@synkro-sh/cli 1.7.9 → 1.7.24

package/dist/bootstrap.js

@@ -269,6 +269,14 @@ function installCCHooks(settingsPath, config) {
     ],
     [SYNKRO_MARKER]: true
   });
+  settings.env = settings.env ?? {};
+  const existingBaseUrl = settings.env.ANTHROPIC_BASE_URL;
+  if (!existingBaseUrl || existingBaseUrl === USAGE_PROXY_URL) {
+    settings.env.ANTHROPIC_BASE_URL = USAGE_PROXY_URL;
+  } else {
+    console.warn(`  \u26A0 ANTHROPIC_BASE_URL already set to ${existingBaseUrl} \u2014 leaving it; live usage capture is off for this agent.`);
+  }
+  if (Object.keys(settings.env).length === 0) delete settings.env;
   writeSettingsAtomic(settingsPath, settings);
 }
 function uninstallCCHooks(settingsPath) {
@@ -287,14 +295,19 @@ function uninstallCCHooks(settingsPath) {
   if (Object.keys(settings.hooks).length === 0) {
     delete settings.hooks;
   }
+  if (settings.env && settings.env.ANTHROPIC_BASE_URL === USAGE_PROXY_URL) {
+    delete settings.env.ANTHROPIC_BASE_URL;
+    if (Object.keys(settings.env).length === 0) delete settings.env;
+  }
   writeSettingsAtomic(settingsPath, settings);
   return true;
 }
-var SYNKRO_MARKER;
+var SYNKRO_MARKER, USAGE_PROXY_URL;
 var init_ccHookConfig = __esm({
   "cli/installer/ccHookConfig.ts"() {
     "use strict";
     SYNKRO_MARKER = "__synkro_managed__";
+    USAGE_PROXY_URL = `http://127.0.0.1:${process.env.SYNKRO_HOST_USAGE_PROXY_PORT || "18927"}`;
   }
 });
 
@@ -10610,6 +10623,8 @@ async function dockerInstall(opts = {}) {
     "-p",
     `127.0.0.1:${HOST_CWE_PORT}:8930`,
     "-p",
+    `127.0.0.1:${HOST_USAGE_PROXY_PORT}:8927`,
+    "-p",
     `127.0.0.1:${HOST_PGLITE_PORT}:5433`,
     "-v",
     `${PGDATA_PATH}:/data/pgdata`,
@@ -10860,7 +10875,7 @@ function checkPgdata() {
   if (!hasPgControl) return { healthy: false, details: "pg_control/global directory missing" };
   return { healthy: true, details: `${entries.length} entries, WAL present, no stale PID` };
 }
-var SYNKRO_DIR2, MCP_JWT_PATH, PGDATA_PATH, CLAUDE_HOST_STATE_DIR, CLAUDE_HOST_STATE_FILE, HOST_MCP_PORT, HOST_GRADER_PORT, HOST_CWE_PORT, HOST_PGLITE_PORT, CONTAINER_NAME, DEFAULT_IMAGE, DockerInstallError, BACKUP_DIR;
+var SYNKRO_DIR2, MCP_JWT_PATH, PGDATA_PATH, CLAUDE_HOST_STATE_DIR, CLAUDE_HOST_STATE_FILE, HOST_MCP_PORT, HOST_GRADER_PORT, HOST_CWE_PORT, HOST_USAGE_PROXY_PORT, HOST_PGLITE_PORT, CONTAINER_NAME, DEFAULT_IMAGE, DockerInstallError, BACKUP_DIR;
 var init_dockerInstall = __esm({
   "cli/local-cc/dockerInstall.ts"() {
     "use strict";
@@ -10874,6 +10889,7 @@ var init_dockerInstall = __esm({
     HOST_MCP_PORT = parseInt(process.env.SYNKRO_HOST_MCP_PORT || "18931", 10);
     HOST_GRADER_PORT = parseInt(process.env.SYNKRO_HOST_GRADER_PORT || "18929", 10);
     HOST_CWE_PORT = parseInt(process.env.SYNKRO_HOST_CWE_PORT || "18930", 10);
+    HOST_USAGE_PROXY_PORT = parseInt(process.env.SYNKRO_HOST_USAGE_PROXY_PORT || "18927", 10);
     HOST_PGLITE_PORT = parseInt(process.env.SYNKRO_HOST_PGLITE_PORT || "15433", 10);
     CONTAINER_NAME = "synkro-server";
     DEFAULT_IMAGE = "ghcr.io/synkro-sh/synkro-server:latest";
@@ -10979,6 +10995,87 @@ var init_setupToken = __esm({
   }
 });
 
+// cli/local-cc/codexCloudSetup.ts
+var codexCloudSetup_exports = {};
+__export(codexCloudSetup_exports, {
+  setupCodexCloud: () => setupCodexCloud
+});
+import { spawn as nodeSpawn2, spawnSync as spawnSync4 } from "child_process";
+import { readFileSync as readFileSync9, mkdirSync as mkdirSync9, rmSync, existsSync as existsSync10 } from "fs";
+import { homedir as homedir9 } from "os";
+import { join as join9 } from "path";
+function findCodexBinary() {
+  if (process.env.SYNKRO_CODEX_BIN) return process.env.SYNKRO_CODEX_BIN;
+  const r = spawnSync4("which", ["codex"], { encoding: "utf-8" });
+  const p = (r.stdout || "").trim().split("\n")[0];
+  return p || null;
+}
+function runCodexLogin(codexBin) {
+  mkdirSync9(CODEX_CLOUD_HOME, { recursive: true, mode: 448 });
+  return new Promise((resolve4, reject) => {
+    const proc = nodeSpawn2(codexBin, ["login"], {
+      stdio: "inherit",
+      env: { ...process.env, CODEX_HOME: CODEX_CLOUD_HOME }
+    });
+    proc.on("error", (err) => reject(new Error(`failed to spawn codex login: ${err.message}`)));
+    proc.on("close", (code) => code === 0 ? resolve4() : reject(new Error(`codex login exited with code ${code}`)));
+  });
+}
+async function setupCodexCloud(gatewayUrl, bearerToken, onStatus) {
+  const codexBin = findCodexBinary();
+  if (!codexBin) {
+    return { ok: false, error: "Codex CLI not found on PATH. Install Codex (https://developers.openai.com/codex), then re-run `synkro install`. (Set SYNKRO_CODEX_BIN to override the binary path.)" };
+  }
+  onStatus?.("Opening your browser to authorize your Codex subscription for Synkro Cloud\u2026");
+  try {
+    await runCodexLogin(codexBin);
+  } catch (e) {
+    return { ok: false, error: `Codex login failed: ${e.message}` };
+  }
+  const authPath = join9(CODEX_CLOUD_HOME, "auth.json");
+  if (!existsSync10(authPath)) {
+    return { ok: false, error: "codex login completed but no auth.json was written \u2014 did the browser approval finish?" };
+  }
+  let auth;
+  try {
+    auth = JSON.parse(readFileSync9(authPath, "utf-8"));
+  } catch (e) {
+    return { ok: false, error: `could not read codex auth.json: ${e.message}` };
+  }
+  if (!auth || typeof auth !== "object" || !auth.tokens?.refresh_token) {
+    return { ok: false, error: "codex auth.json has no refresh token \u2014 cloud refresh would fail. Re-run login." };
+  }
+  onStatus?.("Connecting your Codex session to Synkro Cloud\u2026");
+  let resp;
+  try {
+    resp = await fetch(`${gatewayUrl.replace(/\/+$/, "")}/codex/seed`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${bearerToken}` },
+      body: JSON.stringify({ auth })
+    });
+  } catch (e) {
+    return { ok: false, error: `failed to reach Synkro API: ${e.message}` };
+  }
+  if (!resp.ok) {
+    const detail = await resp.text().catch(() => "");
+    return { ok: false, error: `seed rejected (${resp.status}): ${detail.slice(0, 200)}` };
+  }
+  try {
+    rmSync(CODEX_CLOUD_HOME, { recursive: true, force: true });
+  } catch {
+  }
+  onStatus?.("\u2713 Codex subscription connected to Synkro Cloud.");
+  return { ok: true };
+}
+var SYNKRO_DIR4, CODEX_CLOUD_HOME;
+var init_codexCloudSetup = __esm({
+  "cli/local-cc/codexCloudSetup.ts"() {
+    "use strict";
+    SYNKRO_DIR4 = join9(homedir9(), ".synkro");
+    CODEX_CLOUD_HOME = join9(SYNKRO_DIR4, "codex-cloud-session");
+  }
+});
+
 // cli/commands/setupGithub.ts
 var setupGithub_exports = {};
 __export(setupGithub_exports, {
@@ -10988,14 +11085,14 @@ __export(setupGithub_exports, {
 import { createInterface as createInterface2 } from "readline/promises";
 import { stdin as input, stdout as output } from "process";
 import { execSync as execSync5 } from "child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
-import { homedir as homedir9, platform as platform4 } from "os";
-import { join as join9 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
+import { homedir as homedir10, platform as platform4 } from "os";
+import { join as join10 } from "path";
 import { execFile as execFile2 } from "child_process";
 function readConfig() {
-  if (!existsSync10(CONFIG_PATH)) return {};
+  if (!existsSync11(CONFIG_PATH)) return {};
   const out = {};
-  for (const line of readFileSync9(CONFIG_PATH, "utf-8").split("\n")) {
+  for (const line of readFileSync10(CONFIG_PATH, "utf-8").split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#")) continue;
     const eq = t.indexOf("=");
@@ -11295,15 +11392,15 @@ Will push secrets to ${selected.length} repo(s):`);
   console.log(`Secrets pushed: ${SECRET_NAMES.CLAUDE_OAUTH}, ${SECRET_NAMES.SYNKRO_API_KEY}`);
   console.log("Open a PR on any selected repo to trigger your first Synkro scan.");
 }
-var SYNKRO_DIR4, CONFIG_PATH;
+var SYNKRO_DIR5, CONFIG_PATH;
 var init_setupGithub = __esm({
   "cli/commands/setupGithub.ts"() {
     "use strict";
     init_githubSetup();
     init_stub();
     init_setupToken();
-    SYNKRO_DIR4 = join9(homedir9(), ".synkro");
-    CONFIG_PATH = join9(SYNKRO_DIR4, "config.env");
+    SYNKRO_DIR5 = join10(homedir10(), ".synkro");
+    CONFIG_PATH = join10(SYNKRO_DIR5, "config.env");
   }
 });
 
@@ -11311,6 +11408,7 @@ var init_setupGithub = __esm({
 var install_exports = {};
 __export(install_exports, {
   detectGitRepo: () => detectGitRepo2,
+  discoverAndIngestSkills: () => discoverAndIngestSkills,
   getOrMintCloudToken: () => getOrMintCloudToken,
   installCommand: () => installCommand,
   parseArgs: () => parseArgs,
@@ -11321,16 +11419,17 @@ __export(install_exports, {
   syncSkillFiles: () => syncSkillFiles,
   writeHookScripts: () => writeHookScripts
 });
-import { existsSync as existsSync11, mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, chmodSync as chmodSync2, readFileSync as readFileSync10, readdirSync as readdirSync3, unlinkSync as unlinkSync4, statSync } from "fs";
-import { homedir as homedir10 } from "os";
-import { join as join10 } from "path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync10, writeFileSync as writeFileSync8, chmodSync as chmodSync2, readFileSync as readFileSync11, readdirSync as readdirSync3, unlinkSync as unlinkSync4, statSync } from "fs";
+import { homedir as homedir11 } from "os";
+import { join as join11 } from "path";
 import { execSync as execSync6 } from "child_process";
 import { createInterface as createInterface3 } from "readline";
+import { createHash } from "crypto";
 function resolvePersistedHookMode() {
   if (process.env.SYNKRO_HOOK_MODE === "full") return "full";
   if (process.env.SYNKRO_HOOK_MODE === "stub") return "stub";
   try {
-    const env = readFileSync10(CONFIG_PATH2, "utf-8");
+    const env = readFileSync11(CONFIG_PATH2, "utf-8");
     if (/^SYNKRO_HOOK_MODE=['"]?full['"]?\s*$/m.test(env)) return "full";
   } catch {
   }
@@ -11466,37 +11565,51 @@ coding patterns and the dashboard shows full history. (Y/n) `
     rl.close();
   }
 }
+async function promptCodexCloudSetup() {
+  if (!process.stdin.isTTY) return false;
+  const rl = createInterface3({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve4) => {
+    rl.question(
+      "Connect a Codex (ChatGPT subscription) session for cloud grading? This opens a\nbrowser to authorize; your subscription is stored securely and refreshed for you. (y/N) ",
+      (answer) => {
+        rl.close();
+        const a = answer.trim().toLowerCase();
+        resolve4(a === "y" || a === "yes");
+      }
+    );
+  });
+}
 function ensureSynkroDir() {
-  mkdirSync9(SYNKRO_DIR5, { recursive: true });
-  mkdirSync9(HOOKS_DIR, { recursive: true });
-  mkdirSync9(BIN_DIR, { recursive: true });
-  mkdirSync9(OFFSETS_DIR, { recursive: true });
-  mkdirSync9(join10(SYNKRO_DIR5, "sessions"), { recursive: true });
+  mkdirSync10(SYNKRO_DIR6, { recursive: true });
+  mkdirSync10(HOOKS_DIR, { recursive: true });
+  mkdirSync10(BIN_DIR, { recursive: true });
+  mkdirSync10(OFFSETS_DIR, { recursive: true });
+  mkdirSync10(join11(SYNKRO_DIR6, "sessions"), { recursive: true });
 }
 function writeHookScripts(mode = "stub") {
-  const installExtractCorePath = join10(HOOKS_DIR, "installExtractCore.ts");
-  const bashScriptPath = join10(HOOKS_DIR, "cc-bash-judge.ts");
-  const bashFollowupScriptPath = join10(HOOKS_DIR, "cc-bash-followup.ts");
-  const editPrecheckScriptPath = join10(HOOKS_DIR, "cc-edit-precheck.ts");
-  const cwePrecheckScriptPath = join10(HOOKS_DIR, "cc-cwe-precheck.ts");
-  const cvePrecheckScriptPath = join10(HOOKS_DIR, "cc-cve-precheck.ts");
-  const planJudgeScriptPath = join10(HOOKS_DIR, "cc-plan-judge.ts");
-  const agentJudgeScriptPath = join10(HOOKS_DIR, "cc-agent-judge.ts");
-  const stopSummaryScriptPath = join10(HOOKS_DIR, "cc-stop-summary.ts");
-  const sessionStartScriptPath = join10(HOOKS_DIR, "cc-session-start.ts");
-  const transcriptSyncScriptPath = join10(HOOKS_DIR, "cc-transcript-sync.ts");
-  const userPromptSubmitScriptPath = join10(HOOKS_DIR, "cc-user-prompt-submit.ts");
-  const commonScriptPath = join10(HOOKS_DIR, "_synkro-common.ts");
-  const commonBashScriptPath = join10(HOOKS_DIR, "_synkro-common.sh");
-  const installScanScriptPath = join10(HOOKS_DIR, "cc-install-scan.ts");
-  const cursorBashJudgePath = join10(HOOKS_DIR, "cursor-bash-judge.ts");
-  const cursorEditCapturePath = join10(HOOKS_DIR, "cursor-edit-capture.ts");
-  const cursorAgentCapturePath = join10(HOOKS_DIR, "cursor-agent-capture.ts");
-  const mcpStdioProxyPath = join10(HOOKS_DIR, "mcp-stdio-proxy.ts");
-  const taskActivateIntentScriptPath = join10(HOOKS_DIR, "cc-task-activate-intent.ts");
-  const mcpGateScriptPath = join10(HOOKS_DIR, "cc-mcp-gate.ts");
+  const installExtractCorePath = join11(HOOKS_DIR, "installExtractCore.ts");
+  const bashScriptPath = join11(HOOKS_DIR, "cc-bash-judge.ts");
+  const bashFollowupScriptPath = join11(HOOKS_DIR, "cc-bash-followup.ts");
+  const editPrecheckScriptPath = join11(HOOKS_DIR, "cc-edit-precheck.ts");
+  const cwePrecheckScriptPath = join11(HOOKS_DIR, "cc-cwe-precheck.ts");
+  const cvePrecheckScriptPath = join11(HOOKS_DIR, "cc-cve-precheck.ts");
+  const planJudgeScriptPath = join11(HOOKS_DIR, "cc-plan-judge.ts");
+  const agentJudgeScriptPath = join11(HOOKS_DIR, "cc-agent-judge.ts");
+  const stopSummaryScriptPath = join11(HOOKS_DIR, "cc-stop-summary.ts");
+  const sessionStartScriptPath = join11(HOOKS_DIR, "cc-session-start.ts");
+  const transcriptSyncScriptPath = join11(HOOKS_DIR, "cc-transcript-sync.ts");
+  const userPromptSubmitScriptPath = join11(HOOKS_DIR, "cc-user-prompt-submit.ts");
+  const commonScriptPath = join11(HOOKS_DIR, "_synkro-common.ts");
+  const commonBashScriptPath = join11(HOOKS_DIR, "_synkro-common.sh");
+  const installScanScriptPath = join11(HOOKS_DIR, "cc-install-scan.ts");
+  const cursorBashJudgePath = join11(HOOKS_DIR, "cursor-bash-judge.ts");
+  const cursorEditCapturePath = join11(HOOKS_DIR, "cursor-edit-capture.ts");
+  const cursorAgentCapturePath = join11(HOOKS_DIR, "cursor-agent-capture.ts");
+  const mcpStdioProxyPath = join11(HOOKS_DIR, "mcp-stdio-proxy.ts");
+  const taskActivateIntentScriptPath = join11(HOOKS_DIR, "cc-task-activate-intent.ts");
+  const mcpGateScriptPath = join11(HOOKS_DIR, "cc-mcp-gate.ts");
   if (mode === "stub") {
-    const stubCommonPath2 = join10(HOOKS_DIR, "_synkro-stub-common.ts");
+    const stubCommonPath2 = join11(HOOKS_DIR, "_synkro-stub-common.ts");
     const stubFiles = [
       [stubCommonPath2, STUB_COMMON_TS],
       [bashScriptPath, STUB_BASH_JUDGE_TS],
@@ -11525,7 +11638,7 @@ function writeHookScripts(mode = "stub") {
     chmodSync2(mcpStdioProxyPath, 493);
     for (const stale of ["_synkro-common.ts", "_synkro-common.sh", "installExtractCore.ts"]) {
       try {
-        unlinkSync4(join10(HOOKS_DIR, stale));
+        unlinkSync4(join11(HOOKS_DIR, stale));
       } catch {
       }
     }
@@ -11569,7 +11682,7 @@ function writeHookScripts(mode = "stub") {
   writeFileSync8(mcpStdioProxyPath, MCP_STDIO_PROXY_SRC, "utf-8");
   writeFileSync8(installExtractCorePath, "/**\n * Deterministic install-command extraction \u2014 no LLM, no network.\n * Shared by the API pkg-scan route and the hook scripts (copied to ~/.synkro/hooks/).\n */\nimport { parse as shellParse } from 'shell-quote';\n\nexport interface DeterministicPkgRequest {\n  name: string;\n  version: string;\n  ecosystem: string;\n}\n\ninterface RawInstall {\n  ecosystem: string;\n  name: string;\n  versionSpec: string | null;\n  source: 'registry' | 'git' | 'local' | 'url' | 'unknown';\n}\n\nconst SEPARATOR_OPS = new Set(['&&', '||', ';', '|', '&', '\\n']);\n\n/** Split a shell command into command segments (each an argv string array). */\nexport function segmentCommand(command: string): string[][] {\n  let tokens: unknown[];\n  try {\n    tokens = shellParse(command) as unknown[];\n  } catch {\n    return [command.split(/\\s+/).filter(Boolean)];\n  }\n  const segments: string[][] = [];\n  let current: string[] = [];\n  for (const tok of tokens) {\n    if (typeof tok === 'string') {\n      current.push(tok);\n      continue;\n    }\n    if (tok && typeof tok === 'object') {\n      const op = (tok as { op?: string }).op;\n      const pattern = (tok as { pattern?: string }).pattern;\n      if (op && SEPARATOR_OPS.has(op)) {\n        if (current.length) segments.push(current);\n        current = [];\n      } else if (typeof pattern === 'string') {\n        current.push(pattern);\n      }\n    }\n  }\n  if (current.length) segments.push(current);\n  return segments;\n}\n\nconst PM_TABLE: Record<string, { subs: Set<string>; ecosystem: string }> = {\n  npm:      { subs: new Set(['install', 'i', 'add', 'ci']),  ecosystem: 'npm' },\n  pnpm:     { subs: new Set(['add', 'install', 'i', 'dlx']), ecosystem: 'npm' },\n  yarn:     { subs: new Set(['add', 'install']),             ecosystem: 'npm' },\n  bun:      { subs: new Set(['add', 'install', 'i']),        ecosystem: 'npm' },\n  pip:      { subs: new Set(['install']),                    ecosystem: 'PyPI' },\n  pip3:     { subs: new Set(['install']),                    ecosystem: 'PyPI' },\n  cargo:    { subs: new Set(['add', 'install']),             ecosystem: 'crates.io' },\n  go:       { subs: new Set(['get', 'install']),             ecosystem: 'Go' },\n  gem:      { subs: new Set(['install']),                    ecosystem: 'RubyGems' },\n  composer: { subs: new Set(['require']),                    ecosystem: 'Packagist' },\n};\nconst SYSTEM_PMS = new Set(['apt', 'apt-get', 'apk', 'brew', 'dnf', 'yum', 'pacman']);\nconst SYSTEM_SUBS = new Set(['install', 'add']);\n\nconst WRAPPERS = new Set(['sudo', 'doas', 'command', 'env', 'xargs', 'nice', 'time']);\nconst VALUE_FLAGS = new Set([\n  '--filter', '-F', '-C', '--dir', '--prefix', '--registry', '--tag', '--features',\n  '-v', '--version', '--index-url', '--extra-index-url', '--target', '-t',\n]);\n\nfunction basename(p: string): string {\n  const i = p.lastIndexOf('/');\n  return i >= 0 ? p.slice(i + 1) : p;\n}\n\nfunction stripPrefixes(argv: string[]): string[] {\n  let i = 0;\n  while (i < argv.length) {\n    const t = argv[i];\n    if (WRAPPERS.has(basename(t).toLowerCase())) { i++; continue; }\n    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(t)) { i++; continue; }\n    break;\n  }\n  return argv.slice(i);\n}\n\nfunction looksLikePath(tok: string): boolean {\n  return tok === '.' || tok === '..' || /^\\.{0,2}\\//.test(tok) || tok.startsWith('~/') || tok.startsWith('file:');\n}\n\n/** Shell redirect fragments (e.g. `2>&1` \u2192 argv `2`, `1`) \u2014 not package names. */\nfunction isRedirectFragment(tok: string): boolean {\n  if (/^\\d+$/.test(tok)) return true;\n  if (/^[<>]|[<>]$/.test(tok)) return true;\n  if (tok === '&' || tok === '|') return true;\n  if (/^\\d*[<>]/.test(tok)) return true;\n  return false;\n}\n\nfunction parsePackageToken(tok: string, ecosystem: string): RawInstall | null {\n  if (/^(https?:)?\\/\\//.test(tok) || tok.startsWith('git+') || tok.startsWith('git:')) {\n    return { ecosystem, name: tok, versionSpec: null, source: tok.includes('git') ? 'git' : 'url' };\n  }\n  if (looksLikePath(tok)) {\n    return { ecosystem, name: basename(tok.replace(/\\/+$/, '')) || tok, versionSpec: null, source: 'local' };\n  }\n  if (ecosystem === 'PyPI') {\n    const noExtras = tok.replace(/\\[[^\\]]*\\]/g, '');\n    const m = noExtras.match(/^([A-Za-z0-9_.-]+)\\s*([=~!<>].*)?$/);\n    if (!m) return null;\n    return { ecosystem, name: m[1], versionSpec: m[2] ? m[2].trim() : null, source: 'registry' };\n  }\n  if (ecosystem === 'Packagist') {\n    // composer uses vendor/package:version-constraint (e.g. monolog/monolog:1.0.0).\n    // Split on the first ':' after the vendor/ slash; never on the '/'.\n    const ci = tok.indexOf(':');\n    if (ci > 0) return { ecosystem, name: tok.slice(0, ci), versionSpec: tok.slice(ci + 1) || null, source: 'registry' };\n    return { ecosystem, name: tok, versionSpec: null, source: 'registry' };\n  }\n  const at = tok.lastIndexOf('@');\n  if (at > 0) {\n    return { ecosystem, name: tok.slice(0, at), versionSpec: tok.slice(at + 1) || null, source: 'registry' };\n  }\n  return { ecosystem, name: tok, versionSpec: null, source: 'registry' };\n}\n\n/** Deterministic extraction for a single command segment. */\nexport function extractSegment(rawArgv: string[]): RawInstall[] {\n  let argv = stripPrefixes(rawArgv);\n  if (argv.length < 2) return [];\n  let bin = basename(argv[0]).toLowerCase();\n\n  if (bin === 'uv' && argv[1] === 'pip') { argv = argv.slice(1); bin = 'pip'; }\n  if ((bin === 'python' || bin === 'python3') && argv.includes('-m')) {\n    const mi = argv.indexOf('-m');\n    if (argv[mi + 1] === 'pip') { argv = ['pip', ...argv.slice(mi + 2)]; bin = 'pip'; }\n  }\n\n  const isSystem = SYSTEM_PMS.has(bin);\n  const entry = PM_TABLE[bin];\n  if (!entry && !isSystem) return [];\n  const ecosystem = entry ? entry.ecosystem : 'system';\n  const subs = entry ? entry.subs : SYSTEM_SUBS;\n\n  let subIdx = -1;\n  for (let i = 1; i < argv.length; i++) {\n    if (subs.has(argv[i].toLowerCase())) { subIdx = i; break; }\n  }\n  if (subIdx === -1) return [];\n\n  const installs: RawInstall[] = [];\n  // gem pins the version with a separate `-v`/`--version` flag rather than an\n  // inline spec; capture it and apply to the package(s) in this segment.\n  let flagVersion: string | null = null;\n  for (let i = subIdx + 1; i < argv.length; i++) {\n    const tok = argv[i];\n    if (isRedirectFragment(tok)) break;\n    if (tok.startsWith('-')) {\n      const lower = tok.toLowerCase();\n      if (ecosystem === 'RubyGems' && (lower === '-v' || lower === '--version')) {\n        flagVersion = (argv[i + 1] || '').replace(/^[v=\\s]+/, '') || null;\n        i++;\n        continue;\n      }\n      if (VALUE_FLAGS.has(tok)) i++;\n      continue;\n    }\n    const parsed = parsePackageToken(tok, ecosystem);\n    if (parsed) installs.push(parsed);\n  }\n  if (flagVersion) {\n    for (const ins of installs) {\n      if (ins.source === 'registry' && !ins.versionSpec) ins.versionSpec = flagVersion;\n    }\n  }\n  return installs;\n}\n\nconst ECO_TO_OSV: Record<string, string | null> = {\n  npm: 'npm',\n  pypi: 'PyPI', PyPI: 'PyPI',\n  cargo: 'crates.io', 'crates.io': 'crates.io',\n  go: 'Go', Go: 'Go',\n  rubygems: 'RubyGems', RubyGems: 'RubyGems',\n  packagist: 'Packagist', Packagist: 'Packagist',\n  maven: 'Maven', Maven: 'Maven',\n  nuget: 'NuGet', NuGet: 'NuGet',\n  apt: null, brew: null, system: null, other: null,\n};\n\nfunction normalizeName(name: string, osvEco: string): string {\n  const n = name.trim();\n  if (osvEco === 'npm') return n.toLowerCase();\n  if (osvEco === 'PyPI') return n.toLowerCase().replace(/[-_.]+/g, '-');\n  return n;\n}\n\nfunction concretePin(spec: string | null): string | null {\n  if (!spec) return null;\n  const c = spec.trim().replace(/^[v=\\s]+/, '');\n  if (c.toLowerCase() === 'latest' || c === '') return null;\n  if (/[\\^~><|*\\sx]/i.test(c)) return null;\n  return /^\\d[\\w.\\-+]*$/.test(c) ? c : null;\n}\n\nconst PKG_JSON_DEP_FIELDS = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];\n\nfunction safeParseObject(text: string): Record<string, any> | null {\n  try {\n    const v = JSON.parse(text);\n    return v && typeof v === 'object' && !Array.isArray(v) ? v : null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Diff two package.json contents and return the registry packages that are\n * newly added or whose version spec changed in the new content. The caller\n * scans these against the vuln DB before letting the edit land \u2014 so a bare\n * `pnpm install` afterwards has nothing left to vet. Non-registry sources\n * (file:, link:, workspace:, git, http, relative paths) are skipped.\n */\nexport function extractPackageJsonDelta(oldText: string, newText: string): DeterministicPkgRequest[] {\n  const newJson = safeParseObject(newText);\n  if (!newJson) return [];\n  const oldJson = safeParseObject(oldText) || {};\n\n  const out = new Map<string, DeterministicPkgRequest>();\n  for (const field of PKG_JSON_DEP_FIELDS) {\n    const oldDeps = (oldJson[field] && typeof oldJson[field] === 'object') ? oldJson[field] : {};\n    const newDeps = (newJson[field] && typeof newJson[field] === 'object') ? newJson[field] : {};\n    for (const [rawName, version] of Object.entries(newDeps)) {\n      if (typeof version !== 'string') continue;\n      if (oldDeps[rawName] === version) continue;\n      const spec = version.trim();\n      if (\n        spec.startsWith('file:') || spec.startsWith('link:') ||\n        spec.startsWith('http') || spec.startsWith('git') ||\n        spec.startsWith('workspace:') || spec.startsWith('catalog:') ||\n        spec.startsWith('npm:') ||\n        spec.startsWith('./') || spec.startsWith('../') ||\n        spec === '' || spec === '*'\n      ) continue;\n      const name = rawName.toLowerCase();\n      out.set(name, {\n        name,\n        version: concretePin(spec) ?? '*',\n        ecosystem: 'npm',\n      });\n    }\n  }\n  return [...out.values()];\n}\n\n/**\n * Parse registry installs from a shell command without LLM/network.\n * Unpinned versions use '*' so OSV scans the full advisory history.\n */\nexport function extractDeterministicPkgRequests(command: string): DeterministicPkgRequest[] {\n  const merged = new Map<string, DeterministicPkgRequest>();\n  for (const r of segmentCommand(command).flatMap(extractSegment)) {\n    if (r.source !== 'registry') continue;\n    const osvEco = ECO_TO_OSV[r.ecosystem] ?? ECO_TO_OSV[r.ecosystem.toLowerCase()] ?? null;\n    if (!osvEco) continue;\n    const name = normalizeName(r.name, osvEco);\n    if (!name) continue;\n    const key = osvEco + '|' + name.toLowerCase();\n    const version = concretePin(r.versionSpec) ?? '*';\n    const prev = merged.get(key);\n    if (!prev || (prev.version === '*' && version !== '*')) {\n      merged.set(key, { name, version, ecosystem: osvEco });\n    }\n  }\n  return [...merged.values()];\n}\n", "utf-8");
   writeFileSync8(taskActivateIntentScriptPath, STUB_TASK_ACTIVATE_INTENT_TS, "utf-8");
-  const stubCommonPath = join10(HOOKS_DIR, "_synkro-stub-common.ts");
+  const stubCommonPath = join11(HOOKS_DIR, "_synkro-stub-common.ts");
   writeFileSync8(stubCommonPath, STUB_COMMON_TS, "utf-8");
   chmodSync2(stubCommonPath, 493);
   writeFileSync8(mcpGateScriptPath, STUB_MCP_GATE_TS, "utf-8");
@@ -11623,11 +11736,11 @@ function shellQuoteSingle(value) {
 }
 function resolveSynkroBundle() {
   const scriptPath = process.argv[1];
-  if (scriptPath && existsSync11(scriptPath)) return scriptPath;
+  if (scriptPath && existsSync12(scriptPath)) return scriptPath;
   return null;
 }
 function writeConfigEnv(opts) {
-  const credsPath = join10(SYNKRO_DIR5, "credentials.json");
+  const credsPath = join11(SYNKRO_DIR6, "credentials.json");
   const safeGateway = sanitizeConfigValue(opts.gatewayUrl);
   const safeUserId = sanitizeConfigValue(opts.userId);
   const safeOrgId = sanitizeConfigValue(opts.orgId);
@@ -11643,7 +11756,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.7.9")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.7.24")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -11676,7 +11789,7 @@ async function getOrMintCloudToken(gatewayUrl) {
   assertGatewayAllowed(gatewayUrl);
   let stored = "";
   try {
-    stored = readFileSync10(CLOUD_JWT_PATH, "utf-8").trim();
+    stored = readFileSync11(CLOUD_JWT_PATH, "utf-8").trim();
   } catch {
   }
   if (stored && !jwtExpired(stored)) return stored;
@@ -11735,7 +11848,7 @@ async function provisionCloudContainer(opts) {
   let cursorApiKey = "";
   if (cursorTotal > 0) {
     try {
-      cursorApiKey = readFileSync10(join10(SYNKRO_DIR5, "cursor-creds", "api-key"), "utf-8").trim();
+      cursorApiKey = readFileSync11(join11(SYNKRO_DIR6, "cursor-creds", "api-key"), "utf-8").trim();
     } catch {
     }
   }
@@ -11892,8 +12005,8 @@ async function verifyCloudGrader(jwt2) {
 }
 function readPersistedDeployLocation() {
   try {
-    if (existsSync11(CONFIG_PATH2)) {
-      const m = readFileSync10(CONFIG_PATH2, "utf-8").match(/^SYNKRO_DEPLOY_LOCATION='([^']*)'/m);
+    if (existsSync12(CONFIG_PATH2)) {
+      const m = readFileSync11(CONFIG_PATH2, "utf-8").match(/^SYNKRO_DEPLOY_LOCATION='([^']*)'/m);
       if (m?.[1] === "cloud") return "cloud";
     }
   } catch {
@@ -11901,8 +12014,8 @@ function readPersistedDeployLocation() {
   return "local";
 }
 function updateConfigEnvLocation(location) {
-  if (!existsSync11(CONFIG_PATH2)) return;
-  let env = readFileSync10(CONFIG_PATH2, "utf-8");
+  if (!existsSync12(CONFIG_PATH2)) return;
+  let env = readFileSync11(CONFIG_PATH2, "utf-8");
   const set = (k, v) => {
     const re = new RegExp(`^${k}=.*$`, "m");
     const line = `${k}='${v}'`;
@@ -11917,7 +12030,7 @@ async function applyMcpConfig(opts) {
   if (!opts.hasClaudeCode && !opts.hasCursor) return;
   let mcpJwt = "";
   try {
-    mcpJwt = readFileSync10(join10(SYNKRO_DIR5, ".mcp-jwt"), "utf-8").trim();
+    mcpJwt = readFileSync11(join11(SYNKRO_DIR6, ".mcp-jwt"), "utf-8").trim();
   } catch {
   }
   if (!mcpJwt) {
@@ -12035,8 +12148,8 @@ function resolveDeploymentMode() {
   const envOverride = process.env.SYNKRO_DEPLOYMENT_MODE?.toLowerCase();
   if (envOverride === "bare-host" || envOverride === "docker") return envOverride;
   try {
-    if (existsSync11(CONFIG_PATH2)) {
-      const m = readFileSync10(CONFIG_PATH2, "utf-8").match(/^SYNKRO_DEPLOYMENT_MODE='([^']*)'/m);
+    if (existsSync12(CONFIG_PATH2)) {
+      const m = readFileSync11(CONFIG_PATH2, "utf-8").match(/^SYNKRO_DEPLOYMENT_MODE='([^']*)'/m);
       const val = m?.[1]?.toLowerCase();
       if (val === "bare-host" || val === "docker") return val;
     }
@@ -12063,16 +12176,16 @@ function collectLocalMetadata(includeClaudeCode = true) {
     meta.cc_version = execSync6("claude --version", { encoding: "utf-8", timeout: 5e3 }).trim().split("\n")[0];
   } catch {
   }
-  const claudeDir = join10(homedir10(), ".claude");
+  const claudeDir = join11(homedir11(), ".claude");
   try {
-    const settings = JSON.parse(readFileSync10(join10(claudeDir, "settings.json"), "utf-8"));
+    const settings = JSON.parse(readFileSync11(join11(claudeDir, "settings.json"), "utf-8"));
     const plugins = Object.keys(settings.enabledPlugins ?? {}).filter((k) => settings.enabledPlugins[k]);
     if (plugins.length) meta.enabled_plugins = plugins;
     if (settings.permissions?.defaultMode) meta.permissions_mode = settings.permissions.defaultMode;
   } catch {
   }
   try {
-    const mcpCache = JSON.parse(readFileSync10(join10(claudeDir, "mcp-needs-auth-cache.json"), "utf-8"));
+    const mcpCache = JSON.parse(readFileSync11(join11(claudeDir, "mcp-needs-auth-cache.json"), "utf-8"));
     const mcpNames = Object.keys(mcpCache);
     if (mcpNames.length) meta.mcp_servers = mcpNames;
   } catch {
@@ -12084,10 +12197,10 @@ function collectLocalMetadata(includeClaudeCode = true) {
   } catch {
   }
   try {
-    const sessionsDir = join10(claudeDir, "sessions");
+    const sessionsDir = join11(claudeDir, "sessions");
     const files = readdirSync3(sessionsDir).filter((f) => f.endsWith(".json")).slice(-5);
     for (const f of files) {
-      const s = JSON.parse(readFileSync10(join10(sessionsDir, f), "utf-8"));
+      const s = JSON.parse(readFileSync11(join11(sessionsDir, f), "utf-8"));
       if (s.version) {
         meta.cc_version = meta.cc_version || s.version;
         break;
@@ -12275,9 +12388,9 @@ async function installCommand(opts = {}) {
   const scripts = writeHookScripts(hookMode);
   console.log("Wrote hook scripts to ~/.synkro/hooks/\n");
   for (const mode of ["edit", "bash"]) {
-    const pidFile = join10(SYNKRO_DIR5, "daemon", mode, "daemon.pid");
+    const pidFile = join11(SYNKRO_DIR6, "daemon", mode, "daemon.pid");
     try {
-      const pid = parseInt(readFileSync10(pidFile, "utf-8").trim(), 10);
+      const pid = parseInt(readFileSync11(pidFile, "utf-8").trim(), 10);
       if (pid > 0) {
         process.kill(pid, "SIGTERM");
         console.log(`Stopped stale ${mode} grader daemon (pid ${pid})`);
@@ -12360,7 +12473,7 @@ async function installCommand(opts = {}) {
         if (mintResp.ok) {
           const minted = await mintResp.json();
           mcpJwt = minted.token;
-          writeFileSync8(join10(SYNKRO_DIR5, ".mcp-jwt"), mcpJwt + "\n", { mode: 384 });
+          writeFileSync8(join11(SYNKRO_DIR6, ".mcp-jwt"), mcpJwt + "\n", { mode: 384 });
         } else {
           console.warn("  \u26A0 Could not mint MCP token \u2014 local server will reject requests until re-installed.");
         }
@@ -12388,7 +12501,7 @@ async function installCommand(opts = {}) {
           throw new Error(`mcp-token mint failed (${mintResp.status}): ${errText.slice(0, 200)}`);
         }
         const minted = await mintResp.json();
-        writeFileSync8(join10(SYNKRO_DIR5, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
+        writeFileSync8(join11(SYNKRO_DIR6, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
         const mcp = installMcpConfig({ gatewayUrl, bearerToken: minted.token });
         console.log(`Registered Synkro guardrails MCP server in ${mcp.path}`);
         console.log(`  url:        ${mcp.url}`);
@@ -12405,8 +12518,8 @@ async function installCommand(opts = {}) {
   if (hasCursor && !opts.noMcp) {
     try {
       if (useLocalMcp) {
-        const jwtPath = join10(SYNKRO_DIR5, ".mcp-jwt");
-        if (!existsSync11(jwtPath)) {
+        const jwtPath = join11(SYNKRO_DIR6, ".mcp-jwt");
+        if (!existsSync12(jwtPath)) {
           const mintResp = await fetch(`${gatewayUrl}/api/v1/cli/mcp-token`, {
             method: "POST",
             headers: { "Authorization": `Bearer ${token}`, "Content-Type": "application/json" },
@@ -12434,7 +12547,7 @@ async function installCommand(opts = {}) {
           throw new Error(`mcp-token mint failed (${mintResp.status}): ${errText.slice(0, 200)}`);
         }
         const minted = await mintResp.json();
-        writeFileSync8(join10(SYNKRO_DIR5, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
+        writeFileSync8(join11(SYNKRO_DIR6, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
         const mcp = installCursorMcpConfig({ gatewayUrl, bearerToken: minted.token });
         console.log(`Registered Synkro guardrails MCP server in ${mcp.path}`);
         console.log(`  url:        ${mcp.url}`);
@@ -12516,7 +12629,7 @@ async function installCommand(opts = {}) {
     const ready = await waitForContainerReady(6e4);
     if (ready) {
       console.log("  \u2713 container ready");
-      const mcpJwt = readFileSync10(join10(SYNKRO_DIR5, ".mcp-jwt"), "utf-8").trim();
+      const mcpJwt = readFileSync11(join11(SYNKRO_DIR6, ".mcp-jwt"), "utf-8").trim();
       try {
         const ingestResp = await fetch(`http://127.0.0.1:${hostMcpPort}/api/ingest`, {
           method: "POST",
@@ -12537,6 +12650,7 @@ async function installCommand(opts = {}) {
       if (workersUp) {
         console.log("  \u2713 workers ready");
         await syncSkillFiles();
+        await discoverAndIngestSkills();
       } else {
         console.warn("  \u26A0 workers did not register within 30s \u2014 skill sync skipped");
       }
@@ -12550,6 +12664,11 @@ async function installCommand(opts = {}) {
     if (hasCursor) await promptCursorApiKey(opts);
     await provisionCloudContainer({ gatewayUrl, jwt: token, orgId, userId, email, hasClaudeCode, hasCursor });
     cloudGradeOk = await verifyCloudGrader(token);
+    if (await promptCodexCloudSetup()) {
+      const { setupCodexCloud: setupCodexCloud2 } = await Promise.resolve().then(() => (init_codexCloudSetup(), codexCloudSetup_exports));
+      const res = await setupCodexCloud2(gatewayUrl, token, (m) => console.log(`  ${m}`));
+      if (!res.ok) console.warn(`  \u26A0 Codex cloud setup skipped: ${res.error}`);
+    }
   }
   if (transcriptConsent) {
     const repo = detectGitRepo2();
@@ -12558,7 +12677,7 @@ async function installCommand(opts = {}) {
         try {
           let mcpToken = "";
           try {
-            mcpToken = readFileSync10(join10(SYNKRO_DIR5, ".mcp-jwt"), "utf-8").trim();
+            mcpToken = readFileSync11(join11(SYNKRO_DIR6, ".mcp-jwt"), "utf-8").trim();
           } catch {
           }
           if (mcpToken) {
@@ -12694,8 +12813,8 @@ function writeSynkroFileIfMissing(opts) {
   try {
     const root = execSync6("git rev-parse --show-toplevel", { encoding: "utf-8", timeout: 3e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
     if (!root) return;
-    if (root === homedir10()) return;
-    const fp = join10(root, "synkro.toml");
+    if (root === homedir11()) return;
+    const fp = join11(root, "synkro.toml");
     let hasFile = false;
     try {
       hasFile = statSync(fp).isFile();
@@ -12740,9 +12859,9 @@ function readFullSynkroFile() {
   try {
     const root = execSync6("git rev-parse --show-toplevel", { encoding: "utf-8", timeout: 3e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
     if (!root) return null;
-    const fp = join10(root, "synkro.toml");
-    if (!existsSync11(fp)) return null;
-    const parsed = parseSynkroToml2(readFileSync10(fp, "utf-8"));
+    const fp = join11(root, "synkro.toml");
+    if (!existsSync12(fp)) return null;
+    const parsed = parseSynkroToml2(readFileSync11(fp, "utf-8"));
     const valid = ["claude-code", "cursor"];
     const harness = Array.isArray(parsed.harness) ? parsed.harness.filter((h) => valid.includes(h)) : ["claude-code", "cursor"];
     const resolved = resolveGraderPool(parsed);
@@ -12780,7 +12899,7 @@ function reconcileHarness() {
   console.log(`synkro.toml: harness=[${sf.harness.join(", ")}] pool=${poolLabel(sf.grader.pool)} mode=${sf.grader.mode}`);
   const scripts = writeHookScripts(resolvePersistedHookMode());
   console.log("Wrote hook scripts to ~/.synkro/hooks/");
-  const ccSettings = join10(homedir10(), ".claude", "settings.json");
+  const ccSettings = join11(homedir11(), ".claude", "settings.json");
   if (wantCC) {
     installCCHooks(ccSettings, {
       bashJudgeScriptPath: scripts.bashScript,
@@ -12800,7 +12919,7 @@ function reconcileHarness() {
     });
     console.log("  \u2713 Claude Code hooks registered");
     try {
-      const mcpJwt = readFileSync10(join10(SYNKRO_DIR5, ".mcp-jwt"), "utf-8").trim();
+      const mcpJwt = readFileSync11(join11(SYNKRO_DIR6, ".mcp-jwt"), "utf-8").trim();
       if (mcpJwt) {
         installMcpConfig({ gatewayUrl: "", bearerToken: mcpJwt, local: true });
         console.log("  \u2713 Claude Code MCP registered");
@@ -12812,7 +12931,7 @@ function reconcileHarness() {
     if (uninstallMcpConfig()) console.log("  \u2717 Claude Code MCP removed");
     if (uninstallClaudeDesktopMcpConfig()) console.log("  \u2717 Claude Desktop MCP removed");
   }
-  const cursorHooks = join10(homedir10(), ".cursor", "hooks.json");
+  const cursorHooks = join11(homedir11(), ".cursor", "hooks.json");
   if (wantCursor) {
     installCursorHooks(cursorHooks, {
       bashJudgeScriptPath: scripts.cursorBashJudgeScript,
@@ -12859,6 +12978,34 @@ function reconcileHarness() {
   if (providers.length === 0) providers.push("claude_code");
   return splitWorkers(total, providers);
 }
+async function ingestSkillTasks(tasks, mcpPort) {
+  const summary = { ingested: 0, rules: 0, rejected: [] };
+  for (const { source, content } of tasks) {
+    try {
+      const resp = await fetch(`http://127.0.0.1:${mcpPort}/api/local/skills/sync`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ source, content }),
+        signal: AbortSignal.timeout(65e3)
+      });
+      if (!resp.ok) throw new Error(`${resp.status}`);
+      const r = await resp.json();
+      if (r.status === "rejected") {
+        const reason = (r.reasons || []).slice(0, 2).join("; ") || r.message || "blocked by security vetting";
+        summary.rejected.push({ source, reason });
+        console.log(`  \u26D4 skill ${source}: BLOCKED \u2014 ${reason}`);
+      } else {
+        const created = r.created || 0;
+        summary.ingested++;
+        summary.rules += created;
+        console.log(created > 0 ? `  \u2713 skill ${source}: ${created} rule${created === 1 ? "" : "s"} \u2192 its own pack` : `  \u2713 skill ${source}: ${r.message || "up to date"}`);
+      }
+    } catch (e) {
+      console.warn(`  \u26A0 skill ${source}: sync failed (${e instanceof Error ? e.message : String(e)})`);
+    }
+  }
+  return summary;
+}
 async function syncSkillFiles() {
   const sf = readFullSynkroFile();
   if (!sf || sf.skills.length === 0) return;
@@ -12866,7 +13013,7 @@ async function syncSkillFiles() {
   if (resolved.length === 0) return;
   const mcpPort = process.env.SYNKRO_MCP_PORT || "18931";
   const tasks = resolved.map((fp) => {
-    const content = readFileSync10(fp, "utf-8");
+    const content = readFileSync11(fp, "utf-8");
     const source = `skill:${fp.split("/").pop()}`;
     if (!content.trim()) {
       console.log(`  \u2298 skill ${source}: empty file, skipped`);
@@ -12878,20 +13025,128 @@ async function syncSkillFiles() {
   }).filter(Boolean);
   if (tasks.length === 0) return;
   console.log(`  indexing ${tasks.length} skill file${tasks.length === 1 ? "" : "s"} \u2014 comparing against existing ruleset (this may take a few seconds)...`);
-  for (const { source, content } of tasks) {
+  await ingestSkillTasks(tasks, mcpPort);
+}
+function discoverSkillFiles(repoRoot, excludeHashes) {
+  const roots = [];
+  const add = (p) => {
     try {
-      const resp = await fetch(`http://127.0.0.1:${mcpPort}/api/local/skills/sync`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ source, content }),
-        signal: AbortSignal.timeout(65e3)
-      });
-      if (!resp.ok) throw new Error(`${resp.status}`);
-      const { created, message } = await resp.json();
-      console.log(created > 0 ? `  \u2713 skill ${source}: ${created} new rule${created === 1 ? "" : "s"} added to index` : `  \u2713 skill ${source}: ${message || "up to date"} \u2014 index unchanged`);
-    } catch (e) {
-      console.warn(`  \u26A0 skill ${source}: sync failed (${e instanceof Error ? e.message : String(e)})`);
+      if (p && existsSync12(p) && statSync(p).isDirectory()) roots.push(p);
+    } catch {
+    }
+  };
+  add(join11(homedir11(), ".claude", "skills"));
+  add(join11(homedir11(), ".agents", "skills"));
+  if (repoRoot) {
+    add(join11(repoRoot, ".claude", "skills"));
+    add(join11(repoRoot, ".agents", "skills"));
+  }
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const MAX = 200;
+  const consider = (file, name) => {
+    if (out.length >= MAX) return;
+    let content = "";
+    try {
+      const st = statSync(file);
+      if (!st.isFile() || st.size > 2e5) return;
+      content = readFileSync11(file, "utf-8");
+    } catch {
+      return;
+    }
+    if (!content.trim()) return;
+    const hash = createHash("sha256").update(content).digest("hex");
+    if (seen.has(hash) || excludeHashes.has(hash)) return;
+    seen.add(hash);
+    out.push({ source: `skill:${name}`, content, name, hash });
+  };
+  for (const root of roots) {
+    let entries = [];
+    try {
+      entries = readdirSync3(root);
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (entry.startsWith(".")) continue;
+      const full = join11(root, entry);
+      let st;
+      try {
+        st = statSync(full);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        const skillMd = join11(full, "SKILL.md");
+        if (existsSync12(skillMd)) consider(skillMd, entry);
+      } else if (/\.mdx?$/i.test(entry) && entry.toUpperCase() !== "README.MD") {
+        consider(full, entry.replace(/\.mdx?$/i, ""));
+      }
+    }
+  }
+  return out;
+}
+function discoverySetHash(found) {
+  return createHash("sha256").update(found.map((f) => f.hash).sort().join(",")).digest("hex");
+}
+async function promptSkillDiscovery(found) {
+  if (!process.stdin.isTTY || found.length === 0) return [];
+  const rl = createInterface3({ input: process.stdin, output: process.stdout });
+  const ask3 = (q) => new Promise((res) => rl.question(q, (a) => res(a.trim())));
+  try {
+    console.log(`
+Found ${found.length} skill${found.length === 1 ? "" : "s"} in your Claude Code / skills.sh folders:`);
+    found.forEach((s, i) => console.log(`  ${i + 1}. ${s.name}`));
+    console.log("Ingest into Synkro as enforceable rules? Each is security-vetted first \u2014 anything");
+    console.log("malicious (prompt injection, guardrail-weakening, secret exfil) is blocked and reported.");
+    const a = (await ask3("Ingest [all] / type numbers (e.g. 1,3) / [skip]: ")).toLowerCase();
+    if (a === "skip" || a === "n" || a === "no" || a === "s") return [];
+    if (a === "" || a === "all" || a === "y" || a === "yes" || a === "a") return found.map((_, i) => i);
+    const picks = a.split(/[\s,]+/).map((x) => parseInt(x, 10) - 1).filter((i) => Number.isInteger(i) && i >= 0 && i < found.length);
+    return [...new Set(picks)];
+  } finally {
+    rl.close();
+  }
+}
+async function discoverAndIngestSkills() {
+  try {
+    const sf = readFullSynkroFile();
+    const repoRoot = sf?._repoRoot || detectGitRepo2();
+    const excludeHashes = /* @__PURE__ */ new Set();
+    if (sf?.skills?.length) {
+      for (const fp of resolveSkillPaths(sf.skills, sf._repoRoot)) {
+        try {
+          excludeHashes.add(createHash("sha256").update(readFileSync11(fp, "utf-8")).digest("hex"));
+        } catch {
+        }
+      }
+    }
+    const found = discoverSkillFiles(repoRoot, excludeHashes);
+    if (found.length === 0) return;
+    const setHash = discoverySetHash(found);
+    let prev = "";
+    try {
+      prev = readFileSync11(SKILLS_DISCOVERED_PATH, "utf-8").trim();
+    } catch {
+    }
+    if (prev === setHash) return;
+    const picks = await promptSkillDiscovery(found);
+    try {
+      writeFileSync8(SKILLS_DISCOVERED_PATH, setHash);
+    } catch {
     }
+    if (picks.length === 0) {
+      console.log("  Skipped \u2014 you can ingest skills anytime from the Synkro dashboard or via the MCP tool.");
+      return;
+    }
+    const mcpPort = process.env.SYNKRO_MCP_PORT || "18931";
+    console.log(`  Ingesting ${picks.length} skill${picks.length === 1 ? "" : "s"} (security-vetting each first)\u2026`);
+    const summary = await ingestSkillTasks(picks.map((i) => ({ source: found[i].source, content: found[i].content })), mcpPort);
+    const parts = [`${summary.ingested} ingested (${summary.rules} rule${summary.rules === 1 ? "" : "s"})`];
+    if (summary.rejected.length) parts.push(`${summary.rejected.length} blocked`);
+    console.log(`  Skills: ${parts.join(", ")} \u2014 each in its own toggleable pack.`);
+  } catch (e) {
+    console.warn(`  \u26A0 skill discovery skipped (${e instanceof Error ? e.message : String(e)})`);
   }
 }
 function detectGitRepo2() {
@@ -12912,17 +13167,17 @@ function detectGitRepo2() {
 function getClaudeProjectsFolder() {
   const cwd = process.cwd();
   const sanitized = "-" + cwd.replace(/\//g, "-");
-  const projectsDir = join10(homedir10(), ".claude", "projects", sanitized);
-  return existsSync11(projectsDir) ? projectsDir : null;
+  const projectsDir = join11(homedir11(), ".claude", "projects", sanitized);
+  return existsSync12(projectsDir) ? projectsDir : null;
 }
 function extractSessionInsights(projectsDir) {
   const insights = [];
   const files = readdirSync3(projectsDir).filter((f) => f.endsWith(".jsonl"));
   for (const file of files) {
     const sessionId = file.replace(".jsonl", "");
-    const filePath = join10(projectsDir, file);
+    const filePath = join11(projectsDir, file);
     try {
-      const content = readFileSync10(filePath, "utf-8");
+      const content = readFileSync11(filePath, "utf-8");
       const lines = content.split("\n").filter(Boolean);
       for (let i = 0; i < lines.length; i++) {
         try {
@@ -13001,14 +13256,14 @@ function cursorProjectSlug(workspaceRoot) {
   return workspaceRoot.replace(/^[/]+/, "").replace(/[^a-zA-Z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function getCursorTranscriptsDir() {
-  const dir = join10(homedir10(), ".cursor", "projects", cursorProjectSlug(process.cwd()), "agent-transcripts");
-  return existsSync11(dir) ? dir : null;
+  const dir = join11(homedir11(), ".cursor", "projects", cursorProjectSlug(process.cwd()), "agent-transcripts");
+  return existsSync12(dir) ? dir : null;
 }
 function isSafeConvId(id) {
   return /^[A-Za-z0-9_-]+$/.test(id);
 }
 function parseCursorTranscriptFile(filePath) {
-  const content = readFileSync10(filePath, "utf-8");
+  const content = readFileSync11(filePath, "utf-8");
   const lines = content.split("\n").filter(Boolean);
   const messages = [];
   for (let i = 0; i < lines.length; i++) {
@@ -13040,8 +13295,8 @@ async function syncCursorTranscriptsLocal(mcpPort, mcpToken, repo) {
   for (let i = 0; i < convDirs.length; i++) {
     const convId = convDirs[i];
     if (!isSafeConvId(convId)) continue;
-    const filePath = join10(dir, convId, `${convId}.jsonl`);
-    if (!existsSync11(filePath)) continue;
+    const filePath = join11(dir, convId, `${convId}.jsonl`);
+    if (!existsSync12(filePath)) continue;
     try {
       const all = parseCursorTranscriptFile(filePath);
       const messages = all.length > 500 ? all.slice(-500) : all;
@@ -13063,8 +13318,8 @@ async function syncCursorTranscriptsLocal(mcpPort, mcpToken, repo) {
       process.stdout.write(`\r  Progress: ${i + 1}/${convDirs.length} sessions (${totalMessages} messages embedded)   `);
     }
     try {
-      const lc = readFileSync10(filePath, "utf-8").split("\n").filter(Boolean).length;
-      writeFileSync8(join10(OFFSETS_DIR, convId), String(lc), "utf-8");
+      const lc = readFileSync11(filePath, "utf-8").split("\n").filter(Boolean).length;
+      writeFileSync8(join11(OFFSETS_DIR, convId), String(lc), "utf-8");
     } catch {
     }
   }
@@ -13072,7 +13327,7 @@ async function syncCursorTranscriptsLocal(mcpPort, mcpToken, repo) {
   return { sessions: totalSessions, messages: totalMessages };
 }
 function parseTranscriptFile(filePath) {
-  const content = readFileSync10(filePath, "utf-8");
+  const content = readFileSync11(filePath, "utf-8");
   const lines = content.split("\n").filter(Boolean);
   const messages = [];
   for (let i = 0; i < lines.length; i++) {
@@ -13120,7 +13375,7 @@ async function syncTranscriptsLocal(mcpPort, mcpToken, repo) {
   for (let i = 0; i < files.length; i++) {
     const file = files[i];
     const sessionId = file.replace(".jsonl", "");
-    const filePath = join10(projectsDir, file);
+    const filePath = join11(projectsDir, file);
     try {
       const allMessages = parseTranscriptFile(filePath);
       const messages = allMessages.length > 500 ? allMessages.slice(-500) : allMessages;
@@ -13142,9 +13397,9 @@ async function syncTranscriptsLocal(mcpPort, mcpToken, repo) {
       process.stdout.write(`\r  Progress: ${i + 1}/${files.length} sessions (${totalMessages} messages embedded)   `);
     }
     try {
-      const content = readFileSync10(join10(projectsDir, file), "utf-8");
+      const content = readFileSync11(join11(projectsDir, file), "utf-8");
       const lineCount = content.split("\n").filter(Boolean).length;
-      writeFileSync8(join10(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
+      writeFileSync8(join11(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
     } catch {
     }
   }
@@ -13165,7 +13420,7 @@ async function syncTranscriptsBulk(gatewayUrl, token, repo) {
     const sessions = [];
     for (const file of batch) {
       const sessionId = file.replace(".jsonl", "");
-      const filePath = join10(projectsDir, file);
+      const filePath = join11(projectsDir, file);
       try {
         const allMessages = parseTranscriptFile(filePath);
         const messages = allMessages.length > maxMessagesPerSession ? allMessages.slice(-maxMessagesPerSession) : allMessages;
@@ -13194,18 +13449,18 @@ async function syncTranscriptsBulk(gatewayUrl, token, repo) {
     }
     for (const file of batch) {
       const sessionId = file.replace(".jsonl", "");
-      const filePath = join10(projectsDir, file);
+      const filePath = join11(projectsDir, file);
       try {
-        const content = readFileSync10(filePath, "utf-8");
+        const content = readFileSync11(filePath, "utf-8");
         const lineCount = content.split("\n").filter(Boolean).length;
-        writeFileSync8(join10(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
+        writeFileSync8(join11(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
       } catch {
       }
     }
   }
   return { sessions: totalSessions, messages: totalMessages };
 }
-var SYNKRO_DIR5, HOOKS_DIR, BIN_DIR, CONFIG_PATH2, MCP_STDIO_PROXY_SRC, OFFSETS_DIR, CLOUD_JWT_PATH;
+var SYNKRO_DIR6, HOOKS_DIR, BIN_DIR, CONFIG_PATH2, MCP_STDIO_PROXY_SRC, OFFSETS_DIR, CLOUD_JWT_PATH, SKILLS_DISCOVERED_PATH;
 var init_install = __esm({
   "cli/commands/install.ts"() {
     "use strict";
@@ -13224,10 +13479,10 @@ var init_install = __esm({
     init_claudeDesktopTap();
     init_dockerInstall();
     init_setupToken();
-    SYNKRO_DIR5 = join10(homedir10(), ".synkro");
-    HOOKS_DIR = join10(SYNKRO_DIR5, "hooks");
-    BIN_DIR = join10(SYNKRO_DIR5, "bin");
-    CONFIG_PATH2 = join10(SYNKRO_DIR5, "config.env");
+    SYNKRO_DIR6 = join11(homedir11(), ".synkro");
+    HOOKS_DIR = join11(SYNKRO_DIR6, "hooks");
+    BIN_DIR = join11(SYNKRO_DIR6, "bin");
+    CONFIG_PATH2 = join11(SYNKRO_DIR6, "config.env");
     MCP_STDIO_PROXY_SRC = `#!/usr/bin/env bun
 import { readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
@@ -13338,20 +13593,21 @@ rl.on('line', async (line) => {
   }
 });
 `;
-    OFFSETS_DIR = join10(SYNKRO_DIR5, ".transcript-offsets");
-    CLOUD_JWT_PATH = join10(SYNKRO_DIR5, ".cloud-jwt");
+    OFFSETS_DIR = join11(SYNKRO_DIR6, ".transcript-offsets");
+    CLOUD_JWT_PATH = join11(SYNKRO_DIR6, ".cloud-jwt");
+    SKILLS_DISCOVERED_PATH = join11(SYNKRO_DIR6, ".skills-discovered");
   }
 });
 
 // cli/local-cc/install.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync10, writeFileSync as writeFileSync9, readFileSync as readFileSync11, chmodSync as chmodSync3, copyFileSync as copyFileSync2, renameSync as renameSync4, unlinkSync as unlinkSync5, openSync, fsyncSync, closeSync } from "fs";
-import { join as join11 } from "path";
-import { homedir as homedir11 } from "os";
-import { spawnSync as spawnSync5 } from "child_process";
+import { existsSync as existsSync13, mkdirSync as mkdirSync11, writeFileSync as writeFileSync9, readFileSync as readFileSync12, chmodSync as chmodSync3, copyFileSync as copyFileSync2, renameSync as renameSync4, unlinkSync as unlinkSync5, openSync, fsyncSync, closeSync } from "fs";
+import { join as join12 } from "path";
+import { homedir as homedir12 } from "os";
+import { spawnSync as spawnSync6 } from "child_process";
 function writePluginFiles() {
   for (const c of CHANNELS) {
-    mkdirSync10(c.sessionDir, { recursive: true });
-    mkdirSync10(c.pluginSettingsDir, { recursive: true });
+    mkdirSync11(c.sessionDir, { recursive: true });
+    mkdirSync11(c.pluginSettingsDir, { recursive: true });
     writeFileSync9(c.pluginPkgPath, PLUGIN_PACKAGE_JSON, "utf-8");
     writeFileSync9(
       c.pluginSettingsPath,
@@ -13374,7 +13630,7 @@ function writePluginFiles() {
 }
 function runBunInstall() {
   for (const c of CHANNELS) {
-    const r = spawnSync5("bun", ["install", "--silent"], {
+    const r = spawnSync6("bun", ["install", "--silent"], {
       cwd: c.sessionDir,
       encoding: "utf-8",
       timeout: 12e4
@@ -13387,10 +13643,10 @@ function runBunInstall() {
   }
 }
 function safelyMutateClaudeJson(mutator) {
-  if (!existsSync12(CLAUDE_JSON_PATH)) {
+  if (!existsSync13(CLAUDE_JSON_PATH)) {
     return;
   }
-  const originalText = readFileSync11(CLAUDE_JSON_PATH, "utf-8");
+  const originalText = readFileSync12(CLAUDE_JSON_PATH, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(originalText);
@@ -13490,15 +13746,15 @@ function patchClaudeJson() {
   });
 }
 function installLocalCC() {
-  let bunCheck = spawnSync5("bun", ["--version"], { encoding: "utf-8" });
+  let bunCheck = spawnSync6("bun", ["--version"], { encoding: "utf-8" });
   if (bunCheck.status !== 0) {
     if (process.platform === "darwin") {
       console.log("  Installing bun via brew...");
-      const brewR = spawnSync5("brew", ["install", "oven-sh/bun/bun"], { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
