@synkro-sh/cli 1.4.9 → 1.4.11

package/dist/bootstrap.js

@@ -132,7 +132,7 @@ function installCCHooks(settingsPath, config) {
       {
         type: "command",
         command: config.bashJudgeScriptPath,
-        timeout: 15
+        timeout: 30
       }
     ],
     [SYNKRO_MARKER]: true
@@ -709,8 +709,17 @@ ensure_fresh_jwt() {
 
 ensure_fresh_jwt
 
-# Resolve tier + capture_depth live from /cli/me every call. Default to local_only (fail-safe).
-ME_RESP=$(curl -sS "\${GATEWAY_URL}/api/v1/cli/me" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null || echo "")
+# Parallel fetch: /cli/me + rules in background, wait for both.
+_ME_TMP=$(mktemp -t synkro-me.XXXXXX)
+_RULES_TMP=$(mktemp -t synkro-rules.XXXXXX)
+trap "rm -f \\"$_ME_TMP\\" \\"$_RULES_TMP\\"" EXIT
+curl -sS "\${GATEWAY_URL}/api/v1/cli/me" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null > "$_ME_TMP" &
+_ME_PID=$!
+curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null > "$_RULES_TMP" &
+_RULES_PID=$!
+wait $_ME_PID 2>/dev/null; wait $_RULES_PID 2>/dev/null
+
+ME_RESP=$(cat "$_ME_TMP" 2>/dev/null || echo "")
 SYNKRO_INFERENCE_TIER=$(echo "$ME_RESP" | jq -r '.tier // empty' 2>/dev/null)
 SYNKRO_CAPTURE_DEPTH=$(echo "$ME_RESP" | jq -r '.capture_depth // empty' 2>/dev/null)
 SYNKRO_INFERENCE_TIER="\${SYNKRO_INFERENCE_TIER:-fast}"
@@ -721,32 +730,14 @@ if command -v claude >/dev/null 2>&1; then
   USE_LOCAL=true
 fi
 
-# Prefer local grading whenever it's available \u2014 the local-cc channel beats
-# the cloud fast tier on latency, and it's available regardless of the
-# server-assigned tier. Fall through to the cloud curl only when neither
-# the channel nor a usable \`claude\` CLI is reachable.
 if synkro_channel_up || { [ "$SYNKRO_INFERENCE_TIER" = "free" ] && command -v claude >/dev/null 2>&1; }; then
-  # \u2500\u2500\u2500 LOCAL PATH: channel-grader first, then \`claude --print\` cold fallback. \u2500\u2500\u2500
-
   RULES_CACHE="$HOME/.synkro/.rules-cache-bash"
-  ORG_RULES="[]"
-  if [ "$SYNKRO_CAPTURE_DEPTH" = "local_only" ]; then
-    ORG_RULES=$(curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules" \\
-      -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null \\
-      | jq -c '[.rules[]? | select(.hook_stage == "pre" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category}]' 2>/dev/null || echo "[]")
-    if [ -n "$ORG_RULES" ] && [ "$ORG_RULES" != "null" ] && [ "$ORG_RULES" != "[]" ]; then
-      printf '%s' "$ORG_RULES" > "$RULES_CACHE" 2>/dev/null || true
-    elif [ -f "$RULES_CACHE" ]; then
-      ORG_RULES=$(cat "$RULES_CACHE" 2>/dev/null || echo "[]")
-    fi
-  else
-    ORG_RULES=$(printf '%s' "$COMMAND" | head -c 4000 \\
-      | jq -Rs '{content: .}' \\
-      | curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules?top_k=15" \\
-      -X POST -H "Content-Type: application/json" \\
-      -H "Authorization: Bearer $JWT" \\
-      -d @- --max-time 2 2>/dev/null \\
-      | jq -c '[.rules[]? | select(.hook_stage == "pre" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category}]' 2>/dev/null || echo "[]")
+  RULES_JQ='[.rules[]? | select(.hook_stage == "pre" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category}]'
+  ORG_RULES=$(jq -c "$RULES_JQ" "$_RULES_TMP" 2>/dev/null || echo "[]")
+  if [ -n "$ORG_RULES" ] && [ "$ORG_RULES" != "null" ] && [ "$ORG_RULES" != "[]" ]; then
+    printf '%s' "$ORG_RULES" > "$RULES_CACHE" 2>/dev/null || true
+  elif [ -f "$RULES_CACHE" ]; then
+    ORG_RULES=$(cat "$RULES_CACHE" 2>/dev/null || echo "[]")
   fi
   if [ -z "$ORG_RULES" ] || [ "$ORG_RULES" = "null" ]; then ORG_RULES="[]"; fi
 
@@ -831,7 +822,9 @@ if [ "$VERDICT" != "__LOCAL_XML_PARSED__" ]; then
   ALTERNATIVE=$(echo "$VERDICT" | jq -r '.alternative // ""' 2>/dev/null)
   CATEGORY=$(echo "$VERDICT" | jq -r '.category // "destructive_command"' 2>/dev/null)
   RISK_LEVEL=$(echo "$VERDICT" | jq -r '.risk_level // empty' 2>/dev/null)
+  VIOLATED_RULES=$(echo "$VERDICT" | jq -c '.violated_rules // []' 2>/dev/null)
 fi
+VIOLATED_RULES="\${VIOLATED_RULES:-[]}"
 # Defaults if any var is empty (defensive \u2014 XML primer should always emit them).
 SEVERITY="\${SEVERITY:-audit}"
 VERDICT_KIND="\${VERDICT_KIND:-warn}"
@@ -951,6 +944,7 @@ if [ "$USE_LOCAL" = "true" ] && [ -n "$VERDICT_KIND" ]; then
       --arg reasoning "$REASONING" \\
       --arg alternative "$ALTERNATIVE" \\
       --argjson rules_checked "\${ORG_RULES:-[]}" \\
+      --argjson violated_rules "\${VIOLATED_RULES:-[]}" \\
       --argjson recent_user_messages "\${RECENT_USER_MESSAGES:-[]}" \\
       '{
         event_id: $event_id,
@@ -963,7 +957,8 @@ if [ "$USE_LOCAL" = "true" ] && [ -n "$VERDICT_KIND" ]; then
         model: $model,
         tool_name: $tool_name,
         capture_depth: $capture_depth,
-        rules_checked: $rules_checked
+        rules_checked: $rules_checked,
+        violated_rules: $violated_rules
       } + (if $repo != "" then {repo: $repo} else {} end)
         + (if $session_id != "" then {session_id: $session_id} else {} end)
         + (if $tool_use_id != "" then {tool_use_id: $tool_use_id} else {} end)
@@ -1217,34 +1212,30 @@ ensure_fresh_jwt() {
 ensure_fresh_jwt
 
 
-# Resolve tier + capture_depth live from /cli/me every call. Default to local_only (fail-safe).
-ME_RESP=$(curl -sS "\${GATEWAY_URL}/api/v1/cli/me" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null || echo "")
+# Parallel fetch: /cli/me + rules in background, wait for both.
+_ME_TMP=$(mktemp -t synkro-me.XXXXXX)
+_RULES_TMP=$(mktemp -t synkro-rules.XXXXXX)
+trap "rm -f \\"$_ME_TMP\\" \\"$_RULES_TMP\\"" EXIT
+curl -sS "\${GATEWAY_URL}/api/v1/cli/me" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null > "$_ME_TMP" &
+_ME_PID=$!
+curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null > "$_RULES_TMP" &
+_RULES_PID=$!
+wait $_ME_PID 2>/dev/null; wait $_RULES_PID 2>/dev/null
+
+ME_RESP=$(cat "$_ME_TMP" 2>/dev/null || echo "")
 SYNKRO_INFERENCE_TIER=$(echo "$ME_RESP" | jq -r '.tier // empty' 2>/dev/null)
 SYNKRO_CAPTURE_DEPTH=$(echo "$ME_RESP" | jq -r '.capture_depth // empty' 2>/dev/null)
 SYNKRO_INFERENCE_TIER="\${SYNKRO_INFERENCE_TIER:-fast}"
 SYNKRO_CAPTURE_DEPTH="\${SYNKRO_CAPTURE_DEPTH:-local_only}"
 
