@synkro-sh/cli 1.3.16 → 1.3.17

package/dist/bootstrap.js

@@ -175,18 +175,20 @@ function installCCHooks(settingsPath, config2) {
     ],
     [SYNKRO_MARKER]: true
   });
-  settings.hooks.Stop = settings.hooks.Stop ?? [];
-  removeSynkroEntries(settings.hooks, "Stop");
-  settings.hooks.Stop.push({
-    hooks: [
-      {
-        type: "command",
-        command: config2.transcriptSyncScriptPath,
-        timeout: 3
-      }
-    ],
-    [SYNKRO_MARKER]: true
-  });
+  if (!config2.skipTranscriptSync) {
+    settings.hooks.Stop = settings.hooks.Stop ?? [];
+    removeSynkroEntries(settings.hooks, "Stop");
+    settings.hooks.Stop.push({
+      hooks: [
+        {
+          type: "command",
+          command: config2.transcriptSyncScriptPath,
+          timeout: 3
+        }
+      ],
+      [SYNKRO_MARKER]: true
+    });
+  }
   writeSettingsAtomic(settingsPath, settings);
 }
 function uninstallCCHooks(settingsPath) {
@@ -1535,6 +1537,7 @@ GATEWAY_URL="\${SYNKRO_GATEWAY_URL:-https://api.synkro.sh}"
 CREDS_PATH="\${SYNKRO_CREDENTIALS_PATH:-$HOME/.synkro/credentials.json}"
 
 if [ ! -f "$CREDS_PATH" ]; then echo '{}'; exit 0; fi
+if [ "\${SYNKRO_TRANSCRIPT_CONSENT:-yes}" = "no" ]; then echo '{}'; exit 0; fi
 JWT=$(jq -r '.access_token // empty' "$CREDS_PATH" 2>/dev/null)
 if [ -z "$JWT" ]; then echo '{}'; exit 0; fi
 
@@ -2606,7 +2609,9 @@ async function listAccessibleRepos(opts) {
 }
 async function pushSecretsToRepo(opts, owner, repo, secrets) {
   const pubkey = await getRepoPublicKey(opts, owner, repo);
-  await putRepoSecret(opts, owner, repo, "CLAUDE_CODE_OAUTH_TOKEN", secrets.claudeCodeOauthToken, pubkey);
+  if (secrets.claudeCodeOauthToken) {
+    await putRepoSecret(opts, owner, repo, "CLAUDE_CODE_OAUTH_TOKEN", secrets.claudeCodeOauthToken, pubkey);
+  }
   await putRepoSecret(opts, owner, repo, "SYNKRO_API_KEY", secrets.synkroApiKey, pubkey);
 }
 function writeWorkflowFile(repoRootPath) {
@@ -2750,8 +2755,27 @@ async function connectGithubAndSelectRepos() {
     rl.close();
   }
 }
-async function promptRepoConnection() {
+async function promptRepoConnection(opts) {
   const localRepo = detectGitRepo();
+  if (opts?.linkRepo && localRepo) {
+    console.log("Connect repos to Synkro:\n");
+    try {
+      const existing = await listProjects();
+      const alreadyLinked = existing.some(
+        (p) => p.repos?.some((r) => r.full_name === localRepo.fullName)
+      );
+      if (!alreadyLinked) {
+        await createProject(localRepo.shortName, [{ full_name: localRepo.fullName }]);
+        console.log(`  \u2713 Created project "${localRepo.shortName}" linked to ${localRepo.fullName}`);
+      } else {
+        console.log(`  \u2713 ${localRepo.fullName} is already linked to a Synkro project.`);
+      }
+    } catch (err) {
+      console.warn(`  \u26A0 Could not link repo: ${err.message}`);
+    }
+    console.log();
+    return;
+  }
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   try {
     console.log("Connect repos to Synkro:\n");
@@ -2829,16 +2853,282 @@ var init_repoConnect = __esm({
   }
 });
 
+// cli/commands/setupGithub.ts
+var setupGithub_exports = {};
+__export(setupGithub_exports, {
+  setupGithubCommand: () => setupGithubCommand
+});
+import { createInterface as createInterface2 } from "readline/promises";
+import { stdin as input, stdout as output } from "process";
+import { execSync as execSync3, spawn as nodeSpawn } from "child_process";
+import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join5 } from "path";
+function readConfig() {
+  if (!existsSync6(CONFIG_PATH)) return {};
+  const out = {};
+  for (const line of readFileSync4(CONFIG_PATH, "utf-8").split("\n")) {
+    const t = line.trim();
+    if (!t || t.startsWith("#")) continue;
+    const eq = t.indexOf("=");
+    if (eq > 0) out[t.slice(0, eq).trim()] = t.slice(eq + 1).trim().replace(/^['"]|['"]$/g, "");
+  }
+  return out;
+}
+async function prompt(rl, q, opts = {}) {
+  if (opts.silent) {
+    process.stdout.write(q);
+    const wasRaw = process.stdin.isRaw;
+    if (process.stdin.setRawMode) process.stdin.setRawMode(true);
+    return await new Promise((resolve2) => {
+      let chunk = "";
+      const onData = (data) => {
+        const s = data.toString("utf-8");
+        if (s === "\r" || s === "\n" || s === "\r\n") {
+          process.stdin.removeListener("data", onData);
+          if (process.stdin.setRawMode) process.stdin.setRawMode(wasRaw ?? false);
+          process.stdout.write("\n");
+          resolve2(chunk);
+          return;
+        }
+        if (s === "") {
+          process.exit(130);
+        }
+        if (s === "\x7F" || s === "\b") {
+          chunk = chunk.slice(0, -1);
+          return;
+        }
+        chunk += s;
+      };
+      process.stdin.on("data", onData);
+    });
+  }
+  return await rl.question(q);
+}
+function captureClaudeSetupToken() {
+  return new Promise((resolve2, reject) => {
+    const proc = nodeSpawn("script", ["-q", "/dev/null", "claude", "setup-token"], {
+      stdio: ["inherit", "pipe", "inherit"]
+    });
+    let stdout = "";
+    proc.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    proc.on("error", (err) => reject(new Error(`Failed to spawn claude setup-token: ${err.message}`)));
+    proc.on("close", (code) => {
+      if (code !== 0) {
+        reject(new Error(`claude setup-token exited with code ${code}`));
+        return;
+      }
+      const stripped = stdout.replace(/\r/g, "").replace(/\x1b\[[0-9;]*[A-Za-z]/g, "").replace(/\x1b\][^\x07]*\x07/g, "").replace(/\x1b[^[\]]*/, "").replace(/\n/g, "");
+      const match = stripped.match(/sk-ant-oat01-[A-Za-z0-9_-]+AA/);
+      if (!match) {
+        reject(new Error("Could not find token in claude setup-token output"));
+        return;
+      }
+      resolve2(match[0]);
+    });
+  });
+}
+async function setupGithubCommand(opts = {}) {
+  if (!isAuthenticated()) {
+    console.error("Not authenticated. Run `synkro-cli login` first.");
+    process.exit(1);
+  }
+  const config2 = readConfig();
+  const gatewayUrl = (config2.SYNKRO_GATEWAY_URL || process.env.SYNKRO_GATEWAY_URL || "https://api.synkro.sh").replace(/\/$/, "");
+  const jwt2 = getAccessToken();
+  if (!jwt2) {
+    console.error("Could not load access token from ~/.synkro/credentials.json. Run `synkro-cli login`.");
+    process.exit(1);
+  }
+  console.log("Requesting CI API key from Synkro...");
+  let synkroCiApiKey;
+  try {
