync as writeFileSync11, readFileSync as readFileSync14, existsSync as existsSync16, mkdirSync as mkdirSync9, unlinkSync as unlinkSync5 } from "fs";
+import { homedir as homedir14, platform as platform2 } from "os";
+import { join as join12, dirname as dirname5 } from "path";
 import { execFile } from "child_process";
 import jwt from "jsonwebtoken";
 function openBrowser(url) {
@@ -3423,7 +4036,7 @@ function loadCredentials() {
     return null;
   }
   try {
-    const content = readFileSync13(AUTH_FILE, "utf8");
+    const content = readFileSync14(AUTH_FILE, "utf8");
     return JSON.parse(content);
   } catch (error) {
     return null;
@@ -3711,7 +4324,7 @@ var init_stub = __esm({
     PORT = 8100;
     RAW_WEB_AUTH_URL = process.env.SYNKRO_WEB_AUTH_URL;
     SYNKRO_WEB_AUTH_URL = RAW_WEB_AUTH_URL && /^https?:\/\//.test(RAW_WEB_AUTH_URL) ? RAW_WEB_AUTH_URL : "https://app.synkro.sh";
-    AUTH_FILE = process.env.SYNKRO_AUTH_FILE || join11(homedir13(), ".synkro", "credentials.json");
+    AUTH_FILE = process.env.SYNKRO_AUTH_FILE || join12(homedir14(), ".synkro", "credentials.json");
     RAW_API_URL = process.env.SYNKRO_CRUD_URL || process.env.SYNKRO_API_URL;
     SYNKRO_API_URL = RAW_API_URL && /^https?:\/\//.test(RAW_API_URL) ? RAW_API_URL : "https://api.synkro.sh";
     ERROR_HTML = `
@@ -3948,9 +4561,9 @@ __export(claudeDesktopTap_exports, {
   runClaudeDesktopTap: () => runClaudeDesktopTap
 });
 import { spawn as spawn2 } from "child_process";
-import { writeFileSync as writeFileSync12, mkdtempSync, mkdirSync as mkdirSync10, readFileSync as readFileSync14, existsSync as existsSync17 } from "fs";
-import { join as join12 } from "path";
-import { homedir as homedir14 } from "os";
+import { writeFileSync as writeFileSync12, mkdtempSync, mkdirSync as mkdirSync10, readFileSync as readFileSync15, existsSync as existsSync17 } from "fs";
+import { join as join13 } from "path";
+import { homedir as homedir15 } from "os";
 function claudeDesktopInstalled() {
   return process.platform === "darwin" && existsSync17("/Applications/Claude.app/Contents/MacOS/Claude");
 }
@@ -4066,7 +4679,7 @@ async function runClaudeDesktopTap(opts = {}) {
   }
   let token = "";
   try {
-    token = readFileSync14(JWT_PATH, "utf-8").trim();
+    token = readFileSync15(JWT_PATH, "utf-8").trim();
   } catch {
   }
   if (!token) {
@@ -4087,13 +4700,13 @@ async function runClaudeDesktopTap(opts = {}) {
   } catch (err) {
     console.log(`  \u26A0 Could not register Claude Desktop MCP: ${err.message}`);
   }
-  const cdRoot = join12(homedir14(), ".synkro", "cd-sessions");
+  const cdRoot = join13(homedir15(), ".synkro", "cd-sessions");
   mkdirSync10(cdRoot, { recursive: true });
-  const sessionDir = mkdtempSync(join12(cdRoot, "synkro-cd-"));
-  writeFileSync12(join12(sessionDir, "tap.py"), ADDON_PY, "utf-8");
-  writeFileSync12(join12(sessionDir, "mcp_proxy.py"), MCP_PROXY_PY, { mode: 493 });
-  writeFileSync12(join12(sessionDir, "mcp_patch.py"), MCP_PATCH_PY, "utf-8");
-  const runnerPath = join12(sessionDir, "run.sh");
+  const sessionDir = mkdtempSync(join13(cdRoot, "synkro-cd-"));
+  writeFileSync12(join13(sessionDir, "tap.py"), ADDON_PY, "utf-8");
+  writeFileSync12(join13(sessionDir, "mcp_proxy.py"), MCP_PROXY_PY, { mode: 493 });
+  writeFileSync12(join13(sessionDir, "mcp_patch.py"), MCP_PATCH_PY, "utf-8");
+  const runnerPath = join13(sessionDir, "run.sh");
   writeFileSync12(runnerPath, buildRunner(sessionDir), { mode: 493 });
   await new Promise((resolve6) => {
     const child = spawn2("bash", [runnerPath], {
@@ -4127,7 +4740,7 @@ var init_claudeDesktopTap = __esm({
     TURN_VERDICTS_URL = "http://127.0.0.1:18931/api/local/turn-verdicts";
     TURN_VERDICT_URL = "http://127.0.0.1:18931/api/local/turn-verdict";
     MCP_EVENT_URL = "http://127.0.0.1:18931/api/local/mcp/event";
-    JWT_PATH = join12(homedir14(), ".synkro", ".mcp-jwt");
+    JWT_PATH = join13(homedir15(), ".synkro", ".mcp-jwt");
     ADDON_PY = `import os, json, threading, urllib.request, urllib.error, re, base64, time, hashlib
 from mitmproxy import http
 
@@ -4264,6 +4877,7 @@ def _emit_mcp_event(server, tool, ev_type, eid, convo_id=""):
             "tool_name": (str(tool)[:120] if tool else None),
             "decision": ("allowed" if ev_type == "tool_call" else None),
             "repo": "claude-desktop",
+            "harness": "claude_desktop",
         }).encode("utf-8")
         _post_json(MCP_EVENT_URL, payload, 5)
     except Exception:
@@ -5243,9 +5857,9 @@ __export(macKeychain_exports, {
   writeCursorApiKey: () => writeCursorApiKey,
   writeRefreshAgent: () => writeRefreshAgent
 });
-import { existsSync as existsSync18, mkdirSync as mkdirSync11, writeFileSync as writeFileSync13, chmodSync as chmodSync2, readFileSync as readFileSync15 } from "fs";
-import { homedir as homedir15, platform as platform3 } from "os";
-import { join as join13 } from "path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync11, writeFileSync as writeFileSync13, chmodSync as chmodSync2, readFileSync as readFileSync16 } from "fs";
+import { homedir as homedir16, platform as platform3 } from "os";
+import { join as join14 } from "path";
 import { spawnSync as spawnSync2 } from "child_process";
 function needsKeychainBridge() {
   return platform3() === "darwin";
@@ -5268,7 +5882,7 @@ function exportKeychainCreds() {
   let changed = true;
   try {
     if (existsSync18(CLAUDE_CREDS_FILE)) {
-      changed = readFileSync15(CLAUDE_CREDS_FILE, "utf-8") !== blob;
+      changed = readFileSync16(CLAUDE_CREDS_FILE, "utf-8") !== blob;
     }
   } catch {
   }
@@ -5278,7 +5892,7 @@ function exportKeychainCreds() {
 }
 function cursorApiKeyConfigured() {
   try {
-    return existsSync18(CURSOR_API_KEY_FILE) && readFileSync15(CURSOR_API_KEY_FILE, "utf-8").trim().length > 0;
+    return existsSync18(CURSOR_API_KEY_FILE) && readFileSync16(CURSOR_API_KEY_FILE, "utf-8").trim().length > 0;
   } catch {
     return false;
   }
@@ -5294,7 +5908,7 @@ function writeCursorApiKey(key) {
 async function validateCursorApiKey() {
   let key;
   try {
-    key = readFileSync15(CURSOR_API_KEY_FILE, "utf-8").trim();
+    key = readFileSync16(CURSOR_API_KEY_FILE, "utf-8").trim();
   } catch {
     return null;
   }
@@ -5315,7 +5929,7 @@ async function validateCursorApiKey() {
 function credsAreStale() {
   if (!existsSync18(CLAUDE_CREDS_FILE)) return true;
   try {
-    const raw = readFileSync15(CLAUDE_CREDS_FILE, "utf-8");
+    const raw = readFileSync16(CLAUDE_CREDS_FILE, "utf-8");
     const exp = JSON.parse(raw)?.claudeAiOauth?.expiresAt ?? 0;
     if (!exp) return true;
     return Date.now() >= exp - REFRESH_EXPIRY_BUFFER_SECONDS * 1e3;
@@ -5330,7 +5944,7 @@ function writeRefreshAgent(synkroBinPath) {
   if (platform3() !== "darwin") {
     throw new KeychainExportError("writeRefreshAgent is darwin-only");
   }
-  mkdirSync11(join13(homedir15(), "Library", "LaunchAgents"), { recursive: true });
+  mkdirSync11(join14(homedir16(), "Library", "LaunchAgents"), { recursive: true });
   mkdirSync11(SYNKRO_DIR6, { recursive: true });
   const script = `#!/bin/bash
 # Generated by synkro (writeRefreshAgent). Expiry-aware Claude creds refresher.
@@ -5427,7 +6041,7 @@ function refreshCreds() {
 }
 function readExportedCreds() {
   try {
-    return readFileSync15(CLAUDE_CREDS_FILE, "utf-8");
+    return readFileSync16(CLAUDE_CREDS_FILE, "utf-8");
   } catch {
     return null;
   }
@@ -5436,16 +6050,16 @@ var SYNKRO_DIR6, CLAUDE_CREDS_DIR, CLAUDE_CREDS_FILE, CURSOR_CREDS_DIR, CURSOR_A
 var init_macKeychain = __esm({
   "cli/local-cc/macKeychain.ts"() {
     "use strict";
-    SYNKRO_DIR6 = join13(homedir15(), ".synkro");
-    CLAUDE_CREDS_DIR = join13(SYNKRO_DIR6, "claude-creds");
-    CLAUDE_CREDS_FILE = join13(CLAUDE_CREDS_DIR, ".credentials.json");
-    CURSOR_CREDS_DIR = join13(SYNKRO_DIR6, "cursor-creds");
-    CURSOR_API_KEY_FILE = join13(CURSOR_CREDS_DIR, "api-key");
+    SYNKRO_DIR6 = join14(homedir16(), ".synkro");
+    CLAUDE_CREDS_DIR = join14(SYNKRO_DIR6, "claude-creds");
+    CLAUDE_CREDS_FILE = join14(CLAUDE_CREDS_DIR, ".credentials.json");
+    CURSOR_CREDS_DIR = join14(SYNKRO_DIR6, "cursor-creds");
+    CURSOR_API_KEY_FILE = join14(CURSOR_CREDS_DIR, "api-key");
     KEYCHAIN_SERVICE = "Claude Code-credentials";
     LAUNCHD_LABEL = "com.synkro.cli.claude-creds-refresh";
-    LAUNCHD_PLIST = join13(homedir15(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
-    REFRESH_SCRIPT = join13(SYNKRO_DIR6, "claude-creds-refresh-loop.sh");
-    REFRESH_LOG = join13(SYNKRO_DIR6, "claude-creds-refresh.log");
+    LAUNCHD_PLIST = join14(homedir16(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+    REFRESH_SCRIPT = join14(SYNKRO_DIR6, "claude-creds-refresh-loop.sh");
+    REFRESH_LOG = join14(SYNKRO_DIR6, "claude-creds-refresh.log");
     REFRESH_EXPIRY_BUFFER_SECONDS = 120;
     MIN_REFRESH_INTERVAL_SECONDS = 30;
     MAX_REFRESH_INTERVAL_SECONDS = 5 * 60;
@@ -5464,8 +6078,11 @@ var init_macKeychain = __esm({
 var dockerInstall_exports = {};
 __export(dockerInstall_exports, {
   DockerInstallError: () => DockerInstallError,
+  HOST_PGLITE_PORT: () => HOST_PGLITE_PORT,
+  PGLITE_PASSWORD_PATH: () => PGLITE_PASSWORD_PATH,
   SYNKRO_DIR: () => SYNKRO_DIR7,
   assertDockerAvailable: () => assertDockerAvailable,
+  createPgliteScramVerifier: () => createPgliteScramVerifier,
   dockerInstall: () => dockerInstall,
   dockerRemove: () => dockerRemove,
   dockerSafeRestart: () => dockerSafeRestart,
@@ -5474,21 +6091,71 @@ __export(dockerInstall_exports, {
   dockerStatus: () => dockerStatus,
   dockerStop: () => dockerStop,
   dockerUpdate: () => dockerUpdate,
+  ensurePgliteProxyCredentials: () => ensurePgliteProxyCredentials,
   imageTag: () => imageTag,
   normalizeProvider: () => normalizeProvider,
   poolLabel: () => poolLabel,
   readContainerConfig: () => readContainerConfig,
   resolveConductorProvider: () => resolveConductorProvider,
+  resolveContainerName: () => resolveContainerName,
   resolveGraderPool: () => resolveGraderPool,
   resolveWorkerConfig: () => resolveWorkerConfig,
   splitWorkers: () => splitWorkers,
   waitForContainerReady: () => waitForContainerReady,
   waitForWorkersReady: () => waitForWorkersReady
 });
-import { copyFileSync, existsSync as existsSync19, mkdirSync as mkdirSync12, readFileSync as readFileSync16, readdirSync as readdirSync2 } from "fs";
-import { homedir as homedir16 } from "os";
-import { join as join14 } from "path";
+import {
+  chmodSync as chmodSync3,
+  copyFileSync,
+  existsSync as existsSync19,
+  mkdirSync as mkdirSync12,
+  readFileSync as readFileSync17,
+  readdirSync as readdirSync2,
+  renameSync as renameSync7,
+  writeFileSync as writeFileSync14
+} from "fs";
+import { createHash as createHash2, createHmac, pbkdf2Sync, randomBytes as randomBytes2 } from "crypto";
+import { homedir as homedir17 } from "os";
+import { join as join15 } from "path";
 import { execSync as execSync3, spawnSync as spawnSync3 } from "child_process";
+function resolveContainerName(raw = process.env.SYNKRO_CONTAINER_NAME) {
+  const value = String(raw || "").trim();
+  if (!value) return "synkro-server";
+  if (!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(value)) {
+    throw new Error("SYNKRO_CONTAINER_NAME must be a valid Docker container name (1-128 letters, digits, _, ., or -)");
+  }
+  return value;
+}
+function createPgliteScramVerifier(password, salt = randomBytes2(16)) {
+  const iterations = 4096;
+  const saltedPassword = pbkdf2Sync(password, salt, iterations, 32, "sha256");
+  const clientKey = createHmac("sha256", saltedPassword).update("Client Key").digest();
+  const storedKey = createHash2("sha256").update(clientKey).digest();
+  const serverKey = createHmac("sha256", saltedPassword).update("Server Key").digest();
+  return `SCRAM-SHA-256$${iterations}:${salt.toString("base64")}$${storedKey.toString("base64")}:${serverKey.toString("base64")}`;
+}
+function ensurePgliteProxyCredentials() {
+  const hasPassword = existsSync19(PGLITE_PASSWORD_PATH) && readFileSync17(PGLITE_PASSWORD_PATH, "utf-8").trim().length > 0;
+  const hasUserlist = existsSync19(PGLITE_USERLIST_PATH) && readFileSync17(PGLITE_USERLIST_PATH, "utf-8").trim().length > 0;
+  if (hasPassword && hasUserlist) {
+    chmodSync3(PGLITE_PASSWORD_PATH, 384);
+    chmodSync3(PGLITE_USERLIST_PATH, 384);
+    return;
+  }
+  const password = randomBytes2(24).toString("base64url");
+  const verifier = createPgliteScramVerifier(password);
+  const suffix = `${process.pid}.${Date.now()}.tmp`;
+  const passwordTmp = `${PGLITE_PASSWORD_PATH}.${suffix}`;
+  const userlistTmp = `${PGLITE_USERLIST_PATH}.${suffix}`;
+  writeFileSync14(passwordTmp, `${password}
+`, { mode: 384 });
+  writeFileSync14(userlistTmp, `"synkro" "${verifier}"
+`, { mode: 384 });
+  renameSync7(passwordTmp, PGLITE_PASSWORD_PATH);
+  renameSync7(userlistTmp, PGLITE_USERLIST_PATH);
+  chmodSync3(PGLITE_PASSWORD_PATH, 384);
+  chmodSync3(PGLITE_USERLIST_PATH, 384);
+}
 function resolveConductorProvider(pool, counts) {
   if (pool !== "auto") return pool;
   const ranked = [
@@ -5597,9 +6264,9 @@ function readSynkroFileConfig() {
   try {
     const root = execSync3("git rev-parse --show-toplevel 2>/dev/null", { encoding: "utf-8", timeout: 3e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
     if (!root) return { pool: "auto", warnings: [] };
-    const fp = join14(root, "synkro.toml");
+    const fp = join15(root, "synkro.toml");
     if (!existsSync19(fp)) return { pool: "auto", warnings: [] };
-    const parsed = parseSynkroToml(readFileSync16(fp, "utf-8"));
+    const parsed = parseSynkroToml(readFileSync17(fp, "utf-8"));
     return resolveGraderPool(parsed);
   } catch {
   }
@@ -5682,7 +6349,7 @@ function assertDockerAvailable() {
 }
 function claudeCredsHostDir() {
   if (needsKeychainBridge()) return CLAUDE_CREDS_DIR;
-  return join14(homedir16(), ".claude");
+  return join15(homedir17(), ".claude");
 }
 function resolveSynkroBin() {
   const which2 = spawnSync3("which", ["synkro"], { encoding: "utf-8", timeout: 5e3 });
@@ -5741,16 +6408,17 @@ async function dockerInstall(opts = {}) {
   const usesClaude = claudeWorkers > 0 || conductorProvider === "claude_code";
   const usesCursor = cursorWorkers > 0 || conductorProvider === "cursor";
   const usesCodex = codexWorkers > 0 || conductorProvider === "codex";
-  const codexHomeDir = opts.codexHomeDir ?? join14(SYNKRO_DIR7, "codex-local-session");
-  if (usesCodex && !existsSync19(join14(codexHomeDir, "auth.json"))) {
+  const codexHomeDir = opts.codexHomeDir ?? join15(SYNKRO_DIR7, "codex-local-session");
+  if (usesCodex && !existsSync19(join15(codexHomeDir, "auth.json"))) {
     throw new DockerInstallError(
       "Codex grader credentials are missing. Re-run `synkro install` to authorize an isolated Codex session."
     );
   }
   mkdirSync12(PGDATA_PATH, { recursive: true });
   mkdirSync12(BACKUP_DIR, { recursive: true });
+  ensurePgliteProxyCredentials();
   mkdirSync12(CLAUDE_HOST_STATE_DIR, { recursive: true });
-  const hostClaudeJson = join14(homedir16(), ".claude.json");
+  const hostClaudeJson = join15(homedir17(), ".claude.json");
   if (existsSync19(hostClaudeJson)) {
     copyFileSync(hostClaudeJson, CLAUDE_HOST_STATE_FILE);
   }
@@ -5783,7 +6451,7 @@ async function dockerInstall(opts = {}) {
       console.warn(`    Plist written to ${plist} \u2014 load manually with launchctl bootstrap when ready.`);
     }
   } else {
-    mkdirSync12(join14(homedir16(), ".claude"), { recursive: true });
+    mkdirSync12(join15(homedir17(), ".claude"), { recursive: true });
   }
   const imageExistsLocally = () => spawnSync3("docker", ["image", "inspect", image], { stdio: "ignore", timeout: 3e4 }).status === 0;
   const skipPull = process.env.SYNKRO_SKIP_PULL === "1" || process.env.SYNKRO_SKIP_PULL === "true";
@@ -5822,7 +6490,7 @@ async function dockerInstall(opts = {}) {
     "-p",
     `127.0.0.1:${HOST_CWE_PORT}:8930`,
     "-p",
-    `127.0.0.1:${HOST_PGLITE_PORT}:5433`,
+    `127.0.0.1:${HOST_PGLITE_PORT}:5434`,
     "-v",
     `${PGDATA_PATH}:/data/pgdata`,
     "-v",
@@ -5836,7 +6504,7 @@ async function dockerInstall(opts = {}) {
     "-v",
     `${credsDir}:/home/synkro/.claude:rw`,
     "-v",
-    `${join14(homedir16(), ".claude")}:/data/claude-host:ro`,
+    `${join15(homedir17(), ".claude")}:/data/claude-host:ro`,
     "-v",
     `${CLAUDE_HOST_STATE_DIR}:/data/claude-host-state:ro`,
     // Cursor creds — mounted RW so the in-container refresher can rotate the
@@ -5856,6 +6524,8 @@ async function dockerInstall(opts = {}) {
     // Pass through the batch-size lever if the operator set it. Defaults
     // inside the container to 5; clamped to [1, 20] by synkro-server.ts.
     ...process.env.SYNKRO_MAX_BATCH_SIZE ? ["-e", `SYNKRO_MAX_BATCH_SIZE=${process.env.SYNKRO_MAX_BATCH_SIZE}`] : [],
+    // Full verifier prompt/response tracing is explicit opt-in because it contains source code.
+    ...process.env.SYNKRO_VERIFY_TRACE === "1" ? ["-e", "SYNKRO_VERIFY_TRACE=1"] : [],
     // Cursor grading model — tunable like SYNKRO_MAX_BATCH_SIZE.
     ...process.env.SYNKRO_CURSOR_MODEL ? ["-e", `SYNKRO_CURSOR_MODEL=${process.env.SYNKRO_CURSOR_MODEL}`] : [],
     // Fix-poll kill switch. Default ON in the image; a benchmark/headless run
@@ -5887,7 +6557,14 @@ async function dockerInstall(opts = {}) {
   if (run.status !== 0) {
     throw new DockerInstallError(`docker run failed (image ${image})`);
   }
-  return { image, hostMcpPort: HOST_MCP_PORT, hostGraderPort: HOST_GRADER_PORT, hostCwePort: HOST_CWE_PORT, hostPglitePort: HOST_PGLITE_PORT };
+  return {
+    image,
+    hostMcpPort: HOST_MCP_PORT,
+    hostGraderPort: HOST_GRADER_PORT,
+    hostCwePort: HOST_CWE_PORT,
+    hostPglitePort: HOST_PGLITE_PORT,
+    pglitePasswordPath: PGLITE_PASSWORD_PATH
+  };
 }
 async function waitForContainerReady(timeoutMs = 6e4) {
   const start = Date.now();
@@ -5942,7 +6619,7 @@ function dockerStatus() {
   return {
     running: true,
     image: imageTag(),
-    healthz: `http://127.0.0.1:${HOST_MCP_PORT}/`
+    healthz: `http://127.0.0.1:${HOST_MCP_PORT}/health`
   };
 }
 function readContainerConfig() {
@@ -6089,23 +6766,34 @@ function checkPgdata() {
   if (!hasPgControl) return { healthy: false, details: "pg_control/global directory missing" };
   return { healthy: true, details: `${entries.length} entries, WAL present, no stale PID` };
 }
-var SYNKRO_DIR7, MCP_JWT_PATH, PGDATA_PATH, CLAUDE_HOST_STATE_DIR, CLAUDE_HOST_STATE_FILE, HOST_MCP_PORT, HOST_GRADER_PORT, HOST_CWE_PORT, HOST_PGLITE_PORT, CONTAINER_NAME, DEFAULT_IMAGE, DockerInstallError, BACKUP_DIR;
+var SYNKRO_DIR7, MCP_JWT_PATH, PGDATA_PATH, PGLITE_PASSWORD_PATH, PGLITE_USERLIST_PATH, CLAUDE_HOST_STATE_DIR, CLAUDE_HOST_STATE_FILE, HOST_MCP_PORT, HOST_GRADER_PORT, HOST_CWE_PORT, HOST_PGLITE_PORT, CONTAINER_NAME, defaultImageVersion, DEFAULT_IMAGE, DockerInstallError, BACKUP_DIR;
 var init_dockerInstall = __esm({
   "cli/local-cc/dockerInstall.ts"() {
     "use strict";
     init_agentDetect();
     init_macKeychain();
-    SYNKRO_DIR7 = join14(homedir16(), ".synkro");
-    MCP_JWT_PATH = join14(SYNKRO_DIR7, ".mcp-jwt");
-    PGDATA_PATH = join14(SYNKRO_DIR7, "pgdata");
-    CLAUDE_HOST_STATE_DIR = join14(SYNKRO_DIR7, "claude-host-state");
-    CLAUDE_HOST_STATE_FILE = join14(CLAUDE_HOST_STATE_DIR, ".claude.json");
+    SYNKRO_DIR7 = join15(homedir17(), ".synkro");
+    MCP_JWT_PATH = join15(SYNKRO_DIR7, ".mcp-jwt");
+    PGDATA_PATH = join15(SYNKRO_DIR7, "pgdata");
+    PGLITE_PASSWORD_PATH = join15(SYNKRO_DIR7, ".pglite-password");
+    PGLITE_USERLIST_PATH = join15(SYNKRO_DIR7, ".pglite-userlist");
+    CLAUDE_HOST_STATE_DIR = join15(SYNKRO_DIR7, "claude-host-state");
+    CLAUDE_HOST_STATE_FILE = join15(CLAUDE_HOST_STATE_DIR, ".claude.json");
     HOST_MCP_PORT = parseInt(process.env.SYNKRO_HOST_MCP_PORT || "18931", 10);
     HOST_GRADER_PORT = parseInt(process.env.SYNKRO_HOST_GRADER_PORT || "18929", 10);
     HOST_CWE_PORT = parseInt(process.env.SYNKRO_HOST_CWE_PORT || "18930", 10);
     HOST_PGLITE_PORT = parseInt(process.env.SYNKRO_HOST_PGLITE_PORT || "15433", 10);
-    CONTAINER_NAME = "synkro-server";
-    DEFAULT_IMAGE = "ghcr.io/synkro-sh/synkro-server:latest";
+    CONTAINER_NAME = resolveContainerName();
+    defaultImageVersion = () => {
+      if (true) return "1.7.90";
+      try {
+        const pkg = JSON.parse(readFileSync17(new URL("../../package.json", import.meta.url), "utf8"));
+        if (pkg.version) return pkg.version;
+      } catch {
+      }
+      return process.env.npm_package_version || "0.0.0-dev";
+    };
+    DEFAULT_IMAGE = `ghcr.io/synkro-sh/synkro-server:${defaultImageVersion()}`;
     DockerInstallError = class extends Error {
       constructor(message, cause) {
         super(message);
@@ -6114,17 +6802,17 @@ var init_dockerInstall = __esm({
       }
       cause;
     };
-    BACKUP_DIR = join14(SYNKRO_DIR7, "pgdata-backups");
+    BACKUP_DIR = join15(SYNKRO_DIR7, "pgdata-backups");
   }
 });
 
 // cli/local-cc/setupToken.ts
 import { spawn as nodeSpawn } from "child_process";
-import { readFileSync as readFileSync17, unlinkSync as unlinkSync6 } from "fs";
-import { homedir as homedir17, platform as platform4 } from "os";
-import { join as join15 } from "path";
+import { readFileSync as readFileSync18, unlinkSync as unlinkSync6 } from "fs";
+import { homedir as homedir18, platform as platform4 } from "os";
+import { join as join16 } from "path";
 function captureClaudeSetupToken() {
-  const tmpFile = join15(SYNKRO_DIR8, `token-capture-${Date.now()}.raw`);
+  const tmpFile = join16(SYNKRO_DIR8, `token-capture-${Date.now()}.raw`);
   const isMac = platform4() === "darwin";
   const bin = "script";
   const args2 = isMac ? ["-q", tmpFile, "claude", "setup-token"] : ["-qec", "claude setup-token", tmpFile];
@@ -6138,7 +6826,7 @@ function captureClaudeSetupToken() {
     proc.on("close", (code) => {
       let raw = "";
       try {
-        raw = readFileSync17(tmpFile, "utf-8");
+        raw = readFileSync18(tmpFile, "utf-8");
       } catch (e) {
         reject(new Error(`Could not read script output file: ${e.message}`));
         return;
@@ -6204,15 +6892,15 @@ var SYNKRO_DIR8;
 var init_setupToken = __esm({
   "cli/local-cc/setupToken.ts"() {
     "use strict";
-    SYNKRO_DIR8 = join15(homedir17(), ".synkro");
+    SYNKRO_DIR8 = join16(homedir18(), ".synkro");
   }
 });
 
 // cli/local-cc/codexCloudSetup.ts
 import { spawn as nodeSpawn2, spawnSync as spawnSync4 } from "child_process";
-import { readFileSync as readFileSync18, writeFileSync as writeFileSync14, mkdirSync as mkdirSync13, rmSync, existsSync as existsSync20 } from "fs";
-import { homedir as homedir18 } from "os";
-import { join as join16 } from "path";
+import { readFileSync as readFileSync19, writeFileSync as writeFileSync15, mkdirSync as mkdirSync13, rmSync, existsSync as existsSync20 } from "fs";
+import { homedir as homedir19 } from "os";
+import { join as join17 } from "path";
 function findCodexBinary() {
   if (process.env.SYNKRO_CODEX_BIN) return process.env.SYNKRO_CODEX_BIN;
   const r = spawnSync4("which", ["codex"], { encoding: "utf-8" });
@@ -6221,7 +6909,7 @@ function findCodexBinary() {
 }
 function runCodexLogin(codexBin, codexHome) {
   mkdirSync13(codexHome, { recursive: true, mode: 448 });
-  writeFileSync14(join16(codexHome, "config.toml"), 'cli_auth_credentials_store = "file"\n', { mode: 384 });
+  writeFileSync15(join17(codexHome, "config.toml"), 'cli_auth_credentials_store = "file"\n', { mode: 384 });
   return new Promise((resolve6, reject) => {
     const proc = nodeSpawn2(codexBin, ["login"], {
       stdio: "inherit",
@@ -6253,13 +6941,13 @@ async function setupCodexCloud(gatewayUrl, bearerToken, onStatus) {
   } catch (e) {
     return { ok: false, error: `Codex login failed: ${e.message}` };
   }
-  const authPath = join16(CODEX_CLOUD_HOME, "auth.json");
+  const authPath = join17(CODEX_CLOUD_HOME, "auth.json");
   if (!existsSync20(authPath)) {
     return { ok: false, error: "codex login completed but no auth.json was written \u2014 did the browser approval finish?" };
   }
   let auth;
   try {
-    auth = JSON.parse(readFileSync18(authPath, "utf-8"));
+    auth = JSON.parse(readFileSync19(authPath, "utf-8"));
   } catch (e) {
     return { ok: false, error: `could not read codex auth.json: ${e.message}` };
   }
@@ -6293,7 +6981,7 @@ async function setupCodexLocal(onStatus) {
   if (!codexBin) {
     return { ok: false, error: "Codex CLI not found on PATH. Install Codex, then re-run `synkro install`." };
   }
-  const authPath = join16(CODEX_LOCAL_HOME, "auth.json");
+  const authPath = join17(CODEX_LOCAL_HOME, "auth.json");
   if (!existsSync20(authPath)) {
     onStatus?.("Opening your browser to authorize an isolated Codex session for the local grader\u2026");
     try {
@@ -6303,7 +6991,7 @@ async function setupCodexLocal(onStatus) {
     }
   }
   try {
-    const auth = JSON.parse(readFileSync18(authPath, "utf-8"));
+    const auth = JSON.parse(readFileSync19(authPath, "utf-8"));
     if (!auth.tokens?.refresh_token) throw new Error("auth.json has no refresh token");
   } catch (e) {
     return { ok: false, error: `Codex local grader auth is invalid: ${e.message}` };
@@ -6315,9 +7003,9 @@ var SYNKRO_DIR9, CODEX_CLOUD_HOME, CODEX_LOCAL_HOME;
 var init_codexCloudSetup = __esm({
   "cli/local-cc/codexCloudSetup.ts"() {
     "use strict";
-    SYNKRO_DIR9 = join16(homedir18(), ".synkro");
-    CODEX_CLOUD_HOME = join16(SYNKRO_DIR9, "codex-cloud-session");
-    CODEX_LOCAL_HOME = join16(SYNKRO_DIR9, "codex-local-session");
+    SYNKRO_DIR9 = join17(homedir19(), ".synkro");
+    CODEX_CLOUD_HOME = join17(SYNKRO_DIR9, "codex-cloud-session");
+    CODEX_LOCAL_HOME = join17(SYNKRO_DIR9, "codex-local-session");
   }
 });
 
@@ -6339,21 +7027,21 @@ __export(ptyShim_exports, {
 import {
   existsSync as existsSync21,
   mkdirSync as mkdirSync14,
-  writeFileSync as writeFileSync15,
-  chmodSync as chmodSync3,
-  readFileSync as readFileSync19,
+  writeFileSync as writeFileSync16,
+  chmodSync as chmodSync4,
+  readFileSync as readFileSync20,
   rmSync as rmSync2,
   realpathSync,
   symlinkSync,
   lstatSync,
   readdirSync as readdirSync3
 } from "fs";
-import { homedir as homedir19 } from "os";
-import { join as join17 } from "path";
+import { homedir as homedir20 } from "os";
+import { join as join18 } from "path";
 import { spawnSync as spawnSync5, spawn as spawn3 } from "child_process";
 function rcFiles() {
-  const h = homedir19();
-  return [join17(h, ".zshrc"), join17(h, ".bashrc"), join17(h, ".bash_profile")];
+  const h = homedir20();
+  return [join18(h, ".zshrc"), join18(h, ".bashrc"), join18(h, ".bash_profile")];
 }
 function resolveRealClaude() {
   const r = spawnSync5("bash", ["-lc", `PATH="$(printf '%s' "$PATH" | sed "s#$HOME/.synkro/bin:##g")" command -v claude`], { encoding: "utf-8" });
@@ -6365,7 +7053,7 @@ function resolveRealClaude() {
       return p;
     }
   }
-  for (const c of [join17(homedir19(), ".local", "bin", "claude"), "/usr/local/bin/claude", "/opt/homebrew/bin/claude"]) {
+  for (const c of [join18(homedir20(), ".local", "bin", "claude"), "/usr/local/bin/claude", "/opt/homebrew/bin/claude"]) {
     if (existsSync21(c)) {
       try {
         return realpathSync(c);
@@ -6380,7 +7068,7 @@ function findClaudeLink() {
   const r = spawnSync5("bash", ["-lc", `PATH="$(printf '%s' "$PATH" | sed "s#$HOME/.synkro/bin:##g")" command -v claude`], { encoding: "utf-8" });
   let linkPath = (r.stdout || "").trim();
   if (!linkPath) {
-    const c = join17(homedir19(), ".local", "bin", "claude");
+    const c = join18(homedir20(), ".local", "bin", "claude");
     if (existsSync21(c)) linkPath = c;
     else return null;
   }
@@ -6394,7 +7082,7 @@ function findClaudeLink() {
 }
 function isOurShim(path) {
   try {
-    return readFileSync19(path, "utf-8").slice(0, 300).includes("Synkro pty shim");
+    return readFileSync20(path, "utf-8").slice(0, 300).includes("Synkro pty shim");
   } catch {
     return false;
   }
@@ -6407,7 +7095,7 @@ function shadowClaude() {
   }
   const { linkPath, realTarget } = found;
   if (isOurShim(linkPath)) {
-    console.log(`    \xB7 ${linkPath.replace(homedir19(), "~")} already shadowed`);
+    console.log(`    \xB7 ${linkPath.replace(homedir20(), "~")} already shadowed`);
     return;
   }
   let wasSymlink = false;
@@ -6417,14 +7105,14 @@ function shadowClaude() {
   }
   const state = { linkPath, realTarget, wasSymlink };
   try {
-    writeFileSync15(SHADOW_STATE_FILE, JSON.stringify(state), "utf-8");
+    writeFileSync16(SHADOW_STATE_FILE, JSON.stringify(state), "utf-8");
   } catch {
   }
   try {
     rmSync2(linkPath, { force: true });
-    writeFileSync15(linkPath, SHIM_SOURCE.replace("__BAKED_CLAUDE__", realTarget), "utf-8");
-    chmodSync3(linkPath, 493);
-    console.log(`    \u2713 shadowed ${linkPath.replace(homedir19(), "~")} \u2192 shim (real: ${realTarget.replace(homedir19(), "~")})`);
+    writeFileSync16(linkPath, SHIM_SOURCE.replace("__BAKED_CLAUDE__", realTarget), "utf-8");
+    chmodSync4(linkPath, 493);
+    console.log(`    \u2713 shadowed ${linkPath.replace(homedir20(), "~")} \u2192 shim (real: ${realTarget.replace(homedir20(), "~")})`);
   } catch (e) {
     console.warn(`    \u26A0 could not shadow ${linkPath}: ${e.message}`);
   }
@@ -6432,7 +7120,7 @@ function shadowClaude() {
 function unshadowClaude() {
   let state;
   try {
-    state = JSON.parse(readFileSync19(SHADOW_STATE_FILE, "utf-8"));
+    state = JSON.parse(readFileSync20(SHADOW_STATE_FILE, "utf-8"));
   } catch {
     return;
   }
@@ -6441,7 +7129,7 @@ function unshadowClaude() {
     if (existsSync21(state.linkPath) && !isOurShim(state.linkPath)) return;
     rmSync2(state.linkPath, { force: true });
     symlinkSync(state.realTarget, state.linkPath);
-    console.log(`\u2713 restored ${state.linkPath.replace(homedir19(), "~")} \u2192 ${state.realTarget.replace(homedir19(), "~")}`);
+    console.log(`\u2713 restored ${state.linkPath.replace(homedir20(), "~")} \u2192 ${state.realTarget.replace(homedir20(), "~")}`);
   } catch (e) {
     console.warn(`  \u26A0 could not restore claude: ${e.message} \u2014 run: ln -sf ${state.realTarget} ${state.linkPath}`);
   }
@@ -6452,13 +7140,13 @@ function addPathBlock() {
     if (!existsSync21(rc) && rc.endsWith(".bash_profile")) continue;
     let body = "";
     try {
-      body = readFileSync19(rc, "utf-8");
+      body = readFileSync20(rc, "utf-8");
     } catch {
     }
     const cleaned = stripBlock(body);
     const next = cleaned.replace(/\n*$/, "") + (cleaned ? "\n\n" : "") + RC_BLOCK + "\n";
     try {
-      writeFileSync15(rc, next, "utf-8");
+      writeFileSync16(rc, next, "utf-8");
       touched.push(rc);
     } catch {
     }
@@ -6477,12 +7165,12 @@ function installPtyShim() {
   mkdirSync14(SHIM_BIN_DIR, { recursive: true });
   mkdirSync14(PTY_STATE_DIR, { recursive: true });
   const real = resolveRealClaude();
-  writeFileSync15(SHIM_PATH, SHIM_SOURCE.replace("__BAKED_CLAUDE__", real), "utf-8");
-  chmodSync3(SHIM_PATH, 493);
+  writeFileSync16(SHIM_PATH, SHIM_SOURCE.replace("__BAKED_CLAUDE__", real), "utf-8");
+  chmodSync4(SHIM_PATH, 493);
   const touched = addPathBlock();
   console.log(`  \u2713 pty routing shim installed (real claude: ${real})`);
   shadowClaude();
-  if (touched.length) console.log(`    added ~/.synkro/bin to PATH in: ${touched.map((t) => t.replace(homedir19(), "~")).join(", ")}`);
+  if (touched.length) console.log(`    added ~/.synkro/bin to PATH in: ${touched.map((t) => t.replace(homedir20(), "~")).join(", ")}`);
 }
 function uninstallPtyShim() {
   try {
@@ -6500,10 +7188,10 @@ function uninstallPtyShim() {
   for (const rc of rcFiles()) {
     if (!existsSync21(rc)) continue;
     try {
-      const body = readFileSync19(rc, "utf-8");
+      const body = readFileSync20(rc, "utf-8");
       if (body.includes(RC_BEGIN)) {
-        writeFileSync15(rc, stripBlock(body).replace(/\n{3,}/g, "\n\n"), "utf-8");
-        cleaned.push(rc.replace(homedir19(), "~"));
+        writeFileSync16(rc, stripBlock(body).replace(/\n{3,}/g, "\n\n"), "utf-8");
+        cleaned.push(rc.replace(homedir20(), "~"));
       }
     } catch {
     }
@@ -6535,7 +7223,7 @@ function listSessions(opts = {}) {
   const out = [];
   for (const f of files) {
     try {
-      const r = JSON.parse(readFileSync19(join17(SESSIONS_DIR, f), "utf-8"));
+      const r = JSON.parse(readFileSync20(join18(SESSIONS_DIR, f), "utf-8"));
       if (!r || !r.session_id) continue;
       if (liveOnly) {
         const s = r.tmux_session;
@@ -6564,7 +7252,7 @@ function resolveTargetSession(override) {
   const own = currentTmuxSession();
   const fromFile = (() => {
     try {
-      return readFileSync19(ACTIVE_SESSION_FILE, "utf-8").trim();
+      return readFileSync20(ACTIVE_SESSION_FILE, "utf-8").trim();
     } catch {
       return "";
     }
@@ -6590,7 +7278,7 @@ function injectModel(model, sessionOverride) {
   sendKeys("Escape");
   sendKeys("-l", `/model ${model}`);
   sendKeys("Enter");
-  const pidFile = join17(PTY_STATE_DIR, `poll-${session}.pid`);
+  const pidFile = join18(PTY_STATE_DIR, `poll-${session}.pid`);
   try {
     mkdirSync14(PTY_STATE_DIR, { recursive: true });
   } catch {
@@ -6604,13 +7292,13 @@ var SYNKRO_DIR10, SHIM_BIN_DIR, SHIM_PATH, PTY_STATE_DIR, ACTIVE_SESSION_FILE, S
 var init_ptyShim = __esm({
   "cli/local-cc/ptyShim.ts"() {
     "use strict";
-    SYNKRO_DIR10 = join17(homedir19(), ".synkro");
-    SHIM_BIN_DIR = join17(SYNKRO_DIR10, "bin");
-    SHIM_PATH = join17(SHIM_BIN_DIR, "claude");
-    PTY_STATE_DIR = join17(SYNKRO_DIR10, "pty");
-    ACTIVE_SESSION_FILE = join17(PTY_STATE_DIR, "active");
-    SHADOW_STATE_FILE = join17(PTY_STATE_DIR, "shadow.json");
-    SESSIONS_DIR = join17(PTY_STATE_DIR, "sessions");
+    SYNKRO_DIR10 = join18(homedir20(), ".synkro");
+    SHIM_BIN_DIR = join18(SYNKRO_DIR10, "bin");
+    SHIM_PATH = join18(SHIM_BIN_DIR, "claude");
+    PTY_STATE_DIR = join18(SYNKRO_DIR10, "pty");
+    ACTIVE_SESSION_FILE = join18(PTY_STATE_DIR, "active");
+    SHADOW_STATE_FILE = join18(PTY_STATE_DIR, "shadow.json");
+    SESSIONS_DIR = join18(PTY_STATE_DIR, "sessions");
     SHIM_SESSION_PREFIX = "synkro-cc-";
     RC_BEGIN = "# >>> synkro pty shim (managed \u2014 do not edit) >>>";
     RC_END = "# <<< synkro pty shim <<<";
@@ -6681,6 +7369,189 @@ var init_graderSmoke = __esm({
   }
 });
 
+// cli/scanning/codexTranscriptUsage.ts
+function rawCounters(value) {
+  return {
+    input: finiteCounter(value?.input_tokens),
+    output: finiteCounter(value?.output_tokens),
+    cacheCreation: finiteCounter(value?.cache_write_input_tokens),
+    cacheRead: finiteCounter(value?.cached_input_tokens)
+  };
+}
+function counterDelta(current, previous) {
+  return current >= previous ? current - previous : current;
+}
+function normalizedUsage(raw) {
+  return {
+    // Codex input_tokens includes cached/cache-write details. Store only the
+    // uncached remainder in input_tokens so totals and pricing never count the
+    // same prompt tokens twice.
+    input_tokens: Math.max(0, raw.input - raw.cacheCreation - raw.cacheRead),
+    output_tokens: raw.output,
+    cache_creation_input_tokens: raw.cacheCreation,
+    cache_read_input_tokens: raw.cacheRead
+  };
+}
+function addUsage(a, b) {
+  return {
+    input_tokens: (a?.input_tokens || 0) + b.input_tokens,
+    output_tokens: (a?.output_tokens || 0) + b.output_tokens,
+    cache_creation_input_tokens: (a?.cache_creation_input_tokens || 0) + b.cache_creation_input_tokens,
+    cache_read_input_tokens: (a?.cache_read_input_tokens || 0) + b.cache_read_input_tokens
+  };
+}
+function parseCodexTranscriptUsage(transcript, options = {}) {
+  if (!transcript) return null;
+  const lines = transcript.split("\n");
+  const hasCanonicalAssistant = lines.some((line) => {
+    try {
+      const entry = JSON.parse(line);
+      return entry?.type === "event_msg" && entry?.payload?.type === "agent_message";
+    } catch {
+      return false;
+    }
+  });
+  const turnsByLine = /* @__PURE__ */ new Map();
+  let model = "";
+  let lastAssistantLine = -1;
+  let previous = { input: 0, output: 0, cacheCreation: 0, cacheRead: 0 };
+  let latest = null;
+  let sawSnapshot = false;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i].trim();
+    if (!line) continue;
+    let entry;
+    try {
+      entry = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (entry?.type === "turn_context" && typeof entry?.payload?.model === "string") {
+      model = entry.payload.model;
+      continue;
+    }
+    if (!hasCanonicalAssistant && entry?.type === "response_item" && entry?.payload?.type === "message" && entry?.payload?.role === "assistant") {
+      lastAssistantLine = i;
+      continue;
+    }
+    if (entry?.type !== "event_msg") continue;
+    if (entry?.payload?.type === "agent_message") {
+      lastAssistantLine = i;
+      continue;
+    }
+    if (entry?.payload?.type !== "token_count") continue;
+    const eventModel = entry?.payload?.model ?? entry?.model;
+    if (typeof eventModel === "string" && eventModel) model = eventModel;
+    const total = entry?.payload?.info?.total_token_usage;
+    if (!total || typeof total !== "object") continue;
+    const current = rawCounters(total);
+    latest = current;
+    if (options.partial && !sawSnapshot) {
+      previous = current;
+      sawSnapshot = true;
+      continue;
+    }
+    sawSnapshot = true;
+    const delta = normalizedUsage({
+      input: counterDelta(current.input, previous.input),
+      output: counterDelta(current.output, previous.output),
+      cacheCreation: counterDelta(current.cacheCreation, previous.cacheCreation),
+      cacheRead: counterDelta(current.cacheRead, previous.cacheRead)
+    });
+    previous = current;
+    if (lastAssistantLine >= 0) {
+      const prior = turnsByLine.get(lastAssistantLine);
+      turnsByLine.set(lastAssistantLine, {
+        lineIndex: lastAssistantLine,
+        model,
+        usage: addUsage(prior?.usage, delta)
+      });
+    }
+  }
+  if (model) {
+    for (const turn of turnsByLine.values()) {
+      if (!turn.model) turn.model = model;
+    }
+  }
+  if (!latest) return null;
+  return { model, total: normalizedUsage(latest), turnsByLine };
+}
+var finiteCounter;
+var init_codexTranscriptUsage = __esm({
+  "cli/scanning/codexTranscriptUsage.ts"() {
+    "use strict";
+    finiteCounter = (value) => {
+      const n = Number(value);
+      return Number.isFinite(n) && n > 0 ? Math.floor(n) : 0;
+    };
+  }
+});
+
+// cli/scanning/codexTranscriptMessages.ts
+import { createHash as createHash3 } from "crypto";
+function textContent(content) {
+  if (typeof content === "string") return content.trim();
+  if (!Array.isArray(content)) return "";
+  return content.map((block) => {
+    if (typeof block === "string") return block;
+    return block?.type === "text" || block?.type === "input_text" || block?.type === "output_text" ? String(block.text || "") : "";
+  }).join(" ").trim();
+}
+function isCodexConversationNoise(content) {
+  const value = content.trimStart();
+  return value.startsWith("[synkro:") || value.startsWith("claude-code: {") || value.startsWith("RAW claude-code agent:") || value.startsWith("Guard: (R") || value.startsWith("<developer") || value.startsWith("<system") || value.startsWith("<permissions instructions>") || value.startsWith("<app-context>") || value.startsWith("<environment_context>") || value.startsWith("<recommended_plugins>");
+}
+function parseCodexConversationMessages(transcript) {
+  if (!transcript) return [];
+  const entries = [];
+  for (const [lineIndex, line] of transcript.split("\n").entries()) {
+    const value = line.trim();
+    if (!value) continue;
+    try {
+      entries.push({ lineIndex, entry: JSON.parse(value) });
+    } catch {
+    }
+  }
+  const hasCanonicalMessages = entries.some(({ entry }) => entry?.type === "event_msg" && (entry?.payload?.type === "user_message" || entry?.payload?.type === "agent_message"));
+  const messages = [];
+  for (const { lineIndex, entry } of entries) {
+    let role = null;
+    let content;
+    let itemId = "";
+    const eventType = entry?.type === "event_msg" ? entry?.payload?.type : "";
+    if (eventType === "user_message" || eventType === "agent_message") {
+      role = eventType === "user_message" ? "user" : "assistant";
+      content = entry?.payload?.message;
+    } else if (!hasCanonicalMessages && entry?.type === "response_item" && entry?.payload?.type === "message") {
+      const responseRole = entry?.payload?.role;
+      if (responseRole !== "user" && responseRole !== "assistant") continue;
+      role = responseRole;
+      content = entry?.payload?.content;
+      itemId = typeof entry?.payload?.id === "string" ? entry.payload.id : "";
+    } else {
+      continue;
+    }
+    if (!role) continue;
+    const text = textContent(content);
+    if (!text || isCodexConversationNoise(text)) continue;
+    const timestamp = typeof entry?.timestamp === "string" && entry.timestamp ? entry.timestamp : void 0;
+    const uuid = typeof entry?.uuid === "string" && entry.uuid ? entry.uuid : itemId || createHash3("sha256").update((timestamp || "") + "\0" + role + "\0" + text).digest("hex").slice(0, 32);
+    messages.push({
+      lineIndex,
+      role,
+      content: text.slice(0, 8e3),
+      uuid,
+      ...timestamp ? { timestamp } : {}
+    });
+  }
+  return messages;
+}
+var init_codexTranscriptMessages = __esm({
+  "cli/scanning/codexTranscriptMessages.ts"() {
+    "use strict";
+  }
+});
+
 // cli/commands/install.ts
 var install_exports = {};
 __export(install_exports, {
@@ -6696,12 +7567,12 @@ __export(install_exports, {
   syncSkillFiles: () => syncSkillFiles,
   writeHookScripts: () => writeHookScripts
 });
-import { existsSync as existsSync22, mkdirSync as mkdirSync15, writeFileSync as writeFileSync16, chmodSync as chmodSync4, readFileSync as readFileSync20, readdirSync as readdirSync4, unlinkSync as unlinkSync7, statSync as statSync2 } from "fs";
-import { homedir as homedir20 } from "os";
-import { join as join18, isAbsolute, resolve as resolve4 } from "path";
+import { existsSync as existsSync22, mkdirSync as mkdirSync15, writeFileSync as writeFileSync17, chmodSync as chmodSync5, readFileSync as readFileSync21, readdirSync as readdirSync4, unlinkSync as unlinkSync7, statSync as statSync2 } from "fs";
+import { homedir as homedir21 } from "os";
+import { join as join19, isAbsolute, resolve as resolve4 } from "path";
 import { execSync as execSync4, spawn as spawn4 } from "child_process";
 import { createInterface as createInterface2 } from "readline";
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 function resolvePersistedHookMode() {
   return "stub";
 }
@@ -6829,34 +7700,39 @@ function ensureSynkroDir() {
   mkdirSync15(HOOKS_DIR, { recursive: true });
   mkdirSync15(BIN_DIR, { recursive: true });
   mkdirSync15(OFFSETS_DIR, { recursive: true });
-  mkdirSync15(join18(SYNKRO_DIR11, "sessions"), { recursive: true });
+  mkdirSync15(join19(SYNKRO_DIR11, "sessions"), { recursive: true });
 }
 function writeHookScripts() {
-  const installExtractCorePath = join18(HOOKS_DIR, "installExtractCore.ts");
-  const bashScriptPath = join18(HOOKS_DIR, "cc-bash-judge.ts");
-  const skillJudgeScriptPath = join18(HOOKS_DIR, "cc-skill-judge.ts");
-  const cursorSkillJudgePath = join18(HOOKS_DIR, "cursor-skill-judge.ts");
-  const bashFollowupScriptPath = join18(HOOKS_DIR, "cc-bash-followup.ts");
-  const editPrecheckScriptPath = join18(HOOKS_DIR, "cc-edit-precheck.ts");
-  const cwePrecheckScriptPath = join18(HOOKS_DIR, "cc-cwe-precheck.ts");
-  const cvePrecheckScriptPath = join18(HOOKS_DIR, "cc-cve-precheck.ts");
-  const planJudgeScriptPath = join18(HOOKS_DIR, "cc-plan-judge.ts");
-  const agentJudgeScriptPath = join18(HOOKS_DIR, "cc-agent-judge.ts");
-  const stopSummaryScriptPath = join18(HOOKS_DIR, "cc-stop-summary.ts");
-  const sessionStartScriptPath = join18(HOOKS_DIR, "cc-session-start.ts");
-  const transcriptSyncScriptPath = join18(HOOKS_DIR, "cc-transcript-sync.ts");
-  const userPromptSubmitScriptPath = join18(HOOKS_DIR, "cc-user-prompt-submit.ts");
-  const promptRouteScriptPath = join18(HOOKS_DIR, "cc-prompt-route.ts");
-  const commonScriptPath = join18(HOOKS_DIR, "_synkro-common.ts");
-  const commonBashScriptPath = join18(HOOKS_DIR, "_synkro-common.sh");
-  const installScanScriptPath = join18(HOOKS_DIR, "cc-install-scan.ts");
-  const cursorBashJudgePath = join18(HOOKS_DIR, "cursor-bash-judge.ts");
-  const cursorEditCapturePath = join18(HOOKS_DIR, "cursor-edit-capture.ts");
-  const cursorAgentCapturePath = join18(HOOKS_DIR, "cursor-agent-capture.ts");
-  const mcpStdioProxyPath = join18(HOOKS_DIR, "mcp-stdio-proxy.ts");
-  const taskActivateIntentScriptPath = join18(HOOKS_DIR, "cc-task-activate-intent.ts");
-  const mcpGateScriptPath = join18(HOOKS_DIR, "cc-mcp-gate.ts");
-  const stubCommonPath = join18(HOOKS_DIR, "_synkro-stub-common.ts");
+  const installExtractCorePath = join19(HOOKS_DIR, "installExtractCore.ts");
+  const bashScriptPath = join19(HOOKS_DIR, "cc-bash-judge.ts");
+  const skillJudgeScriptPath = join19(HOOKS_DIR, "cc-skill-judge.ts");
+  const cursorSkillJudgePath = join19(HOOKS_DIR, "cursor-skill-judge.ts");
+  const bashFollowupScriptPath = join19(HOOKS_DIR, "cc-bash-followup.ts");
+  const editPrecheckScriptPath = join19(HOOKS_DIR, "cc-edit-precheck.ts");
+  const editFollowupScriptPath = join19(HOOKS_DIR, "cc-edit-followup.ts");
+  const cwePrecheckScriptPath = join19(HOOKS_DIR, "cc-cwe-precheck.ts");
+  const cvePrecheckScriptPath = join19(HOOKS_DIR, "cc-cve-precheck.ts");
+  const planJudgeScriptPath = join19(HOOKS_DIR, "cc-plan-judge.ts");
+  const agentJudgeScriptPath = join19(HOOKS_DIR, "cc-agent-judge.ts");
+  const stopSummaryScriptPath = join19(HOOKS_DIR, "cc-stop-summary.ts");
+  const cweStopScriptPath = join19(HOOKS_DIR, "codex-cwe-stop.ts");
+  const cveStopScriptPath = join19(HOOKS_DIR, "codex-cve-stop.ts");
+  const sessionStartScriptPath = join19(HOOKS_DIR, "cc-session-start.ts");
+  const transcriptSyncScriptPath = join19(HOOKS_DIR, "cc-transcript-sync.ts");
+  const subagentStartScriptPath = join19(HOOKS_DIR, "codex-subagent-start.ts");
+  const subagentStopScriptPath = join19(HOOKS_DIR, "codex-subagent-stop.ts");
+  const userPromptSubmitScriptPath = join19(HOOKS_DIR, "cc-user-prompt-submit.ts");
+  const promptRouteScriptPath = join19(HOOKS_DIR, "cc-prompt-route.ts");
+  const commonScriptPath = join19(HOOKS_DIR, "_synkro-common.ts");
+  const commonBashScriptPath = join19(HOOKS_DIR, "_synkro-common.sh");
+  const installScanScriptPath = join19(HOOKS_DIR, "cc-install-scan.ts");
+  const cursorBashJudgePath = join19(HOOKS_DIR, "cursor-bash-judge.ts");
+  const cursorEditCapturePath = join19(HOOKS_DIR, "cursor-edit-capture.ts");
+  const cursorAgentCapturePath = join19(HOOKS_DIR, "cursor-agent-capture.ts");
+  const mcpStdioProxyPath = join19(HOOKS_DIR, "mcp-stdio-proxy.ts");
+  const taskActivateIntentScriptPath = join19(HOOKS_DIR, "cc-task-activate-intent.ts");
+  const mcpGateScriptPath = join19(HOOKS_DIR, "cc-mcp-gate.ts");
+  const stubCommonPath = join19(HOOKS_DIR, "_synkro-stub-common.ts");
   const stubFiles = [
     [stubCommonPath, STUB_COMMON_TS],
     [bashScriptPath, STUB_BASH_JUDGE_TS],
@@ -6864,13 +7740,18 @@ function writeHookScripts() {
     [cursorSkillJudgePath, STUB_CURSOR_SKILL_JUDGE_TS],
     [bashFollowupScriptPath, STUB_BASH_FOLLOWUP_TS],
     [editPrecheckScriptPath, STUB_EDIT_PRECHECK_TS],
+    [editFollowupScriptPath, STUB_EDIT_FOLLOWUP_TS],
     [cwePrecheckScriptPath, STUB_CWE_PRECHECK_TS],
     [cvePrecheckScriptPath, STUB_CVE_PRECHECK_TS],
     [planJudgeScriptPath, STUB_PLAN_JUDGE_TS],
     [agentJudgeScriptPath, STUB_AGENT_JUDGE_TS],
     [stopSummaryScriptPath, STUB_STOP_SUMMARY_TS],
+    [cweStopScriptPath, STUB_CODEX_CWE_STOP_TS],
+    [cveStopScriptPath, STUB_CODEX_CVE_STOP_TS],
     [sessionStartScriptPath, STUB_SESSION_START_TS],
     [transcriptSyncScriptPath, STUB_TRANSCRIPT_SYNC_TS],
+    [subagentStartScriptPath, STUB_SUBAGENT_START_TS],
+    [subagentStopScriptPath, STUB_SUBAGENT_STOP_TS],
     [userPromptSubmitScriptPath, STUB_USER_PROMPT_SUBMIT_TS],
     [promptRouteScriptPath, STUB_PROMPT_ROUTE_TS],
     [installScanScriptPath, STUB_INSTALL_SCAN_TS],
@@ -6881,14 +7762,14 @@ function writeHookScripts() {
     [cursorAgentCapturePath, STUB_CURSOR_AGENT_CAPTURE_TS]
   ];
   for (const [p, content] of stubFiles) {
-    writeFileSync16(p, content, "utf-8");
-    chmodSync4(p, 493);
+    writeFileSync17(p, content, "utf-8");
+    chmodSync5(p, 493);
   }
-  writeFileSync16(mcpStdioProxyPath, MCP_STDIO_PROXY_SRC, "utf-8");
-  chmodSync4(mcpStdioProxyPath, 493);
+  writeFileSync17(mcpStdioProxyPath, MCP_STDIO_PROXY_SRC, "utf-8");
+  chmodSync5(mcpStdioProxyPath, 493);
   for (const stale of ["_synkro-common.ts", "_synkro-common.sh", "installExtractCore.ts"]) {
     try {
-      unlinkSync7(join18(HOOKS_DIR, stale));
+      unlinkSync7(join19(HOOKS_DIR, stale));
     } catch {
     }
   }
@@ -6898,13 +7779,18 @@ function writeHookScripts() {
     cursorSkillJudgeScript: cursorSkillJudgePath,
     bashFollowupScript: bashFollowupScriptPath,
     editPrecheckScript: editPrecheckScriptPath,
+    editFollowupScript: editFollowupScriptPath,
     cwePrecheckScript: cwePrecheckScriptPath,
     cvePrecheckScript: cvePrecheckScriptPath,
     planJudgeScript: planJudgeScriptPath,
     agentJudgeScript: agentJudgeScriptPath,
     stopSummaryScript: stopSummaryScriptPath,
+    cweStopScript: cweStopScriptPath,
+    cveStopScript: cveStopScriptPath,
     sessionStartScript: sessionStartScriptPath,
     transcriptSyncScript: transcriptSyncScriptPath,
+    subagentStartScript: subagentStartScriptPath,
+    subagentStopScript: subagentStopScriptPath,
     userPromptSubmitScript: userPromptSubmitScriptPath,
     promptRouteScript: promptRouteScriptPath,
     installScanScript: installScanScriptPath,
@@ -6928,7 +7814,7 @@ function resolveSynkroBundle() {
   return null;
 }
 function writeConfigEnv(opts) {
-  const credsPath = join18(SYNKRO_DIR11, "credentials.json");
+  const credsPath = join19(SYNKRO_DIR11, "credentials.json");
   const safeGateway = sanitizeConfigValue(opts.gatewayUrl);
   const safeUserId = sanitizeConfigValue(opts.userId);
   const safeOrgId = sanitizeConfigValue(opts.orgId);
@@ -6944,7 +7830,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle2(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle2(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle2(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle2("1.7.88")}`
+    `SYNKRO_VERSION=${shellQuoteSingle2("1.7.90")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle2(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle2(safeUserId)}`);
@@ -6964,12 +7850,12 @@ function writeConfigEnv(opts) {
   lines.push(`SYNKRO_DEPLOY_LOCATION=${shellQuoteSingle2(sanitizeConfigValue(opts.deployLocation ?? "local", 16))}`);
   lines.push(`SYNKRO_HOOK_MODE=${shellQuoteSingle2(sanitizeConfigValue(opts.hookMode ?? "stub", 8))}`);
   lines.push("");
-  writeFileSync16(CONFIG_PATH4, lines.join("\n"), "utf-8");
-  chmodSync4(CONFIG_PATH4, 384);
+  writeFileSync17(CONFIG_PATH4, lines.join("\n"), "utf-8");
+  chmodSync5(CONFIG_PATH4, 384);
 }
 function persistedTranscriptConsent(source) {
   try {
-    const env = readFileSync20(CONFIG_PATH4, "utf-8");
+    const env = readFileSync21(CONFIG_PATH4, "utf-8");
     const specific = env.match(new RegExp(`^SYNKRO_TRANSCRIPT_CONSENT_${source}='(yes|no)'`, "m"));
     if (specific) return specific[1] === "yes";
     if (source !== "CODEX") {
@@ -6992,7 +7878,7 @@ async function getOrMintCloudToken(gatewayUrl) {
   assertGatewayAllowed(gatewayUrl);
   let stored = "";
   try {
-    stored = readFileSync20(CLOUD_JWT_PATH, "utf-8").trim();
+    stored = readFileSync21(CLOUD_JWT_PATH, "utf-8").trim();
   } catch {
   }
   if (stored && !jwtExpired(stored)) return stored;
@@ -7008,7 +7894,7 @@ async function getOrMintCloudToken(gatewayUrl) {
     throw new Error(`cloud-token mint failed (${resp.status}): ${t.slice(0, 200)}`);
   }
   const { token } = await resp.json();
-  writeFileSync16(CLOUD_JWT_PATH, token + "\n", { mode: 384 });
+  writeFileSync17(CLOUD_JWT_PATH, token + "\n", { mode: 384 });
   return token;
 }
 async function provisionCloudContainer(opts) {
@@ -7092,7 +7978,7 @@ async function provisionCloudContainer(opts) {
   let cursorApiKey = "";
   if (cursorWorkers > 0 || selectedKind === "cursor") {
     try {
-      cursorApiKey = readFileSync20(join18(SYNKRO_DIR11, "cursor-creds", "api-key"), "utf-8").trim();
+      cursorApiKey = readFileSync21(join19(SYNKRO_DIR11, "cursor-creds", "api-key"), "utf-8").trim();
     } catch {
     }
   }
@@ -7278,7 +8164,7 @@ async function verifyCloudGrader(jwt2, requestedKind) {
 function readPersistedDeployLocation() {
   try {
     if (existsSync22(CONFIG_PATH4)) {
-      const m = readFileSync20(CONFIG_PATH4, "utf-8").match(/^SYNKRO_DEPLOY_LOCATION='([^']*)'/m);
+      const m = readFileSync21(CONFIG_PATH4, "utf-8").match(/^SYNKRO_DEPLOY_LOCATION='([^']*)'/m);
       if (m?.[1] === "cloud") return "cloud";
     }
   } catch {
@@ -7287,7 +8173,7 @@ function readPersistedDeployLocation() {
 }
 function updateConfigEnvLocation(location) {
   if (!existsSync22(CONFIG_PATH4)) return;
-  let env = readFileSync20(CONFIG_PATH4, "utf-8");
+  let env = readFileSync21(CONFIG_PATH4, "utf-8");
   const set = (k, v) => {
     const re = new RegExp(`^${k}=.*$`, "m");
     const line = `${k}='${v}'`;
@@ -7295,14 +8181,14 @@ function updateConfigEnvLocation(location) {
   };
   set("SYNKRO_DEPLOY_LOCATION", location);
   set("SYNKRO_STORAGE_MODE", location === "cloud" ? "cloud" : "local");
-  writeFileSync16(CONFIG_PATH4, env, "utf-8");
-  chmodSync4(CONFIG_PATH4, 384);
+  writeFileSync17(CONFIG_PATH4, env, "utf-8");
+  chmodSync5(CONFIG_PATH4, 384);
 }
 async function applyMcpConfig(opts) {
   if (!opts.hasClaudeCode && !opts.hasCursor && !opts.hasCodex) return;
   let mcpJwt2 = "";
   try {
-    mcpJwt2 = readFileSync20(join18(SYNKRO_DIR11, ".mcp-jwt"), "utf-8").trim();
+    mcpJwt2 = readFileSync21(join19(SYNKRO_DIR11, ".mcp-jwt"), "utf-8").trim();
   } catch {
   }
   if (!mcpJwt2) {
@@ -7433,7 +8319,7 @@ function resolveDeploymentMode() {
   if (envOverride === "bare-host" || envOverride === "docker") return envOverride;
   try {
     if (existsSync22(CONFIG_PATH4)) {
-      const m = readFileSync20(CONFIG_PATH4, "utf-8").match(/^SYNKRO_DEPLOYMENT_MODE='([^']*)'/m);
+      const m = readFileSync21(CONFIG_PATH4, "utf-8").match(/^SYNKRO_DEPLOYMENT_MODE='([^']*)'/m);
       const val = m?.[1]?.toLowerCase();
       if (val === "bare-host" || val === "docker") return val;
     }
@@ -7460,16 +8346,16 @@ function collectLocalMetadata(includeClaudeCode = true) {
     meta.cc_version = execSync4("claude --version", { encoding: "utf-8", timeout: 5e3 }).trim().split("\n")[0];
   } catch {
   }
-  const claudeDir = join18(homedir20(), ".claude");
+  const claudeDir = join19(homedir21(), ".claude");
   try {
-    const settings = JSON.parse(readFileSync20(join18(claudeDir, "settings.json"), "utf-8"));
+    const settings = JSON.parse(readFileSync21(join19(claudeDir, "settings.json"), "utf-8"));
     const plugins = Object.keys(settings.enabledPlugins ?? {}).filter((k) => settings.enabledPlugins[k]);
     if (plugins.length) meta.enabled_plugins = plugins;
     if (settings.permissions?.defaultMode) meta.permissions_mode = settings.permissions.defaultMode;
   } catch {
   }
   try {
-    const mcpCache = JSON.parse(readFileSync20(join18(claudeDir, "mcp-needs-auth-cache.json"), "utf-8"));
+    const mcpCache = JSON.parse(readFileSync21(join19(claudeDir, "mcp-needs-auth-cache.json"), "utf-8"));
     const mcpNames = Object.keys(mcpCache);
     if (mcpNames.length) meta.mcp_servers = mcpNames;
   } catch {
@@ -7481,10 +8367,10 @@ function collectLocalMetadata(includeClaudeCode = true) {
   } catch {
   }
   try {
-    const sessionsDir = join18(claudeDir, "sessions");
+    const sessionsDir = join19(claudeDir, "sessions");
     const files = readdirSync4(sessionsDir).filter((f) => f.endsWith(".json")).slice(-5);
     for (const f of files) {
-      const s = JSON.parse(readFileSync20(join18(sessionsDir, f), "utf-8"));
+      const s = JSON.parse(readFileSync21(join19(sessionsDir, f), "utf-8"));
       if (s.version) {
         meta.cc_version = meta.cc_version || s.version;
         break;
@@ -7686,7 +8572,7 @@ async function installCommand(opts = {}) {
   await setTelemetryState({ enabled: true, remoteFlushEnabled: telemetryConsent });
   emit("install", {
     phase: "started",
-    cli_version_to: "1.7.88",
+    cli_version_to: "1.7.90",
     agents_detected: agents.map((a) => a.kind),
     with_github: false,
     with_local_cc: false,
@@ -7698,9 +8584,9 @@ async function installCommand(opts = {}) {
   const scripts = writeHookScripts();
   console.log("Wrote hook scripts to ~/.synkro/hooks/\n");
   for (const mode of ["edit", "bash"]) {
-    const pidFile = join18(SYNKRO_DIR11, "daemon", mode, "daemon.pid");
+    const pidFile = join19(SYNKRO_DIR11, "daemon", mode, "daemon.pid");
     try {
-      const pid = parseInt(readFileSync20(pidFile, "utf-8").trim(), 10);
+      const pid = parseInt(readFileSync21(pidFile, "utf-8").trim(), 10);
       if (pid > 0) {
         process.kill(pid, "SIGTERM");
         console.log(`Stopped stale ${mode} grader daemon (pid ${pid})`);
@@ -7763,12 +8649,17 @@ async function installCommand(opts = {}) {
         skillJudgeScriptPath: scripts.skillJudgeScript,
         bashFollowupScriptPath: scripts.bashFollowupScript,
         editPrecheckScriptPath: scripts.editPrecheckScript,
+        editFollowupScriptPath: scripts.editFollowupScript,
         cwePrecheckScriptPath: scripts.cwePrecheckScript,
         cvePrecheckScriptPath: scripts.cvePrecheckScript,
         agentJudgeScriptPath: scripts.agentJudgeScript,
         stopSummaryScriptPath: scripts.stopSummaryScript,
+        cweStopScriptPath: scripts.cweStopScript,
+        cveStopScriptPath: scripts.cveStopScript,
         sessionStartScriptPath: scripts.sessionStartScript,
         transcriptSyncScriptPath: scripts.transcriptSyncScript,
+        subagentStartScriptPath: scripts.subagentStartScript,
+        subagentStopScriptPath: scripts.subagentStopScript,
         userPromptSubmitScriptPath: scripts.userPromptSubmitScript,
         promptRouteScriptPath: scripts.promptRouteScript,
         installScanScriptPath: scripts.installScanScript,
@@ -7818,7 +8709,7 @@ async function installCommand(opts = {}) {
         if (mintResp.ok) {
           const minted = await mintResp.json();
           mcpJwt2 = minted.token;
-          writeFileSync16(join18(SYNKRO_DIR11, ".mcp-jwt"), mcpJwt2 + "\n", { mode: 384 });
+          writeFileSync17(join19(SYNKRO_DIR11, ".mcp-jwt"), mcpJwt2 + "\n", { mode: 384 });
         } else {
           console.warn("  \u26A0 Could not mint MCP token \u2014 local server will reject requests until re-installed.");
         }
@@ -7846,7 +8737,7 @@ async function installCommand(opts = {}) {
           throw new Error(`mcp-token mint failed (${mintResp.status}): ${errText.slice(0, 200)}`);
         }
         const minted = await mintResp.json();
-        writeFileSync16(join18(SYNKRO_DIR11, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
+        writeFileSync17(join19(SYNKRO_DIR11, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
         const mcp = installMcpConfig({ gatewayUrl, bearerToken: minted.token });
         console.log(`Registered Synkro guardrails MCP server in ${mcp.path}`);
         console.log(`  url:        ${mcp.url}`);
@@ -7868,7 +8759,7 @@ async function installCommand(opts = {}) {
   if (hasCursor && !opts.noMcp) {
     try {
       if (useLocalMcp) {
-        const jwtPath = join18(SYNKRO_DIR11, ".mcp-jwt");
+        const jwtPath = join19(SYNKRO_DIR11, ".mcp-jwt");
         if (!existsSync22(jwtPath)) {
           const mintResp = await fetch(`${gatewayUrl}/api/v1/cli/mcp-token`, {
             method: "POST",
@@ -7877,7 +8768,7 @@ async function installCommand(opts = {}) {
           });
           if (mintResp.ok) {
             const minted = await mintResp.json();
-            writeFileSync16(jwtPath, minted.token + "\n", { mode: 384 });
+            writeFileSync17(jwtPath, minted.token + "\n", { mode: 384 });
           }
         }
         const mcp = installCursorMcpConfig({ gatewayUrl, bearerToken: "", local: true });
@@ -7897,7 +8788,7 @@ async function installCommand(opts = {}) {
           throw new Error(`mcp-token mint failed (${mintResp.status}): ${errText.slice(0, 200)}`);
         }
         const minted = await mintResp.json();
-        writeFileSync16(join18(SYNKRO_DIR11, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
+        writeFileSync17(join19(SYNKRO_DIR11, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
         const mcp = installCursorMcpConfig({ gatewayUrl, bearerToken: minted.token });
         console.log(`Registered Synkro guardrails MCP server in ${mcp.path}`);
         console.log(`  url:        ${mcp.url}`);
@@ -7910,10 +8801,10 @@ async function installCommand(opts = {}) {
   }
   if (hasCodex && !opts.noMcp) {
     try {
-      const jwtPath = join18(SYNKRO_DIR11, ".mcp-jwt");
+      const jwtPath = join19(SYNKRO_DIR11, ".mcp-jwt");
       let mcpJwt2 = "";
       try {
-        mcpJwt2 = readFileSync20(jwtPath, "utf-8").trim();
+        mcpJwt2 = readFileSync21(jwtPath, "utf-8").trim();
       } catch {
       }
       if (!mcpJwt2) {
@@ -7931,7 +8822,7 @@ async function installCommand(opts = {}) {
         }
         const minted = await mintResp.json();
         mcpJwt2 = minted.token;
-        writeFileSync16(jwtPath, mcpJwt2 + "\n", { mode: 384 });
+        writeFileSync17(jwtPath, mcpJwt2 + "\n", { mode: 384 });
       }
       const mcp = installCodexMcpConfig({
         gatewayUrl,
@@ -8043,14 +8934,15 @@ async function installCommand(opts = {}) {
     }
     console.log(`  worker pool: ${claudeWorkers} claude + ${cursorWorkers} cursor + ${codexWorkers} codex`);
     const connectedRepo = detectGitRepo2() || void 0;
-    const { image, hostMcpPort, hostGraderPort, hostCwePort, hostPglitePort } = await dockerInstall({ claudeWorkers, cursorWorkers, codexWorkers, conductorProvider, codexHomeDir, connectedRepo });
+    const { image, hostMcpPort, hostGraderPort, hostCwePort, hostPglitePort, pglitePasswordPath } = await dockerInstall({ claudeWorkers, cursorWorkers, codexWorkers, conductorProvider, codexHomeDir, connectedRepo });
     console.log(`  \u2713 pulled ${image}`);
-    console.log(`  container started \u2014 MCP=${hostMcpPort} general=${hostGraderPort} CWE=${hostCwePort} pglite=${hostPglitePort}`);
+    console.log(`  container started \u2014 MCP=${hostMcpPort} general=${hostGraderPort} CWE=${hostCwePort}`);
+    console.log(`  PGLite: postgresql://synkro@127.0.0.1:${hostPglitePort}/postgres (password: ${pglitePasswordPath})`);
     console.log("  waiting for container to be ready...");
     const ready = await waitForContainerReady(6e4);
     if (ready) {
       console.log("  \u2713 container ready");
-      const mcpJwt2 = readFileSync20(join18(SYNKRO_DIR11, ".mcp-jwt"), "utf-8").trim();
+      const mcpJwt2 = readFileSync21(join19(SYNKRO_DIR11, ".mcp-jwt"), "utf-8").trim();
       try {
         const ingestResp = await fetch(`http://127.0.0.1:${hostMcpPort}/api/ingest`, {
           method: "POST",
@@ -8093,7 +8985,7 @@ async function installCommand(opts = {}) {
         try {
           let mcpToken = "";
           try {
-            mcpToken = readFileSync20(join18(SYNKRO_DIR11, ".mcp-jwt"), "utf-8").trim();
+            mcpToken = readFileSync21(join19(SYNKRO_DIR11, ".mcp-jwt"), "utf-8").trim();
           } catch {
           }
           if (mcpToken) {
@@ -8261,8 +9153,8 @@ function writeSynkroFileIfMissing(opts) {
   try {
     const root = execSync4("git rev-parse --show-toplevel", { encoding: "utf-8", timeout: 3e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
     if (!root) return;
-    if (root === homedir20()) return;
-    const fp = join18(root, "synkro.toml");
+    if (root === homedir21()) return;
+    const fp = join19(root, "synkro.toml");
     let hasFile = false;
     try {
       hasFile = statSync2(fp).isFile();
@@ -8294,7 +9186,7 @@ function writeSynkroFileIfMissing(opts) {
       "cve = true",
       ""
     ].join("\n");
-    writeFileSync16(fp, toml, "utf-8");
+    writeFileSync17(fp, toml, "utf-8");
     console.log(`  synkro.toml: wrote ${fp} (pool=${pool}, mode=${mode})`);
   } catch {
   }
@@ -8302,12 +9194,12 @@ function writeSynkroFileIfMissing(opts) {
 function updateSynkroTomlLocation(location) {
   try {
     const root = execSync4("git rev-parse --show-toplevel", { encoding: "utf-8", timeout: 3e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
-    if (!root || root === homedir20()) return;
-    const fp = join18(root, "synkro.toml");
+    if (!root || root === homedir21()) return;
+    const fp = join19(root, "synkro.toml");
     let txt = "";
     try {
       if (!statSync2(fp).isFile()) return;
-      txt = readFileSync20(fp, "utf-8");
+      txt = readFileSync21(fp, "utf-8");
     } catch {
       return;
     }
@@ -8315,7 +9207,7 @@ function updateSynkroTomlLocation(location) {
     if (!re.test(txt)) return;
     const next = txt.replace(re, `$1"${location}"`);
     if (next !== txt) {
-      writeFileSync16(fp, next, "utf-8");
+      writeFileSync17(fp, next, "utf-8");
       console.log(`  synkro.toml: [grader] location = "${location}"`);
     }
   } catch {
@@ -8325,9 +9217,9 @@ function readFullSynkroFile() {
   try {
     const root = execSync4("git rev-parse --show-toplevel", { encoding: "utf-8", timeout: 3e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
     if (!root) return null;
-    const fp = join18(root, "synkro.toml");
+    const fp = join19(root, "synkro.toml");
     if (!existsSync22(fp)) return null;
-    const parsed = parseSynkroToml2(readFileSync20(fp, "utf-8"));
+    const parsed = parseSynkroToml2(readFileSync21(fp, "utf-8"));
     const valid = ["claude-code", "cursor", "codex"];
     const harness = Array.isArray(parsed.harness) ? parsed.harness.filter((h) => valid.includes(h)) : ["claude-code", "cursor"];
     const resolved = resolveGraderPool(parsed);
@@ -8367,7 +9259,7 @@ function reconcileHarness() {
   console.log(`synkro.toml: harness=[${sf.harness.join(", ")}] pool=${poolLabel(sf.grader.pool)} mode=${sf.grader.mode}`);
   const scripts = writeHookScripts();
   console.log("Wrote hook scripts to ~/.synkro/hooks/");
-  const ccSettings = join18(homedir20(), ".claude", "settings.json");
+  const ccSettings = join19(homedir21(), ".claude", "settings.json");
   if (wantCC) {
     installCCHooks(ccSettings, {
       bashJudgeScriptPath: scripts.bashScript,
@@ -8390,7 +9282,7 @@ function reconcileHarness() {
     });
     console.log("  \u2713 Claude Code hooks registered");
     try {
-      const mcpJwt2 = readFileSync20(join18(SYNKRO_DIR11, ".mcp-jwt"), "utf-8").trim();
+      const mcpJwt2 = readFileSync21(join19(SYNKRO_DIR11, ".mcp-jwt"), "utf-8").trim();
       if (mcpJwt2) {
         installMcpConfig({ gatewayUrl: "", bearerToken: mcpJwt2, local: true });
         console.log("  \u2713 Claude Code MCP registered");
@@ -8402,7 +9294,7 @@ function reconcileHarness() {
     if (uninstallMcpConfig()) console.log("  \u2717 Claude Code MCP removed");
     if (uninstallClaudeDesktopMcpConfig()) console.log("  \u2717 Claude Desktop MCP removed");
   }
-  const cursorHooks = join18(homedir20(), ".cursor", "hooks.json");
+  const cursorHooks = join19(homedir21(), ".cursor", "hooks.json");
   if (wantCursor) {
     installCursorHooks(cursorHooks, {
       bashJudgeScriptPath: scripts.cursorBashJudgeScript,
@@ -8433,19 +9325,24 @@ function reconcileHarness() {
     if (uninstallCursorHooks(cursorHooks)) console.log("  \u2717 Cursor hooks removed");
     if (uninstallCursorMcpConfig()) console.log("  \u2717 Cursor MCP removed");
   }
-  const codexHooks = join18(process.env.CODEX_HOME || join18(homedir20(), ".codex"), "hooks.json");
+  const codexHooks = join19(process.env.CODEX_HOME || join19(homedir21(), ".codex"), "hooks.json");
   if (wantCodex) {
     installCodexHooks(codexHooks, {
       bashJudgeScriptPath: scripts.bashScript,
       skillJudgeScriptPath: scripts.skillJudgeScript,
       bashFollowupScriptPath: scripts.bashFollowupScript,
       editPrecheckScriptPath: scripts.editPrecheckScript,
+      editFollowupScriptPath: scripts.editFollowupScript,
       cwePrecheckScriptPath: scripts.cwePrecheckScript,
       cvePrecheckScriptPath: scripts.cvePrecheckScript,
       agentJudgeScriptPath: scripts.agentJudgeScript,
       stopSummaryScriptPath: scripts.stopSummaryScript,
+      cweStopScriptPath: scripts.cweStopScript,
+      cveStopScriptPath: scripts.cveStopScript,
       sessionStartScriptPath: scripts.sessionStartScript,
       transcriptSyncScriptPath: scripts.transcriptSyncScript,
+      subagentStartScriptPath: scripts.subagentStartScript,
+      subagentStopScriptPath: scripts.subagentStopScript,
       userPromptSubmitScriptPath: scripts.userPromptSubmitScript,
       promptRouteScriptPath: scripts.promptRouteScript,
       installScanScriptPath: scripts.installScanScript,
@@ -8525,7 +9422,7 @@ async function syncSkillFiles() {
   if (resolved.length === 0) return;
   const mcpPort = process.env.SYNKRO_MCP_PORT || "18931";
   const tasks = resolved.map((fp) => {
-    const content = readFileSync20(fp, "utf-8");
+    const content = readFileSync21(fp, "utf-8");
     const source = `skill:${fp.split("/").pop()}`;
     if (!content.trim()) {
       console.log(`  \u2298 skill ${source}: empty file, skipped`);
@@ -8550,11 +9447,11 @@ function discoverSkillFiles(repoRoot2, excludeHashes, ingestedHashes, ingestedNa
     } catch {
     }
   };
-  add(join18(homedir20(), ".claude", "skills"));
-  add(join18(homedir20(), ".agents", "skills"));
+  add(join19(homedir21(), ".claude", "skills"));
+  add(join19(homedir21(), ".agents", "skills"));
   if (repoRoot2) {
-    add(join18(repoRoot2, ".claude", "skills"));
-    add(join18(repoRoot2, ".agents", "skills"));
+    add(join19(repoRoot2, ".claude", "skills"));
+    add(join19(repoRoot2, ".agents", "skills"));
   }
   const out = [];
   const seen = /* @__PURE__ */ new Set();
@@ -8565,12 +9462,12 @@ function discoverSkillFiles(repoRoot2, excludeHashes, ingestedHashes, ingestedNa
     try {
       const st = statSync2(file);
       if (!st.isFile() || st.size > 2e5) return;
-      content = readFileSync20(file, "utf-8");
+      content = readFileSync21(file, "utf-8");
     } catch {
       return;
     }
     if (!content.trim()) return;
-    const hash = createHash2("sha256").update(content).digest("hex");
+    const hash = createHash4("sha256").update(content).digest("hex");
     if (seen.has(hash) || excludeHashes.has(hash)) return;
     seen.add(hash);
     const ingested = ingestedHashes.has(hash) || ingestedNames.has(normSkillName(name));
@@ -8585,7 +9482,7 @@ function discoverSkillFiles(repoRoot2, excludeHashes, ingestedHashes, ingestedNa
     }
     for (const entry of entries) {
       if (entry.startsWith(".")) continue;
-      const full = join18(root, entry);
+      const full = join19(root, entry);
       let st;
       try {
         st = statSync2(full);
@@ -8593,7 +9490,7 @@ function discoverSkillFiles(repoRoot2, excludeHashes, ingestedHashes, ingestedNa
         continue;
       }
       if (st.isDirectory()) {
-        const skillMd = join18(full, "SKILL.md");
+        const skillMd = join19(full, "SKILL.md");
         if (existsSync22(skillMd)) consider(skillMd, entry);
       } else if (/\.mdx?$/i.test(entry) && entry.toUpperCase() !== "README.MD") {
         consider(full, entry.replace(/\.mdx?$/i, ""));
@@ -8603,7 +9500,7 @@ function discoverSkillFiles(repoRoot2, excludeHashes, ingestedHashes, ingestedNa
   return out;
 }
 function discoverySetHash(found) {
-  return createHash2("sha256").update(found.map((f) => f.hash).sort().join(",")).digest("hex");
+  return createHash4("sha256").update(found.map((f) => f.hash).sort().join(",")).digest("hex");
 }
 async function promptSkillDiscovery(found) {
   if (!process.stdin.isTTY || found.length === 0) return [];
@@ -8643,7 +9540,7 @@ async function discoverAndIngestSkills() {
     if (sf?.skills?.length) {
       for (const fp of resolveSkillPaths(sf.skills, sf._repoRoot)) {
         try {
-          excludeHashes.add(createHash2("sha256").update(readFileSync20(fp, "utf-8")).digest("hex"));
+          excludeHashes.add(createHash4("sha256").update(readFileSync21(fp, "utf-8")).digest("hex"));
         } catch {
         }
       }
@@ -8674,13 +9571,13 @@ async function discoverAndIngestSkills() {
     const setHash = discoverySetHash(selectable);
     let prev = "";
     try {
-      prev = readFileSync20(SKILLS_DISCOVERED_PATH, "utf-8").trim();
+      prev = readFileSync21(SKILLS_DISCOVERED_PATH, "utf-8").trim();
     } catch {
     }
     if (prev === setHash) return;
     const picks = await promptSkillDiscovery(found);
     try {
-      writeFileSync16(SKILLS_DISCOVERED_PATH, setHash);
+      writeFileSync17(SKILLS_DISCOVERED_PATH, setHash);
     } catch {
     }
     if (picks.length === 0) {
@@ -8719,9 +9616,9 @@ function ensureReachabilityGitHook() {
     const root = run("git rev-parse --show-toplevel");
     if (!root) return null;
     let hooksDir = run("git config --get core.hooksPath");
-    hooksDir = hooksDir ? isAbsolute(hooksDir) ? hooksDir : join18(root, hooksDir) : join18(root, ".git", "hooks");
+    hooksDir = hooksDir ? isAbsolute(hooksDir) ? hooksDir : join19(root, hooksDir) : join19(root, ".git", "hooks");
     if (!existsSync22(hooksDir)) mkdirSync15(hooksDir, { recursive: true });
-    const hookPath = join18(hooksDir, "post-commit");
+    const hookPath = join19(hooksDir, "post-commit");
     const resolvedBin = resolveSynkroBinPath();
     const invoke = resolvedBin ? `"${resolvedBin}" reachability-scan --quiet` : "true";
     const START = "# >>> synkro reachability (managed) >>>";
@@ -8735,23 +9632,23 @@ function ensureReachabilityGitHook() {
     ].join("\n");
     const esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     if (!existsSync22(hookPath)) {
-      writeFileSync16(hookPath, "#!/bin/sh\n" + block + "\n", { mode: 493 });
+      writeFileSync17(hookPath, "#!/bin/sh\n" + block + "\n", { mode: 493 });
       return "installed";
     }
-    let cur = readFileSync20(hookPath, "utf-8");
+    let cur = readFileSync21(hookPath, "utf-8");
     if (cur.includes(START)) {
       cur = cur.replace(new RegExp(esc(START) + "[\\s\\S]*?" + esc(END), "m"), block);
-      writeFileSync16(hookPath, cur);
+      writeFileSync17(hookPath, cur);
       try {
-        chmodSync4(hookPath, 493);
+        chmodSync5(hookPath, 493);
       } catch {
       }
       return "updated";
     }
     const sep = cur.endsWith("\n") ? "" : "\n";
-    writeFileSync16(hookPath, cur + sep + "\n" + block + "\n");
+    writeFileSync17(hookPath, cur + sep + "\n" + block + "\n");
     try {
-      chmodSync4(hookPath, 493);
+      chmodSync5(hookPath, 493);
     } catch {
     }
     return "updated";
@@ -8777,7 +9674,7 @@ function detectGitRepo2() {
 function getClaudeProjectsFolder() {
   const cwd = process.cwd();
   const sanitized = "-" + cwd.replace(/\//g, "-");
-  const projectsDir = join18(homedir20(), ".claude", "projects", sanitized);
+  const projectsDir = join19(homedir21(), ".claude", "projects", sanitized);
   return existsSync22(projectsDir) ? projectsDir : null;
 }
 function extractSessionInsights(projectsDir) {
@@ -8785,9 +9682,9 @@ function extractSessionInsights(projectsDir) {
   const files = readdirSync4(projectsDir).filter((f) => f.endsWith(".jsonl"));
   for (const file of files) {
     const sessionId = file.replace(".jsonl", "");
-    const filePath = join18(projectsDir, file);
+    const filePath = join19(projectsDir, file);
     try {
-      const content = readFileSync20(filePath, "utf-8");
+      const content = readFileSync21(filePath, "utf-8");
       const lines = content.split("\n").filter(Boolean);
       for (let i = 0; i < lines.length; i++) {
         try {
@@ -8863,7 +9760,7 @@ function extractTextContent(content) {
   return "";
 }
 function getCodexTranscriptFiles(repo) {
-  const sessionsDir = join18(process.env.CODEX_HOME || join18(homedir20(), ".codex"), "sessions");
+  const sessionsDir = join19(process.env.CODEX_HOME || join19(homedir21(), ".codex"), "sessions");
   if (!existsSync22(sessionsDir)) return [];
   let relative = [];
   try {
@@ -8871,9 +9768,9 @@ function getCodexTranscriptFiles(repo) {
   } catch {
     return [];
   }
-  return relative.filter((p) => p.endsWith(".jsonl")).map((p) => join18(sessionsDir, p)).filter((filePath) => {
+  return relative.filter((p) => p.endsWith(".jsonl")).map((p) => join19(sessionsDir, p)).filter((filePath) => {
     try {
-      const first = readFileSync20(filePath, "utf-8").split("\n", 1)[0];
+      const first = readFileSync21(filePath, "utf-8").split("\n", 1)[0];
       const meta = JSON.parse(first);
       const cwd = typeof meta?.payload?.cwd === "string" ? resolve4(meta.payload.cwd) : "";
       const root = resolve4(repo);
@@ -8883,38 +9780,45 @@ function getCodexTranscriptFiles(repo) {
     }
   });
 }
+function isJsonSyntaxError(error) {
+  return error instanceof SyntaxError;
+}
 function parseCodexTranscriptFile(filePath) {
-  const lines = readFileSync20(filePath, "utf-8").split("\n").filter(Boolean);
+  const transcript = readFileSync21(filePath, "utf-8");
+  const lines = transcript.split("\n");
+  const transcriptUsage = parseCodexTranscriptUsage(transcript);
   let sessionId = "";
   let model = "";
-  const messages = [];
-  for (let i = 0; i < lines.length; i++) {
+  for (const line of lines) {
     try {
-      const entry = JSON.parse(lines[i]);
+      const entry = JSON.parse(line);
       if (entry.type === "session_meta") {
         sessionId = String(entry.payload?.session_id || entry.payload?.id || sessionId);
-        continue;
-      }
-      if (entry.type === "turn_context" && typeof entry.payload?.model === "string") {
+      } else if (entry.type === "turn_context" && typeof entry.payload?.model === "string") {
         model = entry.payload.model;
-        continue;
       }
-      if (entry.type !== "event_msg") continue;
-      const eventType = entry.payload?.type;
-      if (eventType !== "user_message" && eventType !== "agent_message") continue;
-      const text = String(entry.payload?.message || "").slice(0, 8e3);
-      if (!text) continue;
-      const type = eventType === "user_message" ? "user" : "assistant";
-      messages.push({
-        message_index: i,
-        type,
-        content: text,
-        ...type === "assistant" && model ? { model } : {}
-      });
-    } catch {
+    } catch (error) {
+      if (!isJsonSyntaxError(error)) throw error;
     }
   }
-  return { sessionId, messages };
+  const messages = parseCodexConversationMessages(transcript).map((message) => {
+    const turnUsage = message.role === "assistant" ? transcriptUsage?.turnsByLine.get(message.lineIndex) : void 0;
+    return {
+      message_index: message.lineIndex,
+      uuid: message.uuid,
+      type: message.role,
+      content: message.content,
+      ...message.role === "assistant" && (turnUsage?.model || model) ? { model: turnUsage?.model || model } : {},
+      ...turnUsage ? { usage: turnUsage.usage } : {},
+      ...message.timestamp ? { timestamp: message.timestamp } : {}
+    };
+  });
+  return {
+    sessionId,
+    messages,
+    model: transcriptUsage?.model || model,
+    usage: transcriptUsage?.total
+  };
 }
 async function syncCodexTranscriptsLocal(mcpPort, mcpToken, repo) {
   const files = getCodexTranscriptFiles(repo);
@@ -8931,7 +9835,15 @@ async function syncCodexTranscriptsLocal(mcpPort, mcpToken, repo) {
       const resp = await fetch(`http://127.0.0.1:${mcpPort}/api/conversation-sync`, {
         method: "POST",
         headers: { "Content-Type": "application/json", Authorization: `Bearer ${mcpToken}` },
-        body: JSON.stringify({ session_id: parsed.sessionId, repo, messages }),
+        body: JSON.stringify({
+          session_id: parsed.sessionId,
+          repo,
+          messages,
+          session_usage: parsed.usage,
+          model: parsed.model,
+          harness: "codex",
+          usage_cumulative: true
+        }),
         signal: AbortSignal.timeout(15e3)
       });
       if (resp.ok) {
@@ -8939,7 +9851,7 @@ async function syncCodexTranscriptsLocal(mcpPort, mcpToken, repo) {
         totalSessions++;
         totalMessages += result.ingested ?? messages.length;
       }
-      writeFileSync16(join18(OFFSETS_DIR, parsed.sessionId), String(readFileSync20(files[i], "utf-8").split("\n").filter(Boolean).length), "utf-8");
+      writeFileSync17(join19(OFFSETS_DIR, parsed.sessionId), String(readFileSync21(files[i], "utf-8").split("\n").filter(Boolean).length), "utf-8");
     } catch {
     }
     if ((i + 1) % 10 === 0 || i === files.length - 1) {
@@ -8953,14 +9865,14 @@ function cursorProjectSlug(workspaceRoot) {
   return workspaceRoot.replace(/^[/]+/, "").replace(/[^a-zA-Z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function getCursorTranscriptsDir() {
-  const dir = join18(homedir20(), ".cursor", "projects", cursorProjectSlug(process.cwd()), "agent-transcripts");
+  const dir = join19(homedir21(), ".cursor", "projects", cursorProjectSlug(process.cwd()), "agent-transcripts");
   return existsSync22(dir) ? dir : null;
 }
 function isSafeConvId(id) {
   return /^[A-Za-z0-9_-]+$/.test(id);
 }
 function parseCursorTranscriptFile(filePath) {
-  const content = readFileSync20(filePath, "utf-8");
+  const content = readFileSync21(filePath, "utf-8");
   const lines = content.split("\n").filter(Boolean);
   const messages = [];
   for (let i = 0; i < lines.length; i++) {
@@ -8992,7 +9904,7 @@ async function syncCursorTranscriptsLocal(mcpPort, mcpToken, repo) {
   for (let i = 0; i < convDirs.length; i++) {
     const convId = convDirs[i];
     if (!isSafeConvId(convId)) continue;
-    const filePath = join18(dir, convId, `${convId}.jsonl`);
+    const filePath = join19(dir, convId, `${convId}.jsonl`);
     if (!existsSync22(filePath)) continue;
     try {
       const all = parseCursorTranscriptFile(filePath);
@@ -9015,8 +9927,8 @@ async function syncCursorTranscriptsLocal(mcpPort, mcpToken, repo) {
       process.stdout.write(`\r  Progress: ${i + 1}/${convDirs.length} sessions (${totalMessages} messages embedded)   `);
     }
     try {
-      const lc = readFileSync20(filePath, "utf-8").split("\n").filter(Boolean).length;
-      writeFileSync16(join18(OFFSETS_DIR, convId), String(lc), "utf-8");
+      const lc = readFileSync21(filePath, "utf-8").split("\n").filter(Boolean).length;
+      writeFileSync17(join19(OFFSETS_DIR, convId), String(lc), "utf-8");
     } catch {
     }
   }
@@ -9024,7 +9936,7 @@ async function syncCursorTranscriptsLocal(mcpPort, mcpToken, repo) {
   return { sessions: totalSessions, messages: totalMessages };
 }
 function parseTranscriptFile(filePath) {
-  const content = readFileSync20(filePath, "utf-8");
+  const content = readFileSync21(filePath, "utf-8");
   const lines = content.split("\n").filter(Boolean);
   const messages = [];
   for (let i = 0; i < lines.length; i++) {
@@ -9072,7 +9984,7 @@ async function syncTranscriptsLocal(mcpPort, mcpToken, repo) {
   for (let i = 0; i < files.length; i++) {
     const file = files[i];
     const sessionId = file.replace(".jsonl", "");
-    const filePath = join18(projectsDir, file);
+    const filePath = join19(projectsDir, file);
     try {
       const allMessages = parseTranscriptFile(filePath);
       const messages = allMessages.length > 500 ? allMessages.slice(-500) : allMessages;
@@ -9094,9 +10006,9 @@ async function syncTranscriptsLocal(mcpPort, mcpToken, repo) {
       process.stdout.write(`\r  Progress: ${i + 1}/${files.length} sessions (${totalMessages} messages embedded)   `);
     }
     try {
-      const content = readFileSync20(join18(projectsDir, file), "utf-8");
+      const content = readFileSync21(join19(projectsDir, file), "utf-8");
       const lineCount = content.split("\n").filter(Boolean).length;
-      writeFileSync16(join18(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
+      writeFileSync17(join19(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
     } catch {
     }
   }
@@ -9117,7 +10029,7 @@ async function syncTranscriptsBulk(gatewayUrl, token, repo) {
     const sessions = [];
     for (const file of batch) {
       const sessionId = file.replace(".jsonl", "");
-      const filePath = join18(projectsDir, file);
+      const filePath = join19(projectsDir, file);
       try {
         const allMessages = parseTranscriptFile(filePath);
         const messages = allMessages.length > maxMessagesPerSession ? allMessages.slice(-maxMessagesPerSession) : allMessages;
@@ -9146,11 +10058,11 @@ async function syncTranscriptsBulk(gatewayUrl, token, repo) {
     }
     for (const file of batch) {
       const sessionId = file.replace(".jsonl", "");
-      const filePath = join18(projectsDir, file);
+      const filePath = join19(projectsDir, file);
       try {
-        const content = readFileSync20(filePath, "utf-8");
+        const content = readFileSync21(filePath, "utf-8");
         const lineCount = content.split("\n").filter(Boolean).length;
-        writeFileSync16(join18(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
+        writeFileSync17(join19(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
       } catch {
       }
     }
@@ -9168,7 +10080,16 @@ async function syncCodexTranscriptsBulk(gatewayUrl, token, repo) {
       try {
         const parsed = parseCodexTranscriptFile(filePath);
         const messages = parsed.messages.length > 500 ? parsed.messages.slice(-500) : parsed.messages;
-        if (parsed.sessionId && messages.length > 0) sessions.push({ cc_session_id: parsed.sessionId, messages });
+        if (parsed.sessionId && messages.length > 0) {
+          sessions.push({
+            cc_session_id: parsed.sessionId,
+            messages,
+            model: parsed.model,
+            session_usage: parsed.usage,
+            harness: "codex",
+            usage_cumulative: true
+          });
+        }
       } catch {
       }
     }
@@ -9190,7 +10111,7 @@ async function syncCodexTranscriptsBulk(gatewayUrl, token, repo) {
       try {
         const parsed = parseCodexTranscriptFile(filePath);
         if (parsed.sessionId) {
-          writeFileSync16(join18(OFFSETS_DIR, parsed.sessionId), String(readFileSync20(filePath, "utf-8").split("\n").filter(Boolean).length), "utf-8");
+          writeFileSync17(join19(OFFSETS_DIR, parsed.sessionId), String(readFileSync21(filePath, "utf-8").split("\n").filter(Boolean).length), "utf-8");
         }
       } catch {
       }
@@ -9221,10 +10142,12 @@ var init_install = __esm({
     init_codexCloudSetup();
     init_ptyShim();
     init_graderSmoke();
-    SYNKRO_DIR11 = join18(homedir20(), ".synkro");
-    HOOKS_DIR = join18(SYNKRO_DIR11, "hooks");
-    BIN_DIR = join18(SYNKRO_DIR11, "bin");
-    CONFIG_PATH4 = join18(SYNKRO_DIR11, "config.env");
+    init_codexTranscriptUsage();
+    init_codexTranscriptMessages();
+    SYNKRO_DIR11 = join19(homedir21(), ".synkro");
+    HOOKS_DIR = join19(SYNKRO_DIR11, "hooks");
+    BIN_DIR = join19(SYNKRO_DIR11, "bin");
+    CONFIG_PATH4 = join19(SYNKRO_DIR11, "config.env");
     MCP_STDIO_PROXY_SRC = `#!/usr/bin/env bun
 import { readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
@@ -9335,23 +10258,23 @@ rl.on('line', async (line) => {
   }
 });
 `;
-    OFFSETS_DIR = join18(SYNKRO_DIR11, ".transcript-offsets");
-    CLOUD_JWT_PATH = join18(SYNKRO_DIR11, ".cloud-jwt");
-    SKILLS_DISCOVERED_PATH = join18(SYNKRO_DIR11, ".skills-discovered");
+    OFFSETS_DIR = join19(SYNKRO_DIR11, ".transcript-offsets");
+    CLOUD_JWT_PATH = join19(SYNKRO_DIR11, ".cloud-jwt");
+    SKILLS_DISCOVERED_PATH = join19(SYNKRO_DIR11, ".skills-discovered");
   }
 });
 
 // cli/local-cc/install.ts
-import { existsSync as existsSync23, mkdirSync as mkdirSync16, writeFileSync as writeFileSync17, readFileSync as readFileSync21, chmodSync as chmodSync5, copyFileSync as copyFileSync2, renameSync as renameSync7, unlinkSync as unlinkSync8, openSync as openSync2, fsyncSync, closeSync as closeSync2 } from "fs";
-import { join as join19 } from "path";
-import { homedir as homedir21 } from "os";
+import { existsSync as existsSync23, mkdirSync as mkdirSync16, writeFileSync as writeFileSync18, readFileSync as readFileSync22, chmodSync as chmodSync6, copyFileSync as copyFileSync2, renameSync as renameSync8, unlinkSync as unlinkSync8, openSync as openSync2, fsyncSync, closeSync as closeSync2 } from "fs";
+import { join as join20 } from "path";
+import { homedir as homedir22 } from "os";
 import { spawnSync as spawnSync7 } from "child_process";
 function writePluginFiles() {
   for (const c of CHANNELS) {
     mkdirSync16(c.sessionDir, { recursive: true });
     mkdirSync16(c.pluginSettingsDir, { recursive: true });
-    writeFileSync17(c.pluginPkgPath, PLUGIN_PACKAGE_JSON, "utf-8");
-    writeFileSync17(
+    writeFileSync18(c.pluginPkgPath, PLUGIN_PACKAGE_JSON, "utf-8");
+    writeFileSync18(
       c.pluginSettingsPath,
       JSON.stringify({
         fastMode: true,
@@ -9366,8 +10289,8 @@ function writePluginFiles() {
       }, null, 2) + "\n",
       "utf-8"
     );
-    writeFileSync17(c.runScriptPath, c.runScriptSource, "utf-8");
-    chmodSync5(c.runScriptPath, 493);
+    writeFileSync18(c.runScriptPath, c.runScriptSource, "utf-8");
+    chmodSync6(c.runScriptPath, 493);
   }
 }
 function runBunInstall() {
@@ -9388,7 +10311,7 @@ function safelyMutateClaudeJson(mutator) {
   if (!existsSync23(CLAUDE_JSON_PATH)) {
     return;
   }
-  const originalText = readFileSync21(CLAUDE_JSON_PATH, "utf-8");
+  const originalText = readFileSync22(CLAUDE_JSON_PATH, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(originalText);
@@ -9420,14 +10343,14 @@ function safelyMutateClaudeJson(mutator) {
   copyFileSync2(CLAUDE_JSON_PATH, CLAUDE_JSON_BACKUP_PATH);
   const tmpPath = `${CLAUDE_JSON_PATH}.synkro-tmp.${process.pid}`;
   try {
-    writeFileSync17(tmpPath, newText, "utf-8");
+    writeFileSync18(tmpPath, newText, "utf-8");
     const fd = openSync2(tmpPath, "r");
     try {
       fsyncSync(fd);
     } finally {
       closeSync2(fd);
     }
-    renameSync7(tmpPath, CLAUDE_JSON_PATH);
+    renameSync8(tmpPath, CLAUDE_JSON_PATH);
   } catch (err) {
     try {
       unlinkSync8(tmpPath);
@@ -9453,7 +10376,7 @@ function writeProjectMcpJson() {
         }
       }
     };
-    writeFileSync17(c.projectMcpPath, JSON.stringify(mcp, null, 2) + "\n", "utf-8");
+    writeFileSync18(c.projectMcpPath, JSON.stringify(mcp, null, 2) + "\n", "utf-8");
   }
 }
 function patchClaudeJson() {
@@ -9530,42 +10453,42 @@ var CLAUDE_JSON_BACKUP_PATH, SESSION_DIR, PLUGIN_PATH, PLUGIN_PKG_PATH, PLUGIN_S
 var init_install2 = __esm({
   "cli/local-cc/install.ts"() {
     "use strict";
-    CLAUDE_JSON_BACKUP_PATH = join19(homedir21(), ".claude.json.synkro-bak");
-    SESSION_DIR = join19(homedir21(), ".synkro", "cc_sessions");
-    PLUGIN_PATH = join19(SESSION_DIR, "synkro-channel.ts");
-    PLUGIN_PKG_PATH = join19(SESSION_DIR, "package.json");
-    PLUGIN_SETTINGS_DIR = join19(SESSION_DIR, ".claude");
-    PLUGIN_SETTINGS_PATH = join19(PLUGIN_SETTINGS_DIR, "settings.json");
-    PROJECT_MCP_PATH = join19(SESSION_DIR, ".mcp.json");
-    CLAUDE_JSON_PATH = join19(homedir21(), ".claude.json");
-    RUN_SCRIPT_PATH = join19(SESSION_DIR, "run-claude.sh");
+    CLAUDE_JSON_BACKUP_PATH = join20(homedir22(), ".claude.json.synkro-bak");
+    SESSION_DIR = join20(homedir22(), ".synkro", "cc_sessions");
+    PLUGIN_PATH = join20(SESSION_DIR, "synkro-channel.ts");
+    PLUGIN_PKG_PATH = join20(SESSION_DIR, "package.json");
+    PLUGIN_SETTINGS_DIR = join20(SESSION_DIR, ".claude");
+    PLUGIN_SETTINGS_PATH = join20(PLUGIN_SETTINGS_DIR, "settings.json");
+    PROJECT_MCP_PATH = join20(SESSION_DIR, ".mcp.json");
+    CLAUDE_JSON_PATH = join20(homedir22(), ".claude.json");
+    RUN_SCRIPT_PATH = join20(SESSION_DIR, "run-claude.sh");
     TMUX_SESSION_NAME = "synkro-local-cc";
     CHANNEL_1_PORT = 8941;
-    SESSION_DIR_2 = join19(homedir21(), ".synkro", "cc_sessions_2");
-    PLUGIN_PATH_2 = join19(SESSION_DIR_2, "synkro-channel.ts");
-    PLUGIN_PKG_PATH_2 = join19(SESSION_DIR_2, "package.json");
-    PLUGIN_SETTINGS_DIR_2 = join19(SESSION_DIR_2, ".claude");
-    PLUGIN_SETTINGS_PATH_2 = join19(PLUGIN_SETTINGS_DIR_2, "settings.json");
-    PROJECT_MCP_PATH_2 = join19(SESSION_DIR_2, ".mcp.json");
-    RUN_SCRIPT_PATH_2 = join19(SESSION_DIR_2, "run-claude.sh");
+    SESSION_DIR_2 = join20(homedir22(), ".synkro", "cc_sessions_2");
+    PLUGIN_PATH_2 = join20(SESSION_DIR_2, "synkro-channel.ts");
+    PLUGIN_PKG_PATH_2 = join20(SESSION_DIR_2, "package.json");
+    PLUGIN_SETTINGS_DIR_2 = join20(SESSION_DIR_2, ".claude");
+    PLUGIN_SETTINGS_PATH_2 = join20(PLUGIN_SETTINGS_DIR_2, "settings.json");
+    PROJECT_MCP_PATH_2 = join20(SESSION_DIR_2, ".mcp.json");
+    RUN_SCRIPT_PATH_2 = join20(SESSION_DIR_2, "run-claude.sh");
     TMUX_SESSION_NAME_2 = "synkro-local-cc-2";
     CHANNEL_2_PORT = 8951;
-    SESSION_DIR_3 = join19(homedir21(), ".synkro", "cc_sessions_3");
-    PLUGIN_PATH_3 = join19(SESSION_DIR_3, "synkro-channel.ts");
-    PLUGIN_PKG_PATH_3 = join19(SESSION_DIR_3, "package.json");
-    PLUGIN_SETTINGS_DIR_3 = join19(SESSION_DIR_3, ".claude");
-    PLUGIN_SETTINGS_PATH_3 = join19(PLUGIN_SETTINGS_DIR_3, "settings.json");
-    PROJECT_MCP_PATH_3 = join19(SESSION_DIR_3, ".mcp.json");
-    RUN_SCRIPT_PATH_3 = join19(SESSION_DIR_3, "run-claude.sh");
+    SESSION_DIR_3 = join20(homedir22(), ".synkro", "cc_sessions_3");
+    PLUGIN_PATH_3 = join20(SESSION_DIR_3, "synkro-channel.ts");
+    PLUGIN_PKG_PATH_3 = join20(SESSION_DIR_3, "package.json");
+    PLUGIN_SETTINGS_DIR_3 = join20(SESSION_DIR_3, ".claude");
+    PLUGIN_SETTINGS_PATH_3 = join20(PLUGIN_SETTINGS_DIR_3, "settings.json");
+    PROJECT_MCP_PATH_3 = join20(SESSION_DIR_3, ".mcp.json");
+    RUN_SCRIPT_PATH_3 = join20(SESSION_DIR_3, "run-claude.sh");
     TMUX_SESSION_NAME_3 = "synkro-local-cc-3";
     CHANNEL_3_PORT = 8942;
-    SESSION_DIR_4 = join19(homedir21(), ".synkro", "cc_sessions_4");
-    PLUGIN_PATH_4 = join19(SESSION_DIR_4, "synkro-channel.ts");
-    PLUGIN_PKG_PATH_4 = join19(SESSION_DIR_4, "package.json");
-    PLUGIN_SETTINGS_DIR_4 = join19(SESSION_DIR_4, ".claude");
-    PLUGIN_SETTINGS_PATH_4 = join19(PLUGIN_SETTINGS_DIR_4, "settings.json");
-    PROJECT_MCP_PATH_4 = join19(SESSION_DIR_4, ".mcp.json");
-    RUN_SCRIPT_PATH_4 = join19(SESSION_DIR_4, "run-claude.sh");
+    SESSION_DIR_4 = join20(homedir22(), ".synkro", "cc_sessions_4");
+    PLUGIN_PATH_4 = join20(SESSION_DIR_4, "synkro-channel.ts");
+    PLUGIN_PKG_PATH_4 = join20(SESSION_DIR_4, "package.json");
+    PLUGIN_SETTINGS_DIR_4 = join20(SESSION_DIR_4, ".claude");
+    PLUGIN_SETTINGS_PATH_4 = join20(PLUGIN_SETTINGS_DIR_4, "settings.json");
+    PROJECT_MCP_PATH_4 = join20(SESSION_DIR_4, ".mcp.json");
+    RUN_SCRIPT_PATH_4 = join20(SESSION_DIR_4, "run-claude.sh");
     TMUX_SESSION_NAME_4 = "synkro-local-cc-4";
     CHANNEL_4_PORT = 8952;
     RUN_SCRIPT_SOURCE = `#!/usr/bin/env bash
@@ -9840,8 +10763,8 @@ __export(disconnect_exports, {
   disconnectCommand: () => disconnectCommand
 });
 import { existsSync as existsSync24, rmSync as rmSync3, readdirSync as readdirSync5 } from "fs";
-import { homedir as homedir22 } from "os";
-import { join as join20 } from "path";
+import { homedir as homedir23 } from "os";
+import { join as join21 } from "path";
 import { spawnSync as spawnSync8 } from "child_process";
 import { createInterface as createInterface3 } from "readline";
 async function tearDownLocalCC() {
@@ -9956,13 +10879,13 @@ async function disconnectCommand(args2 = [], opts = {}) {
       console.log(`\u2713 wiped ${SYNKRO_DIR12} entirely \u2014 including all scan data and backups`);
     } else {
       const keep = /* @__PURE__ */ new Set([
-        join20(SYNKRO_DIR12, "pgdata"),
-        join20(SYNKRO_DIR12, "pgdata-backups"),
-        join20(SYNKRO_DIR12, ".transcript-offsets")
+        join21(SYNKRO_DIR12, "pgdata"),
+        join21(SYNKRO_DIR12, "pgdata-backups"),
+        join21(SYNKRO_DIR12, ".transcript-offsets")
       ]);
       const preserved = [];
       for (const entry of readdirSync5(SYNKRO_DIR12)) {
-        const full = join20(SYNKRO_DIR12, entry);
+        const full = join21(SYNKRO_DIR12, entry);
         if (keep.has(full)) {
           preserved.push(entry);
           continue;
@@ -10000,14 +10923,14 @@ var init_disconnect = __esm({
     init_dockerInstall();
     init_macKeychain();
     init_telemetry();
-    SYNKRO_DIR12 = join20(homedir22(), ".synkro");
+    SYNKRO_DIR12 = join21(homedir23(), ".synkro");
   }
 });
 
