@synkro-sh/cli 1.6.11 → 1.6.12

package/dist/bootstrap.js

@@ -990,6 +990,12 @@ export interface HookConfig {
   policyName: string;
   rules: Rule[];
   scanExemptions: Array<{ path: string; cwe_id: string }>;
+  // User-owned data axes. gradingMode: 'local' (container worker pool) | 'byok'
+  // (LLM API with the user's own key). storageMode: 'local' (PGLite) | 'cloud'
+  // (Timescale). Sourced from config.env (the installed choice); the server
+  // value from /v1/hook/config is only a fallback when the env var is unset.
+  gradingMode: string;
+  storageMode: string;
 }
 
 export async function loadConfig(jwt: string, query?: string): Promise<HookConfig> {
@@ -1000,6 +1006,8 @@ export async function loadConfig(jwt: string, query?: string): Promise<HookConfi
     policyName: '',
     rules: [],
     scanExemptions: [],
+    gradingMode: process.env.SYNKRO_GRADING_MODE || 'local',
+    storageMode: process.env.SYNKRO_STORAGE_MODE || 'local',
   };
 
   // Kick the telemetry spool drainer. Fire-and-forget: it runs concurrently
@@ -1047,6 +1055,9 @@ export async function loadConfig(jwt: string, query?: string): Promise<HookConfi
     config.captureDepth = data.capture_depth || 'local_only';
     config.tier = data.tier || 'standard';
     config.silent = data.silent_mode === true || data.silent_mode === 'true';
+    // Env var (config.env, the installed choice) wins; server value is fallback.
+    if (!process.env.SYNKRO_GRADING_MODE && data.grading_mode) config.gradingMode = data.grading_mode;
+    if (!process.env.SYNKRO_STORAGE_MODE && data.storage_mode) config.storageMode = data.storage_mode;
     config.policyName = data.active_policy_name || '';
     if (Array.isArray(data.scan_exemptions)) {
       config.scanExemptions = data.scan_exemptions
@@ -1123,10 +1134,34 @@ async function channelGrade(role: GradeRole, prompt: string, _jwt: string, port:
   return String(data.result || '');
 }
 
+// BYOK grading \u2014 grade via the cloud /v1/grade endpoint, which runs the same
+// grader prompt through an LLM API using the org's own provider key. Any
+// non-2xx (incl. 422 when no key is configured) throws, so the caller's
+// existing catch falls open \u2014 never a hard block on a grader error.
+async function cloudGrade(surface: string, prompt: string, jwt: string, timeoutMs: number): Promise<string> {
+  const resp = await fetch(GATEWAY_URL + '/api/v1/grade', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
+    body: JSON.stringify({ surface, grader_prompt: prompt }),
+    signal: AbortSignal.timeout(timeoutMs),
+  });
+  if (!resp.ok) {
+    const text = await resp.text().catch(() => '');
+    throw new Error('cloud grade ' + resp.status + ': ' + text.slice(0, 200));
+  }
+  const data = await resp.json() as { verdict?: string };
+  return String(data.verdict || '');
+}
+
 export async function localGrade(surface: string, prompt: string, timeoutMs = 30000, agentKind: AgentKind = 'claude_code'): Promise<string> {
-  if (!(await channelUp())) throw new Error('SYNKRO_CHANNEL_DOWN');
   const jwt = loadJwt();
   if (!jwt) throw new Error('NO_JWT');
+  // BYOK grading mode routes the grade through an LLM API instead of the
+  // on-device channel worker pool. The grader prompt + parseVerdict are shared.
+  if ((process.env.SYNKRO_GRADING_MODE || 'local') === 'byok') {
+    return cloudGrade(surface, prompt, jwt, timeoutMs);
+  }
+  if (!(await channelUp())) throw new Error('SYNKRO_CHANNEL_DOWN');
   return channelGrade(ROLE_MAP[surface] || 'grade-edit', prompt, jwt, 18929, timeoutMs, agentKind);
 }
 
@@ -1518,6 +1553,19 @@ export function parseVerdict(resp: string): Verdict {
 
 // \u2500\u2500\u2500 Telemetry Dispatch \u2500\u2500\u2500
 
+// Gated cloud telemetry POST \u2014 fires only when storage mode is 'cloud'. The
+// local PGLite spool (appendLocalTelemetry) always gets the data regardless,
+// so 'local' storage keeps everything on the machine.
+function shipCloud(jwt: string, path: string, body: Record<string, any>, timeoutMs = 3000): void {
+  if ((process.env.SYNKRO_STORAGE_MODE || 'local') !== 'cloud') return;
+  fetch(GATEWAY_URL + path, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(timeoutMs),
+  }).catch(() => {});
+}
+
 export function dispatchCapture(
   jwt: string,
   hookType: string,
@@ -1540,9 +1588,6 @@ export function dispatchCapture(
   // Fire-and-forget
   const eventId = 'evt_' + Date.now() + '_' + process.pid;
   const model = opts?.ccModel || 'unknown';
-  const sendFull =
-    captureDepth === 'full' ||
-    (captureDepth === 'evidence_on_violation' && ['block', 'warning', 'deny'].includes(verdictStr));
 
   const body: Record<string, any> = {
     capture_type: 'local_verdict',
@@ -1570,24 +1615,16 @@ export function dispatchCapture(
   }
   appendLocalTelemetry(localBody);
 
-  // local_only: no data leaves the machine
-  if (captureDepth === 'local_only') return;
-
-  if (sendFull && opts) {
-    body.capture_depth = captureDepth;
+  // Cloud copy carries the same full content as the local spool; shipCloud
+  // gates on storage mode (no-op when storage is local).
+  if (opts) {
     if (opts.command) body.command = opts.command;
     if (opts.reasoning) body.reasoning = opts.reasoning;
     if (opts.rulesChecked) body.rules_checked = opts.rulesChecked;
     if (opts.violatedRules) body.violated_rules = opts.violatedRules;
     if (opts.recentUserMessages) body.recent_user_messages = opts.recentUserMessages;
   }
-
-  fetch(GATEWAY_URL + '/api/v1/hook/capture', {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
-    body: JSON.stringify(body),
-    signal: AbortSignal.timeout(3000),
-  }).catch(() => {});
+  shipCloud(jwt, '/api/v1/hook/capture', body);
 }
 
 // \u2500\u2500\u2500 Durable Telemetry Spool \u2500\u2500\u2500
@@ -2059,36 +2096,24 @@ export function dispatchFinding(
   };
   appendLocalTelemetry(localEntry);
 
-  if (captureDepth === 'local_only') return;
-
+  // Cloud copy carries the full finding; shipCloud gates on storage mode.
   const cloudBody: Record<string, any> = {
     finding_type: finding.finding_type,
     finding_id: finding.finding_id,
     severity: finding.severity,
     status: finding.status,
     session_id: finding.session_id,
+    file_path: finding.file_path,
+    package_name: finding.package_name,
+    package_version: finding.package_version,
+    fixed_version: finding.fixed_version,
+    aliases: finding.aliases,
+    references: finding.references,
+    cwe_name: finding.cwe_name,
+    detail: finding.detail,
+    description: finding.description,
   };
-
-  if (captureDepth === 'evidence_on_violation' || captureDepth === 'full') {
-    cloudBody.file_path = finding.file_path;
-    cloudBody.package_name = finding.package_name;
-    cloudBody.package_version = finding.package_version;
-    cloudBody.fixed_version = finding.fixed_version;
-    cloudBody.aliases = finding.aliases;
-    cloudBody.references = finding.references;
-    cloudBody.cwe_name = finding.cwe_name;
-  }
-  if (captureDepth === 'full') {
-    cloudBody.detail = finding.detail;
-    cloudBody.description = finding.description;
-  }
-
-  fetch(GATEWAY_URL + '/api/v1/hook/finding', {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
-    body: JSON.stringify(cloudBody),
-    signal: AbortSignal.timeout(3000),
-  }).catch(() => {});
+  shipCloud(jwt, '/api/v1/hook/finding', cloudBody);
 }
 
