@synkro-sh/cli 1.4.99 → 1.4.101

package/dist/bootstrap.js

@@ -992,7 +992,7 @@ export async function channelUp(port = 18929): Promise<boolean> {
     const done = (ok: boolean) => { try { sock.destroy(); } catch {} resolve(ok); };
     sock.once('connect', () => done(true));
     sock.once('error', () => done(false));
-    sock.setTimeout(500, () => done(false));
+    sock.setTimeout(3000, () => done(false));
   });
 }
 
@@ -2016,6 +2016,7 @@ async function main() {
         'User intent (last human message): ' + (transcript.userIntent || 'none stated'),
         'Last user prompt: ' + (lastPrompt || 'none'),
         'Org rules: ' + JSON.stringify(config.rules),
+        'IMPORTANT: If a rule is violated, ALWAYS return ok=false with the rule_id and reason, regardless of the rule mode. Do NOT pass a command just because the rule mode is "audit". The enforcement layer handles audit vs blocking \u2014 your job is only to detect violations.',
       ].join('\\n');
 
       let gradeResp: string;
@@ -2964,6 +2965,9 @@ async function main() {
         'User intent (last human message): ' + (transcript.userIntent || 'none stated'),
         'Last user prompt: ' + (lastPrompt || 'none'),
         'Org rules: ' + JSON.stringify(config.rules),
+        'IMPORTANT: If a rule is violated, ALWAYS return ok=false with the rule_id and reason, regardless of the rule mode. Do NOT pass a command just because the rule mode is "audit". The enforcement layer handles audit vs blocking — your job is only to detect violations.',
+        'When passing (ok=true), cite which rules you checked and why they passed (e.g. "R006 satisfied: typecheck found in session history"). Be specific, not generic.',
+        'Rules with preconditions (e.g. "run X before Y") are CONSUMED after the protected action completes. Use the session history timestamps to determine ordering: a precondition satisfied before the last occurrence of the protected action does NOT satisfy the next occurrence. Each new protected action needs its precondition re-satisfied.',
       ].filter(Boolean).join('\\n');
 
       let gradeResp: string;
@@ -3004,7 +3008,9 @@ async function main() {
             });
         }
       } else {
-        const reason = tagStr + ' bashGuard → pass: ' + (verdict.reason || 'no policy violations detected');
+        const auditRuleIds = (config.rules || []).filter((r: any) => r.mode === 'audit').map((r: any) => r.rule_id || r.id).filter(Boolean);
+        const auditNote = auditRuleIds.length > 0 ? ' (audit rules checked: ' + auditRuleIds.join(', ') + ')' : '';
+        const reason = tagStr + ' bashGuard → pass: ' + (verdict.reason || 'no policy violations detected') + auditNote;
         const combined = (installScanMsg ? installScanMsg + '\\n' : '') + reason;
         outputJson({ systemMessage: combined, hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: combined } });
         dispatchCapture(jwt, 'bash', 'pass', 'audit', verdict.category || 'trivial_utility',
@@ -3149,6 +3155,7 @@ async function main() {
         'User intent (last human message): ' + (transcript.userIntent || 'none stated'),
         'Last user prompt: ' + (lastPrompt || 'none'),
         'Org rules: ' + JSON.stringify(config.rules),
+        'IMPORTANT: If a rule is violated, ALWAYS return ok=false with the rule_id and reason, regardless of the rule mode. Do NOT pass a command just because the rule mode is "audit". The enforcement layer handles audit vs blocking \u2014 your job is only to detect violations.',
       ].filter(Boolean).join('\\n');
 
       let gradeResp: string;
@@ -5445,7 +5452,7 @@ __export(dockerInstall_exports, {
   imageTag: () => imageTag,
   waitForContainerReady: () => waitForContainerReady
 });
-import { existsSync as existsSync8, mkdirSync as mkdirSync7 } from "fs";
+import { copyFileSync, existsSync as existsSync8, mkdirSync as mkdirSync7 } from "fs";
 import { homedir as homedir7 } from "os";
 import { join as join7 } from "path";
 import { spawnSync as spawnSync2 } from "child_process";
@@ -5472,8 +5479,13 @@ function claudeCredsHostDir() {
 async function dockerInstall(opts = {}) {
   assertDockerAvailable();
   const image = imageTag();
-  const workers = String(opts.workersPerPool ?? 4);
+  const workers = String(opts.workersPerPool ?? 8);
   mkdirSync7(PGDATA_PATH, { recursive: true });
+  mkdirSync7(CLAUDE_HOST_STATE_DIR, { recursive: true });
+  const hostClaudeJson = join7(homedir7(), ".claude.json");
+  if (existsSync8(hostClaudeJson)) {
+    copyFileSync(hostClaudeJson, CLAUDE_HOST_STATE_FILE);
+  }
   if (!existsSync8(MCP_JWT_PATH)) {
     throw new DockerInstallError(
       `MCP JWT missing at ${MCP_JWT_PATH}. The installer should mint this before calling dockerInstall.`
@@ -5529,7 +5541,7 @@ async function dockerInstall(opts = {}) {
     "-v",
     `${join7(homedir7(), ".claude")}:/data/claude-host:ro`,
     "-v",
-    `${join7(homedir7(), ".claude.json")}:/home/synkro/.claude.json:rw`,
+    `${CLAUDE_HOST_STATE_DIR}:/data/claude-host-state:ro`,
     "-e",
     `WORKERS_PER_POOL=${workers}`,
     image
@@ -5574,7 +5586,7 @@ function dockerStatus() {
     healthz: `http://127.0.0.1:${HOST_MCP_PORT}/`
   };
 }
-var SYNKRO_DIR3, MCP_JWT_PATH, SYNKRO_CREDS_PATH, PGDATA_PATH, HOST_MCP_PORT, HOST_GRADER_PORT, HOST_CWE_PORT, HOST_PG_PORT, CONTAINER_NAME, DEFAULT_IMAGE, DockerInstallError;
+var SYNKRO_DIR3, MCP_JWT_PATH, SYNKRO_CREDS_PATH, PGDATA_PATH, CLAUDE_HOST_STATE_DIR, CLAUDE_HOST_STATE_FILE, HOST_MCP_PORT, HOST_GRADER_PORT, HOST_CWE_PORT, HOST_PG_PORT, CONTAINER_NAME, DEFAULT_IMAGE, DockerInstallError;
 var init_dockerInstall = __esm({
   "cli/local-cc/dockerInstall.ts"() {
     "use strict";
@@ -5583,6 +5595,8 @@ var init_dockerInstall = __esm({
     MCP_JWT_PATH = join7(SYNKRO_DIR3, ".mcp-jwt");
     SYNKRO_CREDS_PATH = join7(SYNKRO_DIR3, "credentials.json");
     PGDATA_PATH = join7(SYNKRO_DIR3, "pgdata");
+    CLAUDE_HOST_STATE_DIR = join7(SYNKRO_DIR3, "claude-host-state");
+    CLAUDE_HOST_STATE_FILE = join7(CLAUDE_HOST_STATE_DIR, ".claude.json");
     HOST_MCP_PORT = parseInt(process.env.SYNKRO_HOST_MCP_PORT || "18931", 10);
     HOST_GRADER_PORT = parseInt(process.env.SYNKRO_HOST_GRADER_PORT || "18929", 10);
     HOST_CWE_PORT = parseInt(process.env.SYNKRO_HOST_CWE_PORT || "18930", 10);
@@ -5732,7 +5746,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.4.99")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.4.101")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -6496,7 +6510,7 @@ rl.on('line', async (line) => {
 });
 
 // cli/local-cc/install.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, readFileSync as readFileSync8, chmodSync as chmodSync3, copyFileSync, renameSync as renameSync4, unlinkSync as unlinkSync4, openSync, fsyncSync, closeSync } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, readFileSync as readFileSync8, chmodSync as chmodSync3, copyFileSync as copyFileSync2, renameSync as renameSync4, unlinkSync as unlinkSync4, openSync, fsyncSync, closeSync } from "fs";
 import { join as join9 } from "path";
 import { homedir as homedir9 } from "os";
 import { spawnSync as spawnSync3 } from "child_process";
@@ -6533,7 +6547,7 @@ function safelyMutateClaudeJson(mutator) {
       err
     );
   }
-  copyFileSync(CLAUDE_JSON_PATH, CLAUDE_JSON_BACKUP_PATH);
+  copyFileSync2(CLAUDE_JSON_PATH, CLAUDE_JSON_BACKUP_PATH);
   const tmpPath = `${CLAUDE_JSON_PATH}.synkro-tmp.${process.pid}`;
   try {
     writeFileSync8(tmpPath, newText, "utf-8");
@@ -6550,7 +6564,7 @@ function safelyMutateClaudeJson(mutator) {
     } catch {
     }
     try {
-      copyFileSync(CLAUDE_JSON_BACKUP_PATH, CLAUDE_JSON_PATH);
+      copyFileSync2(CLAUDE_JSON_BACKUP_PATH, CLAUDE_JSON_PATH);
     } catch {
     }
     throw new LocalCCInstallError(
@@ -7168,7 +7182,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.4.99");
+  console.log("1.4.101");
 }
 function printHelp() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents