@synkro-sh/cli 1.4.10 → 1.4.11

package/dist/bootstrap.js

@@ -132,7 +132,7 @@ function installCCHooks(settingsPath, config) {
       {
         type: "command",
         command: config.bashJudgeScriptPath,
-        timeout: 15
+        timeout: 30
       }
     ],
     [SYNKRO_MARKER]: true
@@ -709,8 +709,17 @@ ensure_fresh_jwt() {
 
 ensure_fresh_jwt
 
-# Resolve tier + capture_depth live from /cli/me every call. Default to local_only (fail-safe).
-ME_RESP=$(curl -sS "\${GATEWAY_URL}/api/v1/cli/me" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null || echo "")
+# Parallel fetch: /cli/me + rules in background, wait for both.
+_ME_TMP=$(mktemp -t synkro-me.XXXXXX)
+_RULES_TMP=$(mktemp -t synkro-rules.XXXXXX)
+trap "rm -f \\"$_ME_TMP\\" \\"$_RULES_TMP\\"" EXIT
+curl -sS "\${GATEWAY_URL}/api/v1/cli/me" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null > "$_ME_TMP" &
+_ME_PID=$!
+curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null > "$_RULES_TMP" &
+_RULES_PID=$!
+wait $_ME_PID 2>/dev/null; wait $_RULES_PID 2>/dev/null
+
+ME_RESP=$(cat "$_ME_TMP" 2>/dev/null || echo "")
 SYNKRO_INFERENCE_TIER=$(echo "$ME_RESP" | jq -r '.tier // empty' 2>/dev/null)
 SYNKRO_CAPTURE_DEPTH=$(echo "$ME_RESP" | jq -r '.capture_depth // empty' 2>/dev/null)
 SYNKRO_INFERENCE_TIER="\${SYNKRO_INFERENCE_TIER:-fast}"
@@ -721,32 +730,14 @@ if command -v claude >/dev/null 2>&1; then
   USE_LOCAL=true
 fi
 
-# Prefer local grading whenever it's available \u2014 the local-cc channel beats
-# the cloud fast tier on latency, and it's available regardless of the
-# server-assigned tier. Fall through to the cloud curl only when neither
-# the channel nor a usable \`claude\` CLI is reachable.
 if synkro_channel_up || { [ "$SYNKRO_INFERENCE_TIER" = "free" ] && command -v claude >/dev/null 2>&1; }; then
-  # \u2500\u2500\u2500 LOCAL PATH: channel-grader first, then \`claude --print\` cold fallback. \u2500\u2500\u2500
-
   RULES_CACHE="$HOME/.synkro/.rules-cache-bash"
-  ORG_RULES="[]"
-  if [ "$SYNKRO_CAPTURE_DEPTH" = "local_only" ]; then
-    ORG_RULES=$(curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules" \\
-      -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null \\
-      | jq -c '[.rules[]? | select(.hook_stage == "pre" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category}]' 2>/dev/null || echo "[]")
-    if [ -n "$ORG_RULES" ] && [ "$ORG_RULES" != "null" ] && [ "$ORG_RULES" != "[]" ]; then
-      printf '%s' "$ORG_RULES" > "$RULES_CACHE" 2>/dev/null || true
-    elif [ -f "$RULES_CACHE" ]; then
-      ORG_RULES=$(cat "$RULES_CACHE" 2>/dev/null || echo "[]")
-    fi
-  else
-    ORG_RULES=$(printf '%s' "$COMMAND" | head -c 4000 \\
-      | jq -Rs '{content: .}' \\
-      | curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules?top_k=15" \\
-      -X POST -H "Content-Type: application/json" \\
-      -H "Authorization: Bearer $JWT" \\
-      -d @- --max-time 2 2>/dev/null \\
-      | jq -c '[.rules[]? | select(.hook_stage == "pre" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category}]' 2>/dev/null || echo "[]")
+  RULES_JQ='[.rules[]? | select(.hook_stage == "pre" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category}]'
+  ORG_RULES=$(jq -c "$RULES_JQ" "$_RULES_TMP" 2>/dev/null || echo "[]")
+  if [ -n "$ORG_RULES" ] && [ "$ORG_RULES" != "null" ] && [ "$ORG_RULES" != "[]" ]; then
+    printf '%s' "$ORG_RULES" > "$RULES_CACHE" 2>/dev/null || true
+  elif [ -f "$RULES_CACHE" ]; then
+    ORG_RULES=$(cat "$RULES_CACHE" 2>/dev/null || echo "[]")
   fi
   if [ -z "$ORG_RULES" ] || [ "$ORG_RULES" = "null" ]; then ORG_RULES="[]"; fi
 