+    const resp = await fetch(`${gatewayUrl}/api/v1/cli/ci-api-key`, {
+      method: "POST",
+      headers: {
+        "Authorization": `Bearer ${jwt2}`,
+        "Content-Type": "application/json"
+      },
+      body: "{}"
+    });
+    if (!resp.ok) {
+      const errText = await resp.text().catch(() => "");
+      console.error(`Failed to mint CI API key (${resp.status}): ${errText.slice(0, 200)}`);
+      process.exit(1);
+    }
+    const minted = await resp.json();
+    synkroCiApiKey = minted.api_key;
+    console.log(`  \u2713 Issued CI key (${synkroCiApiKey.slice(0, 18)}\u2026), expires ${minted.expires_at.slice(0, 10)}`);
+  } catch (err) {
+    console.error(`Failed to mint CI API key: ${err.message}`);
+    process.exit(1);
+  }
+  let ghToken;
+  if (opts.githubToken) {
+    ghToken = opts.githubToken;
+  } else if (opts.nonInteractive) {
+    try {
+      ghToken = execSync3("gh auth token", { encoding: "utf-8", timeout: 5e3 }).trim();
+    } catch {
+      console.error("Could not get GitHub token from `gh auth token`. Run `gh auth login` first.");
+      return;
+    }
+  } else {
+    const rl = createInterface2({ input, output });
+    console.log("Synkro PR scan setup\n");
+    console.log("Requirements:");
+    console.log("  \u2022 Claude Code installed and logged in (Pro, Max, Teams, or Enterprise)");
+    console.log("  \u2022 A GitHub personal access token with `repo` scope");
+    console.log("    (create at https://github.com/settings/tokens?type=beta)\n");
+    ghToken = (await prompt(rl, "GitHub token (paste): ", { silent: true })).trim();
+    rl.close();
+    if (!ghToken || !ghToken.startsWith("ghp_") && !ghToken.startsWith("github_pat_")) {
+      console.error("Invalid GitHub token format. Expected ghp_... or github_pat_...");
+      process.exit(1);
+    }
+  }
+  let claudeToken;
+  if (!opts.skipClaudeToken) {
+    console.log("Generating Claude Code OAuth token...");
+    console.log("  A browser window will open \u2014 authorize with your Claude account.\n");
+    try {
+      claudeToken = await captureClaudeSetupToken();
+    } catch (err) {
+      console.error(`Failed to get Claude token: ${err instanceof Error ? err.message : String(err)}`);
+      if (opts.nonInteractive) return;
+      process.exit(1);
+    }
+    if (!claudeToken.startsWith("sk-ant-oat01-")) {
+      console.error("Invalid token received from `claude setup-token`. Expected sk-ant-oat01-...");
+      if (opts.nonInteractive) return;
+      process.exit(1);
+    }
+    console.log("  Validating token...");
+    try {
+      const validateResult = execSync3(
+        'claude --print --output-format json "say ok"',
+        { env: { ...process.env, CLAUDE_CODE_OAUTH_TOKEN: claudeToken }, encoding: "utf-8", timeout: 3e4, stdio: ["ignore", "pipe", "pipe"] }
+      );
+      const result = JSON.parse(validateResult);
+      if (result.is_error) throw new Error(result.result || "auth failed");
+      console.log("  \u2713 Token validated.\n");
+    } catch (err) {
+      console.error(`Token validation failed: ${err instanceof Error ? err.message : String(err)}`);
+      if (opts.nonInteractive) return;
+      process.exit(1);
+    }
+  }
+  let selected;
+  if (opts.nonInteractive) {
+    let currentFullName = null;
+    try {
+      const remoteUrl = execSync3("git remote get-url origin", { encoding: "utf-8", timeout: 5e3 }).trim();
+      const m = remoteUrl.match(/(?:github\.com)[:/](.+?)(?:\.git)?$/);
+      if (m) currentFullName = m[1];
+    } catch {
+    }
+    if (!currentFullName) {
+      console.warn("  \u26A0 Not in a GitHub repo. Skipping PR scan setup.");
+      return;
+    }
+    const [owner, repo] = currentFullName.split("/");
+    selected = [{ owner, repo, full_name: currentFullName }];
+    console.log(`  Auto-selected repo: ${currentFullName}`);
+  } else {
+    console.log("\nFetching accessible repos...");
+    const repos = await listAccessibleRepos({ token: ghToken });
+    if (repos.length === 0) {
+      console.error("No accessible repos found. Verify the GitHub token has `repo` scope.");
+      process.exit(1);
+    }
+    console.log(`
+Found ${repos.length} accessible repo(s):
+`);
+    repos.slice(0, 100).forEach((r, i) => {
+      console.log(`  ${String(i + 1).padStart(3)}.  ${r.full_name}`);
+    });
+    console.log();
+    const rl2 = createInterface2({ input, output });
+    const selectionRaw = await prompt(rl2, "Select repos to enable (comma-separated numbers, e.g. 1,3,5): ");
+    const selectedIdx = selectionRaw.split(",").map((s) => parseInt(s.trim(), 10) - 1).filter((n) => !isNaN(n) && n >= 0 && n < repos.length);
+    if (selectedIdx.length === 0) {
+      console.error("No valid selections.");
+      rl2.close();
+      process.exit(1);
+    }
+    selected = selectedIdx.map((i) => repos[i]);
+    console.log(`
+Will push secrets to ${selected.length} repo(s):`);
+    for (const r of selected) console.log(`  \u2022 ${r.full_name}`);
+    console.log();
+    const confirm = (await prompt(rl2, "Continue? (yes/no): ")).trim().toLowerCase();
+    if (confirm !== "yes" && confirm !== "y") {
+      console.log("Cancelled.");
+      rl2.close();
+      process.exit(0);
+    }
+    rl2.close();
+  }
+  console.log();
+  for (const r of selected) {
+    process.stdout.write(`Pushing secrets to ${r.full_name}... `);
+    try {
+      await pushSecretsToRepo(
+        { token: ghToken },
+        r.owner,
+        r.repo,
+        {
+          claudeCodeOauthToken: claudeToken,
+          synkroApiKey: synkroCiApiKey
+        }
+      );
+      console.log("\u2713");
+    } catch (err) {
+      console.log(`\u2717 (${err.message})`);
+    }
+  }
+  console.log();
+  const gitRoot = findGitRoot(process.cwd());
+  if (gitRoot) {
+    const written = writeWorkflowFile(gitRoot);
+    if (written) {
+      console.log(`Wrote workflow: ${written}`);
+      console.log("Commit and push it to enable PR scanning.");
+    }
+  } else {
+    console.log("Not in a git repo. To enable scanning, add this file to your repo:");
+    console.log(`  Path: ${WORKFLOW_RELATIVE_PATH}`);
+    console.log(`  Content: run \`synkro-cli setup-github\` from inside a repo to write it automatically`);
+  }
+  console.log();
+  console.log("\u2713 PR scan setup complete.");
+  console.log(`Secrets pushed: ${SECRET_NAMES.CLAUDE_OAUTH}, ${SECRET_NAMES.SYNKRO_API_KEY}`);
+  console.log("Open a PR on any selected repo to trigger your first Synkro scan.");
+}
+var SYNKRO_DIR, CONFIG_PATH;
+var init_setupGithub = __esm({
+  "cli/commands/setupGithub.ts"() {
+    "use strict";
+    init_githubSetup();
+    init_stub();
+    SYNKRO_DIR = join5(homedir4(), ".synkro");
+    CONFIG_PATH = join5(SYNKRO_DIR, "config.env");
+  }
+});
+
 // cli/commands/install.ts
 var install_exports = {};
 __export(install_exports, {
   installCommand: () => installCommand,
   parseArgs: () => parseArgs
 });
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, writeFileSync as writeFileSync5, chmodSync, readFileSync as readFileSync4, readdirSync } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join5 } from "path";
-import { execSync as execSync3 } from "child_process";
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, writeFileSync as writeFileSync5, chmodSync, readFileSync as readFileSync5, readdirSync } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join6 } from "path";
+import { execSync as execSync4 } from "child_process";
+import { createInterface as createInterface3 } from "readline";
 function sanitizeGatewayCandidate(raw) {
   if (!raw) return void 0;
   return /^https?:\/\//.test(raw) ? raw : void 0;
@@ -2851,6 +3141,8 @@ function parseArgs(argv) {
     else if (a === "--skip-auth") opts.skipAuth = true;
     else if (a === "--no-mcp") opts.noMcp = true;
     else if (a === "--force" || a === "-f") opts.force = true;
+    else if (a === "--link-repo") opts.linkRepo = true;
+    else if (a === "--pr-scan") opts.prScan = true;
   }
   if (!opts.gatewayUrl) {
     const fromEnv = sanitizeGatewayCandidate(process.env.SYNKRO_GATEWAY_URL);
@@ -2858,8 +3150,21 @@ function parseArgs(argv) {
   }
   return opts;
 }
+async function promptTranscriptConsent() {
+  const rl = createInterface3({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve2) => {
+    rl.question(
+      "Would you like Synkro to use Claude Code session transcripts\nto generate guardrail rules and policies for your team? (Y/n) ",
+      (answer) => {
+        rl.close();
+        const trimmed = answer.trim().toLowerCase();
+        resolve2(trimmed === "" || trimmed === "y" || trimmed === "yes");
+      }
+    );
+  });
+}
 function ensureSynkroDir() {
-  mkdirSync5(SYNKRO_DIR, { recursive: true });
+  mkdirSync5(SYNKRO_DIR2, { recursive: true });
   mkdirSync5(HOOKS_DIR, { recursive: true });
   mkdirSync5(BIN_DIR, { recursive: true });
   mkdirSync5(OFFSETS_DIR, { recursive: true });
@@ -2873,13 +3178,13 @@ function writeGraderDaemon() {
   chmodSync(GRADER_PRIMER_BASH_PATH, 420);
 }
 function writeHookScripts() {
-  const bashScriptPath = join5(HOOKS_DIR, "cc-bash-judge.sh");
-  const bashFollowupScriptPath = join5(HOOKS_DIR, "cc-bash-followup.sh");
-  const editCaptureScriptPath = join5(HOOKS_DIR, "cc-edit-capture.sh");
-  const editPrecheckScriptPath = join5(HOOKS_DIR, "cc-edit-precheck.sh");
-  const stopSummaryScriptPath = join5(HOOKS_DIR, "cc-stop-summary.sh");
-  const sessionStartScriptPath = join5(HOOKS_DIR, "cc-session-start.sh");
-  const transcriptSyncScriptPath = join5(HOOKS_DIR, "cc-transcript-sync.sh");
+  const bashScriptPath = join6(HOOKS_DIR, "cc-bash-judge.sh");
+  const bashFollowupScriptPath = join6(HOOKS_DIR, "cc-bash-followup.sh");
+  const editCaptureScriptPath = join6(HOOKS_DIR, "cc-edit-capture.sh");
+  const editPrecheckScriptPath = join6(HOOKS_DIR, "cc-edit-precheck.sh");
+  const stopSummaryScriptPath = join6(HOOKS_DIR, "cc-stop-summary.sh");
+  const sessionStartScriptPath = join6(HOOKS_DIR, "cc-session-start.sh");
+  const transcriptSyncScriptPath = join6(HOOKS_DIR, "cc-transcript-sync.sh");
   writeFileSync5(bashScriptPath, CC_BASH_JUDGE_SCRIPT, "utf-8");
   writeFileSync5(bashFollowupScriptPath, CC_BASH_FOLLOWUP_SCRIPT, "utf-8");
   writeFileSync5(editCaptureScriptPath, CC_EDIT_CAPTURE_SCRIPT, "utf-8");
@@ -2912,7 +3217,7 @@ function shellQuoteSingle(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
 function writeConfigEnv(opts) {
-  const credsPath = join5(SYNKRO_DIR, "credentials.json");
+  const credsPath = join6(SYNKRO_DIR2, "credentials.json");
   const safeGateway = sanitizeConfigValue(opts.gatewayUrl);
   const safeUserId = sanitizeConfigValue(opts.userId);
   const safeOrgId = sanitizeConfigValue(opts.orgId);
@@ -2925,14 +3230,17 @@ function writeConfigEnv(opts) {
     `SYNKRO_GATEWAY_URL=${shellQuoteSingle(safeGateway)}`,
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.3.16")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.3.17")}`
   ];
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
   if (safeOrgId) lines.push(`SYNKRO_ORG_ID=${shellQuoteSingle(safeOrgId)}`);
   if (safeEmail) lines.push(`SYNKRO_EMAIL=${shellQuoteSingle(safeEmail)}`);
+  if (opts.transcriptConsent !== void 0) {
+    lines.push(`SYNKRO_TRANSCRIPT_CONSENT=${shellQuoteSingle(opts.transcriptConsent ? "yes" : "no")}`);
+  }
   lines.push("");
-  writeFileSync5(CONFIG_PATH, lines.join("\n"), "utf-8");
-  chmodSync(CONFIG_PATH, 384);
+  writeFileSync5(CONFIG_PATH2, lines.join("\n"), "utf-8");
+  chmodSync(CONFIG_PATH2, 384);
 }
 function assertGatewayAllowed(gatewayUrl) {
   let parsed;
@@ -2957,19 +3265,19 @@ function assertGatewayAllowed(gatewayUrl) {
 }
 function isAlreadyInstalled() {
   const requiredScripts = [
-    join5(HOOKS_DIR, "cc-bash-judge.sh"),
-    join5(HOOKS_DIR, "cc-bash-followup.sh"),
-    join5(HOOKS_DIR, "cc-edit-precheck.sh"),
-    join5(HOOKS_DIR, "cc-edit-capture.sh"),
-    join5(HOOKS_DIR, "cc-stop-summary.sh"),
-    join5(HOOKS_DIR, "cc-session-start.sh")
+    join6(HOOKS_DIR, "cc-bash-judge.sh"),
+    join6(HOOKS_DIR, "cc-bash-followup.sh"),
+    join6(HOOKS_DIR, "cc-edit-precheck.sh"),
+    join6(HOOKS_DIR, "cc-edit-capture.sh"),
+    join6(HOOKS_DIR, "cc-stop-summary.sh"),
+    join6(HOOKS_DIR, "cc-session-start.sh")
   ];
-  if (!requiredScripts.every((p) => existsSync6(p))) return false;
-  if (!existsSync6(CONFIG_PATH)) return false;
-  const settingsPath = join5(homedir4(), ".claude", "settings.json");
-  if (!existsSync6(settingsPath)) return false;
+  if (!requiredScripts.every((p) => existsSync7(p))) return false;
+  if (!existsSync7(CONFIG_PATH2)) return false;
+  const settingsPath = join6(homedir5(), ".claude", "settings.json");
+  if (!existsSync7(settingsPath)) return false;
   try {
-    const settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
+    const settings = JSON.parse(readFileSync5(settingsPath, "utf-8"));
     const hooks = settings?.hooks;
     if (!hooks || typeof hooks !== "object") return false;