 // cli/local-cc/turnLog.ts
-import { appendFileSync as appendFileSync3, existsSync as existsSync25, mkdirSync as mkdirSync17, openSync as openSync3, readFileSync as readFileSync22, readSync, closeSync as closeSync3, statSync as statSync3, watchFile, unwatchFile } from "fs";
-import { dirname as dirname7, join as join21 } from "path";
-import { homedir as homedir23 } from "os";
+import { appendFileSync as appendFileSync3, existsSync as existsSync25, mkdirSync as mkdirSync17, openSync as openSync3, readFileSync as readFileSync23, readSync, closeSync as closeSync3, statSync as statSync3, watchFile, unwatchFile } from "fs";
+import { dirname as dirname7, join as join22 } from "path";
+import { homedir as homedir24 } from "os";
 function truncate(s, max = PREVIEW_MAX) {
   if (s.length <= max) return s;
   return s.slice(0, max) + "\u2026 [+" + (s.length - max) + " chars]";
@@ -10047,7 +10970,7 @@ function readRecentTurns(n = 20) {
   try {
     const size = statSync3(TURN_LOG_PATH).size;
     if (size === 0) return [];
-    const text = readFileSync22(TURN_LOG_PATH, "utf-8");
+    const text = readFileSync23(TURN_LOG_PATH, "utf-8");
     const lines = text.split("\n").filter(Boolean);
     const lastN = lines.slice(-n).reverse();
     return lastN.map((line) => {
@@ -10126,7 +11049,7 @@ var TURN_LOG_PATH, PREVIEW_MAX;
 var init_turnLog = __esm({
   "cli/local-cc/turnLog.ts"() {
     "use strict";
-    TURN_LOG_PATH = join21(homedir23(), ".synkro", "cc_sessions", "turns.log");
+    TURN_LOG_PATH = join22(homedir24(), ".synkro", "cc_sessions", "turns.log");
     PREVIEW_MAX = 400;
   }
 });
@@ -10280,8 +11203,8 @@ __export(scanPr_exports, {
   scanPrCommand: () => scanPrCommand
 });
 import { execSync as execSync5, spawn as spawn5 } from "child_process";
-import { readFileSync as readFileSync23, existsSync as existsSync26 } from "fs";
-import { join as join22 } from "path";
+import { readFileSync as readFileSync24, existsSync as existsSync26 } from "fs";
+import { join as join23 } from "path";
 function parseMatchSpec(condition) {
   if (!condition.startsWith("match_spec:")) return null;
   try {
@@ -10760,10 +11683,10 @@ function shouldFail(findings, threshold) {
   return findings.some((f) => order.indexOf(f.severity) >= thresholdIdx);
 }
 function readRepoDeps() {
-  const pkgPath = join22(process.cwd(), "package.json");
+  const pkgPath = join23(process.cwd(), "package.json");
   if (!existsSync26(pkgPath)) return {};
   try {
-    const pkg = JSON.parse(readFileSync23(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync24(pkgPath, "utf-8"));
     return { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
   } catch {
     return {};
@@ -11007,15 +11930,15 @@ var routeDecide_exports = {};
 __export(routeDecide_exports, {
   routeDecide: () => routeDecide
 });
-import { readFileSync as readFileSync24, writeFileSync as writeFileSync18 } from "fs";
-import { homedir as homedir24 } from "os";
-import { join as join23 } from "path";
+import { readFileSync as readFileSync25, writeFileSync as writeFileSync19 } from "fs";
+import { homedir as homedir25 } from "os";
+import { join as join24 } from "path";
 function safeSid(sid) {
   return sid.replace(/[^A-Za-z0-9_-]/g, "_");
 }
 function loadMcpJwt() {
   try {
-    return readFileSync24(join23(SYNKRO_DIR13, ".mcp-jwt"), "utf-8").trim();
+    return readFileSync25(join24(SYNKRO_DIR13, ".mcp-jwt"), "utf-8").trim();
   } catch {
     return "";
   }
@@ -11025,7 +11948,7 @@ async function routeDecide(sessionId) {
   const sid = safeSid(sessionId);
   let prompt = "";
   try {
-    const rec = JSON.parse(readFileSync24(join23(SESSIONS_DIR2, sid + ".json"), "utf-8"));
+    const rec = JSON.parse(readFileSync25(join24(SESSIONS_DIR2, sid + ".json"), "utf-8"));
     prompt = String(rec.last_prompt || "").trim();
   } catch {
     return;
@@ -11036,7 +11959,7 @@ async function routeDecide(sessionId) {
     const resp = await fetch(`http://127.0.0.1:${GRADER_HOST_PORT}/submit`, {
       method: "POST",
       headers: { "Content-Type": "application/json", Authorization: "Bearer " + loadMcpJwt() },
-      body: JSON.stringify({ role: "route-classify", payload: prompt, content: prompt, agent_kind: "claude_code", hedge: false }),
+      body: JSON.stringify({ role: "route-classify", payload: prompt, content: prompt, hedge: false }),
       // First call may spin up the route lane (a haiku worker boot), so allow headroom.
       signal: AbortSignal.timeout(12e4)
     });
@@ -11048,19 +11971,19 @@ async function routeDecide(sessionId) {
     return;
   }
   if (!model || !VALID_MODELS.has(model)) return;
-  const lastFile = join23(PTY_DIR, "route-last-" + sid);
+  const lastFile = join24(PTY_DIR, "route-last-" + sid);
   let last = "";
   try {
-    last = readFileSync24(lastFile, "utf-8").trim();
+    last = readFileSync25(lastFile, "utf-8").trim();
   } catch {
   }
   if (model === last) return;
   try {
-    writeFileSync18(lastFile, model);
+    writeFileSync19(lastFile, model);
   } catch {
   }
   try {
-    writeFileSync18(join23(PTY_DIR, "route-" + sid), model);
+    writeFileSync19(join24(PTY_DIR, "route-" + sid), model);
   } catch {
   }
 }
@@ -11068,9 +11991,9 @@ var SYNKRO_DIR13, PTY_DIR, SESSIONS_DIR2, VALID_MODELS, GRADER_HOST_PORT;
 var init_routeDecide = __esm({
   "cli/local-cc/routeDecide.ts"() {
     "use strict";
-    SYNKRO_DIR13 = join23(homedir24(), ".synkro");
-    PTY_DIR = join23(SYNKRO_DIR13, "pty");
-    SESSIONS_DIR2 = join23(PTY_DIR, "sessions");
+    SYNKRO_DIR13 = join24(homedir25(), ".synkro");
+    PTY_DIR = join24(SYNKRO_DIR13, "pty");
+    SESSIONS_DIR2 = join24(PTY_DIR, "sessions");
     VALID_MODELS = /* @__PURE__ */ new Set(["claude-haiku-4-5", "claude-sonnet-5", "claude-opus-4-8"]);
     GRADER_HOST_PORT = process.env.SYNKRO_GRADER_HOST_PORT || "18929";
   }
@@ -11081,9 +12004,9 @@ var routeOrchestrate_exports = {};
 __export(routeOrchestrate_exports, {
   routeAndResubmit: () => routeAndResubmit
 });
-import { readFileSync as readFileSync25, writeFileSync as writeFileSync19 } from "fs";
-import { homedir as homedir25 } from "os";
-import { join as join24 } from "path";
+import { readFileSync as readFileSync26, writeFileSync as writeFileSync20 } from "fs";
+import { homedir as homedir26 } from "os";
+import { join as join25 } from "path";
 import { spawnSync as spawnSync9 } from "child_process";
 function safeSid2(sid) {
   return sid.replace(/[^A-Za-z0-9_-]/g, "_");
@@ -11093,7 +12016,7 @@ function safeSession(s) {
 }
 function loadMcpJwt2() {
   try {
-    return readFileSync25(join24(SYNKRO_DIR14, ".mcp-jwt"), "utf-8").trim();
+    return readFileSync26(join25(SYNKRO_DIR14, ".mcp-jwt"), "utf-8").trim();
   } catch {
     return "";
   }
@@ -11103,7 +12026,7 @@ async function classifyTask(prompt) {
     const resp = await fetch(`http://127.0.0.1:${GRADER_HOST_PORT2}/submit`, {
       method: "POST",
       headers: { "Content-Type": "application/json", Authorization: "Bearer " + loadMcpJwt2() },
-      body: JSON.stringify({ role: "route-classify", payload: prompt, content: prompt, agent_kind: "claude_code", hedge: false }),
+      body: JSON.stringify({ role: "route-classify", payload: prompt, content: prompt, hedge: false }),
       signal: AbortSignal.timeout(6e4)
     });
     if (!resp.ok) return null;
@@ -11119,7 +12042,7 @@ async function classifyTask(prompt) {
 }
 function lastRoutedModel(sid) {
   try {
-    const v = readFileSync25(join24(PTY_DIR2, "route-last-" + sid), "utf-8").trim();
+    const v = readFileSync26(join25(PTY_DIR2, "route-last-" + sid), "utf-8").trim();
     return VALID_MODELS2.has(v) ? v : "";
   } catch {
     return "";
@@ -11129,12 +12052,12 @@ function resolveSession(sid, tmuxSession) {
   const candidates = [];
   if (tmuxSession) candidates.push(tmuxSession);
   try {
-    const rec = JSON.parse(readFileSync25(join24(SESSIONS_DIR3, safeSid2(sid) + ".json"), "utf-8"));
+    const rec = JSON.parse(readFileSync26(join25(SESSIONS_DIR3, safeSid2(sid) + ".json"), "utf-8"));
     if (rec.tmux_session) candidates.push(rec.tmux_session);
   } catch {
   }
   try {
-    candidates.push(readFileSync25(ACTIVE_SESSION_FILE2, "utf-8").trim());
+    candidates.push(readFileSync26(ACTIVE_SESSION_FILE2, "utf-8").trim());
   } catch {
   }
   for (const c of candidates) if (c && safeSession(c)) return c;
@@ -11169,12 +12092,12 @@ async function routeAndResubmit(sessionId, task, tmuxSession, forceModel) {
     }
     await wait(500);
     try {
-      writeFileSync19(join24(PTY_DIR2, "route-last-" + sid), picked);
+      writeFileSync20(join25(PTY_DIR2, "route-last-" + sid), picked);
     } catch {
     }
   }
   try {
-    writeFileSync19(join24(PTY_DIR2, "route-guard-" + sid), "1");
+    writeFileSync20(join25(PTY_DIR2, "route-guard-" + sid), "1");
   } catch {
   }
   sk("C-u");
@@ -11188,10 +12111,10 @@ var SYNKRO_DIR14, PTY_DIR2, SESSIONS_DIR3, ACTIVE_SESSION_FILE2, VALID_MODELS2,
 var init_routeOrchestrate = __esm({
   "cli/local-cc/routeOrchestrate.ts"() {
     "use strict";
-    SYNKRO_DIR14 = join24(homedir25(), ".synkro");
-    PTY_DIR2 = join24(SYNKRO_DIR14, "pty");
-    SESSIONS_DIR3 = join24(PTY_DIR2, "sessions");
-    ACTIVE_SESSION_FILE2 = join24(PTY_DIR2, "active");
+    SYNKRO_DIR14 = join25(homedir26(), ".synkro");
+    PTY_DIR2 = join25(SYNKRO_DIR14, "pty");
+    SESSIONS_DIR3 = join25(PTY_DIR2, "sessions");
+    ACTIVE_SESSION_FILE2 = join25(PTY_DIR2, "active");
     VALID_MODELS2 = /* @__PURE__ */ new Set(["claude-haiku-4-5", "claude-sonnet-5", "claude-opus-4-8"]);
     GRADER_HOST_PORT2 = process.env.SYNKRO_GRADER_HOST_PORT || "18929";
     wait = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -11203,14 +12126,14 @@ var routingToggle_exports = {};
 __export(routingToggle_exports, {
   routingCommand: () => routingCommand
 });
-import { writeFileSync as writeFileSync20, unlinkSync as unlinkSync9, existsSync as existsSync27, readdirSync as readdirSync6 } from "fs";
-import { homedir as homedir26 } from "os";
-import { join as join25 } from "path";
+import { writeFileSync as writeFileSync21, unlinkSync as unlinkSync9, existsSync as existsSync27, readdirSync as readdirSync6 } from "fs";
+import { homedir as homedir27 } from "os";
+import { join as join26 } from "path";
 function safeSid3(sid) {
   return sid.replace(/[^A-Za-z0-9_-]/g, "_");
 }
 function markerFor(session) {
-  return session ? join25(PTY_DIR3, "routing-on-" + safeSid3(session)) : join25(PTY_DIR3, "routing-on");
+  return session ? join26(PTY_DIR3, "routing-on-" + safeSid3(session)) : join26(PTY_DIR3, "routing-on");
 }
 function routingCommand(args2) {
   const sub = (args2[0] || "status").trim();
@@ -11219,7 +12142,7 @@ function routingCommand(args2) {
   if (si >= 0 && args2[si + 1]) session = args2[si + 1].trim();
   if (sub === "on") {
     try {
-      writeFileSync20(markerFor(session), "1");
+      writeFileSync21(markerFor(session), "1");
     } catch (e) {
       console.error("routing on failed:", String(e));
       return;
@@ -11242,7 +12165,7 @@ function routingCommand(args2) {
       for (const f of safeList()) {
         if (f === "routing-on" || f.startsWith("routing-on-")) {
           try {
-            unlinkSync9(join25(PTY_DIR3, f));
+            unlinkSync9(join26(PTY_DIR3, f));
             removed++;
           } catch {
           }
@@ -11274,14 +12197,14 @@ var PTY_DIR3;
 var init_routingToggle = __esm({
   "cli/local-cc/routingToggle.ts"() {
     "use strict";
-    PTY_DIR3 = join25(homedir26(), ".synkro", "pty");
+    PTY_DIR3 = join26(homedir27(), ".synkro", "pty");
   }
 });
 
 // cli/local-cc/pueue.ts
 import { execFileSync as execFileSync4, spawnSync as spawnSync10, spawn as spawn6 } from "child_process";
-import { homedir as homedir27 } from "os";
-import { join as join26 } from "path";
+import { homedir as homedir28 } from "os";
+import { join as join27 } from "path";
 import { connect as connect2 } from "net";
 function pueueAvailable() {
   const r = spawnSync10("pueue", ["--version"], { encoding: "utf-8" });
@@ -11347,7 +12270,7 @@ function startTask(opts = {}) {
     spawnSync10("pueue", ["remove", String(existing.id)], { encoding: "utf-8" });
     existing = findTask(ch);
   }
-  const runScript = join26(cwd, "run-claude.sh");
+  const runScript = join27(cwd, "run-claude.sh");
   const args2 = [
     "add",
     "--label",
@@ -11477,12 +12400,12 @@ var init_pueue = __esm({
     "use strict";
     TASK_LABEL = "synkro-local-cc";
     TMUX_SESSION = "synkro-local-cc";
-    SESSION_DIR2 = join26(homedir27(), ".synkro", "cc_sessions");
+    SESSION_DIR2 = join27(homedir28(), ".synkro", "cc_sessions");
     TASK_LABEL_2 = "synkro-local-cc-2";
     TMUX_SESSION_2 = "synkro-local-cc-2";
-    SESSION_DIR_22 = join26(homedir27(), ".synkro", "cc_sessions_2");
-    SESSION_DIR_32 = join26(homedir27(), ".synkro", "cc_sessions_3");
-    SESSION_DIR_42 = join26(homedir27(), ".synkro", "cc_sessions_4");
+    SESSION_DIR_22 = join27(homedir28(), ".synkro", "cc_sessions_2");
+    SESSION_DIR_32 = join27(homedir28(), ".synkro", "cc_sessions_3");
+    SESSION_DIR_42 = join27(homedir28(), ".synkro", "cc_sessions_4");
     PueueError = class extends Error {
       constructor(message, cause) {
         super(message);
@@ -11497,13 +12420,13 @@ var init_pueue = __esm({
 });
 