@@ -831,7 +822,9 @@ if [ "$VERDICT" != "__LOCAL_XML_PARSED__" ]; then
   ALTERNATIVE=$(echo "$VERDICT" | jq -r '.alternative // ""' 2>/dev/null)
   CATEGORY=$(echo "$VERDICT" | jq -r '.category // "destructive_command"' 2>/dev/null)
   RISK_LEVEL=$(echo "$VERDICT" | jq -r '.risk_level // empty' 2>/dev/null)
+  VIOLATED_RULES=$(echo "$VERDICT" | jq -c '.violated_rules // []' 2>/dev/null)
 fi
+VIOLATED_RULES="\${VIOLATED_RULES:-[]}"
 # Defaults if any var is empty (defensive \u2014 XML primer should always emit them).
 SEVERITY="\${SEVERITY:-audit}"
 VERDICT_KIND="\${VERDICT_KIND:-warn}"
@@ -951,6 +944,7 @@ if [ "$USE_LOCAL" = "true" ] && [ -n "$VERDICT_KIND" ]; then
       --arg reasoning "$REASONING" \\
       --arg alternative "$ALTERNATIVE" \\
       --argjson rules_checked "\${ORG_RULES:-[]}" \\
+      --argjson violated_rules "\${VIOLATED_RULES:-[]}" \\
       --argjson recent_user_messages "\${RECENT_USER_MESSAGES:-[]}" \\
       '{
         event_id: $event_id,
@@ -963,7 +957,8 @@ if [ "$USE_LOCAL" = "true" ] && [ -n "$VERDICT_KIND" ]; then
         model: $model,
         tool_name: $tool_name,
         capture_depth: $capture_depth,
-        rules_checked: $rules_checked
+        rules_checked: $rules_checked,
+        violated_rules: $violated_rules
       } + (if $repo != "" then {repo: $repo} else {} end)
         + (if $session_id != "" then {session_id: $session_id} else {} end)
         + (if $tool_use_id != "" then {tool_use_id: $tool_use_id} else {} end)
@@ -1217,34 +1212,30 @@ ensure_fresh_jwt() {
 ensure_fresh_jwt
 
 
-# Resolve tier + capture_depth live from /cli/me every call. Default to local_only (fail-safe).
-ME_RESP=$(curl -sS "\${GATEWAY_URL}/api/v1/cli/me" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null || echo "")
+# Parallel fetch: /cli/me + rules in background, wait for both.
+_ME_TMP=$(mktemp -t synkro-me.XXXXXX)
+_RULES_TMP=$(mktemp -t synkro-rules.XXXXXX)
+trap "rm -f \\"$_ME_TMP\\" \\"$_RULES_TMP\\"" EXIT
+curl -sS "\${GATEWAY_URL}/api/v1/cli/me" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null > "$_ME_TMP" &
+_ME_PID=$!
+curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null > "$_RULES_TMP" &
+_RULES_PID=$!
+wait $_ME_PID 2>/dev/null; wait $_RULES_PID 2>/dev/null
+
+ME_RESP=$(cat "$_ME_TMP" 2>/dev/null || echo "")
 SYNKRO_INFERENCE_TIER=$(echo "$ME_RESP" | jq -r '.tier // empty' 2>/dev/null)
 SYNKRO_CAPTURE_DEPTH=$(echo "$ME_RESP" | jq -r '.capture_depth // empty' 2>/dev/null)
 SYNKRO_INFERENCE_TIER="\${SYNKRO_INFERENCE_TIER:-fast}"
 SYNKRO_CAPTURE_DEPTH="\${SYNKRO_CAPTURE_DEPTH:-local_only}"
 
 if synkro_channel_up || { [ "$SYNKRO_INFERENCE_TIER" = "free" ] && command -v claude >/dev/null 2>&1; }; then
-  # \u2500\u2500\u2500 LOCAL PATH: channel-grader first, then \`claude --print\` cold fallback. \u2500\u2500\u2500
   RULES_CACHE="$HOME/.synkro/.rules-cache-edit"
-  ORG_RULES="[]"
-  if [ "$SYNKRO_CAPTURE_DEPTH" = "local_only" ]; then
-    ORG_RULES=$(curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules" \\
-      -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null \\
-      | jq -c '[.rules[]? | select(.hook_stage == "pre" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category, mode}]' 2>/dev/null || echo "[]")
-    if [ -n "$ORG_RULES" ] && [ "$ORG_RULES" != "null" ] && [ "$ORG_RULES" != "[]" ]; then
-      printf '%s' "$ORG_RULES" > "$RULES_CACHE" 2>/dev/null || true
-    elif [ -f "$RULES_CACHE" ]; then
-      ORG_RULES=$(cat "$RULES_CACHE" 2>/dev/null || echo "[]")
-    fi
-  else
-    ORG_RULES=$(printf '%s' "$PROPOSED" | head -c 8000 \\
-      | jq -Rs '{content: .}' \\
-      | curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules?top_k=20" \\
-      -X POST -H "Content-Type: application/json" \\
-      -H "Authorization: Bearer $JWT" \\
-      -d @- --max-time 2 2>/dev/null \\
-      | jq -c '[.rules[]? | select(.hook_stage == "pre" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category, mode}]' 2>/dev/null || echo "[]")
+  RULES_JQ='[.rules[]? | select(.hook_stage == "pre" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category, mode}]'
+  ORG_RULES=$(jq -c "$RULES_JQ" "$_RULES_TMP" 2>/dev/null || echo "[]")
+  if [ -n "$ORG_RULES" ] && [ "$ORG_RULES" != "null" ] && [ "$ORG_RULES" != "[]" ]; then
+    printf '%s' "$ORG_RULES" > "$RULES_CACHE" 2>/dev/null || true
+  elif [ -f "$RULES_CACHE" ]; then
+    ORG_RULES=$(cat "$RULES_CACHE" 2>/dev/null || echo "[]")
   fi
   if [ -z "$ORG_RULES" ] || [ "$ORG_RULES" = "null" ]; then ORG_RULES="[]"; fi
 
@@ -1661,30 +1652,25 @@ if [ -n "$SESSION_ID" ] && [ -n "$TOOL_USE_ID" ]; then
   ) &
 fi
 
-# Resolve tier + capture_depth live from /cli/me every call. Default to local_only (fail-safe).
-ME_RESP=$(curl -sS "\${GATEWAY_URL}/api/v1/cli/me" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null || echo "")
+# Parallel fetch: /cli/me + rules in background, wait for both.
+_ME_TMP=$(mktemp -t synkro-me.XXXXXX)
+_RULES_TMP=$(mktemp -t synkro-rules.XXXXXX)
+trap "rm -f \\"$_ME_TMP\\" \\"$_RULES_TMP\\"" EXIT
+curl -sS "\${GATEWAY_URL}/api/v1/cli/me" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null > "$_ME_TMP" &
+_ME_PID=$!
+curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null > "$_RULES_TMP" &
+_RULES_PID=$!
+wait $_ME_PID 2>/dev/null; wait $_RULES_PID 2>/dev/null
+
+ME_RESP=$(cat "$_ME_TMP" 2>/dev/null || echo "")
 SYNKRO_INFERENCE_TIER=$(echo "$ME_RESP" | jq -r '.tier // empty' 2>/dev/null)
 SYNKRO_CAPTURE_DEPTH=$(echo "$ME_RESP" | jq -r '.capture_depth // empty' 2>/dev/null)
 SYNKRO_INFERENCE_TIER="\${SYNKRO_INFERENCE_TIER:-fast}"
 SYNKRO_CAPTURE_DEPTH="\${SYNKRO_CAPTURE_DEPTH:-local_only}"
 
 if synkro_channel_up || { [ "$SYNKRO_INFERENCE_TIER" = "free" ] && command -v claude >/dev/null 2>&1; }; then
-  # \u2500\u2500\u2500 LOCAL PATH: channel-grader first, then \`claude --print\` cold fallback. \u2500\u2500\u2500
-
   RULES_CACHE="$HOME/.synkro/.rules-cache-edit-capture"
-  RULES_RESP=""
-  if [ "$SYNKRO_CAPTURE_DEPTH" = "local_only" ]; then
-    RULES_RESP=$(curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules" \\
-      -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null || echo "")
-  else
-    RULES_RESP=$(printf '%s' "$FILE_CONTENT" | head -c 8000 \\
-      | jq -Rs '{content: .}' \\
-      | curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules?top_k=20" \\
-      -X POST -H "Content-Type: application/json" \\
-      -H "Authorization: Bearer $JWT" \\
-      -d @- --max-time 2 2>/dev/null || echo "")
-  fi
-  ORG_RULES=$(echo "$RULES_RESP" | jq -c '[.rules[]? | select(.hook_stage == "post" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category}]' 2>/dev/null || echo "[]")
+  ORG_RULES=$(jq -c '[.rules[]? | select(.hook_stage == "post" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category}]' "$_RULES_TMP" 2>/dev/null || echo "[]")
   if [ -n "$ORG_RULES" ] && [ "$ORG_RULES" != "null" ] && [ "$ORG_RULES" != "[]" ]; then
     printf '%s' "$ORG_RULES" > "$RULES_CACHE" 2>/dev/null || true
   elif [ -f "$RULES_CACHE" ]; then
@@ -4839,7 +4825,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.4.10")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.4.11")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);