@synkro-sh/cli 1.4.6 → 1.4.8

package/dist/bootstrap.js

@@ -63,6 +63,18 @@ function detectAgents() {
       version: codexBinary ? getVersion("codex") : void 0
     });
   }
+  const cursorBinary = which("cursor");
+  const cursorConfigDir = join(home, ".cursor");
+  if (cursorBinary || existsSync(cursorConfigDir)) {
+    agents.push({
+      kind: "cursor",
+      name: "Cursor",
+      binaryPath: cursorBinary,
+      configDir: cursorConfigDir,
+      settingsPath: join(cursorConfigDir, "hooks.json"),
+      version: cursorBinary ? getVersion("cursor") : void 0
+    });
+  }
   return agents;
 }
 var init_agentDetect = __esm({
@@ -239,48 +251,156 @@ var init_ccHookConfig = __esm({
   }
 });
 
-// cli/installer/mcpConfig.ts
+// cli/installer/cursorHookConfig.ts
 import { existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2, renameSync as renameSync2, mkdirSync as mkdirSync2 } from "fs";
+import { dirname as dirname2 } from "path";
+function readHooksFile(path) {
+  if (!existsSync3(path)) return { version: 1, hooks: {} };
+  try {
+    const raw = readFileSync2(path, "utf-8");
+    return JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`Failed to parse ${path}: ${err.message}`);
+  }
+}
+function writeHooksFileAtomic(path, data) {
+  mkdirSync2(dirname2(path), { recursive: true });
+  const tmpPath = `${path}.synkro.tmp`;
+  writeFileSync2(tmpPath, JSON.stringify(data, null, 2) + "\n", "utf-8");
+  renameSync2(tmpPath, path);
+}
+function isSynkroEntry2(entry) {
+  if (entry?.[SYNKRO_MARKER2]) return true;
+  return typeof entry?.command === "string" && entry.command.includes("/.synkro/hooks/");
+}
+function removeSynkroEntries2(hooks, event) {
+  if (!hooks) return;
+  const arr = hooks[event];
+  if (!Array.isArray(arr)) return;
+  hooks[event] = arr.filter((entry) => !isSynkroEntry2(entry));
+}
+function installCursorHooks(hooksJsonPath, config) {
+  const file = readHooksFile(hooksJsonPath);
+  file.version = file.version ?? 1;
+  file.hooks = file.hooks ?? {};
+  const events = ["beforeShellExecution", "preToolUse", "afterFileEdit", "postToolUse"];
+  for (const evt of events) {
+    removeSynkroEntries2(file.hooks, evt);
+  }
+  file.hooks.beforeShellExecution = file.hooks.beforeShellExecution ?? [];
+  file.hooks.beforeShellExecution.push({
+    command: config.bashJudgeScriptPath,
+    timeout: 10,
+    failClosed: true,
+    [SYNKRO_MARKER2]: true
+  });
+  file.hooks.preToolUse = file.hooks.preToolUse ?? [];
+  file.hooks.preToolUse.push({
+    command: config.editPrecheckScriptPath,
+    timeout: 15,
+    [SYNKRO_MARKER2]: true
+  });
+  file.hooks.afterFileEdit = file.hooks.afterFileEdit ?? [];
+  file.hooks.afterFileEdit.push({
+    command: config.editCaptureScriptPath,
+    timeout: 15,
+    [SYNKRO_MARKER2]: true
+  });
+  file.hooks.postToolUse = file.hooks.postToolUse ?? [];
+  file.hooks.postToolUse.push({
+    command: config.bashFollowupScriptPath,
+    timeout: 10,
+    [SYNKRO_MARKER2]: true
+  });
+  writeHooksFileAtomic(hooksJsonPath, file);
+}
+function uninstallCursorHooks(hooksJsonPath) {
+  if (!existsSync3(hooksJsonPath)) return false;
+  const file = readHooksFile(hooksJsonPath);
+  if (!file.hooks) return false;
+  const events = ["beforeShellExecution", "preToolUse", "afterFileEdit", "postToolUse"];
+  for (const evt of events) {
+    removeSynkroEntries2(file.hooks, evt);
+  }
+  for (const evt of events) {
+    if (Array.isArray(file.hooks[evt]) && file.hooks[evt].length === 0) {
+      delete file.hooks[evt];
+    }
+  }
+  if (Object.keys(file.hooks).length === 0) {
+    delete file.hooks;
+  }
+  writeHooksFileAtomic(hooksJsonPath, file);
+  return true;
+}
+function inspectCursorHooks(hooksJsonPath) {
+  if (!existsSync3(hooksJsonPath)) {
+    return { installed: false, beforeShellExecution: false, preToolUse: false, afterFileEdit: false, postToolUse: false };
+  }
+  const file = readHooksFile(hooksJsonPath);
+  const h = file.hooks ?? {};
+  const beforeShellExecution = (h.beforeShellExecution ?? []).some((e) => isSynkroEntry2(e));
+  const preToolUse = (h.preToolUse ?? []).some((e) => isSynkroEntry2(e));
+  const afterFileEdit = (h.afterFileEdit ?? []).some((e) => isSynkroEntry2(e));
+  const postToolUse = (h.postToolUse ?? []).some((e) => isSynkroEntry2(e));
+  return {
+    installed: beforeShellExecution || preToolUse || afterFileEdit || postToolUse,
+    beforeShellExecution,
+    preToolUse,
+    afterFileEdit,
+    postToolUse
+  };
+}
+var SYNKRO_MARKER2;
+var init_cursorHookConfig = __esm({
+  "cli/installer/cursorHookConfig.ts"() {
+    "use strict";
+    SYNKRO_MARKER2 = "__synkro_managed__";
+  }
+});
+
+// cli/installer/mcpConfig.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync3, renameSync as renameSync3, mkdirSync as mkdirSync3 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join2 } from "path";
+import { dirname as dirname3, join as join2 } from "path";
 function readClaudeJson() {
-  if (!existsSync3(CC_CONFIG_PATH)) return {};
+  if (!existsSync4(CC_CONFIG_PATH)) return {};
   try {
-    const raw = readFileSync2(CC_CONFIG_PATH, "utf-8");
+    const raw = readFileSync3(CC_CONFIG_PATH, "utf-8");
     return JSON.parse(raw);
   } catch (err) {
     throw new Error(`Failed to parse ${CC_CONFIG_PATH}: ${err.message}`);
   }
 }
 function writeClaudeJsonAtomic(config) {
-  mkdirSync2(dirname2(CC_CONFIG_PATH), { recursive: true });
+  mkdirSync3(dirname3(CC_CONFIG_PATH), { recursive: true });
   const tmpPath = `${CC_CONFIG_PATH}.synkro.tmp`;
-  writeFileSync2(tmpPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
-  renameSync2(tmpPath, CC_CONFIG_PATH);
+  writeFileSync3(tmpPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  renameSync3(tmpPath, CC_CONFIG_PATH);
 }
 function installMcpConfig(opts) {
   const config = readClaudeJson();
   config.mcpServers = config.mcpServers ?? {};
   for (const [name, entry] of Object.entries(config.mcpServers)) {
-    if (entry?.[SYNKRO_MARKER2] === true) delete config.mcpServers[name];
+    if (entry?.[SYNKRO_MARKER3] === true) delete config.mcpServers[name];
   }
   const url = `${opts.gatewayUrl.replace(/\/$/, "")}/api/v1/mcp/guardrails`;
   config.mcpServers[SYNKRO_SERVER_NAME] = {
     type: "http",
     url,
     headers: { Authorization: `Bearer ${opts.bearerToken}` },
-    [SYNKRO_MARKER2]: true
+    [SYNKRO_MARKER3]: true
   };
   writeClaudeJsonAtomic(config);
   return { path: CC_CONFIG_PATH, url };
 }
 function uninstallMcpConfig() {
-  if (!existsSync3(CC_CONFIG_PATH)) return false;
+  if (!existsSync4(CC_CONFIG_PATH)) return false;
   const config = readClaudeJson();
   if (!config.mcpServers || Object.keys(config.mcpServers).length === 0) return false;
   let removed = false;
   for (const [name, entry] of Object.entries(config.mcpServers)) {
-    if (entry?.[SYNKRO_MARKER2] === true) {
+    if (entry?.[SYNKRO_MARKER3] === true) {
       delete config.mcpServers[name];
       removed = true;
     }
@@ -291,28 +411,28 @@ function uninstallMcpConfig() {
   return true;
 }
 function inspectMcpConfig() {
-  if (!existsSync3(CC_CONFIG_PATH)) {
+  if (!existsSync4(CC_CONFIG_PATH)) {
     return { installed: false, configPath: CC_CONFIG_PATH };
   }
   const config = readClaudeJson();
   const entry = config.mcpServers?.[SYNKRO_SERVER_NAME];
-  if (!entry || entry[SYNKRO_MARKER2] !== true) {
+  if (!entry || entry[SYNKRO_MARKER3] !== true) {
     return { installed: false, configPath: CC_CONFIG_PATH };
   }
   return { installed: true, configPath: CC_CONFIG_PATH, url: entry.url };
 }
-var SYNKRO_MARKER2, SYNKRO_SERVER_NAME, CC_CONFIG_PATH;
+var SYNKRO_MARKER3, SYNKRO_SERVER_NAME, CC_CONFIG_PATH;
 var init_mcpConfig = __esm({
   "cli/installer/mcpConfig.ts"() {
     "use strict";
-    SYNKRO_MARKER2 = "__synkro_managed__";
+    SYNKRO_MARKER3 = "__synkro_managed__";
     SYNKRO_SERVER_NAME = "synkro-guardrails";
     CC_CONFIG_PATH = join2(homedir2(), ".claude.json");
   }
 });
 
 // cli/installer/hookScripts.ts
-var CC_BASH_JUDGE_SCRIPT, CC_EDIT_PRECHECK_SCRIPT, CC_EDIT_CAPTURE_SCRIPT, CC_STOP_SUMMARY_SCRIPT, CC_SESSION_START_SCRIPT, CC_BASH_FOLLOWUP_SCRIPT, CC_TRANSCRIPT_SYNC_SCRIPT;
+var CC_BASH_JUDGE_SCRIPT, CC_EDIT_PRECHECK_SCRIPT, CC_EDIT_CAPTURE_SCRIPT, CC_STOP_SUMMARY_SCRIPT, CC_SESSION_START_SCRIPT, CC_BASH_FOLLOWUP_SCRIPT, CC_TRANSCRIPT_SYNC_SCRIPT, SYNKRO_COMMON_SCRIPT, CURSOR_BASH_JUDGE_SCRIPT, CURSOR_EDIT_PRECHECK_SCRIPT, CURSOR_EDIT_CAPTURE_SCRIPT, CURSOR_BASH_FOLLOWUP_SCRIPT;
 var init_hookScripts = __esm({
   "cli/installer/hookScripts.ts"() {
     "use strict";
@@ -1647,8 +1767,10 @@ if synkro_channel_up || { [ "$SYNKRO_INFERENCE_TIER" = "free" ] && command -v cl
   # Wait for CVE scan
   wait $CVE_PID 2>/dev/null
   CVE_TEXT=""
+  CVE_FINDINGS_JSON="[]"
   if [ -s "$CVE_RESULT_FILE" ]; then
     CVE_TEXT=$(jq -r '.summary // empty' "$CVE_RESULT_FILE" 2>/dev/null || echo "")
+    CVE_FINDINGS_JSON=$(jq -c '[.findings[]? | {package: .package, version: .version, cve: .id, severity: .severity, score: .score}]' "$CVE_RESULT_FILE" 2>/dev/null || echo "[]")
   fi
 
   # Wrapper extraction (greedy \u2014 tolerates nested XML tags).
@@ -1766,6 +1888,7 @@ if [ "$SYNKRO_CAPTURE_DEPTH" = "local_only" ]; then
       --arg session_id "$SESSION_ID" \\
       --arg mech_cat "$MECH_CAT" \\
       --arg biz_cat "$BIZ_CAT" \\
+      --argjson cve_findings "\${CVE_FINDINGS_JSON:-[]}" \\
       '{
         event_id: $event_id, timestamp: $timestamp, hook_type: $hook_type,
         verdict: $verdict, severity: $severity, risk_level: $risk_level,
@@ -1773,7 +1896,8 @@ if [ "$SYNKRO_CAPTURE_DEPTH" = "local_only" ]; then
       } + (if $repo != "" then {repo: $repo} else {} end)
         + (if $session_id != "" then {session_id: $session_id} else {} end)
         + (if $mech_cat != "" then {mechanism_category: $mech_cat} else {} end)
-        + (if $biz_cat != "" then {business_category: $biz_cat} else {} end)')
+        + (if $biz_cat != "" then {business_category: $biz_cat} else {} end)
+        + (if ($cve_findings | length) > 0 then {cve_findings: $cve_findings} else {} end)')
     curl -sS -X POST "\${GATEWAY_URL}/api/v1/events/local-verdict" \\
       -H "Content-Type: application/json" \\
       -H "Authorization: Bearer $JWT" \\
@@ -2182,6 +2306,386 @@ disown 2>/dev/null || true
 # Update offset
 printf '%s' "$TOTAL_LINES" > "$OFFSET_FILE" 2>/dev/null || true
 
+echo '{}'
+exit 0
+`;
+    SYNKRO_COMMON_SCRIPT = `#!/bin/bash
+# Shared Synkro hook utilities \u2014 sourced by IDE-specific adapter scripts.
+# Provides: auth, JWT refresh, config loading, API helpers, git detection.
+
+synkro_log() { echo "[synkro] $1" >&2; }
+
+synkro_channel_up() {
+  (exec 3<>/dev/tcp/127.0.0.1/\${SYNKRO_CHANNEL_PORT:-8929}) 2>/dev/null && exec 3<&- 3>&-
+}
+
+# Load config
+_SYNKRO_CONFIG="$HOME/.synkro/config.env"
+if [ -f "$_SYNKRO_CONFIG" ]; then
+  set -a
+  # shellcheck disable=SC1090
+  . "$_SYNKRO_CONFIG"
+  set +a
+fi
+
+GATEWAY_URL="\${SYNKRO_GATEWAY_URL:-https://api.synkro.sh}"
+CREDS_PATH="\${SYNKRO_CREDENTIALS_PATH:-$HOME/.synkro/credentials.json}"
+
+synkro_load_jwt() {
+  if [ ! -f "$CREDS_PATH" ]; then
+    echo ""
+    return 1
+  fi
+  jq -r '.access_token // empty' "$CREDS_PATH" 2>/dev/null
+}
+
+synkro_refresh_jwt() {
+  local refresh_token
+  refresh_token=$(jq -r '.refresh_token // empty' "$CREDS_PATH" 2>/dev/null)
+  if [ -z "$refresh_token" ]; then return 1; fi
+  local refresh_body
+  refresh_body=$(jq -n --arg rt "$refresh_token" '{refresh_token:$rt}')
+  local refresh_resp
+  refresh_resp=$(curl -sS -X POST "\${GATEWAY_URL}/api/auth/refresh" \\
+    -H "Content-Type: application/json" \\
+    -d "$refresh_body" \\
+    --max-time 4 2>/dev/null)
+  local new_access
+  new_access=$(echo "$refresh_resp" | jq -r '.access_token // empty' 2>/dev/null)
+  if [ -z "$new_access" ]; then return 1; fi
+  local new_refresh
+  new_refresh=$(echo "$refresh_resp" | jq -r '.refresh_token // empty' 2>/dev/null)
+  if [ -z "$new_refresh" ]; then new_refresh="$refresh_token"; fi
+  local tmp="\${CREDS_PATH}.synkro.tmp"
+  jq --arg at "$new_access" --arg rt "$new_refresh" \\
+    '. + {access_token: $at, refresh_token: $rt}' \\
+    "$CREDS_PATH" > "$tmp" 2>/dev/null && mv "$tmp" "$CREDS_PATH"
+  JWT="$new_access"
+  return 0
+}
+
+synkro_ensure_fresh_jwt() {
+  [ -z "$JWT" ] && return 1
+  local payload exp now remaining
+  payload=$(printf '%s' "$JWT" | cut -d. -f2)
+  case $((\${#payload} % 4)) in
+    2) payload="\${payload}==" ;;
+    3) payload="\${payload}=" ;;
+  esac
+  exp=$(printf '%s' "$payload" | tr '_-' '/+' | base64 -D 2>/dev/null | jq -r '.exp // 0' 2>/dev/null)
+  now=$(date -u +%s)
+  remaining=$((exp - now))
+  if [ "$remaining" -lt 60 ]; then
+    synkro_refresh_jwt
+  fi
+}
+
+synkro_detect_repo() {
+  local cwd="\${1:-.}"
+  if command -v git >/dev/null 2>&1; then
+    local remote
+    remote=$(git -C "$cwd" remote get-url origin 2>/dev/null || true)
+    if [ -n "$remote" ]; then
+      echo "$remote" | sed -E 's|^git@[^:]+:||; s|^https?://[^/]+/||; s|\\.git$||'
+      return
+    fi
+  fi
+  echo ""
+}
+`;
+    CURSOR_BASH_JUDGE_SCRIPT = `#!/bin/bash
+# Synkro beforeShellExecution hook for Cursor.
+# Reads Cursor's stdin payload, judges via Synkro gateway, returns Cursor-format verdict.
+
+SCRIPT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck disable=SC1091
+. "$SCRIPT_DIR/_synkro-common.sh"
+
+JWT=$(synkro_load_jwt)
+if [ -z "$JWT" ]; then echo '{}'; exit 0; fi
+synkro_ensure_fresh_jwt
+
+PAYLOAD=$(cat)
+if [ -z "$PAYLOAD" ]; then echo '{}'; exit 0; fi
+
+COMMAND=$(echo "$PAYLOAD" | jq -r '.command // empty' 2>/dev/null)
+if [ -z "$COMMAND" ]; then echo '{}'; exit 0; fi
+
+CWD=$(echo "$PAYLOAD" | jq -r '.cwd // empty' 2>/dev/null)
+SESSION_ID=$(echo "$PAYLOAD" | jq -r '.conversation_id // empty' 2>/dev/null)
+GIT_REPO=$(synkro_detect_repo "\${CWD:-.}")
+
+CMD_SHORT=$(printf '%s' "$COMMAND" | head -c 80)
+synkro_log "bashGuard checking: $CMD_SHORT"
+
+TOOL_INPUT=$(jq -n --arg cmd "$COMMAND" '{command: $cmd}')
+
+BODY=$(jq -n \\
+  --argjson tool_input "$TOOL_INPUT" \\
+  --arg session_id "$SESSION_ID" \\
+  --arg cwd "$CWD" \\
+  --arg repo "$GIT_REPO" \\
+  '{
+    kind: "bash_judge",
+    tool_input: $tool_input,
+    user_intent: null,
+    recent_user_messages: [],
+    recent_messages: [],
+    recent_actions: [],
+    session_id: (if ($session_id | length) > 0 then $session_id else null end),
+    cwd: (if ($cwd | length) > 0 then $cwd else null end),
+    repo: (if ($repo | length) > 0 then $repo else null end),
+    ide: "cursor"
+  }')
+
+VERDICT=$(curl -sS -X POST "\${GATEWAY_URL}/api/v1/judge" \\
+  -H "Content-Type: application/json" \\
+  -H "Authorization: Bearer $JWT" \\
+  -d "$BODY" \\
+  --max-time 6 2>/dev/null || echo "")
+
+if echo "$VERDICT" | grep -qE '"detail":"Token has expired|"detail":"Invalid or expired token'; then
+  if synkro_refresh_jwt; then
+    VERDICT=$(curl -sS -X POST "\${GATEWAY_URL}/api/v1/judge" \\
+      -H "Content-Type: application/json" \\
+      -H "Authorization: Bearer $JWT" \\
+      -d "$BODY" \\
+      --max-time 6 2>/dev/null || echo "")
+  fi
+fi
+
+if [ -z "$VERDICT" ]; then
+  synkro_log "bashGuard $CMD_SHORT \u2192 error (timeout)"
+  echo '{}'
+  exit 0
+fi
+
+SEVERITY=$(echo "$VERDICT" | jq -r '.severity // "audit"' 2>/dev/null)
+REASONING=$(echo "$VERDICT" | jq -r '.reasoning // ""' 2>/dev/null)
+ALTERNATIVE=$(echo "$VERDICT" | jq -r '.alternative // ""' 2>/dev/null)
+CATEGORY=$(echo "$VERDICT" | jq -r '.category // ""' 2>/dev/null)
+VERDICT_KIND=$(echo "$VERDICT" | jq -r '.verdict // "warn"' 2>/dev/null)
+
+case "$SEVERITY" in
+  block|audit) ;;
+  low|medium|high|critical)
+    if [ "$VERDICT_KIND" = "allow" ]; then SEVERITY="audit"; else SEVERITY="block"; fi
+    ;;
+  *)
+    if [ "$VERDICT_KIND" = "allow" ]; then SEVERITY="audit"; else SEVERITY="block"; fi
+    ;;
+esac
+
+ALT_SUFFIX=""
+if [ -n "$ALTERNATIVE" ] && [ "$ALTERNATIVE" != "null" ]; then
+  ALT_SUFFIX=" Suggested: \${ALTERNATIVE}"
+fi
+
+case "$SEVERITY" in
+  block)
+    synkro_log "bashGuard $CMD_SHORT \u2192 BLOCK: $REASONING"
+    jq -n \\
+      --arg user "Synkro safety judge blocked this command: \${REASONING}\${ALT_SUFFIX}" \\
+      --arg agent "Synkro safety judge (severity: \${SEVERITY}, category: \${CATEGORY}). Reasoning: \${REASONING}.\${ALT_SUFFIX}" \\
+      '{permission: "deny", user_message: $user, agent_message: $agent}'
+    ;;
+  audit)
+    synkro_log "bashGuard $CMD_SHORT \u2192 pass (\${CATEGORY})"
+    echo '{}'
+    ;;
+  *)
+    synkro_log "bashGuard $CMD_SHORT \u2192 BLOCK (unexpected severity)"
+    jq -n \\
+      --arg user "Synkro safety judge blocked this command (unexpected severity)." \\
+      '{permission: "deny", user_message: $user}'
+    ;;
+esac
+`;
+    CURSOR_EDIT_PRECHECK_SCRIPT = `#!/bin/bash
+# Synkro preToolUse hook for Cursor \u2014 pre-check edits against org rules.
+# Only acts on edit-like tool names; passes through everything else.
+
+SCRIPT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck disable=SC1091
+. "$SCRIPT_DIR/_synkro-common.sh"
+
+JWT=$(synkro_load_jwt)
+if [ -z "$JWT" ]; then echo '{}'; exit 0; fi
+synkro_ensure_fresh_jwt
+
+PAYLOAD=$(cat)
+if [ -z "$PAYLOAD" ]; then echo '{}'; exit 0; fi
+
+TOOL_NAME=$(echo "$PAYLOAD" | jq -r '.tool_name // empty' 2>/dev/null)
+
+CWD=$(echo "$PAYLOAD" | jq -r '.cwd // empty' 2>/dev/null)
+SESSION_ID=$(echo "$PAYLOAD" | jq -r '.conversation_id // empty' 2>/dev/null)
+GIT_REPO=$(synkro_detect_repo "\${CWD:-.}")
+
+FILE_PATH=$(echo "$PAYLOAD" | jq -r '.tool_input.file_path // .tool_input.path // .tool_input.target_file // empty' 2>/dev/null)
+CONTENT=$(echo "$PAYLOAD" | jq -r '.tool_input.content // .tool_input.new_string // .tool_input.code_edit // empty' 2>/dev/null)
+
+# Skip non-edit tools \u2014 if there's no file path in tool_input, this isn't a file edit
+if [ -z "$FILE_PATH" ]; then echo '{}'; exit 0; fi
+if [ -z "$FILE_PATH" ]; then echo '{}'; exit 0; fi
+
+BASENAME=$(basename "$FILE_PATH" 2>/dev/null || echo "$FILE_PATH")
+synkro_log "editGuard checking: $BASENAME"
+
+BODY=$(jq -n \\
+  --arg file_path "$FILE_PATH" \\
+  --arg content "$CONTENT" \\
+  --arg session_id "$SESSION_ID" \\
+  --arg cwd "$CWD" \\
+  --arg repo "$GIT_REPO" \\
+  '{
+    file_path: $file_path,
+    content: $content,
+    session_id: (if ($session_id | length) > 0 then $session_id else null end),
+    cwd: (if ($cwd | length) > 0 then $cwd else null end),
+    repo: (if ($repo | length) > 0 then $repo else null end),
+    ide: "cursor"
+  }')
+
+RESP=$(curl -sS -X POST "\${GATEWAY_URL}/api/v1/precheck-edit" \\
+  -H "Content-Type: application/json" \\
+  -H "Authorization: Bearer $JWT" \\
+  -d "$BODY" \\
+  --max-time 8 2>/dev/null || echo "")
+
+if [ -z "$RESP" ]; then
+  synkro_log "editGuard $BASENAME \u2192 error (timeout)"
+  echo '{}'
+  exit 0
+fi
+
+DECISION=$(echo "$RESP" | jq -r '.hookSpecificOutput.permissionDecision // "allow"' 2>/dev/null)
+case "$DECISION" in
+  deny|ask)
+    REASON=$(echo "$RESP" | jq -r '.hookSpecificOutput.permissionDecisionReason // "Blocked by Synkro"' 2>/dev/null)
+    synkro_log "editGuard $BASENAME \u2192 BLOCK: $REASON"
+    jq -n --arg user "$REASON" --arg agent "$REASON" \\
+      '{permission: "deny", user_message: $user, agent_message: $agent}'
+    ;;
+  *)
+    synkro_log "editGuard $BASENAME \u2192 pass"
+    echo '{}'
+    ;;
+esac
+`;
+    CURSOR_EDIT_CAPTURE_SCRIPT = `#!/bin/bash
+# Synkro afterFileEdit hook for Cursor \u2014 fire-and-forget telemetry + CVE scan.
+# Cannot block (Cursor afterFileEdit is observational only).
+
+SCRIPT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck disable=SC1091
+. "$SCRIPT_DIR/_synkro-common.sh"
+
+JWT=$(synkro_load_jwt)
+if [ -z "$JWT" ]; then echo '{}'; exit 0; fi
+
+PAYLOAD=$(cat)
+if [ -z "$PAYLOAD" ]; then echo '{}'; exit 0; fi
+
+FILE_PATH=$(echo "$PAYLOAD" | jq -r '.file_path // empty' 2>/dev/null)
+if [ -z "$FILE_PATH" ]; then echo '{}'; exit 0; fi
+
+CWD=$(echo "$PAYLOAD" | jq -r '.cwd // .workspace_roots[0] // empty' 2>/dev/null)
+SESSION_ID=$(echo "$PAYLOAD" | jq -r '.conversation_id // empty' 2>/dev/null)
+GIT_REPO=$(synkro_detect_repo "\${CWD:-.}")
+BASENAME=$(basename "$FILE_PATH" 2>/dev/null || echo "$FILE_PATH")
+
+# Read full file content for edit scan
+FULL_CONTENT=""
+FULL_PATH=""
+if [ -n "$CWD" ]; then
+  FULL_PATH="$CWD/$FILE_PATH"
+else
+  FULL_PATH="$FILE_PATH"
+fi
+if [ -f "$FULL_PATH" ]; then
+  FULL_CONTENT=$(head -c 50000 "$FULL_PATH" 2>/dev/null || true)
+fi
+
+# Extract deps from nearest package.json
+DEPS_JSON="{}"
+_PKG_DIR="\${CWD:-.}"
+while [ "$_PKG_DIR" != "/" ]; do
+  if [ -f "$_PKG_DIR/package.json" ]; then
+    DEPS_JSON=$(jq -c '(.dependencies // {}) + (.devDependencies // {})' "$_PKG_DIR/package.json" 2>/dev/null || echo "{}")
+    break
+  fi
+  _PKG_DIR=$(dirname "$_PKG_DIR")
+done
+
+synkro_log "editScan $BASENAME"
+
+# Fire-and-forget: edit scan + CVE scan in background
+(
+  BODY=$(jq -n \\
+    --arg file_path "$FILE_PATH" \\
+    --arg content "$FULL_CONTENT" \\
+    --arg session_id "$SESSION_ID" \\
+    --arg cwd "$CWD" \\
+    --arg repo "$GIT_REPO" \\
+    --argjson deps "$DEPS_JSON" \\
+    '{
+      file_path: $file_path,
+      content: $content,
+      dependencies: $deps,
+      session_id: (if ($session_id | length) > 0 then $session_id else null end),
+      cwd: (if ($cwd | length) > 0 then $cwd else null end),
+      repo: (if ($repo | length) > 0 then $repo else null end),
+      ide: "cursor"
+    }')
+
+  curl -sS -X POST "\${GATEWAY_URL}/api/v1/events/edit-scan" \\
+    -H "Content-Type: application/json" \\
+    -H "Authorization: Bearer $JWT" \\
+    -d "$BODY" \\
+    --max-time 10 >/dev/null 2>&1 || true
+) &
+disown 2>/dev/null || true
+
+echo '{}'
+exit 0
+`;
+    CURSOR_BASH_FOLLOWUP_SCRIPT = `#!/bin/bash
+# Synkro postToolUse hook for Cursor \u2014 fire-and-forget follow-up telemetry.
+# Marks bash judgments as "allowed" after successful execution.
+
+SCRIPT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck disable=SC1091
+. "$SCRIPT_DIR/_synkro-common.sh"
+
+JWT=$(synkro_load_jwt)
+if [ -z "$JWT" ]; then echo '{}'; exit 0; fi
+
+PAYLOAD=$(cat)
+if [ -z "$PAYLOAD" ]; then echo '{}'; exit 0; fi
+
+TOOL_NAME=$(echo "$PAYLOAD" | jq -r '.tool_name // empty' 2>/dev/null)
+case "$TOOL_NAME" in
+  Shell|Bash|terminal|run_terminal_cmd|execute_command) ;;
+  *) echo '{}'; exit 0 ;;
+esac
+
+SESSION_ID=$(echo "$PAYLOAD" | jq -r '.conversation_id // empty' 2>/dev/null)
+TOOL_USE_ID=$(echo "$PAYLOAD" | jq -r '.tool_use_id // empty' 2>/dev/null)
+
+if [ -n "$SESSION_ID" ] && [ -n "$TOOL_USE_ID" ]; then
+  (
+    BODY=$(jq -n --arg sid "$SESSION_ID" --arg tid "$TOOL_USE_ID" \\
+      '{session_id: $sid, tool_use_id: $tid, decision: "allow"}')
+    curl -sS -X POST "\${GATEWAY_URL}/api/v1/events/bash-followup" \\
+      -H "Content-Type: application/json" \\
+      -H "Authorization: Bearer $JWT" \\
+      -d "$BODY" \\
+      --max-time 3 >/dev/null 2>&1 || true
+  ) &
+  disown 2>/dev/null || true
+fi
+
 echo '{}'
 exit 0
 `;
@@ -2190,9 +2694,9 @@ exit 0
 
 // cli/auth/stub.ts
 import { createServer } from "http";
-import { writeFileSync as writeFileSync3, readFileSync as readFileSync3, existsSync as existsSync4, mkdirSync as mkdirSync3, unlinkSync as unlinkSync2 } from "fs";
+import { writeFileSync as writeFileSync4, readFileSync as readFileSync4, existsSync as existsSync5, mkdirSync as mkdirSync4, unlinkSync as unlinkSync2 } from "fs";
 import { homedir as homedir3, platform } from "os";
-import { join as join3, dirname as dirname3 } from "path";
+import { join as join3, dirname as dirname4 } from "path";
 import { execFile } from "child_process";
 import jwt from "jsonwebtoken";
 function openBrowser(url) {
@@ -2220,18 +2724,18 @@ function openBrowser(url) {
   });
 }
 function saveCredentials(data) {
-  const dir = dirname3(AUTH_FILE);
-  if (!existsSync4(dir)) {
-    mkdirSync3(dir, { recursive: true, mode: 448 });
+  const dir = dirname4(AUTH_FILE);
+  if (!existsSync5(dir)) {
+    mkdirSync4(dir, { recursive: true, mode: 448 });
   }
-  writeFileSync3(AUTH_FILE, JSON.stringify(data, null, 2), { mode: 384 });
+  writeFileSync4(AUTH_FILE, JSON.stringify(data, null, 2), { mode: 384 });
 }
 function loadCredentials() {
-  if (!existsSync4(AUTH_FILE)) {
+  if (!existsSync5(AUTH_FILE)) {
     return null;
   }
   try {
-    const content = readFileSync3(AUTH_FILE, "utf8");
+    const content = readFileSync4(AUTH_FILE, "utf8");
     return JSON.parse(content);
   } catch (error) {
     return null;
@@ -2475,7 +2979,7 @@ async function ensureValidToken() {
   return true;
 }
 function clearCredentials() {
-  if (existsSync4(AUTH_FILE)) {
+  if (existsSync5(AUTH_FILE)) {
     unlinkSync2(AUTH_FILE);
   }
 }
@@ -2649,7 +3153,7 @@ jobs:
 });
 
 // cli/installer/githubSetup.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "fs";
 import { execSync as execSync2 } from "child_process";
 import { join as join4 } from "path";
 function ghSecretSet(token, owner, repo, name, value) {
@@ -2698,15 +3202,15 @@ async function pushSecretsToRepo(opts, owner, repo, secrets) {
 }
 function writeWorkflowFile(repoRootPath) {
   const workflowDir = join4(repoRootPath, ".github", "workflows");
-  mkdirSync4(workflowDir, { recursive: true });
+  mkdirSync5(workflowDir, { recursive: true });
   const workflowFile = join4(workflowDir, "synkro.yml");
-  writeFileSync4(workflowFile, SYNKRO_WORKFLOW_YAML, "utf-8");
+  writeFileSync5(workflowFile, SYNKRO_WORKFLOW_YAML, "utf-8");
   return workflowFile;
 }
 function findGitRoot(startCwd) {
   let cur = startCwd;
   while (cur && cur !== "/") {
-    if (existsSync5(join4(cur, ".git"))) return cur;
+    if (existsSync6(join4(cur, ".git"))) return cur;
     const parent = join4(cur, "..");
     if (parent === cur) break;
     cur = parent;
@@ -2949,14 +3453,14 @@ __export(setupGithub_exports, {
 import { createInterface as createInterface2 } from "readline/promises";
 import { stdin as input, stdout as output } from "process";
 import { execSync as execSync4, spawn as nodeSpawn } from "child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync4, unlinkSync as unlinkSync3 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync5, unlinkSync as unlinkSync3 } from "fs";
 import { homedir as homedir4, platform as platform2 } from "os";
 import { join as join5 } from "path";
 import { execFile as execFile2 } from "child_process";
 function readConfig() {
-  if (!existsSync6(CONFIG_PATH)) return {};
+  if (!existsSync7(CONFIG_PATH)) return {};
   const out = {};
-  for (const line of readFileSync4(CONFIG_PATH, "utf-8").split("\n")) {
+  for (const line of readFileSync5(CONFIG_PATH, "utf-8").split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#")) continue;
     const eq = t.indexOf("=");
@@ -3026,7 +3530,7 @@ function captureClaudeSetupToken() {
     proc.on("close", (code) => {
       let raw = "";
       try {
-        raw = readFileSync4(tmpFile, "utf-8");
+        raw = readFileSync5(tmpFile, "utf-8");
       } catch (e) {
         reject(new Error(`Could not read script output file: ${e.message}`));
         return;
@@ -3304,20 +3808,20 @@ var init_setupGithub = __esm({
 });
 
 // cli/installer/promptFetcher.ts
-import { existsSync as existsSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync5, mkdirSync as mkdirSync5 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6 } from "fs";
 import { homedir as homedir5 } from "os";
 import { join as join6 } from "path";
 function readCache() {
-  if (!existsSync7(CACHE_PATH)) return null;
+  if (!existsSync8(CACHE_PATH)) return null;
   try {
-    return JSON.parse(readFileSync5(CACHE_PATH, "utf-8"));
+    return JSON.parse(readFileSync6(CACHE_PATH, "utf-8"));
   } catch {
     return null;
   }
 }
 function writeCache(entry) {
-  mkdirSync5(join6(homedir5(), ".synkro", "prompts"), { recursive: true });
-  writeFileSync5(CACHE_PATH, JSON.stringify(entry, null, 2), "utf-8");
+  mkdirSync6(join6(homedir5(), ".synkro", "prompts"), { recursive: true });
+  writeFileSync6(CACHE_PATH, JSON.stringify(entry, null, 2), "utf-8");
 }
 function isCacheFresh(cache) {
   const ageMs = Date.now() - cache.fetched_at;
@@ -3371,13 +3875,13 @@ var init_promptFetcher = __esm({
 });
 
 // cli/local-cc/settings.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
 import { homedir as homedir6 } from "os";
 import { join as join7 } from "path";
 function isLocalCCEnabled() {
-  if (!existsSync8(CONFIG_PATH2)) return false;
+  if (!existsSync9(CONFIG_PATH2)) return false;
   try {
-    const content = readFileSync6(CONFIG_PATH2, "utf-8");
+    const content = readFileSync7(CONFIG_PATH2, "utf-8");
     const match = content.match(/^SYNKRO_LOCAL_INFERENCE='([^']*)'/m);
     return match?.[1] === "yes";
   } catch {
@@ -3542,17 +4046,17 @@ await mcp.connect(new StdioServerTransport());
 });
 
 // cli/local-cc/install.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, readFileSync as readFileSync7, chmodSync, copyFileSync, renameSync as renameSync3, unlinkSync as unlinkSync4, openSync, fsyncSync, closeSync } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync7, writeFileSync as writeFileSync7, readFileSync as readFileSync8, chmodSync, copyFileSync, renameSync as renameSync4, unlinkSync as unlinkSync4, openSync, fsyncSync, closeSync } from "fs";
 import { join as join8 } from "path";
 import { homedir as homedir7 } from "os";
 import { spawnSync } from "child_process";
 function writePluginFiles() {
-  mkdirSync6(SESSION_DIR, { recursive: true });
-  mkdirSync6(PLUGIN_SETTINGS_DIR, { recursive: true });
-  writeFileSync6(PLUGIN_PATH, CHANNEL_PLUGIN_SOURCE, "utf-8");
+  mkdirSync7(SESSION_DIR, { recursive: true });
+  mkdirSync7(PLUGIN_SETTINGS_DIR, { recursive: true });
+  writeFileSync7(PLUGIN_PATH, CHANNEL_PLUGIN_SOURCE, "utf-8");
   chmodSync(PLUGIN_PATH, 493);
-  writeFileSync6(PLUGIN_PKG_PATH, PLUGIN_PACKAGE_JSON, "utf-8");
-  writeFileSync6(
+  writeFileSync7(PLUGIN_PKG_PATH, PLUGIN_PACKAGE_JSON, "utf-8");
+  writeFileSync7(
     PLUGIN_SETTINGS_PATH,
     JSON.stringify({
       fastMode: true,
@@ -3564,7 +4068,7 @@ function writePluginFiles() {
     }, null, 2) + "\n",
     "utf-8"
   );
-  writeFileSync6(RUN_SCRIPT_PATH, RUN_SCRIPT_SOURCE, "utf-8");
+  writeFileSync7(RUN_SCRIPT_PATH, RUN_SCRIPT_SOURCE, "utf-8");
   chmodSync(RUN_SCRIPT_PATH, 493);
 }
 function runBunInstall() {
@@ -3580,10 +4084,10 @@ function runBunInstall() {
   }
 }
 function safelyMutateClaudeJson(mutator) {
-  if (!existsSync9(CLAUDE_JSON_PATH)) {
+  if (!existsSync10(CLAUDE_JSON_PATH)) {
     return;
   }
-  const originalText = readFileSync7(CLAUDE_JSON_PATH, "utf-8");
+  const originalText = readFileSync8(CLAUDE_JSON_PATH, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(originalText);
@@ -3615,14 +4119,14 @@ function safelyMutateClaudeJson(mutator) {
   copyFileSync(CLAUDE_JSON_PATH, CLAUDE_JSON_BACKUP_PATH);
   const tmpPath = `${CLAUDE_JSON_PATH}.synkro-tmp.${process.pid}`;
   try {
-    writeFileSync6(tmpPath, newText, "utf-8");
+    writeFileSync7(tmpPath, newText, "utf-8");
     const fd = openSync(tmpPath, "r");
     try {
       fsyncSync(fd);
     } finally {
       closeSync(fd);
     }
-    renameSync3(tmpPath, CLAUDE_JSON_PATH);
+    renameSync4(tmpPath, CLAUDE_JSON_PATH);
   } catch (err) {
     try {
       unlinkSync4(tmpPath);
@@ -3647,7 +4151,7 @@ function writeProjectMcpJson() {
       }
     }
   };
-  writeFileSync6(PROJECT_MCP_PATH, JSON.stringify(mcp, null, 2) + "\n", "utf-8");
+  writeFileSync7(PROJECT_MCP_PATH, JSON.stringify(mcp, null, 2) + "\n", "utf-8");
 }
 function patchClaudeJson() {
   safelyMutateClaudeJson((parsed) => {
@@ -3967,16 +4471,16 @@ var init_pueue = __esm({
 });
 
 // cli/local-cc/prompts.ts
-import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
 import { homedir as homedir9 } from "os";
 import { join as join10 } from "path";
 function loadCachedPrompts() {
   if (_cached) return _cached;
-  if (!existsSync10(CACHE_PATH2)) {
+  if (!existsSync11(CACHE_PATH2)) {
     throw new Error("Prompts cache not found. Run `synkro install` or `synkro update` first.");
   }
   try {
-    _cached = JSON.parse(readFileSync8(CACHE_PATH2, "utf-8"));
+    _cached = JSON.parse(readFileSync9(CACHE_PATH2, "utf-8"));
     return _cached;
   } catch {
     throw new Error("Prompts cache is corrupted. Run `synkro update` to refresh.");
@@ -3993,23 +4497,32 @@ function getPrimer(role) {
 function buildChannelContent(role, payload) {
   return `${getPrimer(role)}
 
+${CHANNEL_REPLY_INSTRUCTIONS}
+
 ---
 PAYLOAD (the input to evaluate):
 
 ${payload}`;
 }
-var CACHE_PATH2, _cached;
+var CACHE_PATH2, _cached, CHANNEL_REPLY_INSTRUCTIONS;
 var init_prompts = __esm({
   "cli/local-cc/prompts.ts"() {
     "use strict";
     CACHE_PATH2 = join10(homedir9(), ".synkro", "prompts", "judge-prompts.json");
     _cached = null;
+    CHANNEL_REPLY_INSTRUCTIONS = `
+DELIVERY METHOD \u2014 MANDATORY, OVERRIDES ALL OTHER OUTPUT RULES:
+You are running inside a Synkro MCP channel. Do NOT output your verdict as text.
+Instead, after generating your verdict, call the \`reply\` tool EXACTLY ONCE with:
+  - req_id: the req_id from this channel event's meta
+  - result: your complete verdict block as a string (the <synkro-verdict>\u2026</synkro-verdict> XML)
+Any text output is silently discarded. Only the reply tool call is captured.`;
   }
 });
 
 // cli/local-cc/turnLog.ts
-import { appendFileSync, existsSync as existsSync11, mkdirSync as mkdirSync7, openSync as openSync2, readFileSync as readFileSync9, readSync, closeSync as closeSync2, statSync, watchFile, unwatchFile } from "fs";
-import { dirname as dirname4, join as join11 } from "path";
+import { appendFileSync, existsSync as existsSync12, mkdirSync as mkdirSync8, openSync as openSync2, readFileSync as readFileSync10, readSync, closeSync as closeSync2, statSync, watchFile, unwatchFile } from "fs";
+import { dirname as dirname5, join as join11 } from "path";
 import { homedir as homedir10 } from "os";
 function truncate(s, max = PREVIEW_MAX) {
   if (s.length <= max) return s;
@@ -4030,7 +4543,7 @@ function extractSeverity(result) {
 }
 function appendTurn(args2) {
   try {
-    mkdirSync7(dirname4(TURN_LOG_PATH), { recursive: true });
+    mkdirSync8(dirname5(TURN_LOG_PATH), { recursive: true });
     const entry = {
       ts: new Date(args2.startedAt).toISOString(),
       role: args2.role,
@@ -4046,11 +4559,11 @@ function appendTurn(args2) {
   }
 }
 function readRecentTurns(n = 20) {
-  if (!existsSync11(TURN_LOG_PATH)) return [];
+  if (!existsSync12(TURN_LOG_PATH)) return [];
   try {
     const size = statSync(TURN_LOG_PATH).size;
     if (size === 0) return [];
-    const text = readFileSync9(TURN_LOG_PATH, "utf-8");
+    const text = readFileSync10(TURN_LOG_PATH, "utf-8");
     const lines = text.split("\n").filter(Boolean);
     const lastN = lines.slice(-n).reverse();
     return lastN.map((line) => {
@@ -4066,8 +4579,8 @@ function readRecentTurns(n = 20) {
 }
 function followTurns(onEntry) {
   try {
-    mkdirSync7(dirname4(TURN_LOG_PATH), { recursive: true });
-    if (!existsSync11(TURN_LOG_PATH)) {
+    mkdirSync8(dirname5(TURN_LOG_PATH), { recursive: true });
+    if (!existsSync12(TURN_LOG_PATH)) {
       appendFileSync(TURN_LOG_PATH, "", "utf-8");
     }
   } catch {
@@ -4235,7 +4748,7 @@ __export(install_exports, {
   installCommand: () => installCommand,
   parseArgs: () => parseArgs
 });
-import { existsSync as existsSync12, mkdirSync as mkdirSync8, writeFileSync as writeFileSync7, chmodSync as chmodSync2, readFileSync as readFileSync10, readdirSync } from "fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, chmodSync as chmodSync2, readFileSync as readFileSync11, readdirSync } from "fs";
 import { homedir as homedir11 } from "os";
 import { join as join12 } from "path";
 import { execSync as execSync5 } from "child_process";
@@ -4274,10 +4787,10 @@ async function promptTranscriptConsent() {
   });
 }
 function ensureSynkroDir() {
-  mkdirSync8(SYNKRO_DIR2, { recursive: true });
-  mkdirSync8(HOOKS_DIR, { recursive: true });
-  mkdirSync8(BIN_DIR, { recursive: true });
-  mkdirSync8(OFFSETS_DIR, { recursive: true });
+  mkdirSync9(SYNKRO_DIR2, { recursive: true });
+  mkdirSync9(HOOKS_DIR, { recursive: true });
+  mkdirSync9(BIN_DIR, { recursive: true });
+  mkdirSync9(OFFSETS_DIR, { recursive: true });
 }
 function writeHookScripts() {
   const bashScriptPath = join12(HOOKS_DIR, "cc-bash-judge.sh");
@@ -4287,13 +4800,23 @@ function writeHookScripts() {
   const stopSummaryScriptPath = join12(HOOKS_DIR, "cc-stop-summary.sh");
   const sessionStartScriptPath = join12(HOOKS_DIR, "cc-session-start.sh");
   const transcriptSyncScriptPath = join12(HOOKS_DIR, "cc-transcript-sync.sh");
-  writeFileSync7(bashScriptPath, CC_BASH_JUDGE_SCRIPT, "utf-8");
-  writeFileSync7(bashFollowupScriptPath, CC_BASH_FOLLOWUP_SCRIPT, "utf-8");
-  writeFileSync7(editCaptureScriptPath, CC_EDIT_CAPTURE_SCRIPT, "utf-8");
-  writeFileSync7(editPrecheckScriptPath, CC_EDIT_PRECHECK_SCRIPT, "utf-8");
-  writeFileSync7(stopSummaryScriptPath, CC_STOP_SUMMARY_SCRIPT, "utf-8");
-  writeFileSync7(sessionStartScriptPath, CC_SESSION_START_SCRIPT, "utf-8");
-  writeFileSync7(transcriptSyncScriptPath, CC_TRANSCRIPT_SYNC_SCRIPT, "utf-8");
+  const commonScriptPath = join12(HOOKS_DIR, "_synkro-common.sh");
+  const cursorBashJudgePath = join12(HOOKS_DIR, "cursor-bash-judge.sh");
+  const cursorEditPrecheckPath = join12(HOOKS_DIR, "cursor-edit-precheck.sh");
+  const cursorEditCapturePath = join12(HOOKS_DIR, "cursor-edit-capture.sh");
+  const cursorBashFollowupPath = join12(HOOKS_DIR, "cursor-bash-followup.sh");
+  writeFileSync8(bashScriptPath, CC_BASH_JUDGE_SCRIPT, "utf-8");
+  writeFileSync8(bashFollowupScriptPath, CC_BASH_FOLLOWUP_SCRIPT, "utf-8");
+  writeFileSync8(editCaptureScriptPath, CC_EDIT_CAPTURE_SCRIPT, "utf-8");
+  writeFileSync8(editPrecheckScriptPath, CC_EDIT_PRECHECK_SCRIPT, "utf-8");
+  writeFileSync8(stopSummaryScriptPath, CC_STOP_SUMMARY_SCRIPT, "utf-8");
+  writeFileSync8(sessionStartScriptPath, CC_SESSION_START_SCRIPT, "utf-8");
+  writeFileSync8(transcriptSyncScriptPath, CC_TRANSCRIPT_SYNC_SCRIPT, "utf-8");
+  writeFileSync8(commonScriptPath, SYNKRO_COMMON_SCRIPT, "utf-8");
+  writeFileSync8(cursorBashJudgePath, CURSOR_BASH_JUDGE_SCRIPT, "utf-8");
+  writeFileSync8(cursorEditPrecheckPath, CURSOR_EDIT_PRECHECK_SCRIPT, "utf-8");
+  writeFileSync8(cursorEditCapturePath, CURSOR_EDIT_CAPTURE_SCRIPT, "utf-8");
+  writeFileSync8(cursorBashFollowupPath, CURSOR_BASH_FOLLOWUP_SCRIPT, "utf-8");
   chmodSync2(bashScriptPath, 493);
   chmodSync2(bashFollowupScriptPath, 493);
   chmodSync2(editCaptureScriptPath, 493);
@@ -4301,6 +4824,11 @@ function writeHookScripts() {
   chmodSync2(stopSummaryScriptPath, 493);
   chmodSync2(sessionStartScriptPath, 493);
   chmodSync2(transcriptSyncScriptPath, 493);
+  chmodSync2(commonScriptPath, 493);
+  chmodSync2(cursorBashJudgePath, 493);
+  chmodSync2(cursorEditPrecheckPath, 493);
+  chmodSync2(cursorEditCapturePath, 493);
+  chmodSync2(cursorBashFollowupPath, 493);
   return {
     bashScript: bashScriptPath,
     bashFollowupScript: bashFollowupScriptPath,
@@ -4308,7 +4836,11 @@ function writeHookScripts() {
     editPrecheckScript: editPrecheckScriptPath,
     stopSummaryScript: stopSummaryScriptPath,
     sessionStartScript: sessionStartScriptPath,
-    transcriptSyncScript: transcriptSyncScriptPath
+    transcriptSyncScript: transcriptSyncScriptPath,
+    cursorBashJudgeScript: cursorBashJudgePath,
+    cursorEditPrecheckScript: cursorEditPrecheckPath,
+    cursorEditCaptureScript: cursorEditCapturePath,
+    cursorBashFollowupScript: cursorBashFollowupPath
   };
 }
 function sanitizeConfigValue(raw, maxLen = 256) {
@@ -4320,7 +4852,7 @@ function shellQuoteSingle(value) {
 }
 function resolveSynkroBundle() {
   const scriptPath = process.argv[1];
-  if (scriptPath && existsSync12(scriptPath)) return scriptPath;
+  if (scriptPath && existsSync13(scriptPath)) return scriptPath;
   return null;
 }
 function writeConfigEnv(opts) {
@@ -4340,7 +4872,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.4.6")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.4.8")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -4351,12 +4883,12 @@ function writeConfigEnv(opts) {
   }
   lines.push(`SYNKRO_LOCAL_INFERENCE=${shellQuoteSingle(opts.localInference ? "yes" : "no")}`);
   lines.push("");
-  writeFileSync7(CONFIG_PATH3, lines.join("\n"), "utf-8");
+  writeFileSync8(CONFIG_PATH3, lines.join("\n"), "utf-8");
   chmodSync2(CONFIG_PATH3, 384);
 }
 function updateLocalInferenceFlag(enabled) {
-  if (!existsSync12(CONFIG_PATH3)) return;
-  let content = readFileSync10(CONFIG_PATH3, "utf-8");
+  if (!existsSync13(CONFIG_PATH3)) return;
+  let content = readFileSync11(CONFIG_PATH3, "utf-8");
   const flag = enabled ? "yes" : "no";
   if (content.includes("SYNKRO_LOCAL_INFERENCE=")) {
     content = content.replace(/^SYNKRO_LOCAL_INFERENCE='[^']*'/m, `SYNKRO_LOCAL_INFERENCE='${flag}'`);
@@ -4365,7 +4897,7 @@ function updateLocalInferenceFlag(enabled) {
 SYNKRO_LOCAL_INFERENCE='${flag}'
 `;
   }
-  writeFileSync7(CONFIG_PATH3, content, "utf-8");
+  writeFileSync8(CONFIG_PATH3, content, "utf-8");
 }
 function collectLocalMetadata() {
   const meta = { platform: process.platform };
@@ -4387,14 +4919,14 @@ function collectLocalMetadata() {
   }
   const claudeDir = join12(homedir11(), ".claude");
   try {
-    const settings = JSON.parse(readFileSync10(join12(claudeDir, "settings.json"), "utf-8"));
+    const settings = JSON.parse(readFileSync11(join12(claudeDir, "settings.json"), "utf-8"));
     const plugins = Object.keys(settings.enabledPlugins ?? {}).filter((k) => settings.enabledPlugins[k]);
     if (plugins.length) meta.enabled_plugins = plugins;
     if (settings.permissions?.defaultMode) meta.permissions_mode = settings.permissions.defaultMode;
   } catch {
   }
   try {
-    const mcpCache = JSON.parse(readFileSync10(join12(claudeDir, "mcp-needs-auth-cache.json"), "utf-8"));
+    const mcpCache = JSON.parse(readFileSync11(join12(claudeDir, "mcp-needs-auth-cache.json"), "utf-8"));
     const mcpNames = Object.keys(mcpCache);
     if (mcpNames.length) meta.mcp_servers = mcpNames;
   } catch {
@@ -4409,7 +4941,7 @@ function collectLocalMetadata() {
     const sessionsDir = join12(claudeDir, "sessions");
     const files = readdirSync(sessionsDir).filter((f) => f.endsWith(".json")).slice(-5);
     for (const f of files) {
-      const s = JSON.parse(readFileSync10(join12(sessionsDir, f), "utf-8"));
+      const s = JSON.parse(readFileSync11(join12(sessionsDir, f), "utf-8"));
       if (s.version) {
         meta.cc_version = meta.cc_version || s.version;
         break;
@@ -4472,12 +5004,12 @@ function isAlreadyInstalled() {
     join12(HOOKS_DIR, "cc-stop-summary.sh"),
     join12(HOOKS_DIR, "cc-session-start.sh")
   ];
-  if (!requiredScripts.every((p) => existsSync12(p))) return false;
-  if (!existsSync12(CONFIG_PATH3)) return false;
+  if (!requiredScripts.every((p) => existsSync13(p))) return false;
+  if (!existsSync13(CONFIG_PATH3)) return false;
   const settingsPath = join12(homedir11(), ".claude", "settings.json");
-  if (!existsSync12(settingsPath)) return false;
+  if (!existsSync13(settingsPath)) return false;
   try {
-    const settings = JSON.parse(readFileSync10(settingsPath, "utf-8"));
+    const settings = JSON.parse(readFileSync11(settingsPath, "utf-8"));
     const hooks = settings?.hooks;
     if (!hooks || typeof hooks !== "object") return false;
     const hasManaged = (kind) => Array.isArray(hooks[kind]) && hooks[kind].some((entry) => entry?.__synkro_managed__ === true);
@@ -4610,7 +5142,7 @@ async function installCommand(opts = {}) {
   for (const mode of ["edit", "bash"]) {
     const pidFile = join12(SYNKRO_DIR2, "daemon", mode, "daemon.pid");
     try {
-      const pid = parseInt(readFileSync10(pidFile, "utf-8").trim(), 10);
+      const pid = parseInt(readFileSync11(pidFile, "utf-8").trim(), 10);
       if (pid > 0) {
         process.kill(pid, "SIGTERM");
         console.log(`Stopped stale ${mode} grader daemon (pid ${pid})`);
@@ -4628,6 +5160,7 @@ async function installCommand(opts = {}) {
     }
   }
   let hasClaudeCode = false;
+  let hasCursor = false;
   for (const agent of agents) {
     if (agent.kind === "claude_code") {
       hasClaudeCode = true;
@@ -4642,6 +5175,15 @@ async function installCommand(opts = {}) {
         skipTranscriptSync: !transcriptConsent
       });
       console.log(`Configured ${agent.name} hooks at ${agent.settingsPath}`);
+    } else if (agent.kind === "cursor") {
+      hasCursor = true;
+      installCursorHooks(agent.settingsPath, {
+        bashJudgeScriptPath: scripts.cursorBashJudgeScript,
+        editPrecheckScriptPath: scripts.cursorEditPrecheckScript,
+        editCaptureScriptPath: scripts.cursorEditCaptureScript,
+        bashFollowupScriptPath: scripts.cursorBashFollowupScript
+      });
+      console.log(`Configured ${agent.name} hooks at ${agent.settingsPath}`);
     }
   }
   console.log();
@@ -4764,7 +5306,7 @@ function getClaudeProjectsFolder() {
   const cwd = process.cwd();
   const sanitized = "-" + cwd.replace(/\//g, "-");
   const projectsDir = join12(homedir11(), ".claude", "projects", sanitized);
-  return existsSync12(projectsDir) ? projectsDir : null;
+  return existsSync13(projectsDir) ? projectsDir : null;
 }
 function extractSessionInsights(projectsDir) {
   const insights = [];
@@ -4773,7 +5315,7 @@ function extractSessionInsights(projectsDir) {
     const sessionId = file.replace(".jsonl", "");
     const filePath = join12(projectsDir, file);
     try {
-      const content = readFileSync10(filePath, "utf-8");
+      const content = readFileSync11(filePath, "utf-8");
       const lines = content.split("\n").filter(Boolean);
       for (let i = 0; i < lines.length; i++) {
         try {
@@ -4849,7 +5391,7 @@ function extractTextContent(content) {
   return "";
 }
 function parseTranscriptFile(filePath) {
-  const content = readFileSync10(filePath, "utf-8");
+  const content = readFileSync11(filePath, "utf-8");
   const lines = content.split("\n").filter(Boolean);
   const messages = [];
   for (let i = 0; i < lines.length; i++) {
@@ -4931,9 +5473,9 @@ async function syncTranscriptsBulk(gatewayUrl, token, repo) {
       const sessionId = file.replace(".jsonl", "");
       const filePath = join12(projectsDir, file);
       try {
-        const content = readFileSync10(filePath, "utf-8");
+        const content = readFileSync11(filePath, "utf-8");
         const lineCount = content.split("\n").filter(Boolean).length;
-        writeFileSync7(join12(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
+        writeFileSync8(join12(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
       } catch {
       }
     }
@@ -4946,6 +5488,7 @@ var init_install2 = __esm({
     "use strict";
     init_agentDetect();
     init_ccHookConfig();
+    init_cursorHookConfig();
     init_mcpConfig();
     init_hookScripts();
     init_stub();
@@ -5037,13 +5580,13 @@ var status_exports = {};
 __export(status_exports, {
   statusCommand: () => statusCommand
 });
-import { existsSync as existsSync13, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync12 } from "fs";
 import { homedir as homedir12 } from "os";
 import { join as join13 } from "path";
 function readConfigEnv() {
-  if (!existsSync13(CONFIG_PATH4)) return {};
+  if (!existsSync14(CONFIG_PATH4)) return {};
   const out = {};
-  const raw = readFileSync11(CONFIG_PATH4, "utf-8");
+  const raw = readFileSync12(CONFIG_PATH4, "utf-8");
   for (const line of raw.split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -5112,6 +5655,15 @@ async function statusCommand() {
           console.log(`      \u2022 SessionEnd summary: ${hooks.sessionEnd ? "\u2713" : "\u2717"}`);
           console.log(`      \u2022 SessionStart:       ${hooks.sessionStart ? "\u2713" : "\u2717"}`);
         }
+      } else if (a.kind === "cursor") {
+        const hooks = inspectCursorHooks(a.settingsPath);
+        console.log(`    hooks installed: ${hooks.installed ? "\u2713" : "\u2717"}`);
+        if (hooks.installed) {
+          console.log(`      \u2022 beforeShellExecution: ${hooks.beforeShellExecution ? "\u2713" : "\u2717"}`);
+          console.log(`      \u2022 preToolUse:           ${hooks.preToolUse ? "\u2713" : "\u2717"}`);
+          console.log(`      \u2022 afterFileEdit:        ${hooks.afterFileEdit ? "\u2713" : "\u2717"}`);
+          console.log(`      \u2022 postToolUse:          ${hooks.postToolUse ? "\u2713" : "\u2717"}`);
+        }
       }
     }
   }
@@ -5122,13 +5674,23 @@ async function statusCommand() {
   const editCaptureScript = join13(SYNKRO_DIR3, "hooks", "cc-edit-capture.sh");
   const stopSummaryScript = join13(SYNKRO_DIR3, "hooks", "cc-stop-summary.sh");
   const sessionStartScript = join13(SYNKRO_DIR3, "hooks", "cc-session-start.sh");
+  const cursorBashJudgeScript = join13(SYNKRO_DIR3, "hooks", "cursor-bash-judge.sh");
+  const cursorEditPrecheckScript = join13(SYNKRO_DIR3, "hooks", "cursor-edit-precheck.sh");
+  const cursorEditCaptureScript = join13(SYNKRO_DIR3, "hooks", "cursor-edit-capture.sh");
+  const cursorBashFollowupScript = join13(SYNKRO_DIR3, "hooks", "cursor-bash-followup.sh");
+  const commonScript = join13(SYNKRO_DIR3, "hooks", "_synkro-common.sh");
   console.log("Hook scripts:");
-  console.log(`  ${existsSync13(bashScript) ? "\u2713" : "\u2717"} ${bashScript}`);
-  console.log(`  ${existsSync13(bashFollowupScript) ? "\u2713" : "\u2717"} ${bashFollowupScript}`);
-  console.log(`  ${existsSync13(editPrecheckScript) ? "\u2713" : "\u2717"} ${editPrecheckScript}`);
-  console.log(`  ${existsSync13(editCaptureScript) ? "\u2713" : "\u2717"} ${editCaptureScript}`);
-  console.log(`  ${existsSync13(stopSummaryScript) ? "\u2713" : "\u2717"} ${stopSummaryScript}`);
-  console.log(`  ${existsSync13(sessionStartScript) ? "\u2713" : "\u2717"} ${sessionStartScript}`);
+  console.log(`  ${existsSync14(bashScript) ? "\u2713" : "\u2717"} ${bashScript}`);
+  console.log(`  ${existsSync14(bashFollowupScript) ? "\u2713" : "\u2717"} ${bashFollowupScript}`);
+  console.log(`  ${existsSync14(editPrecheckScript) ? "\u2713" : "\u2717"} ${editPrecheckScript}`);
+  console.log(`  ${existsSync14(editCaptureScript) ? "\u2713" : "\u2717"} ${editCaptureScript}`);
+  console.log(`  ${existsSync14(stopSummaryScript) ? "\u2713" : "\u2717"} ${stopSummaryScript}`);
+  console.log(`  ${existsSync14(sessionStartScript) ? "\u2713" : "\u2717"} ${sessionStartScript}`);
+  console.log(`  ${existsSync14(commonScript) ? "\u2713" : "\u2717"} ${commonScript}`);
+  console.log(`  ${existsSync14(cursorBashJudgeScript) ? "\u2713" : "\u2717"} ${cursorBashJudgeScript}`);
+  console.log(`  ${existsSync14(cursorEditPrecheckScript) ? "\u2713" : "\u2717"} ${cursorEditPrecheckScript}`);
+  console.log(`  ${existsSync14(cursorEditCaptureScript) ? "\u2713" : "\u2717"} ${cursorEditCaptureScript}`);
+  console.log(`  ${existsSync14(cursorBashFollowupScript) ? "\u2713" : "\u2717"} ${cursorBashFollowupScript}`);
   console.log();
   const mcp = inspectMcpConfig();
   console.log("Guardrails MCP server (Claude Code):");
@@ -5147,6 +5709,7 @@ var init_status = __esm({
     init_stub();
     init_agentDetect();
     init_ccHookConfig();
+    init_cursorHookConfig();
     init_mcpConfig();
     SYNKRO_DIR3 = join13(homedir12(), ".synkro");
     CONFIG_PATH4 = join13(SYNKRO_DIR3, "config.env");
@@ -5238,13 +5801,13 @@ var config_exports = {};
 __export(config_exports, {
   configCommand: () => configCommand
 });
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync8, existsSync as existsSync14 } from "fs";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync9, existsSync as existsSync15 } from "fs";
 import { join as join14 } from "path";
 import { homedir as homedir13 } from "os";
 function readConfigEnv2() {
-  if (!existsSync14(CONFIG_PATH5)) return {};
+  if (!existsSync15(CONFIG_PATH5)) return {};
   const out = {};
-  for (const line of readFileSync12(CONFIG_PATH5, "utf-8").split("\n")) {
+  for (const line of readFileSync13(CONFIG_PATH5, "utf-8").split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#")) continue;
     const eq = t.indexOf("=");
@@ -5253,11 +5816,11 @@ function readConfigEnv2() {
   return out;
 }
 function updateConfigValue(key, value) {
-  if (!existsSync14(CONFIG_PATH5)) {
+  if (!existsSync15(CONFIG_PATH5)) {
     console.error("No config found. Run `synkro install` first.");
     process.exit(1);
   }
-  const lines = readFileSync12(CONFIG_PATH5, "utf-8").split("\n");
+  const lines = readFileSync13(CONFIG_PATH5, "utf-8").split("\n");
   const pattern = new RegExp(`^${key}=`);
   let found = false;
   const updated = lines.map((line) => {
@@ -5268,7 +5831,7 @@ function updateConfigValue(key, value) {
     return line;
   });
   if (!found) updated.splice(updated.length - 1, 0, `${key}='${value}'`);
-  writeFileSync8(CONFIG_PATH5, updated.join("\n"), "utf-8");
+  writeFileSync9(CONFIG_PATH5, updated.join("\n"), "utf-8");
 }
 async function configCommand(args2) {
   if (args2.length === 0) {
@@ -5335,7 +5898,7 @@ __export(scanPr_exports, {
   scanPrCommand: () => scanPrCommand
 });
 import { execSync as execSync6, spawn as spawn2 } from "child_process";
-import { readFileSync as readFileSync13, existsSync as existsSync15 } from "fs";
+import { readFileSync as readFileSync14, existsSync as existsSync16 } from "fs";
 import { join as join15 } from "path";
 function parseMatchSpec(condition) {
   if (!condition.startsWith("match_spec:")) return null;
@@ -5816,9 +6379,9 @@ function shouldFail(findings, threshold) {
 }
 function readRepoDeps() {
   const pkgPath = join15(process.cwd(), "package.json");
-  if (!existsSync15(pkgPath)) return {};
+  if (!existsSync16(pkgPath)) return {};
   try {
-    const pkg = JSON.parse(readFileSync13(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync14(pkgPath, "utf-8"));
     return { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
   } catch {
     return {};
@@ -6080,7 +6643,7 @@ var disconnect_exports = {};
 __export(disconnect_exports, {
   disconnectCommand: () => disconnectCommand
 });
-import { existsSync as existsSync16, rmSync } from "fs";
+import { existsSync as existsSync17, rmSync } from "fs";
 import { homedir as homedir14 } from "os";
 import { join as join16 } from "path";
 function tearDownLocalCC() {
@@ -6105,6 +6668,9 @@ function disconnectCommand(args2 = []) {
       sawClaudeCode = true;
       const removed = uninstallCCHooks(agent.settingsPath);
       console.log(`${removed ? "\u2713" : "\xB7"} ${agent.name}: ${removed ? "removed Synkro hook entries" : "no Synkro hooks found"}`);
+    } else if (agent.kind === "cursor") {
+      const removed = uninstallCursorHooks(agent.settingsPath);
+      console.log(`${removed ? "\u2713" : "\xB7"} ${agent.name}: ${removed ? "removed Synkro hook entries" : "no Synkro hooks found"}`);
     }
   }
   if (sawClaudeCode) {
@@ -6112,13 +6678,13 @@ function disconnectCommand(args2 = []) {
     console.log(`${mcpRemoved ? "\u2713" : "\xB7"} MCP guardrails server: ${mcpRemoved ? "removed entry from ~/.claude.json" : "no Synkro MCP entry found"}`);
   }
   if (purge) {
-    if (existsSync16(SYNKRO_DIR5)) {
+    if (existsSync17(SYNKRO_DIR5)) {
       rmSync(SYNKRO_DIR5, { recursive: true, force: true });
       console.log(`\u2713 Removed ${SYNKRO_DIR5}`);
     } else {
       console.log(`\xB7 ${SYNKRO_DIR5} already gone, nothing to remove`);
     }
-  } else if (existsSync16(SYNKRO_DIR5)) {
+  } else if (existsSync17(SYNKRO_DIR5)) {
     console.log(`Config preserved at ${SYNKRO_DIR5}. Run with --purge to remove.`);
   }
   console.log("\nSynkro disconnected.");
@@ -6129,6 +6695,7 @@ var init_disconnect = __esm({
     "use strict";
     init_agentDetect();
     init_ccHookConfig();
+    init_cursorHookConfig();
     init_mcpConfig();
     init_pueue();
     init_install();
@@ -6181,7 +6748,7 @@ __export(localCc_exports, {
 import { spawnSync as spawnSync3 } from "child_process";
 import { homedir as homedir15 } from "os";
 import { join as join17 } from "path";
-import { existsSync as existsSync17, readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync15, writeFileSync as writeFileSync10 } from "fs";
 function printHelp() {
   console.log(`synkro local-cc \u2014 manage the local Claude Code inference session
 
@@ -6271,15 +6838,15 @@ TROUBLESHOOTING
 `);
 }
 function readGatewayUrl() {
-  if (existsSync17(CONFIG_PATH6)) {
-    const m = readFileSync14(CONFIG_PATH6, "utf-8").match(/^SYNKRO_GATEWAY_URL='([^']*)'/m);
+  if (existsSync18(CONFIG_PATH6)) {
+    const m = readFileSync15(CONFIG_PATH6, "utf-8").match(/^SYNKRO_GATEWAY_URL='([^']*)'/m);
     if (m) return m[1];
   }
   return "https://api.synkro.sh";
 }
 function updateLocalInferenceFlag2(enabled) {
-  if (!existsSync17(CONFIG_PATH6)) return;
-  let content = readFileSync14(CONFIG_PATH6, "utf-8");
+  if (!existsSync18(CONFIG_PATH6)) return;
+  let content = readFileSync15(CONFIG_PATH6, "utf-8");
   const flag = enabled ? "yes" : "no";
   if (content.includes("SYNKRO_LOCAL_INFERENCE=")) {
     content = content.replace(/^SYNKRO_LOCAL_INFERENCE='[^']*'/m, `SYNKRO_LOCAL_INFERENCE='${flag}'`);
@@ -6288,7 +6855,7 @@ function updateLocalInferenceFlag2(enabled) {
 SYNKRO_LOCAL_INFERENCE='${flag}'
 `;
   }
-  writeFileSync9(CONFIG_PATH6, content, "utf-8");
+  writeFileSync10(CONFIG_PATH6, content, "utf-8");
 }
 async function setServerGradingProvider(provider) {
   await ensureValidToken();
@@ -6615,15 +7182,15 @@ var init_grade = __esm({
 });
 
 // cli/bootstrap.js
-import { readFileSync as readFileSync15, existsSync as existsSync18 } from "fs";
+import { readFileSync as readFileSync16, existsSync as existsSync19 } from "fs";
 import { resolve } from "path";
 var envCandidates = [
   resolve(process.cwd(), ".env"),
   resolve(process.env.HOME ?? "", ".synkro", "config.env")
 ];
 for (const envPath of envCandidates) {
-  if (!existsSync18(envPath)) continue;
-  const envContent = readFileSync15(envPath, "utf-8");
+  if (!existsSync19(envPath)) continue;
+  const envContent = readFileSync16(envPath, "utf-8");
   for (const line of envContent.split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;