 if synkro_channel_up || { [ "$SYNKRO_INFERENCE_TIER" = "free" ] && command -v claude >/dev/null 2>&1; }; then
-  # \u2500\u2500\u2500 LOCAL PATH: channel-grader first, then \`claude --print\` cold fallback. \u2500\u2500\u2500
   RULES_CACHE="$HOME/.synkro/.rules-cache-edit"
-  ORG_RULES="[]"
-  if [ "$SYNKRO_CAPTURE_DEPTH" = "local_only" ]; then
-    ORG_RULES=$(curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules" \\
-      -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null \\
-      | jq -c '[.rules[]? | select(.hook_stage == "pre" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category, mode}]' 2>/dev/null || echo "[]")
-    if [ -n "$ORG_RULES" ] && [ "$ORG_RULES" != "null" ] && [ "$ORG_RULES" != "[]" ]; then
-      printf '%s' "$ORG_RULES" > "$RULES_CACHE" 2>/dev/null || true
-    elif [ -f "$RULES_CACHE" ]; then
-      ORG_RULES=$(cat "$RULES_CACHE" 2>/dev/null || echo "[]")
-    fi
-  else
-    ORG_RULES=$(printf '%s' "$PROPOSED" | head -c 8000 \\
-      | jq -Rs '{content: .}' \\
-      | curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules?top_k=20" \\
-      -X POST -H "Content-Type: application/json" \\
-      -H "Authorization: Bearer $JWT" \\
-      -d @- --max-time 2 2>/dev/null \\
-      | jq -c '[.rules[]? | select(.hook_stage == "pre" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category, mode}]' 2>/dev/null || echo "[]")
+  RULES_JQ='[.rules[]? | select(.hook_stage == "pre" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category, mode}]'
+  ORG_RULES=$(jq -c "$RULES_JQ" "$_RULES_TMP" 2>/dev/null || echo "[]")
+  if [ -n "$ORG_RULES" ] && [ "$ORG_RULES" != "null" ] && [ "$ORG_RULES" != "[]" ]; then
+    printf '%s' "$ORG_RULES" > "$RULES_CACHE" 2>/dev/null || true
+  elif [ -f "$RULES_CACHE" ]; then
+    ORG_RULES=$(cat "$RULES_CACHE" 2>/dev/null || echo "[]")
   fi
   if [ -z "$ORG_RULES" ] || [ "$ORG_RULES" = "null" ]; then ORG_RULES="[]"; fi
 
@@ -1661,30 +1652,25 @@ if [ -n "$SESSION_ID" ] && [ -n "$TOOL_USE_ID" ]; then
   ) &
 fi
 
-# Resolve tier + capture_depth live from /cli/me every call. Default to local_only (fail-safe).
-ME_RESP=$(curl -sS "\${GATEWAY_URL}/api/v1/cli/me" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null || echo "")
+# Parallel fetch: /cli/me + rules in background, wait for both.
+_ME_TMP=$(mktemp -t synkro-me.XXXXXX)
+_RULES_TMP=$(mktemp -t synkro-rules.XXXXXX)
+trap "rm -f \\"$_ME_TMP\\" \\"$_RULES_TMP\\"" EXIT
+curl -sS "\${GATEWAY_URL}/api/v1/cli/me" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null > "$_ME_TMP" &
+_ME_PID=$!
+curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules" -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null > "$_RULES_TMP" &
+_RULES_PID=$!
+wait $_ME_PID 2>/dev/null; wait $_RULES_PID 2>/dev/null
+
+ME_RESP=$(cat "$_ME_TMP" 2>/dev/null || echo "")
 SYNKRO_INFERENCE_TIER=$(echo "$ME_RESP" | jq -r '.tier // empty' 2>/dev/null)
 SYNKRO_CAPTURE_DEPTH=$(echo "$ME_RESP" | jq -r '.capture_depth // empty' 2>/dev/null)
 SYNKRO_INFERENCE_TIER="\${SYNKRO_INFERENCE_TIER:-fast}"
 SYNKRO_CAPTURE_DEPTH="\${SYNKRO_CAPTURE_DEPTH:-local_only}"
 
 if synkro_channel_up || { [ "$SYNKRO_INFERENCE_TIER" = "free" ] && command -v claude >/dev/null 2>&1; }; then
-  # \u2500\u2500\u2500 LOCAL PATH: channel-grader first, then \`claude --print\` cold fallback. \u2500\u2500\u2500
-
   RULES_CACHE="$HOME/.synkro/.rules-cache-edit-capture"
-  RULES_RESP=""
-  if [ "$SYNKRO_CAPTURE_DEPTH" = "local_only" ]; then
-    RULES_RESP=$(curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules" \\
-      -H "Authorization: Bearer $JWT" --max-time 3 2>/dev/null || echo "")
-  else
-    RULES_RESP=$(printf '%s' "$FILE_CONTENT" | head -c 8000 \\
-      | jq -Rs '{content: .}' \\
-      | curl -sS "\${GATEWAY_URL}/api/v1/cli/pr-rules?top_k=20" \\
-      -X POST -H "Content-Type: application/json" \\
-      -H "Authorization: Bearer $JWT" \\
-      -d @- --max-time 2 2>/dev/null || echo "")
-  fi
-  ORG_RULES=$(echo "$RULES_RESP" | jq -c '[.rules[]? | select(.hook_stage == "post" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category}]' 2>/dev/null || echo "[]")
+  ORG_RULES=$(jq -c '[.rules[]? | select(.hook_stage == "post" or .hook_stage == "both" or .hook_stage == null) | {rule_id, text, severity, category}]' "$_RULES_TMP" 2>/dev/null || echo "[]")
   if [ -n "$ORG_RULES" ] && [ "$ORG_RULES" != "null" ] && [ "$ORG_RULES" != "[]" ]; then
     printf '%s' "$ORG_RULES" > "$RULES_CACHE" 2>/dev/null || true
   elif [ -f "$RULES_CACHE" ]; then
@@ -4432,31 +4418,38 @@ var init_pueue = __esm({
 });
 
 // cli/local-cc/prompts.ts
-import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 import { homedir as homedir9 } from "os";
 import { join as join10 } from "path";
-function loadCachedPrompts() {
-  if (_cached) return _cached;
-  if (!existsSync11(CACHE_PATH2)) {
-    throw new Error("Prompts cache not found. Run `synkro install` or `synkro update` first.");
-  }
+async function fetchPrimers() {
+  let jwt2 = "";
+  let gatewayUrl = "";
   try {
-    _cached = JSON.parse(readFileSync9(CACHE_PATH2, "utf-8"));
-    return _cached;
+    const creds = JSON.parse(readFileSync9(CREDS_PATH, "utf-8"));
+    jwt2 = creds.access_token || "";
+    gatewayUrl = creds.gateway_url || "https://api.synkro.sh";
   } catch {
-    throw new Error("Prompts cache is corrupted. Run `synkro update` to refresh.");
+    throw new Error("No credentials found. Run `synkro install` first.");
   }
+  if (!jwt2) throw new Error("No access token. Run `synkro install` first.");
+  const resp = await fetch(`${gatewayUrl}/api/v1/cli/judge-prompts`, {
+    headers: { Authorization: `Bearer ${jwt2}` },
+    signal: AbortSignal.timeout(5e3)
+  });
+  if (!resp.ok) throw new Error(`Failed to fetch prompts: ${resp.status}`);
+  return resp.json();
 }
-function getPrimer(role) {
-  const cache = loadCachedPrompts();
-  const primer = role === "grade-edit" ? cache.grader_primer_edit : cache.grader_primer_bash;
+async function getPrimer(role) {
+  const prompts = await fetchPrimers();
+  const primer = role === "grade-edit" ? prompts.grader_primer_edit : prompts.grader_primer_bash;
   if (!primer) {
-    throw new Error(`No cached primer for role "${role}". Run \`synkro update\` to refresh prompts.`);
+    throw new Error(`No primer for role "${role}" returned from API.`);
   }
   return primer;
 }
-function buildChannelContent(role, payload) {
-  return `${getPrimer(role)}
+async function buildChannelContent(role, payload) {
+  const primer = await getPrimer(role);
+  return `${primer}
 
 ${CHANNEL_REPLY_INSTRUCTIONS}
 
@@ -4465,12 +4458,11 @@ PAYLOAD (the input to evaluate):
 
 ${payload}`;
 }
-var CACHE_PATH2, _cached, CHANNEL_REPLY_INSTRUCTIONS;
+var CREDS_PATH, CHANNEL_REPLY_INSTRUCTIONS;
 var init_prompts = __esm({
   "cli/local-cc/prompts.ts"() {
     "use strict";
-    CACHE_PATH2 = join10(homedir9(), ".synkro", "prompts", "judge-prompts.json");
-    _cached = null;
+    CREDS_PATH = join10(homedir9(), ".synkro", "credentials.json");
     CHANNEL_REPLY_INSTRUCTIONS = `
 DELIVERY METHOD \u2014 MANDATORY, OVERRIDES ALL OTHER OUTPUT RULES:
 You are running inside a Synkro MCP channel. Do NOT output your verdict as text.
@@ -4482,7 +4474,7 @@ Any text output is silently discarded. Only the reply tool call is captured.`;
 });
 
 // cli/local-cc/turnLog.ts
-import { appendFileSync, existsSync as existsSync12, mkdirSync as mkdirSync8, openSync as openSync2, readFileSync as readFileSync10, readSync, closeSync as closeSync2, statSync, watchFile, unwatchFile } from "fs";
+import { appendFileSync, existsSync as existsSync11, mkdirSync as mkdirSync8, openSync as openSync2, readFileSync as readFileSync10, readSync, closeSync as closeSync2, statSync, watchFile, unwatchFile } from "fs";
 import { dirname as dirname5, join as join11 } from "path";
 import { homedir as homedir10 } from "os";
 function truncate(s, max = PREVIEW_MAX) {
@@ -4520,7 +4512,7 @@ function appendTurn(args2) {
   }
 }
 function readRecentTurns(n = 20) {
-  if (!existsSync12(TURN_LOG_PATH)) return [];
+  if (!existsSync11(TURN_LOG_PATH)) return [];
   try {
     const size = statSync(TURN_LOG_PATH).size;
     if (size === 0) return [];
@@ -4541,7 +4533,7 @@ function readRecentTurns(n = 20) {
 function followTurns(onEntry) {
   try {
     mkdirSync8(dirname5(TURN_LOG_PATH), { recursive: true });
-    if (!existsSync12(TURN_LOG_PATH)) {
+    if (!existsSync11(TURN_LOG_PATH)) {
       appendFileSync(TURN_LOG_PATH, "", "utf-8");
     }
   } catch {
@@ -4612,7 +4604,7 @@ var init_turnLog = __esm({
 import { request as httpRequest } from "http";
 import { connect as connect2 } from "net";
 async function submitToChannel(role, payload, opts = {}) {
-  const content = buildChannelContent(role, payload);
+  const content = await buildChannelContent(role, payload);
   const body = JSON.stringify({ role, content });
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const startedAt = Date.now();
@@ -4709,7 +4701,7 @@ __export(install_exports, {
   installCommand: () => installCommand,
   parseArgs: () => parseArgs
 });
-import { existsSync as existsSync13, mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, chmodSync as chmodSync2, readFileSync as readFileSync11, readdirSync } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, chmodSync as chmodSync2, readFileSync as readFileSync11, readdirSync } from "fs";
 import { homedir as homedir11 } from "os";
 import { join as join12 } from "path";
 import { execSync as execSync5 } from "child_process";
@@ -4813,7 +4805,7 @@ function shellQuoteSingle(value) {
 }
 function resolveSynkroBundle() {
   const scriptPath = process.argv[1];
-  if (scriptPath && existsSync13(scriptPath)) return scriptPath;
+  if (scriptPath && existsSync12(scriptPath)) return scriptPath;
   return null;
 }
 function writeConfigEnv(opts) {
@@ -4833,7 +4825,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.4.9")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.4.11")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -4848,7 +4840,7 @@ function writeConfigEnv(opts) {
   chmodSync2(CONFIG_PATH3, 384);
 }
 function updateLocalInferenceFlag(enabled) {
-  if (!existsSync13(CONFIG_PATH3)) return;
+  if (!existsSync12(CONFIG_PATH3)) return;
   let content = readFileSync11(CONFIG_PATH3, "utf-8");
   const flag = enabled ? "yes" : "no";
   if (content.includes("SYNKRO_LOCAL_INFERENCE=")) {
@@ -4965,10 +4957,10 @@ function isAlreadyInstalled() {
     join12(HOOKS_DIR, "cc-stop-summary.sh"),
     join12(HOOKS_DIR, "cc-session-start.sh")
   ];
-  if (!requiredScripts.every((p) => existsSync13(p))) return false;
-  if (!existsSync13(CONFIG_PATH3)) return false;
+  if (!requiredScripts.every((p) => existsSync12(p))) return false;
+  if (!existsSync12(CONFIG_PATH3)) return false;
   const settingsPath = join12(homedir11(), ".claude", "settings.json");
-  if (!existsSync13(settingsPath)) return false;
+  if (!existsSync12(settingsPath)) return false;
   try {
     const settings = JSON.parse(readFileSync11(settingsPath, "utf-8"));
     const hooks = settings?.hooks;
@@ -5267,7 +5259,7 @@ function getClaudeProjectsFolder() {
   const cwd = process.cwd();
   const sanitized = "-" + cwd.replace(/\//g, "-");
   const projectsDir = join12(homedir11(), ".claude", "projects", sanitized);
-  return existsSync13(projectsDir) ? projectsDir : null;
+  return existsSync12(projectsDir) ? projectsDir : null;
 }
 function extractSessionInsights(projectsDir) {
   const insights = [];
@@ -5541,11 +5533,11 @@ var status_exports = {};
 __export(status_exports, {
   statusCommand: () => statusCommand
 });
-import { existsSync as existsSync14, readFileSync as readFileSync12 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
 import { homedir as homedir12 } from "os";
 import { join as join13 } from "path";
 function readConfigEnv() {
-  if (!existsSync14(CONFIG_PATH4)) return {};
+  if (!existsSync13(CONFIG_PATH4)) return {};
   const out = {};
   const raw = readFileSync12(CONFIG_PATH4, "utf-8");
   for (const line of raw.split("\n")) {
@@ -5641,17 +5633,17 @@ async function statusCommand() {
   const cursorBashFollowupScript = join13(SYNKRO_DIR3, "hooks", "cursor-bash-followup.sh");
   const commonScript = join13(SYNKRO_DIR3, "hooks", "_synkro-common.sh");
   console.log("Hook scripts:");
-  console.log(`  ${existsSync14(bashScript) ? "\u2713" : "\u2717"} ${bashScript}`);
-  console.log(`  ${existsSync14(bashFollowupScript) ? "\u2713" : "\u2717"} ${bashFollowupScript}`);
-  console.log(`  ${existsSync14(editPrecheckScript) ? "\u2713" : "\u2717"} ${editPrecheckScript}`);
-  console.log(`  ${existsSync14(editCaptureScript) ? "\u2713" : "\u2717"} ${editCaptureScript}`);
-  console.log(`  ${existsSync14(stopSummaryScript) ? "\u2713" : "\u2717"} ${stopSummaryScript}`);
-  console.log(`  ${existsSync14(sessionStartScript) ? "\u2713" : "\u2717"} ${sessionStartScript}`);
-  console.log(`  ${existsSync14(commonScript) ? "\u2713" : "\u2717"} ${commonScript}`);
-  console.log(`  ${existsSync14(cursorBashJudgeScript) ? "\u2713" : "\u2717"} ${cursorBashJudgeScript}`);
-  console.log(`  ${existsSync14(cursorEditPrecheckScript) ? "\u2713" : "\u2717"} ${cursorEditPrecheckScript}`);
-  console.log(`  ${existsSync14(cursorEditCaptureScript) ? "\u2713" : "\u2717"} ${cursorEditCaptureScript}`);
-  console.log(`  ${existsSync14(cursorBashFollowupScript) ? "\u2713" : "\u2717"} ${cursorBashFollowupScript}`);
+  console.log(`  ${existsSync13(bashScript) ? "\u2713" : "\u2717"} ${bashScript}`);
+  console.log(`  ${existsSync13(bashFollowupScript) ? "\u2713" : "\u2717"} ${bashFollowupScript}`);
+  console.log(`  ${existsSync13(editPrecheckScript) ? "\u2713" : "\u2717"} ${editPrecheckScript}`);
+  console.log(`  ${existsSync13(editCaptureScript) ? "\u2713" : "\u2717"} ${editCaptureScript}`);
+  console.log(`  ${existsSync13(stopSummaryScript) ? "\u2713" : "\u2717"} ${stopSummaryScript}`);
+  console.log(`  ${existsSync13(sessionStartScript) ? "\u2713" : "\u2717"} ${sessionStartScript}`);
+  console.log(`  ${existsSync13(commonScript) ? "\u2713" : "\u2717"} ${commonScript}`);
+  console.log(`  ${existsSync13(cursorBashJudgeScript) ? "\u2713" : "\u2717"} ${cursorBashJudgeScript}`);
+  console.log(`  ${existsSync13(cursorEditPrecheckScript) ? "\u2713" : "\u2717"} ${cursorEditPrecheckScript}`);
+  console.log(`  ${existsSync13(cursorEditCaptureScript) ? "\u2713" : "\u2717"} ${cursorEditCaptureScript}`);
+  console.log(`  ${existsSync13(cursorBashFollowupScript) ? "\u2713" : "\u2717"} ${cursorBashFollowupScript}`);
   console.log();
   const mcp = inspectMcpConfig();
   console.log("Guardrails MCP server (Claude Code):");
@@ -5762,11 +5754,11 @@ var config_exports = {};
 __export(config_exports, {
   configCommand: () => configCommand
 });
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync9, existsSync as existsSync15 } from "fs";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync9, existsSync as existsSync14 } from "fs";
 import { join as join14 } from "path";
 import { homedir as homedir13 } from "os";
 function readConfigEnv2() {
-  if (!existsSync15(CONFIG_PATH5)) return {};
+  if (!existsSync14(CONFIG_PATH5)) return {};
   const out = {};
   for (const line of readFileSync13(CONFIG_PATH5, "utf-8").split("\n")) {
     const t = line.trim();
@@ -5777,7 +5769,7 @@ function readConfigEnv2() {
   return out;
 }
 function updateConfigValue(key, value) {
-  if (!existsSync15(CONFIG_PATH5)) {
+  if (!existsSync14(CONFIG_PATH5)) {
     console.error("No config found. Run `synkro install` first.");
     process.exit(1);
   }
@@ -5859,7 +5851,7 @@ __export(scanPr_exports, {
   scanPrCommand: () => scanPrCommand
 });
 import { execSync as execSync6, spawn as spawn2 } from "child_process";
-import { readFileSync as readFileSync14, existsSync as existsSync16 } from "fs";
+import { readFileSync as readFileSync14, existsSync as existsSync15 } from "fs";
 import { join as join15 } from "path";
 function parseMatchSpec(condition) {
   if (!condition.startsWith("match_spec:")) return null;
@@ -6340,7 +6332,7 @@ function shouldFail(findings, threshold) {
 }
 function readRepoDeps() {
   const pkgPath = join15(process.cwd(), "package.json");
-  if (!existsSync16(pkgPath)) return {};
+  if (!existsSync15(pkgPath)) return {};
   try {
     const pkg = JSON.parse(readFileSync14(pkgPath, "utf-8"));
     return { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
@@ -6604,7 +6596,7 @@ var disconnect_exports = {};
 __export(disconnect_exports, {
   disconnectCommand: () => disconnectCommand
 });
-import { existsSync as existsSync17, rmSync } from "fs";
+import { existsSync as existsSync16, rmSync } from "fs";
 import { homedir as homedir14 } from "os";
 import { join as join16 } from "path";
 function tearDownLocalCC() {
@@ -6639,13 +6631,13 @@ function disconnectCommand(args2 = []) {
     console.log(`${mcpRemoved ? "\u2713" : "\xB7"} MCP guardrails server: ${mcpRemoved ? "removed entry from ~/.claude.json" : "no Synkro MCP entry found"}`);
   }
   if (purge) {
-    if (existsSync17(SYNKRO_DIR5)) {
+    if (existsSync16(SYNKRO_DIR5)) {
       rmSync(SYNKRO_DIR5, { recursive: true, force: true });
       console.log(`\u2713 Removed ${SYNKRO_DIR5}`);
     } else {
       console.log(`\xB7 ${SYNKRO_DIR5} already gone, nothing to remove`);
     }
-  } else if (existsSync17(SYNKRO_DIR5)) {
+  } else if (existsSync16(SYNKRO_DIR5)) {
     console.log(`Config preserved at ${SYNKRO_DIR5}. Run with --purge to remove.`);
   }
   console.log("\nSynkro disconnected.");
@@ -6709,7 +6701,7 @@ __export(localCc_exports, {
 import { spawnSync as spawnSync3 } from "child_process";
 import { homedir as homedir15 } from "os";
 import { join as join17 } from "path";
-import { existsSync as existsSync18, readFileSync as readFileSync15, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync17, readFileSync as readFileSync15, writeFileSync as writeFileSync10 } from "fs";
 function printHelp() {
   console.log(`synkro local-cc \u2014 manage the local Claude Code inference session
 
@@ -6799,14 +6791,14 @@ TROUBLESHOOTING
 `);
 }
 function readGatewayUrl() {
-  if (existsSync18(CONFIG_PATH6)) {
+  if (existsSync17(CONFIG_PATH6)) {
     const m = readFileSync15(CONFIG_PATH6, "utf-8").match(/^SYNKRO_GATEWAY_URL='([^']*)'/m);
     if (m) return m[1];
   }
   return "https://api.synkro.sh";
 }
 function updateLocalInferenceFlag2(enabled) {
-  if (!existsSync18(CONFIG_PATH6)) return;
+  if (!existsSync17(CONFIG_PATH6)) return;
   let content = readFileSync15(CONFIG_PATH6, "utf-8");
   const flag = enabled ? "yes" : "no";
   if (content.includes("SYNKRO_LOCAL_INFERENCE=")) {
@@ -7143,14 +7135,14 @@ var init_grade = __esm({
 });
 
 // cli/bootstrap.js
-import { readFileSync as readFileSync16, existsSync as existsSync19 } from "fs";
+import { readFileSync as readFileSync16, existsSync as existsSync18 } from "fs";
 import { resolve } from "path";
 var envCandidates = [
   resolve(process.cwd(), ".env"),
   resolve(process.env.HOME ?? "", ".synkro", "config.env")
 ];
 for (const envPath of envCandidates) {
-  if (!existsSync19(envPath)) continue;
+  if (!existsSync18(envPath)) continue;
   const envContent = readFileSync16(envPath, "utf-8");
   for (const line of envContent.split("\n")) {
     const trimmed = line.trim();