     const hasManaged = (kind) => Array.isArray(hooks[kind]) && hooks[kind].some((entry) => entry?.__synkro_managed__ === true);
@@ -3028,7 +3336,7 @@ async function installCommand(opts = {}) {
     console.error("No access token available after auth.");
     process.exit(1);
   }
-  await promptRepoConnection();
+  await promptRepoConnection({ linkRepo: opts.linkRepo });
   const agents = detectAgents();
   if (agents.length === 0) {
     console.error("No AI coding agents detected. Install Claude Code first: https://docs.claude.com/claude-code");
@@ -3052,9 +3360,9 @@ async function installCommand(opts = {}) {
 `);
   writeGraderDaemon();
   for (const mode of ["edit", "bash"]) {
-    const pidFile = join5(SYNKRO_DIR, "daemon", mode, "daemon.pid");
+    const pidFile = join6(SYNKRO_DIR2, "daemon", mode, "daemon.pid");
     try {
-      const pid = parseInt(readFileSync4(pidFile, "utf-8").trim(), 10);
+      const pid = parseInt(readFileSync5(pidFile, "utf-8").trim(), 10);
       if (pid > 0) {
         process.kill(pid, "SIGTERM");
         console.log(`Stopped stale ${mode} daemon (pid ${pid})`);
@@ -3067,6 +3375,15 @@ async function installCommand(opts = {}) {
   console.log(`  ${GRADER_PRIMER_EDIT_PATH}`);
   console.log(`  ${GRADER_PRIMER_BASH_PATH}
 `);
+  let transcriptConsent = true;
+  if (process.stdin.isTTY) {
+    transcriptConsent = await promptTranscriptConsent();
+    if (transcriptConsent) {
+      console.log("  \u2713 Transcript collection enabled\n");
+    } else {
+      console.log("  \u2717 Transcript collection disabled \u2014 skipping transcript sync\n");
+    }
+  }
   let hasClaudeCode = false;
   for (const agent of agents) {
     if (agent.kind === "claude_code") {
@@ -3078,7 +3395,8 @@ async function installCommand(opts = {}) {
         editPrecheckScriptPath: scripts.editPrecheckScript,
         stopSummaryScriptPath: scripts.stopSummaryScript,
         sessionStartScriptPath: scripts.sessionStartScript,
-        transcriptSyncScriptPath: scripts.transcriptSyncScript
+        transcriptSyncScriptPath: scripts.transcriptSyncScript,
+        skipTranscriptSync: !transcriptConsent
       });
       console.log(`Configured ${agent.name} hooks at ${agent.settingsPath}`);
     }
@@ -3121,44 +3439,53 @@ async function installCommand(opts = {}) {
     email = info.email;
   } catch {
   }
-  writeConfigEnv({ gatewayUrl, userId, orgId, email });
-  console.log(`Wrote config to ${CONFIG_PATH}
+  writeConfigEnv({ gatewayUrl, userId, orgId, email, transcriptConsent });
+  console.log(`Wrote config to ${CONFIG_PATH2}
 `);
-  try {
-    const repo = detectGitRepo2();
-    if (repo) {
-      const ingested = await ingestSessionTranscripts(gatewayUrl, token, repo);
-      if (ingested > 0) {
-        console.log(`Indexed ${ingested} session insights from Claude Code history for ${repo}.`);
-        console.log("  This helps the safety judge understand your workflow.\n");
+  if (transcriptConsent) {
+    try {
+      const repo = detectGitRepo2();
+      if (repo) {
+        const ingested = await ingestSessionTranscripts(gatewayUrl, token, repo);
+        if (ingested > 0) {
+          console.log(`Indexed ${ingested} session insights from Claude Code history for ${repo}.`);
+          console.log("  This helps the safety judge understand your workflow.\n");
+        }
       }
-    }
-  } catch (err) {
-    console.warn(`  \u26A0 Session indexing skipped: ${err.message}
+    } catch (err) {
+      console.warn(`  \u26A0 Session indexing skipped: ${err.message}
 `);
-  }
-  try {
-    const repo = detectGitRepo2();
-    if (repo) {
-      const result = await syncTranscriptsBulk(gatewayUrl, token, repo);
-      if (result.messages > 0) {
-        console.log(`Synced ${result.sessions} sessions (${result.messages} messages) from Claude Code history.`);
-        console.log("  This data will be used to suggest guardrail rules.\n");
-      }
     }
-  } catch (err) {
-    console.warn(`  \u26A0 Transcript sync skipped: ${err.message}
+    try {
+      const repo = detectGitRepo2();
+      if (repo) {
+        const result = await syncTranscriptsBulk(gatewayUrl, token, repo);
+        if (result.messages > 0) {
+          console.log(`Synced ${result.sessions} sessions (${result.messages} messages) from Claude Code history.`);
+          console.log("  This data will be used to suggest guardrail rules.\n");
+        }
+      }
+    } catch (err) {
+      console.warn(`  \u26A0 Transcript sync skipped: ${err.message}
 `);
+    }
+  }
+  if (opts.prScan) {
+    console.log();
+    const { setupGithubCommand: setupGithubCommand2 } = await Promise.resolve().then(() => (init_setupGithub(), setupGithub_exports));
+    await setupGithubCommand2({ nonInteractive: true });
   }
   console.log("\u2713 Synkro installed.");
   console.log();
-  console.log("Next steps:");
-  console.log("  \u2022 synkro-cli setup-github   (enable PR scanning)");
-  console.log("  \u2022 synkro-cli status         (check what is configured)");
+  if (!opts.prScan) {
+    console.log("Next steps:");
+    console.log("  \u2022 synkro-cli setup-github   (enable PR scanning)");
+    console.log("  \u2022 synkro-cli status         (check what is configured)");
+  }
 }
 function detectGitRepo2() {
   try {
-    const remoteUrl = execSync3("git remote get-url origin", { encoding: "utf-8", timeout: 5e3 }).trim();
+    const remoteUrl = execSync4("git remote get-url origin", { encoding: "utf-8", timeout: 5e3 }).trim();
     const match = remoteUrl.match(/(?:github\.com|gitlab\.com|bitbucket\.org)[:/](.+?)(?:\.git)?$/);
     return match ? match[1] : null;
   } catch {
@@ -3168,17 +3495,17 @@ function detectGitRepo2() {
 function getClaudeProjectsFolder() {
   const cwd = process.cwd();
   const sanitized = "-" + cwd.replace(/\//g, "-");
-  const projectsDir = join5(homedir4(), ".claude", "projects", sanitized);
-  return existsSync6(projectsDir) ? projectsDir : null;
+  const projectsDir = join6(homedir5(), ".claude", "projects", sanitized);
+  return existsSync7(projectsDir) ? projectsDir : null;
 }
 function extractSessionInsights(projectsDir) {
   const insights = [];
   const files = readdirSync(projectsDir).filter((f) => f.endsWith(".jsonl"));
   for (const file of files) {
     const sessionId = file.replace(".jsonl", "");
-    const filePath = join5(projectsDir, file);
+    const filePath = join6(projectsDir, file);
     try {
-      const content = readFileSync4(filePath, "utf-8");
+      const content = readFileSync5(filePath, "utf-8");
       const lines = content.split("\n").filter(Boolean);
       for (let i = 0; i < lines.length; i++) {
         try {
@@ -3254,7 +3581,7 @@ function extractTextContent(content) {
   return "";
 }
 function parseTranscriptFile(filePath) {
-  const content = readFileSync4(filePath, "utf-8");
+  const content = readFileSync5(filePath, "utf-8");
   const lines = content.split("\n").filter(Boolean);
   const messages = [];
   for (let i = 0; i < lines.length; i++) {
@@ -3305,7 +3632,7 @@ async function syncTranscriptsBulk(gatewayUrl, token, repo) {
     const sessions = [];
     for (const file of batch) {
       const sessionId = file.replace(".jsonl", "");
-      const filePath = join5(projectsDir, file);
+      const filePath = join6(projectsDir, file);
       try {
         const allMessages = parseTranscriptFile(filePath);
         const messages = allMessages.length > maxMessagesPerSession ? allMessages.slice(-maxMessagesPerSession) : allMessages;
@@ -3334,18 +3661,18 @@ async function syncTranscriptsBulk(gatewayUrl, token, repo) {
     }
     for (const file of batch) {
       const sessionId = file.replace(".jsonl", "");
-      const filePath = join5(projectsDir, file);
+      const filePath = join6(projectsDir, file);
       try {
-        const content = readFileSync4(filePath, "utf-8");
+        const content = readFileSync5(filePath, "utf-8");
         const lineCount = content.split("\n").filter(Boolean).length;
-        writeFileSync5(join5(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
+        writeFileSync5(join6(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
       } catch {
       }
     }
   }
   return { sessions: totalSessions, messages: totalMessages };
 }
-var SYNKRO_DIR, HOOKS_DIR, BIN_DIR, CONFIG_PATH, GRADER_DAEMON_PATH, GRADER_PRIMER_EDIT_PATH, GRADER_PRIMER_BASH_PATH, OFFSETS_DIR;
+var SYNKRO_DIR2, HOOKS_DIR, BIN_DIR, CONFIG_PATH2, GRADER_DAEMON_PATH, GRADER_PRIMER_EDIT_PATH, GRADER_PRIMER_BASH_PATH, OFFSETS_DIR;
 var init_install = __esm({
   "cli/commands/install.ts"() {
     "use strict";
@@ -3356,14 +3683,14 @@ var init_install = __esm({
     init_graderDaemon();
     init_stub();
     init_repoConnect();
-    SYNKRO_DIR = join5(homedir4(), ".synkro");
-    HOOKS_DIR = join5(SYNKRO_DIR, "hooks");
-    BIN_DIR = join5(SYNKRO_DIR, "bin");
-    CONFIG_PATH = join5(SYNKRO_DIR, "config.env");
-    GRADER_DAEMON_PATH = join5(BIN_DIR, "grader_daemon.py");
-    GRADER_PRIMER_EDIT_PATH = join5(SYNKRO_DIR, "grader-primer-edit.txt");
-    GRADER_PRIMER_BASH_PATH = join5(SYNKRO_DIR, "grader-primer-bash.txt");
-    OFFSETS_DIR = join5(SYNKRO_DIR, ".transcript-offsets");
+    SYNKRO_DIR2 = join6(homedir5(), ".synkro");
+    HOOKS_DIR = join6(SYNKRO_DIR2, "hooks");
+    BIN_DIR = join6(SYNKRO_DIR2, "bin");
+    CONFIG_PATH2 = join6(SYNKRO_DIR2, "config.env");
+    GRADER_DAEMON_PATH = join6(BIN_DIR, "grader_daemon.py");
+    GRADER_PRIMER_EDIT_PATH = join6(SYNKRO_DIR2, "grader-primer-edit.txt");
+    GRADER_PRIMER_BASH_PATH = join6(SYNKRO_DIR2, "grader-primer-bash.txt");
+    OFFSETS_DIR = join6(SYNKRO_DIR2, ".transcript-offsets");
   }
 });
 
@@ -3439,13 +3766,13 @@ var status_exports = {};
 __export(status_exports, {
   statusCommand: () => statusCommand
 });
-import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join6 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join7 } from "path";
 function readConfigEnv() {
-  if (!existsSync7(CONFIG_PATH2)) return {};
+  if (!existsSync8(CONFIG_PATH3)) return {};
   const out = {};
-  const raw = readFileSync5(CONFIG_PATH2, "utf-8");
+  const raw = readFileSync6(CONFIG_PATH3, "utf-8");
   for (const line of raw.split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -3476,10 +3803,10 @@ function statusCommand() {
   console.log(`  tier:        ${config2.SYNKRO_TIER ?? "(unset)"}`);
   const info2 = getUserInfo();
   const userId = info2?.id ?? config2.SYNKRO_USER_ID ?? "default";
-  const tierCacheFile = join6(SYNKRO_DIR2, `.tier-cache-${userId}`);
+  const tierCacheFile = join7(SYNKRO_DIR3, `.tier-cache-${userId}`);
   let inferenceTier = config2.SYNKRO_INFERENCE_TIER || null;
-  if (!inferenceTier && existsSync7(tierCacheFile)) {
-    inferenceTier = readFileSync5(tierCacheFile, "utf-8").trim() || null;
+  if (!inferenceTier && existsSync8(tierCacheFile)) {
+    inferenceTier = readFileSync6(tierCacheFile, "utf-8").trim() || null;
   }
   const tierLabel = inferenceTier === "fast" ? "'fast' (server-side grading)" : inferenceTier === "free" ? "'free' (local daemon grading)" : "(unknown \u2014 fires on next hook)";
   console.log(`  inference:   ${tierLabel}`);
@@ -3506,19 +3833,19 @@ function statusCommand() {
     }
   }
   console.log();
-  const bashScript = join6(SYNKRO_DIR2, "hooks", "cc-bash-judge.sh");
-  const bashFollowupScript = join6(SYNKRO_DIR2, "hooks", "cc-bash-followup.sh");
-  const editPrecheckScript = join6(SYNKRO_DIR2, "hooks", "cc-edit-precheck.sh");
-  const editCaptureScript = join6(SYNKRO_DIR2, "hooks", "cc-edit-capture.sh");
-  const stopSummaryScript = join6(SYNKRO_DIR2, "hooks", "cc-stop-summary.sh");
-  const sessionStartScript = join6(SYNKRO_DIR2, "hooks", "cc-session-start.sh");
+  const bashScript = join7(SYNKRO_DIR3, "hooks", "cc-bash-judge.sh");
+  const bashFollowupScript = join7(SYNKRO_DIR3, "hooks", "cc-bash-followup.sh");
+  const editPrecheckScript = join7(SYNKRO_DIR3, "hooks", "cc-edit-precheck.sh");
+  const editCaptureScript = join7(SYNKRO_DIR3, "hooks", "cc-edit-capture.sh");
+  const stopSummaryScript = join7(SYNKRO_DIR3, "hooks", "cc-stop-summary.sh");
+  const sessionStartScript = join7(SYNKRO_DIR3, "hooks", "cc-session-start.sh");
   console.log("Hook scripts:");
-  console.log(`  ${existsSync7(bashScript) ? "\u2713" : "\u2717"} ${bashScript}`);
-  console.log(`  ${existsSync7(bashFollowupScript) ? "\u2713" : "\u2717"} ${bashFollowupScript}`);
-  console.log(`  ${existsSync7(editPrecheckScript) ? "\u2713" : "\u2717"} ${editPrecheckScript}`);
-  console.log(`  ${existsSync7(editCaptureScript) ? "\u2713" : "\u2717"} ${editCaptureScript}`);
-  console.log(`  ${existsSync7(stopSummaryScript) ? "\u2713" : "\u2717"} ${stopSummaryScript}`);
-  console.log(`  ${existsSync7(sessionStartScript) ? "\u2713" : "\u2717"} ${sessionStartScript}`);
+  console.log(`  ${existsSync8(bashScript) ? "\u2713" : "\u2717"} ${bashScript}`);
+  console.log(`  ${existsSync8(bashFollowupScript) ? "\u2713" : "\u2717"} ${bashFollowupScript}`);
+  console.log(`  ${existsSync8(editPrecheckScript) ? "\u2713" : "\u2717"} ${editPrecheckScript}`);
+  console.log(`  ${existsSync8(editCaptureScript) ? "\u2713" : "\u2717"} ${editCaptureScript}`);
+  console.log(`  ${existsSync8(stopSummaryScript) ? "\u2713" : "\u2717"} ${stopSummaryScript}`);
+  console.log(`  ${existsSync8(sessionStartScript) ? "\u2713" : "\u2717"} ${sessionStartScript}`);
   console.log();
   const mcp = inspectMcpConfig();
   console.log("Guardrails MCP server (Claude Code):");
@@ -3530,7 +3857,7 @@ function statusCommand() {
     console.log(`    expected at ${mcp.configPath} \u2192 mcpServers.synkro-guardrails`);
   }
 }
-var SYNKRO_DIR2, CONFIG_PATH2;
+var SYNKRO_DIR3, CONFIG_PATH3;
 var init_status = __esm({
   "cli/commands/status.ts"() {
     "use strict";
@@ -3538,8 +3865,8 @@ var init_status = __esm({
     init_agentDetect();
     init_ccHookConfig();
     init_mcpConfig();
-    SYNKRO_DIR2 = join6(homedir5(), ".synkro");
-    CONFIG_PATH2 = join6(SYNKRO_DIR2, "config.env");
+    SYNKRO_DIR3 = join7(homedir6(), ".synkro");
+    CONFIG_PATH3 = join7(SYNKRO_DIR3, "config.env");
   }
 });
 
@@ -3569,7 +3896,7 @@ var unlink_exports = {};
 __export(unlink_exports, {
   unlinkCommand: () => unlinkCommand
 });
-import { createInterface as createInterface2 } from "readline";
+import { createInterface as createInterface4 } from "readline";
 function ask2(rl, question) {
   return new Promise((resolve2) => rl.question(question, resolve2));
 }
@@ -3597,7 +3924,7 @@ async function unlinkCommand() {
     console.log(`  ${i + 1}. ${r.fullName} (${r.projectName})`);
   });
   console.log();
-  const rl = createInterface2({ input: process.stdin, output: process.stdout });
+  const rl = createInterface4({ input: process.stdin, output: process.stdout });
   try {
     const selection = await ask2(rl, "  Select repos to unlink (comma-separated numbers): ");
     const indices = selection.split(",").map((s) => parseInt(s.trim(), 10) - 1).filter((n) => !isNaN(n) && n >= 0 && n < linked.length);
@@ -3623,200 +3950,12 @@ var init_unlink = __esm({
   }
 });
 
-// cli/commands/setupGithub.ts
-var setupGithub_exports = {};
-__export(setupGithub_exports, {
-  setupGithubCommand: () => setupGithubCommand
-});
-import { createInterface as createInterface3 } from "readline/promises";
-import { stdin as input, stdout as output } from "process";
-import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
-import { homedir as homedir6 } from "os";
-import { join as join7 } from "path";
-function readConfig() {
-  if (!existsSync8(CONFIG_PATH3)) return {};
-  const out = {};
-  for (const line of readFileSync6(CONFIG_PATH3, "utf-8").split("\n")) {
-    const t = line.trim();
-    if (!t || t.startsWith("#")) continue;
-    const eq = t.indexOf("=");
-    if (eq > 0) out[t.slice(0, eq).trim()] = t.slice(eq + 1).trim();
-  }
-  return out;
-}
-async function prompt(rl, q, opts = {}) {
-  if (opts.silent) {
-    process.stdout.write(q);
-    const wasRaw = process.stdin.isRaw;
-    if (process.stdin.setRawMode) process.stdin.setRawMode(true);
-    return await new Promise((resolve2) => {
-      let chunk = "";
-      const onData = (data) => {
-        const s = data.toString("utf-8");
-        if (s === "\r" || s === "\n" || s === "\r\n") {
-          process.stdin.removeListener("data", onData);
-          if (process.stdin.setRawMode) process.stdin.setRawMode(wasRaw ?? false);
-          process.stdout.write("\n");
-          resolve2(chunk);
-          return;
-        }
-        if (s === "") {
-          process.exit(130);
-        }
-        if (s === "\x7F" || s === "\b") {
-          chunk = chunk.slice(0, -1);
-          return;
-        }
-        chunk += s;
-      };
-      process.stdin.on("data", onData);
-    });
-  }
-  return await rl.question(q);
-}
-async function setupGithubCommand() {
-  if (!isAuthenticated()) {
-    console.error("Not authenticated. Run `synkro-cli login` first.");
-    process.exit(1);
-  }
-  const config2 = readConfig();
-  const gatewayUrl = (config2.SYNKRO_GATEWAY_URL || process.env.SYNKRO_GATEWAY_URL || "https://api.synkro.sh").replace(/\/$/, "");
-  const jwt2 = getAccessToken();
-  if (!jwt2) {
-    console.error("Could not load access token from ~/.synkro/credentials.json. Run `synkro-cli login`.");
-    process.exit(1);
-  }
-  console.log("Requesting CI API key from Synkro...");
-  let synkroCiApiKey;
-  try {
-    const resp = await fetch(`${gatewayUrl}/api/v1/cli/ci-api-key`, {
-      method: "POST",
-      headers: {
-        "Authorization": `Bearer ${jwt2}`,
-        "Content-Type": "application/json"
-      },
-      body: "{}"
-    });
-    if (!resp.ok) {
-      const errText = await resp.text().catch(() => "");
-      console.error(`Failed to mint CI API key (${resp.status}): ${errText.slice(0, 200)}`);
-      process.exit(1);
-    }
-    const minted = await resp.json();
-    synkroCiApiKey = minted.api_key;
-    console.log(`  \u2713 Issued CI key (${synkroCiApiKey.slice(0, 18)}\u2026), expires ${minted.expires_at.slice(0, 10)}`);
-  } catch (err) {
-    console.error(`Failed to mint CI API key: ${err.message}`);
-    process.exit(1);
-  }
-  const rl = createInterface3({ input, output });
-  console.log("Synkro PR scan setup\n");
-  console.log("Requirements:");
-  console.log("  \u2022 Claude Code Pro or Max subscription (for `claude setup-token`)");
-  console.log("  \u2022 A GitHub personal access token with `repo` scope");
-  console.log("    (create at https://github.com/settings/tokens?type=beta)\n");
-  const ghToken = (await prompt(rl, "GitHub token (paste): ", { silent: true })).trim();
-  if (!ghToken || !ghToken.startsWith("ghp_") && !ghToken.startsWith("github_pat_")) {
-    console.error("Invalid GitHub token format. Expected ghp_... or github_pat_...");
-    rl.close();
-    process.exit(1);
-  }
-  console.log("\nNow get your Claude Code OAuth token:");
-  console.log("  1. In another terminal, run: claude setup-token");
-  console.log("  2. Complete the browser flow");
-  console.log("  3. Copy the resulting sk-ant-oat01-... token\n");
-  const claudeToken = (await prompt(rl, "Claude Code OAuth token (paste): ", { silent: true })).trim();
-  if (!claudeToken.startsWith("sk-ant-oat01-")) {
-    console.error("Invalid token. Expected sk-ant-oat01-... \u2014 generate one with `claude setup-token`.");
-    rl.close();
-    process.exit(1);
-  }
-  console.log("\nFetching accessible repos...");
-  const repos = await listAccessibleRepos({ token: ghToken });
-  if (repos.length === 0) {
-    console.error("No accessible repos found. Verify the GitHub token has `repo` scope.");
-    rl.close();
-    process.exit(1);
-  }
-  console.log(`
-Found ${repos.length} accessible repo(s):
-`);
-  repos.slice(0, 100).forEach((r, i) => {
-    console.log(`  ${String(i + 1).padStart(3)}.  ${r.full_name}`);
-  });
-  console.log();
-  const selectionRaw = await prompt(rl, "Select repos to enable (comma-separated numbers, e.g. 1,3,5): ");
-  const selectedIdx = selectionRaw.split(",").map((s) => parseInt(s.trim(), 10) - 1).filter((n) => !isNaN(n) && n >= 0 && n < repos.length);
-  if (selectedIdx.length === 0) {
-    console.error("No valid selections.");
-    rl.close();
-    process.exit(1);
-  }
-  const selected = selectedIdx.map((i) => repos[i]);
-  console.log(`
-Will push secrets to ${selected.length} repo(s):`);
-  for (const r of selected) console.log(`  \u2022 ${r.full_name}`);
-  console.log();
-  const confirm = (await prompt(rl, "Continue? (yes/no): ")).trim().toLowerCase();
-  if (confirm !== "yes" && confirm !== "y") {
-    console.log("Cancelled.");
-    rl.close();
-    process.exit(0);
-  }
-  rl.close();
-  console.log();
-  for (const r of selected) {
-    process.stdout.write(`Pushing secrets to ${r.full_name}... `);
-    try {
-      await pushSecretsToRepo(
-        { token: ghToken },
-        r.owner,
-        r.repo,
-        {
-          claudeCodeOauthToken: claudeToken,
-          synkroApiKey: synkroCiApiKey
-        }
-      );
-      console.log("\u2713");
-    } catch (err) {
-      console.log(`\u2717 (${err.message})`);
-    }
-  }
-  console.log();
-  const gitRoot = findGitRoot(process.cwd());
-  if (gitRoot) {
-    const written = writeWorkflowFile(gitRoot);
-    if (written) {
-      console.log(`Wrote workflow: ${written}`);
-      console.log("Commit and push it to enable PR scanning.");
-    }
-  } else {
-    console.log("Not in a git repo. To enable scanning, add this file to your repo:");
-    console.log(`  Path: ${WORKFLOW_RELATIVE_PATH}`);
-    console.log(`  Content: run \`synkro-cli setup-github\` from inside a repo to write it automatically`);
-  }
-  console.log();
-  console.log("\u2713 PR scan setup complete.");
-  console.log(`Secrets pushed: ${SECRET_NAMES.CLAUDE_OAUTH}, ${SECRET_NAMES.SYNKRO_API_KEY}`);
-  console.log("Open a PR on any selected repo to trigger your first Synkro scan.");
-}
-var SYNKRO_DIR3, CONFIG_PATH3;
-var init_setupGithub = __esm({
-  "cli/commands/setupGithub.ts"() {
-    "use strict";
-    init_githubSetup();
-    init_stub();
-    SYNKRO_DIR3 = join7(homedir6(), ".synkro");
-    CONFIG_PATH3 = join7(SYNKRO_DIR3, "config.env");
-  }
-});
-
 // cli/commands/scanPr.ts
 var scanPr_exports = {};
 __export(scanPr_exports, {
   scanPrCommand: () => scanPrCommand
 });
-import { execSync as execSync4, spawn } from "child_process";
+import { execSync as execSync5, spawn } from "child_process";
 function parseMatchSpec(condition) {
   if (!condition.startsWith("match_spec:")) return null;
   try {
@@ -3922,7 +4061,7 @@ function shouldSkipFile(filename) {
   return SKIP_FILE_PATTERNS.some((p) => p.test(filename));
 }
 function ghJson(args2) {
-  const out = execSync4(`gh ${args2.map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(" ")}`, {
+  const out = execSync5(`gh ${args2.map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(" ")}`, {
     encoding: "utf-8",
     maxBuffer: 16 * 1024 * 1024
   });
@@ -3978,9 +4117,9 @@ ${hunks}`;
     const t0 = Date.now();
     const proc = spawn(
       "claude",
-      ["--print", "--model", "claude-sonnet-4-6", "--output-format", "json", "--no-session-persistence", fullPrompt],
+      ["--print", "--model", "claude-sonnet-4-6", "--output-format", "json", "--no-session-persistence"],
       {
-        stdio: ["ignore", "pipe", "pipe"],
+        stdio: ["pipe", "pipe", "pipe"],
         env: {
           ...process.env,
           CLAUDE_CODE_OAUTH_TOKEN: claudeToken
@@ -3988,6 +4127,8 @@ ${hunks}`;
         timeout: 12e4
       }
     );
+    proc.stdin.write(fullPrompt);
+    proc.stdin.end();
     let stdout = "";
     let stderr = "";
     proc.stdout.on("data", (chunk) => {
@@ -4036,19 +4177,174 @@ async function processInBatches(items, batchSize, fn) {
   }
   return results;
 }
-function postPrComment(repo, prNumber, sha, finding) {
-  const body = `\u{1F512} **Synkro [${finding.severity}]: ${finding.category}**
+function buildConsolidationPrompt(findings) {
+  return `You are a senior security reviewer writing the final PR review. You received raw findings from an automated detector. Your job:
 
-${finding.description}
+1. VERIFY \u2014 remove false positives or findings that are clearly wrong.
+2. CONSOLIDATE \u2014 if multiple findings describe the same underlying issue in the same file (e.g. 8 hardcoded secrets), merge them into ONE comment pinned to the first line, listing all affected lines. If findings are genuinely different issues (e.g. SQL injection on line 5 AND a hardcoded secret on line 12), keep them separate.
+3. WRITE \u2014 produce concise, actionable review comments. No fluff. Each comment should name the issue and say what to do. One sentence max for description, one for fix.
 
-**Fix:** ${finding.fix}`;
-  try {
-    execSync4(
-      `gh api -X POST /repos/${repo}/pulls/${prNumber}/comments -f body=${JSON.stringify(body)} -f commit_id=${sha} -f path=${JSON.stringify(finding.file)} -F line=${finding.line} -f side=RIGHT`,
-      { encoding: "utf-8", stdio: ["ignore", "ignore", "pipe"] }
+Output ONLY a JSON object (no prose, no markdown fences):
+{
+  "summary": "<2-3 sentence overview for the review body \u2014 total issues, severity, what to do>",
+  "comments": [
+    {
+      "path": "<file path>",
+      "line": <integer, first affected line number \u2014 REQUIRED, never null>,
+      "body": "<markdown comment \u2014 include affected lines if consolidated, e.g. 'Lines 1-8: ...'>"
+    }
+  ]
+}
+
+Rules:
+- Each comment body should start with a severity emoji+label: \u{1F534} critical, \u{1F7E0} high, \u{1F7E1} medium, \u{1F535} low
+- If consolidating, mention all affected line numbers in the body
+- Keep comments short \u2014 developers read these in a PR, not a report
+- Maximum 15 comments. If more, pick the most critical and mention the rest in the summary.
+- If all findings are legitimate and distinct, keep them all (up to 15)
+- If you determine ALL findings are false positives, return {"summary": "No issues found after verification.", "comments": []}
+
+Raw findings from detector:
+${JSON.stringify(findings, null, 2)}
+`;
+}
+function spawnOpusConsolidator(findings, claudeToken) {
+  return new Promise((resolve2) => {
+    const prompt2 = buildConsolidationPrompt(findings);
+    const proc = spawn(
+      "claude",
+      ["--print", "--model", "claude-opus-4-7", "--output-format", "json", "--no-session-persistence"],
+      {
+        stdio: ["pipe", "pipe", "pipe"],
+        env: {
+          ...process.env,
+          CLAUDE_CODE_OAUTH_TOKEN: claudeToken
+        },
+        timeout: 12e4
+      }
     );
-  } catch (err) {
-    console.warn(`Failed to post comment on ${finding.file}:${finding.line}:`, err.message);
+    proc.stdin.write(prompt2);
+    proc.stdin.end();
+    let stdout = "";
+    let stderr = "";
+    proc.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    proc.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    proc.on("close", (code) => {
+      if (code !== 0) {
+        console.warn(`  opus consolidation exited ${code}: ${(stderr || stdout).slice(0, 300)}`);
+        resolve2(fallbackReview(findings));
+        return;
+      }
+      try {
+        const wrapper = JSON.parse(stdout);
+        const responseText = (wrapper.result || wrapper.response || wrapper.text || "").trim();
+        let txt = responseText;
+        if (txt.startsWith("```")) {
+          txt = txt.replace(/^```(?:json)?\n?/, "").replace(/\n?```\s*$/, "").trim();
+        }
+        const review = JSON.parse(txt);
+        const comments = (review.comments || []).map((c) => ({
+          path: c.path,
+          line: c.line ?? 1,
+          side: "RIGHT",
+          body: c.body
+        }));
+        const maxSeverity = findings.reduce((max, f) => {
+          const order = ["low", "medium", "high", "critical"];
+          return order.indexOf(f.severity) > order.indexOf(max) ? f.severity : max;
+        }, "low");
+        resolve2({ summary: review.summary || "", comments, severity: maxSeverity });
+      } catch {
+        console.warn(`  failed to parse opus response, using fallback`);
+        resolve2(fallbackReview(findings));
+      }
+    });
+  });
+}
+function fallbackReview(findings) {
+  const grouped = /* @__PURE__ */ new Map();
+  for (const f of findings) {
+    const key = `${f.file}::${f.category}`;
+    if (!grouped.has(key)) grouped.set(key, []);
+    grouped.get(key).push(f);
+  }
+  const comments = [];
+  for (const [, group] of grouped) {
+    const first = group[0];
+    const lines = group.map((f) => f.line);
+    const linesStr = lines.length > 1 ? `Lines ${lines.join(", ")}` : `Line ${lines[0]}`;
+    const severityEmoji = first.severity === "critical" ? "\u{1F534}" : first.severity === "high" ? "\u{1F7E0}" : first.severity === "medium" ? "\u{1F7E1}" : "\u{1F535}";
+    comments.push({
+      path: first.file,
+      line: first.line,
+      side: "RIGHT",
+      body: `${severityEmoji} **${first.severity}: ${first.category}**
+
+${linesStr}: ${first.description}
+
+**Fix:** ${first.fix}`
+    });
+  }
+  const maxSeverity = findings.reduce((max, f) => {
+    const order = ["low", "medium", "high", "critical"];
+    return order.indexOf(f.severity) > order.indexOf(max) ? f.severity : max;
+  }, "low");
+  return {
+    summary: `${findings.length} security finding(s) detected.`,
+    comments: comments.slice(0, 15),
+    severity: maxSeverity
+  };
+}
+function postPrReview(repo, prNumber, sha, review) {
+  const preferredEvent = review.severity === "critical" || review.severity === "high" ? "REQUEST_CHANGES" : "COMMENT";
+  function tryPost(event) {
+    const body = JSON.stringify({
+      commit_id: sha,
+      body: `## \u{1F512} Synkro Security Review
+
+${review.summary}`,
+      event,
+      comments: review.comments
+    });
+    try {
+      execSync5(`gh api -X POST /repos/${repo}/pulls/${prNumber}/reviews --input -`, {
+        encoding: "utf-8",
+        input: body,
+        stdio: ["pipe", "pipe", "pipe"]
+      });
+      console.log(`  \u2713 Posted PR review (${event}).`);
+      return true;
+    } catch (err) {
+      const stderr = err.stderr?.toString() || "";
+      const stdout = err.stdout?.toString() || "";
+      const combined = stderr + stdout;
+      if (combined.includes("own pull request") && event === "REQUEST_CHANGES") {
+        return false;
+      }
+      console.warn(`Failed to post review: ${(stderr || stdout || err.message).slice(0, 200)}`);
+      return false;
+    }
+  }
+  if (tryPost(preferredEvent)) return;
+  if (preferredEvent === "REQUEST_CHANGES" && tryPost("COMMENT")) return;
+  try {
+    const fallbackBody = `## \u{1F512} Synkro Security Review
+
+${review.summary}
+
+` + review.comments.map((c) => `**${c.path}:${c.line}** \u2014 ${c.body}`).join("\n\n");
+    execSync5(`gh api -X POST /repos/${repo}/issues/${prNumber}/comments --input -`, {
+      encoding: "utf-8",
+      input: JSON.stringify({ body: fallbackBody }),
+      stdio: ["pipe", "ignore", "pipe"]
+    });
+    console.log("  \u2713 Posted fallback issue comment.");
+  } catch (err2) {
+    console.warn("Failed to post fallback comment:", err2.message);
   }
 }
 function postCheckRun(repo, sha, conclusion, findings) {
@@ -4065,7 +4361,7 @@ function postCheckRun(repo, sha, conclusion, findings) {
     }
   });
   try {
-    execSync4(`gh api -X POST /repos/${repo}/check-runs --input -`, {
+    execSync5(`gh api -X POST /repos/${repo}/check-runs --input -`, {
       encoding: "utf-8",
       input: body,
       stdio: ["pipe", "ignore", "pipe"]
@@ -4173,8 +4469,13 @@ async function scanPrCommand() {
   console.log(`
 Total: ${allFindings.length} finding(s) across ${eligible.length} file(s) in ${totalLatencyMs}ms
 `);
-  for (const finding of allFindings) {
-    postPrComment(repo, prNumber, sha, finding);
+  if (allFindings.length > 0) {
+    console.log("Consolidating findings with Opus 4.7...");
+    const review = await spawnOpusConsolidator(allFindings, claudeToken);
+    console.log(`  \u2192 ${review.comments.length} review comment(s), severity: ${review.severity}`);
+    if (review.comments.length > 0) {
+      postPrReview(repo, prNumber, sha, review);
+    }
   }
   const conclusion = shouldFail(allFindings, failThreshold) ? "failure" : "success";
   postCheckRun(repo, sha, conclusion, allFindings);
@@ -4336,8 +4637,8 @@ for (const envPath of envCandidates) {
     const eqIndex = trimmed.indexOf("=");
     if (eqIndex <= 0) continue;
     const key = trimmed.slice(0, eqIndex).trim();
-    const value = trimmed.slice(eqIndex + 1).trim();
-    if (!process.env[key]) process.env[key] = value;
+    const value = trimmed.slice(eqIndex + 1).trim().replace(/^['"]|['"]$/g, "");
+    if (!process.env[key] && !value.startsWith("op://")) process.env[key] = value;
   }
 }
 var args = process.argv.slice(2);
@@ -4358,7 +4659,6 @@ Commands:
   link                 Link repos to a Synkro project (local git or GitHub OAuth)
   unlink               Remove repo links from Synkro projects
   setup-github         Configure GitHub PR scanning (push secrets + workflow file)
-  scan-pr              Run a PR scan (used by GitHub Actions, not for direct invocation)
   update               Refresh hook configs and judge prompts
   disconnect [--purge] Remove Synkro hooks from agents (--purge also removes ~/.synkro)
   uninstall            Fully remove Synkro from this machine
@@ -4407,7 +4707,13 @@ async function main() {
     }
     case "setup-github": {
       const { setupGithubCommand: setupGithubCommand2 } = await Promise.resolve().then(() => (init_setupGithub(), setupGithub_exports));
-      await setupGithubCommand2();
+      const ghOpts = {};
+      for (const a of subArgs) {
+        if (a === "--non-interactive") ghOpts.nonInteractive = true;
+        else if (a === "--skip-claude-token") ghOpts.skipClaudeToken = true;
+        else if (a.startsWith("--github-token=")) ghOpts.githubToken = a.slice("--github-token=".length);
+      }
+      await setupGithubCommand2(ghOpts);
       break;
     }
     case "scan-pr": {