 // cli/local-cc/settings.ts
-import { existsSync as existsSync28, readFileSync as readFileSync26 } from "fs";
-import { homedir as homedir28 } from "os";
-import { join as join27 } from "path";
+import { existsSync as existsSync28, readFileSync as readFileSync27 } from "fs";
+import { homedir as homedir29 } from "os";
+import { join as join28 } from "path";
 function isLocalCCEnabled() {
   if (!existsSync28(CONFIG_PATH5)) return false;
   try {
-    const content = readFileSync26(CONFIG_PATH5, "utf-8");
+    const content = readFileSync27(CONFIG_PATH5, "utf-8");
     const match = content.match(/^SYNKRO_LOCAL_INFERENCE='([^']*)'/m);
     return match?.[1] === "yes";
   } catch {
@@ -11514,7 +12437,7 @@ var CONFIG_PATH5;
 var init_settings = __esm({
   "cli/local-cc/settings.ts"() {
     "use strict";
-    CONFIG_PATH5 = join27(homedir28(), ".synkro", "config.env");
+    CONFIG_PATH5 = join28(homedir29(), ".synkro", "config.env");
   }
 });
 
@@ -11524,10 +12447,10 @@ __export(localCc_exports, {
   localCcCommand: () => localCcCommand
 });
 import { spawnSync as spawnSync11 } from "child_process";
-import { homedir as homedir29 } from "os";
-import { join as join28 } from "path";
+import { homedir as homedir30 } from "os";
+import { join as join29 } from "path";
 import { readFileSync as fsReadFileSync, existsSync as fsExistsSync } from "fs";
-import { existsSync as existsSync29, readFileSync as readFileSync27, writeFileSync as writeFileSync21 } from "fs";
+import { existsSync as existsSync29, readFileSync as readFileSync28, writeFileSync as writeFileSync22 } from "fs";
 function deploymentMode() {
   const env = (process.env.SYNKRO_DEPLOYMENT_MODE || "").toLowerCase();
   if (env === "docker") return "docker";
@@ -11634,14 +12557,14 @@ TROUBLESHOOTING
 }
 function readGatewayUrl() {
   if (existsSync29(CONFIG_PATH6)) {
-    const m = readFileSync27(CONFIG_PATH6, "utf-8").match(/^SYNKRO_GATEWAY_URL='([^']*)'/m);
+    const m = readFileSync28(CONFIG_PATH6, "utf-8").match(/^SYNKRO_GATEWAY_URL='([^']*)'/m);
     if (m) return m[1];
   }
   return "https://api.synkro.sh";
 }
 function updateLocalInferenceFlag(enabled) {
   if (!existsSync29(CONFIG_PATH6)) return;
-  let content = readFileSync27(CONFIG_PATH6, "utf-8");
+  let content = readFileSync28(CONFIG_PATH6, "utf-8");
   const flag = enabled ? "yes" : "no";
   if (content.includes("SYNKRO_LOCAL_INFERENCE=")) {
     content = content.replace(/^SYNKRO_LOCAL_INFERENCE='[^']*'/m, `SYNKRO_LOCAL_INFERENCE='${flag}'`);
@@ -11650,7 +12573,7 @@ function updateLocalInferenceFlag(enabled) {
 SYNKRO_LOCAL_INFERENCE='${flag}'
 `;
   }
-  writeFileSync21(CONFIG_PATH6, content, "utf-8");
+  writeFileSync22(CONFIG_PATH6, content, "utf-8");
 }
 async function setServerGradingProvider(provider) {
   await ensureValidToken();
@@ -11679,7 +12602,7 @@ async function cmdStatus() {
     } else {
       console.log(`synkro-server container: running (${status.image})`);
       try {
-        const r = await fetch(`${status.healthz}healthz`, { signal: AbortSignal.timeout(3e3) });
+        const r = await fetch(status.healthz, { signal: AbortSignal.timeout(3e3) });
         console.log(`Health probe: ${r.ok ? "ok" : `HTTP ${r.status}`}`);
       } catch (err) {
         console.log(`Health probe: ${err.message}`);
@@ -12084,8 +13007,8 @@ var init_localCc = __esm({
     init_install();
     init_client2();
     init_stub();
-    SYNKRO_CONFIG_PATH = join28(homedir29(), ".synkro", "config.env");
-    CONFIG_PATH6 = join28(homedir29(), ".synkro", "config.env");
+    SYNKRO_CONFIG_PATH = join29(homedir30(), ".synkro", "config.env");
+    CONFIG_PATH6 = join29(homedir30(), ".synkro", "config.env");
   }
 });
 
@@ -12094,14 +13017,14 @@ var import_exports = {};
 __export(import_exports, {
   importCommand: () => importCommand
 });
-import { existsSync as existsSync30, readFileSync as readFileSync28, readdirSync as readdirSync7 } from "fs";
-import { homedir as homedir30 } from "os";
-import { join as join29 } from "path";
+import { existsSync as existsSync30, readFileSync as readFileSync29, readdirSync as readdirSync7 } from "fs";
+import { homedir as homedir31 } from "os";
+import { join as join30 } from "path";
 import { execSync as execSync6 } from "child_process";
 import { createInterface as createInterface4 } from "readline";
 function readMcpJwt() {
   try {
-    return readFileSync28(join29(homedir30(), ".synkro", ".mcp-jwt"), "utf-8").trim();
+    return readFileSync29(join30(homedir31(), ".synkro", ".mcp-jwt"), "utf-8").trim();
   } catch {
     return "";
   }
@@ -12109,7 +13032,7 @@ function readMcpJwt() {
 function readConfigEnv2() {
   const out = {};
   try {
-    for (const line of readFileSync28(CONFIG_PATH7, "utf-8").split("\n")) {
+    for (const line of readFileSync29(CONFIG_PATH7, "utf-8").split("\n")) {
       const t = line.trim();
       if (!t || t.startsWith("#")) continue;
       const eq = t.indexOf("=");
@@ -12121,7 +13044,7 @@ function readConfigEnv2() {
 }
 function projectsFolder() {
   const sanitized = process.cwd().replace(/\//g, "-");
-  const dir = join29(homedir30(), ".claude", "projects", sanitized);
+  const dir = join30(homedir31(), ".claude", "projects", sanitized);
   return existsSync30(dir) ? dir : null;
 }
 function repoName() {
@@ -12161,7 +13084,7 @@ function extractToolResultText(content, e) {
   return t;
 }
 function parseSession(filePath, sessionId) {
-  const lines = readFileSync28(filePath, "utf-8").split("\n").filter(Boolean);
+  const lines = readFileSync29(filePath, "utf-8").split("\n").filter(Boolean);
   const messages = [];
   const actions = [];
   let step = 0;
@@ -12241,7 +13164,7 @@ async function importCommand() {
       return;
     }
   }
-  const sessions = files.map((f) => parseSession(join29(dir, f), f.replace(".jsonl", ""))).filter((s) => s.messages.length > 0);
+  const sessions = files.map((f) => parseSession(join30(dir, f), f.replace(".jsonl", ""))).filter((s) => s.messages.length > 0);
   const totalMsgs = sessions.reduce((n, s) => n + s.messages.length, 0);
   let ok = 0, fail = 0;
   if (isCloud) {
@@ -12316,7 +13239,7 @@ var init_import = __esm({
   "cli/commands/import.ts"() {
     "use strict";
     init_stub();
-    CONFIG_PATH7 = join29(homedir30(), ".synkro", "config.env");
+    CONFIG_PATH7 = join30(homedir31(), ".synkro", "config.env");
   }
 });
 
@@ -12358,10 +13281,10 @@ var init_packVerify = __esm({
 });
 
 // cli/installer/lockfile.ts
-import { existsSync as existsSync31, readFileSync as readFileSync29, writeFileSync as writeFileSync22 } from "fs";
-import { join as join30 } from "path";
+import { existsSync as existsSync31, readFileSync as readFileSync30, writeFileSync as writeFileSync23 } from "fs";
+import { join as join31 } from "path";
 function lockPath(repoRoot2) {
-  return join30(repoRoot2, LOCK_FILE);
+  return join31(repoRoot2, LOCK_FILE);
 }
 function writeLockfile(repoRoot2, entries) {
   const sorted = [...entries].sort((a, b) => a.ref.localeCompare(b.ref));
@@ -12379,7 +13302,7 @@ function writeLockfile(repoRoot2, entries) {
       ""
     ])
   ].join("\n");
-  writeFileSync22(lockPath(repoRoot2), body, "utf-8");
+  writeFileSync23(lockPath(repoRoot2), body, "utf-8");
 }
 var LOCK_FILE;
 var init_lockfile = __esm({
@@ -12394,9 +13317,9 @@ var sync_exports = {};
 __export(sync_exports, {
   syncCommand: () => syncCommand
 });
-import { existsSync as existsSync32, mkdirSync as mkdirSync18, readdirSync as readdirSync8, rmSync as rmSync4, writeFileSync as writeFileSync23 } from "fs";
-import { homedir as homedir31 } from "os";
-import { join as join31 } from "path";
+import { existsSync as existsSync32, mkdirSync as mkdirSync18, readdirSync as readdirSync8, rmSync as rmSync4, writeFileSync as writeFileSync24 } from "fs";
+import { homedir as homedir32 } from "os";
+import { join as join32 } from "path";
 function cacheKey(ref, version) {
   return ref.replace(/\//g, "__").replace(/[^\w.@-]/g, "_") + "@" + version + ".json";
 }
@@ -12427,7 +13350,7 @@ async function syncCommand(_args = []) {
   }
   const gateway = (process.env.SYNKRO_GATEWAY_URL || "https://api.synkro.sh").replace(/\/$/, "");
   const cloud = process.env.SYNKRO_DEPLOY_LOCATION === "cloud";
-  const cacheDir = join31(homedir31(), ".synkro", "cache", "packs");
+  const cacheDir = join32(homedir32(), ".synkro", "cache", "packs");
   if (!cloud) mkdirSync18(cacheDir, { recursive: true });
   console.log(`Syncing ${refs.length} standard(s) from the registry\u2026`);
   const lock = [];
@@ -12456,7 +13379,7 @@ async function syncCommand(_args = []) {
     if (!cloud) {
       const fname = cacheKey(ref, data.version);
       keptCacheFiles.add(fname);
-      writeFileSync23(join31(cacheDir, fname), JSON.stringify({
+      writeFileSync24(join32(cacheDir, fname), JSON.stringify({
         ref,
         version: data.version,
         digest: data.digest,
@@ -12472,7 +13395,7 @@ async function syncCommand(_args = []) {
     for (const f of readdirSync8(cacheDir)) {
       if (f.endsWith(".json") && !keptCacheFiles.has(f)) {
         try {
-          rmSync4(join31(cacheDir, f));
+          rmSync4(join32(cacheDir, f));
         } catch {
         }
       }
@@ -12501,13 +13424,13 @@ var whoami_exports = {};
 __export(whoami_exports, {
   whoamiCommand: () => whoamiCommand
 });
-import { readFileSync as readFileSync30, existsSync as existsSync33 } from "fs";
-import { join as join32 } from "path";
-import { homedir as homedir32 } from "os";
+import { readFileSync as readFileSync31, existsSync as existsSync33 } from "fs";
+import { join as join33 } from "path";
+import { homedir as homedir33 } from "os";
 function readConfigEnv3() {
   if (!existsSync33(CONFIG_PATH8)) return {};
   const out = {};
-  for (const line of readFileSync30(CONFIG_PATH8, "utf-8").split("\n")) {
+  for (const line of readFileSync31(CONFIG_PATH8, "utf-8").split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#")) continue;
     const eq = t.indexOf("=");
@@ -12518,7 +13441,7 @@ function readConfigEnv3() {
 function jwtStatus() {
   try {
     if (!existsSync33(JWT_PATH2)) return { status: "none" };
-    const jwt2 = readFileSync30(JWT_PATH2, "utf-8").trim();
+    const jwt2 = readFileSync31(JWT_PATH2, "utf-8").trim();
     if (!jwt2) return { status: "none" };
     const payload = jwt2.split(".")[1];
     if (!payload) return { status: "valid" };
@@ -12580,9 +13503,9 @@ var SYNKRO_DIR15, CONFIG_PATH8, JWT_PATH2, GRADING_LABEL;
 var init_whoami = __esm({
   "cli/commands/whoami.ts"() {
     "use strict";
-    SYNKRO_DIR15 = join32(homedir32(), ".synkro");
-    CONFIG_PATH8 = join32(SYNKRO_DIR15, "config.env");
-    JWT_PATH2 = join32(SYNKRO_DIR15, ".mcp-jwt");
+    SYNKRO_DIR15 = join33(homedir33(), ".synkro");
+    CONFIG_PATH8 = join33(SYNKRO_DIR15, "config.env");
+    JWT_PATH2 = join33(SYNKRO_DIR15, ".mcp-jwt");
     GRADING_LABEL = {
       local: "on-device worker pool",
       cloud: "Synkro Cloud worker pool",
@@ -12627,12 +13550,12 @@ __export(linear_exports, {
   formatLinks: () => formatLinks,
   linearCommand: () => linearCommand
 });
-import { readFileSync as readFileSync31 } from "fs";
-import { homedir as homedir33 } from "os";
-import { join as join33 } from "path";
+import { readFileSync as readFileSync32 } from "fs";
+import { homedir as homedir34 } from "os";
+import { join as join34 } from "path";
 function mcpJwt() {
   try {
-    return readFileSync31(join33(SYNKRO_DIR16, ".mcp-jwt"), "utf-8").trim();
+    return readFileSync32(join34(SYNKRO_DIR16, ".mcp-jwt"), "utf-8").trim();
   } catch {
     return "";
   }
@@ -12671,7 +13594,7 @@ var SYNKRO_DIR16, PORT2, BASE;
 var init_linear = __esm({
   "cli/commands/linear.ts"() {
     "use strict";
-    SYNKRO_DIR16 = join33(homedir33(), ".synkro");
+    SYNKRO_DIR16 = join34(homedir34(), ".synkro");
     PORT2 = process.env.SYNKRO_MCP_PORT || "18931";
     BASE = `http://127.0.0.1:${PORT2}`;
   }
@@ -12679,7 +13602,7 @@ var init_linear = __esm({
 
 // cli/scanning/cveReachability.ts
 import { parse } from "@babel/parser";
-import { readFileSync as readFileSync32 } from "fs";
+import { readFileSync as readFileSync33 } from "fs";
 function walk(node, visit) {
   if (!node || typeof node.type !== "string") return;
   visit(node);
@@ -12821,9 +13744,9 @@ var init_cveReachability = __esm({
 
 // cli/reachability/reachabilityScan.ts
 import { spawnSync as spawnSync12, execFileSync as execFileSync5 } from "child_process";
-import { readFileSync as readFileSync33, writeFileSync as writeFileSync24, existsSync as existsSync34, readdirSync as readdirSync9 } from "fs";
-import { join as join34 } from "path";
-import { homedir as homedir34 } from "os";
+import { readFileSync as readFileSync34, writeFileSync as writeFileSync25, existsSync as existsSync34, readdirSync as readdirSync9 } from "fs";
+import { join as join35 } from "path";
+import { homedir as homedir35 } from "os";
 import { createRequire } from "module";
 function walkSourceFiles(repoRoot2, maxFiles = 4e3, maxBytes = 5e5) {
   const SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", "coverage", ".next", ".turbo", "out", ".cache", ".synkro", ".claude", "vendor", "__tests__", "test-results"]);
@@ -12840,7 +13763,7 @@ function walkSourceFiles(repoRoot2, maxFiles = 4e3, maxBytes = 5e5) {
     }
     for (const e of ents) {
       if (files.length >= maxFiles) break;
-      const full = join34(dir, e.name);
+      const full = join35(dir, e.name);
       if (e.isDirectory()) {
         if (!SKIP.has(e.name) && !e.name.startsWith(".")) stack.push(full);
         continue;
@@ -12848,7 +13771,7 @@ function walkSourceFiles(repoRoot2, maxFiles = 4e3, maxBytes = 5e5) {
       if (!EXT.test(e.name) || e.name.endsWith(".d.ts")) continue;
       const rel = full.startsWith(repoRoot2 + "/") ? full.slice(repoRoot2.length + 1) : full;
       try {
-        const content = readFileSync33(full, "utf8");
+        const content = readFileSync34(full, "utf8");
         if (content.length <= maxBytes) files.push({ path: rel, content });
       } catch {
       }
@@ -12867,12 +13790,12 @@ function cleanVersion(spec) {
 function gatherManifestVersions(repoRoot2) {
   const out = {};
   const dirs = [repoRoot2];
-  const pkgsDir = join34(repoRoot2, "packages");
+  const pkgsDir = join35(repoRoot2, "packages");
   if (existsSync34(pkgsDir)) {
     try {
       for (const d of readdirSync9(pkgsDir)) {
-        const pd = join34(pkgsDir, d);
-        if (existsSync34(join34(pd, "package.json"))) dirs.push(pd);
+        const pd = join35(pkgsDir, d);
+        if (existsSync34(join35(pd, "package.json"))) dirs.push(pd);
       }
     } catch {
     }
@@ -12881,7 +13804,7 @@ function gatherManifestVersions(repoRoot2) {
   for (const dir of dirs) {
     let pkg;
     try {
-      pkg = JSON.parse(readFileSync33(join34(dir, "package.json"), "utf8"));
+      pkg = JSON.parse(readFileSync34(join35(dir, "package.json"), "utf8"));
     } catch {
       continue;
     }
@@ -12901,28 +13824,28 @@ function findJelly(repoRoot2) {
   try {
     const pkgJson = require2.resolve("@cs-au-dk/jelly/package.json");
     const dir = pkgJson.slice(0, pkgJson.length - "package.json".length);
-    const pkg = JSON.parse(readFileSync33(pkgJson, "utf8"));
+    const pkg = JSON.parse(readFileSync34(pkgJson, "utf8"));
     const bin = typeof pkg.bin === "string" ? pkg.bin : pkg.bin && (pkg.bin.jelly || pkg.bin[Object.keys(pkg.bin)[0]]);
     if (bin) {
-      const p = join34(dir, bin);
+      const p = join35(dir, bin);
       if (existsSync34(p)) return p;
     }
   } catch {
   }
   for (const base of [repoRoot2, process.cwd()]) {
-    const b = join34(base, "node_modules", ".bin", "jelly");
+    const b = join35(base, "node_modules", ".bin", "jelly");
     if (existsSync34(b)) return b;
   }
   return null;
 }
 function findEntries(repoRoot2) {
   const dirs = [repoRoot2];
-  const pkgsDir = join34(repoRoot2, "packages");
+  const pkgsDir = join35(repoRoot2, "packages");
   if (existsSync34(pkgsDir)) {
     try {
       for (const d of readdirSync9(pkgsDir)) {
-        const pd = join34(pkgsDir, d);
-        if (existsSync34(join34(pd, "package.json"))) dirs.push(pd);
+        const pd = join35(pkgsDir, d);
+        if (existsSync34(join35(pd, "package.json"))) dirs.push(pd);
       }
     } catch {
     }
@@ -12930,11 +13853,11 @@ function findEntries(repoRoot2) {
   const entries = [];
   for (const dir of dirs) {
     try {
-      const pkg = JSON.parse(readFileSync33(join34(dir, "package.json"), "utf8"));
+      const pkg = JSON.parse(readFileSync34(join35(dir, "package.json"), "utf8"));
       const cands = [pkg.source, pkg.module, pkg.main, "src/index.ts", "src/index.js", "src/main.ts", "src/server.ts", "index.ts", "index.js"];
       for (const c of cands) {
         if (typeof c !== "string") continue;
-        const f = join34(dir, c);
+        const f = join35(dir, c);
         if (existsSync34(f)) {
           entries.push(f);
           break;
@@ -12970,7 +13893,7 @@ function runReachabilityScan(repoRoot2, opts = {}) {
   const commit = currentCommit(repoRoot2);
   if (!opts.force && commit && existsSync34(REACHABILITY_PATH)) {
     try {
-      const prev = JSON.parse(readFileSync33(REACHABILITY_PATH, "utf8"));
+      const prev = JSON.parse(readFileSync34(REACHABILITY_PATH, "utf8"));
       if (prev.commit === commit) return { ok: true, cached: true, packages: Object.keys(prev.packages || {}).length };
     } catch {
     }
@@ -13059,7 +13982,7 @@ function runReachabilityScan(repoRoot2, opts = {}) {
   if (Object.keys(packages).length === 0) return { ok: false, reason: "no package usage found (no jelly output, no AST imports)" };
   const file = { generatedAt: (/* @__PURE__ */ new Date()).toISOString(), commit, tool, packages, versions: gatherManifestVersions(repoRoot2) };
   try {
-    writeFileSync24(REACHABILITY_PATH, JSON.stringify(file, null, 2));
+    writeFileSync25(REACHABILITY_PATH, JSON.stringify(file, null, 2));
   } catch (e) {
     return { ok: false, reason: "write failed: " + String(e.message || e) };
   }
@@ -13071,7 +13994,7 @@ var init_reachabilityScan = __esm({
     "use strict";
     init_cveReachability();
     require2 = createRequire(import.meta.url);
-    REACHABILITY_PATH = join34(homedir34(), ".synkro", "reachability.json");
+    REACHABILITY_PATH = join35(homedir35(), ".synkro", "reachability.json");
   }
 });
 
@@ -13080,15 +14003,15 @@ var reachabilityScan_exports = {};
 __export(reachabilityScan_exports, {
   reachabilityScanCommand: () => reachabilityScanCommand
 });
-import { readFileSync as readFileSync34, existsSync as existsSync35 } from "fs";
-import { join as join35 } from "path";
-import { homedir as homedir35 } from "os";
+import { readFileSync as readFileSync35, existsSync as existsSync35 } from "fs";
+import { join as join36 } from "path";
+import { homedir as homedir36 } from "os";
 import { execFileSync as execFileSync6 } from "child_process";
 function readConfigEnv4() {
-  const p = join35(SYNKRO_DIR17, "config.env");
+  const p = join36(SYNKRO_DIR17, "config.env");
   if (!existsSync35(p)) return {};
   const out = {};
-  for (const line of readFileSync34(p, "utf-8").split("\n")) {
+  for (const line of readFileSync35(p, "utf-8").split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#")) continue;
     const eq = t.indexOf("=");
@@ -13120,11 +14043,11 @@ async function pushToCloud(cfg, repo) {
   while (gwBase.endsWith("/")) gwBase = gwBase.slice(0, -1);
   let jwt2 = "";
   try {
-    jwt2 = readFileSync34(join35(SYNKRO_DIR17, ".mcp-jwt"), "utf-8").trim();
+    jwt2 = readFileSync35(join36(SYNKRO_DIR17, ".mcp-jwt"), "utf-8").trim();
   } catch {
   }
   if (!jwt2 || !existsSync35(REACHABILITY_PATH)) return;
-  const body = readFileSync34(REACHABILITY_PATH, "utf-8");
+  const body = readFileSync35(REACHABILITY_PATH, "utf-8");
   try {
     const resp = await fetch(gwBase + "/api/v1/reachability?repo=" + encodeURIComponent(repo), {
       method: "POST",
@@ -13156,7 +14079,7 @@ var init_reachabilityScan2 = __esm({
   "cli/commands/reachabilityScan.ts"() {
     "use strict";
     init_reachabilityScan();
-    SYNKRO_DIR17 = join35(homedir35(), ".synkro");
+    SYNKRO_DIR17 = join36(homedir36(), ".synkro");
   }
 });
 
@@ -13188,9 +14111,9 @@ async function startCommand(rest = []) {
     console.log(`Synkro: starting server (${cfg.claudeWorkers} claude + ${cfg.cursorWorkers} cursor + ${cfg.codexWorkers} codex)
 `);
     await dockerUpdate({ claudeWorkers: cfg.claudeWorkers, cursorWorkers: cfg.cursorWorkers, codexWorkers: cfg.codexWorkers, conductorProvider: cfg.conductorProvider, connectedRepo: resolveConnectedRepo() });
-    const ready = await waitForContainerReady(6e4);
+    const ready = await waitForContainerReady(LOCAL_CONTAINER_READY_TIMEOUT_MS);
     if (!ready) {
-      console.error("\n\u26A0 container did not pass /healthz within 60s");
+      console.error("\n\u26A0 container did not pass /healthz within 10m");
       process.exit(1);
     }
     console.log("\nServer is running.");
@@ -13220,9 +14143,9 @@ async function updateCommand() {
   console.log(`  preserving pool: ${claudeWorkers} claude + ${cursorWorkers} cursor + ${codexWorkers} codex worker(s)
 `);
   await dockerUpdate({ claudeWorkers, cursorWorkers, codexWorkers, conductorProvider, connectedRepo: resolveConnectedRepo() });
-  const ready = await waitForContainerReady(9e4);
+  const ready = await waitForContainerReady(LOCAL_CONTAINER_READY_TIMEOUT_MS);
   if (!ready) {
-    console.error("\n\u26A0 container did not pass its health check within 90s \u2014 check: docker logs synkro-server");
+    console.error("\n\u26A0 container did not pass its health check within 10m \u2014 check: docker logs synkro-server");
     process.exit(1);
   }
   try {
@@ -13257,9 +14180,9 @@ async function restartCommand(rest = []) {
   console.log(`Synkro: restarting server (${claudeWorkers} claude + ${cursorWorkers} cursor + ${codexWorkers} codex)
 `);
   await dockerUpdate({ claudeWorkers, cursorWorkers, codexWorkers, conductorProvider, connectedRepo: resolveConnectedRepo() });
-  const ready = await waitForContainerReady(6e4);
+  const ready = await waitForContainerReady(LOCAL_CONTAINER_READY_TIMEOUT_MS);
   if (!ready) {
-    console.error("\n\u26A0 container did not pass /healthz within 60s");
+    console.error("\n\u26A0 container did not pass /healthz within 10m");
     process.exit(1);
   }
   console.log("\nServer restarted successfully.");
@@ -13271,11 +14194,13 @@ async function restartCommand(rest = []) {
     console.warn("\u26A0 workers did not register within 30s \u2014 skill sync skipped");
   }
 }
+var LOCAL_CONTAINER_READY_TIMEOUT_MS;
 var init_lifecycle = __esm({
   "cli/commands/lifecycle.ts"() {
     "use strict";
     init_dockerInstall();
     init_install();
+    LOCAL_CONTAINER_READY_TIMEOUT_MS = 6e5;
   }
 });
 
@@ -13284,13 +14209,13 @@ var config_exports = {};
 __export(config_exports, {
   configCommand: () => configCommand
 });
-import { readFileSync as readFileSync35, writeFileSync as writeFileSync25, existsSync as existsSync36 } from "fs";
-import { join as join36 } from "path";
-import { homedir as homedir36 } from "os";
+import { readFileSync as readFileSync36, writeFileSync as writeFileSync26, existsSync as existsSync36 } from "fs";
+import { join as join37 } from "path";
+import { homedir as homedir37 } from "os";
 function readConfigEnv5() {
   if (!existsSync36(CONFIG_PATH9)) return {};
   const out = {};
-  for (const line of readFileSync35(CONFIG_PATH9, "utf-8").split("\n")) {
+  for (const line of readFileSync36(CONFIG_PATH9, "utf-8").split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#")) continue;
     const eq = t.indexOf("=");
@@ -13303,7 +14228,7 @@ function updateConfigValue(key, value) {
     console.error("No config found. Run `synkro install` first.");
     process.exit(1);
   }
-  const lines = readFileSync35(CONFIG_PATH9, "utf-8").split("\n");
+  const lines = readFileSync36(CONFIG_PATH9, "utf-8").split("\n");
   const pattern = new RegExp(`^${key}=`);
   let found = false;
   const updated = lines.map((line) => {
@@ -13314,7 +14239,7 @@ function updateConfigValue(key, value) {
     return line;
   });
   if (!found) updated.splice(updated.length - 1, 0, `${key}='${value}'`);
-  writeFileSync25(CONFIG_PATH9, updated.join("\n"), "utf-8");
+  writeFileSync26(CONFIG_PATH9, updated.join("\n"), "utf-8");
 }
 function resolveInferenceMode(cfg) {
   if ((cfg.SYNKRO_GRADING_MODE || "local") === "byok") return "byok";
@@ -13472,8 +14397,8 @@ var init_config = __esm({
     "use strict";
     init_stub();
     init_optout();
-    SYNKRO_DIR18 = join36(homedir36(), ".synkro");
-    CONFIG_PATH9 = join36(SYNKRO_DIR18, "config.env");
+    SYNKRO_DIR18 = join37(homedir37(), ".synkro");
+    CONFIG_PATH9 = join37(SYNKRO_DIR18, "config.env");
   }
 });
 
@@ -13662,14 +14587,14 @@ Usage:
 });
 
 // cli/bootstrap.js
-import { readFileSync as readFileSync36, existsSync as existsSync37 } from "fs";
+import { readFileSync as readFileSync37, existsSync as existsSync37 } from "fs";
 import { resolve as resolve5 } from "path";
 var envCandidates = [
   resolve5(process.env.HOME ?? "", ".synkro", "config.env")
 ];
 for (const envPath of envCandidates) {
   if (!existsSync37(envPath)) continue;
-  const envContent = readFileSync36(envPath, "utf-8");
+  const envContent = readFileSync37(envPath, "utf-8");
   for (const line of envContent.split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -13686,7 +14611,7 @@ var subArgs = args.slice(1);
 var isDetachedChild = process.env.SYNKRO_TELEMETRY_DETACHED === "1";
 var FLUSH_SKIP = /* @__PURE__ */ new Set(["grade", "version", "--version", "-v", "help", "--help", "-h", ""]);
 function printVersion() {
-  console.log("1.7.88");
+  console.log("1.7.90");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents