@synkro-sh/cli 1.8.0 → 1.9.0

package/dist/bootstrap.js

@@ -147,7 +147,7 @@ function getIdentity() {
   if (cached2) return cached2;
   let cliVersion2 = "0.0.0";
   try {
-    cliVersion2 = "1.8.0";
+    cliVersion2 = "1.9.0";
   } catch {
   }
   const creds = loadCredentialsIdentity();
@@ -234,7 +234,7 @@ function emit(eventType, context, opts) {
     const cwd = opts?.cwd ?? process.cwd();
     const git = deriveGit(cwd);
     const emitter = process.env.SYNKRO_TELEMETRY_EMITTER || "bootstrap";
-    const row = {
+    const row2 = {
       client_event_id: randomUUID2(),
       event_type: eventType,
       occurred_at: (/* @__PURE__ */ new Date()).toISOString(),
@@ -263,7 +263,7 @@ function emit(eventType, context, opts) {
       context: redactContext(context)
     };
     ensureDir2();
-    appendFileSync(PENDING_PATH, JSON.stringify(row) + "\n", { mode: 384 });
+    appendFileSync(PENDING_PATH, JSON.stringify(row2) + "\n", { mode: 384 });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     process.stderr.write(`[synkro] telemetry emit(${eventType}) failed: ${msg}
@@ -297,9 +297,9 @@ function shiftPlaceholders(text, offset) {
 function bulkFragment(rows, columns) {
   if (!rows.length || !columns.length) throw new Error("empty SQL helper");
   const params = [];
-  const tuples = rows.map((row) => {
+  const tuples = rows.map((row2) => {
     const placeholders = columns.map((column) => {
-      let value = row[column];
+      let value = row2[column];
       let cast = "";
       if (column === "context" && typeof value === "object" && value !== null) {
         value = JSON.stringify(value);
@@ -1169,7 +1169,7 @@ async function getStats() {
       GROUP BY event_type
       ORDER BY c DESC
     `;
-    for (const row of types) base.by_type[String(row.event_type)] = Number(row.c);
+    for (const row2 of types) base.by_type[String(row2.event_type)] = Number(row2.c);
     const newest = await sql`
       SELECT occurred_at FROM telemetry_events ORDER BY occurred_at DESC LIMIT 1
     `;
@@ -1224,8 +1224,8 @@ async function exportEvents(path) {
   const lines = [];
   try {
     const rows = await sql`SELECT * FROM telemetry_events ORDER BY occurred_at ASC`;
-    for (const row of rows) {
-      lines.push(JSON.stringify(row));
+    for (const row2 of rows) {
+      lines.push(JSON.stringify(row2));
     }
   } catch {
   }
@@ -2880,8 +2880,8 @@ Print a short readiness summary: rules now active, security scanning on, the gra
 // cli/installer/skillParser.ts
 import { existsSync as existsSync15 } from "fs";
 import { resolve as resolve3 } from "path";
-function resolveSkillPaths(skills, repoRoot2) {
-  return skills.filter((s) => s.endsWith(".md")).map((s) => resolve3(repoRoot2, s)).filter((p) => existsSync15(p));
+function resolveSkillPaths(skills, repoRoot3) {
+  return skills.filter((s) => s.endsWith(".md")).map((s) => resolve3(repoRoot3, s)).filter((p) => existsSync15(p));
 }
 var init_skillParser = __esm({
   "cli/installer/skillParser.ts"() {
@@ -2897,7 +2897,7 @@ var STUB_COMMON_TS, STUB_EDIT_PRECHECK_TS, STUB_EDIT_FOLLOWUP_TS, STUB_CWE_PRECH
 var init_hookScriptsTs = __esm({
   "cli/installer/hookScriptsTs.ts"() {
     "use strict";
-    STUB_COMMON_TS = String.raw`import { existsSync, readFileSync, readdirSync, mkdirSync, writeFileSync, appendFileSync, statSync, realpathSync, openSync, readSync, closeSync } from 'node:fs';
+    STUB_COMMON_TS = String.raw`import { existsSync, readFileSync, readdirSync, mkdirSync, writeFileSync, appendFileSync, statSync, realpathSync, openSync, readSync, closeSync, unlinkSync } from 'node:fs';
 import { execFileSync, execSync } from 'node:child_process';
 import { homedir } from 'node:os';
 import { basename, dirname, join, resolve, relative, isAbsolute } from 'node:path';
@@ -3136,6 +3136,28 @@ function gitRoot(cwd: string): string {
   } catch { return ''; }
 }
 
+// synkro.toml is per-machine and untracked, so a LINKED git worktree never has
+// its own copy — its root is a fresh checkout. Resolve the main checkout through
+// the worktree's .git pointer file (a linked worktree's .git is a FILE reading
+// "gitdir: <main>/.git/worktrees/<name>") so worktrees inherit the repo's
+// config instead of silently skipping all grading. Opt-in semantics survive: a
+// repo whose MAIN root has no synkro.toml stays dormant. Pure fs — no
+// subprocess on the hook hot path.
+function mainWorktreeRoot(root: string): string {
+  try {
+    const dotGit = join(root, '.git');
+    if (statSync(dotGit).isDirectory()) return root;
+    const pointer = readFileSync(dotGit, 'utf-8');
+    const match = pointer.match(/^gitdir:\s*(.+?)\s*$/m);
+    if (!match) return root;
+    const gitDir = isAbsolute(match[1]) ? match[1] : join(root, match[1]);
+    const marker = join('.git', 'worktrees') + '/';
+    const at = gitDir.lastIndexOf('/' + marker);
+    if (at === -1) return root;
+    return gitDir.slice(0, at) || root;
+  } catch { return root; }
+}
+
 function taskRepoContext(root: string): any {
   if (!root) return undefined;
   try {
@@ -3182,16 +3204,144 @@ function taskRepoContext(root: string): any {
   } catch { return undefined; }
 }
 
-function taskScmBlockResponse(harness: string, reason: string): string {
-  const message = '[synkro:scm] ' + reason;
-  if (harness === 'cursor') return JSON.stringify({ permission: 'deny', user_message: message, agent_message: message });
+// One task-workspace message per TOOL CALL, not per hook. A single Bash call fans
+// out to install-scan + bash-judge + skill-judge (an Edit fans out to four), and
+// every hook is its own process, so the dedupe has to live on disk rather than in
+// a Map the way the server-side status-line dedupe does (see stableHookEventIdentity
+// in scanning/scanRouter). Atomic first-writer-wins via an exclusive create: the
+// hook that wins says it in full, the rest stay terse.
+const TOOL_CALL_MARK_DIR = join(HOME, '.synkro', 'tool-call-marks');
+const TOOL_CALL_MARK_WINDOW_MS = 15000;
+
+function pruneToolCallMarks(now: number): void {
+  try {
+    const entries = readdirSync(TOOL_CALL_MARK_DIR);
+    if (entries.length < 200) return;
+    for (const name of entries) {
+      const path = join(TOOL_CALL_MARK_DIR, name);
+      try {
+        if (now - statSync(path).mtimeMs > TOOL_CALL_MARK_WINDOW_MS) unlinkSync(path);
+      } catch {}
+    }
+  } catch {}
+}
+
+// The user's answer to "move into the task worktree, or stay here?". Written by the
+// "synkro workspace stay" command (the CLI owns ~/.synkro, so nothing hand-writes it)
+// and read here. Keyed by task alone: the decision resets when the active task
+// changes, which is the scope the workspace gate is asking about.
+const WORKSPACE_CHOICE_DIR = join(HOME, '.synkro', 'workspace-choice');
+
+// The user answers the workspace question in plain language on their next
+// prompt. Writing the marker is exactly what the CLI's "workspace stay"
+// command does — but the consent matcher only accepts one literal spelling,
+// and on a machine where PATH shadows the binary (observed: a venv python
+// named synkro, and an older global without the command) that spelling cannot
+// succeed, which deadlocked the ask. Patterns are DIRECTIVES, never
+// questions: a trailing question mark rejects, and the bare verb matches only
+// as a short standalone reply. Callers gate on a PENDING ask, so ordinary
+// conversation containing "stay" is never scanned against this.
+function isWorkspaceStayIntent(prompt: string): boolean {
+  const normalized = String(prompt || '').toLowerCase().replace(/\s+/g, ' ').trim();
+  if (!normalized || normalized.length > 240) return false;
+  if (/\?\s*$/.test(normalized)) return false;
+  if (/^(?:yes[,.\s]+)?(?:please\s+)?stay(?:\s+(?:here|put))?(?:\s*(?:pls|please))?[.!]?$/.test(normalized)) return true;
+  return [
+    /\b(?:stay|remain|keep working|keep going|continue)\b[^?]{0,60}\b(?:current|same|this)\s+(?:worktree|workspace|checkout|directory)\b/,
+    /\b(?:do not|don't|dont|no need to)\s+(?:move|switch|change)\b[^?]{0,40}\b(?:worktrees?|workspaces?|checkouts?)\b/,
+  ].some((pattern) => pattern.test(normalized));
+}
+
+function taskWorkspaceStayRecorded(taskId: string): boolean {
+  if (!/^task_[a-z0-9]{8}$/i.test(String(taskId || ''))) return false;
+  try { return existsSync(join(WORKSPACE_CHOICE_DIR, taskId + '.stay')); } catch { return false; }
+}
+
+// Our own context string, so the shape is stable: '... task=<id> ...'.
+function taskIdFromScmContext(context: string): string {
+  const marker = ' task=';
+  const at = String(context || '').indexOf(marker);
+  if (at === -1) return '';
+  const rest = context.slice(at + marker.length);
+  const end = rest.indexOf(' ');
+  return (end === -1 ? rest : rest.slice(0, end)).trim();
+}
+
+// Consent must never deadlock behind the block it resolves: the command that records
+// the answer is allowed through for the task currently being asked about, and nothing
+// else is.
+function isWorkspaceConsentCommand(payload: any, taskId: string): boolean {
+  if (!taskId || String(payload?.tool_name || '') !== 'Bash') return false;
+  const input = payload?.tool_input && typeof payload.tool_input === 'object' ? payload.tool_input : {};
+  const command = String(input.command || input.cmd || '').trim();
+  return command === 'synkro workspace stay ' + taskId;
+}
+
+function firstHookForToolCall(sessionId: string, payload: any): boolean {
+  const p = payload && typeof payload === 'object' ? payload : {};
+  const id = String(p.tool_use_id || p.tool_call_id || p.call_id || p.event_id || '').trim();
+  // Fallback when the harness omits a call id: tool name + input is identical across
+  // the surfaces of one call and distinct across different calls. Identical
+  // back-to-back commands can collide inside the window, which costs one repeated
+  // line and nothing else.
+  const material = id || (String(p.tool_name || '') + ':' + (p.tool_input ? JSON.stringify(p.tool_input) : ''));
+  if (!sessionId || !material) return true;
+  const key = createHash('sha256').update(sessionId + '\0' + material).digest('hex').slice(0, 24);
+  const marker = join(TOOL_CALL_MARK_DIR, key);
+  const now = Date.now();
+  try { mkdirSync(TOOL_CALL_MARK_DIR, { recursive: true }); } catch {}
+  pruneToolCallMarks(now);
+  try {
+    writeFileSync(marker, '', { flag: 'wx', mode: 0o600 });
+    return true;
+  } catch (err: any) {
+    if (err && err.code === 'EEXIST') {
+      // Outside the burst window this is a genuinely new call reusing the fallback
+      // key, so re-arm the marker and let it speak.
+      try {
+        if (now - statSync(marker).mtimeMs > TOOL_CALL_MARK_WINDOW_MS) {
+          writeFileSync(marker, '', { mode: 0o600 });
+          return true;
+        }
+      } catch {}
+      return false;
+    }
+    // Any other failure (read-only home, quota) must not silence the message.
+    return true;
+  }
+}
+
+function taskScmBlockResponse(harness: string, reason: string, verbose = true): string {
+  // Every fanned-out hook still denies — suppressing the decision itself would let the
+  // tool through if the winning hook's response were ever dropped. Only the TEXT
+  // collapses: the later surfaces of one tool call deny with no systemMessage and no
+  // additionalContext, so the transcript carries one workspace message, not three.
+  const tag = synkroOriginTag('synkro:scm', harness);
+  const message = tag + ' ' + reason;
+  if (harness === 'cursor') {
+    return verbose
+      ? JSON.stringify({ permission: 'deny', user_message: message, agent_message: message })
+      : JSON.stringify({ permission: 'deny', user_message: '', agent_message: '' });
+  }
+  if (!verbose) {
+    return JSON.stringify({
+      systemMessage: '',
+      hookSpecificOutput: {
+        hookEventName: 'PreToolUse',
+        permissionDecision: 'deny',
+        // Only surfaces if this hook's denial is the one the harness reports.
+        permissionDecisionReason: tag + ' blocked — see the workspace message above',
+        additionalContext: '',
+      },
+    });
+  }
   return JSON.stringify({
     systemMessage: message,
     hookSpecificOutput: {
       hookEventName: 'PreToolUse',
       permissionDecision: 'deny',
       permissionDecisionReason: message,
-      additionalContext: message + ' Resolve the repository state, then retry the tool call.',
+      additionalContext: message,
     },
   });
 }
@@ -3228,8 +3378,36 @@ function sharedRepoRoot(root: string): string {
   return dirname(common);
 }
 
-function taskWorktreePath(root: string, taskId: string): string {
-  return join(sharedRepoRoot(root), '.synkro-worktrees', taskId);
+// Claude Code only permits switching BETWEEN worktrees when the target lives under
+// <repo>/.claude/worktrees, so a cc session that activates a second task can never
+// reach another .synkro-worktrees path. Provisioning cc task worktrees under
+// .claude/worktrees keeps mid-session task switching working; every other harness
+// keeps the original location.
+const CC_MANAGED_WORKTREE_DIR = join('.claude', 'worktrees');
+const LEGACY_MANAGED_WORKTREE_DIR = '.synkro-worktrees';
+
+function managedWorktreeDir(harness: string): string {
+  return harness === 'cc' ? CC_MANAGED_WORKTREE_DIR : LEGACY_MANAGED_WORKTREE_DIR;
+}
+
+function taskWorktreePath(root: string, taskId: string, harness: string): string {
+  return join(sharedRepoRoot(root), managedWorktreeDir(harness), taskId);
+}
+
+function taskWorktreeCandidatePaths(root: string, taskId: string): string[] {
+  const shared = sharedRepoRoot(root);
+  return [CC_MANAGED_WORKTREE_DIR, LEGACY_MANAGED_WORKTREE_DIR]
+    .map((dir) => join(shared, dir, taskId));
+}
+
+// A task bound before the cc relocation keeps the worktree it already owns: the
+// canonical branch is checked out there, so provisioning a second one would fail
+// on 'the canonical task branch already exists in another workspace'.
+function resolveTaskWorktreePath(root: string, taskId: string, harness: string): string {
+  const records = taskWorktreeRecords(root);
+  const registered = taskWorktreeCandidatePaths(root, taskId)
+    .find((candidate) => records.some((item) => samePath(item.path, candidate)));
+  return registered || taskWorktreePath(root, taskId, harness);
 }
 
 function codexDesktopOrigin(): boolean {
@@ -3238,10 +3416,13 @@ function codexDesktopOrigin(): boolean {
   return origin === 'codex desktop' || bundle === 'com.openai.codex';
 }
 
-function ignoreManagedWorktreeDirectory(root: string): void {
-  const common = join(sharedRepoRoot(root), '.git');
+function ignoreManagedWorktreeDirectory(root: string, worktreePath: string): void {
+  const shared = sharedRepoRoot(root);
+  const common = join(shared, '.git');
   const excludePath = join(common, 'info', 'exclude');
-  const entry = '.synkro-worktrees/';
+  // Ignore the directory the worktree actually landed in, which differs per harness.
+  const entry = relative(shared, dirname(worktreePath)) + '/';
+  if (entry.startsWith('..')) return;
   let existing = '';
   try { existing = readFileSync(excludePath, 'utf-8'); } catch {}
   if (existing.split(/\r?\n/).includes(entry)) return;
@@ -3279,9 +3460,11 @@ function gitOperationInProgress(root: string): boolean {
 }
 
 function validateTaskWorktree(root: string, currentRoot: string, op: any): string {
-  const expected = taskWorktreePath(root, String(op.taskId || ''));
+  // Accept either managed location: a task bound before the cc relocation still
+  // pushes from its legacy .synkro-worktrees path.
+  const expected = taskWorktreeCandidatePaths(root, String(op.taskId || ''));
   const supplied = String(op.worktreePath || '');
-  const managed = Boolean(supplied) && samePath(supplied, expected);
+  const managed = Boolean(supplied) && expected.some((candidate) => samePath(supplied, candidate));
   const nativeCurrent = Boolean(supplied) && samePath(supplied, currentRoot);
   if (!managed && !nativeCurrent) {
     throw new Error('task worktree path does not match the managed or current native workspace');
@@ -3307,7 +3490,7 @@ async function completeTaskScm(sessionId: string, op: any, ok: boolean, error: s
   } catch {}
 }
 
-function executeTaskScm(root: string, op: any): string {
+function executeTaskScm(root: string, op: any, harness: string): string {
   if (!op || typeof op !== 'object') throw new Error('invalid SCM operation');
   if (!/^task_[a-z0-9]{8}$/i.test(String(op.taskId || ''))) throw new Error('invalid task id');
   const branch = String(op.branchName || '');
@@ -3372,7 +3555,7 @@ function executeTaskScm(root: string, op: any): string {
       }
       return root;
     }
-    const worktreePath = taskWorktreePath(boundRoot, String(op.taskId));
+    const worktreePath = resolveTaskWorktreePath(boundRoot, String(op.taskId), harness);
     const existing = taskWorktreeRecords(boundRoot).find((item) => samePath(item.path, worktreePath));
     if (existing) {
       if (existing.branch !== branch || gitOutput(worktreePath, ['rev-parse', '--abbrev-ref', 'HEAD']) !== branch) {
@@ -3398,7 +3581,7 @@ function executeTaskScm(root: string, op: any): string {
       throw new Error('task base revision is unavailable in this repository');
     }
     const originalBranch = gitOutput(root, ['rev-parse', '--abbrev-ref', 'HEAD']);
-    ignoreManagedWorktreeDirectory(boundRoot);
+    ignoreManagedWorktreeDirectory(boundRoot, worktreePath);
     mkdirSync(dirname(worktreePath), { recursive: true });
     gitOutput(root, ['worktree', 'add', '-b', branch, worktreePath, String(op.baseSha)], 30000);
     if (gitOutput(root, ['rev-parse', 'HEAD']) !== head
@@ -3430,14 +3613,23 @@ function executeTaskScm(root: string, op: any): string {
 
 interface TaskScmReconcileResult { reason: string; context: string }
 
-function taskScmWorkspaceContext(workspace: any): string {
+// Who acted and where it ran: a message in a shared terminal should say which
+// harness produced it and whether this install is grading locally or in the cloud.
+function synkroOriginTag(prefix: string, harness: string): string {
+  return '[' + prefix
+    + (harness ? ':' + harness : '')
+    + ':' + (deployIsCloud() ? 'cloud' : 'local')
+    + ']';
+}
+
+function taskScmWorkspaceContext(workspace: any, harness = ''): string {
   if (!workspace || typeof workspace !== 'object') return '';
   const taskId = String(workspace.taskId || '');
   const linearRef = String(workspace.linearRef || '');
   const branchName = String(workspace.branchName || '');
   const worktreePath = String(workspace.worktreePath || '');
   if (!taskId || !branchName) return '';
-  return '[synkro:task-workspace] task=' + taskId
+  return synkroOriginTag('synkro:task-workspace', harness) + ' task=' + taskId
     + (linearRef ? ' linear=' + linearRef : '')
     + ' branch=' + branchName
     + (worktreePath ? ' worktree=' + worktreePath : ' worktree=pending-native-handoff');
@@ -3448,7 +3640,7 @@ function shellTaskWorkspaceArg(value: string): string {
 }
 
 function taskScmWorkspaceInstruction(harness: string, sessionId: string, workspace: any): string {
-  const context = taskScmWorkspaceContext(workspace);
+  const context = taskScmWorkspaceContext(workspace, harness);
   const worktreePath = String(workspace?.worktreePath || '');
   const branchName = String(workspace?.branchName || '');
   if (!context || !branchName) return '';
@@ -3456,9 +3648,14 @@ function taskScmWorkspaceInstruction(harness: string, sessionId: string, workspa
     + 'or ask the user to perform the transition. Synkro keeps substantive tools blocked until this exact session reports '
     + 'the task worktree and canonical branch.';
   if (harness === 'cc') {
-    if (!worktreePath) return context + '\n[synkro:workspace-handoff] Task worktree creation failed closed; retry workspace preparation.';
-    return context + '\n[synkro:workspace-handoff] Invoke Claude Code EnterWorktree now for the existing worktree '
-      + JSON.stringify(worktreePath) + ' on branch ' + JSON.stringify(branchName) + '. ' + requirement;
+    if (!worktreePath) return context + '\nTask worktree creation failed closed; retry workspace preparation.';
+    // Ask, do not command. The user may legitimately want to keep working where they
+    // are, and Synkro should not move them without their say-so.
+    return context + '\nAsk the user whether to move this task into its isolated worktree '
+      + JSON.stringify(worktreePath) + ' on branch ' + JSON.stringify(branchName)
+      + ', or keep working in the current workspace. Do not decide for them. '
+      + 'To move: invoke EnterWorktree on that path. '
+      + 'To stay: run "synkro workspace stay ' + String(workspace?.taskId || '') + '".';
   }
   if (harness === 'cursor') {
     if (!worktreePath) return context + '\n[synkro:workspace-handoff] Task worktree creation failed closed; retry workspace preparation.';
@@ -3539,11 +3736,11 @@ async function reconcileTaskScm(
           ? (taskScmWorkspaceInstruction(harness, sessionId, workspace)
             || String(result.reason || 'task source-control preparation is pending'))
           : '',
-        context: taskScmWorkspaceContext(workspace),
+        context: taskScmWorkspaceContext(workspace, harness),
       };
     }
     try {
-      const worktreePath = executeTaskScm(root, result.op);
+      const worktreePath = executeTaskScm(root, result.op, harness);
       await completeTaskScm(sessionId, result.op, true, '', worktreePath);
       if (result.op.kind === 'branch') {
         if (result.op.adoptExistingWorktree === true) {
@@ -3551,12 +3748,12 @@ async function reconcileTaskScm(
           if (rebound.ok) {
             const reboundResult = await rebound.json() as any;
             if (!reboundResult?.waiting && reboundResult?.workspace) {
-              return { reason: '', context: taskScmWorkspaceContext(reboundResult.workspace) };
+              return { reason: '', context: taskScmWorkspaceContext(reboundResult.workspace, harness) };
             }
             if (reboundResult?.waiting) {
               return {
                 reason: String(reboundResult.reason || 'Codex native worktree binding is pending'),
-                context: taskScmWorkspaceContext(reboundResult.workspace),
+                context: taskScmWorkspaceContext(reboundResult.workspace, harness),
               };
             }
           }
@@ -4188,10 +4385,19 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
     // Dormancy: a repo is onboarded only if it has a synkro.toml FILE at its git
     // root. Guard root !== HOME — ~/.synkro is the config DIRECTORY, so without
     // this a home-rooted cwd (dotfiles in git, non-git dir under home) could
-    // look onboarded.
+    // look onboarded. A linked worktree checked out at a commit predating the
+    // tracked synkro.toml has no copy of its own — fall back to the main
+    // checkout's config rather than silently skipping enforcement there.
     let synkroFileText = '';
-    if (root && root !== HOME && existsSync(join(root, 'synkro.toml'))) {
-      try { synkroFileText = readFileSync(join(root, 'synkro.toml'), 'utf-8'); } catch {}
+    if (root && root !== HOME) {
+      let configRoot = root;
+      if (!existsSync(join(configRoot, 'synkro.toml'))) {
+        const mainRoot = mainWorktreeRoot(root);
+        if (mainRoot !== root && mainRoot !== HOME && existsSync(join(mainRoot, 'synkro.toml'))) {
+          configRoot = mainRoot;
+        }
+      }
+      try { synkroFileText = readFileSync(join(configRoot, 'synkro.toml'), 'utf-8'); } catch {}
     }
     if (!synkroFileText) {
       // Repo not onboarded — emit a minimal tool_call so usage analytics still
@@ -4220,8 +4426,26 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
 
     const scm = await reconcileTaskScm(root || cwd, sessionId, harness, payload);
     const substantiveTool = /^(?:Bash|Edit|Write|MultiEdit|NotebookEdit|apply_patch|file_change)$/i.test(String(payload.tool_name || ''));
-    if (scm.reason && substantiveTool) {
-      out(taskScmBlockResponse(harness, scm.reason));
+    const scmTaskId = taskIdFromScmContext(scm.context);
+    // The user can settle the workspace question in plain language: while the
+    // ask is pending for this session's task, a stay-directive on the user's
+    // prompt records the same durable marker the CLI command writes. Reconcile
+    // just told us WHICH task is being asked, so no extra state is needed and
+    // ordinary prompts outside a pending ask are never scanned.
+    if (surface === 'prompt-submit' && scm.reason && scmTaskId && !taskWorkspaceStayRecorded(scmTaskId)) {
+      const promptText = String(payload.prompt || payload.user_message || '');
+      if (isWorkspaceStayIntent(promptText)) {
+        try {
+          mkdirSync(WORKSPACE_CHOICE_DIR, { recursive: true });
+          writeFileSync(join(WORKSPACE_CHOICE_DIR, scmTaskId + '.stay'), new Date().toISOString() + '\n');
+        } catch { /* fail-open: the CLI command and the exact-string path remain */ }
+      }
+    }
+    // The user was asked and chose to keep working here, or is answering right now.
+    const workspaceConsentSettled = Boolean(scmTaskId)
+      && (taskWorkspaceStayRecorded(scmTaskId) || isWorkspaceConsentCommand(payload, scmTaskId));
+    if (scm.reason && substantiveTool && !workspaceConsentSettled) {
+      out(taskScmBlockResponse(harness, scm.reason, firstHookForToolCall(sessionId, payload)));
       return;
     }
 
@@ -4382,7 +4606,15 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
     const contractResponseText = opts.stopContract && harness === 'codex'
       ? codexStopResponse(rawResponseText)
       : rawResponseText;
-    const responseText = withTaskScmContext(contractResponseText, harness, scm.context);
+    // Only the first hook of this tool call carries the workspace context; the other
+    // surfaces of the same call would otherwise repeat it verbatim 2-4 times.
+    let scmContext = scm.context && firstHookForToolCall(sessionId, payload) ? scm.context : '';
+    // Say plainly that work is continuing outside the task worktree by the user's choice,
+    // so the state is never mistaken for a binding that silently failed.
+    if (scmContext && scmTaskId && taskWorkspaceStayRecorded(scmTaskId)) {
+      scmContext += ' workspace=staying-here-by-user-choice';
+    }
+    const responseText = withTaskScmContext(contractResponseText, harness, scmContext);
     out(responseText);
     emitStubTelemetry(surface, harness, telemPayload, responseText, Date.now() - startedAt, telemCwd, telemSessionId);
   } catch (err) {
@@ -7281,8 +7513,8 @@ async function dockerInstall(opts = {}) {
     "SYNKRO_TELEMETRY_QUEUE=/data/synkro-host/telemetry-pending.jsonl",
     image
   ];
-  const run = spawnSync3("docker", args2, { encoding: "utf-8", stdio: "inherit", timeout: 6e4 });
-  if (run.status !== 0) {
+  const run2 = spawnSync3("docker", args2, { encoding: "utf-8", stdio: "inherit", timeout: 6e4 });
+  if (run2.status !== 0) {
     throw new DockerInstallError(`docker run failed (image ${image})`);
   }
   return {
@@ -7513,7 +7745,7 @@ var init_dockerInstall = __esm({
     HOST_PGLITE_PORT = parseInt(process.env.SYNKRO_HOST_PGLITE_PORT || "15433", 10);
     CONTAINER_NAME = resolveContainerName();
     defaultImageVersion = () => {
-      if (true) return "1.8.0";
+      if (true) return "1.9.0";
       try {
         const pkg = JSON.parse(readFileSync17(new URL("../../package.json", import.meta.url), "utf8"));
         if (pkg.version) return pkg.version;
@@ -8221,7 +8453,7 @@ function isoDay(value, fallbackDay) {
 function parseClaudeTranscriptUsage(transcript, fallbackDay = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10), options = {}) {
   const seen = options.seenStableIds ?? /* @__PURE__ */ new Set();
   const rollups = /* @__PURE__ */ new Map();
-  const usage = {
+  const usage2 = {
     input_tokens: 0,
     output_tokens: 0,
     cache_creation_input_tokens: 0,
@@ -8255,7 +8487,7 @@ function parseClaudeTranscriptUsage(transcript, fallbackDay = (/* @__PURE__ */ n
       if (entryModel !== "<synthetic>") model = entryModel;
       const day = isoDay(entry.timestamp, fallbackDay);
       const key = `${day}\0${entryModel}`;
-      const row = rollups.get(key) ?? {
+      const row2 = rollups.get(key) ?? {
         day,
         model: entryModel,
         turns: 0,
@@ -8264,23 +8496,23 @@ function parseClaudeTranscriptUsage(transcript, fallbackDay = (/* @__PURE__ */ n
         cache_creation_input_tokens: 0,
         cache_read_input_tokens: 0
       };
-      row.turns += 1;
-      row.input_tokens += counts.input_tokens;
-      row.output_tokens += counts.output_tokens;
-      row.cache_creation_input_tokens += counts.cache_creation_input_tokens;
-      row.cache_read_input_tokens += counts.cache_read_input_tokens;
-      rollups.set(key, row);
+      row2.turns += 1;
+      row2.input_tokens += counts.input_tokens;
+      row2.output_tokens += counts.output_tokens;
+      row2.cache_creation_input_tokens += counts.cache_creation_input_tokens;
+      row2.cache_read_input_tokens += counts.cache_read_input_tokens;
+      rollups.set(key, row2);
       turns += 1;
-      usage.input_tokens += counts.input_tokens;
-      usage.output_tokens += counts.output_tokens;
-      usage.cache_creation_input_tokens += counts.cache_creation_input_tokens;
-      usage.cache_read_input_tokens += counts.cache_read_input_tokens;
+      usage2.input_tokens += counts.input_tokens;
+      usage2.output_tokens += counts.output_tokens;
+      usage2.cache_creation_input_tokens += counts.cache_creation_input_tokens;
+      usage2.cache_read_input_tokens += counts.cache_read_input_tokens;
     } catch {
     }
   }
   if (turns === 0) return null;
   return {
-    usage,
+    usage: usage2,
     model: model || "unknown",
     rollups: [...rollups.values()].sort(
       (a, b) => a.day.localeCompare(b.day) || a.model.localeCompare(b.model)
@@ -8570,7 +8802,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle2(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle2(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle2(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle2("1.8.0")}`
+    `SYNKRO_VERSION=${shellQuoteSingle2("1.9.0")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle2(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle2(safeUserId)}`);
@@ -9317,7 +9549,7 @@ async function installCommand(opts = {}) {
   await setTelemetryState({ enabled: true, remoteFlushEnabled: telemetryConsent });
   emit("install", {
     phase: "started",
-    cli_version_to: "1.8.0",
+    cli_version_to: "1.9.0",
     agents_detected: agents.map((a) => a.kind),
     with_github: false,
     with_local_cc: false,
@@ -10178,7 +10410,7 @@ async function syncSkillFiles() {
 function normSkillName(name) {
   return name.toLowerCase().replace(/\.mdx?$/, "");
 }
-function discoverSkillFiles(repoRoot2, excludeHashes, ingestedHashes, ingestedNames) {
+function discoverSkillFiles(repoRoot3, excludeHashes, ingestedHashes, ingestedNames) {
   const roots = [];
   const add = (p) => {
     try {
@@ -10188,9 +10420,9 @@ function discoverSkillFiles(repoRoot2, excludeHashes, ingestedHashes, ingestedNa
   };
   add(join19(homedir21(), ".claude", "skills"));
   add(join19(homedir21(), ".agents", "skills"));
-  if (repoRoot2) {
-    add(join19(repoRoot2, ".claude", "skills"));
-    add(join19(repoRoot2, ".agents", "skills"));
+  if (repoRoot3) {
+    add(join19(repoRoot3, ".claude", "skills"));
+    add(join19(repoRoot3, ".agents", "skills"));
   }
   const out = [];
   const seen = /* @__PURE__ */ new Set();
@@ -10273,7 +10505,7 @@ Found ${found.length} skill${found.length === 1 ? "" : "s"} in your Claude Code
 async function discoverAndIngestSkills() {
   try {
     const sf = readFullSynkroFile();
-    const repoRoot2 = sf?._repoRoot || detectGitRepo2();
+    const repoRoot3 = sf?._repoRoot || detectGitRepo2();
     const mcpPort = process.env.SYNKRO_MCP_PORT || "18931";
     const excludeHashes = /* @__PURE__ */ new Set();
     if (sf?.skills?.length) {
@@ -10297,7 +10529,7 @@ async function discoverAndIngestSkills() {
       }
     } catch {
     }
-    const found = discoverSkillFiles(repoRoot2, excludeHashes, ingestedHashes, ingestedNames);
+    const found = discoverSkillFiles(repoRoot3, excludeHashes, ingestedHashes, ingestedNames);
     if (found.length === 0) return;
     const selectable = found.filter((f) => !f.ingested);
     if (selectable.length === 0) {
@@ -10333,18 +10565,18 @@ async function discoverAndIngestSkills() {
   }
 }
 function resolveSynkroBinPath() {
-  const run = (cmd3) => {
+  const run2 = (cmd3) => {
     try {
       return execSync4(cmd3, { encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
     } catch {
       return "";
     }
   };
-  const p = run("command -v synkro").split("\n")[0].trim();
+  const p = run2("command -v synkro").split("\n")[0].trim();
   return p && isAbsolute(p) ? p : "";
 }
 function ensureReachabilityGitHook() {
-  const run = (cmd3) => {
+  const run2 = (cmd3) => {
     try {
       return execSync4(cmd3, { encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
     } catch {
@@ -10352,9 +10584,9 @@ function ensureReachabilityGitHook() {
     }
   };
   try {
-    const root = run("git rev-parse --show-toplevel");
+    const root = run2("git rev-parse --show-toplevel");
     if (!root) return null;
-    let hooksDir = run("git config --get core.hooksPath");
+    let hooksDir = run2("git config --get core.hooksPath");
     hooksDir = hooksDir ? isAbsolute(hooksDir) ? hooksDir : join19(root, hooksDir) : join19(root, ".git", "hooks");
     if (!existsSync22(hooksDir)) mkdirSync15(hooksDir, { recursive: true });
     const hookPath = join19(hooksDir, "post-commit");
@@ -10396,18 +10628,18 @@ function ensureReachabilityGitHook() {
   }
 }
 function detectGitRepo2() {
-  const run = (cmd3) => {
+  const run2 = (cmd3) => {
     try {
       return execSync4(cmd3, { encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
     } catch {
       return "";
     }
   };
-  const remoteUrl = run("git remote get-url origin");
+  const remoteUrl = run2("git remote get-url origin");
   if (remoteUrl) {
     return remoteUrl.replace(/^git@[^:]+:/, "").replace(/^https?:\/\/[^/]+\//, "").replace(/\.git$/, "");
   }
-  const root = run("git rev-parse --show-toplevel");
+  const root = run2("git rev-parse --show-toplevel");
   return root ? root.split("/").pop() || null : null;
 }
 function getClaudeProjectsFolder() {
@@ -13856,10 +14088,10 @@ var init_packVerify = __esm({
 // cli/installer/lockfile.ts
 import { existsSync as existsSync30, readFileSync as readFileSync28, writeFileSync as writeFileSync20 } from "fs";
 import { join as join28 } from "path";
-function lockPath(repoRoot2) {
-  return join28(repoRoot2, LOCK_FILE);
+function lockPath(repoRoot3) {
+  return join28(repoRoot3, LOCK_FILE);
 }
-function writeLockfile(repoRoot2, entries) {
+function writeLockfile(repoRoot3, entries) {
   const sorted = [...entries].sort((a, b) => a.ref.localeCompare(b.ref));
   const body = [
     "# synkro.lock \u2014 generated by `synkro sync`. Commit this file.",
@@ -13875,7 +14107,7 @@ function writeLockfile(repoRoot2, entries) {
       ""
     ])
   ].join("\n");
-  writeFileSync20(lockPath(repoRoot2), body, "utf-8");
+  writeFileSync20(lockPath(repoRoot3), body, "utf-8");
 }
 var LOCK_FILE;
 var init_lockfile = __esm({
@@ -14087,6 +14319,822 @@ var init_whoami = __esm({
   }
 });
 
+// cli/commands/workspace.ts
+var workspace_exports = {};
+__export(workspace_exports, {
+  workspaceCommand: () => workspaceCommand
+});
+import { existsSync as existsSync33, mkdirSync as mkdirSync19, readdirSync as readdirSync8, rmSync as rmSync5, writeFileSync as writeFileSync22 } from "fs";
+import { join as join31 } from "path";
+import { homedir as homedir31 } from "os";
+function markerPath(taskId) {
+  return join31(WORKSPACE_CHOICE_DIR, `${taskId}.stay`);
+}
+function usage() {
+  console.log(`synkro workspace \u2014 record where a task's work happens
+
+Usage:
+  synkro workspace stay <taskId>     keep working in the current checkout
+  synkro workspace clear <taskId>    forget the choice (the gate asks again)
+  synkro workspace status [taskId]   show recorded choices
+
+The gate asks once per task. "stay" is remembered until the choice is cleared or
+the active task changes.`);
+}
+async function workspaceCommand(args2) {
+  const sub = String(args2[0] || "").trim();
+  const taskId = String(args2[1] || "").trim();
+  if (!sub || sub === "help" || sub === "--help" || sub === "-h") {
+    usage();
+    return;
+  }
+  if (sub === "status") {
+    let recorded = [];
+    try {
+      recorded = existsSync33(WORKSPACE_CHOICE_DIR) ? readdirSync8(WORKSPACE_CHOICE_DIR).filter((name) => name.endsWith(".stay")) : [];
+    } catch {
+      recorded = [];
+    }
+    if (taskId) {
+      const on = recorded.includes(`${taskId}.stay`);
+      console.log(`${taskId}: ${on ? "stay recorded" : "no choice recorded"}`);
+      return;
+    }
+    if (recorded.length === 0) {
+      console.log("No workspace choices recorded.");
+      return;
+    }
+    console.log("Staying in the current checkout for:");
+    for (const name of recorded.sort()) console.log(`  ${name.replace(/\.stay$/, "")}`);
+    return;
+  }
+  if (sub !== "stay" && sub !== "clear") {
+    console.error(`Unknown workspace subcommand: ${sub}`);
+    usage();
+    process.exitCode = 2;
+    return;
+  }
+  if (!TASK_ID.test(taskId)) {
+    console.error(taskId ? `Not a task id: ${taskId} (expected task_ followed by 8 characters)` : `Usage: synkro workspace ${sub} <taskId>`);
+    process.exitCode = 2;
+    return;
+  }
+  if (sub === "clear") {
+    try {
+      rmSync5(markerPath(taskId), { force: true });
+    } catch {
+    }
+    console.log(`Cleared the workspace choice for ${taskId}.`);
+    return;
+  }
+  try {
+    mkdirSync19(WORKSPACE_CHOICE_DIR, { recursive: true });
+    writeFileSync22(markerPath(taskId), `${(/* @__PURE__ */ new Date()).toISOString()}
+`, "utf-8");
+  } catch (error) {
+    console.error(`Could not record the workspace choice: ${error?.message || error}`);
+    process.exitCode = 1;
+    return;
+  }
+  console.log(`Staying in the current checkout for ${taskId}. Synkro will not ask again for this task.`);
+}
+var WORKSPACE_CHOICE_DIR, TASK_ID;
+var init_workspace = __esm({
+  "cli/commands/workspace.ts"() {
+    "use strict";
+    WORKSPACE_CHOICE_DIR = join31(homedir31(), ".synkro", "workspace-choice");
+    TASK_ID = /^task_[a-z0-9]{8}$/i;
+  }
+});
+
+// cli/ui/tmux.ts
+import { execFile as execFile2, spawnSync as spawnSync11 } from "child_process";
+import { promisify } from "util";
+function runnerArgs(runner, argv) {
+  return runner.kind === "container" ? ["docker", "exec", "-u", CONTAINER_USER, runner.container, ...argv] : argv;
+}
+function runnerInteractiveArgs(runner, argv) {
+  return runner.kind === "container" ? ["docker", "exec", "-it", "-u", CONTAINER_USER, runner.container, ...argv] : argv;
+}
+async function run(runner, argv) {
+  const [cmd3, ...args2] = runnerArgs(runner, argv);
+  try {
+    const { stdout, stderr } = await execFileAsync(cmd3, args2, { timeout: 8e3, maxBuffer: 1024 * 1024 });
+    return { ok: true, stdout: String(stdout || ""), stderr: String(stderr || "") };
+  } catch (error) {
+    return { ok: false, stdout: String(error?.stdout || ""), stderr: String(error?.stderr || error?.message || "") };
+  }
+}
+function runInherit(argv) {
+  const [cmd3, ...args2] = argv;
+  const result = spawnSync11(cmd3, args2, { stdio: "inherit" });
+  return result.status ?? 1;
+}
+function slugify(name) {
+  return String(name || "").toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "agent";
+}
+function agentSession(name) {
+  return AGENT_PREFIX + slugify(name);
+}
+function buildSpawnAgent(opts) {
+  const session = agentSession(opts.name);
+  return [
+    ["tmux", "new-session", "-d", "-s", session, "-c", opts.cwd, opts.command],
+    ["tmux", "set-option", "-t", session, "status", "off"],
+    ["tmux", "set-option", "-t", session, "-q", "@synkro_harness", opts.harness],
+    ["tmux", "set-option", "-t", session, "-q", "@synkro_space", opts.space],
+    ["tmux", "set-option", "-t", session, "-q", "@synkro_backend", opts.backend],
+    // Keep the pane visible after exit so the sidebar can render 'done'
+    // instead of the agent silently vanishing.
+    ["tmux", "set-option", "-t", session, "remain-on-exit", "on"]
+  ];
+}
+function buildListAgents() {
+  return ["tmux", "list-sessions", "-F", ["#{session_name}", "#{?pane_dead,dead,alive}", "#{@synkro_harness}", "#{@synkro_space}", "#{@synkro_backend}", "#{@synkro_pueue}"].join(FIELD_SEP)];
+}
+function buildCapture(session, lines = 14) {
+  return ["tmux", "capture-pane", "-p", "-t", session, "-S", String(-lines)];
+}
+function buildKillSession(session) {
+  return ["tmux", "kill-session", "-t", session];
+}
+function buildSetOption(session, option, value) {
+  return ["tmux", "set-option", "-t", session, "-q", option, value];
+}
+function buildSendText(session, text) {
+  return [
+    ["tmux", "send-keys", "-t", session, "-l", text],
+    ["tmux", "send-keys", "-t", session, "Enter"]
+  ];
+}
+function buildInterrupt(session) {
+  return ["tmux", "send-keys", "-t", session, "Escape"];
+}
+function buildCenterAttachCommand(runner, session) {
+  const argv = runnerInteractiveArgs(runner, ["tmux", "attach-session", "-t", session]);
+  return "env TMUX= " + argv.map(shellQuote3).join(" ");
+}
+function shellQuote3(value) {
+  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value) ? value : "'" + value.replace(/'/g, "'\\''") + "'";
+}
+function parseAgentSessions(output, backend) {
+  return String(output || "").split("\n").map((line) => line.split(FIELD_SEP)).filter((cols) => cols[0]?.startsWith(AGENT_PREFIX)).map((cols) => ({
+    session: cols[0],
+    name: cols[0].slice(AGENT_PREFIX.length),
+    dead: cols[1] === "dead",
+    harness: cols[2] || "claude",
+    space: cols[3] || "",
+    backend: cols[4] || backend,
+    pueue: cols[5] || ""
+  }));
+}
+function parseWorktrees(porcelain) {
+  const rows = [];
+  let current = {};
+  for (const line of String(porcelain || "").split("\n")) {
+    if (line.startsWith("worktree ")) current = { path: line.slice(9).trim() };
+    else if (line.startsWith("branch ")) current.branch = line.slice(7).replace("refs/heads/", "").trim();
+    else if (line.trim() === "" && current.path) {
+      rows.push({
+        path: current.path,
+        branch: current.branch || "detached",
+        name: current.path.split("/").filter(Boolean).pop() || current.path
+      });
+      current = {};
+    }
+  }
+  if (current.path) {
+    rows.push({
+      path: current.path,
+      branch: current.branch || "detached",
+      name: current.path.split("/").filter(Boolean).pop() || current.path
+    });
+  }
+  return rows;
+}
+var execFileAsync, AGENT_PREFIX, UI_SESSION, CONTAINER_USER, FIELD_SEP;
+var init_tmux = __esm({
+  "cli/ui/tmux.ts"() {
+    "use strict";
+    execFileAsync = promisify(execFile2);
+    AGENT_PREFIX = "synkro-agent-";
+    UI_SESSION = "synkro-ui";
+    CONTAINER_USER = "synkro";
+    FIELD_SEP = "|";
+  }
+});
+
+// cli/ui/launch.ts
+function welcomeCommand() {
+  const banner = [
+    "",
+    "   synkro ui",
+    "   governed agents, one screen",
+    "",
+    "   enter  attach selected agent",
+    "   n      new agent in selected space",
+    "   c      new container agent",
+    "   g/s/y  consent: track / skip / stay",
+    "   T      new tab      q  quit",
+    ""
+  ].join("\\n");
+  return "printf " + shellQuote3(banner + "\\n") + "; tail -f /dev/null";
+}
+function sidebarCommand(bootPath, centerPane, repoCwd) {
+  const env = [
+    "SYNKRO_UI_CENTER=" + shellQuote3(centerPane),
+    "SYNKRO_UI_OUTER=" + UI_SESSION,
+    "SYNKRO_UI_BOOT=" + shellQuote3(bootPath),
+    "SYNKRO_UI_REPO=" + shellQuote3(repoCwd)
+  ].join(" ");
+  return "env " + env + " node " + shellQuote3(bootPath) + " ui --sidebar";
+}
+async function styleOuterSession() {
+  const style = [
+    ["set-option", "-t", UI_SESSION, "status-position", "top"],
+    ["set-option", "-t", UI_SESSION, "status-style", "bg=colour233,fg=colour245"],
+    ["set-option", "-t", UI_SESSION, "status-left", " synkro "],
+    ["set-option", "-t", UI_SESSION, "status-left-style", "fg=colour135,bold"],
+    ["set-option", "-t", UI_SESSION, "status-right", " + (T new tab) "],
+    ["set-option", "-t", UI_SESSION, "status-right-style", "fg=colour240"],
+    ["set-option", "-t", UI_SESSION, "-w", "window-status-format", "  #W  "],
+    ["set-option", "-t", UI_SESSION, "-w", "window-status-current-format", "#[bg=colour135,fg=colour233,bold]  #W  #[default]"],
+    ["set-option", "-t", UI_SESSION, "pane-border-style", "fg=colour236"],
+    ["set-option", "-t", UI_SESSION, "pane-active-border-style", "fg=colour135"],
+    // Tab keys without the prefix: Alt+t new tab, Alt+arrows to move.
+    ["bind-key", "-n", "M-t", "new-window"],
+    ["bind-key", "-n", "M-Right", "next-window"],
+    ["bind-key", "-n", "M-Left", "previous-window"]
+  ];
+  for (const argv of style) await run(HOST, ["tmux", ...argv]);
+}
+async function buildTab(bootPath, repoCwd, windowTarget) {
+  if (windowTarget === void 0) {
+    await run(HOST, ["tmux", "new-session", "-d", "-s", UI_SESSION, "-x", "220", "-y", "55", welcomeCommand()]);
+    windowTarget = UI_SESSION + ":0";
+  } else {
+    const created = await run(HOST, ["tmux", "new-window", "-t", UI_SESSION, "-P", "-F", "#{window_id}", welcomeCommand()]);
+    windowTarget = created.stdout.trim() || windowTarget;
+  }
+  await run(HOST, ["tmux", "rename-window", "-t", windowTarget, "space"]);
+  const split = await run(HOST, [
+    "tmux",
+    "split-window",
+    "-hb",
+    "-t",
+    windowTarget,
+    "-l",
+    SIDEBAR_WIDTH,
+    "-P",
+    "-F",
+    "#{pane_id}",
+    "tail -f /dev/null"
+  ]);
+  const sidebarPane = split.stdout.trim();
+  const panes = await run(HOST, ["tmux", "list-panes", "-t", windowTarget, "-F", "#{pane_id}"]);
+  const centerPane = panes.stdout.split("\n").map((line) => line.trim()).filter(Boolean).find((id) => id !== sidebarPane) || "";
+  await run(HOST, ["tmux", "respawn-pane", "-k", "-t", sidebarPane, sidebarCommand(bootPath, centerPane, repoCwd)]);
+}
+async function uiSessionExists() {
+  const result = await run(HOST, ["tmux", "has-session", "-t", UI_SESSION]);
+  return result.ok;
+}
+async function launchUi(bootPath, repoCwd) {
+  if (!await uiSessionExists()) {
+    await buildTab(bootPath, repoCwd);
+    await styleOuterSession();
+  }
+  return runInherit(process.env.TMUX ? ["tmux", "switch-client", "-t", UI_SESSION] : ["tmux", "attach-session", "-t", UI_SESSION]);
+}
+var SIDEBAR_WIDTH, HOST;
+var init_launch = __esm({
+  "cli/ui/launch.ts"() {
+    "use strict";
+    init_tmux();
+    SIDEBAR_WIDTH = "34";
+    HOST = { kind: "host" };
+  }
+});
+
+// cli/ui/model.ts
+function detectAsk(tail2) {
+  for (const marker of BLOCK_MARKERS) {
+    if (marker.pattern.test(String(tail2 || ""))) return marker.ask;
+  }
+  return null;
+}
+function deriveStatus(input) {
+  if (input.dead) return { status: "done" };
+  const ask3 = detectAsk(input.tail);
+  if (ask3) return { status: "blocked", ask: ask3 };
+  return { status: input.changed ? "working" : "idle" };
+}
+function hashTail(tail2) {
+  let hash = 0;
+  const text = String(tail2 || "");
+  for (let index = 0; index < text.length; index += 1) {
+    hash = (hash << 5) - hash + text.charCodeAt(index) | 0;
+  }
+  return String(hash);
+}
+function mapAgentToTask(spacePath, tasks) {
+  const normalized = String(spacePath || "").replace(/\/+$/, "");
+  if (!normalized) return void 0;
+  const hit = tasks.find((task) => task.worktree && task.worktree.replace(/\/+$/, "") === normalized);
+  return hit?.linear || void 0;
+}
+async function fetchConductorTasks(baseUrl) {
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 900);
+    const response = await fetch(baseUrl + "/api/local/conductor/repositories", { signal: controller.signal });
+    clearTimeout(timer);
+    if (!response.ok) return [];
+    const payload = await response.json().catch(() => null);
+    return Array.isArray(payload?.tasks) ? payload.tasks.map((task) => ({
+      worktree: task?.worktree || null,
+      linear: task?.linear?.key || null,
+      status: String(task?.status || "")
+    })) : [];
+  } catch {
+    return [];
+  }
+}
+async function discoverHostSpaces(repoCwd) {
+  const result = await run({ kind: "host" }, ["git", "-C", repoCwd, "worktree", "list", "--porcelain"]);
+  if (!result.ok) return [];
+  return parseWorktrees(result.stdout).map((row2) => ({
+    name: row2.name,
+    branch: row2.branch,
+    path: row2.path,
+    backend: "host"
+  }));
+}
+async function discoverContainerSpaces(runner) {
+  if (runner.kind !== "container") return [];
+  const result = await run(runner, ["sh", "-c", "ls -1 /home/synkro/work 2>/dev/null"]);
+  if (!result.ok) return [];
+  return result.stdout.split("\n").map((line) => line.trim()).filter((name) => /^ui-/.test(name)).map((name) => ({
+    name,
+    branch: "container",
+    path: "/home/synkro/work/" + name,
+    backend: "container"
+  }));
+}
+async function discoverAgents(runner, backend, previousHashes) {
+  const listed = await run(runner, buildListAgents());
+  const rows = listed.ok ? parseAgentSessions(listed.stdout, backend) : [];
+  const hashes = /* @__PURE__ */ new Map();
+  const agents = [];
+  for (const row2 of rows) {
+    const capture = row2.dead ? { ok: true, stdout: "" } : await run(runner, buildCapture(row2.session));
+    const tail2 = capture.ok ? capture.stdout : "";
+    const nextHash = hashTail(tail2);
+    const changed = previousHashes.has(row2.session) && previousHashes.get(row2.session) !== nextHash;
+    hashes.set(row2.session, nextHash);
+    const derived = deriveStatus({ dead: row2.dead, tail: tail2, changed });
+    agents.push({
+      name: row2.name,
+      session: row2.session,
+      harness: row2.harness,
+      space: row2.space,
+      backend: row2.backend,
+      status: derived.status,
+      ask: derived.ask
+    });
+  }
+  return { agents, hashes };
+}
+var BLOCK_MARKERS;
+var init_model = __esm({
+  "cli/ui/model.ts"() {
+    "use strict";
+    init_tmux();
+    BLOCK_MARKERS = [
+      { pattern: /needs a tracking decision|Task tracking suggestion|tracking decision for "/i, ask: "tracking" },
+      { pattern: /\[synkro:task-workspace|\[synkro:scm|keep working in the current workspace/i, ask: "workspace" },
+      { pattern: /⛔/, ask: "tracking" }
+    ];
+  }
+});
+
+// cli/ui/consent.ts
+function actionsForAsk(ask3) {
+  return ask3 === "workspace" ? ["stay"] : ["track", "skip"];
+}
+var CONSENT_PHRASES;
+var init_consent = __esm({
+  "cli/ui/consent.ts"() {
+    "use strict";
+    CONSENT_PHRASES = {
+      /** Settles the conductor tracking ask by durable decline. */
+      skip: "skip the task tracking, continue without a task",
+      /** Settles the task-workspace ask in place. */
+      stay: "stay in the current worktree",
+      /** Asks the agent to run the two-phase create flow (draft → approve). */
+      track: "yes, track this work \u2014 draft the requirements and create the task"
+    };
+  }
+});
+
+// cli/ui/render.ts
+function pad(text, width) {
+  return text.length >= width ? text.slice(0, width) : text + " ".repeat(width - text.length);
+}
+function row(selected, width, content) {
+  const body = stripForPad(" " + content, width);
+  return selected ? STYLE.select + body + STYLE.reset : body;
+}
+function stripForPad(text, width) {
+  let visible = 0;
+  let out = "";
+  let index = 0;
+  while (index < text.length && visible < width) {
+    if (text.startsWith(ESC, index)) {
+      const end = text.indexOf("m", index);
+      if (end === -1) break;
+      out += text.slice(index, end + 1);
+      index = end + 1;
+    } else {
+      out += text[index];
+      index += 1;
+      visible += 1;
+    }
+  }
+  return out + " ".repeat(Math.max(0, width - visible));
+}
+function renderSidebar(state, width = 32, height = 40) {
+  const lines = [];
+  lines.push("");
+  lines.push(" " + STYLE.header + "spaces" + STYLE.reset);
+  lines.push("");
+  state.spaces.forEach((space, index) => {
+    const selected = state.section === "spaces" && index === state.spaceIndex;
+    const badge = space.backend === "container" ? STYLE.accent + "\u25A3 " + STYLE.reset : "";
+    lines.push(row(selected, width, STYLE.done + "\u25CF" + STYLE.reset + " " + badge + STYLE.bold + space.name + STYLE.reset));
+    lines.push(row(selected, width, "  " + STYLE.branch + space.branch + STYLE.reset));
+  });
+  if (state.spaces.length === 0) lines.push(row(false, width, STYLE.dim + "no spaces found" + STYLE.reset));
+  lines.push("");
+  lines.push(" " + STYLE.header + "agents" + STYLE.reset);
+  lines.push("");
+  state.agents.forEach((agent, index) => {
+    const selected = state.section === "agents" && index === state.agentIndex;
+    const dot = DOT[agent.status] || DOT.idle;
+    const badge = agent.backend === "container" ? STYLE.accent + "\u25A3 " + STYLE.reset : "";
+    const linear = agent.linear ? "  " + STYLE.dim + agent.linear + STYLE.reset : "";
+    lines.push(row(selected, width, dot + " " + badge + STYLE.bold + agent.name + STYLE.reset + linear));
+    const statusStyle = agent.status === "blocked" ? STYLE.blocked : STYLE.dim;
+    lines.push(row(selected, width, "  " + statusStyle + agent.status + STYLE.reset + STYLE.dim + " \xB7 " + agent.harness + STYLE.reset));
+  });
+  if (state.agents.length === 0) lines.push(row(false, width, STYLE.dim + "no agents \u2014 n to spawn" + STYLE.reset));
+  const selectedAgent = state.section === "agents" ? state.agents[state.agentIndex] : void 0;
+  if (selectedAgent?.status === "blocked" && selectedAgent.ask) {
+    lines.push("");
+    lines.push(row(false, width, STYLE.blocked + "\u26D4 needs consent" + STYLE.reset));
+    for (const action of actionsForAsk(selectedAgent.ask)) {
+      const key = action === "track" ? "g" : action === "skip" ? "s" : "y";
+      lines.push(row(false, width, STYLE.dim + "  " + key + " \u2014 " + action + STYLE.reset));
+    }
+  }
+  while (lines.length < height - 4) lines.push(pad("", width));
+  lines.push(pad("", width));
+  if (state.message) lines.push(row(false, width, STYLE.accent + state.message.slice(0, width - 2) + STYLE.reset));
+  else lines.push(row(false, width, STYLE.dim + "n new \xB7 enter attach \xB7 x kill" + STYLE.reset));
+  lines.push(row(false, width, STYLE.dim + "T tab \xB7 i interrupt \xB7 q quit" + STYLE.reset));
+  lines.push(row(false, width, STYLE.dim + state.backendNote + STYLE.reset));
+  return lines.slice(0, height).join("\n");
+}
+var ESC, STYLE, DOT;
+var init_render = __esm({
+  "cli/ui/render.ts"() {
+    "use strict";
+    init_consent();
+    ESC = "\x1B[";
+    STYLE = {
+      reset: ESC + "0m",
+      dim: ESC + "2m",
+      bold: ESC + "1m",
+      header: ESC + "38;5;245m",
+      select: ESC + "48;5;236m",
+      working: ESC + "38;5;214m",
+      idle: ESC + "38;5;244m",
+      blocked: ESC + "38;5;203m",
+      done: ESC + "38;5;114m",
+      accent: ESC + "38;5;135m",
+      branch: ESC + "38;5;140m"
+    };
+    DOT = {
+      working: STYLE.working + "\u25CF" + STYLE.reset,
+      idle: STYLE.idle + "\u25CB" + STYLE.reset,
+      blocked: STYLE.blocked + "\u25CF" + STYLE.reset,
+      done: STYLE.done + "\u25CF" + STYLE.reset
+    };
+  }
+});
+
+// cli/ui/pueue.ts
+function buildEnsureGroup() {
+  return ["pueue", "group", "add", PUEUE_GROUP];
+}
+function buildGroupParallel() {
+  return ["pueue", "parallel", "-g", PUEUE_GROUP, "32"];
+}
+function buildSentinel(session) {
+  const loop = "while tmux has-session -t " + shellQuote3(session) + " 2>/dev/null; do sleep 10; done";
+  return ["pueue", "add", "-g", PUEUE_GROUP, "-l", session, "--", loop];
+}
+function buildRemove(taskId) {
+  return ["pueue", "remove", taskId];
+}
+async function pueueAvailable2(runner) {
+  const result = await run(runner, ["sh", "-c", "command -v pueue >/dev/null 2>&1 && pueue status >/dev/null 2>&1 && echo ok"]);
+  return result.ok && result.stdout.includes("ok");
+}
+async function registerAgent(runner, session) {
+  if (!await pueueAvailable2(runner)) return "";
+  await run(runner, buildEnsureGroup());
+  await run(runner, buildGroupParallel());
+  const added = await run(runner, buildSentinel(session));
+  const match = added.stdout.match(/id\s+(\d+)/i) || added.stderr.match(/id\s+(\d+)/i);
+  return match ? match[1] : "";
+}
+async function releaseAgent(runner, pueueId) {
+  if (!pueueId) return;
+  await run(runner, buildRemove(pueueId)).catch?.(() => {
+  });
+}
+var PUEUE_GROUP;
+var init_pueue2 = __esm({
+  "cli/ui/pueue.ts"() {
+    "use strict";
+    init_tmux();
+    PUEUE_GROUP = "synkro-ui";
+  }
+});
+
+// cli/ui/backend.ts
+async function detectContainerBackend() {
+  const runner = { kind: "container", container: CONTAINER_NAME2 };
+  const probe = await run({ kind: "host" }, [
+    "docker",
+    "exec",
+    CONTAINER_NAME2,
+    "sh",
+    "-c",
+    "command -v tmux >/dev/null && command -v claude >/dev/null && ls " + shellQuote3(AUTH_SEED) + " >/dev/null 2>&1 && echo ready"
+  ]);
+  if (probe.ok && probe.stdout.includes("ready")) {
+    return { runner, backend: "container", note: "runtime: container (" + CONTAINER_NAME2 + ")" };
+  }
+  return { runner: { kind: "host" }, backend: "host", note: "runtime: host (container unavailable)" };
+}
+async function provisionContainerWorkspace(runner, slug) {
+  const dir = CONTAINER_WORK + "/ui-" + slug;
+  await run(runner, [
+    "sh",
+    "-c",
+    "mkdir -p " + shellQuote3(dir) + " && cp -n " + shellQuote3(AUTH_SEED) + " " + shellQuote3(dir + "/.claude.json") + " 2>/dev/null; true"
+  ]);
+  return dir;
+}
+async function spawnAgent(info, request) {
+  const slug = slugify(request.name);
+  const session = agentSession(slug);
+  const runner = request.backend === "container" ? { kind: "container", container: CONTAINER_NAME2 } : { kind: "host" };
+  let cwd = request.cwd;
+  if (request.backend === "container") {
+    cwd = request.cwd.startsWith(CONTAINER_WORK) ? request.cwd : await provisionContainerWorkspace(runner, slug);
+  }
+  const command = request.harness === "codex" ? "codex" : "claude";
+  for (const argv of buildSpawnAgent({ name: slug, cwd, command, harness: request.harness, space: request.spaceName, backend: request.backend })) {
+    const result = await run(runner, argv);
+    if (!result.ok && argv[1] === "new-session") {
+      return { ok: false, session, error: result.stderr.trim() || "tmux new-session failed" };
+    }
+  }
+  const pueueId = await registerAgent(runner, session);
+  if (pueueId) await run(runner, buildSetOption(session, "@synkro_pueue", pueueId));
+  return { ok: true, session };
+}
+async function killAgent(backend, session, pueueId) {
+  const runner = backend === "container" ? { kind: "container", container: CONTAINER_NAME2 } : { kind: "host" };
+  await run(runner, buildKillSession(session));
+  await releaseAgent(runner, pueueId);
+}
+var CONTAINER_NAME2, CONTAINER_WORK, AUTH_SEED;
+var init_backend = __esm({
+  "cli/ui/backend.ts"() {
+    "use strict";
+    init_tmux();
+    init_pueue2();
+    CONTAINER_NAME2 = "synkro-server";
+    CONTAINER_WORK = "/home/synkro/work";
+    AUTH_SEED = CONTAINER_WORK + "/claude-1/.claude.json";
+  }
+});
+
+// cli/ui/sidebar.ts
+function runnerFor(backend) {
+  return backend === "container" ? { kind: "container", container: CONTAINER_NAME2 } : { kind: "host" };
+}
+async function runSidebar() {
+  const centerPane = process.env.SYNKRO_UI_CENTER || "";
+  const outerSession = process.env.SYNKRO_UI_OUTER || "synkro-ui";
+  const bootPath = process.env.SYNKRO_UI_BOOT || process.argv[1];
+  const repoCwd = process.env.SYNKRO_UI_REPO || process.cwd();
+  const info = await detectContainerBackend();
+  const state = {
+    spaces: [],
+    agents: [],
+    section: "agents",
+    spaceIndex: 0,
+    agentIndex: 0,
+    backendNote: info.note,
+    message: ""
+  };
+  let hashes = /* @__PURE__ */ new Map();
+  let lastFrame = "";
+  let spawnCounter = 1;
+  const host = { kind: "host" };
+  const containerRunner = { kind: "container", container: CONTAINER_NAME2 };
+  async function refresh() {
+    const [hostSpaces, containerSpaces, conductorTasks] = await Promise.all([
+      discoverHostSpaces(repoCwd),
+      info.backend === "container" ? discoverContainerSpaces(containerRunner) : Promise.resolve([]),
+      fetchConductorTasks(CONDUCTOR_URL)
+    ]);
+    state.spaces = [...hostSpaces, ...containerSpaces];
+    const hostAgents = await discoverAgents(host, "host", hashes);
+    const containerAgents = info.backend === "container" ? await discoverAgents(containerRunner, "container", hashes) : { agents: [], hashes: /* @__PURE__ */ new Map() };
+    hashes = new Map([...hostAgents.hashes, ...containerAgents.hashes]);
+    state.agents = [...hostAgents.agents, ...containerAgents.agents].map((agent) => ({
+      ...agent,
+      linear: mapAgentToTask(agent.space, conductorTasks)
+    }));
+    state.spaceIndex = Math.min(state.spaceIndex, Math.max(0, state.spaces.length - 1));
+    state.agentIndex = Math.min(state.agentIndex, Math.max(0, state.agents.length - 1));
+  }
+  function draw() {
+    const rows = Number(process.stdout.rows || 42);
+    const cols = Number(process.stdout.columns || 32);
+    const frame = renderSidebar(state, cols, rows);
+    if (frame === lastFrame) return;
+    lastFrame = frame;
+    process.stdout.write("\x1B[2J\x1B[H" + frame);
+  }
+  async function attachSelected() {
+    const agent = state.agents[state.agentIndex];
+    if (!agent || !centerPane) return;
+    const command = buildCenterAttachCommand(runnerFor(agent.backend), agent.session);
+    await run(host, ["tmux", "respawn-pane", "-k", "-t", centerPane, command]);
+    await run(host, ["tmux", "rename-window", "-t", outerSession, agent.name]);
+    state.message = "attached " + agent.name;
+  }
+  async function spawnInSelectedSpace() {
+    const space = state.spaces[state.spaceIndex] || state.spaces[0];
+    if (!space) {
+      state.message = "no space selected";
+      return;
+    }
+    const name = space.name + "-" + spawnCounter++;
+    const result = await spawnAgent(info, {
+      name,
+      harness: "claude",
+      spaceName: space.name,
+      cwd: space.path,
+      backend: space.backend === "container" && info.backend === "container" ? "container" : "host"
+    });
+    state.message = result.ok ? "spawned " + name : "spawn failed: " + (result.error || "").slice(0, 24);
+  }
+  async function spawnContainerAgent() {
+    if (info.backend !== "container") {
+      state.message = "container runtime unavailable";
+      return;
+    }
+    const name = "box-" + spawnCounter++;
+    const result = await spawnAgent(info, { name, harness: "claude", spaceName: name, cwd: "", backend: "container" });
+    state.message = result.ok ? "spawned \u25A3 " + name : "spawn failed: " + (result.error || "").slice(0, 24);
+  }
+  async function consent(action) {
+    const agent = state.agents[state.agentIndex];
+    if (!agent || agent.status !== "blocked" || !agent.ask) return;
+    if (!actionsForAsk(agent.ask).includes(action)) return;
+    const runner = runnerFor(agent.backend);
+    for (const argv of buildSendText(agent.session, CONSENT_PHRASES[action])) await run(runner, argv);
+    state.message = action + " \u2192 " + agent.name;
+  }
+  async function newTab() {
+    await run(host, ["node", String(bootPath), "ui", "--new-tab", outerSession]);
+  }
+  process.stdin.setRawMode?.(true);
+  process.stdin.resume();
+  process.stdin.on("data", (chunk) => {
+    const key = chunk.toString("utf8");
+    void (async () => {
+      const list = state.section === "spaces" ? state.spaces : state.agents;
+      if (key === "	") state.section = state.section === "spaces" ? "agents" : "spaces";
+      else if (key === "j" || key === "\x1B[B") {
+        if (state.section === "spaces") state.spaceIndex = Math.min(state.spaceIndex + 1, Math.max(0, list.length - 1));
+        else state.agentIndex = Math.min(state.agentIndex + 1, Math.max(0, list.length - 1));
+      } else if (key === "k" || key === "\x1B[A") {
+        if (state.section === "spaces") state.spaceIndex = Math.max(0, state.spaceIndex - 1);
+        else state.agentIndex = Math.max(0, state.agentIndex - 1);
+      } else if (key === "\r") {
+        if (state.section === "agents") await attachSelected();
+        else state.message = "space: " + (state.spaces[state.spaceIndex]?.name || "");
+      } else if (key === "n") await spawnInSelectedSpace();
+      else if (key === "c") await spawnContainerAgent();
+      else if (key === "x") {
+        const agent = state.agents[state.agentIndex];
+        if (agent) {
+          await killAgent(agent.backend, agent.session, "");
+          state.message = "killed " + agent.name;
+        }
+      } else if (key === "i") {
+        const agent = state.agents[state.agentIndex];
+        if (agent) await run(runnerFor(agent.backend), buildInterrupt(agent.session));
+      } else if (key === "g") await consent("track");
+      else if (key === "s") await consent("skip");
+      else if (key === "y") await consent("stay");
+      else if (key === "T") await newTab();
+      else if (key === "q" || key === "") {
+        await run(host, ["tmux", "kill-session", "-t", outerSession]);
+        process.exit(0);
+      }
+      await refresh();
+      draw();
+    })();
+  });
+  await refresh();
+  draw();
+  setInterval(() => {
+    void refresh().then(draw);
+  }, POLL_MS);
+}
+var POLL_MS, CONDUCTOR_URL;
+var init_sidebar = __esm({
+  "cli/ui/sidebar.ts"() {
+    "use strict";
+    init_model();
+    init_render();
+    init_consent();
+    init_backend();
+    init_tmux();
+    POLL_MS = 2e3;
+    CONDUCTOR_URL = "http://127.0.0.1:" + (process.env.SYNKRO_HOST_MCP_PORT || "18931");
+  }
+});
+
+// cli/commands/ui.ts
+var ui_exports = {};
+__export(ui_exports, {
+  uiCommand: () => uiCommand
+});
+import { execSync as execSync7 } from "child_process";
+function repoRoot() {
+  try {
+    return execSync7("git rev-parse --show-toplevel", { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim() || process.cwd();
+  } catch {
+    return process.cwd();
+  }
+}
+function tmuxPresent() {
+  try {
+    execSync7("tmux -V", { stdio: ["pipe", "pipe", "pipe"] });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function uiCommand(args2) {
+  const bootPath = String(process.argv[1] || "");
+  if (args2.includes("--sidebar")) {
+    await runSidebar();
+    await new Promise(() => {
+    });
+    return;
+  }
+  if (args2.includes("--new-tab")) {
+    await buildTab(bootPath, repoRoot(), "new");
+    return;
+  }
+  if (!tmuxPresent()) {
+    console.error("synkro ui needs tmux. Install it (brew install tmux) and rerun.");
+    process.exitCode = 1;
+    return;
+  }
+  const code = await launchUi(bootPath, repoRoot());
+  process.exitCode = code;
+}
+var init_ui = __esm({
+  "cli/commands/ui.ts"() {
+    "use strict";
+    init_launch();
+    init_sidebar();
+  }
+});
+
 // cli/commands/refresh.ts
 var refresh_exports = {};
 __export(refresh_exports, {
@@ -14124,11 +15172,11 @@ __export(linear_exports, {
   linearCommand: () => linearCommand
 });
 import { readFileSync as readFileSync30 } from "fs";
-import { homedir as homedir31 } from "os";
-import { join as join31 } from "path";
+import { homedir as homedir32 } from "os";
+import { join as join32 } from "path";
 function mcpJwt() {
   try {
-    return readFileSync30(join31(SYNKRO_DIR14, ".mcp-jwt"), "utf-8").trim();
+    return readFileSync30(join32(SYNKRO_DIR14, ".mcp-jwt"), "utf-8").trim();
   } catch {
     return "";
   }
@@ -14167,7 +15215,7 @@ var SYNKRO_DIR14, PORT2, BASE;
 var init_linear = __esm({
   "cli/commands/linear.ts"() {
     "use strict";
-    SYNKRO_DIR14 = join31(homedir31(), ".synkro");
+    SYNKRO_DIR14 = join32(homedir32(), ".synkro");
     PORT2 = process.env.SYNKRO_MCP_PORT || "18931";
     BASE = `http://127.0.0.1:${PORT2}`;
   }
@@ -14316,33 +15364,33 @@ var init_cveReachability = __esm({
 });
 
 // cli/reachability/reachabilityScan.ts
-import { spawnSync as spawnSync11, execFileSync as execFileSync5 } from "child_process";
-import { readFileSync as readFileSync32, writeFileSync as writeFileSync22, existsSync as existsSync33, readdirSync as readdirSync8 } from "fs";
-import { join as join32 } from "path";
-import { homedir as homedir32 } from "os";
+import { spawnSync as spawnSync12, execFileSync as execFileSync5 } from "child_process";
+import { readFileSync as readFileSync32, writeFileSync as writeFileSync23, existsSync as existsSync34, readdirSync as readdirSync9 } from "fs";
+import { join as join33 } from "path";
+import { homedir as homedir33 } from "os";
 import { createRequire } from "module";
-function walkSourceFiles(repoRoot2, maxFiles = 4e3, maxBytes = 5e5) {
+function walkSourceFiles(repoRoot3, maxFiles = 4e3, maxBytes = 5e5) {
   const SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", "coverage", ".next", ".turbo", "out", ".cache", ".synkro", ".claude", "vendor", "__tests__", "test-results"]);
   const EXT = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
   const files = [];
-  const stack = [repoRoot2];
+  const stack = [repoRoot3];
   while (stack.length && files.length < maxFiles) {
     const dir = stack.pop();
     let ents;
     try {
-      ents = readdirSync8(dir, { withFileTypes: true });
+      ents = readdirSync9(dir, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const e of ents) {
       if (files.length >= maxFiles) break;
-      const full = join32(dir, e.name);
+      const full = join33(dir, e.name);
       if (e.isDirectory()) {
         if (!SKIP.has(e.name) && !e.name.startsWith(".")) stack.push(full);
         continue;
       }
       if (!EXT.test(e.name) || e.name.endsWith(".d.ts")) continue;
-      const rel = full.startsWith(repoRoot2 + "/") ? full.slice(repoRoot2.length + 1) : full;
+      const rel = full.startsWith(repoRoot3 + "/") ? full.slice(repoRoot3.length + 1) : full;
       try {
         const content = readFileSync32(full, "utf8");
         if (content.length <= maxBytes) files.push({ path: rel, content });
@@ -14360,15 +15408,15 @@ function cleanVersion(spec) {
   const c = s.replace(/^[\^~>=<\s]+/, "");
   return /^\d[\w.\-+]*$/.test(c) ? c : null;
 }
-function gatherManifestVersions(repoRoot2) {
+function gatherManifestVersions(repoRoot3) {
   const out = {};
-  const dirs = [repoRoot2];
-  const pkgsDir = join32(repoRoot2, "packages");
-  if (existsSync33(pkgsDir)) {
+  const dirs = [repoRoot3];
+  const pkgsDir = join33(repoRoot3, "packages");
+  if (existsSync34(pkgsDir)) {
     try {
-      for (const d of readdirSync8(pkgsDir)) {
-        const pd = join32(pkgsDir, d);
-        if (existsSync33(join32(pd, "package.json"))) dirs.push(pd);
+      for (const d of readdirSync9(pkgsDir)) {
+        const pd = join33(pkgsDir, d);
+        if (existsSync34(join33(pd, "package.json"))) dirs.push(pd);
       }
     } catch {
     }
@@ -14377,7 +15425,7 @@ function gatherManifestVersions(repoRoot2) {
   for (const dir of dirs) {
     let pkg;
     try {
-      pkg = JSON.parse(readFileSync32(join32(dir, "package.json"), "utf8"));
+      pkg = JSON.parse(readFileSync32(join33(dir, "package.json"), "utf8"));
     } catch {
       continue;
     }
@@ -14393,32 +15441,32 @@ function gatherManifestVersions(repoRoot2) {
   }
   return out;
 }
-function findJelly(repoRoot2) {
+function findJelly(repoRoot3) {
   try {
     const pkgJson = require2.resolve("@cs-au-dk/jelly/package.json");
     const dir = pkgJson.slice(0, pkgJson.length - "package.json".length);
     const pkg = JSON.parse(readFileSync32(pkgJson, "utf8"));
     const bin = typeof pkg.bin === "string" ? pkg.bin : pkg.bin && (pkg.bin.jelly || pkg.bin[Object.keys(pkg.bin)[0]]);
     if (bin) {
-      const p = join32(dir, bin);
-      if (existsSync33(p)) return p;
+      const p = join33(dir, bin);
+      if (existsSync34(p)) return p;
     }
   } catch {
   }
-  for (const base of [repoRoot2, process.cwd()]) {
-    const b = join32(base, "node_modules", ".bin", "jelly");
-    if (existsSync33(b)) return b;
+  for (const base of [repoRoot3, process.cwd()]) {
+    const b = join33(base, "node_modules", ".bin", "jelly");
+    if (existsSync34(b)) return b;
   }
   return null;
 }
-function findEntries(repoRoot2) {
-  const dirs = [repoRoot2];
-  const pkgsDir = join32(repoRoot2, "packages");
-  if (existsSync33(pkgsDir)) {
+function findEntries(repoRoot3) {
+  const dirs = [repoRoot3];
+  const pkgsDir = join33(repoRoot3, "packages");
+  if (existsSync34(pkgsDir)) {
     try {
-      for (const d of readdirSync8(pkgsDir)) {
-        const pd = join32(pkgsDir, d);
-        if (existsSync33(join32(pd, "package.json"))) dirs.push(pd);
+      for (const d of readdirSync9(pkgsDir)) {
+        const pd = join33(pkgsDir, d);
+        if (existsSync34(join33(pd, "package.json"))) dirs.push(pd);
       }
     } catch {
     }
@@ -14426,12 +15474,12 @@ function findEntries(repoRoot2) {
   const entries = [];
   for (const dir of dirs) {
     try {
-      const pkg = JSON.parse(readFileSync32(join32(dir, "package.json"), "utf8"));
+      const pkg = JSON.parse(readFileSync32(join33(dir, "package.json"), "utf8"));
       const cands = [pkg.source, pkg.module, pkg.main, "src/index.ts", "src/index.js", "src/main.ts", "src/server.ts", "index.ts", "index.js"];
       for (const c of cands) {
         if (typeof c !== "string") continue;
-        const f = join32(dir, c);
-        if (existsSync33(f)) {
+        const f = join33(dir, c);
+        if (existsSync34(f)) {
           entries.push(f);
           break;
         }
@@ -14441,9 +15489,9 @@ function findEntries(repoRoot2) {
   }
   return entries.slice(0, 40);
 }
-function currentCommit(repoRoot2) {
+function currentCommit(repoRoot3) {
   try {
-    return execFileSync5("git", ["rev-parse", "HEAD"], { cwd: repoRoot2, encoding: "utf8" }).trim();
+    return execFileSync5("git", ["rev-parse", "HEAD"], { cwd: repoRoot3, encoding: "utf8" }).trim();
   } catch {
     return "";
   }
@@ -14462,9 +15510,9 @@ function parseApiUsage(log) {
   for (const k of Object.keys(map)) out[k] = { reachableApis: [...map[k]].slice(0, 60) };
   return out;
 }
-function runReachabilityScan(repoRoot2, opts = {}) {
-  const commit = currentCommit(repoRoot2);
-  if (!opts.force && commit && existsSync33(REACHABILITY_PATH)) {
+function runReachabilityScan(repoRoot3, opts = {}) {
+  const commit = currentCommit(repoRoot3);
+  if (!opts.force && commit && existsSync34(REACHABILITY_PATH)) {
     try {
       const prev = JSON.parse(readFileSync32(REACHABILITY_PATH, "utf8"));
       if (prev.commit === commit) return { ok: true, cached: true, packages: Object.keys(prev.packages || {}).length };
@@ -14513,13 +15561,13 @@ function runReachabilityScan(repoRoot2, opts = {}) {
     }
   };
   let tool = "ast";
-  const jelly = findJelly(repoRoot2);
+  const jelly = findJelly(repoRoot3);
   if (jelly) {
-    const entries = findEntries(repoRoot2);
+    const entries = findEntries(repoRoot3);
     if (entries.length > 0) {
-      const r = spawnSync11(
+      const r = spawnSync12(
         process.execPath,
-        [jelly, "-b", repoRoot2, "--api-usage", ...entries],
+        [jelly, "-b", repoRoot3, "--api-usage", ...entries],
         { encoding: "utf8", timeout: opts.timeoutMs ?? 18e4, maxBuffer: 2e8 }
       );
       const jp = parseApiUsage((r.stdout || "") + (r.stderr || ""));
@@ -14529,7 +15577,7 @@ function runReachabilityScan(repoRoot2, opts = {}) {
       }
     }
   }
-  const astPackages = extractAllPackageUsage(walkSourceFiles(repoRoot2));
+  const astPackages = extractAllPackageUsage(walkSourceFiles(repoRoot3));
   for (const [k, v] of Object.entries(astPackages)) {
     addAll(k, v.apis);
     addSites(k, v.sites);
@@ -14553,9 +15601,9 @@ function runReachabilityScan(repoRoot2, opts = {}) {
     packages[k] = entry;
   }
   if (Object.keys(packages).length === 0) return { ok: false, reason: "no package usage found (no jelly output, no AST imports)" };
-  const file = { generatedAt: (/* @__PURE__ */ new Date()).toISOString(), commit, tool, packages, versions: gatherManifestVersions(repoRoot2) };
+  const file = { generatedAt: (/* @__PURE__ */ new Date()).toISOString(), commit, tool, packages, versions: gatherManifestVersions(repoRoot3) };
   try {
-    writeFileSync22(REACHABILITY_PATH, JSON.stringify(file, null, 2));
+    writeFileSync23(REACHABILITY_PATH, JSON.stringify(file, null, 2));
   } catch (e) {
     return { ok: false, reason: "write failed: " + String(e.message || e) };
   }
@@ -14567,7 +15615,7 @@ var init_reachabilityScan = __esm({
     "use strict";
     init_cveReachability();
     require2 = createRequire(import.meta.url);
-    REACHABILITY_PATH = join32(homedir32(), ".synkro", "reachability.json");
+    REACHABILITY_PATH = join33(homedir33(), ".synkro", "reachability.json");
   }
 });
 
@@ -14576,13 +15624,13 @@ var reachabilityScan_exports = {};
 __export(reachabilityScan_exports, {
   reachabilityScanCommand: () => reachabilityScanCommand
 });
-import { readFileSync as readFileSync33, existsSync as existsSync34 } from "fs";
-import { join as join33 } from "path";
-import { homedir as homedir33 } from "os";
+import { readFileSync as readFileSync33, existsSync as existsSync35 } from "fs";
+import { join as join34 } from "path";
+import { homedir as homedir34 } from "os";
 import { execFileSync as execFileSync6 } from "child_process";
 function readConfigEnv4() {
-  const p = join33(SYNKRO_DIR15, "config.env");
-  if (!existsSync34(p)) return {};
+  const p = join34(SYNKRO_DIR15, "config.env");
+  if (!existsSync35(p)) return {};
   const out = {};
   for (const line of readFileSync33(p, "utf-8").split("\n")) {
     const t = line.trim();
@@ -14592,7 +15640,7 @@ function readConfigEnv4() {
   }
   return out;
 }
-function repoRoot() {
+function repoRoot2() {
   try {
     return execFileSync6("git", ["rev-parse", "--show-toplevel"], { encoding: "utf-8" }).trim();
   } catch {
@@ -14600,14 +15648,14 @@ function repoRoot() {
   }
 }
 function repoSlug(root) {
-  const run = (a) => {
+  const run2 = (a) => {
     try {
       return execFileSync6("git", a, { encoding: "utf-8" }).trim();
     } catch {
       return "";
     }
   };
-  const remote = run(["remote", "get-url", "origin"]);
+  const remote = run2(["remote", "get-url", "origin"]);
   if (remote) return remote.replace(/^git@[^:]+:/, "").replace(/^https?:\/\/[^/]+\//, "").replace(/\.git$/, "");
   return root.split("/").pop() || root;
 }
@@ -14616,10 +15664,10 @@ async function pushToCloud(cfg, repo) {
   while (gwBase.endsWith("/")) gwBase = gwBase.slice(0, -1);
   let jwt2 = "";
   try {
-    jwt2 = readFileSync33(join33(SYNKRO_DIR15, ".mcp-jwt"), "utf-8").trim();
+    jwt2 = readFileSync33(join34(SYNKRO_DIR15, ".mcp-jwt"), "utf-8").trim();
   } catch {
   }
-  if (!jwt2 || !existsSync34(REACHABILITY_PATH)) return;
+  if (!jwt2 || !existsSync35(REACHABILITY_PATH)) return;
   const body = readFileSync33(REACHABILITY_PATH, "utf-8");
   try {
     const resp = await fetch(gwBase + "/api/v1/reachability?repo=" + encodeURIComponent(repo), {
@@ -14634,7 +15682,7 @@ async function pushToCloud(cfg, repo) {
   }
 }
 async function reachabilityScanCommand(args2 = []) {
-  const root = repoRoot();
+  const root = repoRoot2();
   const force = args2.includes("--force");
   const quiet = args2.includes("--quiet");
   const res = runReachabilityScan(root, { force });
@@ -14652,7 +15700,7 @@ var init_reachabilityScan2 = __esm({
   "cli/commands/reachabilityScan.ts"() {
     "use strict";
     init_reachabilityScan();
-    SYNKRO_DIR15 = join33(homedir33(), ".synkro");
+    SYNKRO_DIR15 = join34(homedir34(), ".synkro");
   }
 });
 
@@ -14782,11 +15830,11 @@ var config_exports = {};
 __export(config_exports, {
   configCommand: () => configCommand
 });
-import { readFileSync as readFileSync34, writeFileSync as writeFileSync23, existsSync as existsSync35 } from "fs";
-import { join as join34 } from "path";
-import { homedir as homedir34 } from "os";
+import { readFileSync as readFileSync34, writeFileSync as writeFileSync24, existsSync as existsSync36 } from "fs";
+import { join as join35 } from "path";
+import { homedir as homedir35 } from "os";
 function readConfigEnv5() {
-  if (!existsSync35(CONFIG_PATH9)) return {};
+  if (!existsSync36(CONFIG_PATH9)) return {};
   const out = {};
   for (const line of readFileSync34(CONFIG_PATH9, "utf-8").split("\n")) {
     const t = line.trim();
@@ -14797,7 +15845,7 @@ function readConfigEnv5() {
   return out;
 }
 function updateConfigValue(key, value) {
-  if (!existsSync35(CONFIG_PATH9)) {
+  if (!existsSync36(CONFIG_PATH9)) {
     console.error("No config found. Run `synkro install` first.");
     process.exit(1);
   }
@@ -14812,7 +15860,7 @@ function updateConfigValue(key, value) {
     return line;
   });
   if (!found) updated.splice(updated.length - 1, 0, `${key}='${value}'`);
-  writeFileSync23(CONFIG_PATH9, updated.join("\n"), "utf-8");
+  writeFileSync24(CONFIG_PATH9, updated.join("\n"), "utf-8");
 }
 function resolveInferenceMode(cfg) {
   if ((cfg.SYNKRO_GRADING_MODE || "local") === "byok") return "byok";
@@ -14970,8 +16018,8 @@ var init_config = __esm({
     "use strict";
     init_stub();
     init_optout();
-    SYNKRO_DIR16 = join34(homedir34(), ".synkro");
-    CONFIG_PATH9 = join34(SYNKRO_DIR16, "config.env");
+    SYNKRO_DIR16 = join35(homedir35(), ".synkro");
+    CONFIG_PATH9 = join35(SYNKRO_DIR16, "config.env");
   }
 });
 
@@ -15035,11 +16083,11 @@ async function printTail(args2) {
     console.log("(no events \u2014 run `synkro start` if the container is down so JSONL pending events can drain)");
     return;
   }
-  for (const row of rows) {
-    const session = row.cc_session_id ? ` session=${String(row.cc_session_id).slice(0, 8)}` : "";
-    const ts = typeof row.occurred_at === "string" ? row.occurred_at : new Date(row.occurred_at).toISOString();
-    console.log(`  ${ts}  ${row.event_type.padEnd(20)} ${row.emitter}${session}`);
-    const contextStr = typeof row.context === "string" ? row.context : JSON.stringify(row.context);
+  for (const row2 of rows) {
+    const session = row2.cc_session_id ? ` session=${String(row2.cc_session_id).slice(0, 8)}` : "";
+    const ts = typeof row2.occurred_at === "string" ? row2.occurred_at : new Date(row2.occurred_at).toISOString();
+    console.log(`  ${ts}  ${row2.event_type.padEnd(20)} ${row2.emitter}${session}`);
+    const contextStr = typeof row2.context === "string" ? row2.context : JSON.stringify(row2.context);
     console.log(`     context: ${truncate2(contextStr, 200)}`);
   }
 }
@@ -15161,27 +16209,27 @@ Usage:
 
 // cli/inventory/identity.ts
 import { randomUUID as randomUUID5 } from "crypto";
-import { existsSync as existsSync36, mkdirSync as mkdirSync19, readFileSync as readFileSync35, renameSync as renameSync9, writeFileSync as writeFileSync24 } from "fs";
-import { homedir as homedir35 } from "os";
-import { dirname as dirname9, join as join35 } from "path";
+import { existsSync as existsSync37, mkdirSync as mkdirSync20, readFileSync as readFileSync35, renameSync as renameSync9, writeFileSync as writeFileSync25 } from "fs";
+import { homedir as homedir36 } from "os";
+import { dirname as dirname9, join as join36 } from "path";
 function operationalIdentityPath() {
-  return process.env.SYNKRO_OPERATIONAL_IDENTITY_PATH || join35(homedir35(), ".synkro", "installation.json");
+  return process.env.SYNKRO_OPERATIONAL_IDENTITY_PATH || join36(homedir36(), ".synkro", "installation.json");
 }
 function validIdentity(value) {
   if (!value || typeof value !== "object") return false;
-  const row = value;
-  return typeof row.installation_id === "string" && UUID_RE.test(row.installation_id) && typeof row.created_at === "string" && Number.isFinite(Date.parse(row.created_at));
+  const row2 = value;
+  return typeof row2.installation_id === "string" && UUID_RE.test(row2.installation_id) && typeof row2.created_at === "string" && Number.isFinite(Date.parse(row2.created_at));
 }
 function writeIdentity(path, identity) {
-  mkdirSync19(dirname9(path), { recursive: true, mode: 448 });
+  mkdirSync20(dirname9(path), { recursive: true, mode: 448 });
   const temp = `${path}.${process.pid}.${randomUUID5()}.tmp`;
-  writeFileSync24(temp, JSON.stringify(identity, null, 2) + "\n", { encoding: "utf8", mode: 384 });
+  writeFileSync25(temp, JSON.stringify(identity, null, 2) + "\n", { encoding: "utf8", mode: 384 });
   renameSync9(temp, path);
 }
 function getOperationalInstallationIdentity(path = operationalIdentityPath()) {
   const prior = cached4.get(path);
   if (prior) return prior;
-  if (existsSync36(path)) {
+  if (existsSync37(path)) {
     try {
       const parsed = JSON.parse(readFileSync35(path, "utf8"));
       if (validIdentity(parsed)) {
@@ -15208,13 +16256,13 @@ var init_identity2 = __esm({
 // cli/inventory/collector.ts
 import { createHash as createHash5 } from "crypto";
 import {
-  existsSync as existsSync37,
+  existsSync as existsSync38,
   readFileSync as readFileSync36,
-  readdirSync as readdirSync9,
+  readdirSync as readdirSync10,
   statSync as statSync5
 } from "fs";
-import { arch, homedir as homedir36, hostname as hostname2, platform as platform5, release } from "os";
-import { basename as basename3, join as join36, relative, resolve as resolve5 } from "path";
+import { arch, homedir as homedir37, hostname as hostname2, platform as platform5, release } from "os";
+import { basename as basename3, join as join37, relative, resolve as resolve5 } from "path";
 import { fileURLToPath } from "url";
 function sha256(value) {
   return createHash5("sha256").update(value).digest("hex");
@@ -15224,14 +16272,14 @@ function pseudonymousHostnameHash(installationId, host) {
 }
 function cliVersion() {
   try {
-    return "1.8.0";
+    return "1.9.0";
   } catch {
     return "0.0.0";
   }
 }
 function readJson(path) {
   try {
-    if (!existsSync37(path)) return null;
+    if (!existsSync38(path)) return null;
     const parsed = JSON.parse(readFileSync36(path, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
@@ -15240,7 +16288,7 @@ function readJson(path) {
 }
 function readText(path) {
   try {
-    if (!existsSync37(path)) return "";
+    if (!existsSync38(path)) return "";
     return readFileSync36(path, "utf8");
   } catch {
     return "";
@@ -15327,16 +16375,16 @@ function mcpArtifactsFromJson(harness, config, configScope = "user") {
 }
 function claudeDesktopConfigCandidates(home, targetPlatform) {
   if (targetPlatform === "darwin") {
-    return [join36(home, "Library", "Application Support", "Claude", "claude_desktop_config.json")];
+    return [join37(home, "Library", "Application Support", "Claude", "claude_desktop_config.json")];
   }
   if (targetPlatform === "linux") {
     return [
-      join36(home, ".config", "Claude", "claude_desktop_config.json"),
-      join36(home, ".config", "claude", "claude_desktop_config.json")
+      join37(home, ".config", "Claude", "claude_desktop_config.json"),
+      join37(home, ".config", "claude", "claude_desktop_config.json")
     ];
   }
   if (targetPlatform === "win32" && process.env.APPDATA) {
-    return [join36(process.env.APPDATA, "Claude", "claude_desktop_config.json")];
+    return [join37(process.env.APPDATA, "Claude", "claude_desktop_config.json")];
   }
   return [];
 }
@@ -15344,7 +16392,7 @@ function claudeManagedMcpConfigCandidates(targetPlatform) {
   if (targetPlatform === "darwin") return ["/Library/Application Support/ClaudeCode/managed-mcp.json"];
   if (targetPlatform === "linux") return ["/etc/claude-code/managed-mcp.json"];
   if (targetPlatform === "win32" && process.env.ProgramFiles) {
-    return [join36(process.env.ProgramFiles, "ClaudeCode", "managed-mcp.json")];
+    return [join37(process.env.ProgramFiles, "ClaudeCode", "managed-mcp.json")];
   }
   return [];
 }
@@ -15353,7 +16401,7 @@ function discoveredProjectRoots(claudeState, currentDirectory, explicit = [], cu
   const add = (value) => {
     if (typeof value !== "string" || !value.trim()) return;
     const path = resolve5(value);
-    if (existsSync37(path)) roots.add(path);
+    if (existsSync38(path)) roots.add(path);
   };
   add(currentDirectory);
   for (const path of explicit) add(path);
@@ -15364,31 +16412,31 @@ function discoveredProjectRoots(claudeState, currentDirectory, explicit = [], cu
   return [...roots];
 }
 function cursorWorkspaceStorageCandidates(home, targetPlatform) {
-  if (targetPlatform === "darwin") return [join36(home, "Library", "Application Support", "Cursor", "User", "workspaceStorage")];
-  if (targetPlatform === "linux") return [join36(home, ".config", "Cursor", "User", "workspaceStorage")];
+  if (targetPlatform === "darwin") return [join37(home, "Library", "Application Support", "Cursor", "User", "workspaceStorage")];
+  if (targetPlatform === "linux") return [join37(home, ".config", "Cursor", "User", "workspaceStorage")];
   if (targetPlatform === "win32" && process.env.APPDATA) {
-    return [join36(process.env.APPDATA, "Cursor", "User", "workspaceStorage")];
+    return [join37(process.env.APPDATA, "Cursor", "User", "workspaceStorage")];
   }
   return [];
 }
 function cursorWorkspaceRoots(home, targetPlatform) {
   const roots = /* @__PURE__ */ new Set();
   for (const storage of cursorWorkspaceStorageCandidates(home, targetPlatform)) {
-    if (!existsSync37(storage)) continue;
+    if (!existsSync38(storage)) continue;
     let entries = [];
     try {
-      entries = readdirSync9(storage, { withFileTypes: true });
+      entries = readdirSync10(storage, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
       if (!entry.isDirectory() || entry.isSymbolicLink?.()) continue;
-      const state = readJson(join36(storage, entry.name, "workspace.json"));
+      const state = readJson(join37(storage, entry.name, "workspace.json"));
       const raw = state?.folder;
       if (typeof raw !== "string" || !raw.trim()) continue;
       try {
         const path = raw.startsWith("file:") ? fileURLToPath(raw) : raw;
-        if (existsSync37(path)) roots.add(resolve5(path));
+        if (existsSync38(path)) roots.add(resolve5(path));
       } catch {
       }
     }
@@ -15482,18 +16530,18 @@ function parseFrontmatter(content) {
   return { name: value("name"), version: value("version") };
 }
 function skillArtifacts(harness, root) {
-  if (!existsSync37(root)) return [];
+  if (!existsSync38(root)) return [];
   const manifests = [];
   const visit = (dir) => {
     let entries;
     try {
-      entries = readdirSync9(dir, { withFileTypes: true });
+      entries = readdirSync10(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry.isSymbolicLink?.()) continue;
-      const path = join36(dir, entry.name);
+      const path = join37(dir, entry.name);
       if (entry.isFile() && entry.name === "SKILL.md") manifests.push(path);
       else if (entry.isDirectory()) visit(path);
     }
@@ -15503,7 +16551,7 @@ function skillArtifacts(harness, root) {
     const content = readText(path);
     const frontmatter = parseFrontmatter(content);
     const rel = relative(root, path).replaceAll("\\", "/");
-    const name = frontmatter.name || basename3(join36(path, "..")) || "skill";
+    const name = frontmatter.name || basename3(join37(path, "..")) || "skill";
     return {
       harness,
       type: "skill",
@@ -15518,16 +16566,16 @@ function skillArtifacts(harness, root) {
   });
 }
 function cursorExtensionArtifacts(root) {
-  if (!existsSync37(root)) return [];
+  if (!existsSync38(root)) return [];
   let dirs = [];
   try {
-    dirs = readdirSync9(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.isSymbolicLink());
+    dirs = readdirSync10(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.isSymbolicLink());
   } catch {
     return [];
   }
   const artifacts = [];
   for (const dir of dirs) {
-    const pkg = readJson(join36(root, dir.name, "package.json"));
+    const pkg = readJson(join37(root, dir.name, "package.json"));
     if (!pkg) continue;
     const publisher = typeof pkg.publisher === "string" ? pkg.publisher : void 0;
     const name = typeof pkg.name === "string" ? pkg.name : dir.name;
@@ -15547,18 +16595,18 @@ function cursorExtensionArtifacts(root) {
   return artifacts;
 }
 function deploymentMode2(home) {
-  const raw = readText(join36(home, ".synkro", "config.env"));
+  const raw = readText(join37(home, ".synkro", "config.env"));
   const value = (key) => raw.match(new RegExp(`^${key}=['"]?([^'"\\n]*)`, "m"))?.[1]?.toLowerCase();
   if (value("SYNKRO_GRADING_MODE") === "byok") return "byok";
   if (value("SYNKRO_STORAGE_MODE") === "cloud") return "cloud";
   return "local";
 }
 function telemetryHealth(home) {
-  const meta = readJson(join36(home, ".synkro", "telemetry-meta.json"));
+  const meta = readJson(join37(home, ".synkro", "telemetry-meta.json"));
   const health = {};
   if (meta?.last_flush_ok_at && Number.isFinite(Date.parse(meta.last_flush_ok_at))) health.telemetry_last_flush_at = meta.last_flush_ok_at;
   if (meta?.last_flush_error) health.telemetry_last_error = "flush_failed";
-  const queue = join36(home, ".synkro", "telemetry-pending.jsonl");
+  const queue = join37(home, ".synkro", "telemetry-pending.jsonl");
   try {
     const size = statSync5(queue).size;
     health.telemetry_backlog = size <= 5 * 1024 * 1024 ? readFileSync36(queue, "utf8").split("\n").filter(Boolean).length : Math.ceil(size / 1024);
@@ -15602,7 +16650,7 @@ function harnessSnapshot(agent) {
   }
   const config = readJson(agent.settingsPath);
   const coverage = inspectCodexHooks(agent.settingsPath);
-  const toml = readText(join36(agent.configDir, "config.toml"));
+  const toml = readText(join37(agent.configDir, "config.toml"));
   const permission = toml.match(/^\s*approval_policy\s*=\s*["']([^"']+)/m)?.[1];
   return {
     row: {
@@ -15619,19 +16667,19 @@ function harnessSnapshot(agent) {
   };
 }
 function collectOperationalInventory(options = {}) {
-  const home = options.homeDir ?? homedir36();
+  const home = options.homeDir ?? homedir37();
   const detected = options.detectedAgents ?? detectAgents();
   const identity = getOperationalInstallationIdentity(options.identityPath);
   const targetPlatform = options.platformName ?? platform5();
-  const codexHome = options.homeDir ? join36(home, ".codex") : process.env.CODEX_HOME || join36(home, ".codex");
+  const codexHome = options.homeDir ? join37(home, ".codex") : process.env.CODEX_HOME || join37(home, ".codex");
   const harnesses = [];
   const artifacts = [];
   for (const agent of detected) {
-    const { row, config } = harnessSnapshot(agent);
-    harnesses.push(row);
-    artifacts.push(...hookArtifacts(row.harness, config));
+    const { row: row2, config } = harnessSnapshot(agent);
+    harnesses.push(row2);
+    artifacts.push(...hookArtifacts(row2.harness, config));
   }
-  const claudeJson = readJson(join36(home, ".claude.json"));
+  const claudeJson = readJson(join37(home, ".claude.json"));
   artifacts.push(...mcpArtifactsFromJson("claude_code", claudeJson));
   if (claudeJson?.projects && typeof claudeJson.projects === "object") {
     for (const [projectPath, project] of Object.entries(claudeJson.projects)) {
@@ -15639,8 +16687,8 @@ function collectOperationalInventory(options = {}) {
       artifacts.push(...mcpArtifactsFromJson("claude_code", project, `local:${sha256(projectPath).slice(0, 16)}`));
     }
   }
-  artifacts.push(...mcpArtifactsFromJson("cursor", readJson(join36(home, ".cursor", "mcp.json"))));
-  artifacts.push(...codexMcpArtifacts(readText(join36(codexHome, "config.toml"))));
+  artifacts.push(...mcpArtifactsFromJson("cursor", readJson(join37(home, ".cursor", "mcp.json"))));
+  artifacts.push(...codexMcpArtifacts(readText(join37(codexHome, "config.toml"))));
   const projectRoots = discoveredProjectRoots(
     claudeJson,
     options.currentDirectory ?? process.cwd(),
@@ -15651,11 +16699,11 @@ function collectOperationalInventory(options = {}) {
     const scopeHash = sha256(projectRoot).slice(0, 16);
     artifacts.push(...mcpArtifactsFromJson(
       "claude_code",
-      readJson(join36(projectRoot, ".mcp.json")),
+      readJson(join37(projectRoot, ".mcp.json")),
       `project:${scopeHash}`
     ));
-    const cursorProjectConfig = join36(projectRoot, ".cursor", "mcp.json");
-    if (resolve5(cursorProjectConfig) !== resolve5(join36(home, ".cursor", "mcp.json"))) {
+    const cursorProjectConfig = join37(projectRoot, ".cursor", "mcp.json");
+    if (resolve5(cursorProjectConfig) !== resolve5(join37(home, ".cursor", "mcp.json"))) {
       artifacts.push(...mcpArtifactsFromJson(
         "cursor",
         readJson(cursorProjectConfig),
@@ -15666,7 +16714,7 @@ function collectOperationalInventory(options = {}) {
   for (const managedPath of claudeManagedMcpConfigCandidates(targetPlatform)) {
     artifacts.push(...mcpArtifactsFromJson("claude_code", readJson(managedPath), "managed"));
   }
-  const desktopConfigPath = claudeDesktopConfigCandidates(home, targetPlatform).find((path) => existsSync37(path));
+  const desktopConfigPath = claudeDesktopConfigCandidates(home, targetPlatform).find((path) => existsSync38(path));
   if (desktopConfigPath) {
     const desktopConfig = readJson(desktopConfigPath);
     harnesses.push({
@@ -15677,7 +16725,7 @@ function collectOperationalInventory(options = {}) {
     });
     artifacts.push(...mcpArtifactsFromJson("claude_desktop", desktopConfig));
   }
-  const claudeSettings = readJson(join36(home, ".claude", "settings.json"));
+  const claudeSettings = readJson(join37(home, ".claude", "settings.json"));
   if (claudeSettings?.enabledPlugins && typeof claudeSettings.enabledPlugins === "object") {
     for (const [name, enabled] of Object.entries(claudeSettings.enabledPlugins)) {
       artifacts.push({
@@ -15691,19 +16739,19 @@ function collectOperationalInventory(options = {}) {
       });
     }
   }
-  artifacts.push(...skillArtifacts("claude_code", join36(home, ".claude", "skills")));
-  artifacts.push(...skillArtifacts("cursor", join36(home, ".cursor", "skills")));
-  artifacts.push(...skillArtifacts("codex", join36(codexHome, "skills")));
-  artifacts.push(...cursorExtensionArtifacts(join36(home, ".cursor", "extensions")));
+  artifacts.push(...skillArtifacts("claude_code", join37(home, ".claude", "skills")));
+  artifacts.push(...skillArtifacts("cursor", join37(home, ".cursor", "skills")));
+  artifacts.push(...skillArtifacts("codex", join37(codexHome, "skills")));
+  artifacts.push(...cursorExtensionArtifacts(join37(home, ".cursor", "extensions")));
   const uniqueArtifacts = /* @__PURE__ */ new Map();
   for (const artifact of artifacts) {
     const key = `${artifact.harness || "global"}:${artifact.type}:${artifact.canonical_id}`;
     uniqueArtifacts.set(key, artifact);
   }
-  const codingHarnesses = harnesses.filter((row) => row.harness === "claude_code" || row.harness === "cursor" || row.harness === "codex");
+  const codingHarnesses = harnesses.filter((row2) => row2.harness === "claude_code" || row2.harness === "cursor" || row2.harness === "codex");
   const health = telemetryHealth(home) ?? {};
   health.scanners = {
-    hook_runtime: codingHarnesses.length === 0 ? "unknown" : codingHarnesses.every((row) => row.enabled) ? "ok" : "degraded"
+    hook_runtime: codingHarnesses.length === 0 ? "unknown" : codingHarnesses.every((row2) => row2.enabled) ? "ok" : "degraded"
   };
   return {
     schema_version: 1,
@@ -15749,16 +16797,16 @@ __export(sync_exports2, {
 import { createHash as createHash6, randomUUID as randomUUID6 } from "crypto";
 import { spawn as spawn8 } from "child_process";
 import {
-  existsSync as existsSync38,
-  mkdirSync as mkdirSync20,
+  existsSync as existsSync39,
+  mkdirSync as mkdirSync21,
   readFileSync as readFileSync37,
   renameSync as renameSync10,
-  writeFileSync as writeFileSync25
+  writeFileSync as writeFileSync26
 } from "fs";
-import { homedir as homedir37 } from "os";
-import { dirname as dirname10, join as join37 } from "path";
+import { homedir as homedir38 } from "os";
+import { dirname as dirname10, join as join38 } from "path";
 function syncStatePath() {
-  return process.env.SYNKRO_INVENTORY_SYNC_STATE_PATH || join37(homedir37(), ".synkro", "inventory-sync.json");
+  return process.env.SYNKRO_INVENTORY_SYNC_STATE_PATH || join38(homedir38(), ".synkro", "inventory-sync.json");
 }
 function readState(path = syncStatePath()) {
   try {
@@ -15770,9 +16818,9 @@ function readState(path = syncStatePath()) {
 }
 function writeState(state, path = syncStatePath()) {
   try {
-    mkdirSync20(dirname10(path), { recursive: true, mode: 448 });
+    mkdirSync21(dirname10(path), { recursive: true, mode: 448 });
     const temp = `${path}.${process.pid}.tmp`;
-    writeFileSync25(temp, JSON.stringify(state, null, 2) + "\n", { encoding: "utf8", mode: 384 });
+    writeFileSync26(temp, JSON.stringify(state, null, 2) + "\n", { encoding: "utf8", mode: 384 });
     renameSync10(temp, path);
   } catch {
   }
@@ -15785,7 +16833,7 @@ function shouldSyncInventory(state, now = Date.now(), target) {
   return !Number.isFinite(lastAttempt) || lastAttempt <= 0 || now - lastAttempt >= FAILURE_RETRY_MS;
 }
 function readConfig() {
-  const path = join37(homedir37(), ".synkro", "config.env");
+  const path = join38(homedir38(), ".synkro", "config.env");
   const out = {};
   try {
     for (const rawLine of readFileSync37(path, "utf8").split("\n")) {
@@ -15827,7 +16875,7 @@ function resolveInventoryGateway(raw) {
 }
 async function loadToken() {
   try {
-    const durable = readFileSync37(join37(homedir37(), ".synkro", ".mcp-jwt"), "utf8").trim();
+    const durable = readFileSync37(join38(homedir38(), ".synkro", ".mcp-jwt"), "utf8").trim();
     if (durable) return durable;
   } catch {
   }
@@ -15945,7 +16993,7 @@ function syncOperationalInventoryDetached() {
   writeState({ ...state, last_attempt_at: (/* @__PURE__ */ new Date()).toISOString(), last_target: target }, path);
   try {
     const script = process.argv[1];
-    if (!script || !existsSync38(script)) return;
+    if (!script || !existsSync39(script)) return;
     const child = spawn8(process.execPath, [script, "inventory-sync", "--detached"], {
       detached: true,
       stdio: "ignore",
@@ -15969,13 +17017,13 @@ var init_sync2 = __esm({
 });
 
 // cli/bootstrap.js
-import { readFileSync as readFileSync38, existsSync as existsSync39 } from "fs";
+import { readFileSync as readFileSync38, existsSync as existsSync40 } from "fs";
 import { resolve as resolve6 } from "path";
 var envCandidates = [
   resolve6(process.env.HOME ?? "", ".synkro", "config.env")
 ];
 for (const envPath of envCandidates) {
-  if (!existsSync39(envPath)) continue;
+  if (!existsSync40(envPath)) continue;
   const envContent = readFileSync38(envPath, "utf-8");
   for (const line of envContent.split("\n")) {
     const trimmed = line.trim();
@@ -15993,7 +17041,7 @@ var subArgs = args.slice(1);
 var isDetachedChild = process.env.SYNKRO_TELEMETRY_DETACHED === "1";
 var FLUSH_SKIP = /* @__PURE__ */ new Set(["grade", "inventory-sync", "version", "--version", "-v", "help", "--help", "-h", ""]);
 function printVersion() {
-  console.log("1.8.0");
+  console.log("1.9.0");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents
@@ -16012,9 +17060,16 @@ Commands:
   claude-desktop         Monitor Claude Desktop conversations (local, macOS)
   telemetry <sub>        Inspect or flush local telemetry events
   whoami                 Show resolved identity + where grading runs
+  workspace <sub>        Answer the task-workspace question (stay/clear/status)
+  ui                     Governed multiplexer: spaces + agents, real sessions in tabs
   refresh                Refresh the login session (keeps you signed in; run on a schedule)
   version                Show version
 
+  workspace:
+    synkro workspace stay <taskId>       keep working in the current checkout
+    synkro workspace clear <taskId>      forget the choice (Synkro asks again)
+    synkro workspace status [taskId]     show recorded choices
+
   config:
     synkro config                        show current settings
     synkro config grading <local|byok>   where grading runs
@@ -16118,6 +17173,16 @@ async function main() {
       await whoamiCommand2(subArgs);
       break;
     }
+    case "workspace": {
+      const { workspaceCommand: workspaceCommand2 } = await Promise.resolve().then(() => (init_workspace(), workspace_exports));
+      await workspaceCommand2(subArgs);
+      break;
+    }
+    case "ui": {
+      const { uiCommand: uiCommand2 } = await Promise.resolve().then(() => (init_ui(), ui_exports));
+      await uiCommand2(subArgs);
+      break;
+    }
     case "refresh": {
       const { refreshCommand: refreshCommand2 } = await Promise.resolve().then(() => (init_refresh(), refresh_exports));
       await refreshCommand2(subArgs);
@@ -16230,7 +17295,7 @@ async function shutdown(code) {
   }, 200);
   force.unref();
 }
-main().then(() => postDispatchFlush()).then(() => shutdown(0)).catch(async (err) => {
+main().then(() => postDispatchFlush()).then(() => shutdown(typeof process.exitCode === "number" ? process.exitCode : 0)).catch(async (err) => {
   try {
     const { emit: emit2 } = await Promise.resolve().then(() => (init_telemetry(), telemetry_exports));
     emit2("error", {