@synkro-sh/cli 1.4.66 → 1.4.67

package/dist/bootstrap.js

@@ -283,22 +283,32 @@ var init_ccHookConfig = __esm({
 });
 
 // cli/installer/cursorHookConfig.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2, renameSync as renameSync2, mkdirSync as mkdirSync2 } from "fs";
-import { dirname as dirname2 } from "path";
-function readHooksFile(path) {
-  if (!existsSync3(path)) return { version: 1, hooks: {} };
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, renameSync as renameSync2, mkdirSync as mkdirSync2 } from "fs";
+import { dirname as dirname2, resolve, normalize } from "path";
+import { homedir as homedir2 } from "os";
+function validateHooksPath(path) {
+  const resolved = resolve(normalize(path));
+  if (!ALLOWED_PARENT_DIRS.some((dir) => resolved.startsWith(dir + "/") || resolved === dir)) {
+    throw new Error(`Hooks path must be under ~/.cursor or ~/.config/cursor, got: ${resolved}`);
+  }
+  return resolved;
+}
+function readHooksFile(rawPath) {
+  const safePath = validateHooksPath(rawPath);
   try {
-    const raw = readFileSync2(path, "utf-8");
+    const raw = readFileSync2(safePath, "utf-8");
     return JSON.parse(raw);
   } catch (err) {
-    throw new Error(`Failed to parse ${path}: ${err.message}`);
+    if (err?.code === "ENOENT") return { version: 1, hooks: {} };
+    throw new Error(`Failed to parse ${safePath}: ${err.message}`);
   }
 }
-function writeHooksFileAtomic(path, data) {
-  mkdirSync2(dirname2(path), { recursive: true });
-  const tmpPath = `${path}.synkro.tmp`;
-  writeFileSync2(tmpPath, JSON.stringify(data, null, 2) + "\n", "utf-8");
-  renameSync2(tmpPath, path);
+function writeHooksFileAtomic(rawPath, data) {
+  const safePath = validateHooksPath(rawPath);
+  mkdirSync2(dirname2(safePath), { recursive: true });
+  const tmpPath = `${safePath}.synkro.tmp`;
+  writeFileSync2(tmpPath, JSON.stringify(data, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
+  renameSync2(tmpPath, safePath);
 }
 function isSynkroEntry2(entry) {
   if (entry?.[SYNKRO_MARKER2]) return true;
@@ -314,10 +324,15 @@ function installCursorHooks(hooksJsonPath, config) {
   const file = readHooksFile(hooksJsonPath);
   file.version = file.version ?? 1;
   file.hooks = file.hooks ?? {};
-  const events = ["beforeShellExecution", "preToolUse", "afterFileEdit", "postToolUse"];
-  for (const evt of events) {
+  for (const evt of ALL_EVENTS) {
     removeSynkroEntries2(file.hooks, evt);
   }
+  file.hooks.sessionStart = file.hooks.sessionStart ?? [];
+  file.hooks.sessionStart.push({
+    command: config.sessionStartScriptPath,
+    timeout: 5,
+    [SYNKRO_MARKER2]: true
+  });
   file.hooks.beforeShellExecution = file.hooks.beforeShellExecution ?? [];
   file.hooks.beforeShellExecution.push({
     command: config.bashJudgeScriptPath,
@@ -346,14 +361,17 @@ function installCursorHooks(hooksJsonPath, config) {
   writeHooksFileAtomic(hooksJsonPath, file);
 }
 function uninstallCursorHooks(hooksJsonPath) {
-  if (!existsSync3(hooksJsonPath)) return false;
-  const file = readHooksFile(hooksJsonPath);
+  let file;
+  try {
+    file = readHooksFile(hooksJsonPath);
+  } catch {
+    return false;
+  }
   if (!file.hooks) return false;
-  const events = ["beforeShellExecution", "preToolUse", "afterFileEdit", "postToolUse"];
-  for (const evt of events) {
+  for (const evt of ALL_EVENTS) {
     removeSynkroEntries2(file.hooks, evt);
   }
-  for (const evt of events) {
+  for (const evt of ALL_EVENTS) {
     if (Array.isArray(file.hooks[evt]) && file.hooks[evt].length === 0) {
       delete file.hooks[evt];
     }
@@ -365,37 +383,46 @@ function uninstallCursorHooks(hooksJsonPath) {
   return true;
 }
 function inspectCursorHooks(hooksJsonPath) {
-  if (!existsSync3(hooksJsonPath)) {
-    return { installed: false, beforeShellExecution: false, preToolUse: false, afterFileEdit: false, postToolUse: false };
+  let file;
+  try {
+    file = readHooksFile(hooksJsonPath);
+  } catch {
+    return { installed: false, sessionStart: false, beforeShellExecution: false, preToolUse: false, afterFileEdit: false, postToolUse: false };
   }
-  const file = readHooksFile(hooksJsonPath);
   const h = file.hooks ?? {};
+  const sessionStart = (h.sessionStart ?? []).some((e) => isSynkroEntry2(e));
   const beforeShellExecution = (h.beforeShellExecution ?? []).some((e) => isSynkroEntry2(e));
   const preToolUse = (h.preToolUse ?? []).some((e) => isSynkroEntry2(e));
   const afterFileEdit = (h.afterFileEdit ?? []).some((e) => isSynkroEntry2(e));
   const postToolUse = (h.postToolUse ?? []).some((e) => isSynkroEntry2(e));
   return {
-    installed: beforeShellExecution || preToolUse || afterFileEdit || postToolUse,
+    installed: sessionStart || beforeShellExecution || preToolUse || afterFileEdit || postToolUse,
+    sessionStart,
     beforeShellExecution,
     preToolUse,
     afterFileEdit,
     postToolUse
   };
 }
-var SYNKRO_MARKER2;
+var SYNKRO_MARKER2, ALLOWED_PARENT_DIRS, ALL_EVENTS;
 var init_cursorHookConfig = __esm({
   "cli/installer/cursorHookConfig.ts"() {
     "use strict";
     SYNKRO_MARKER2 = "__synkro_managed__";
+    ALLOWED_PARENT_DIRS = [
+      resolve(homedir2(), ".cursor"),
+      resolve(homedir2(), ".config", "cursor")
+    ];
+    ALL_EVENTS = ["sessionStart", "beforeShellExecution", "preToolUse", "afterFileEdit", "postToolUse"];
   }
 });
 
 // cli/installer/mcpConfig.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync3, renameSync as renameSync3, mkdirSync as mkdirSync3 } from "fs";
-import { homedir as homedir2 } from "os";
+import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3, renameSync as renameSync3, mkdirSync as mkdirSync3 } from "fs";
+import { homedir as homedir3 } from "os";
 import { dirname as dirname3, join as join2 } from "path";
 function readClaudeJson() {
-  if (!existsSync4(CC_CONFIG_PATH)) return {};
+  if (!existsSync3(CC_CONFIG_PATH)) return {};
   try {
     const raw = readFileSync3(CC_CONFIG_PATH, "utf-8");
     return JSON.parse(raw);
@@ -417,7 +444,7 @@ function installMcpConfig(opts) {
   }
   if (opts.local) {
     const url2 = "http://127.0.0.1:8931/";
-    const tokenPath = join2(homedir2(), ".synkro", ".mcp-local-token");
+    const tokenPath = join2(homedir3(), ".synkro", ".mcp-local-token");
     let localToken = "";
     try {
       localToken = readFileSync3(tokenPath, "utf-8").trim();
@@ -443,7 +470,7 @@ function installMcpConfig(opts) {
   return { path: CC_CONFIG_PATH, url };
 }
 function uninstallMcpConfig() {
-  if (!existsSync4(CC_CONFIG_PATH)) return false;
+  if (!existsSync3(CC_CONFIG_PATH)) return false;
   const config = readClaudeJson();
   if (!config.mcpServers || Object.keys(config.mcpServers).length === 0) return false;
   let removed = false;
@@ -459,7 +486,7 @@ function uninstallMcpConfig() {
   return true;
 }
 function inspectMcpConfig() {
-  if (!existsSync4(CC_CONFIG_PATH)) {
+  if (!existsSync3(CC_CONFIG_PATH)) {
     return { installed: false, configPath: CC_CONFIG_PATH };
   }
   const config = readClaudeJson();
@@ -475,7 +502,7 @@ var init_mcpConfig = __esm({
     "use strict";
     SYNKRO_MARKER3 = "__synkro_managed__";
     SYNKRO_SERVER_NAME = "synkro-guardrails";
-    CC_CONFIG_PATH = join2(homedir2(), ".claude.json");
+    CC_CONFIG_PATH = join2(homedir3(), ".claude.json");
   }
 });
 
@@ -675,7 +702,7 @@ synkro_post_with_retry() {
 });
 
 // cli/installer/hookScriptsTs.ts
-var SYNKRO_COMMON_TS, EDIT_PRECHECK_TS, CWE_PRECHECK_TS, CVE_PRECHECK_TS, BASH_JUDGE_TS, AGENT_JUDGE_TS, PLAN_JUDGE_TS, STOP_SUMMARY_TS, SESSION_START_TS, BASH_FOLLOWUP_TS, TRANSCRIPT_SYNC_TS, USER_PROMPT_SUBMIT_TS, CURSOR_BASH_JUDGE_TS, CURSOR_EDIT_PRECHECK_TS, CURSOR_EDIT_CAPTURE_TS, CURSOR_BASH_FOLLOWUP_TS;
+var SYNKRO_COMMON_TS, EDIT_PRECHECK_TS, CWE_PRECHECK_TS, CVE_PRECHECK_TS, BASH_JUDGE_TS, AGENT_JUDGE_TS, PLAN_JUDGE_TS, STOP_SUMMARY_TS, SESSION_START_TS, BASH_FOLLOWUP_TS, TRANSCRIPT_SYNC_TS, USER_PROMPT_SUBMIT_TS, CURSOR_BASH_JUDGE_TS, CURSOR_EDIT_PRECHECK_TS, CURSOR_EDIT_CAPTURE_TS, CURSOR_BASH_FOLLOWUP_TS, CURSOR_SESSION_START_TS;
 var init_hookScriptsTs = __esm({
   "cli/installer/hookScriptsTs.ts"() {
     "use strict";
@@ -855,7 +882,7 @@ export async function ensureFreshJwt(jwt: string): Promise<string> {
 
 export function detectRepo(cwd: string): string {
   try {
-    const url = execSync('git remote get-url origin', { cwd, timeout: 3000, encoding: 'utf-8' }).trim();
+    const url = execSync('git remote get-url origin 2>/dev/null', { cwd, timeout: 3000, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
     if (!url) return '';
     return url
       .replace(/^git@[^:]+:/, '')
@@ -2261,7 +2288,7 @@ async function main() {
     let installScanMsg = '';
     if (toolName === 'Bash') {
       const pkgInstallMatch = command.match(
-        /(?:npm\\s+(?:install|i|add)|pnpm\\s+(?:add|install|i)|yarn\\s+add|bun\\s+(?:add|install|i)|(?:uv\\s+)?pip3?\\s+install|go\\s+get|cargo\\s+add|gem\\s+install|composer\\s+require)\\s+(.+)/
+        /(?:npm\\s+(?:install|i|add)|pnpm\\s+(?:add|install|i)|yarn\\s+add|bun\\s+(?:add|install|i)|(?:uv\\s+)?pip3?\\s+install|go\\s+get|cargo\\s+add|gem\\s+install|composer\\s+require)\\s+([^|;&><]+)/
       );
       const isPip = /(?:uv\\s+)?pip3?\\s+install/.test(command);
       const isGo = command.match(/^go\\s+get/);
@@ -2275,6 +2302,7 @@ async function main() {
         let skipNext = false;
         for (const token of tokens) {
           if (skipNext) { skipNext = false; continue; }
+          if (!token || !/^[@a-zA-Z]/.test(token)) continue;
           if (token.startsWith('-')) {
             if (/^--(python|target|prefix|root|constraint|requirement|index-url|extra-index-url|find-links|build|src|cache-dir|filter|workspace)$/.test(token)) skipNext = true;
             continue;
@@ -2313,8 +2341,9 @@ async function main() {
                   warnings.push('\\u26a0 ' + pkg + ': package not found on PyPI \\u2014 may not exist');
                 }
               } else {
+                const verSlug = deps[pkg] !== '*' ? deps[pkg] : 'latest';
                 const [metaResp, dlResp] = await Promise.all([
-                  fetch('https://registry.npmjs.org/' + encodeURIComponent(pkg) + '/latest', { signal: AbortSignal.timeout(4000) }),
+                  fetch('https://registry.npmjs.org/' + encodeURIComponent(pkg) + '/' + verSlug, { signal: AbortSignal.timeout(4000) }),
                   fetch('https://api.npmjs.org/downloads/point/last-week/' + encodeURIComponent(pkg), { signal: AbortSignal.timeout(4000) }),
                 ]);
                 if (metaResp.ok) {
@@ -3737,6 +3766,42 @@ async function main() {
   }
 }
 
+main();
+`;
+    CURSOR_SESSION_START_TS = `#!/usr/bin/env bun
+import {
+  loadJwt, loadConfig, readStdin,
+  type HookConfig,
+} from './_synkro-common.ts';
+
+async function main() {
+  try {
+    const input = await readStdin();
+
+    let jwt = loadJwt();
+    const config: HookConfig = jwt ? await loadConfig(jwt) : {
+      captureDepth: 'local_only', tier: 'standard', silent: false,
+      policyName: '', rules: [], scanExemptions: [],
+    };
+
+    const policyName = config.policyName || 'default';
+    const ruleCount = config.rules.length;
+    const mode = config.silent ? 'silent' : 'active';
+
+    const context = [
+      'This session is monitored by Synkro (' + mode + ' mode, policy: "' + policyName + '", ' + ruleCount + ' rules).',
+      'Synkro enforces security and compliance rules on tool calls (shell commands, file edits).',
+      'If a tool call is blocked, Synkro will explain which rule was violated and why.',
+      'Do not suggest workarounds to bypass Synkro hooks \u2014 fix the underlying issue instead.',
+    ].join(' ');
+
+    const result = { additional_context: context };
+    process.stdout.write(JSON.stringify(result) + '\\n');
+  } catch {
+    process.stdout.write('{}\\n');
+  }
+}
+
 main();
 `;
   }
@@ -3744,8 +3809,8 @@ main();
 
 // cli/auth/stub.ts
 import { createServer } from "http";
-import { writeFileSync as writeFileSync4, readFileSync as readFileSync4, existsSync as existsSync5, mkdirSync as mkdirSync4, unlinkSync as unlinkSync2 } from "fs";
-import { homedir as homedir3, platform } from "os";
+import { writeFileSync as writeFileSync4, readFileSync as readFileSync4, existsSync as existsSync4, mkdirSync as mkdirSync4, unlinkSync as unlinkSync2 } from "fs";
+import { homedir as homedir4, platform } from "os";
 import { join as join3, dirname as dirname4 } from "path";
 import { execFile } from "child_process";
 import jwt from "jsonwebtoken";
@@ -3775,13 +3840,13 @@ function openBrowser(url) {
 }
 function saveCredentials(data) {
   const dir = dirname4(AUTH_FILE);
-  if (!existsSync5(dir)) {
+  if (!existsSync4(dir)) {
     mkdirSync4(dir, { recursive: true, mode: 448 });
   }
   writeFileSync4(AUTH_FILE, JSON.stringify(data, null, 2), { mode: 384 });
 }
 function loadCredentials() {
-  if (!existsSync5(AUTH_FILE)) {
+  if (!existsSync4(AUTH_FILE)) {
     return null;
   }
   try {
@@ -3798,7 +3863,7 @@ function createCallbackServer() {
     "Access-Control-Allow-Headers": "Content-Type",
     "Vary": "Origin"
   };
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const server = createServer((req, res) => {
       if (req.method === "OPTIONS") {
         const origin = req.headers.origin;
@@ -3887,7 +3952,7 @@ function createCallbackServer() {
         res.end(JSON.stringify({ ok: true }));
         setTimeout(() => {
           server.close();
-          resolve2(authData);
+          resolve3(authData);
         }, 200);
       });
       req.on("error", (e) => {
@@ -4029,7 +4094,7 @@ async function ensureValidToken() {
   return true;
 }
 function clearCredentials() {
-  if (existsSync5(AUTH_FILE)) {
+  if (existsSync4(AUTH_FILE)) {
     unlinkSync2(AUTH_FILE);
   }
 }
@@ -4040,7 +4105,7 @@ var init_stub = __esm({
     PORT = 8100;
     RAW_WEB_AUTH_URL = process.env.SYNKRO_WEB_AUTH_URL;
     SYNKRO_WEB_AUTH_URL = RAW_WEB_AUTH_URL && /^https?:\/\//.test(RAW_WEB_AUTH_URL) ? RAW_WEB_AUTH_URL : "https://app.synkro.sh";
-    AUTH_FILE = process.env.SYNKRO_AUTH_FILE || join3(homedir3(), ".synkro", "credentials.json");
+    AUTH_FILE = process.env.SYNKRO_AUTH_FILE || join3(homedir4(), ".synkro", "credentials.json");
     RAW_API_URL = process.env.SYNKRO_CRUD_URL || process.env.SYNKRO_API_URL;
     SYNKRO_API_URL = RAW_API_URL && /^https?:\/\//.test(RAW_API_URL) ? RAW_API_URL : "https://api.synkro.sh";
     ERROR_HTML = `
@@ -4203,7 +4268,7 @@ jobs:
 });
 
 // cli/installer/githubSetup.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "fs";
 import { execSync as execSync2 } from "child_process";
 import { join as join4 } from "path";
 function ghSecretSet(token, owner, repo, name, value) {
@@ -4260,7 +4325,7 @@ function writeWorkflowFile(repoRootPath) {
 function findGitRoot(startCwd) {
   let cur = startCwd;
   while (cur && cur !== "/") {
-    if (existsSync6(join4(cur, ".git"))) return cur;
+    if (existsSync5(join4(cur, ".git"))) return cur;
     const parent = join4(cur, "..");
     if (parent === cur) break;
     cur = parent;
@@ -4298,10 +4363,10 @@ function detectGitRepo() {
   }
 }
 function ask(rl, question) {
-  return new Promise((resolve2) => rl.question(question, resolve2));
+  return new Promise((resolve3) => rl.question(question, resolve3));
 }
 function waitForGithubToken() {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const server = createServer2((req, res) => {
       if (req.method === "OPTIONS") {
         res.writeHead(204, {
@@ -4338,7 +4403,7 @@ function waitForGithubToken() {
           });
           res.end(JSON.stringify({ ok: true }));
           setTimeout(() => server.close(), 200);
-          resolve2(parsed.github_token);
+          resolve3(parsed.github_token);
         } catch {
           res.writeHead(400, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ error: "invalid json" }));
@@ -4503,12 +4568,12 @@ __export(setupGithub_exports, {
 import { createInterface as createInterface2 } from "readline/promises";
 import { stdin as input, stdout as output } from "process";
 import { execSync as execSync4, spawn as nodeSpawn } from "child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync5, unlinkSync as unlinkSync3 } from "fs";
-import { homedir as homedir4, platform as platform2 } from "os";
+import { existsSync as existsSync6, readFileSync as readFileSync5, unlinkSync as unlinkSync3 } from "fs";
+import { homedir as homedir5, platform as platform2 } from "os";
 import { join as join5 } from "path";
 import { execFile as execFile2 } from "child_process";
 function readConfig() {
-  if (!existsSync7(CONFIG_PATH)) return {};
+  if (!existsSync6(CONFIG_PATH)) return {};
   const out = {};
   for (const line of readFileSync5(CONFIG_PATH, "utf-8").split("\n")) {
     const t = line.trim();
@@ -4523,7 +4588,7 @@ async function prompt(rl, q, opts = {}) {
     process.stdout.write(q);
     const wasRaw = process.stdin.isRaw;
     if (process.stdin.setRawMode) process.stdin.setRawMode(true);
-    return await new Promise((resolve2) => {
+    return await new Promise((resolve3) => {
       let chunk = "";
       const onData = (data) => {
         const s = data.toString("utf-8");
@@ -4531,7 +4596,7 @@ async function prompt(rl, q, opts = {}) {
           process.stdin.removeListener("data", onData);
           if (process.stdin.setRawMode) process.stdin.setRawMode(wasRaw ?? false);
           process.stdout.write("\n");
-          resolve2(chunk);
+          resolve3(chunk);
           return;
         }
         if (s === "") process.exit(130);
@@ -4572,7 +4637,7 @@ function sleep(ms) {
 }
 function captureClaudeSetupToken() {
   const tmpFile = join5(SYNKRO_DIR, `token-capture-${Date.now()}.raw`);
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const proc = nodeSpawn("script", ["-q", tmpFile, "claude", "setup-token"], {
       stdio: "inherit"
     });
@@ -4602,7 +4667,7 @@ function captureClaudeSetupToken() {
         reject(new Error(`Could not find token in claude setup-token output (file=${raw.length}b, yellow=${yellow.length}b)`));
         return;
       }
-      resolve2(token[0]);
+      resolve3(token[0]);
     });
   });
 }
@@ -4852,7 +4917,7 @@ var init_setupGithub = __esm({
     "use strict";
     init_githubSetup();
     init_stub();
-    SYNKRO_DIR = join5(homedir4(), ".synkro");
+    SYNKRO_DIR = join5(homedir5(), ".synkro");
     CONFIG_PATH = join5(SYNKRO_DIR, "config.env");
   }
 });
@@ -4881,11 +4946,11 @@ var init_promptFetcher = __esm({
 });
 
 // cli/local-cc/settings.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
-import { homedir as homedir5 } from "os";
+import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
+import { homedir as homedir6 } from "os";
 import { join as join6 } from "path";
 function isLocalCCEnabled() {
-  if (!existsSync8(CONFIG_PATH2)) return false;
+  if (!existsSync7(CONFIG_PATH2)) return false;
   try {
     const content = readFileSync6(CONFIG_PATH2, "utf-8");
     const match = content.match(/^SYNKRO_LOCAL_INFERENCE='([^']*)'/m);
@@ -4898,7 +4963,7 @@ var CONFIG_PATH2;
 var init_settings = __esm({
   "cli/local-cc/settings.ts"() {
     "use strict";
-    CONFIG_PATH2 = join6(homedir5(), ".synkro", "config.env");
+    CONFIG_PATH2 = join6(homedir6(), ".synkro", "config.env");
   }
 });
 
@@ -5052,9 +5117,9 @@ await mcp.connect(new StdioServerTransport());
 });
 
 // cli/local-cc/install.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, readFileSync as readFileSync7, chmodSync, copyFileSync, renameSync as renameSync4, unlinkSync as unlinkSync4, openSync, fsyncSync, closeSync } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, readFileSync as readFileSync7, chmodSync, copyFileSync, renameSync as renameSync4, unlinkSync as unlinkSync4, openSync, fsyncSync, closeSync } from "fs";
 import { join as join7 } from "path";
-import { homedir as homedir6 } from "os";
+import { homedir as homedir7 } from "os";
 import { spawnSync } from "child_process";
 function writePluginFiles() {
   mkdirSync6(SESSION_DIR, { recursive: true });
@@ -5103,7 +5168,7 @@ function runBunInstall() {
   }
 }
 function safelyMutateClaudeJson(mutator) {
-  if (!existsSync9(CLAUDE_JSON_PATH)) {
+  if (!existsSync8(CLAUDE_JSON_PATH)) {
     return;
   }
   const originalText = readFileSync7(CLAUDE_JSON_PATH, "utf-8");
@@ -5256,17 +5321,17 @@ var init_install = __esm({
   "cli/local-cc/install.ts"() {
     "use strict";
     init_channelSource();
-    CLAUDE_JSON_BACKUP_PATH = join7(homedir6(), ".claude.json.synkro-bak");
-    SESSION_DIR = join7(homedir6(), ".synkro", "cc_sessions");
+    CLAUDE_JSON_BACKUP_PATH = join7(homedir7(), ".claude.json.synkro-bak");
+    SESSION_DIR = join7(homedir7(), ".synkro", "cc_sessions");
     PLUGIN_PATH = join7(SESSION_DIR, "synkro-channel.ts");
     PLUGIN_PKG_PATH = join7(SESSION_DIR, "package.json");
     PLUGIN_SETTINGS_DIR = join7(SESSION_DIR, ".claude");
     PLUGIN_SETTINGS_PATH = join7(PLUGIN_SETTINGS_DIR, "settings.json");
     PROJECT_MCP_PATH = join7(SESSION_DIR, ".mcp.json");
-    CLAUDE_JSON_PATH = join7(homedir6(), ".claude.json");
+    CLAUDE_JSON_PATH = join7(homedir7(), ".claude.json");
     RUN_SCRIPT_PATH = join7(SESSION_DIR, "run-claude.sh");
     TMUX_SESSION_NAME = "synkro-local-cc";
-    SESSION_DIR_2 = join7(homedir6(), ".synkro", "cc_sessions_2");
+    SESSION_DIR_2 = join7(homedir7(), ".synkro", "cc_sessions_2");
     PLUGIN_PATH_2 = join7(SESSION_DIR_2, "synkro-channel.ts");
     PLUGIN_PKG_PATH_2 = join7(SESSION_DIR_2, "package.json");
     PLUGIN_SETTINGS_DIR_2 = join7(SESSION_DIR_2, ".claude");
@@ -5425,7 +5490,7 @@ log "tmux session ended."
 
 // cli/local-cc/pueue.ts
 import { execFileSync, spawnSync as spawnSync2, spawn } from "child_process";
-import { homedir as homedir7 } from "os";
+import { homedir as homedir8 } from "os";
 import { join as join8 } from "path";
 import { connect } from "net";
 function pueueAvailable() {
@@ -5542,14 +5607,14 @@ function ensureRunning(opts = {}) {
   return startTask(opts);
 }
 function probePort(host, port, timeoutMs = 500) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const sock = connect(port, host);
     const done = (ok) => {
       try {
         sock.destroy();
       } catch {
       }
-      resolve2(ok);
+      resolve3(ok);
     };
     sock.once("connect", () => done(true));
     sock.once("error", () => done(false));
@@ -5622,10 +5687,10 @@ var init_pueue = __esm({
     "use strict";
     TASK_LABEL = "synkro-local-cc";
     TMUX_SESSION = "synkro-local-cc";
-    SESSION_DIR2 = join8(homedir7(), ".synkro", "cc_sessions");
+    SESSION_DIR2 = join8(homedir8(), ".synkro", "cc_sessions");
     TASK_LABEL_2 = "synkro-local-cc-2";
     TMUX_SESSION_2 = "synkro-local-cc-2";
-    SESSION_DIR_22 = join8(homedir7(), ".synkro", "cc_sessions_2");
+    SESSION_DIR_22 = join8(homedir8(), ".synkro", "cc_sessions_2");
     PueueError = class extends Error {
       constructor(message, cause) {
         super(message);
@@ -5641,7 +5706,7 @@ var init_pueue = __esm({
 
 // cli/local-cc/prompts.ts
 import { readFileSync as readFileSync8 } from "fs";
-import { homedir as homedir8 } from "os";
+import { homedir as homedir9 } from "os";
 import { join as join9 } from "path";
 async function fetchPrimers() {
   let jwt2 = "";
@@ -5684,7 +5749,7 @@ var CREDS_PATH, CHANNEL_REPLY_INSTRUCTIONS;
 var init_prompts = __esm({
   "cli/local-cc/prompts.ts"() {
     "use strict";
-    CREDS_PATH = join9(homedir8(), ".synkro", "credentials.json");
+    CREDS_PATH = join9(homedir9(), ".synkro", "credentials.json");
     CHANNEL_REPLY_INSTRUCTIONS = `
 DELIVERY METHOD \u2014 MANDATORY, OVERRIDES ALL OTHER OUTPUT RULES:
 You are running inside a Synkro MCP channel. Do NOT output your verdict as text.
@@ -5696,9 +5761,9 @@ Any text output is silently discarded. Only the reply tool call is captured.`;
 });
 
 // cli/local-cc/turnLog.ts
-import { appendFileSync, existsSync as existsSync10, mkdirSync as mkdirSync7, openSync as openSync2, readFileSync as readFileSync9, readSync, closeSync as closeSync2, statSync, watchFile, unwatchFile } from "fs";
+import { appendFileSync, existsSync as existsSync9, mkdirSync as mkdirSync7, openSync as openSync2, readFileSync as readFileSync9, readSync, closeSync as closeSync2, statSync, watchFile, unwatchFile } from "fs";
 import { dirname as dirname5, join as join10 } from "path";
-import { homedir as homedir9 } from "os";
+import { homedir as homedir10 } from "os";
 function truncate(s, max = PREVIEW_MAX) {
   if (s.length <= max) return s;
   return s.slice(0, max) + "\u2026 [+" + (s.length - max) + " chars]";
@@ -5734,7 +5799,7 @@ function appendTurn(args2) {
   }
 }
 function readRecentTurns(n = 20) {
-  if (!existsSync10(TURN_LOG_PATH)) return [];
+  if (!existsSync9(TURN_LOG_PATH)) return [];
   try {
     const size = statSync(TURN_LOG_PATH).size;
     if (size === 0) return [];
@@ -5755,7 +5820,7 @@ function readRecentTurns(n = 20) {
 function followTurns(onEntry) {
   try {
     mkdirSync7(dirname5(TURN_LOG_PATH), { recursive: true });
-    if (!existsSync10(TURN_LOG_PATH)) {
+    if (!existsSync9(TURN_LOG_PATH)) {
       appendFileSync(TURN_LOG_PATH, "", "utf-8");
     }
   } catch {
@@ -5817,7 +5882,7 @@ var TURN_LOG_PATH, PREVIEW_MAX;
 var init_turnLog = __esm({
   "cli/local-cc/turnLog.ts"() {
     "use strict";
-    TURN_LOG_PATH = join10(homedir9(), ".synkro", "cc_sessions", "turns.log");
+    TURN_LOG_PATH = join10(homedir10(), ".synkro", "cc_sessions", "turns.log");
     PREVIEW_MAX = 400;
   }
 });
@@ -5832,7 +5897,7 @@ async function submitToChannel(role, payload, opts = {}) {
   const port = opts.port ?? CHANNEL_PORT;
   const startedAt = Date.now();
   try {
-    const result = await new Promise((resolve2, reject) => {
+    const result = await new Promise((resolve3, reject) => {
       const req = httpRequest({
         host: CHANNEL_HOST,
         port,
@@ -5858,7 +5923,7 @@ async function submitToChannel(role, payload, opts = {}) {
               reject(new LocalCCError(parsed.error));
               return;
             }
-            resolve2(String(parsed.result ?? ""));
+            resolve3(String(parsed.result ?? ""));
           } catch (err) {
             reject(new LocalCCError(`malformed channel response: ${text.slice(0, 200)}`, err));
           }
@@ -5884,14 +5949,14 @@ async function submitToChannel(role, payload, opts = {}) {
   }
 }
 function isChannelAvailable(port = CHANNEL_PORT, timeoutMs = 500) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const sock = connect2(port, CHANNEL_HOST);
     const done = (ok) => {
       try {
         sock.destroy();
       } catch {
       }
-      resolve2(ok);
+      resolve3(ok);
     };
     sock.once("connect", () => done(true));
     sock.once("error", () => done(false));
@@ -5924,8 +5989,8 @@ __export(install_exports, {
   installCommand: () => installCommand,
   parseArgs: () => parseArgs
 });
-import { existsSync as existsSync11, mkdirSync as mkdirSync8, writeFileSync as writeFileSync7, chmodSync as chmodSync2, readFileSync as readFileSync10, readdirSync, appendFileSync as appendFileSync2, renameSync as renameSync5 } from "fs";
-import { homedir as homedir10 } from "os";
+import { existsSync as existsSync10, mkdirSync as mkdirSync8, writeFileSync as writeFileSync7, chmodSync as chmodSync2, readFileSync as readFileSync10, readdirSync, appendFileSync as appendFileSync2, renameSync as renameSync5 } from "fs";
+import { homedir as homedir11 } from "os";
 import { join as join11 } from "path";
 import { execSync as execSync5, spawnSync as spawnSync3, spawn as spawn2 } from "child_process";
 import { createInterface as createInterface3 } from "readline";
@@ -5951,13 +6016,13 @@ function parseArgs(argv) {
 }
 async function promptTranscriptConsent() {
   const rl = createInterface3({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     rl.question(
       "Would you like Synkro to use Claude Code session transcripts\nto generate guardrail rules and policies for your team? (Y/n) ",
       (answer) => {
         rl.close();
         const trimmed = answer.trim().toLowerCase();
-        resolve2(trimmed === "" || trimmed === "y" || trimmed === "yes");
+        resolve3(trimmed === "" || trimmed === "y" || trimmed === "yes");
       }
     );
   });
@@ -5986,6 +6051,7 @@ function writeHookScripts() {
   const cursorEditPrecheckPath = join11(HOOKS_DIR, "cursor-edit-precheck.ts");
   const cursorEditCapturePath = join11(HOOKS_DIR, "cursor-edit-capture.ts");
   const cursorBashFollowupPath = join11(HOOKS_DIR, "cursor-bash-followup.ts");
+  const cursorSessionStartPath = join11(HOOKS_DIR, "cursor-session-start.ts");
   const mcpLocalServerPath = join11(HOOKS_DIR, "mcp-local-server.ts");
   writeFileSync7(bashScriptPath, BASH_JUDGE_TS, "utf-8");
   writeFileSync7(bashFollowupScriptPath, BASH_FOLLOWUP_TS, "utf-8");
@@ -6004,6 +6070,7 @@ function writeHookScripts() {
   writeFileSync7(cursorEditPrecheckPath, CURSOR_EDIT_PRECHECK_TS, "utf-8");
   writeFileSync7(cursorEditCapturePath, CURSOR_EDIT_CAPTURE_TS, "utf-8");
   writeFileSync7(cursorBashFollowupPath, CURSOR_BASH_FOLLOWUP_TS, "utf-8");
+  writeFileSync7(cursorSessionStartPath, CURSOR_SESSION_START_TS, "utf-8");
   writeFileSync7(mcpLocalServerPath, `#!/usr/bin/env bun
 /**
  * Local MCP guardrails server \u2014 runs on port 8931, stores rules in ~/.synkro/rules.json.
@@ -6827,6 +6894,7 @@ console.log(\`[synkro] local MCP guardrails server listening on http://127.0.0.1
   chmodSync2(cursorEditPrecheckPath, 493);
   chmodSync2(cursorEditCapturePath, 493);
   chmodSync2(cursorBashFollowupPath, 493);
+  chmodSync2(cursorSessionStartPath, 493);
   chmodSync2(mcpLocalServerPath, 493);
   return {
     bashScript: bashScriptPath,
@@ -6844,6 +6912,7 @@ console.log(\`[synkro] local MCP guardrails server listening on http://127.0.0.1
     cursorEditPrecheckScript: cursorEditPrecheckPath,
     cursorEditCaptureScript: cursorEditCapturePath,
     cursorBashFollowupScript: cursorBashFollowupPath,
+    cursorSessionStartScript: cursorSessionStartPath,
     mcpLocalServerScript: mcpLocalServerPath
   };
 }
@@ -6856,7 +6925,7 @@ function shellQuoteSingle(value) {
 }
 function resolveSynkroBundle() {
   const scriptPath = process.argv[1];
-  if (scriptPath && existsSync11(scriptPath)) return scriptPath;
+  if (scriptPath && existsSync10(scriptPath)) return scriptPath;
   return null;
 }
 function writeConfigEnv(opts) {
@@ -6876,7 +6945,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.4.66")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.4.67")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -6891,7 +6960,7 @@ function writeConfigEnv(opts) {
   chmodSync2(CONFIG_PATH3, 384);
 }
 function updateLocalInferenceFlag(enabled) {
-  if (!existsSync11(CONFIG_PATH3)) return;
+  if (!existsSync10(CONFIG_PATH3)) return;
   let content = readFileSync10(CONFIG_PATH3, "utf-8");
   const flag = enabled ? "yes" : "no";
   if (content.includes("SYNKRO_LOCAL_INFERENCE=")) {
@@ -6921,7 +6990,7 @@ function collectLocalMetadata() {
     meta.cc_version = execSync5("claude --version", { encoding: "utf-8", timeout: 5e3 }).trim().split("\n")[0];
   } catch {
   }
-  const claudeDir = join11(homedir10(), ".claude");
+  const claudeDir = join11(homedir11(), ".claude");
   try {
     const settings = JSON.parse(readFileSync10(join11(claudeDir, "settings.json"), "utf-8"));
     const plugins = Object.keys(settings.enabledPlugins ?? {}).filter((k) => settings.enabledPlugins[k]);
@@ -7011,10 +7080,10 @@ function isAlreadyInstalled() {
     join11(HOOKS_DIR, "cc-stop-summary.ts"),
     join11(HOOKS_DIR, "cc-session-start.ts")
   ];
-  if (!requiredScripts.every((p) => existsSync11(p))) return false;
-  if (!existsSync11(CONFIG_PATH3)) return false;
-  const settingsPath = join11(homedir10(), ".claude", "settings.json");
-  if (!existsSync11(settingsPath)) return false;
+  if (!requiredScripts.every((p) => existsSync10(p))) return false;
+  if (!existsSync10(CONFIG_PATH3)) return false;
+  const settingsPath = join11(homedir11(), ".claude", "settings.json");
+  if (!existsSync10(settingsPath)) return false;
   try {
     const settings = JSON.parse(readFileSync10(settingsPath, "utf-8"));
     const hooks = settings?.hooks;
@@ -7048,8 +7117,8 @@ function printChannelDiagnostics() {
         }
       }
     }
-    const logPath = join11(homedir10(), ".synkro", "cc_sessions", "run-claude.log");
-    if (existsSync11(logPath)) {
+    const logPath = join11(homedir11(), ".synkro", "cc_sessions", "run-claude.log");
+    if (existsSync10(logPath)) {
       const logContent = readFileSync10(logPath, "utf-8").trim().split("\n").slice(-10);
       console.warn(`    run-claude.log:`);
       for (const line of logContent) console.warn(`      ${line}`);
@@ -7059,7 +7128,7 @@ function printChannelDiagnostics() {
   console.warn(`    Run \`synkro local-cc status\` and \`synkro local-cc logs --tmux\` to debug.`);
 }
 async function backfillLocalRules(gatewayUrl, token) {
-  if (existsSync11(RULES_PATH)) {
+  if (existsSync10(RULES_PATH)) {
     console.log("  Local rules already exist \u2014 skipping cloud backfill.");
     return;
   }
@@ -7123,7 +7192,7 @@ async function backfillLocalRules(gatewayUrl, token) {
 }
 async function startLocalMcpServer() {
   const serverScript = join11(HOOKS_DIR, "mcp-local-server.ts");
-  if (!existsSync11(serverScript)) {
+  if (!existsSync10(serverScript)) {
     console.warn("  \u26A0 Local MCP server script not found \u2014 skipping.");
     return;
   }
@@ -7329,7 +7398,8 @@ async function installCommand(opts = {}) {
         bashJudgeScriptPath: scripts.cursorBashJudgeScript,
         editPrecheckScriptPath: scripts.cursorEditPrecheckScript,
         editCaptureScriptPath: scripts.cursorEditCaptureScript,
-        bashFollowupScriptPath: scripts.cursorBashFollowupScript
+        bashFollowupScriptPath: scripts.cursorBashFollowupScript,
+        sessionStartScriptPath: scripts.cursorSessionStartScript
       });
       console.log(`Configured ${agent.name} hooks at ${agent.settingsPath}`);
     }
@@ -7542,8 +7612,8 @@ function detectGitRepo2() {
 function getClaudeProjectsFolder() {
   const cwd = process.cwd();
   const sanitized = "-" + cwd.replace(/\//g, "-");
-  const projectsDir = join11(homedir10(), ".claude", "projects", sanitized);
-  return existsSync11(projectsDir) ? projectsDir : null;
+  const projectsDir = join11(homedir11(), ".claude", "projects", sanitized);
+  return existsSync10(projectsDir) ? projectsDir : null;
 }
 function extractSessionInsights(projectsDir) {
   const insights = [];
@@ -7738,7 +7808,7 @@ var init_install2 = __esm({
     init_install();
     init_pueue();
     init_client();
-    SYNKRO_DIR2 = join11(homedir10(), ".synkro");
+    SYNKRO_DIR2 = join11(homedir11(), ".synkro");
     HOOKS_DIR = join11(SYNKRO_DIR2, "hooks");
     BIN_DIR = join11(SYNKRO_DIR2, "bin");
     CONFIG_PATH3 = join11(SYNKRO_DIR2, "config.env");
@@ -7820,11 +7890,11 @@ var status_exports = {};
 __export(status_exports, {
   statusCommand: () => statusCommand
 });
-import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
-import { homedir as homedir11 } from "os";
+import { existsSync as existsSync11, readFileSync as readFileSync11 } from "fs";
+import { homedir as homedir12 } from "os";
 import { join as join12 } from "path";
 function readConfigEnv() {
-  if (!existsSync12(CONFIG_PATH4)) return {};
+  if (!existsSync11(CONFIG_PATH4)) return {};
   const out = {};
   const raw = readFileSync11(CONFIG_PATH4, "utf-8");
   for (const line of raw.split("\n")) {
@@ -7933,12 +8003,12 @@ async function statusCommand() {
   console.log("Hook scripts (Claude Code):");
   for (const f of ccHooks) {
     const p = join12(HOOKS_DIR2, f);
-    console.log(`  ${existsSync12(p) ? "\u2713" : "\u2717"} ${p}`);
+    console.log(`  ${existsSync11(p) ? "\u2713" : "\u2717"} ${p}`);
   }
   console.log("Hook scripts (Cursor):");
   for (const f of cursorHooks) {
     const p = join12(HOOKS_DIR2, f);
-    console.log(`  ${existsSync12(p) ? "\u2713" : "\u2717"} ${p}`);
+    console.log(`  ${existsSync11(p) ? "\u2713" : "\u2717"} ${p}`);
   }
   console.log();
   if (localInference) {
@@ -7981,7 +8051,7 @@ var init_status = __esm({
     init_cursorHookConfig();
     init_mcpConfig();
     init_pueue();
-    SYNKRO_DIR3 = join12(homedir11(), ".synkro");
+    SYNKRO_DIR3 = join12(homedir12(), ".synkro");
     CONFIG_PATH4 = join12(SYNKRO_DIR3, "config.env");
   }
 });
@@ -8014,7 +8084,7 @@ __export(unlink_exports, {
 });
 import { createInterface as createInterface4 } from "readline";
 function ask2(rl, question) {
-  return new Promise((resolve2) => rl.question(question, resolve2));
+  return new Promise((resolve3) => rl.question(question, resolve3));
 }
 async function unlinkCommand() {
   if (!isAuthenticated()) {
@@ -8071,11 +8141,11 @@ var config_exports = {};
 __export(config_exports, {
   configCommand: () => configCommand
 });
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync8, existsSync as existsSync13 } from "fs";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync8, existsSync as existsSync12 } from "fs";
 import { join as join13 } from "path";
-import { homedir as homedir12 } from "os";
+import { homedir as homedir13 } from "os";
 function readConfigEnv2() {
-  if (!existsSync13(CONFIG_PATH5)) return {};
+  if (!existsSync12(CONFIG_PATH5)) return {};
   const out = {};
   for (const line of readFileSync12(CONFIG_PATH5, "utf-8").split("\n")) {
     const t = line.trim();
@@ -8086,7 +8156,7 @@ function readConfigEnv2() {
   return out;
 }
 function updateConfigValue(key, value) {
-  if (!existsSync13(CONFIG_PATH5)) {
+  if (!existsSync12(CONFIG_PATH5)) {
     console.error("No config found. Run `synkro install` first.");
     process.exit(1);
   }
@@ -8157,7 +8227,7 @@ var init_config = __esm({
   "cli/commands/config.ts"() {
     "use strict";
     init_stub();
-    SYNKRO_DIR4 = join13(homedir12(), ".synkro");
+    SYNKRO_DIR4 = join13(homedir13(), ".synkro");
     CONFIG_PATH5 = join13(SYNKRO_DIR4, "config.env");
   }
 });
@@ -8168,7 +8238,7 @@ __export(scanPr_exports, {
   scanPrCommand: () => scanPrCommand
 });
 import { execSync as execSync6, spawn as spawn3 } from "child_process";
-import { readFileSync as readFileSync13, existsSync as existsSync14 } from "fs";
+import { readFileSync as readFileSync13, existsSync as existsSync13 } from "fs";
 import { join as join14 } from "path";
 function parseMatchSpec(condition) {
   if (!condition.startsWith("match_spec:")) return null;
@@ -8376,7 +8446,7 @@ function spawnClaudeJudge(file, claudeToken, promptHeader) {
 Diff:
 ${hunks}`;
   const fullPrompt = promptHeader + userMessage;
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const t0 = Date.now();
     const proc = spawn3(
       "claude",
@@ -8404,7 +8474,7 @@ ${hunks}`;
       const latencyMs = Date.now() - t0;
       if (code !== 0) {
         console.warn(`  claude exited ${code}: ${(stderr || stdout).slice(0, 500)}`);
-        resolve2({ findings: [], latencyMs });
+        resolve3({ findings: [], latencyMs });
         return;
       }
       try {
@@ -8423,10 +8493,10 @@ ${hunks}`;
           description: f.description,
           fix: f.fix
         }));
-        resolve2({ findings, latencyMs });
+        resolve3({ findings, latencyMs });
       } catch (parseErr) {
         console.warn(`  failed to parse claude response: ${stdout.slice(0, 300)}`);
-        resolve2({ findings: [], latencyMs });
+        resolve3({ findings: [], latencyMs });
       }
     });
   });
@@ -8475,7 +8545,7 @@ ${JSON.stringify(findings, null, 2)}
 `;
 }
 function spawnOpusConsolidator(findings, claudeToken) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const prompt2 = buildConsolidationPrompt(findings);
     const proc = spawn3(
       "claude",
@@ -8502,7 +8572,7 @@ function spawnOpusConsolidator(findings, claudeToken) {
     proc.on("close", (code) => {
       if (code !== 0) {
         console.warn(`  opus consolidation exited ${code}: ${(stderr || stdout).slice(0, 300)}`);
-        resolve2(fallbackReview(findings));
+        resolve3(fallbackReview(findings));
         return;
       }
       try {
@@ -8523,10 +8593,10 @@ function spawnOpusConsolidator(findings, claudeToken) {
           const order = ["low", "medium", "high", "critical"];
           return order.indexOf(f.severity) > order.indexOf(max) ? f.severity : max;
         }, "low");
-        resolve2({ summary: review.summary || "", comments, severity: maxSeverity });
+        resolve3({ summary: review.summary || "", comments, severity: maxSeverity });
       } catch {
         console.warn(`  failed to parse opus response, using fallback`);
-        resolve2(fallbackReview(findings));
+        resolve3(fallbackReview(findings));
       }
     });
   });
@@ -8649,7 +8719,7 @@ function shouldFail(findings, threshold) {
 }
 function readRepoDeps() {
   const pkgPath = join14(process.cwd(), "package.json");
-  if (!existsSync14(pkgPath)) return {};
+  if (!existsSync13(pkgPath)) return {};
   try {
     const pkg = JSON.parse(readFileSync13(pkgPath, "utf-8"));
     return { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
@@ -8913,8 +8983,8 @@ var disconnect_exports = {};
 __export(disconnect_exports, {
   disconnectCommand: () => disconnectCommand
 });
-import { existsSync as existsSync15, rmSync } from "fs";
-import { homedir as homedir13 } from "os";
+import { existsSync as existsSync14, rmSync } from "fs";
+import { homedir as homedir14 } from "os";
 import { join as join15 } from "path";
 function tearDownLocalCC() {
   let hadTask = false;
@@ -8951,13 +9021,13 @@ function disconnectCommand(args2 = []) {
     console.log(`${mcpRemoved ? "\u2713" : "\xB7"} MCP guardrails server: ${mcpRemoved ? "removed entry from ~/.claude.json" : "no Synkro MCP entry found"}`);
   }
   if (purge) {
-    if (existsSync15(SYNKRO_DIR5)) {
+    if (existsSync14(SYNKRO_DIR5)) {
       rmSync(SYNKRO_DIR5, { recursive: true, force: true });
       console.log(`\u2713 Removed ${SYNKRO_DIR5}`);
     } else {
       console.log(`\xB7 ${SYNKRO_DIR5} already gone, nothing to remove`);
     }
-  } else if (existsSync15(SYNKRO_DIR5)) {
+  } else if (existsSync14(SYNKRO_DIR5)) {
     console.log(`Config preserved at ${SYNKRO_DIR5}. Run with --purge to remove.`);
   }
   console.log("\nSynkro disconnected.");
@@ -8972,7 +9042,7 @@ var init_disconnect = __esm({
     init_mcpConfig();
     init_pueue();
     init_install();
-    SYNKRO_DIR5 = join15(homedir13(), ".synkro");
+    SYNKRO_DIR5 = join15(homedir14(), ".synkro");
   }
 });
 
@@ -9019,9 +9089,9 @@ __export(localCc_exports, {
   localCcCommand: () => localCcCommand
 });
 import { spawnSync as spawnSync4 } from "child_process";
-import { homedir as homedir14 } from "os";
+import { homedir as homedir15 } from "os";
 import { join as join16 } from "path";
-import { existsSync as existsSync16, readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "fs";
 function printHelp() {
   console.log(`synkro local-cc \u2014 manage the local Claude Code inference session
 
@@ -9111,14 +9181,14 @@ TROUBLESHOOTING
 `);
 }
 function readGatewayUrl() {
-  if (existsSync16(CONFIG_PATH6)) {
+  if (existsSync15(CONFIG_PATH6)) {
     const m = readFileSync14(CONFIG_PATH6, "utf-8").match(/^SYNKRO_GATEWAY_URL='([^']*)'/m);
     if (m) return m[1];
   }
   return "https://api.synkro.sh";
 }
 function updateLocalInferenceFlag2(enabled) {
-  if (!existsSync16(CONFIG_PATH6)) return;
+  if (!existsSync15(CONFIG_PATH6)) return;
   let content = readFileSync14(CONFIG_PATH6, "utf-8");
   const flag = enabled ? "yes" : "no";
   if (content.includes("SYNKRO_LOCAL_INFERENCE=")) {
@@ -9348,7 +9418,7 @@ function cmdLogs(rest) {
     if (!raw) console.log("  " + colorize("(use --raw / -r to see full payloads, --live / -f to follow)", 90));
     return;
   }
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     console.log("  " + colorize("\u2014 following new turns (Ctrl-C to exit) \u2014", 90));
     const stop = followTurns((t) => {
       console.log("  " + formatTurn(t, raw));
@@ -9356,7 +9426,7 @@ function cmdLogs(rest) {
     const onSigint = () => {
       stop();
       process.removeListener("SIGINT", onSigint);
-      resolve2();
+      resolve3();
     };
     process.on("SIGINT", onSigint);
   });
@@ -9453,7 +9523,7 @@ var init_localCc = __esm({
     init_settings();
     init_client();
     init_stub();
-    CONFIG_PATH6 = join16(homedir14(), ".synkro", "config.env");
+    CONFIG_PATH6 = join16(homedir15(), ".synkro", "config.env");
   }
 });
 
@@ -9463,10 +9533,10 @@ __export(grade_exports, {
   gradeCommand: () => gradeCommand
 });
 async function readStdin() {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const chunks = [];
     process.stdin.on("data", (c) => chunks.push(c));
-    process.stdin.on("end", () => resolve2(Buffer.concat(chunks).toString("utf-8")));
+    process.stdin.on("end", () => resolve3(Buffer.concat(chunks).toString("utf-8")));
     process.stdin.on("error", reject);
   });
 }
@@ -9507,14 +9577,14 @@ var init_grade = __esm({
 });
 
 // cli/bootstrap.js
-import { readFileSync as readFileSync15, existsSync as existsSync17 } from "fs";
-import { resolve } from "path";
+import { readFileSync as readFileSync15, existsSync as existsSync16 } from "fs";
+import { resolve as resolve2 } from "path";
 var envCandidates = [
-  resolve(process.cwd(), ".env"),
-  resolve(process.env.HOME ?? "", ".synkro", "config.env")
+  resolve2(process.cwd(), ".env"),
+  resolve2(process.env.HOME ?? "", ".synkro", "config.env")
 ];
 for (const envPath of envCandidates) {
-  if (!existsSync17(envPath)) continue;
+  if (!existsSync16(envPath)) continue;
   const envContent = readFileSync15(envPath, "utf-8");
   for (const line of envContent.split("\n")) {
     const trimmed = line.trim();