@synkro-sh/cli 1.7.95 → 1.8.0

package/dist/bootstrap.js

@@ -145,9 +145,9 @@ function hostnameHash() {
 }
 function getIdentity() {
   if (cached2) return cached2;
-  let cliVersion = "0.0.0";
+  let cliVersion2 = "0.0.0";
   try {
-    cliVersion = "1.7.95";
+    cliVersion2 = "1.8.0";
   } catch {
   }
   const creds = loadCredentialsIdentity();
@@ -157,7 +157,7 @@ function getIdentity() {
     user_id: creds.user_id,
     org_id: creds.org_id,
     email: creds.email,
-    cli_version: cliVersion,
+    cli_version: cliVersion2,
     platform: platform(),
     hostname_hash: hostnameHash(),
     node_version: process.version,
@@ -183,8 +183,8 @@ import { appendFileSync, existsSync as existsSync3, mkdirSync as mkdirSync2 } fr
 import { homedir as homedir3 } from "os";
 import { join as join3 } from "path";
 function deriveGit(cwd) {
-  const cached4 = gitCache.get(cwd);
-  if (cached4) return cached4;
+  const cached5 = gitCache.get(cwd);
+  if (cached5) return cached5;
   const info = { branch: null, sha: null };
   try {
     const branch = execFileSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
@@ -1777,6 +1777,27 @@ function uninstallCCHooks(settingsPath) {
   writeSettingsAtomic(settingsPath, settings);
   return true;
 }
+function inspectCCHooks(settingsPath) {
+  if (!existsSync11(settingsPath)) {
+    return { installed: false, preToolUseBash: false, postToolUseEdit: false, sessionEnd: false, sessionStart: false };
+  }
+  const settings = readSettings(settingsPath);
+  const pre = settings.hooks?.PreToolUse ?? [];
+  const post = settings.hooks?.PostToolUse ?? [];
+  const sessionEndHooks = settings.hooks?.SessionEnd ?? [];
+  const sessionStartHooks = settings.hooks?.SessionStart ?? [];
+  const preToolUseBash = pre.some((e) => e?.[SYNKRO_MARKER] === true);
+  const postToolUseEdit = post.some((e) => e?.[SYNKRO_MARKER] === true);
+  const sessionEnd = sessionEndHooks.some((e) => e?.[SYNKRO_MARKER] === true);
+  const sessionStart = sessionStartHooks.some((e) => e?.[SYNKRO_MARKER] === true);
+  return {
+    installed: preToolUseBash || postToolUseEdit || sessionEnd || sessionStart,
+    preToolUseBash,
+    postToolUseEdit,
+    sessionEnd,
+    sessionStart
+  };
+}
 var SYNKRO_MARKER, USAGE_PROXY_URL;
 var init_ccHookConfig = __esm({
   "cli/installer/ccHookConfig.ts"() {
@@ -1985,6 +2006,74 @@ function uninstallCursorHooks(hooksJsonPath) {
   writeHooksFileAtomic(hooksJsonPath, file);
   return true;
 }
+function preToolUseUsesScript(hooks, scriptBasename) {
+  return (hooks ?? []).some(
+    (e) => isSynkroEntry2(e) && typeof e.command === "string" && e.command.includes(scriptBasename)
+  );
+}
+function inspectCursorHooks(hooksJsonPath) {
+  let file;
+  try {
+    file = readHooksFile(hooksJsonPath);
+  } catch {
+    return {
+      installed: false,
+      sessionStart: false,
+      sessionEnd: false,
+      beforeSubmitPrompt: false,
+      stop: false,
+      beforeShellExecution: false,
+      afterShellExecution: false,
+      preToolUse: false,
+      preToolUseBash: false,
+      preToolUseEdit: false,
+      preToolUseCwe: false,
+      preToolUseCve: false,
+      preToolUseAgent: false,
+      preToolUsePlan: false,
+      afterFileEdit: false,
+      postToolUse: false,
+      beforeMCPExecution: false
+    };
+  }
+  const h = file.hooks ?? {};
+  const sessionStart = (h.sessionStart ?? []).some((e) => isSynkroEntry2(e));
+  const sessionEnd = (h.sessionEnd ?? []).some((e) => isSynkroEntry2(e));
+  const beforeSubmitPrompt = (h.beforeSubmitPrompt ?? []).some((e) => isSynkroEntry2(e));
+  const stop = (h.stop ?? []).some((e) => isSynkroEntry2(e));
+  const beforeShellExecution = (h.beforeShellExecution ?? []).some((e) => isSynkroEntry2(e));
+  const afterShellExecution = (h.afterShellExecution ?? []).some((e) => isSynkroEntry2(e));
+  const pre = h.preToolUse ?? [];
+  const preToolUseBash = preToolUseUsesScript(pre, "cc-bash-judge") || preToolUseUsesScript(pre, "cursor-bash-judge");
+  const preToolUseEdit = preToolUseUsesScript(pre, "cc-edit-precheck") || preToolUseUsesScript(pre, "cursor-edit-precheck");
+  const preToolUseCwe = preToolUseUsesScript(pre, "cc-cwe-precheck");
+  const preToolUseCve = preToolUseUsesScript(pre, "cc-cve-precheck");
+  const preToolUseAgent = preToolUseUsesScript(pre, "cc-agent-judge");
+  const preToolUsePlan = preToolUseUsesScript(pre, "cc-plan-judge");
+  const preToolUse = preToolUseBash || preToolUseEdit || preToolUseCwe || preToolUseCve || preToolUseAgent || preToolUsePlan;
+  const afterFileEdit = (h.afterFileEdit ?? []).some((e) => isSynkroEntry2(e));
+  const postToolUse = (h.postToolUse ?? []).some((e) => isSynkroEntry2(e));
+  const beforeMCPExecution = (h.beforeMCPExecution ?? []).some((e) => isSynkroEntry2(e));
+  return {
+    installed: sessionStart || sessionEnd || beforeSubmitPrompt || stop || beforeShellExecution || afterShellExecution || preToolUse || afterFileEdit || postToolUse || beforeMCPExecution,
+    sessionStart,
+    sessionEnd,
+    beforeSubmitPrompt,
+    stop,
+    beforeShellExecution,
+    afterShellExecution,
+    preToolUse,
+    preToolUseBash,
+    preToolUseEdit,
+    preToolUseCwe,
+    preToolUseCve,
+    preToolUseAgent,
+    preToolUsePlan,
+    afterFileEdit,
+    postToolUse,
+    beforeMCPExecution
+  };
+}
 var SYNKRO_MARKER2, ALLOWED_PARENT_DIRS, ALL_EVENTS;
 var init_cursorHookConfig = __esm({
   "cli/installer/cursorHookConfig.ts"() {
@@ -2128,6 +2217,52 @@ function uninstallCodexHooks(hooksJsonPath) {
   writeHooksFileAtomic2(hooksJsonPath, file);
   return true;
 }
+function inspectCodexHooks(hooksJsonPath) {
+  let file;
+  try {
+    file = readHooksFile2(hooksJsonPath);
+  } catch {
+    return {
+      installed: false,
+      preToolUse: false,
+      preToolUseEdit: false,
+      preToolUseCwe: false,
+      preToolUseCve: false,
+      postToolUse: false,
+      postToolUseEdit: false,
+      sessionStart: false,
+      sessionEnd: false
+    };
+  }
+  const h = file.hooks ?? {};
+  const preToolUse = (h.PreToolUse ?? []).some((e) => isSynkroEntry3(e));
+  const editEntries = (h.PreToolUse ?? []).filter(
+    (e) => typeof e?.matcher === "string" && (e.matcher.includes("apply_patch") || e.matcher.includes("ApplyPatch") || e.matcher.includes("Edit"))
+  );
+  const entryUsesScript = (needle) => editEntries.some(
+    (entry) => (entry.hooks ?? []).some((handler) => String(handler?.command || "").includes(needle))
+  );
+  const preToolUseEdit = entryUsesScript("cc-edit-precheck");
+  const preToolUseCwe = entryUsesScript("cc-cwe-precheck");
+  const preToolUseCve = entryUsesScript("cc-cve-precheck");
+  const postToolUse = (h.PostToolUse ?? []).some((e) => isSynkroEntry3(e));
+  const postToolUseEdit = (h.PostToolUse ?? []).some(
+    (entry) => entry.matcher === CODEX_EDIT_MATCHER && (entry.hooks ?? []).some((handler) => String(handler?.command || "").includes("cc-edit-followup"))
+  );
+  const sessionStart = (h.SessionStart ?? []).some((e) => isSynkroEntry3(e));
+  const sessionEnd = (h.SessionEnd ?? []).some((e) => isSynkroEntry3(e));
+  return {
+    installed: preToolUseEdit && preToolUseCwe && preToolUseCve && postToolUseEdit,
+    preToolUse,
+    preToolUseEdit,
+    preToolUseCwe,
+    preToolUseCve,
+    postToolUse,
+    postToolUseEdit,
+    sessionStart,
+    sessionEnd
+  };
+}
 var SYNKRO_MARKER3, CODEX_BASH_MATCHER, M_BASH, CODEX_EDIT_MATCHER, M_EDIT, M_AGENT, M_MCP, M_ACTIVATE, ALL_EVENTS2;
 var init_codexHookConfig = __esm({
   "cli/installer/codexHookConfig.ts"() {
@@ -2189,7 +2324,7 @@ function buildCodexHookTrustEdits(hooks) {
   return [...edits.values()];
 }
 function queryCodexHookTrust(codexBinary = "codex", cwd = process.cwd(), autoTrust = false) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     let settled = false;
     let stdout = "";
     let pending = "";
@@ -2207,7 +2342,7 @@ function queryCodexHookTrust(codexBinary = "codex", cwd = process.cwd(), autoTru
         child.kill();
       } catch {
       }
-      resolve6(summary);
+      resolve7(summary);
     };
     const timer = setTimeout(() => finish(null), 1e4);
     try {
@@ -2763,9 +2898,9 @@ var init_hookScriptsTs = __esm({
   "cli/installer/hookScriptsTs.ts"() {
     "use strict";
     STUB_COMMON_TS = String.raw`import { existsSync, readFileSync, readdirSync, mkdirSync, writeFileSync, appendFileSync, statSync, realpathSync, openSync, readSync, closeSync } from 'node:fs';
-import { execSync } from 'node:child_process';
+import { execFileSync, execSync } from 'node:child_process';
 import { homedir } from 'node:os';
-import { basename, join, resolve, relative, isAbsolute } from 'node:path';
+import { basename, dirname, join, resolve, relative, isAbsolute } from 'node:path';
 import { randomUUID, createHash } from 'node:crypto';
 
 const HOME = homedir();
@@ -3001,6 +3136,453 @@ function gitRoot(cwd: string): string {
   } catch { return ''; }
 }
 
+function taskRepoContext(root: string): any {
+  if (!root) return undefined;
+  try {
+    const run = (args: string[]) => execFileSync('git', args, {
+      cwd: root,
+      timeout: 2000,
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    }).trim();
+    const branch = run(['rev-parse', '--abbrev-ref', 'HEAD']);
+    const sha = run(['rev-parse', 'HEAD']);
+    const remote = run(['remote', 'get-url', 'origin']);
+    if (!branch || !sha || !remote) return undefined;
+    let baseBranch = branch === 'HEAD' ? '' : branch;
+    let baseSha = sha;
+    try {
+      const remoteHead = run(['symbolic-ref', '--quiet', '--short', 'refs/remotes/origin/HEAD']);
+      if (remoteHead.startsWith('origin/')) {
+        baseBranch = remoteHead.slice('origin/'.length);
+        baseSha = run(['rev-parse', remoteHead]);
+      }
+    } catch {}
+    if (!baseBranch || baseBranch === branch) {
+      for (const candidate of ['main', 'master']) {
+        try {
+          let candidateSha = '';
+          try { candidateSha = run(['rev-parse', '--verify', 'refs/remotes/origin/' + candidate]); }
+          catch { candidateSha = run(['rev-parse', '--verify', 'refs/heads/' + candidate]); }
+          if (candidateSha) {
+            baseBranch = candidate;
+            baseSha = candidateSha;
+            break;
+          }
+        } catch {
+          continue;
+        }
+      }
+    }
+    if (!baseBranch || !baseSha) return undefined;
+    let worktree = false;
+    try { worktree = statSync(join(root, '.git')).isFile(); } catch {}
+    const commonRoot = sharedRepoRoot(root);
+    return { root, commonRoot, remote, branch, sha, baseBranch, baseSha, worktree };
+  } catch { return undefined; }
+}
+
+function taskScmBlockResponse(harness: string, reason: string): string {
+  const message = '[synkro:scm] ' + reason;
+  if (harness === 'cursor') return JSON.stringify({ permission: 'deny', user_message: message, agent_message: message });
+  return JSON.stringify({
+    systemMessage: message,
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'deny',
+      permissionDecisionReason: message,
+      additionalContext: message + ' Resolve the repository state, then retry the tool call.',
+    },
+  });
+}
+
+function safeTaskBranch(value: string): boolean {
+  return /^[a-z][a-z0-9]*-[0-9]+\/[a-z0-9][a-z0-9-]{0,47}$/.test(value);
+}
+
+function gitOutput(root: string, args: string[], timeout = 5000): string {
+  return execFileSync('git', args, {
+    cwd: root,
+    timeout,
+    encoding: 'utf-8',
+    stdio: ['pipe', 'pipe', 'pipe'],
+  }).trim();
+}
+
+function gitSucceeds(root: string, args: string[]): boolean {
+  try { execFileSync('git', args, { cwd: root, timeout: 5000, stdio: 'ignore' }); return true; }
+  catch { return false; }
+}
+
+function samePath(left: string, right: string): boolean {
+  try { return realpathSync(left) === realpathSync(right); }
+  catch { return resolve(left) === resolve(right); }
+}
+
+function sharedRepoRoot(root: string): string {
+  const raw = gitOutput(root, ['rev-parse', '--git-common-dir']);
+  const common = resolve(root, raw);
+  if (basename(common) !== '.git') {
+    throw new Error('task worktrees require a non-bare repository with shared Git metadata');
+  }
+  return dirname(common);
+}
+
+function taskWorktreePath(root: string, taskId: string): string {
+  return join(sharedRepoRoot(root), '.synkro-worktrees', taskId);
+}
+
+function codexDesktopOrigin(): boolean {
+  const origin = String(process.env.CODEX_INTERNAL_ORIGINATOR_OVERRIDE || '').toLowerCase();
+  const bundle = String(process.env.__CFBundleIdentifier || '').toLowerCase();
+  return origin === 'codex desktop' || bundle === 'com.openai.codex';
+}
+
+function ignoreManagedWorktreeDirectory(root: string): void {
+  const common = join(sharedRepoRoot(root), '.git');
+  const excludePath = join(common, 'info', 'exclude');
+  const entry = '.synkro-worktrees/';
+  let existing = '';
+  try { existing = readFileSync(excludePath, 'utf-8'); } catch {}
+  if (existing.split(/\r?\n/).includes(entry)) return;
+  mkdirSync(dirname(excludePath), { recursive: true });
+  appendFileSync(excludePath, (existing && !existing.endsWith('\n') ? '\n' : '') + entry + '\n');
+}
+
+interface TaskWorktreeRecord { path: string; branch: string }
+
+function taskWorktreeRecords(root: string): TaskWorktreeRecord[] {
+  const records: TaskWorktreeRecord[] = [];
+  let current: TaskWorktreeRecord = { path: '', branch: '' };
+  const flush = () => {
+    if (current.path) records.push(current);
+    current = { path: '', branch: '' };
+  };
+  for (const line of (gitOutput(root, ['worktree', 'list', '--porcelain']) + '\n').split('\n')) {
+    if (!line) { flush(); continue; }
+    if (line.startsWith('worktree ')) current.path = line.slice('worktree '.length);
+    else if (line.startsWith('branch refs/heads/')) current.branch = line.slice('branch refs/heads/'.length);
+  }
+  return records;
+}
+
+function gitOperationInProgress(root: string): boolean {
+  if (gitSucceeds(root, ['rev-parse', '--verify', '--quiet', 'MERGE_HEAD'])) return true;
+  for (const state of ['rebase-merge', 'rebase-apply']) {
+    try {
+      const raw = gitOutput(root, ['rev-parse', '--git-path', state]);
+      const path = isAbsolute(raw) ? raw : resolve(root, raw);
+      if (existsSync(path)) return true;
+    } catch {}
+  }
+  return false;
+}
+
+function validateTaskWorktree(root: string, currentRoot: string, op: any): string {
+  const expected = taskWorktreePath(root, String(op.taskId || ''));
+  const supplied = String(op.worktreePath || '');
+  const managed = Boolean(supplied) && samePath(supplied, expected);
+  const nativeCurrent = Boolean(supplied) && samePath(supplied, currentRoot);
+  if (!managed && !nativeCurrent) {
+    throw new Error('task worktree path does not match the managed or current native workspace');
+  }
+  const record = taskWorktreeRecords(root).find((item) => samePath(item.path, supplied));
+  if (!record || record.branch !== String(op.branchName || '')) {
+    throw new Error('task worktree is stale or no longer owns the canonical branch');
+  }
+  if (gitOutput(supplied, ['rev-parse', '--abbrev-ref', 'HEAD']) !== String(op.branchName || '')) {
+    throw new Error('task worktree is not on the canonical branch');
+  }
+  return supplied;
+}
+
+async function completeTaskScm(sessionId: string, op: any, ok: boolean, error: string, worktreePath: string): Promise<void> {
+  try {
+    await fetch('http://127.0.0.1:' + PORT + '/api/local/task-scm/complete', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + loadMcpJwt() },
+      body: JSON.stringify({ taskId: op.taskId, sessionId, kind: op.kind, ok, error, worktreePath }),
+      signal: AbortSignal.timeout(5000),
+    });
+  } catch {}
+}
+
+function executeTaskScm(root: string, op: any): string {
+  if (!op || typeof op !== 'object') throw new Error('invalid SCM operation');
+  if (!/^task_[a-z0-9]{8}$/i.test(String(op.taskId || ''))) throw new Error('invalid task id');
+  const branch = String(op.branchName || '');
+  if (!safeTaskBranch(branch)) throw new Error('invalid canonical task branch');
+  const boundRoot = String(op.repoRoot || '');
+  if (!boundRoot || (!samePath(boundRoot, root) && !samePath(sharedRepoRoot(boundRoot), sharedRepoRoot(root)))) {
+    throw new Error('task workspace does not match this repository');
+  }
+
+  if (op.kind === 'branch') {
+    if (op.prepareHandoffBranch === true) {
+      if (gitOperationInProgress(root)) {
+        throw new Error('finish the active merge or rebase before task automation');
+      }
+      const originalBranch = gitOutput(root, ['rev-parse', '--abbrev-ref', 'HEAD']);
+      const head = gitOutput(root, ['rev-parse', 'HEAD']);
+      if (!op.startSha || head !== String(op.startSha)) {
+        throw new Error('Codex local checkout HEAD does not match the task creation revision');
+      }
+      if (gitSucceeds(boundRoot, ['show-ref', '--verify', '--quiet', 'refs/heads/' + branch])) {
+        throw new Error('the canonical task branch already exists in another workspace');
+      }
+      if (!op.baseSha || !gitSucceeds(boundRoot, ['cat-file', '-e', String(op.baseSha) + '^{commit}'])) {
+        throw new Error('task base revision is unavailable in this repository');
+      }
+      gitOutput(root, ['branch', branch, String(op.baseSha)], 30000);
+      if (gitOutput(root, ['rev-parse', 'HEAD']) !== head
+          || gitOutput(root, ['rev-parse', '--abbrev-ref', 'HEAD']) !== originalBranch) {
+        throw new Error('Git changed the shared checkout while reserving the task branch');
+      }
+      return '';
+    }
+    if (op.adoptExistingWorktree === true) {
+      const supplied = String(op.worktreePath || '');
+      if (!supplied || !samePath(root, supplied)) {
+        throw new Error('Codex native worktree does not match the current session workspace');
+      }
+      const record = taskWorktreeRecords(boundRoot).find((item) => samePath(item.path, root));
+      if (!record) throw new Error('Codex native worktree is not registered with Git');
+      if (gitOperationInProgress(root)) {
+        throw new Error('finish the active merge or rebase before task automation');
+      }
+      if (gitOutput(root, ['status', '--porcelain'])) {
+        throw new Error('Codex native worktree must be clean before it can be assigned to a new task');
+      }
+      const head = gitOutput(root, ['rev-parse', 'HEAD']);
+      if (!op.startSha || head !== String(op.startSha)) {
+        throw new Error('Codex native worktree HEAD does not match the task creation revision');
+      }
+      const currentBranch = gitOutput(root, ['rev-parse', '--abbrev-ref', 'HEAD']);
+      if (currentBranch !== branch) {
+        if (gitSucceeds(boundRoot, ['show-ref', '--verify', '--quiet', 'refs/heads/' + branch])) {
+          throw new Error('the canonical task branch already exists in another workspace');
+        }
+        if (!op.baseSha || !gitSucceeds(boundRoot, ['cat-file', '-e', String(op.baseSha) + '^{commit}'])) {
+          throw new Error('task base revision is unavailable in this repository');
+        }
+        gitOutput(root, ['switch', '-c', branch, String(op.baseSha)], 30000);
+      }
+      if (gitOutput(root, ['rev-parse', '--abbrev-ref', 'HEAD']) !== branch) {
+        throw new Error('Codex native worktree did not adopt the canonical task branch');
+      }
+      return root;
+    }
+    const worktreePath = taskWorktreePath(boundRoot, String(op.taskId));
+    const existing = taskWorktreeRecords(boundRoot).find((item) => samePath(item.path, worktreePath));
+    if (existing) {
+      if (existing.branch !== branch || gitOutput(worktreePath, ['rev-parse', '--abbrev-ref', 'HEAD']) !== branch) {
+        throw new Error('managed task worktree exists on a conflicting branch');
+      }
+      return worktreePath;
+    }
+    if (existsSync(worktreePath)) {
+      throw new Error('managed task worktree path exists but is not registered with Git');
+    }
+    if (gitOperationInProgress(root)) {
+      throw new Error('finish the active merge or rebase before task automation');
+    }
+    const head = gitOutput(root, ['rev-parse', 'HEAD']);
+    if (!op.startSha || head !== String(op.startSha)) {
+      throw new Error('repository HEAD changed after task creation');
+    }
+    if (gitSucceeds(root, ['show-ref', '--verify', '--quiet', 'refs/heads/' + branch])) {
+      throw new Error('the canonical task branch already exists in another workspace');
+    }
+    if (!op.baseSha) throw new Error('task base revision is missing');
+    if (!gitSucceeds(root, ['cat-file', '-e', String(op.baseSha) + '^{commit}'])) {
+      throw new Error('task base revision is unavailable in this repository');
+    }
+    const originalBranch = gitOutput(root, ['rev-parse', '--abbrev-ref', 'HEAD']);
+    ignoreManagedWorktreeDirectory(boundRoot);
+    mkdirSync(dirname(worktreePath), { recursive: true });
+    gitOutput(root, ['worktree', 'add', '-b', branch, worktreePath, String(op.baseSha)], 30000);
+    if (gitOutput(root, ['rev-parse', 'HEAD']) !== head
+        || gitOutput(root, ['rev-parse', '--abbrev-ref', 'HEAD']) !== originalBranch) {
+      throw new Error('Git changed the originating checkout while creating the task worktree');
+    }
+    const record = taskWorktreeRecords(boundRoot).find((item) => samePath(item.path, worktreePath));
+    if (!record || record.branch !== branch
+        || gitOutput(worktreePath, ['rev-parse', '--abbrev-ref', 'HEAD']) !== branch) {
+      throw new Error('Git did not register the canonical task worktree');
+    }
+    return worktreePath;
+  }
+
+  if (op.kind !== 'push') throw new Error('unknown SCM operation');
+  const worktreePath = validateTaskWorktree(boundRoot, root, op);
+  if (gitOperationInProgress(worktreePath)) {
+    throw new Error('finish the active merge or rebase in the task worktree before pushing');
+  }
+  if (gitOutput(worktreePath, ['status', '--porcelain'])) {
+    gitOutput(worktreePath, ['add', '-A']);
+    if (!gitSucceeds(worktreePath, ['diff', '--cached', '--quiet'])) {
+      gitOutput(worktreePath, ['commit', '-m', String(op.commitMessage || 'Synkro task')], 30000);
+    }
+  }
+  gitOutput(worktreePath, ['push', '-u', 'origin', branch], 60000);
+  return worktreePath;
+}
+
+interface TaskScmReconcileResult { reason: string; context: string }
+
+function taskScmWorkspaceContext(workspace: any): string {
+  if (!workspace || typeof workspace !== 'object') return '';
+  const taskId = String(workspace.taskId || '');
+  const linearRef = String(workspace.linearRef || '');
+  const branchName = String(workspace.branchName || '');
+  const worktreePath = String(workspace.worktreePath || '');
+  if (!taskId || !branchName) return '';
+  return '[synkro:task-workspace] task=' + taskId
+    + (linearRef ? ' linear=' + linearRef : '')
+    + ' branch=' + branchName
+    + (worktreePath ? ' worktree=' + worktreePath : ' worktree=pending-native-handoff');
+}
+
+function shellTaskWorkspaceArg(value: string): string {
+  return "'" + value.replace(/'/g, "'\"'\"'") + "'";
+}
+
+function taskScmWorkspaceInstruction(harness: string, sessionId: string, workspace: any): string {
+  const context = taskScmWorkspaceContext(workspace);
+  const worktreePath = String(workspace?.worktreePath || '');
+  const branchName = String(workspace?.branchName || '');
+  if (!context || !branchName) return '';
+  const requirement = 'Do not continue in the shared checkout, use a per-command workdir, prefix commands with cd, '
+    + 'or ask the user to perform the transition. Synkro keeps substantive tools blocked until this exact session reports '
+    + 'the task worktree and canonical branch.';
+  if (harness === 'cc') {
+    if (!worktreePath) return context + '\n[synkro:workspace-handoff] Task worktree creation failed closed; retry workspace preparation.';
+    return context + '\n[synkro:workspace-handoff] Invoke Claude Code EnterWorktree now for the existing worktree '
+      + JSON.stringify(worktreePath) + ' on branch ' + JSON.stringify(branchName) + '. ' + requirement;
+  }
+  if (harness === 'cursor') {
+    if (!worktreePath) return context + '\n[synkro:workspace-handoff] Task worktree creation failed closed; retry workspace preparation.';
+    return context + '\n[synkro:workspace-handoff] Resume this exact Cursor chat in the existing task worktree now: cursor-agent --resume '
+      + shellTaskWorkspaceArg(sessionId) + ' --workspace ' + shellTaskWorkspaceArg(worktreePath)
+      + '. Confirm the resumed workspace is on branch ' + JSON.stringify(branchName) + '. ' + requirement;
+  }
+  if (!worktreePath) {
+    return context + '\n[synkro:workspace-handoff] Invoke Codex\'s native task/worktree Handoff now for this exact task. '
+      + 'Check out branch ' + JSON.stringify(branchName) + ' in a new worktree and continue this same chat there. '
+      + 'Do not switch the shared Local checkout or ask the user to switch branches. '
+      + 'Synkro keeps substantive tools blocked until this exact session reports the new worktree path and canonical branch.';
+  }
+  return context + '\n[synkro:workspace-handoff] Invoke Codex\'s native task/worktree Handoff now for this exact task, '
+    + 'using the existing worktree ' + JSON.stringify(worktreePath) + ' on branch ' + JSON.stringify(branchName) + '. '
+    + 'The Codex Environment panel must show that worktree and branch before retrying the blocked action. ' + requirement;
+}
+
+function withTaskScmContext(responseText: string, harness: string, context: string): string {
+  if (!context) return responseText;
+  try {
+    const response = JSON.parse(responseText || '{}') as any;
+    if (harness === 'cursor') {
+      response.agent_message = [response.agent_message, context].filter(Boolean).join('\n');
+      return JSON.stringify(response);
+    }
+    response.systemMessage = [response.systemMessage, context].filter(Boolean).join('\n');
+    response.hookSpecificOutput = response.hookSpecificOutput || { hookEventName: 'PreToolUse' };
+    response.hookSpecificOutput.additionalContext = [response.hookSpecificOutput.additionalContext, context]
+      .filter(Boolean).join('\n');
+    return JSON.stringify(response);
+  } catch { return responseText; }
+}
+
+async function reconcileTaskScm(
+  root: string,
+  sessionId: string,
+  harness: string,
+  payload?: any,
+): Promise<TaskScmReconcileResult> {
+  if (!root || !sessionId) return { reason: '', context: '' };
+  try {
+    let branch = '';
+    let repoRoot = '';
+    let isWorktree = false;
+    try { branch = gitOutput(root, ['rev-parse', '--abbrev-ref', 'HEAD']); } catch {}
+    try { repoRoot = sharedRepoRoot(root); } catch {}
+    try { isWorktree = statSync(join(root, '.git')).isFile(); } catch {}
+    const nativeCodexWorktree = harness === 'codex' && codexDesktopOrigin();
+    const parentSessionId = codexForkedFromSession(payload, harness, sessionId);
+    const claimWorkspace = (reportedBranch: string) => fetch(
+      'http://127.0.0.1:' + PORT + '/api/local/task-scm/claim', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + loadMcpJwt() },
+        body: JSON.stringify({
+          sessionId, cwd: root, repoRoot, branch: reportedBranch, harness,
+          nativeCodexWorktree, isWorktree, parentSessionId,
+        }),
+        signal: AbortSignal.timeout(5000),
+      },
+    );
+    const claim = await claimWorkspace(branch);
+    if (!claim.ok) return { reason: '', context: '' };
+    let result = await claim.json() as any;
+    for (let attempt = 0; result?.retry === true && attempt < 50; attempt++) {
+      await new Promise((resolveRetry) => setTimeout(resolveRetry, 100));
+      try { branch = gitOutput(root, ['rev-parse', '--abbrev-ref', 'HEAD']); } catch {}
+      const retried = await claimWorkspace(branch);
+      if (!retried.ok) break;
+      result = await retried.json() as any;
+    }
+    if (!result?.op) {
+      const workspace = result?.workspace && typeof result.workspace === 'object'
+        ? { ...result.workspace }
+        : result?.workspace;
+      return {
+        reason: result?.waiting
+          ? (taskScmWorkspaceInstruction(harness, sessionId, workspace)
+            || String(result.reason || 'task source-control preparation is pending'))
+          : '',
+        context: taskScmWorkspaceContext(workspace),
+      };
+    }
+    try {
+      const worktreePath = executeTaskScm(root, result.op);
+      await completeTaskScm(sessionId, result.op, true, '', worktreePath);
+      if (result.op.kind === 'branch') {
+        if (result.op.adoptExistingWorktree === true) {
+          const rebound = await claimWorkspace(String(result.op.branchName || ''));
+          if (rebound.ok) {
+            const reboundResult = await rebound.json() as any;
+            if (!reboundResult?.waiting && reboundResult?.workspace) {
+              return { reason: '', context: taskScmWorkspaceContext(reboundResult.workspace) };
+            }
+            if (reboundResult?.waiting) {
+              return {
+                reason: String(reboundResult.reason || 'Codex native worktree binding is pending'),
+                context: taskScmWorkspaceContext(reboundResult.workspace),
+              };
+            }
+          }
+          return { reason: 'Codex native worktree branch was created but task binding is still pending', context: '' };
+        }
+        const workspace = {
+          taskId: result.op.taskId,
+          linearRef: result.op.linearRef,
+          branchName: result.op.branchName,
+          worktreePath,
+          bindingState: 'handoff_pending',
+        };
+        return {
+          reason: taskScmWorkspaceInstruction(harness, sessionId, workspace),
+          context: '',
+        };
+      }
+      return { reason: '', context: '' };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      await completeTaskScm(sessionId, result.op, false, message, root);
+      return { reason: message, context: '' };
+    }
+  } catch { return { reason: '', context: '' }; }
+}
+
 // Once-per-session onboarding hint for repos with no synkro.toml file.
 function noSynkroHint(sessionId: string): string | null {
   const dir = join(HOME, '.synkro', '.no-synkro-hint');
@@ -3022,13 +3604,11 @@ function filePathFromToolInput(ti: any): string {
 // The container reconstructs the proposed post-edit content by finding the edit's old_string
 // inside baseContent, then computes the changed line-range + per-requirement file snapshot off
 // it. The old flat 64KB HEAD silently truncated any edit past ~the first 1000 lines of a big
-// file (e.g. an 890KB server file): old_string wasn't present, reconstruct produced garbage, and
-// that requirement could never be verified — it graded 'unknown' forever. Ship the WHOLE file
-// (covers virtually all source, incl. large single-file servers) so reconstruct + region math
-// are exact. Only a pathological >2MB file falls back to a line-aligned WINDOW around the edit
-// (front-padded with newlines so ABSOLUTE line numbers — which the container's region slicing
-// keys off — are preserved) instead of the head. This also fixes CWE/CVE scans that previously
-// never saw anything below 64KB in a large file.
+// file (e.g. an 890KB server file): old_string wasn't present, so reconstruction and the durable
+// edit fact were incomplete. Ship the WHOLE file (covers virtually all source, incl. large
+// single-file servers) so reconstruction, audit diffs, and policy/security scans are exact. Only
+// a pathological >2MB file falls back to a line-aligned WINDOW around the edit (front-padded with
+// newlines so ABSOLUTE line numbers are preserved) instead of the head.
 const BASE_CONTENT_WHOLE_CAP = 2000000;
 function editAnchorString(ti: any): string {
   if (!ti || typeof ti !== 'object') return '';
@@ -3436,11 +4016,19 @@ function readJsonlHeader(path: string): string {
   let fd = -1;
   try {
     fd = openSync(path, 'r');
-    const buf = Buffer.alloc(16384);
-    const count = readSync(fd, buf, 0, buf.length, 0);
-    const head = buf.subarray(0, count).toString('utf-8');
-    const newline = head.indexOf('\n');
-    return newline >= 0 ? head.slice(0, newline) : head;
+    const chunks: Buffer[] = [];
+    let position = 0;
+    while (position < 2 * 1024 * 1024) {
+      const buf = Buffer.alloc(Math.min(65536, 2 * 1024 * 1024 - position));
+      const count = readSync(fd, buf, 0, buf.length, position);
+      if (count <= 0) break;
+      const chunk = buf.subarray(0, count);
+      const newline = chunk.indexOf(10);
+      chunks.push(newline >= 0 ? chunk.subarray(0, newline) : chunk);
+      position += count;
+      if (newline >= 0) break;
+    }
+    return Buffer.concat(chunks).toString('utf-8');
   } catch { return ''; }
   finally { if (fd >= 0) { try { closeSync(fd); } catch {} } }
 }
@@ -3518,6 +4106,37 @@ export function resolveHookTranscriptPath(payload: any, harness: string, session
   return found;
 }
 
+function codexForkedFromSession(payload: any, harness: string, sessionId: string): string {
+  if (harness !== 'codex' || !safeCodexSessionId(sessionId)) return '';
+  const cachePath = join(
+    HOME,
+    '.synkro',
+    'codex-parent-' + createHash('sha256').update(sessionId).digest('hex').slice(0, 16),
+  );
+  try {
+    const cached = readFileSync(cachePath, 'utf-8').trim();
+    if (cached === '-') return '';
+    if (safeCodexSessionId(cached)) return cached;
+  } catch {}
+
+  let parent = '';
+  const transcriptPath = resolveHookTranscriptPath(payload, harness, sessionId);
+  if (transcriptPath) {
+    try {
+      const first = JSON.parse(readJsonlHeader(transcriptPath));
+      const candidate = String(first?.payload?.forked_from_id || first?.payload?.forkedFromId || '');
+      if (first?.type === 'session_meta' && safeCodexSessionId(candidate) && candidate !== sessionId) {
+        parent = candidate;
+      }
+    } catch {}
+  }
+  try {
+    mkdirSync(join(HOME, '.synkro'), { recursive: true });
+    writeFileSync(cachePath, parent || '-', { encoding: 'utf-8', mode: 0o600 });
+  } catch {}
+  return parent;
+}
+
 export async function runStub(surface: string, opts: StubOpts = {}): Promise<void> {
   const harness = isCursor(opts.harness) ? 'cursor' : isCodex(opts.harness) ? 'codex' : 'cc';
   const startedAt = Date.now();
@@ -3564,6 +4183,7 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
     const cwd = (typeof payload.cwd === 'string' && payload.cwd) || workspaceRoots[0] || '';
     const sessionId = String(payload.session_id || payload.conversation_id || '');
     const root = gitRoot(cwd);
+    telemCwd = root || cwd;
 
     // Dormancy: a repo is onboarded only if it has a synkro.toml FILE at its git
     // root. Guard root !== HOME — ~/.synkro is the config DIRECTORY, so without
@@ -3598,6 +4218,13 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
       return;
     }
 
+    const scm = await reconcileTaskScm(root || cwd, sessionId, harness, payload);
+    const substantiveTool = /^(?:Bash|Edit|Write|MultiEdit|NotebookEdit|apply_patch|file_change)$/i.test(String(payload.tool_name || ''));
+    if (scm.reason && substantiveTool) {
+      out(taskScmBlockResponse(harness, scm.reason));
+      return;
+    }
+
     if (harness === 'codex' && opts.needsFile && payload.__synkro_codex_patch_error) {
       const reason = String(payload.__synkro_codex_patch_error);
       out(JSON.stringify({
@@ -3613,7 +4240,17 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
     }
 
     // Gather host-only inputs the container can't read.
-    const envelope: any = { payload, harness, cwd: root || cwd, sessionId, synkroFileText };
+    const envelope: any = {
+      payload,
+      harness,
+      cwd: root || cwd,
+      sessionId,
+      synkroFileText,
+      taskWorkspaceContext: scm.context || undefined,
+    };
+    // Task creation is the one moment the container needs a stable Git snapshot.
+    // Capture it on the MCP gate only; ordinary tool hooks avoid extra Git calls.
+    if (surface === 'mcp-gate') envelope.repoContext = taskRepoContext(root || cwd);
 
     if (opts.needsFile) {
       const normalizedEdits = harness === 'codex' && Array.isArray(payload.__synkro_codex_edits)
@@ -3694,15 +4331,10 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
       envelope.planText = String(ti.plan || ti.content || payload.plan || '');
     }
 
-    // bash-followup is telemetry, but it can carry the INLINE "task complete ✓ N/N"
-    // result (the server waits up to 30s for the completion grade), so it needs a
-    // wait above that budget — not the 6s telemetry default — or the stub abandons
-    // the request before the result lands and the completion shows up a hook late.
-    // prompt-submit is the opposite: it's INTERACTIVE (blocks the user's prompt from
+    // prompt-submit is INTERACTIVE (blocks the user's prompt from
     // being sent) under a short 5s hook timeout, so it gets ONE short attempt (below)
     // and a tight per-attempt budget that fits inside 5s — never the 6s×3 telemetry path.
     const timeoutMs = surface === 'cwe-precheck' ? 48000
-      : surface === 'bash-followup' ? 32000
       : surface === 'prompt-submit' ? 3500
       : (opts.telemetry ? 6000 : 28000);
     // Cloud has no local container to reach. Post the SAME envelope to the org's grader
@@ -3727,8 +4359,8 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
     // latency: retry a few times with backoff. Right after a server restart the
     // event loop can be briefly busy / not-yet-listening and a single POST silently
     // drops the event (this was the followup flakiness). Double-delivery is safe here
-    // — the server side is idempotent-ish (completion in-flight guard, dup evidence
-    // is harmless). Blocking hooks make ONE attempt: their response IS the verdict
+    // because the server deduplicates durable hook events and native evidence.
+    // Blocking hooks make ONE attempt: their response IS the verdict
     // and a retry would double-grade. Normal case: first attempt wins, no delay.
     // prompt-submit is EXCLUDED from the retry: it runs on the interactive prompt
     // path under a 5s hook timeout, and 3×6s+backoff (19.5s) blew that budget and
@@ -3744,9 +4376,13 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
       if (i < attempts - 1) await new Promise((r) => setTimeout(r, 500 * (i + 1)));
     }
     const rawResponseText = text || failOpen(harness);
-    const responseText = opts.stopContract && harness === 'codex'
+    // A completion-report sync can arm the push after the pre-scan reconciliation ran.
+    // Reconcile once more so the same Stop/PostToolUse hook can push immediately.
+    await reconcileTaskScm(root || cwd, sessionId, harness, payload);
+    const contractResponseText = opts.stopContract && harness === 'codex'
       ? codexStopResponse(rawResponseText)
       : rawResponseText;
+    const responseText = withTaskScmContext(contractResponseText, harness, scm.context);
     out(responseText);
     emitStubTelemetry(surface, harness, telemPayload, responseText, Date.now() - startedAt, telemCwd, telemSessionId);
   } catch (err) {
@@ -4129,7 +4765,7 @@ function createCallbackServer() {
     "Access-Control-Allow-Headers": "Content-Type",
     "Vary": "Origin"
   };
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     const server = createServer((req, res) => {
       if (req.method === "OPTIONS") {
         const origin = req.headers.origin;
@@ -4218,7 +4854,7 @@ function createCallbackServer() {
         res.end(JSON.stringify({ ok: true }));
         setTimeout(() => {
           server.close();
-          resolve6(authData);
+          resolve7(authData);
         }, 200);
       });
       req.on("error", (e) => {
@@ -4549,7 +5185,7 @@ function detectSubdirRepos() {
   }
 }
 function ask(rl, question) {
-  return new Promise((resolve6) => rl.question(question, resolve6));
+  return new Promise((resolve7) => rl.question(question, resolve7));
 }
 async function linkRepo(repo, linkedNames) {
   try {
@@ -4788,7 +5424,7 @@ async function runClaudeDesktopTap(opts = {}) {
   writeFileSync12(join13(sessionDir, "mcp_patch.py"), MCP_PATCH_PY, "utf-8");
   const runnerPath = join13(sessionDir, "run.sh");
   writeFileSync12(runnerPath, buildRunner(sessionDir), { mode: 493 });
-  await new Promise((resolve6) => {
+  await new Promise((resolve7) => {
     const child = spawn3("bash", [runnerPath], {
       stdio: "inherit",
       env: { ...process.env, SYNKRO_CAPTURE_URL: CAPTURE_URL, SYNKRO_SCAN_URL: SCAN_URL, SYNKRO_SCAN_TURN_URL: SCAN_TURN_URL, SYNKRO_DLP_POLICY_URL: DLP_POLICY_URL, SYNKRO_TURN_VERDICTS_URL: TURN_VERDICTS_URL, SYNKRO_TURN_VERDICT_URL: TURN_VERDICT_URL, SYNKRO_MCP_EVENT_URL: MCP_EVENT_URL, SYNKRO_TAP_TOKEN: token, SYNKRO_TAP_TOKEN_FILE: JWT_PATH, SYNKRO_CD_BACKFILL: opts.backfill ? "1" : "" }
@@ -4804,7 +5440,7 @@ async function runClaudeDesktopTap(opts = {}) {
     child.on("exit", () => {
       process.off("SIGINT", forward);
       process.off("SIGTERM", forward);
-      resolve6();
+      resolve7();
     });
   });
 }
@@ -6610,10 +7246,8 @@ async function dockerInstall(opts = {}) {
     // Pass through the batch-size lever if the operator set it. Defaults
     // inside the container to 5; clamped to [1, 20] by synkro-server.ts.
     ...process.env.SYNKRO_MAX_BATCH_SIZE ? ["-e", `SYNKRO_MAX_BATCH_SIZE=${process.env.SYNKRO_MAX_BATCH_SIZE}`] : [],
-    // Full verifier prompt/response tracing is explicit opt-in because it contains source code.
-    ...process.env.SYNKRO_VERIFY_TRACE === "1" ? ["-e", "SYNKRO_VERIFY_TRACE=1"] : [],
     // Explicit model overrides are preserved across local install/update for
-    // every provider and isolated lane. The server reports the resolved values
+    // every provider and the isolated route lane. The server reports the resolved values
     // in /healthz so operators can audit exactly what is spending tokens.
     ...[
       "SYNKRO_CLAUDE_MODEL",
@@ -6879,7 +7513,7 @@ var init_dockerInstall = __esm({
     HOST_PGLITE_PORT = parseInt(process.env.SYNKRO_HOST_PGLITE_PORT || "15433", 10);
     CONTAINER_NAME = resolveContainerName();
     defaultImageVersion = () => {
-      if (true) return "1.7.95";
+      if (true) return "1.8.0";
       try {
         const pkg = JSON.parse(readFileSync17(new URL("../../package.json", import.meta.url), "utf8"));
         if (pkg.version) return pkg.version;
@@ -6911,7 +7545,7 @@ function captureClaudeSetupToken() {
   const bin = "script";
   const args2 = isMac ? ["-q", tmpFile, "claude", "setup-token"] : ["-qec", "claude setup-token", tmpFile];
   const OAUTH_HINT = 'The browser approval did not return a token. This usually means claude.ai rejected the OAuth request (its "Authorization failed \u2014 Unsupported media type" page), most often because a browser extension (Grammarly, ad/script blockers, AI-assistant toolbars) stripped the request headers, or you approved on the wrong Claude account. Fix: retry in a clean incognito window with extensions disabled, and approve on the Claude account you want the cloud workers to use.';
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     const proc = nodeSpawn(bin, args2, {
       stdio: "inherit",
       env: { ...process.env, FORCE_COLOR: "3", COLORTERM: "truecolor", TERM: "xterm-256color" }
@@ -6978,7 +7612,7 @@ function captureClaudeSetupToken() {
         reject(new Error(`Captured no setup token from claude setup-token output. ${reason}`));
         return;
       }
-      resolve6(token);
+      resolve7(token);
     });
   });
 }
@@ -7004,13 +7638,13 @@ function findCodexBinary() {
 function runCodexLogin(codexBin, codexHome) {
   mkdirSync13(codexHome, { recursive: true, mode: 448 });
   writeFileSync15(join17(codexHome, "config.toml"), 'cli_auth_credentials_store = "file"\n', { mode: 384 });
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     const proc = nodeSpawn2(codexBin, ["login"], {
       stdio: "inherit",
       env: { ...process.env, CODEX_HOME: codexHome }
     });
     proc.on("error", (err) => reject(new Error(`failed to spawn codex login: ${err.message}`)));
-    proc.on("close", (code) => code === 0 ? resolve6() : reject(new Error(`codex login exited with code ${code}`)));
+    proc.on("close", (code) => code === 0 ? resolve7() : reject(new Error(`codex login exited with code ${code}`)));
   });
 }
 async function setupCodexCloud(gatewayUrl, bearerToken, onStatus) {
@@ -7712,20 +8346,20 @@ async function promptAgentSelection(detected) {
   detected.forEach((a, i) => console.log(`  ${i + 1}. ${a.name}`));
   console.log(`  ${detected.length + 1}. Both / all (default)`);
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
-  const ask3 = () => new Promise((resolve6) => {
+  const ask3 = () => new Promise((resolve7) => {
     rl.question(`Pick [1-${detected.length + 1}] (default: all): `, (answer) => {
       const t = answer.trim().toLowerCase();
       if (t === "" || t === String(detected.length + 1) || t === "both" || t === "all") {
         rl.close();
-        return resolve6(detected);
+        return resolve7(detected);
       }
       const n = parseInt(t, 10);
       if (Number.isInteger(n) && n >= 1 && n <= detected.length) {
         rl.close();
-        return resolve6([detected[n - 1]]);
+        return resolve7([detected[n - 1]]);
       }
       console.log("Invalid choice. Try again.");
-      resolve6(ask3());
+      resolve7(ask3());
     });
   });
   return ask3();
@@ -7748,12 +8382,12 @@ async function promptCursorApiKey(opts) {
     return;
   }
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
-  const key = await new Promise((resolve6) => {
+  const key = await new Promise((resolve7) => {
     rl.question(
       "Cursor grading needs a Cursor API key (cursor.com \u2192 Settings \u2192 API Keys).\nPaste it now, or press Enter to skip (Cursor workers stay idle until set): ",
       (answer) => {
         rl.close();
-        resolve6(answer.trim());
+        resolve7(answer.trim());
       }
     );
   });
@@ -7768,7 +8402,7 @@ async function promptDeployLocation(current = "local") {
   if (!process.stdin.isTTY) return current;
   const other = current === "cloud" ? "local" : "cloud";
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     rl.question(
       `Where should Synkro run?
   local \u2014 a grading container on this machine (Docker)
@@ -7777,7 +8411,7 @@ Each worker uses the account credentials you authorize. Choose [${current}] / ${
       (answer) => {
         rl.close();
         const a = answer.trim().toLowerCase();
-        resolve6(a === "cloud" ? "cloud" : a === "local" ? "local" : current);
+        resolve7(a === "cloud" ? "cloud" : a === "local" ? "local" : current);
       }
     );
   });
@@ -7936,7 +8570,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle2(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle2(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle2(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle2("1.7.95")}`
+    `SYNKRO_VERSION=${shellQuoteSingle2("1.8.0")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle2(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle2(safeUserId)}`);
@@ -8683,7 +9317,7 @@ async function installCommand(opts = {}) {
   await setTelemetryState({ enabled: true, remoteFlushEnabled: telemetryConsent });
   emit("install", {
     phase: "started",
-    cli_version_to: "1.7.95",
+    cli_version_to: "1.8.0",
     agents_detected: agents.map((a) => a.kind),
     with_github: false,
     with_local_cc: false,
@@ -9890,13 +10524,13 @@ function extractTextContent(content) {
 function getCodexTranscriptFiles(repo) {
   const sessionsDir = join19(process.env.CODEX_HOME || join19(homedir21(), ".codex"), "sessions");
   if (!existsSync22(sessionsDir)) return [];
-  let relative = [];
+  let relative2 = [];
   try {
-    relative = readdirSync4(sessionsDir, { recursive: true, encoding: "utf-8" });
+    relative2 = readdirSync4(sessionsDir, { recursive: true, encoding: "utf-8" });
   } catch {
     return [];
   }
-  return relative.filter((p) => p.endsWith(".jsonl")).map((p) => join19(sessionsDir, p)).filter((filePath) => {
+  return relative2.filter((p) => p.endsWith(".jsonl")).map((p) => join19(sessionsDir, p)).filter((filePath) => {
     try {
       const first = readFileSync21(filePath, "utf-8").split("\n", 1)[0];
       const meta = JSON.parse(first);
@@ -10971,10 +11605,10 @@ function confirmPurge() {
     return Promise.resolve(false);
   }
   const rl = createInterface3({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     rl.question("   Type 'yes' to wipe everything (anything else cancels): ", (answer) => {
       rl.close();
-      resolve6(answer.trim().toLowerCase() === "yes");
+      resolve7(answer.trim().toLowerCase() === "yes");
     });
   });
 }
@@ -11227,7 +11861,7 @@ async function submitToChannel(role, payload, opts = {}) {
   const port = opts.port ?? CHANNEL_PORT;
   const startedAt = Date.now();
   try {
-    const result = await new Promise((resolve6, reject) => {
+    const result = await new Promise((resolve7, reject) => {
       const req = httpRequest({
         host: CHANNEL_HOST,
         port,
@@ -11253,7 +11887,7 @@ async function submitToChannel(role, payload, opts = {}) {
               reject(new LocalCCError(parsed.error));
               return;
             }
-            resolve6(String(parsed.result ?? ""));
+            resolve7(String(parsed.result ?? ""));
           } catch (err) {
             reject(new LocalCCError(`malformed channel response: ${text.slice(0, 200)}`, err));
           }
@@ -11279,14 +11913,14 @@ async function submitToChannel(role, payload, opts = {}) {
   }
 }
 function isChannelAvailable(port = CHANNEL_PORT, timeoutMs = 500) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const sock = connect(port, CHANNEL_HOST);
     const done = (ok) => {
       try {
         sock.destroy();
       } catch {
       }
-      resolve6(ok);
+      resolve7(ok);
     };
     sock.once("connect", () => done(true));
     sock.once("error", () => done(false));
@@ -11318,10 +11952,10 @@ __export(grade_exports, {
   gradeCommand: () => gradeCommand
 });
 async function readStdin() {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     const chunks = [];
     process.stdin.on("data", (c) => chunks.push(c));
-    process.stdin.on("end", () => resolve6(Buffer.concat(chunks).toString("utf-8")));
+    process.stdin.on("end", () => resolve7(Buffer.concat(chunks).toString("utf-8")));
     process.stdin.on("error", reject);
   });
 }
@@ -11575,7 +12209,7 @@ function spawnClaudeJudge(file, claudeToken, promptHeader) {
 Diff:
 ${hunks}`;
   const fullPrompt = promptHeader + userMessage;
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const t0 = Date.now();
     const proc = spawn6(
       "claude",
@@ -11603,7 +12237,7 @@ ${hunks}`;
       const latencyMs = Date.now() - t0;
       if (code !== 0) {
         console.warn(`  claude exited ${code}: ${(stderr || stdout).slice(0, 500)}`);
-        resolve6({ findings: [], latencyMs });
+        resolve7({ findings: [], latencyMs });
         return;
       }
       try {
@@ -11622,10 +12256,10 @@ ${hunks}`;
           description: f.description,
           fix: f.fix
         }));
-        resolve6({ findings, latencyMs });
+        resolve7({ findings, latencyMs });
       } catch (parseErr) {
         console.warn(`  failed to parse claude response: ${stdout.slice(0, 300)}`);
-        resolve6({ findings: [], latencyMs });
+        resolve7({ findings: [], latencyMs });
       }
     });
   });
@@ -11674,7 +12308,7 @@ ${JSON.stringify(findings, null, 2)}
 `;
 }
 function spawnOpusConsolidator(findings, claudeToken) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const prompt = buildConsolidationPrompt(findings);
     const proc = spawn6(
       "claude",
@@ -11701,7 +12335,7 @@ function spawnOpusConsolidator(findings, claudeToken) {
     proc.on("close", (code) => {
       if (code !== 0) {
         console.warn(`  opus consolidation exited ${code}: ${(stderr || stdout).slice(0, 300)}`);
-        resolve6(fallbackReview(findings));
+        resolve7(fallbackReview(findings));
         return;
       }
       try {
@@ -11722,10 +12356,10 @@ function spawnOpusConsolidator(findings, claudeToken) {
           const order = ["low", "medium", "high", "critical"];
           return order.indexOf(f.severity) > order.indexOf(max) ? f.severity : max;
         }, "low");
-        resolve6({ summary: review.summary || "", comments, severity: maxSeverity });
+        resolve7({ summary: review.summary || "", comments, severity: maxSeverity });
       } catch {
         console.warn(`  failed to parse opus response, using fallback`);
-        resolve6(fallbackReview(findings));
+        resolve7(fallbackReview(findings));
       }
     });
   });
@@ -12208,14 +12842,14 @@ function ensureRunning(opts = {}) {
   return startTask(opts);
 }
 function probePort(host, port, timeoutMs = 500) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const sock = connect2(port, host);
     const done = (ok) => {
       try {
         sock.destroy();
       } catch {
       }
-      resolve6(ok);
+      resolve7(ok);
     };
     sock.once("connect", () => done(true));
     sock.once("error", () => done(false));
@@ -12765,7 +13399,7 @@ function cmdLogs(rest) {
     if (!raw) console.log("  " + colorize("(use --raw / -r to see full payloads, --live / -f to follow)", 90));
     return;
   }
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     console.log("  " + colorize("\u2014 following new turns (Ctrl-C to exit) \u2014", 90));
     const stop = followTurns((t) => {
       console.log("  " + formatTurn(t, raw));
@@ -12773,7 +13407,7 @@ function cmdLogs(rest) {
     const onSigint = () => {
       stop();
       process.removeListener("SIGINT", onSigint);
-      resolve6();
+      resolve7();
     };
     process.on("SIGINT", onSigint);
   });
@@ -13062,9 +13696,9 @@ function parseSession(file, seenStableIds) {
 }
 function ask2(q) {
   const rl = createInterface4({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve6) => rl.question(q, (a) => {
+  return new Promise((resolve7) => rl.question(q, (a) => {
     rl.close();
-    resolve6(/^y(es)?$/i.test(a.trim()));
+    resolve7(/^y(es)?$/i.test(a.trim()));
   }));
 }
 async function importCommand() {
@@ -13197,8 +13831,8 @@ function canonicalize(pack) {
     docs: pack.docs ?? []
   });
 }
-function computeDigest(canonical) {
-  return "sha256:" + crypto.createHash("sha256").update(canonical, "utf8").digest("hex");
+function computeDigest(canonical2) {
+  return "sha256:" + crypto.createHash("sha256").update(canonical2, "utf8").digest("hex");
 }
 function verifySignature(digest, signatureB64, publicKeyPem) {
   try {
@@ -14427,12 +15061,12 @@ async function runExport(args2) {
 }
 function confirmYesNo(question) {
   if (!process.stdin.isTTY) return Promise.resolve(false);
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const rl = createInterface5({ input: process.stdin, output: process.stdout });
     rl.question(`${question} (y/N): `, (answer) => {
       rl.close();
       const t = answer.trim().toLowerCase();
-      resolve6(t === "y" || t === "yes");
+      resolve7(t === "y" || t === "yes");
     });
   });
 }
@@ -14525,15 +15159,824 @@ Usage:
   }
 });
 
+// cli/inventory/identity.ts
+import { randomUUID as randomUUID5 } from "crypto";
+import { existsSync as existsSync36, mkdirSync as mkdirSync19, readFileSync as readFileSync35, renameSync as renameSync9, writeFileSync as writeFileSync24 } from "fs";
+import { homedir as homedir35 } from "os";
+import { dirname as dirname9, join as join35 } from "path";
+function operationalIdentityPath() {
+  return process.env.SYNKRO_OPERATIONAL_IDENTITY_PATH || join35(homedir35(), ".synkro", "installation.json");
+}
+function validIdentity(value) {
+  if (!value || typeof value !== "object") return false;
+  const row = value;
+  return typeof row.installation_id === "string" && UUID_RE.test(row.installation_id) && typeof row.created_at === "string" && Number.isFinite(Date.parse(row.created_at));
+}
+function writeIdentity(path, identity) {
+  mkdirSync19(dirname9(path), { recursive: true, mode: 448 });
+  const temp = `${path}.${process.pid}.${randomUUID5()}.tmp`;
+  writeFileSync24(temp, JSON.stringify(identity, null, 2) + "\n", { encoding: "utf8", mode: 384 });
+  renameSync9(temp, path);
+}
+function getOperationalInstallationIdentity(path = operationalIdentityPath()) {
+  const prior = cached4.get(path);
+  if (prior) return prior;
+  if (existsSync36(path)) {
+    try {
+      const parsed = JSON.parse(readFileSync35(path, "utf8"));
+      if (validIdentity(parsed)) {
+        cached4.set(path, parsed);
+        return parsed;
+      }
+    } catch {
+    }
+  }
+  const identity = { installation_id: randomUUID5(), created_at: (/* @__PURE__ */ new Date()).toISOString() };
+  writeIdentity(path, identity);
+  cached4.set(path, identity);
+  return identity;
+}
+var UUID_RE, cached4;
+var init_identity2 = __esm({
+  "cli/inventory/identity.ts"() {
+    "use strict";
+    UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+    cached4 = /* @__PURE__ */ new Map();
+  }
+});
+
+// cli/inventory/collector.ts
+import { createHash as createHash5 } from "crypto";
+import {
+  existsSync as existsSync37,
+  readFileSync as readFileSync36,
+  readdirSync as readdirSync9,
+  statSync as statSync5
+} from "fs";
+import { arch, homedir as homedir36, hostname as hostname2, platform as platform5, release } from "os";
+import { basename as basename3, join as join36, relative, resolve as resolve5 } from "path";
+import { fileURLToPath } from "url";
+function sha256(value) {
+  return createHash5("sha256").update(value).digest("hex");
+}
+function pseudonymousHostnameHash(installationId, host) {
+  return sha256(`${installationId}:${host}`).slice(0, 32);
+}
+function cliVersion() {
+  try {
+    return "1.8.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+function readJson(path) {
+  try {
+    if (!existsSync37(path)) return null;
+    const parsed = JSON.parse(readFileSync36(path, "utf8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function readText(path) {
+  try {
+    if (!existsSync37(path)) return "";
+    return readFileSync36(path, "utf8");
+  } catch {
+    return "";
+  }
+}
+function urlOrigin(raw) {
+  if (typeof raw !== "string") return void 0;
+  try {
+    const parsed = new URL(raw);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return void 0;
+    return parsed.origin;
+  } catch {
+    return void 0;
+  }
+}
+function canonical(raw) {
+  return raw.trim().toLowerCase().replace(/[\s.]+/g, "-").replace(/[^a-z0-9_:@/+-]/g, "") || "unknown";
+}
+function safePackageName(command, args2) {
+  if (typeof command !== "string" || !command.trim()) return void 0;
+  const runner = basename3(command.trim()).replace(/\.exe$/i, "");
+  if (Array.isArray(args2) && ["npx", "bunx", "uvx"].includes(runner)) {
+    const pkg = args2.find((arg) => typeof arg === "string" && !arg.startsWith("-"));
+    if (typeof pkg === "string") {
+      const candidate = pkg.trim();
+      if (/^(?:@[a-z0-9_.-]+\/)?[a-z0-9_.-]+(?:@[a-z0-9_.+~-]+)?$/i.test(candidate)) {
+        return candidate;
+      }
+      return basename3(candidate);
+    }
+  }
+  return runner;
+}
+function toolNames(entry) {
+  const raw = entry.enabledTools ?? entry.enabled_tools ?? entry.allowedTools ?? entry.allowed_tools ?? entry.tools;
+  if (!Array.isArray(raw)) return [];
+  return [...new Set(raw.map((tool) => typeof tool === "string" ? tool : tool?.name).filter((tool) => typeof tool === "string" && !!tool.trim()))];
+}
+function mcpArtifactsFromJson(harness, config, configScope = "user") {
+  if (!config || !config.mcpServers || typeof config.mcpServers !== "object") return [];
+  const artifacts = [];
+  for (const [name, raw] of Object.entries(config.mcpServers)) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
+    const entry = raw;
+    const transport = typeof entry.type === "string" ? entry.type : entry.command ? "stdio" : entry.url ? "streamable-http" : "unknown";
+    const tools = toolNames(entry);
+    const scopeId = canonical(configScope);
+    const id = `${canonical(name)}@${scopeId}`;
+    const safeShape = {
+      name,
+      transport,
+      origin: urlOrigin(entry.url),
+      package_name: safePackageName(entry.command, entry.args),
+      enabled: entry.enabled !== false && entry.disabled !== true,
+      tools,
+      scope: configScope
+    };
+    artifacts.push({
+      harness,
+      type: "mcp_server",
+      canonical_id: id,
+      display_name: String(name),
+      enabled: safeShape.enabled,
+      config_scope: configScope,
+      transport: String(transport),
+      endpoint_origin: safeShape.origin,
+      package_name: safeShape.package_name,
+      config_hash: sha256(JSON.stringify(safeShape)),
+      metadata: tools.length ? { tool_names: tools } : void 0
+    });
+    for (const tool of tools) {
+      artifacts.push({
+        harness,
+        type: "mcp_tool",
+        canonical_id: `${id}:${canonical(tool)}`,
+        display_name: tool,
+        enabled: safeShape.enabled,
+        config_scope: configScope,
+        metadata: { source: String(name) }
+      });
+    }
+  }
+  return artifacts;
+}
+function claudeDesktopConfigCandidates(home, targetPlatform) {
+  if (targetPlatform === "darwin") {
+    return [join36(home, "Library", "Application Support", "Claude", "claude_desktop_config.json")];
+  }
+  if (targetPlatform === "linux") {
+    return [
+      join36(home, ".config", "Claude", "claude_desktop_config.json"),
+      join36(home, ".config", "claude", "claude_desktop_config.json")
+    ];
+  }
+  if (targetPlatform === "win32" && process.env.APPDATA) {
+    return [join36(process.env.APPDATA, "Claude", "claude_desktop_config.json")];
+  }
+  return [];
+}
+function claudeManagedMcpConfigCandidates(targetPlatform) {
+  if (targetPlatform === "darwin") return ["/Library/Application Support/ClaudeCode/managed-mcp.json"];
+  if (targetPlatform === "linux") return ["/etc/claude-code/managed-mcp.json"];
+  if (targetPlatform === "win32" && process.env.ProgramFiles) {
+    return [join36(process.env.ProgramFiles, "ClaudeCode", "managed-mcp.json")];
+  }
+  return [];
+}
+function discoveredProjectRoots(claudeState, currentDirectory, explicit = [], cursorRoots = []) {
+  const roots = /* @__PURE__ */ new Set();
+  const add = (value) => {
+    if (typeof value !== "string" || !value.trim()) return;
+    const path = resolve5(value);
+    if (existsSync37(path)) roots.add(path);
+  };
+  add(currentDirectory);
+  for (const path of explicit) add(path);
+  for (const path of cursorRoots) add(path);
+  if (claudeState?.projects && typeof claudeState.projects === "object") {
+    for (const path of Object.keys(claudeState.projects)) add(path);
+  }
+  return [...roots];
+}
+function cursorWorkspaceStorageCandidates(home, targetPlatform) {
+  if (targetPlatform === "darwin") return [join36(home, "Library", "Application Support", "Cursor", "User", "workspaceStorage")];
+  if (targetPlatform === "linux") return [join36(home, ".config", "Cursor", "User", "workspaceStorage")];
+  if (targetPlatform === "win32" && process.env.APPDATA) {
+    return [join36(process.env.APPDATA, "Cursor", "User", "workspaceStorage")];
+  }
+  return [];
+}
+function cursorWorkspaceRoots(home, targetPlatform) {
+  const roots = /* @__PURE__ */ new Set();
+  for (const storage of cursorWorkspaceStorageCandidates(home, targetPlatform)) {
+    if (!existsSync37(storage)) continue;
+    let entries = [];
+    try {
+      entries = readdirSync9(storage, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory() || entry.isSymbolicLink?.()) continue;
+      const state = readJson(join36(storage, entry.name, "workspace.json"));
+      const raw = state?.folder;
+      if (typeof raw !== "string" || !raw.trim()) continue;
+      try {
+        const path = raw.startsWith("file:") ? fileURLToPath(raw) : raw;
+        if (existsSync37(path)) roots.add(resolve5(path));
+      } catch {
+      }
+    }
+  }
+  return [...roots];
+}
+function codexMcpArtifacts(content) {
+  const artifacts = [];
+  const sections = [...content.matchAll(/^\s*\[\s*([^\]]+)\s*\]\s*$/gm)];
+  for (let index = 0; index < sections.length && artifacts.length < 1e3; index++) {
+    const section = sections[index];
+    const key = section[1].trim();
+    const root = key.match(/^mcp_servers\s*\.\s*(?:"((?:[^"\\]|\\.)+)"|'([^']+)'|([A-Za-z0-9_-]+))$/);
+    if (!root) continue;
+    let name = root[1] || root[2] || root[3];
+    if (root[1]) {
+      try {
+        name = JSON.parse(`"${root[1]}"`);
+      } catch {
+        continue;
+      }
+    }
+    const start = (section.index ?? 0) + section[0].length;
+    const end = sections[index + 1]?.index ?? content.length;
+    const block = content.slice(start, end);
+    const stringValue = (key2) => {
+      const found = block.match(new RegExp(`^\\s*${key2}\\s*=\\s*("(?:[^"\\\\]|\\\\.)*")`, "m"));
+      if (!found) return void 0;
+      try {
+        return JSON.parse(found[1]);
+      } catch {
+        return void 0;
+      }
+    };
+    const enabled = !/^\s*enabled\s*=\s*false\s*$/m.test(block);
+    const url = stringValue("url");
+    const command = stringValue("command");
+    const safeShape = { name, enabled, origin: urlOrigin(url), package_name: safePackageName(command, []) };
+    artifacts.push({
+      harness: "codex",
+      type: "mcp_server",
+      canonical_id: `${canonical(name)}@user`,
+      display_name: name,
+      enabled,
+      config_scope: "user",
+      transport: command ? "stdio" : url ? "streamable-http" : "unknown",
+      endpoint_origin: safeShape.origin,
+      package_name: safeShape.package_name,
+      config_hash: sha256(JSON.stringify(safeShape))
+    });
+  }
+  return artifacts;
+}
+function flattenHookEntries(value) {
+  if (!Array.isArray(value)) return [];
+  const out = [];
+  for (const entry of value) {
+    if (!entry || typeof entry !== "object") continue;
+    const record = entry;
+    if (typeof record.command === "string") out.push(record);
+    if (Array.isArray(record.hooks)) out.push(...flattenHookEntries(record.hooks));
+  }
+  return out;
+}
+function hookArtifacts(harness, config) {
+  if (!config?.hooks || typeof config.hooks !== "object") return [];
+  const artifacts = [];
+  for (const [event, rawEntries] of Object.entries(config.hooks)) {
+    for (const entry of flattenHookEntries(rawEntries)) {
+      const commandHash = sha256(entry.command);
+      const managed = entry.__synkro_managed__ === true || /[\\/]\.synkro[\\/]hooks[\\/]/.test(entry.command);
+      artifacts.push({
+        harness,
+        type: "hook",
+        canonical_id: `${canonical(event)}:${commandHash.slice(0, 20)}`,
+        display_name: `${event} \xB7 ${basename3(String(entry.command).split(/\s+/)[0] || "hook")}`,
+        enabled: entry.enabled !== false,
+        config_scope: "user",
+        package_name: basename3(String(entry.command).split(/\s+/)[0] || "") || void 0,
+        config_hash: commandHash,
+        metadata: { managed, events: [event] }
+      });
+    }
+  }
+  return artifacts;
+}
+function parseFrontmatter(content) {
+  const match = content.match(/^---\s*\n([\s\S]*?)\n---/);
+  if (!match) return {};
+  const value = (key) => match[1].match(new RegExp(`^${key}:\\s*["']?([^"'\\n]+)`, "m"))?.[1]?.trim();
+  return { name: value("name"), version: value("version") };
+}
+function skillArtifacts(harness, root) {
+  if (!existsSync37(root)) return [];
+  const manifests = [];
+  const visit = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync9(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.isSymbolicLink?.()) continue;
+      const path = join36(dir, entry.name);
+      if (entry.isFile() && entry.name === "SKILL.md") manifests.push(path);
+      else if (entry.isDirectory()) visit(path);
+    }
+  };
+  visit(root);
+  return manifests.map((path) => {
+    const content = readText(path);
+    const frontmatter = parseFrontmatter(content);
+    const rel = relative(root, path).replaceAll("\\", "/");
+    const name = frontmatter.name || basename3(join36(path, "..")) || "skill";
+    return {
+      harness,
+      type: "skill",
+      canonical_id: `${canonical(name)}:${sha256(rel).slice(0, 16)}`,
+      display_name: name,
+      version: frontmatter.version,
+      enabled: true,
+      config_scope: "user",
+      config_hash: content ? sha256(content) : void 0,
+      metadata: { source: "SKILL.md" }
+    };
+  });
+}
+function cursorExtensionArtifacts(root) {
+  if (!existsSync37(root)) return [];
+  let dirs = [];
+  try {
+    dirs = readdirSync9(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.isSymbolicLink());
+  } catch {
+    return [];
+  }
+  const artifacts = [];
+  for (const dir of dirs) {
+    const pkg = readJson(join36(root, dir.name, "package.json"));
+    if (!pkg) continue;
+    const publisher = typeof pkg.publisher === "string" ? pkg.publisher : void 0;
+    const name = typeof pkg.name === "string" ? pkg.name : dir.name;
+    const id = publisher ? `${publisher}.${name}` : name;
+    artifacts.push({
+      harness: "cursor",
+      type: "extension",
+      canonical_id: canonical(id),
+      display_name: String(pkg.displayName || name),
+      version: typeof pkg.version === "string" ? pkg.version : void 0,
+      enabled: true,
+      config_scope: "user",
+      config_hash: sha256(JSON.stringify({ id, version: pkg.version })),
+      metadata: publisher ? { publisher } : void 0
+    });
+  }
+  return artifacts;
+}
+function deploymentMode2(home) {
+  const raw = readText(join36(home, ".synkro", "config.env"));
+  const value = (key) => raw.match(new RegExp(`^${key}=['"]?([^'"\\n]*)`, "m"))?.[1]?.toLowerCase();
+  if (value("SYNKRO_GRADING_MODE") === "byok") return "byok";
+  if (value("SYNKRO_STORAGE_MODE") === "cloud") return "cloud";
+  return "local";
+}
+function telemetryHealth(home) {
+  const meta = readJson(join36(home, ".synkro", "telemetry-meta.json"));
+  const health = {};
+  if (meta?.last_flush_ok_at && Number.isFinite(Date.parse(meta.last_flush_ok_at))) health.telemetry_last_flush_at = meta.last_flush_ok_at;
+  if (meta?.last_flush_error) health.telemetry_last_error = "flush_failed";
+  const queue = join36(home, ".synkro", "telemetry-pending.jsonl");
+  try {
+    const size = statSync5(queue).size;
+    health.telemetry_backlog = size <= 5 * 1024 * 1024 ? readFileSync36(queue, "utf8").split("\n").filter(Boolean).length : Math.ceil(size / 1024);
+  } catch {
+  }
+  return health;
+}
+function harnessSnapshot(agent) {
+  if (agent.kind === "claude_code") {
+    const config2 = readJson(agent.settingsPath);
+    const coverage2 = inspectCCHooks(agent.settingsPath);
+    return {
+      row: {
+        harness: "claude_code",
+        installed: true,
+        enabled: coverage2.installed,
+        version: agent.version,
+        permission_mode: config2?.permissions?.defaultMode,
+        hook_coverage: coverage2,
+        hook_config_hash: sha256(JSON.stringify(coverage2)),
+        config_scope: "user"
+      },
+      config: config2
+    };
+  }
+  if (agent.kind === "cursor") {
+    const config2 = readJson(agent.settingsPath);
+    const coverage2 = inspectCursorHooks(agent.settingsPath);
+    return {
+      row: {
+        harness: "cursor",
+        installed: true,
+        enabled: coverage2.installed,
+        version: agent.version,
+        hook_coverage: coverage2,
+        hook_config_hash: sha256(JSON.stringify(coverage2)),
+        config_scope: "user"
+      },
+      config: config2
+    };
+  }
+  const config = readJson(agent.settingsPath);
+  const coverage = inspectCodexHooks(agent.settingsPath);
+  const toml = readText(join36(agent.configDir, "config.toml"));
+  const permission = toml.match(/^\s*approval_policy\s*=\s*["']([^"']+)/m)?.[1];
+  return {
+    row: {
+      harness: "codex",
+      installed: true,
+      enabled: coverage.installed,
+      version: agent.version,
+      permission_mode: permission,
+      hook_coverage: coverage,
+      hook_config_hash: sha256(JSON.stringify(coverage)),
+      config_scope: "user"
+    },
+    config
+  };
+}
+function collectOperationalInventory(options = {}) {
+  const home = options.homeDir ?? homedir36();
+  const detected = options.detectedAgents ?? detectAgents();
+  const identity = getOperationalInstallationIdentity(options.identityPath);
+  const targetPlatform = options.platformName ?? platform5();
+  const codexHome = options.homeDir ? join36(home, ".codex") : process.env.CODEX_HOME || join36(home, ".codex");
+  const harnesses = [];
+  const artifacts = [];
+  for (const agent of detected) {
+    const { row, config } = harnessSnapshot(agent);
+    harnesses.push(row);
+    artifacts.push(...hookArtifacts(row.harness, config));
+  }
+  const claudeJson = readJson(join36(home, ".claude.json"));
+  artifacts.push(...mcpArtifactsFromJson("claude_code", claudeJson));
+  if (claudeJson?.projects && typeof claudeJson.projects === "object") {
+    for (const [projectPath, project] of Object.entries(claudeJson.projects)) {
+      if (!project || typeof project !== "object") continue;
+      artifacts.push(...mcpArtifactsFromJson("claude_code", project, `local:${sha256(projectPath).slice(0, 16)}`));
+    }
+  }
+  artifacts.push(...mcpArtifactsFromJson("cursor", readJson(join36(home, ".cursor", "mcp.json"))));
+  artifacts.push(...codexMcpArtifacts(readText(join36(codexHome, "config.toml"))));
+  const projectRoots = discoveredProjectRoots(
+    claudeJson,
+    options.currentDirectory ?? process.cwd(),
+    options.projectRoots,
+    cursorWorkspaceRoots(home, targetPlatform)
+  );
+  for (const projectRoot of projectRoots) {
+    const scopeHash = sha256(projectRoot).slice(0, 16);
+    artifacts.push(...mcpArtifactsFromJson(
+      "claude_code",
+      readJson(join36(projectRoot, ".mcp.json")),
+      `project:${scopeHash}`
+    ));
+    const cursorProjectConfig = join36(projectRoot, ".cursor", "mcp.json");
+    if (resolve5(cursorProjectConfig) !== resolve5(join36(home, ".cursor", "mcp.json"))) {
+      artifacts.push(...mcpArtifactsFromJson(
+        "cursor",
+        readJson(cursorProjectConfig),
+        `project:${scopeHash}`
+      ));
+    }
+  }
+  for (const managedPath of claudeManagedMcpConfigCandidates(targetPlatform)) {
+    artifacts.push(...mcpArtifactsFromJson("claude_code", readJson(managedPath), "managed"));
+  }
+  const desktopConfigPath = claudeDesktopConfigCandidates(home, targetPlatform).find((path) => existsSync37(path));
+  if (desktopConfigPath) {
+    const desktopConfig = readJson(desktopConfigPath);
+    harnesses.push({
+      harness: "claude_desktop",
+      installed: true,
+      enabled: true,
+      config_scope: "user"
+    });
+    artifacts.push(...mcpArtifactsFromJson("claude_desktop", desktopConfig));
+  }
+  const claudeSettings = readJson(join36(home, ".claude", "settings.json"));
+  if (claudeSettings?.enabledPlugins && typeof claudeSettings.enabledPlugins === "object") {
+    for (const [name, enabled] of Object.entries(claudeSettings.enabledPlugins)) {
+      artifacts.push({
+        harness: "claude_code",
+        type: "plugin",
+        canonical_id: canonical(name),
+        display_name: name,
+        enabled: enabled === true,
+        config_scope: "user",
+        metadata: { source: "enabledPlugins" }
+      });
+    }
+  }
+  artifacts.push(...skillArtifacts("claude_code", join36(home, ".claude", "skills")));
+  artifacts.push(...skillArtifacts("cursor", join36(home, ".cursor", "skills")));
+  artifacts.push(...skillArtifacts("codex", join36(codexHome, "skills")));
+  artifacts.push(...cursorExtensionArtifacts(join36(home, ".cursor", "extensions")));
+  const uniqueArtifacts = /* @__PURE__ */ new Map();
+  for (const artifact of artifacts) {
+    const key = `${artifact.harness || "global"}:${artifact.type}:${artifact.canonical_id}`;
+    uniqueArtifacts.set(key, artifact);
+  }
+  const codingHarnesses = harnesses.filter((row) => row.harness === "claude_code" || row.harness === "cursor" || row.harness === "codex");
+  const health = telemetryHealth(home) ?? {};
+  health.scanners = {
+    hook_runtime: codingHarnesses.length === 0 ? "unknown" : codingHarnesses.every((row) => row.enabled) ? "ok" : "degraded"
+  };
+  return {
+    schema_version: 1,
+    collected_at: (/* @__PURE__ */ new Date()).toISOString(),
+    installation: {
+      install_id: identity.installation_id,
+      hostname_hash: pseudonymousHostnameHash(identity.installation_id, hostname2()),
+      platform: targetPlatform,
+      os_version: release(),
+      arch: arch(),
+      cli_version: cliVersion(),
+      node_version: process.version,
+      bun_version: process.versions.bun,
+      deployment_mode: deploymentMode2(home)
+    },
+    harnesses,
+    artifacts: [...uniqueArtifacts.values()],
+    health
+  };
+}
+var init_collector = __esm({
+  "cli/inventory/collector.ts"() {
+    "use strict";
+    init_agentDetect();
+    init_ccHookConfig();
+    init_cursorHookConfig();
+    init_codexHookConfig();
+    init_identity2();
+  }
+});
+
+// cli/inventory/sync.ts
+var sync_exports2 = {};
+__export(sync_exports2, {
+  inventorySnapshotChunks: () => inventorySnapshotChunks,
+  inventorySyncTarget: () => inventorySyncTarget,
+  resolveInventoryGateway: () => resolveInventoryGateway,
+  resolveLocalInventoryUrl: () => resolveLocalInventoryUrl,
+  shouldSyncInventory: () => shouldSyncInventory,
+  syncOperationalInventory: () => syncOperationalInventory,
+  syncOperationalInventoryDetached: () => syncOperationalInventoryDetached
+});
+import { createHash as createHash6, randomUUID as randomUUID6 } from "crypto";
+import { spawn as spawn8 } from "child_process";
+import {
+  existsSync as existsSync38,
+  mkdirSync as mkdirSync20,
+  readFileSync as readFileSync37,
+  renameSync as renameSync10,
+  writeFileSync as writeFileSync25
+} from "fs";
+import { homedir as homedir37 } from "os";
+import { dirname as dirname10, join as join37 } from "path";
+function syncStatePath() {
+  return process.env.SYNKRO_INVENTORY_SYNC_STATE_PATH || join37(homedir37(), ".synkro", "inventory-sync.json");
+}
+function readState(path = syncStatePath()) {
+  try {
+    const parsed = JSON.parse(readFileSync37(path, "utf8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function writeState(state, path = syncStatePath()) {
+  try {
+    mkdirSync20(dirname10(path), { recursive: true, mode: 448 });
+    const temp = `${path}.${process.pid}.tmp`;
+    writeFileSync25(temp, JSON.stringify(state, null, 2) + "\n", { encoding: "utf8", mode: 384 });
+    renameSync10(temp, path);
+  } catch {
+  }
+}
+function shouldSyncInventory(state, now = Date.now(), target) {
+  if (target && state.last_target !== target) return true;
+  const lastOk = state.last_ok_at ? Date.parse(state.last_ok_at) : 0;
+  if (Number.isFinite(lastOk) && lastOk > 0 && now - lastOk < SUCCESS_INTERVAL_MS) return false;
+  const lastAttempt = state.last_attempt_at ? Date.parse(state.last_attempt_at) : 0;
+  return !Number.isFinite(lastAttempt) || lastAttempt <= 0 || now - lastAttempt >= FAILURE_RETRY_MS;
+}
+function readConfig() {
+  const path = join37(homedir37(), ".synkro", "config.env");
+  const out = {};
+  try {
+    for (const rawLine of readFileSync37(path, "utf8").split("\n")) {
+      const line = rawLine.trim();
+      if (!line || line.startsWith("#")) continue;
+      const index = line.indexOf("=");
+      if (index <= 0) continue;
+      const key = line.slice(0, index).trim();
+      let value = line.slice(index + 1).trim();
+      if (value.startsWith("'") && value.endsWith("'") || value.startsWith('"') && value.endsWith('"')) value = value.slice(1, -1);
+      out[key] = value;
+    }
+  } catch {
+  }
+  return out;
+}
+function inventorySyncTarget(config, env = process.env) {
+  return (config.SYNKRO_STORAGE_MODE || env.SYNKRO_STORAGE_MODE) === "cloud" ? "cloud" : "local";
+}
+function resolveLocalInventoryUrl(rawPort) {
+  const parsed = Number.parseInt(rawPort || "", 10);
+  const port = Number.isInteger(parsed) && parsed >= 1 && parsed <= 65535 ? parsed : 18931;
+  return `http://127.0.0.1:${port}/api/local/inventory/snapshot`;
+}
+function localhost(host) {
+  return host === "localhost" || host === "127.0.0.1" || host === "::1";
+}
+function resolveInventoryGateway(raw) {
+  if (!raw) return DEFAULT_GATEWAY2;
+  try {
+    const url = new URL(raw);
+    const host = url.hostname.toLowerCase();
+    const allowedHost = localhost(host) || host === "synkro.sh" || host.endsWith(".synkro.sh");
+    const allowedProtocol = url.protocol === "https:" || url.protocol === "http:" && localhost(host);
+    return allowedHost && allowedProtocol ? raw.replace(/\/$/, "") : DEFAULT_GATEWAY2;
+  } catch {
+    return DEFAULT_GATEWAY2;
+  }
+}
+async function loadToken() {
+  try {
+    const durable = readFileSync37(join37(homedir37(), ".synkro", ".mcp-jwt"), "utf8").trim();
+    if (durable) return durable;
+  } catch {
+  }
+  try {
+    const auth = await Promise.resolve().then(() => (init_stub(), stub_exports));
+    if (!auth.isAuthenticated()) return null;
+    await auth.ensureValidToken();
+    return auth.getAccessToken();
+  } catch {
+    return null;
+  }
+}
+function stable(value) {
+  if (Array.isArray(value)) return value.map(stable);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, child]) => [key, stable(child)]));
+}
+function inventorySnapshotChunks(snapshot, maxBytes = INVENTORY_CHUNK_BYTES) {
+  const { collected_at: _heartbeat, ...material } = snapshot;
+  const payloadHash = createHash6("sha256").update(JSON.stringify(stable(material))).digest("hex");
+  const snapshotId = randomUUID6();
+  const base = { ...snapshot, artifacts: [] };
+  const baseBytes = Buffer.byteLength(JSON.stringify(base));
+  const chunks = [];
+  let artifacts = [];
+  let bytes = baseBytes;
+  for (const artifact of snapshot.artifacts) {
+    const artifactBytes = Buffer.byteLength(JSON.stringify(artifact)) + 1;
+    if (artifacts.length > 0 && bytes + artifactBytes > maxBytes) {
+      chunks.push({ ...snapshot, artifacts });
+      artifacts = [];
+      bytes = baseBytes;
+    }
+    artifacts.push(artifact);
+    bytes += artifactBytes;
+  }
+  if (artifacts.length > 0 || chunks.length === 0) chunks.push({ ...snapshot, artifacts });
+  return { snapshotId, payloadHash, chunks };
+}
+async function postInventoryChunks(url, headers, snapshot) {
+  const delivery = inventorySnapshotChunks(snapshot);
+  let response = null;
+  for (let index = 0; index < delivery.chunks.length; index++) {
+    response = await fetch(url, {
+      method: "POST",
+      headers: {
+        ...headers,
+        "Content-Type": "application/json",
+        "X-Synkro-Inventory-Snapshot-Id": delivery.snapshotId,
+        "X-Synkro-Inventory-Payload-Hash": delivery.payloadHash,
+        "X-Synkro-Inventory-Chunk-Index": String(index),
+        "X-Synkro-Inventory-Chunk-Count": String(delivery.chunks.length),
+        "X-Synkro-Inventory-Artifact-Count": String(snapshot.artifacts.length)
+      },
+      body: JSON.stringify(delivery.chunks[index]),
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS2)
+    });
+    if (!response.ok) return response;
+  }
+  return response;
+}
+async function syncOperationalInventory(options = {}) {
+  const path = syncStatePath();
+  const state = readState(path);
+  const config = readConfig();
+  const target = inventorySyncTarget(config);
+  if (!options.force && !shouldSyncInventory(state, Date.now(), target)) return { ok: true, skipped: "throttled", target };
+  const attemptedAt = (/* @__PURE__ */ new Date()).toISOString();
+  writeState({ ...state, last_attempt_at: attemptedAt, last_target: target }, path);
+  try {
+    const snapshot = collectOperationalInventory();
+    if (target === "local") {
+      const response2 = await postInventoryChunks(resolveLocalInventoryUrl(
+        process.env.SYNKRO_HOST_MCP_PORT || process.env.SYNKRO_MCP_PORT || config.SYNKRO_MCP_PORT
+      ), {}, snapshot);
+      if (!response2.ok) {
+        const error = `http_${response2.status}`;
+        writeState({ ...state, last_attempt_at: attemptedAt, last_error: error, last_target: target }, path);
+        return { ok: false, status: response2.status, error, target };
+      }
+      writeState({ last_attempt_at: attemptedAt, last_ok_at: (/* @__PURE__ */ new Date()).toISOString(), last_target: target }, path);
+      return { ok: true, status: response2.status, target };
+    }
+    const token = await loadToken();
+    if (!token) {
+      writeState({ ...state, last_attempt_at: attemptedAt, last_error: "no_auth", last_target: target }, path);
+      return { ok: false, skipped: "no_auth", target };
+    }
+    const gateway = resolveInventoryGateway(
+      process.env.SYNKRO_GATEWAY_URL || config.SYNKRO_GATEWAY_URL || process.env.SYNKRO_API_URL
+    );
+    const response = await postInventoryChunks(
+      `${gateway}/api/v1/cli/inventory/snapshot`,
+      { Authorization: `Bearer ${token}` },
+      snapshot
+    );
+    if (!response.ok) {
+      const error = `http_${response.status}`;
+      writeState({ ...state, last_attempt_at: attemptedAt, last_error: error, last_target: target }, path);
+      return { ok: false, status: response.status, error, target };
+    }
+    writeState({ last_attempt_at: attemptedAt, last_ok_at: (/* @__PURE__ */ new Date()).toISOString(), last_target: target }, path);
+    return { ok: true, status: response.status, target };
+  } catch {
+    writeState({ ...state, last_attempt_at: attemptedAt, last_error: "sync_failed", last_target: target }, path);
+    return { ok: false, error: "sync_failed", target };
+  }
+}
+function syncOperationalInventoryDetached() {
+  if (process.env.SYNKRO_INVENTORY_DETACHED === "1") return;
+  const path = syncStatePath();
+  const state = readState(path);
+  const target = inventorySyncTarget(readConfig());
+  if (!shouldSyncInventory(state, Date.now(), target)) return;
+  writeState({ ...state, last_attempt_at: (/* @__PURE__ */ new Date()).toISOString(), last_target: target }, path);
+  try {
+    const script = process.argv[1];
+    if (!script || !existsSync38(script)) return;
+    const child = spawn8(process.execPath, [script, "inventory-sync", "--detached"], {
+      detached: true,
+      stdio: "ignore",
+      env: { ...process.env, SYNKRO_INVENTORY_DETACHED: "1" }
+    });
+    child.unref();
+  } catch {
+  }
+}
+var DEFAULT_GATEWAY2, SUCCESS_INTERVAL_MS, FAILURE_RETRY_MS, REQUEST_TIMEOUT_MS2, INVENTORY_CHUNK_BYTES;
+var init_sync2 = __esm({
+  "cli/inventory/sync.ts"() {
+    "use strict";
+    init_collector();
+    DEFAULT_GATEWAY2 = "https://api.synkro.sh";
+    SUCCESS_INTERVAL_MS = 30 * 6e4;
+    FAILURE_RETRY_MS = 5 * 6e4;
+    REQUEST_TIMEOUT_MS2 = 15e3;
+    INVENTORY_CHUNK_BYTES = 15e5;
+  }
+});
+
 // cli/bootstrap.js
-import { readFileSync as readFileSync35, existsSync as existsSync36 } from "fs";
-import { resolve as resolve5 } from "path";
+import { readFileSync as readFileSync38, existsSync as existsSync39 } from "fs";
+import { resolve as resolve6 } from "path";
 var envCandidates = [
-  resolve5(process.env.HOME ?? "", ".synkro", "config.env")
+  resolve6(process.env.HOME ?? "", ".synkro", "config.env")
 ];
 for (const envPath of envCandidates) {
-  if (!existsSync36(envPath)) continue;
-  const envContent = readFileSync35(envPath, "utf-8");
+  if (!existsSync39(envPath)) continue;
+  const envContent = readFileSync38(envPath, "utf-8");
   for (const line of envContent.split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -14548,9 +15991,9 @@ var args = process.argv.slice(2);
 var cmd2 = args[0] || "";
 var subArgs = args.slice(1);
 var isDetachedChild = process.env.SYNKRO_TELEMETRY_DETACHED === "1";
-var FLUSH_SKIP = /* @__PURE__ */ new Set(["grade", "version", "--version", "-v", "help", "--help", "-h", ""]);
+var FLUSH_SKIP = /* @__PURE__ */ new Set(["grade", "inventory-sync", "version", "--version", "-v", "help", "--help", "-h", ""]);
 function printVersion() {
-  console.log("1.7.95");
+  console.log("1.8.0");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents
@@ -14738,6 +16181,13 @@ async function main() {
       await telemetryCommand2(subArgs);
       break;
     }
+    // Internal detached worker. Operational inventory is independent of product
+    // telemetry and always fail-open; it intentionally stays out of help output.
+    case "inventory-sync": {
+      const { syncOperationalInventory: syncOperationalInventory2 } = await Promise.resolve().then(() => (init_sync2(), sync_exports2));
+      await syncOperationalInventory2({ force: subArgs.includes("--detached") || subArgs.includes("--force") });
+      break;
+    }
     default: {
       console.error(`Unknown command: ${cmd2}`);
       printHelp2();
@@ -14752,6 +16202,11 @@ async function postDispatchFlush() {
     flushDetached2();
   } catch {
   }
+  try {
+    const { syncOperationalInventoryDetached: syncOperationalInventoryDetached2 } = await Promise.resolve().then(() => (init_sync2(), sync_exports2));
+    syncOperationalInventoryDetached2();
+  } catch {
+  }
 }
 async function shutdown(code) {
   try {