 // \u2500\u2500\u2500 Hook tool-name sets (CC + Cursor) \u2500\u2500\u2500
@@ -3744,12 +3769,7 @@ async function main() {
           ...(sessionId ? { session_id: sessionId } : {}),
         };
         appendLocalTelemetry(usageBody);
-        fetch(GATEWAY_URL + '/api/v1/hook/capture', {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
-          body: JSON.stringify(usageBody),
-          signal: AbortSignal.timeout(3000),
-        }).catch(() => {});
+        shipCloud(jwt, '/api/v1/hook/capture', usageBody);
       }
     }
 
@@ -3910,16 +3930,7 @@ async function main() {
     };
 
     appendLocalTelemetry(body);
-
-    const config = await loadConfig(jwt);
-    if (config.captureDepth !== 'local_only') {
-      fetch(GATEWAY_URL + '/api/v1/hook/capture', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
-        body: JSON.stringify(body),
-        signal: AbortSignal.timeout(3000),
-      }).catch(() => {});
-    }
+    shipCloud(jwt, '/api/v1/hook/capture', body);
 
     outputEmpty();
   } catch {
@@ -3932,7 +3943,7 @@ main();
     TRANSCRIPT_SYNC_TS = `#!/usr/bin/env bun
 import {
   loadJwt, detectRepo, readStdin, aggregateUsage, appendLocalTelemetry,
-  outputEmpty, setupCursorHookSignals, hookSessionId, GATEWAY_URL,
+  outputEmpty, setupCursorHookSignals, hookSessionId, GATEWAY_URL, readSessionLog,
 } from './_synkro-common.ts';
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join, dirname } from 'node:path';
@@ -3976,12 +3987,7 @@ async function main() {
         session_id: sessionId,
       };
       appendLocalTelemetry(usageBody);
-      fetch(GATEWAY_URL + '/api/v1/hook/capture', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
-        body: JSON.stringify(usageBody),
-        signal: AbortSignal.timeout(3000),
-      }).catch(() => {});
+      shipCloud(jwt, '/api/v1/hook/capture', usageBody);
     }
 
     // Transcript consent gates only CLOUD transmission. Local persistence \u2014
@@ -4056,25 +4062,19 @@ async function main() {
       }).catch(() => {});
     }
 
-    // Cloud sync \u2014 only when consented and the org isn't local-only.
-    if (cloudConsent && gitRepo) {
-      let captureDepth = 'local_only';
-      try {
-        const r = await fetch(GATEWAY_URL + '/api/v1/hook/config', {
-          headers: { Authorization: 'Bearer ' + jwt },
-          signal: AbortSignal.timeout(3000),
-        });
-        const data = await r.json() as any;
-        captureDepth = data.capture_depth || 'local_only';
-      } catch {}
-      if (captureDepth !== 'local_only') {
-        fetch(GATEWAY_URL + '/api/v1/cli/sync-transcripts', {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
-          body: JSON.stringify({ repo: gitRepo, sessions: [{ cc_session_id: sessionId, messages }] }),
-          signal: AbortSignal.timeout(10000),
-        }).catch(() => {});
-      }
+    // Cloud sync \u2014 only when storage mode is cloud (and transcript consent
+    // wasn't declined). Carries the transcript + the session step-log so cloud
+    // storage matches the local PGLite shape.
+    if (cloudConsent && gitRepo && (process.env.SYNKRO_STORAGE_MODE || 'local') === 'cloud') {
+      fetch(GATEWAY_URL + '/api/v1/cli/sync-transcripts', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
+        body: JSON.stringify({
+          repo: gitRepo,
+          sessions: [{ cc_session_id: sessionId, messages, actions: readSessionLog(sessionId) }],
+        }),
+        signal: AbortSignal.timeout(10000),
+      }).catch(() => {});
     }
 
     outputEmpty();
@@ -4511,12 +4511,7 @@ async function main() {
     if (repo) captureBody.repo = repo;
 
     appendLocalTelemetry(captureBody);
-    fetch(GATEWAY_URL + '/api/v1/hook/capture', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
-      body: JSON.stringify(captureBody),
-      signal: AbortSignal.timeout(10000),
-    }).catch(() => {});
+    shipCloud(jwt, '/api/v1/hook/capture', captureBody, 10000);
 
     finish();
   } catch (e) {
@@ -6378,6 +6373,32 @@ async function promptCursorApiKey(opts) {
     console.log("  \u26A0 Skipped \u2014 Cursor workers will be idle. Re-run install or pass --cursor-api-key=\u2026 later.");
   }
 }
+async function promptGradingMode() {
+  if (!process.stdin.isTTY) return "local";
+  const rl = createInterface3({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve3) => {
+    rl.question(
+      "Where should grading run?\n  local \u2014 on this machine, via the Synkro container (default)\n  byok  \u2014 via an LLM API using your own provider key\nChoose [local] / byok: ",
+      (answer) => {
+        rl.close();
+        resolve3(answer.trim().toLowerCase() === "byok" ? "byok" : "local");
+      }
+    );
+  });
+}
+async function promptStorageMode() {
+  if (!process.stdin.isTTY) return "local";
+  const rl = createInterface3({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve3) => {
+    rl.question(
+      "Where should telemetry be stored?\n  local \u2014 on this machine only (default)\n  cloud \u2014 sent to Synkro cloud\nChoose [local] / cloud: ",
+      (answer) => {
+        rl.close();
+        resolve3(answer.trim().toLowerCase() === "cloud" ? "cloud" : "local");
+      }
+    );
+  });
+}
 function ensureSynkroDir() {
   mkdirSync8(SYNKRO_DIR4, { recursive: true });
   mkdirSync8(HOOKS_DIR, { recursive: true });
@@ -6479,7 +6500,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.11")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.12")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -6491,6 +6512,8 @@ function writeConfigEnv(opts) {
   lines.push(`SYNKRO_LOCAL_INFERENCE=${shellQuoteSingle(opts.localInference ? "yes" : "no")}`);
   const safeMode = sanitizeConfigValue(opts.deploymentMode ?? "docker", 16);
   lines.push(`SYNKRO_DEPLOYMENT_MODE=${shellQuoteSingle(safeMode)}`);
+  lines.push(`SYNKRO_GRADING_MODE=${shellQuoteSingle(sanitizeConfigValue(opts.gradingMode ?? "local", 16))}`);
+  lines.push(`SYNKRO_STORAGE_MODE=${shellQuoteSingle(sanitizeConfigValue(opts.storageMode ?? "local", 16))}`);
   lines.push("");
   writeFileSync7(CONFIG_PATH2, lines.join("\n"), "utf-8");
   chmodSync2(CONFIG_PATH2, 384);
@@ -6668,6 +6691,14 @@ async function installCommand(opts = {}) {
     console.log(`Installing hooks for: ${agents.map((a) => a.name).join(", ")}
 `);
   }
+  const gradingMode = await promptGradingMode();
+  const storageMode = await promptStorageMode();
+  console.log(`  grading: ${gradingMode}    storage: ${storageMode}
+`);
+  if (gradingMode === "byok") {
+    console.log("  BYOK grading uses your own provider key \u2014 register one in the");
+    console.log("  dashboard under Settings \u2192 Provider Keys if you have not already.\n");
+  }
   ensureSynkroDir();
   const scripts = writeHookScripts();
   console.log("Wrote hook scripts:");
@@ -6845,7 +6876,7 @@ async function installCommand(opts = {}) {
   }
   const synkroBundle = resolveSynkroBundle();
   const persistedMode = resolveDeploymentMode();
-  writeConfigEnv({ gatewayUrl, userId, orgId, email, tier: profile.tier, inference: profile.inference, synkroBin: synkroBundle, transcriptConsent, localInference: profile.localInference, deploymentMode: persistedMode });
+  writeConfigEnv({ gatewayUrl, userId, orgId, email, tier: profile.tier, inference: profile.inference, synkroBin: synkroBundle, transcriptConsent, localInference: profile.localInference, deploymentMode: persistedMode, gradingMode, storageMode });
   console.log(`Wrote config to ${CONFIG_PATH2}`);
   console.log(`  inference: ${profile.inference} (server-side grading)`);
   if (profile.localInference) console.log(`  local inference: enabled (gradingProvider=claude-code)`);
@@ -8956,16 +8987,141 @@ var init_lifecycle = __esm({
   }
 });
 
+// cli/commands/config.ts
+var config_exports = {};
+__export(config_exports, {
+  configCommand: () => configCommand
+});
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync10, existsSync as existsSync15 } from "fs";
+import { join as join15 } from "path";
+import { homedir as homedir15 } from "os";
+function readConfigEnv() {
+  if (!existsSync15(CONFIG_PATH5)) return {};
+  const out = {};
+  for (const line of readFileSync12(CONFIG_PATH5, "utf-8").split("\n")) {
+    const t = line.trim();
+    if (!t || t.startsWith("#")) continue;
+    const eq = t.indexOf("=");
+    if (eq > 0) out[t.slice(0, eq).trim()] = t.slice(eq + 1).trim().replace(/^['"]|['"]$/g, "");
+  }
+  return out;
+}
+function updateConfigValue(key, value) {
+  if (!existsSync15(CONFIG_PATH5)) {
+    console.error("No config found. Run `synkro install` first.");
+    process.exit(1);
+  }
+  const lines = readFileSync12(CONFIG_PATH5, "utf-8").split("\n");
+  const pattern = new RegExp(`^${key}=`);
+  let found = false;
+  const updated = lines.map((line) => {
+    if (pattern.test(line.trim())) {
+      found = true;
+      return `${key}='${value}'`;
+    }
+    return line;
+  });
+  if (!found) updated.splice(updated.length - 1, 0, `${key}='${value}'`);
+  writeFileSync10(CONFIG_PATH5, updated.join("\n"), "utf-8");
+}
+async function configCommand(args2) {
+  if (args2.length === 0) {
+    const config2 = readConfigEnv();
+    console.log("Synkro config:\n");
+    console.log(`  grading:    ${config2.SYNKRO_GRADING_MODE || "local"}`);
+    console.log(`  storage:    ${config2.SYNKRO_STORAGE_MODE || "local"}`);
+    console.log(`  inference:  ${config2.SYNKRO_INFERENCE || "fast"}`);
+    console.log(`  tier:       ${config2.SYNKRO_TIER || "pro"}`);
+    console.log(`  gateway:    ${config2.SYNKRO_GATEWAY_URL || "https://api.synkro.sh"}`);
+    console.log(`  version:    ${config2.SYNKRO_VERSION || "?"}`);
+    console.log(`
+To change:`);
+    console.log(`  synkro config grading <local|byok>    \u2014 where grading runs`);
+    console.log(`  synkro config storage <local|cloud>   \u2014 where telemetry is stored`);
+    console.log(`  synkro config --inference fast|standard`);
+    return;
+  }
+  if (args2[0] === "grading") {
+    const value = args2[1];
+    if (value !== "local" && value !== "byok") {
+      console.error("Usage: synkro config grading <local|byok>");
+      process.exit(1);
+    }
+    updateConfigValue("SYNKRO_GRADING_MODE", value);
+    console.log(`\u2713 Grading mode set to '${value}'.`);
+    if (value === "byok") {
+      console.log("  BYOK grading uses your own provider key \u2014 register one in the");
+      console.log("  dashboard under Settings \u2192 Provider Keys if you have not already.");
+    }
+    return;
+  }
+  if (args2[0] === "storage") {
+    const value = args2[1];
+    if (value !== "local" && value !== "cloud") {
+      console.error("Usage: synkro config storage <local|cloud>");
+      process.exit(1);
+    }
+    updateConfigValue("SYNKRO_STORAGE_MODE", value);
+    console.log(`\u2713 Storage mode set to '${value}'.`);
+    return;
+  }
+  let inferenceValue;
+  for (const a of args2) {
+    if (a.startsWith("--inference=")) inferenceValue = a.slice("--inference=".length);
+    else if (a === "--inference" && args2.indexOf(a) + 1 < args2.length) inferenceValue = args2[args2.indexOf(a) + 1];
+  }
+  if (!inferenceValue || !["fast", "standard"].includes(inferenceValue)) {
+    console.error("Usage: synkro config --inference fast|standard");
+    process.exit(1);
+  }
+  if (!isAuthenticated()) {
+    console.error("Not authenticated. Run `synkro login` first.");
+    process.exit(1);
+  }
+  const token = getAccessToken();
+  const config = readConfigEnv();
+  const gatewayUrl = (config.SYNKRO_GATEWAY_URL || "https://api.synkro.sh").replace(/\/$/, "");
+  try {
+    const resp = await fetch(`${gatewayUrl}/api/v1/cli/me`, {
+      method: "PATCH",
+      headers: {
+        "Authorization": `Bearer ${token}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ fast_inference: inferenceValue === "fast" })
+    });
+    if (!resp.ok) {
+      const errText = await resp.text().catch(() => "");
+      console.error(`Failed to update: ${resp.status} ${errText.slice(0, 200)}`);
+      process.exit(1);
+    }
+  } catch (err) {
+    console.error(`Failed to reach server: ${err.message}`);
+    process.exit(1);
+  }
+  updateConfigValue("SYNKRO_INFERENCE", inferenceValue);
+  console.log(`\u2713 Inference set to '${inferenceValue}'.`);
+}
+var SYNKRO_DIR6, CONFIG_PATH5;
+var init_config = __esm({
+  "cli/commands/config.ts"() {
+    "use strict";
+    init_stub();
+    SYNKRO_DIR6 = join15(homedir15(), ".synkro");
+    CONFIG_PATH5 = join15(SYNKRO_DIR6, "config.env");
+  }
+});
+
 // cli/bootstrap.js
-import { readFileSync as readFileSync12, existsSync as existsSync15 } from "fs";
+import { readFileSync as readFileSync13, existsSync as existsSync16 } from "fs";
 import { resolve as resolve2 } from "path";
 var envCandidates = [
   resolve2(process.cwd(), ".env"),
   resolve2(process.env.HOME ?? "", ".synkro", "config.env")
 ];
 for (const envPath of envCandidates) {
-  if (!existsSync15(envPath)) continue;
-  const envContent = readFileSync12(envPath, "utf-8");
+  if (!existsSync16(envPath)) continue;
+  const envContent = readFileSync13(envPath, "utf-8");
   for (const line of envContent.split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -8980,7 +9136,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.11");
+  console.log("1.6.12");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents
@@ -8995,8 +9151,14 @@ Commands:
   start [opts]           Start the server (with pgdata integrity check)
   restart [opts]         Safe restart (stop \u2192 start, data preserved)
   update                 Pull the latest container image and safely restart
+  config                 Show or change grading + storage modes
   version                Show version
 
+  config:
+    synkro config                        show current settings
+    synkro config grading <local|byok>   where grading runs
+    synkro config storage <local|cloud>  where telemetry is stored
+
   start/restart opts (recreate the worker pool):
     --workers N          total grader workers (default 8, even-split)
     --providers a,b      grading agents: claude, cursor (or both)
@@ -9063,6 +9225,11 @@ async function main() {
       await updateCommand2();
       break;
     }
+    case "config": {
+      const { configCommand: configCommand2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+      await configCommand2(args.slice(1));
+      break;
+    }
     default: {
       console.error(`Unknown command: ${cmd}`);
       printHelp2();