@synkro-sh/cli 1.4.10 → 1.4.12

package/dist/bootstrap.js

@@ -132,7 +132,7 @@ function installCCHooks(settingsPath, config) {
       {
         type: "command",
         command: config.bashJudgeScriptPath,
-        timeout: 15
+        timeout: 30
       }
     ],
     [SYNKRO_MARKER]: true
@@ -709,8 +709,17 @@ ensure_fresh_jwt() {
 
 ensure_fresh_jwt
 
-# Resolve tier + capture_depth live from /cli/me every call. Default to local_only (fail-safe).
-ME_RESP=$(curl -sS "\${GATEWAY_URL}/api/v1/cli/me" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null || echo "")
+# Parallel fetch: /cli/me + rules in background, wait for both.
+_ME_TMP=$(mktemp -t synkro-me.XXXXXX)
+_RULES_TMP=$(mktemp -t synkro-rules.XXXXXX)
+trap "rm -f \\"$_ME_TMP\\" \\"$_RULES_TMP\\"" EXIT
+curl -sS "\${GATEWAY_URL}/api/v1/cli/me" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null > "$_ME_TMP" &
+_ME_PID=$!
+curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null > "$_RULES_TMP" &
+_RULES_PID=$!
+wait $_ME_PID 2>/dev/null; wait $_RULES_PID 2>/dev/null
+
+ME_RESP=$(cat "$_ME_TMP" 2>/dev/null || echo "")
 SYNKRO_INFERENCE_TIER=$(echo "$ME_RESP" | jq -r '.tier // empty' 2>/dev/null)
 SYNKRO_CAPTURE_DEPTH=$(echo "$ME_RESP" | jq -r '.capture_depth // empty' 2>/dev/null)
 SYNKRO_INFERENCE_TIER="\${SYNKRO_INFERENCE_TIER:-fast}"
@@ -721,32 +730,14 @@ if command -v claude >/dev/null 2>&1; then
   USE_LOCAL=true
 fi
 
-# Prefer local grading whenever it's available \u2014 the local-cc channel beats
-# the cloud fast tier on latency, and it's available regardless of the
-# server-assigned tier. Fall through to the cloud curl only when neither
-# the channel nor a usable \`claude\` CLI is reachable.
 if synkro_channel_up || { [ "$SYNKRO_INFERENCE_TIER" = "free" ] && command -v claude >/dev/null 2>&1; }; then
-  # \u2500\u2500\u2500 LOCAL PATH: channel-grader first, then \`claude --print\` cold fallback. \u2500\u2500\u2500
-
   RULES_CACHE="$HOME/.synkro/.rules-cache-bash"
-  ORG_RULES="[]"
-  if [ "$SYNKRO_CAPTURE_DEPTH" = "local_only" ]; then
-    ORG_RULES=$(curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules" \\
-      -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null \\
-      | jq -c '[.rules[]? | select(.hook_stage == "pre" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category}]' 2>/dev/null || echo "[]")
-    if [ -n "$ORG_RULES" ] && [ "$ORG_RULES" != "null" ] && [ "$ORG_RULES" != "[]" ]; then
-      printf '%s' "$ORG_RULES" > "$RULES_CACHE" 2>/dev/null || true
-    elif [ -f "$RULES_CACHE" ]; then
-      ORG_RULES=$(cat "$RULES_CACHE" 2>/dev/null || echo "[]")
-    fi
-  else
-    ORG_RULES=$(printf '%s' "$COMMAND" | head -c 4000 \\
-      | jq -Rs '{content: .}' \\
-      | curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules?top_k=15" \\
-      -X POST -H "Content-Type: application/json" \\
-      -H "Authorization: Bearer $JWT" \\
-      -d @- --max-time 2 2>/dev/null \\
-      | jq -c '[.rules[]? | select(.hook_stage == "pre" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category}]' 2>/dev/null || echo "[]")
+  RULES_JQ='[.rules[]? | select(.hook_stage == "pre" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category}]'
+  ORG_RULES=$(jq -c "$RULES_JQ" "$_RULES_TMP" 2>/dev/null || echo "[]")
+  if [ -n "$ORG_RULES" ] && [ "$ORG_RULES" != "null" ] && [ "$ORG_RULES" != "[]" ]; then
+    printf '%s' "$ORG_RULES" > "$RULES_CACHE" 2>/dev/null || true
+  elif [ -f "$RULES_CACHE" ]; then
+    ORG_RULES=$(cat "$RULES_CACHE" 2>/dev/null || echo "[]")
   fi
   if [ -z "$ORG_RULES" ] || [ "$ORG_RULES" = "null" ]; then ORG_RULES="[]"; fi
 
@@ -831,7 +822,9 @@ if [ "$VERDICT" != "__LOCAL_XML_PARSED__" ]; then
   ALTERNATIVE=$(echo "$VERDICT" | jq -r '.alternative // ""' 2>/dev/null)
   CATEGORY=$(echo "$VERDICT" | jq -r '.category // "destructive_command"' 2>/dev/null)
   RISK_LEVEL=$(echo "$VERDICT" | jq -r '.risk_level // empty' 2>/dev/null)
+  VIOLATED_RULES=$(echo "$VERDICT" | jq -c '.violated_rules // []' 2>/dev/null)
 fi
+VIOLATED_RULES="\${VIOLATED_RULES:-[]}"
 # Defaults if any var is empty (defensive \u2014 XML primer should always emit them).
 SEVERITY="\${SEVERITY:-audit}"
 VERDICT_KIND="\${VERDICT_KIND:-warn}"
@@ -951,6 +944,7 @@ if [ "$USE_LOCAL" = "true" ] && [ -n "$VERDICT_KIND" ]; then
       --arg reasoning "$REASONING" \\
       --arg alternative "$ALTERNATIVE" \\
       --argjson rules_checked "\${ORG_RULES:-[]}" \\
+      --argjson violated_rules "\${VIOLATED_RULES:-[]}" \\
       --argjson recent_user_messages "\${RECENT_USER_MESSAGES:-[]}" \\
       '{
         event_id: $event_id,
@@ -963,7 +957,8 @@ if [ "$USE_LOCAL" = "true" ] && [ -n "$VERDICT_KIND" ]; then
         model: $model,
         tool_name: $tool_name,
         capture_depth: $capture_depth,
-        rules_checked: $rules_checked
+        rules_checked: $rules_checked,
+        violated_rules: $violated_rules
       } + (if $repo != "" then {repo: $repo} else {} end)
         + (if $session_id != "" then {session_id: $session_id} else {} end)
         + (if $tool_use_id != "" then {tool_use_id: $tool_use_id} else {} end)
@@ -1217,34 +1212,30 @@ ensure_fresh_jwt() {
 ensure_fresh_jwt
 
 
-# Resolve tier + capture_depth live from /cli/me every call. Default to local_only (fail-safe).
-ME_RESP=$(curl -sS "\${GATEWAY_URL}/api/v1/cli/me" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null || echo "")
+# Parallel fetch: /cli/me + rules in background, wait for both.
+_ME_TMP=$(mktemp -t synkro-me.XXXXXX)
+_RULES_TMP=$(mktemp -t synkro-rules.XXXXXX)
+trap "rm -f \\"$_ME_TMP\\" \\"$_RULES_TMP\\"" EXIT
+curl -sS "\${GATEWAY_URL}/api/v1/cli/me" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null > "$_ME_TMP" &
+_ME_PID=$!
+curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null > "$_RULES_TMP" &
+_RULES_PID=$!
+wait $_ME_PID 2>/dev/null; wait $_RULES_PID 2>/dev/null
+
+ME_RESP=$(cat "$_ME_TMP" 2>/dev/null || echo "")
 SYNKRO_INFERENCE_TIER=$(echo "$ME_RESP" | jq -r '.tier // empty' 2>/dev/null)
 SYNKRO_CAPTURE_DEPTH=$(echo "$ME_RESP" | jq -r '.capture_depth // empty' 2>/dev/null)
 SYNKRO_INFERENCE_TIER="\${SYNKRO_INFERENCE_TIER:-fast}"
 SYNKRO_CAPTURE_DEPTH="\${SYNKRO_CAPTURE_DEPTH:-local_only}"
 
 if synkro_channel_up || { [ "$SYNKRO_INFERENCE_TIER" = "free" ] && command -v claude >/dev/null 2>&1; }; then
-  # \u2500\u2500\u2500 LOCAL PATH: channel-grader first, then \`claude --print\` cold fallback. \u2500\u2500\u2500
   RULES_CACHE="$HOME/.synkro/.rules-cache-edit"
-  ORG_RULES="[]"
-  if [ "$SYNKRO_CAPTURE_DEPTH" = "local_only" ]; then
-    ORG_RULES=$(curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules" \\
-      -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null \\
-      | jq -c '[.rules[]? | select(.hook_stage == "pre" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category, mode}]' 2>/dev/null || echo "[]")
-    if [ -n "$ORG_RULES" ] && [ "$ORG_RULES" != "null" ] && [ "$ORG_RULES" != "[]" ]; then
-      printf '%s' "$ORG_RULES" > "$RULES_CACHE" 2>/dev/null || true
-    elif [ -f "$RULES_CACHE" ]; then
-      ORG_RULES=$(cat "$RULES_CACHE" 2>/dev/null || echo "[]")
-    fi
-  else
-    ORG_RULES=$(printf '%s' "$PROPOSED" | head -c 8000 \\
-      | jq -Rs '{content: .}' \\
-      | curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules?top_k=20" \\
-      -X POST -H "Content-Type: application/json" \\
-      -H "Authorization: Bearer $JWT" \\
-      -d @- --max-time 2 2>/dev/null \\
-      | jq -c '[.rules[]? | select(.hook_stage == "pre" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category, mode}]' 2>/dev/null || echo "[]")
+  RULES_JQ='[.rules[]? | select(.hook_stage == "pre" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category, mode}]'
+  ORG_RULES=$(jq -c "$RULES_JQ" "$_RULES_TMP" 2>/dev/null || echo "[]")
+  if [ -n "$ORG_RULES" ] && [ "$ORG_RULES" != "null" ] && [ "$ORG_RULES" != "[]" ]; then
+    printf '%s' "$ORG_RULES" > "$RULES_CACHE" 2>/dev/null || true
+  elif [ -f "$RULES_CACHE" ]; then
+    ORG_RULES=$(cat "$RULES_CACHE" 2>/dev/null || echo "[]")
   fi
   if [ -z "$ORG_RULES" ] || [ "$ORG_RULES" = "null" ]; then ORG_RULES="[]"; fi
 
@@ -1256,15 +1247,20 @@ if synkro_channel_up || { [ "$SYNKRO_INFERENCE_TIER" = "free" ] && command -v cl
   printf 'Diff:\\n' >> "$GRADER_PROMPT_FILE"
   printf '%s\\n' "$PROPOSED" >> "$GRADER_PROMPT_FILE"
 
+  ROUTE_TAG=""
   if synkro_channel_up && [ -n "\${SYNKRO_CLI_BIN:-}" ] && [ -f "$SYNKRO_CLI_BIN" ] && command -v node >/dev/null 2>&1; then
+    ROUTE_TAG="local-cc"
     synkro_log "editGuard $FILE_SHORT \u2192 routing via local-cc"
     CC_RESP=$(node "$SYNKRO_CLI_BIN" grade edit < "$GRADER_PROMPT_FILE" 2>/dev/null || echo "")
   elif synkro_channel_up && command -v synkro >/dev/null 2>&1; then
+    ROUTE_TAG="local-cc"
     synkro_log "editGuard $FILE_SHORT \u2192 routing via local-cc (PATH)"
     CC_RESP=$(synkro grade edit < "$GRADER_PROMPT_FILE" 2>/dev/null || echo "")
   else
+    ROUTE_TAG="cc-print"
     CC_RESP=$(claude --print --model claude-sonnet-4-6 --no-session-persistence < "$GRADER_PROMPT_FILE" 2>/dev/null || echo "")
   fi
+  SYNKRO_PREFIX="[synkro:\${ROUTE_TAG:-cloud}]"
 
   # Wrapper extraction (greedy \u2014 tolerates nested XML tags).
   V_INNER=$(printf '%s' "$CC_RESP" | tr '\\n' ' ' | sed -nE 's|.*<synkro-verdict>(.*)</synkro-verdict>.*|\\1|p' | tail -1)
@@ -1363,6 +1359,7 @@ if synkro_channel_up || { [ "$SYNKRO_INFERENCE_TIER" = "free" ] && command -v cl
   fi
 else
   # \u2500\u2500\u2500 Server-side grading. \u2500\u2500\u2500
+  SYNKRO_PREFIX="[synkro:cloud]"
   RESP=$(curl -sS -X POST "\${GATEWAY_URL}/api/v1/precheck-edit" \\
     -H "Content-Type: application/json" \\
     -H "Authorization: Bearer $JWT" \\
@@ -1382,13 +1379,13 @@ fi
 
 if [ -z "$RESP" ]; then
   synkro_log "editGuard $FILE_SHORT \u2192 error (timeout)"
-  jq -n --arg m "[synkro] editGuard $FILE_SHORT \u2192 error (timeout)" '{systemMessage: $m}'
+  jq -n --arg m "$SYNKRO_PREFIX editGuard $FILE_SHORT \u2192 error (timeout)" '{systemMessage: $m}'
   exit 0
 fi
 
 if ! echo "$RESP" | jq -e 'type == "object"' >/dev/null 2>&1; then
   synkro_log "editGuard $FILE_SHORT \u2192 error (bad response)"
-  jq -n --arg m "[synkro] editGuard $FILE_SHORT \u2192 error (bad response)" '{systemMessage: $m}'
+  jq -n --arg m "$SYNKRO_PREFIX editGuard $FILE_SHORT \u2192 error (bad response)" '{systemMessage: $m}'
   exit 0
 fi
 
@@ -1401,10 +1398,10 @@ else
   VERDICT_REASON=$(echo "$RESP" | jq -r '.reason // empty' 2>/dev/null)
   if [ -n "$VERDICT_REASON" ]; then
     synkro_log "editGuard $FILE_SHORT \u2192 pass: $VERDICT_REASON"
-    RESP_WITH_MSG=$(echo "$RESP" | jq --arg m "[synkro] editGuard $FILE_SHORT \u2192 pass: $VERDICT_REASON" '. + {systemMessage: $m}')
+    RESP_WITH_MSG=$(echo "$RESP" | jq --arg m "$SYNKRO_PREFIX editGuard $FILE_SHORT \u2192 pass: $VERDICT_REASON" '. + {systemMessage: $m}')
   else
     synkro_log "editGuard $FILE_SHORT \u2192 pass"
-    RESP_WITH_MSG=$(echo "$RESP" | jq --arg m "[synkro] editGuard $FILE_SHORT \u2192 pass" '. + {systemMessage: $m}')
+    RESP_WITH_MSG=$(echo "$RESP" | jq --arg m "$SYNKRO_PREFIX editGuard $FILE_SHORT \u2192 pass" '. + {systemMessage: $m}')
   fi
   echo "$RESP_WITH_MSG"
 fi
@@ -1661,30 +1658,25 @@ if [ -n "$SESSION_ID" ] && [ -n "$TOOL_USE_ID" ]; then
   ) &
 fi
 
-# Resolve tier + capture_depth live from /cli/me every call. Default to local_only (fail-safe).
-ME_RESP=$(curl -sS "\${GATEWAY_URL}/api/v1/cli/me" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null || echo "")
+# Parallel fetch: /cli/me + rules in background, wait for both.
+_ME_TMP=$(mktemp -t synkro-me.XXXXXX)
+_RULES_TMP=$(mktemp -t synkro-rules.XXXXXX)
+trap "rm -f \\"$_ME_TMP\\" \\"$_RULES_TMP\\"" EXIT
+curl -sS "\${GATEWAY_URL}/api/v1/cli/me" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null > "$_ME_TMP" &
+_ME_PID=$!
+curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null > "$_RULES_TMP" &
+_RULES_PID=$!
+wait $_ME_PID 2>/dev/null; wait $_RULES_PID 2>/dev/null
+
+ME_RESP=$(cat "$_ME_TMP" 2>/dev/null || echo "")
 SYNKRO_INFERENCE_TIER=$(echo "$ME_RESP" | jq -r '.tier // empty' 2>/dev/null)
 SYNKRO_CAPTURE_DEPTH=$(echo "$ME_RESP" | jq -r '.capture_depth // empty' 2>/dev/null)
 SYNKRO_INFERENCE_TIER="\${SYNKRO_INFERENCE_TIER:-fast}"
 SYNKRO_CAPTURE_DEPTH="\${SYNKRO_CAPTURE_DEPTH:-local_only}"
 
 if synkro_channel_up || { [ "$SYNKRO_INFERENCE_TIER" = "free" ] && command -v claude >/dev/null 2>&1; }; then
-  # \u2500\u2500\u2500 LOCAL PATH: channel-grader first, then \`claude --print\` cold fallback. \u2500\u2500\u2500
-
   RULES_CACHE="$HOME/.synkro/.rules-cache-edit-capture"
-  RULES_RESP=""
-  if [ "$SYNKRO_CAPTURE_DEPTH" = "local_only" ]; then
-    RULES_RESP=$(curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules" \\
-      -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null || echo "")
-  else
-    RULES_RESP=$(printf '%s' "$FILE_CONTENT" | head -c 8000 \\
-      | jq -Rs '{content: .}' \\
-      | curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules?top_k=20" \\
-      -X POST -H "Content-Type: application/json" \\
-      -H "Authorization: Bearer $JWT" \\
-      -d @- --max-time 2 2>/dev/null || echo "")
-  fi
-  ORG_RULES=$(echo "$RULES_RESP" | jq -c '[.rules[]? | select(.hook_stage == "post" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category}]' 2>/dev/null || echo "[]")
+  ORG_RULES=$(jq -c '[.rules[]? | select(.hook_stage == "post" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category}]' "$_RULES_TMP" 2>/dev/null || echo "[]")
   if [ -n "$ORG_RULES" ] && [ "$ORG_RULES" != "null" ] && [ "$ORG_RULES" != "[]" ]; then
     printf '%s' "$ORG_RULES" > "$RULES_CACHE" 2>/dev/null || true
   elif [ -f "$RULES_CACHE" ]; then
@@ -1714,15 +1706,20 @@ if synkro_channel_up || { [ "$SYNKRO_INFERENCE_TIER" = "free" ] && command -v cl
   printf 'Content:\\n' >> "$GRADER_PROMPT_FILE"
   printf '%s\\n' "$FILE_CONTENT" >> "$GRADER_PROMPT_FILE"
 
+  ROUTE_TAG=""
   if synkro_channel_up && [ -n "\${SYNKRO_CLI_BIN:-}" ] && [ -f "$SYNKRO_CLI_BIN" ] && command -v node >/dev/null 2>&1; then
+    ROUTE_TAG="local-cc"
     synkro_log "editGuard $BASENAME \u2192 routing via local-cc"
     CC_RESP=$(node "$SYNKRO_CLI_BIN" grade edit < "$GRADER_PROMPT_FILE" 2>/dev/null || echo "")
   elif synkro_channel_up && command -v synkro >/dev/null 2>&1; then
+    ROUTE_TAG="local-cc"
     synkro_log "editGuard $BASENAME \u2192 routing via local-cc (PATH)"
     CC_RESP=$(synkro grade edit < "$GRADER_PROMPT_FILE" 2>/dev/null || echo "")
   else
+    ROUTE_TAG="cc-print"
     CC_RESP=$(claude --print --model claude-sonnet-4-6 --no-session-persistence < "$GRADER_PROMPT_FILE" 2>/dev/null || echo "")
   fi
+  SYNKRO_PREFIX="[synkro:\${ROUTE_TAG:-cloud}]"
 
   # Wait for CVE scan
   wait $CVE_PID 2>/dev/null
@@ -1779,6 +1776,7 @@ if synkro_channel_up || { [ "$SYNKRO_INFERENCE_TIER" = "free" ] && command -v cl
   fi
 else
   # \u2500\u2500\u2500 Server-side grading. \u2500\u2500\u2500
+  SYNKRO_PREFIX="[synkro:cloud]"
   RESP=$(curl -sS -X POST "\${GATEWAY_URL}/api/v1/judge-edit" \\
     -H "Content-Type: application/json" \\
     -H "Authorization: Bearer $JWT" \\
@@ -1798,7 +1796,7 @@ fi
 
 if [ -z "$RESP" ] || ! echo "$RESP" | jq -e 'type == "object"' >/dev/null 2>&1; then
   synkro_log "editScan $BASENAME \u2192 error (no response)"
-  jq -n --arg m "[synkro] editScan $BASENAME \u2192 error (no response)" '{systemMessage: $m}'
+  jq -n --arg m "$SYNKRO_PREFIX editScan $BASENAME \u2192 error (no response)" '{systemMessage: $m}'
   exit 0
 fi
 
@@ -1867,8 +1865,8 @@ fi
 
 if [ "$OK" = "false" ] && [ -n "$REASON" ]; then
   synkro_log "editScan $BASENAME \u2192 FAIL ($CATEGORY): $REASON"
-  SYS_MSG="[synkro] editScan $BASENAME \u2192 FAIL: \${REASON}"
-  ADDITIONAL_CTX="Synkro post-edit grader flagged \${BASENAME} (severity: \${SEVERITY}, category: \${CATEGORY}). Re-edit the file applying the retry guidance: \${REASON}"
+  SYS_MSG="$SYNKRO_PREFIX editScan $BASENAME \u2192 FAIL: \${REASON}"
+  ADDITIONAL_CTX="Synkro post-edit grader flagged \${BASENAME} (severity: \${SEVERITY}, category: \${CATEGORY}, route: \${ROUTE_TAG:-cloud}). Re-edit the file applying the retry guidance: \${REASON}"
   jq -n \\
     --arg sys_msg "$SYS_MSG" \\
     --arg ctx "$ADDITIONAL_CTX" \\
@@ -1884,10 +1882,10 @@ fi
 
 if [ -n "$REASON" ]; then
   synkro_log "editScan $BASENAME \u2192 pass ($CATEGORY): $REASON"
-  jq -n --arg m "[synkro] editScan $BASENAME \u2192 pass ($CATEGORY): $REASON" '{systemMessage: $m}'
+  jq -n --arg m "$SYNKRO_PREFIX editScan $BASENAME \u2192 pass ($CATEGORY): $REASON" '{systemMessage: $m}'
 else
   synkro_log "editScan $BASENAME \u2192 pass"
-  jq -n --arg m "[synkro] editScan $BASENAME \u2192 pass" '{systemMessage: $m}'
+  jq -n --arg m "$SYNKRO_PREFIX editScan $BASENAME \u2192 pass" '{systemMessage: $m}'
 fi
 exit 0
 `;
@@ -4839,7 +4837,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.4.10")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.4.12")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);