+      const brewR = spawnSync6("brew", ["install", "oven-sh/bun/bun"], { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
       if (brewR.status !== 0) {
         throw new LocalCCInstallError("bun auto-install failed. Install manually: curl -fsSL https://bun.sh/install | bash");
       }
-      bunCheck = spawnSync5("bun", ["--version"], { encoding: "utf-8" });
+      bunCheck = spawnSync6("bun", ["--version"], { encoding: "utf-8" });
       if (bunCheck.status !== 0) {
         throw new LocalCCInstallError("bun installed but not found on PATH. Restart your terminal and re-run install.");
       }
@@ -13532,42 +13788,42 @@ var CLAUDE_JSON_BACKUP_PATH, SESSION_DIR, PLUGIN_PATH, PLUGIN_PKG_PATH, PLUGIN_S
 var init_install2 = __esm({
   "cli/local-cc/install.ts"() {
     "use strict";
-    CLAUDE_JSON_BACKUP_PATH = join11(homedir11(), ".claude.json.synkro-bak");
-    SESSION_DIR = join11(homedir11(), ".synkro", "cc_sessions");
-    PLUGIN_PATH = join11(SESSION_DIR, "synkro-channel.ts");
-    PLUGIN_PKG_PATH = join11(SESSION_DIR, "package.json");
-    PLUGIN_SETTINGS_DIR = join11(SESSION_DIR, ".claude");
-    PLUGIN_SETTINGS_PATH = join11(PLUGIN_SETTINGS_DIR, "settings.json");
-    PROJECT_MCP_PATH = join11(SESSION_DIR, ".mcp.json");
-    CLAUDE_JSON_PATH = join11(homedir11(), ".claude.json");
-    RUN_SCRIPT_PATH = join11(SESSION_DIR, "run-claude.sh");
+    CLAUDE_JSON_BACKUP_PATH = join12(homedir12(), ".claude.json.synkro-bak");
+    SESSION_DIR = join12(homedir12(), ".synkro", "cc_sessions");
+    PLUGIN_PATH = join12(SESSION_DIR, "synkro-channel.ts");
+    PLUGIN_PKG_PATH = join12(SESSION_DIR, "package.json");
+    PLUGIN_SETTINGS_DIR = join12(SESSION_DIR, ".claude");
+    PLUGIN_SETTINGS_PATH = join12(PLUGIN_SETTINGS_DIR, "settings.json");
+    PROJECT_MCP_PATH = join12(SESSION_DIR, ".mcp.json");
+    CLAUDE_JSON_PATH = join12(homedir12(), ".claude.json");
+    RUN_SCRIPT_PATH = join12(SESSION_DIR, "run-claude.sh");
     TMUX_SESSION_NAME = "synkro-local-cc";
     CHANNEL_1_PORT = 8941;
-    SESSION_DIR_2 = join11(homedir11(), ".synkro", "cc_sessions_2");
-    PLUGIN_PATH_2 = join11(SESSION_DIR_2, "synkro-channel.ts");
-    PLUGIN_PKG_PATH_2 = join11(SESSION_DIR_2, "package.json");
-    PLUGIN_SETTINGS_DIR_2 = join11(SESSION_DIR_2, ".claude");
-    PLUGIN_SETTINGS_PATH_2 = join11(PLUGIN_SETTINGS_DIR_2, "settings.json");
-    PROJECT_MCP_PATH_2 = join11(SESSION_DIR_2, ".mcp.json");
-    RUN_SCRIPT_PATH_2 = join11(SESSION_DIR_2, "run-claude.sh");
+    SESSION_DIR_2 = join12(homedir12(), ".synkro", "cc_sessions_2");
+    PLUGIN_PATH_2 = join12(SESSION_DIR_2, "synkro-channel.ts");
+    PLUGIN_PKG_PATH_2 = join12(SESSION_DIR_2, "package.json");
+    PLUGIN_SETTINGS_DIR_2 = join12(SESSION_DIR_2, ".claude");
+    PLUGIN_SETTINGS_PATH_2 = join12(PLUGIN_SETTINGS_DIR_2, "settings.json");
+    PROJECT_MCP_PATH_2 = join12(SESSION_DIR_2, ".mcp.json");
+    RUN_SCRIPT_PATH_2 = join12(SESSION_DIR_2, "run-claude.sh");
     TMUX_SESSION_NAME_2 = "synkro-local-cc-2";
     CHANNEL_2_PORT = 8951;
-    SESSION_DIR_3 = join11(homedir11(), ".synkro", "cc_sessions_3");
-    PLUGIN_PATH_3 = join11(SESSION_DIR_3, "synkro-channel.ts");
-    PLUGIN_PKG_PATH_3 = join11(SESSION_DIR_3, "package.json");
-    PLUGIN_SETTINGS_DIR_3 = join11(SESSION_DIR_3, ".claude");
-    PLUGIN_SETTINGS_PATH_3 = join11(PLUGIN_SETTINGS_DIR_3, "settings.json");
-    PROJECT_MCP_PATH_3 = join11(SESSION_DIR_3, ".mcp.json");
-    RUN_SCRIPT_PATH_3 = join11(SESSION_DIR_3, "run-claude.sh");
+    SESSION_DIR_3 = join12(homedir12(), ".synkro", "cc_sessions_3");
+    PLUGIN_PATH_3 = join12(SESSION_DIR_3, "synkro-channel.ts");
+    PLUGIN_PKG_PATH_3 = join12(SESSION_DIR_3, "package.json");
+    PLUGIN_SETTINGS_DIR_3 = join12(SESSION_DIR_3, ".claude");
+    PLUGIN_SETTINGS_PATH_3 = join12(PLUGIN_SETTINGS_DIR_3, "settings.json");
+    PROJECT_MCP_PATH_3 = join12(SESSION_DIR_3, ".mcp.json");
+    RUN_SCRIPT_PATH_3 = join12(SESSION_DIR_3, "run-claude.sh");
     TMUX_SESSION_NAME_3 = "synkro-local-cc-3";
     CHANNEL_3_PORT = 8942;
-    SESSION_DIR_4 = join11(homedir11(), ".synkro", "cc_sessions_4");
-    PLUGIN_PATH_4 = join11(SESSION_DIR_4, "synkro-channel.ts");
-    PLUGIN_PKG_PATH_4 = join11(SESSION_DIR_4, "package.json");
-    PLUGIN_SETTINGS_DIR_4 = join11(SESSION_DIR_4, ".claude");
-    PLUGIN_SETTINGS_PATH_4 = join11(PLUGIN_SETTINGS_DIR_4, "settings.json");
-    PROJECT_MCP_PATH_4 = join11(SESSION_DIR_4, ".mcp.json");
-    RUN_SCRIPT_PATH_4 = join11(SESSION_DIR_4, "run-claude.sh");
+    SESSION_DIR_4 = join12(homedir12(), ".synkro", "cc_sessions_4");
+    PLUGIN_PATH_4 = join12(SESSION_DIR_4, "synkro-channel.ts");
+    PLUGIN_PKG_PATH_4 = join12(SESSION_DIR_4, "package.json");
+    PLUGIN_SETTINGS_DIR_4 = join12(SESSION_DIR_4, ".claude");
+    PLUGIN_SETTINGS_PATH_4 = join12(PLUGIN_SETTINGS_DIR_4, "settings.json");
+    PROJECT_MCP_PATH_4 = join12(SESSION_DIR_4, ".mcp.json");
+    RUN_SCRIPT_PATH_4 = join12(SESSION_DIR_4, "run-claude.sh");
     TMUX_SESSION_NAME_4 = "synkro-local-cc-4";
     CHANNEL_4_PORT = 8952;
     RUN_SCRIPT_SOURCE = `#!/usr/bin/env bash
@@ -13841,10 +14097,10 @@ var disconnect_exports = {};
 __export(disconnect_exports, {
   disconnectCommand: () => disconnectCommand
 });
-import { existsSync as existsSync13, rmSync, readdirSync as readdirSync4 } from "fs";
-import { homedir as homedir12 } from "os";
-import { join as join12 } from "path";
-import { spawnSync as spawnSync6 } from "child_process";
+import { existsSync as existsSync14, rmSync as rmSync2, readdirSync as readdirSync4 } from "fs";
+import { homedir as homedir13 } from "os";
+import { join as join13 } from "path";
+import { spawnSync as spawnSync7 } from "child_process";
 import { createInterface as createInterface4 } from "readline";
 async function tearDownLocalCC() {
   const docker = dockerStatus();
@@ -13858,7 +14114,7 @@ async function tearDownLocalCC() {
   console.log("\u2713 removed synkro-server container");
   try {
     const image = imageTag();
-    const r = spawnSync6("docker", ["rmi", "-f", image], { encoding: "utf-8", timeout: 3e4 });
+    const r = spawnSync7("docker", ["rmi", "-f", image], { encoding: "utf-8", timeout: 3e4 });
     console.log(r.status === 0 ? `\u2713 removed Docker image ${image}` : "\xB7 no Docker image to remove");
   } catch {
   }
@@ -13921,34 +14177,34 @@ async function disconnectCommand(args2 = []) {
     const desktopMcpRemoved = uninstallClaudeDesktopMcpConfig();
     console.log(`${desktopMcpRemoved ? "\u2713" : "\xB7"} MCP guardrails (Claude Desktop): ${desktopMcpRemoved ? "removed from claude_desktop_config.json" : "no entry found"}`);
   }
-  if (existsSync13(SYNKRO_DIR6)) {
+  if (existsSync14(SYNKRO_DIR7)) {
     if (purge) {
-      rmSync(SYNKRO_DIR6, { recursive: true, force: true });
-      console.log(`\u2713 wiped ${SYNKRO_DIR6} entirely \u2014 including all scan data and backups`);
+      rmSync2(SYNKRO_DIR7, { recursive: true, force: true });
+      console.log(`\u2713 wiped ${SYNKRO_DIR7} entirely \u2014 including all scan data and backups`);
     } else {
-      const keep = /* @__PURE__ */ new Set([join12(SYNKRO_DIR6, "pgdata"), join12(SYNKRO_DIR6, "pgdata-backups")]);
+      const keep = /* @__PURE__ */ new Set([join13(SYNKRO_DIR7, "pgdata"), join13(SYNKRO_DIR7, "pgdata-backups")]);
       const preserved = [];
-      for (const entry of readdirSync4(SYNKRO_DIR6)) {
-        const full = join12(SYNKRO_DIR6, entry);
+      for (const entry of readdirSync4(SYNKRO_DIR7)) {
+        const full = join13(SYNKRO_DIR7, entry);
         if (keep.has(full)) {
           preserved.push(entry);
           continue;
         }
-        rmSync(full, { recursive: true, force: true });
+        rmSync2(full, { recursive: true, force: true });
       }
       if (preserved.length > 0) {
-        console.log(`\u2713 removed Synkro config from ${SYNKRO_DIR6} (kept your scan data: ${preserved.join(", ")})`);
+        console.log(`\u2713 removed Synkro config from ${SYNKRO_DIR7} (kept your scan data: ${preserved.join(", ")})`);
         console.log("  run `synkro uninstall --purge` to delete that too");
       } else {
-        console.log(`\u2713 removed ${SYNKRO_DIR6}`);
+        console.log(`\u2713 removed ${SYNKRO_DIR7}`);
       }
     }
   } else {
-    console.log(`\xB7 ${SYNKRO_DIR6} already gone`);
+    console.log(`\xB7 ${SYNKRO_DIR7} already gone`);
   }
   console.log(purge ? "\nSynkro fully removed \u2014 this machine is clean, as if it was never installed." : "\nSynkro uninstalled. Your scan data is preserved.");
 }
-var SYNKRO_DIR6;
+var SYNKRO_DIR7;
 var init_disconnect = __esm({
   "cli/commands/disconnect.ts"() {
     "use strict";
@@ -13959,14 +14215,14 @@ var init_disconnect = __esm({
     init_install2();
     init_dockerInstall();
     init_macKeychain();
-    SYNKRO_DIR6 = join12(homedir12(), ".synkro");
+    SYNKRO_DIR7 = join13(homedir13(), ".synkro");
   }
 });
 
 // cli/local-cc/turnLog.ts
-import { appendFileSync, existsSync as existsSync14, mkdirSync as mkdirSync11, openSync as openSync2, readFileSync as readFileSync12, readSync, closeSync as closeSync2, statSync as statSync2, watchFile, unwatchFile } from "fs";
-import { dirname as dirname6, join as join13 } from "path";
-import { homedir as homedir13 } from "os";
+import { appendFileSync, existsSync as existsSync15, mkdirSync as mkdirSync12, openSync as openSync2, readFileSync as readFileSync13, readSync, closeSync as closeSync2, statSync as statSync2, watchFile, unwatchFile } from "fs";
+import { dirname as dirname6, join as join14 } from "path";
+import { homedir as homedir14 } from "os";
 function truncate(s, max = PREVIEW_MAX) {
   if (s.length <= max) return s;
   return s.slice(0, max) + "\u2026 [+" + (s.length - max) + " chars]";
@@ -13986,7 +14242,7 @@ function extractSeverity(result) {
 }
 function appendTurn(args2) {
   try {
-    mkdirSync11(dirname6(TURN_LOG_PATH), { recursive: true });
+    mkdirSync12(dirname6(TURN_LOG_PATH), { recursive: true });
     const entry = {
       ts: new Date(args2.startedAt).toISOString(),
       role: args2.role,
@@ -14002,11 +14258,11 @@ function appendTurn(args2) {
   }
 }
 function readRecentTurns(n = 20) {
-  if (!existsSync14(TURN_LOG_PATH)) return [];
+  if (!existsSync15(TURN_LOG_PATH)) return [];
   try {
     const size = statSync2(TURN_LOG_PATH).size;
     if (size === 0) return [];
-    const text = readFileSync12(TURN_LOG_PATH, "utf-8");
+    const text = readFileSync13(TURN_LOG_PATH, "utf-8");
     const lines = text.split("\n").filter(Boolean);
     const lastN = lines.slice(-n).reverse();
     return lastN.map((line) => {
@@ -14022,8 +14278,8 @@ function readRecentTurns(n = 20) {
 }
 function followTurns(onEntry) {
   try {
-    mkdirSync11(dirname6(TURN_LOG_PATH), { recursive: true });
-    if (!existsSync14(TURN_LOG_PATH)) {
+    mkdirSync12(dirname6(TURN_LOG_PATH), { recursive: true });
+    if (!existsSync15(TURN_LOG_PATH)) {
       appendFileSync(TURN_LOG_PATH, "", "utf-8");
     }
   } catch {
@@ -14085,7 +14341,7 @@ var TURN_LOG_PATH, PREVIEW_MAX;
 var init_turnLog = __esm({
   "cli/local-cc/turnLog.ts"() {
     "use strict";
-    TURN_LOG_PATH = join13(homedir13(), ".synkro", "cc_sessions", "turns.log");
+    TURN_LOG_PATH = join14(homedir14(), ".synkro", "cc_sessions", "turns.log");
     PREVIEW_MAX = 400;
   }
 });
@@ -14234,19 +14490,19 @@ var init_grade = __esm({
 });
 
 // cli/local-cc/pueue.ts
-import { execFileSync as execFileSync3, spawnSync as spawnSync7, spawn as spawn2 } from "child_process";
-import { homedir as homedir14 } from "os";
-import { join as join14 } from "path";
+import { execFileSync as execFileSync3, spawnSync as spawnSync8, spawn as spawn2 } from "child_process";
+import { homedir as homedir15 } from "os";
+import { join as join15 } from "path";
 import { connect as connect2 } from "net";
 function pueueAvailable() {
-  const r = spawnSync7("pueue", ["--version"], { encoding: "utf-8" });
+  const r = spawnSync8("pueue", ["--version"], { encoding: "utf-8" });
   if (r.status !== 0) {
     throw new PueueError("pueue CLI not found on PATH. Install pueue (https://github.com/Nukesor/pueue) and start `pueued`.");
   }
 }
 function statusJson() {
   pueueAvailable();
-  const r = spawnSync7("pueue", ["status", "--json"], { encoding: "utf-8" });
+  const r = spawnSync8("pueue", ["status", "--json"], { encoding: "utf-8" });
   if (r.status !== 0) {
     throw new PueueError(`pueue status failed: ${r.stderr || r.stdout || "unknown error"} \u2014 is pueued running?`);
   }
@@ -14291,18 +14547,18 @@ function startTask(opts = {}) {
   let existing = findTask(ch);
   while (existing) {
     if (existing.status === "Running" || existing.status === "Queued") {
-      spawnSync7("tmux", ["kill-session", "-t", `=${ch.tmuxSession}`], { encoding: "utf-8" });
-      spawnSync7("pueue", ["kill", String(existing.id)], { encoding: "utf-8" });
+      spawnSync8("tmux", ["kill-session", "-t", `=${ch.tmuxSession}`], { encoding: "utf-8" });
+      spawnSync8("pueue", ["kill", String(existing.id)], { encoding: "utf-8" });
       for (let i = 0; i < 10; i++) {
         const check = findTask(ch);
         if (!check || check.id !== existing.id || check.status !== "Running" && check.status !== "Queued") break;
-        spawnSync7("sleep", ["0.5"], { encoding: "utf-8" });
+        spawnSync8("sleep", ["0.5"], { encoding: "utf-8" });
       }
     }
-    spawnSync7("pueue", ["remove", String(existing.id)], { encoding: "utf-8" });
+    spawnSync8("pueue", ["remove", String(existing.id)], { encoding: "utf-8" });
     existing = findTask(ch);
   }
-  const runScript = join14(cwd, "run-claude.sh");
+  const runScript = join15(cwd, "run-claude.sh");
   const args2 = [
     "add",
     "--label",
@@ -14313,7 +14569,7 @@ function startTask(opts = {}) {
     "bash",
     runScript
   ];
-  const r = spawnSync7("pueue", args2, { encoding: "utf-8" });
+  const r = spawnSync8("pueue", args2, { encoding: "utf-8" });
   if (r.status !== 0) {
     throw new PueueError(`pueue add failed: ${r.stderr || r.stdout}`);
   }
@@ -14324,25 +14580,25 @@ function startTask(opts = {}) {
   return created;
 }
 function stopTask(channel = CHANNEL_PRIMARY) {
-  spawnSync7("tmux", ["kill-session", "-t", `=${channel.tmuxSession}`], { encoding: "utf-8" });
+  spawnSync8("tmux", ["kill-session", "-t", `=${channel.tmuxSession}`], { encoding: "utf-8" });
   let t = findTask(channel);
   while (t) {
     if (t.status === "Running" || t.status === "Queued") {
-      spawnSync7("pueue", ["kill", String(t.id)], { encoding: "utf-8" });
+      spawnSync8("pueue", ["kill", String(t.id)], { encoding: "utf-8" });
       for (let i = 0; i < 10; i++) {
         const check = findTask(channel);
         if (!check || check.id !== t.id || check.status !== "Running" && check.status !== "Queued") break;
-        spawnSync7("sleep", ["0.5"], { encoding: "utf-8" });
+        spawnSync8("sleep", ["0.5"], { encoding: "utf-8" });
       }
     }
-    spawnSync7("pueue", ["remove", String(t.id)], { encoding: "utf-8" });
+    spawnSync8("pueue", ["remove", String(t.id)], { encoding: "utf-8" });
     t = findTask(channel);
   }
 }
 function tailLogs(lines = 80, channel = CHANNEL_PRIMARY) {
   const t = findTask(channel);
   if (!t) return `(no ${channel.taskLabel} task)`;
-  const r = spawnSync7("pueue", ["log", "--lines", String(lines), String(t.id)], { encoding: "utf-8" });
+  const r = spawnSync8("pueue", ["log", "--lines", String(lines), String(t.id)], { encoding: "utf-8" });
   return r.stdout || r.stderr || "(no output)";
 }
 function ensureRunning(opts = {}) {
@@ -14367,8 +14623,8 @@ function probePort(host, port, timeoutMs = 500) {
   });
 }
 function tmuxDismissPrompts(tmuxSession = TMUX_SESSION) {
-  spawnSync7("tmux", ["send-keys", "-t", tmuxSession, "1"], { encoding: "utf-8" });
-  spawnSync7("tmux", ["send-keys", "-t", tmuxSession, "Enter"], { encoding: "utf-8" });
+  spawnSync8("tmux", ["send-keys", "-t", tmuxSession, "1"], { encoding: "utf-8" });
+  spawnSync8("tmux", ["send-keys", "-t", tmuxSession, "Enter"], { encoding: "utf-8" });
 }
 async function waitForChannelReady(port, timeoutMs = 6e4, host = "127.0.0.1", tmuxSession = TMUX_SESSION) {
   const deadline = Date.now() + timeoutMs;
@@ -14380,46 +14636,46 @@ async function waitForChannelReady(port, timeoutMs = 6e4, host = "127.0.0.1", tm
   return probePort(host, port);
 }
 function brewInstall(pkg) {
-  const brew = spawnSync7("brew", ["--version"], { encoding: "utf-8" });
+  const brew = spawnSync8("brew", ["--version"], { encoding: "utf-8" });
   if (brew.status !== 0) return false;
   console.log(`  Installing ${pkg} via brew...`);
-  const r = spawnSync7("brew", ["install", pkg], { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
+  const r = spawnSync8("brew", ["install", pkg], { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
   return r.status === 0;
 }
 function assertPueueInstalled() {
-  let r = spawnSync7("pueue", ["--version"], { encoding: "utf-8" });
+  let r = spawnSync8("pueue", ["--version"], { encoding: "utf-8" });
   if (r.status !== 0) {
     if (process.platform === "darwin" && brewInstall("pueue")) {
-      r = spawnSync7("pueue", ["--version"], { encoding: "utf-8" });
+      r = spawnSync8("pueue", ["--version"], { encoding: "utf-8" });
       if (r.status !== 0) throw new PueueError("pueue install succeeded but binary not found on PATH.");
     } else {
       throw new PueueError("pueue not found. Install it: brew install pueue (macOS) or https://github.com/Nukesor/pueue");
     }
   }
-  const status = spawnSync7("pueue", ["status", "--json"], { encoding: "utf-8", timeout: 5e3 });
+  const status = spawnSync8("pueue", ["status", "--json"], { encoding: "utf-8", timeout: 5e3 });
   if (status.status !== 0) {
     console.log("  Starting pueued daemon...");
     const child = spawn2("pueued", ["-d"], { stdio: "ignore", detached: true });
     child.unref();
-    spawnSync7("sleep", ["1"]);
-    const retry = spawnSync7("pueue", ["status", "--json"], { encoding: "utf-8", timeout: 5e3 });
+    spawnSync8("sleep", ["1"]);
+    const retry = spawnSync8("pueue", ["status", "--json"], { encoding: "utf-8", timeout: 5e3 });
     if (retry.status !== 0) {
       throw new PueueError("pueue daemon not reachable after starting pueued. Check `pueued` manually.");
     }
   }
-  spawnSync7("pueue", ["parallel", "2"], { encoding: "utf-8" });
+  spawnSync8("pueue", ["parallel", "2"], { encoding: "utf-8" });
 }
 function assertClaudeInstalled() {
-  const r = spawnSync7("claude", ["--version"], { encoding: "utf-8" });
+  const r = spawnSync8("claude", ["--version"], { encoding: "utf-8" });
   if (r.status !== 0) {
     throw new PueueError("claude CLI not found on PATH. Install Claude Code first: https://docs.claude.com/claude-code");
   }
 }
 function assertTmuxInstalled() {
-  let r = spawnSync7("tmux", ["-V"], { encoding: "utf-8" });
+  let r = spawnSync8("tmux", ["-V"], { encoding: "utf-8" });
   if (r.status !== 0) {
     if (process.platform === "darwin" && brewInstall("tmux")) {
-      r = spawnSync7("tmux", ["-V"], { encoding: "utf-8" });
+      r = spawnSync8("tmux", ["-V"], { encoding: "utf-8" });
       if (r.status !== 0) throw new PueueError("tmux install succeeded but binary not found on PATH.");
     } else {
       throw new PueueError("tmux not found. Install it: brew install tmux (macOS) or apt install tmux (Linux)");
@@ -14432,12 +14688,12 @@ var init_pueue = __esm({
     "use strict";
     TASK_LABEL = "synkro-local-cc";
     TMUX_SESSION = "synkro-local-cc";
-    SESSION_DIR2 = join14(homedir14(), ".synkro", "cc_sessions");
+    SESSION_DIR2 = join15(homedir15(), ".synkro", "cc_sessions");
     TASK_LABEL_2 = "synkro-local-cc-2";
     TMUX_SESSION_2 = "synkro-local-cc-2";
-    SESSION_DIR_22 = join14(homedir14(), ".synkro", "cc_sessions_2");
-    SESSION_DIR_32 = join14(homedir14(), ".synkro", "cc_sessions_3");
-    SESSION_DIR_42 = join14(homedir14(), ".synkro", "cc_sessions_4");
+    SESSION_DIR_22 = join15(homedir15(), ".synkro", "cc_sessions_2");
+    SESSION_DIR_32 = join15(homedir15(), ".synkro", "cc_sessions_3");
+    SESSION_DIR_42 = join15(homedir15(), ".synkro", "cc_sessions_4");
     PueueError = class extends Error {
       constructor(message, cause) {
         super(message);
@@ -14452,13 +14708,13 @@ var init_pueue = __esm({
 });
 
 // cli/local-cc/settings.ts
-import { existsSync as existsSync15, readFileSync as readFileSync13 } from "fs";
-import { homedir as homedir15 } from "os";
-import { join as join15 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync14 } from "fs";
+import { homedir as homedir16 } from "os";
+import { join as join16 } from "path";
 function isLocalCCEnabled() {
-  if (!existsSync15(CONFIG_PATH3)) return false;
+  if (!existsSync16(CONFIG_PATH3)) return false;
   try {
-    const content = readFileSync13(CONFIG_PATH3, "utf-8");
+    const content = readFileSync14(CONFIG_PATH3, "utf-8");
     const match = content.match(/^SYNKRO_LOCAL_INFERENCE='([^']*)'/m);
     return match?.[1] === "yes";
   } catch {
@@ -14469,7 +14725,7 @@ var CONFIG_PATH3;
 var init_settings = __esm({
   "cli/local-cc/settings.ts"() {
     "use strict";
-    CONFIG_PATH3 = join15(homedir15(), ".synkro", "config.env");
+    CONFIG_PATH3 = join16(homedir16(), ".synkro", "config.env");
   }
 });
 
@@ -14478,11 +14734,11 @@ var localCc_exports = {};
 __export(localCc_exports, {
   localCcCommand: () => localCcCommand
 });
-import { spawnSync as spawnSync8 } from "child_process";
-import { homedir as homedir16 } from "os";
-import { join as join16 } from "path";
+import { spawnSync as spawnSync9 } from "child_process";
+import { homedir as homedir17 } from "os";
+import { join as join17 } from "path";
 import { readFileSync as fsReadFileSync, existsSync as fsExistsSync } from "fs";
-import { existsSync as existsSync16, readFileSync as readFileSync14, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync17, readFileSync as readFileSync15, writeFileSync as writeFileSync10 } from "fs";
 function deploymentMode() {
   const env = (process.env.SYNKRO_DEPLOYMENT_MODE || "").toLowerCase();
   if (env === "docker") return "docker";
@@ -14588,15 +14844,15 @@ TROUBLESHOOTING
 `);
 }
 function readGatewayUrl() {
-  if (existsSync16(CONFIG_PATH4)) {
-    const m = readFileSync14(CONFIG_PATH4, "utf-8").match(/^SYNKRO_GATEWAY_URL='([^']*)'/m);
+  if (existsSync17(CONFIG_PATH4)) {
+    const m = readFileSync15(CONFIG_PATH4, "utf-8").match(/^SYNKRO_GATEWAY_URL='([^']*)'/m);
     if (m) return m[1];
   }
   return "https://api.synkro.sh";
 }
 function updateLocalInferenceFlag(enabled) {
-  if (!existsSync16(CONFIG_PATH4)) return;
-  let content = readFileSync14(CONFIG_PATH4, "utf-8");
+  if (!existsSync17(CONFIG_PATH4)) return;
+  let content = readFileSync15(CONFIG_PATH4, "utf-8");
   const flag = enabled ? "yes" : "no";
   if (content.includes("SYNKRO_LOCAL_INFERENCE=")) {
     content = content.replace(/^SYNKRO_LOCAL_INFERENCE='[^']*'/m, `SYNKRO_LOCAL_INFERENCE='${flag}'`);
@@ -14659,7 +14915,7 @@ async function cmdStatus() {
   }
   const ch1Up = await isChannelAvailable();
   console.log(`Channel 1 ${CHANNEL_HOST}:${CHANNEL_PORT}: ${ch1Up ? "reachable" : "unreachable"}`);
-  const tmux1 = spawnSync8("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME}`], { encoding: "utf-8" });
+  const tmux1 = spawnSync9("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME}`], { encoding: "utf-8" });
   console.log(`tmux '${TMUX_SESSION_NAME}': ${tmux1.status === 0 ? "live" : "absent"}`);
   const t2 = findTask(CHANNEL_SECONDARY);
   if (!t2) {
@@ -14669,7 +14925,7 @@ async function cmdStatus() {
   }
   const ch2Up = await isChannelAvailable(CHANNEL_2_PORT);
   console.log(`Channel 2 ${CHANNEL_HOST}:${CHANNEL_2_PORT}: ${ch2Up ? "reachable" : "unreachable"}`);
-  const tmux2 = spawnSync8("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME_2}`], { encoding: "utf-8" });
+  const tmux2 = spawnSync9("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME_2}`], { encoding: "utf-8" });
   console.log(`tmux '${TMUX_SESSION_NAME_2}': ${tmux2.status === 0 ? "live" : "absent"}`);
 }
 async function cmdEnable() {
@@ -14875,7 +15131,7 @@ function cmdLogs(rest) {
       }
       return "200";
     })();
-    spawnSync8("docker", ["logs", "--tail", tailArg, ...followFlag, "synkro-server"], { stdio: "inherit" });
+    spawnSync9("docker", ["logs", "--tail", tailArg, ...followFlag, "synkro-server"], { stdio: "inherit" });
     return;
   }
   for (const arg of rest) {
@@ -14923,7 +15179,7 @@ function cmdLogs(rest) {
 function cmdAttach(rest) {
   assertTmuxInstalled();
   const readonly = rest.some((a) => a === "--readonly" || a === "-r");
-  const has = spawnSync8("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME}`], { encoding: "utf-8" });
+  const has = spawnSync9("tmux", ["has-session", "-t", `=${TMUX_SESSION_NAME}`], { encoding: "utf-8" });
   if (has.status !== 0) {
     console.error(`No tmux session '${TMUX_SESSION_NAME}' running. Start it with: synkro local-cc start`);
     process.exit(1);
@@ -14936,7 +15192,7 @@ function cmdAttach(rest) {
   console.log("Detach with Ctrl-B then D. (Do not press Ctrl-C \u2014 that would interrupt claude.)");
   console.log();
   const args2 = readonly ? ["attach-session", "-r", "-t", TMUX_SESSION_NAME] : ["attach-session", "-t", TMUX_SESSION_NAME];
-  const r = spawnSync8("tmux", args2, { stdio: "inherit" });
+  const r = spawnSync9("tmux", args2, { stdio: "inherit" });
   process.exit(r.status ?? 0);
 }
 async function cmdTest() {
@@ -15037,8 +15293,8 @@ var init_localCc = __esm({
     init_install();
     init_client();
     init_stub();
-    SYNKRO_CONFIG_PATH = join16(homedir16(), ".synkro", "config.env");
-    CONFIG_PATH4 = join16(homedir16(), ".synkro", "config.env");
+    SYNKRO_CONFIG_PATH = join17(homedir17(), ".synkro", "config.env");
+    CONFIG_PATH4 = join17(homedir17(), ".synkro", "config.env");
   }
 });
 
@@ -15047,15 +15303,15 @@ var import_exports = {};
 __export(import_exports, {
   importCommand: () => importCommand
 });
-import { existsSync as existsSync17, readFileSync as readFileSync15, readdirSync as readdirSync5 } from "fs";
-import { homedir as homedir17 } from "os";
-import { join as join17 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync16, readdirSync as readdirSync5 } from "fs";
+import { homedir as homedir18 } from "os";
+import { join as join18 } from "path";
 import { execSync as execSync7 } from "child_process";
 import { createInterface as createInterface5 } from "readline";
 function readConfigEnv() {
   const out = {};
   try {
-    for (const line of readFileSync15(CONFIG_PATH5, "utf-8").split("\n")) {
+    for (const line of readFileSync16(CONFIG_PATH5, "utf-8").split("\n")) {
       const t = line.trim();
       if (!t || t.startsWith("#")) continue;
       const eq = t.indexOf("=");
@@ -15067,8 +15323,8 @@ function readConfigEnv() {
 }
 function projectsFolder() {
   const sanitized = process.cwd().replace(/\//g, "-");
-  const dir = join17(homedir17(), ".claude", "projects", sanitized);
-  return existsSync17(dir) ? dir : null;
+  const dir = join18(homedir18(), ".claude", "projects", sanitized);
+  return existsSync18(dir) ? dir : null;
 }
 function repoName() {
   try {
@@ -15091,7 +15347,7 @@ function extractText(content) {
   return "";
 }
 function parseSession(filePath, sessionId) {
-  const lines = readFileSync15(filePath, "utf-8").split("\n").filter(Boolean);
+  const lines = readFileSync16(filePath, "utf-8").split("\n").filter(Boolean);
   const messages = [];
   const actions = [];
   let step = 0;
@@ -15164,7 +15420,7 @@ async function importCommand() {
       return;
     }
   }
-  const sessions = files.map((f) => parseSession(join17(dir, f), f.replace(".jsonl", ""))).filter((s) => s.messages.length > 0);
+  const sessions = files.map((f) => parseSession(join18(dir, f), f.replace(".jsonl", ""))).filter((s) => s.messages.length > 0);
   const totalMsgs = sessions.reduce((n, s) => n + s.messages.length, 0);
   let ok = 0, fail = 0;
   if (isCloud) {
@@ -15224,7 +15480,7 @@ var init_import = __esm({
   "cli/commands/import.ts"() {
     "use strict";
     init_stub();
-    CONFIG_PATH5 = join17(homedir17(), ".synkro", "config.env");
+    CONFIG_PATH5 = join18(homedir18(), ".synkro", "config.env");
   }
 });
 
@@ -15266,10 +15522,10 @@ var init_packVerify = __esm({
 });
 
 // cli/installer/lockfile.ts
-import { existsSync as existsSync18, readFileSync as readFileSync16, writeFileSync as writeFileSync11 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync17, writeFileSync as writeFileSync11 } from "fs";
+import { join as join19 } from "path";
 function lockPath(repoRoot) {
-  return join18(repoRoot, LOCK_FILE);
+  return join19(repoRoot, LOCK_FILE);
 }
 function writeLockfile(repoRoot, entries) {
   const sorted = [...entries].sort((a, b) => a.ref.localeCompare(b.ref));
@@ -15302,9 +15558,9 @@ var sync_exports = {};
 __export(sync_exports, {
   syncCommand: () => syncCommand
 });
-import { existsSync as existsSync19, mkdirSync as mkdirSync12, readdirSync as readdirSync6, rmSync as rmSync2, writeFileSync as writeFileSync12 } from "fs";
-import { homedir as homedir18 } from "os";
-import { join as join19 } from "path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync13, readdirSync as readdirSync6, rmSync as rmSync3, writeFileSync as writeFileSync12 } from "fs";
+import { homedir as homedir19 } from "os";
+import { join as join20 } from "path";
 function cacheKey(ref, version) {
   return ref.replace(/\//g, "__").replace(/[^\w.@-]/g, "_") + "@" + version + ".json";
 }
@@ -15335,8 +15591,8 @@ async function syncCommand(_args = []) {
   }
   const gateway = (process.env.SYNKRO_GATEWAY_URL || "https://api.synkro.sh").replace(/\/$/, "");
   const cloud = process.env.SYNKRO_DEPLOY_LOCATION === "cloud";
-  const cacheDir = join19(homedir18(), ".synkro", "cache", "packs");
-  if (!cloud) mkdirSync12(cacheDir, { recursive: true });
+  const cacheDir = join20(homedir19(), ".synkro", "cache", "packs");
+  if (!cloud) mkdirSync13(cacheDir, { recursive: true });
   console.log(`Syncing ${refs.length} standard(s) from the registry\u2026`);
   const lock = [];
   const keptCacheFiles = /* @__PURE__ */ new Set();
@@ -15364,7 +15620,7 @@ async function syncCommand(_args = []) {
     if (!cloud) {
       const fname = cacheKey(ref, data.version);
       keptCacheFiles.add(fname);
-      writeFileSync12(join19(cacheDir, fname), JSON.stringify({
+      writeFileSync12(join20(cacheDir, fname), JSON.stringify({
         ref,
         version: data.version,
         digest: data.digest,
@@ -15376,11 +15632,11 @@ async function syncCommand(_args = []) {
     const ruleCount = Array.isArray(pack.rules) ? pack.rules.length : 0;
     console.log(`  \u2713 ${ref}:${data.version} \u2014 verified (${ruleCount} rule${ruleCount === 1 ? "" : "s"})`);
   }
-  if (!cloud && existsSync19(cacheDir)) {
+  if (!cloud && existsSync20(cacheDir)) {
     for (const f of readdirSync6(cacheDir)) {
       if (f.endsWith(".json") && !keptCacheFiles.has(f)) {
         try {
-          rmSync2(join19(cacheDir, f));
+          rmSync3(join20(cacheDir, f));
         } catch {
         }
       }
@@ -15516,13 +15772,13 @@ var config_exports = {};
 __export(config_exports, {
   configCommand: () => configCommand
 });
-import { readFileSync as readFileSync17, writeFileSync as writeFileSync13, existsSync as existsSync20 } from "fs";
-import { join as join20 } from "path";
-import { homedir as homedir19 } from "os";
+import { readFileSync as readFileSync18, writeFileSync as writeFileSync13, existsSync as existsSync21 } from "fs";
+import { join as join21 } from "path";
+import { homedir as homedir20 } from "os";
 function readConfigEnv2() {
-  if (!existsSync20(CONFIG_PATH6)) return {};
+  if (!existsSync21(CONFIG_PATH6)) return {};
   const out = {};
-  for (const line of readFileSync17(CONFIG_PATH6, "utf-8").split("\n")) {
+  for (const line of readFileSync18(CONFIG_PATH6, "utf-8").split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#")) continue;
     const eq = t.indexOf("=");
@@ -15531,11 +15787,11 @@ function readConfigEnv2() {
   return out;
 }
 function updateConfigValue(key, value) {
-  if (!existsSync20(CONFIG_PATH6)) {
+  if (!existsSync21(CONFIG_PATH6)) {
     console.error("No config found. Run `synkro install` first.");
     process.exit(1);
   }
-  const lines = readFileSync17(CONFIG_PATH6, "utf-8").split("\n");
+  const lines = readFileSync18(CONFIG_PATH6, "utf-8").split("\n");
   const pattern = new RegExp(`^${key}=`);
   let found = false;
   const updated = lines.map((line) => {
@@ -15673,25 +15929,25 @@ To change:`);
   }
   if (inferenceValue !== "cloud") await reconcileContainer();
 }
-var SYNKRO_DIR7, CONFIG_PATH6;
+var SYNKRO_DIR8, CONFIG_PATH6;
 var init_config = __esm({
   "cli/commands/config.ts"() {
     "use strict";
     init_stub();
-    SYNKRO_DIR7 = join20(homedir19(), ".synkro");
-    CONFIG_PATH6 = join20(SYNKRO_DIR7, "config.env");
+    SYNKRO_DIR8 = join21(homedir20(), ".synkro");
+    CONFIG_PATH6 = join21(SYNKRO_DIR8, "config.env");
   }
 });
 
 // cli/bootstrap.js
-import { readFileSync as readFileSync18, existsSync as existsSync21 } from "fs";
+import { readFileSync as readFileSync19, existsSync as existsSync22 } from "fs";
 import { resolve as resolve3 } from "path";
 var envCandidates = [
   resolve3(process.env.HOME ?? "", ".synkro", "config.env")
 ];
 for (const envPath of envCandidates) {
-  if (!existsSync21(envPath)) continue;
-  const envContent = readFileSync18(envPath, "utf-8");
+  if (!existsSync22(envPath)) continue;
+  const envContent = readFileSync19(envPath, "utf-8");
   for (const line of envContent.split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -15706,7 +15962,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.7.9");
+  console.log("1.7.24");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents