@synkro-sh/cli 1.6.33 → 1.6.34

package/dist/bootstrap.js

@@ -601,6 +601,58 @@ var init_mcpConfig = __esm({
   }
 });
 
+// cli/installer/skillParser.ts
+import { readFileSync as readFileSync4, existsSync as existsSync4 } from "fs";
+import { resolve as resolve2, basename } from "path";
+function parseSection(heading, body) {
+  const lines = body.split("\n");
+  const meta = {};
+  const textLines = [];
+  for (const line of lines) {
+    const m = line.match(/^(mode|severity|category)\s*:\s*(.+)/i);
+    if (m && META_KEYS.has(m[1].toLowerCase())) {
+      meta[m[1].toLowerCase()] = m[2].trim();
+    } else if (line.trim()) {
+      textLines.push(line.trim());
+    }
+  }
+  const description = textLines.join(" ").trim();
+  const text = description ? `${heading}: ${description}` : heading;
+  return {
+    text,
+    mode: meta.mode || "ask",
+    severity: meta.severity || "medium",
+    category: meta.category || "custom"
+  };
+}
+function parseSkillFile(filePath) {
+  if (!existsSync4(filePath)) return null;
+  const content = readFileSync4(filePath, "utf-8");
+  const source = `skill:${basename(filePath)}`;
+  const sections = content.split(/^## /m).slice(1);
+  if (sections.length === 0) return null;
+  const rules = [];
+  for (const section of sections) {
+    const newlineIdx = section.indexOf("\n");
+    if (newlineIdx === -1) continue;
+    const heading = section.slice(0, newlineIdx).trim();
+    const body = section.slice(newlineIdx + 1);
+    if (!heading) continue;
+    rules.push(parseSection(heading, body));
+  }
+  return rules.length > 0 ? { source, rules } : null;
+}
+function resolveSkillPaths(skills, repoRoot) {
+  return skills.filter((s) => s.endsWith(".md")).map((s) => resolve2(repoRoot, s)).filter((p) => existsSync4(p));
+}
+var META_KEYS;
+var init_skillParser = __esm({
+  "cli/installer/skillParser.ts"() {
+    "use strict";
+    META_KEYS = /* @__PURE__ */ new Set(["mode", "severity", "category"]);
+  }
+});
+
 // cli/installer/hookScripts.ts
 var SYNKRO_COMMON_SCRIPT;
 var init_hookScripts = __esm({
@@ -1147,6 +1199,7 @@ export interface SynkroFileConfig {
   harness: ('claude-code' | 'cursor')[];
   grader: { pool: 'auto' | 'claude' | 'cursor'; mode?: string };
   ruleset: string;
+  skills: string[];
   scanning: { cwe: boolean; cve: boolean };
 }
 
@@ -1155,6 +1208,7 @@ const SYNKRO_FILE_DEFAULTS: SynkroFileConfig = {
   harness: ['claude-code', 'cursor'],
   grader: { pool: 'auto' },
   ruleset: 'default',
+  skills: [],
   scanning: { cwe: true, cve: true },
 };
 
@@ -1180,6 +1234,7 @@ export function loadSynkroFile(cwd?: string): SynkroFileConfig {
         mode: ['local', 'byok'].includes(parsed.grader?.mode) ? parsed.grader.mode : undefined,
       },
       ruleset: typeof parsed.ruleset === 'string' ? parsed.ruleset : 'default',
+      skills: Array.isArray(parsed.skills) ? parsed.skills.filter((s: unknown) => typeof s === 'string') : [],
       scanning: {
         cwe: parsed.scanning?.cwe !== false,
         cve: parsed.scanning?.cve !== false,
@@ -5946,7 +6001,7 @@ __export(stub_exports, {
   saveCredentials: () => saveCredentials
 });
 import { createServer } from "http";
-import { writeFileSync as writeFileSync4, readFileSync as readFileSync4, existsSync as existsSync4, mkdirSync as mkdirSync4, unlinkSync as unlinkSync2 } from "fs";
+import { writeFileSync as writeFileSync4, readFileSync as readFileSync5, existsSync as existsSync5, mkdirSync as mkdirSync4, unlinkSync as unlinkSync2 } from "fs";
 import { homedir as homedir4, platform } from "os";
 import { join as join3, dirname as dirname4 } from "path";
 import { execFile } from "child_process";
@@ -5977,17 +6032,17 @@ function openBrowser(url) {
 }
 function saveCredentials(data) {
   const dir = dirname4(AUTH_FILE);
-  if (!existsSync4(dir)) {
+  if (!existsSync5(dir)) {
     mkdirSync4(dir, { recursive: true, mode: 448 });
   }
   writeFileSync4(AUTH_FILE, JSON.stringify(data, null, 2), { mode: 384 });
 }
 function loadCredentials() {
-  if (!existsSync4(AUTH_FILE)) {
+  if (!existsSync5(AUTH_FILE)) {
     return null;
   }
   try {
-    const content = readFileSync4(AUTH_FILE, "utf8");
+    const content = readFileSync5(AUTH_FILE, "utf8");
     return JSON.parse(content);
   } catch (error) {
     return null;
@@ -6000,7 +6055,7 @@ function createCallbackServer() {
     "Access-Control-Allow-Headers": "Content-Type",
     "Vary": "Origin"
   };
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const server = createServer((req, res) => {
       if (req.method === "OPTIONS") {
         const origin = req.headers.origin;
@@ -6089,7 +6144,7 @@ function createCallbackServer() {
         res.end(JSON.stringify({ ok: true }));
         setTimeout(() => {
           server.close();
-          resolve3(authData);
+          resolve4(authData);
         }, 200);
       });
       req.on("error", (e) => {
@@ -6242,7 +6297,7 @@ async function ensureValidToken() {
   return true;
 }
 function clearCredentials() {
-  if (existsSync4(AUTH_FILE)) {
+  if (existsSync5(AUTH_FILE)) {
     unlinkSync2(AUTH_FILE);
   }
 }
@@ -6422,7 +6477,7 @@ jobs:
 });
 
 // cli/installer/githubSetup.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "fs";
 import { execSync as execSync2 } from "child_process";
 import { join as join4 } from "path";
 function ghSecretSet(token, owner, repo, name, value) {
@@ -6479,7 +6534,7 @@ function writeWorkflowFile(repoRootPath) {
 function findGitRoot(startCwd) {
   let cur = startCwd;
   while (cur && cur !== "/") {
-    if (existsSync5(join4(cur, ".git"))) return cur;
+    if (existsSync6(join4(cur, ".git"))) return cur;
     const parent = join4(cur, "..");
     if (parent === cur) break;
     cur = parent;
@@ -6545,10 +6600,10 @@ function detectSubdirRepos() {
   }
 }
 function ask(rl, question) {
-  return new Promise((resolve3) => rl.question(question, resolve3));
+  return new Promise((resolve4) => rl.question(question, resolve4));
 }
 function waitForGithubToken() {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const server = createServer2((req, res) => {
       if (req.method === "OPTIONS") {
         res.writeHead(204, {
@@ -6585,7 +6640,7 @@ function waitForGithubToken() {
           });
           res.end(JSON.stringify({ ok: true }));
           setTimeout(() => server.close(), 200);
-          resolve3(parsed.github_token);
+          resolve4(parsed.github_token);
         } catch {
           res.writeHead(400, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ error: "invalid json" }));
@@ -6845,7 +6900,7 @@ __export(macKeychain_exports, {
   writeCursorApiKey: () => writeCursorApiKey,
   writeRefreshAgent: () => writeRefreshAgent
 });
-import { existsSync as existsSync6, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, chmodSync, readFileSync as readFileSync5, statSync } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, chmodSync, readFileSync as readFileSync6, statSync } from "fs";
 import { homedir as homedir5, platform as platform2 } from "os";
 import { join as join5 } from "path";
 import { spawnSync } from "child_process";
@@ -6873,7 +6928,7 @@ function exportKeychainCreds() {
 }
 function cursorApiKeyConfigured() {
   try {
-    return existsSync6(CURSOR_API_KEY_FILE) && readFileSync5(CURSOR_API_KEY_FILE, "utf-8").trim().length > 0;
+    return existsSync7(CURSOR_API_KEY_FILE) && readFileSync6(CURSOR_API_KEY_FILE, "utf-8").trim().length > 0;
   } catch {
     return false;
   }
@@ -6889,7 +6944,7 @@ function writeCursorApiKey(key) {
 async function validateCursorApiKey() {
   let key;
   try {
-    key = readFileSync5(CURSOR_API_KEY_FILE, "utf-8").trim();
+    key = readFileSync6(CURSOR_API_KEY_FILE, "utf-8").trim();
   } catch {
     return null;
   }
@@ -6908,7 +6963,7 @@ async function validateCursorApiKey() {
   }
 }
 function credsAreStale() {
-  if (!existsSync6(CLAUDE_CREDS_FILE)) return true;
+  if (!existsSync7(CLAUDE_CREDS_FILE)) return true;
   try {
     const ageMs = Date.now() - statSync(CLAUDE_CREDS_FILE).mtimeMs;
     return ageMs > REFRESH_INTERVAL_SECONDS * 1e3;
@@ -6971,7 +7026,7 @@ function uninstallRefreshAgent() {
     timeout: 5e3
   });
   try {
-    if (existsSync6(LAUNCHD_PLIST)) {
+    if (existsSync7(LAUNCHD_PLIST)) {
       __require("fs").unlinkSync(LAUNCHD_PLIST);
     }
   } catch {
@@ -6983,7 +7038,7 @@ function refreshCreds() {
 }
 function readExportedCreds() {
   try {
-    return readFileSync5(CLAUDE_CREDS_FILE, "utf-8");
+    return readFileSync6(CLAUDE_CREDS_FILE, "utf-8");
   } catch {
     return null;
   }
@@ -7032,7 +7087,7 @@ __export(dockerInstall_exports, {
   splitWorkers: () => splitWorkers,
   waitForContainerReady: () => waitForContainerReady
 });
-import { copyFileSync, existsSync as existsSync7, mkdirSync as mkdirSync7, readFileSync as readFileSync6, readdirSync as readdirSync2 } from "fs";
+import { copyFileSync, existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync7, readdirSync as readdirSync2 } from "fs";
 import { homedir as homedir6 } from "os";
 import { join as join6 } from "path";
 import { execSync as execSync4, spawnSync as spawnSync2 } from "child_process";
@@ -7058,8 +7113,8 @@ function readSynkroFilePool() {
     const root = execSync4("git rev-parse --show-toplevel 2>/dev/null", { encoding: "utf-8", timeout: 3e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
     if (!root) return "auto";
     const fp = join6(root, ".synkro");
-    if (!existsSync7(fp)) return "auto";
-    const parsed = JSON.parse(readFileSync6(fp, "utf-8"));
+    if (!existsSync8(fp)) return "auto";
+    const parsed = JSON.parse(readFileSync7(fp, "utf-8"));
     const pool = parsed?.grader?.pool;
     if (pool === "cursor" || pool === "claude") return pool;
   } catch {
@@ -7186,10 +7241,10 @@ async function dockerInstall(opts = {}) {
   mkdirSync7(BACKUP_DIR, { recursive: true });
   mkdirSync7(CLAUDE_HOST_STATE_DIR, { recursive: true });
   const hostClaudeJson = join6(homedir6(), ".claude.json");
-  if (existsSync7(hostClaudeJson)) {
+  if (existsSync8(hostClaudeJson)) {
     copyFileSync(hostClaudeJson, CLAUDE_HOST_STATE_FILE);
   }
-  if (!existsSync7(MCP_JWT_PATH)) {
+  if (!existsSync8(MCP_JWT_PATH)) {
     throw new DockerInstallError(
       `MCP JWT missing at ${MCP_JWT_PATH}. The installer should mint this before calling dockerInstall.`
     );
@@ -7424,7 +7479,7 @@ async function dockerSafeStart() {
     return { ok: false, pgdataState: "no_container", error: "No synkro-server container found. Run `synkro install` first." };
   }
   const pgCheck = checkPgdata();
-  if (existsSync7(PGDATA_PATH) && readdirSync2(PGDATA_PATH).length > 0) {
+  if (existsSync8(PGDATA_PATH) && readdirSync2(PGDATA_PATH).length > 0) {
     if (pgCheck.healthy) {
       console.log(`  pgdata: existing data found \u2014 ${pgCheck.details}`);
     } else {
@@ -7464,7 +7519,7 @@ async function dockerSafeRestart() {
   return { ok: startResult.ok, stop: stopResult, start: startResult };
 }
 function checkPgdata() {
-  if (!existsSync7(PGDATA_PATH)) return { healthy: false, details: "pgdata directory does not exist" };
+  if (!existsSync8(PGDATA_PATH)) return { healthy: false, details: "pgdata directory does not exist" };
   const entries = readdirSync2(PGDATA_PATH);
   if (entries.length === 0) return { healthy: true, details: "empty (fresh start)" };
   const hasPidFile = entries.includes("postmaster.pid");
@@ -7513,14 +7568,14 @@ __export(setupGithub_exports, {
 import { createInterface as createInterface2 } from "readline/promises";
 import { stdin as input, stdout as output } from "process";
 import { execSync as execSync5, spawn as nodeSpawn } from "child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync7, unlinkSync as unlinkSync3 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync8, unlinkSync as unlinkSync3 } from "fs";
 import { homedir as homedir7, platform as platform3 } from "os";
 import { join as join7 } from "path";
 import { execFile as execFile2 } from "child_process";
 function readConfig() {
-  if (!existsSync8(CONFIG_PATH)) return {};
+  if (!existsSync9(CONFIG_PATH)) return {};
   const out = {};
-  for (const line of readFileSync7(CONFIG_PATH, "utf-8").split("\n")) {
+  for (const line of readFileSync8(CONFIG_PATH, "utf-8").split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#")) continue;
     const eq = t.indexOf("=");
@@ -7533,7 +7588,7 @@ async function prompt(rl, q, opts = {}) {
     process.stdout.write(q);
     const wasRaw = process.stdin.isRaw;
     if (process.stdin.setRawMode) process.stdin.setRawMode(true);
-    return await new Promise((resolve3) => {
+    return await new Promise((resolve4) => {
       let chunk = "";
       const onData = (data) => {
         const s = data.toString("utf-8");
@@ -7541,7 +7596,7 @@ async function prompt(rl, q, opts = {}) {
           process.stdin.removeListener("data", onData);
           if (process.stdin.setRawMode) process.stdin.setRawMode(wasRaw ?? false);
           process.stdout.write("\n");
-          resolve3(chunk);
+          resolve4(chunk);
           return;
         }
         if (s === "") process.exit(130);
@@ -7582,7 +7637,7 @@ function sleep(ms) {
 }
 function captureClaudeSetupToken() {
   const tmpFile = join7(SYNKRO_DIR3, `token-capture-${Date.now()}.raw`);
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const proc = nodeSpawn("script", ["-q", tmpFile, "claude", "setup-token"], {
       stdio: "inherit"
     });
@@ -7590,7 +7645,7 @@ function captureClaudeSetupToken() {
     proc.on("close", (code) => {
       let raw = "";
       try {
-        raw = readFileSync7(tmpFile, "utf-8");
+        raw = readFileSync8(tmpFile, "utf-8");
       } catch (e) {
         reject(new Error(`Could not read script output file: ${e.message}`));
         return;
@@ -7612,7 +7667,7 @@ function captureClaudeSetupToken() {
         reject(new Error(`Could not find token in claude setup-token output (file=${raw.length}b, yellow=${yellow.length}b)`));
         return;
       }
-      resolve3(token[0]);
+      resolve4(token[0]);
     });
   });
 }
@@ -7874,9 +7929,10 @@ __export(install_exports, {
   installCommand: () => installCommand,
   parseArgs: () => parseArgs,
   reconcileHarness: () => reconcileHarness,
+  syncSkillFiles: () => syncSkillFiles,
   writeHookScripts: () => writeHookScripts
 });
-import { existsSync as existsSync9, mkdirSync as mkdirSync8, writeFileSync as writeFileSync7, chmodSync as chmodSync2, readFileSync as readFileSync8, readdirSync as readdirSync3 } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync8, writeFileSync as writeFileSync7, chmodSync as chmodSync2, readFileSync as readFileSync9, readdirSync as readdirSync3 } from "fs";
 import { homedir as homedir8 } from "os";
 import { join as join8 } from "path";
 import { execSync as execSync6, spawnSync as spawnSync3 } from "child_process";
@@ -7908,20 +7964,20 @@ async function promptAgentSelection(detected) {
   detected.forEach((a, i) => console.log(`  ${i + 1}. ${a.name}`));
   console.log(`  ${detected.length + 1}. Both / all (default)`);
   const rl = createInterface3({ input: process.stdin, output: process.stdout });
-  const ask2 = () => new Promise((resolve3) => {
+  const ask2 = () => new Promise((resolve4) => {
     rl.question(`Pick [1-${detected.length + 1}] (default: all): `, (answer) => {
       const t = answer.trim().toLowerCase();
       if (t === "" || t === String(detected.length + 1) || t === "both" || t === "all") {
         rl.close();
-        return resolve3(detected);
+        return resolve4(detected);
       }
       const n = parseInt(t, 10);
       if (Number.isInteger(n) && n >= 1 && n <= detected.length) {
         rl.close();
-        return resolve3([detected[n - 1]]);
+        return resolve4([detected[n - 1]]);
       }
       console.log("Invalid choice. Try again.");
-      resolve3(ask2());
+      resolve4(ask2());
     });
   });
   return ask2();
@@ -7944,12 +8000,12 @@ async function promptCursorApiKey(opts) {
     return;
   }
   const rl = createInterface3({ input: process.stdin, output: process.stdout });
-  const key = await new Promise((resolve3) => {
+  const key = await new Promise((resolve4) => {
     rl.question(
       "Cursor grading needs a Cursor API key (cursor.com \u2192 Settings \u2192 API Keys).\nPaste it now, or press Enter to skip (Cursor workers stay idle until set): ",
       (answer) => {
         rl.close();
-        resolve3(answer.trim());
+        resolve4(answer.trim());
       }
     );
   });
@@ -7963,12 +8019,12 @@ async function promptCursorApiKey(opts) {
 async function promptGradingMode() {
   if (!process.stdin.isTTY) return "local";
   const rl = createInterface3({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     rl.question(
       "Where should grading run?\n  local \u2014 on this machine, via the Synkro container (default)\n  byok  \u2014 via an LLM API using your own provider key\nChoose [local] / byok: ",
       (answer) => {
         rl.close();
-        resolve3(answer.trim().toLowerCase() === "byok" ? "byok" : "local");
+        resolve4(answer.trim().toLowerCase() === "byok" ? "byok" : "local");
       }
     );
   });
@@ -7976,25 +8032,25 @@ async function promptGradingMode() {
 async function promptStorageMode() {
   if (!process.stdin.isTTY) return "local";
   const rl = createInterface3({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     rl.question(
       "Where should telemetry be stored?\n  local \u2014 on this machine only (default)\n  cloud \u2014 sent to Synkro cloud\nChoose [local] / cloud: ",
       (answer) => {
         rl.close();
-        resolve3(answer.trim().toLowerCase() === "cloud" ? "cloud" : "local");
+        resolve4(answer.trim().toLowerCase() === "cloud" ? "cloud" : "local");
       }
     );
   });
 }
 async function promptTranscriptConsent() {
   const rl = createInterface3({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     rl.question(
       "Import and embed your Claude Code session history?\nThis indexes past sessions so Ask Synkro can answer questions\nabout your coding patterns and the dashboard shows full history. (Y/n) ",
       (answer) => {
         rl.close();
         const trimmed = answer.trim().toLowerCase();
-        resolve3(trimmed === "" || trimmed === "y" || trimmed === "yes");
+        resolve4(trimmed === "" || trimmed === "y" || trimmed === "yes");
       }
     );
   });
@@ -8102,7 +8158,7 @@ function shellQuoteSingle(value) {
 }
 function resolveSynkroBundle() {
   const scriptPath = process.argv[1];
-  if (scriptPath && existsSync9(scriptPath)) return scriptPath;
+  if (scriptPath && existsSync10(scriptPath)) return scriptPath;
   return null;
 }
 function writeConfigEnv(opts) {
@@ -8122,7 +8178,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.33")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.34")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -8144,8 +8200,8 @@ function resolveDeploymentMode() {
   const envOverride = process.env.SYNKRO_DEPLOYMENT_MODE?.toLowerCase();
   if (envOverride === "bare-host" || envOverride === "docker") return envOverride;
   try {
-    if (existsSync9(CONFIG_PATH2)) {
-      const m = readFileSync8(CONFIG_PATH2, "utf-8").match(/^SYNKRO_DEPLOYMENT_MODE='([^']*)'/m);
+    if (existsSync10(CONFIG_PATH2)) {
+      const m = readFileSync9(CONFIG_PATH2, "utf-8").match(/^SYNKRO_DEPLOYMENT_MODE='([^']*)'/m);
       const val = m?.[1]?.toLowerCase();
       if (val === "bare-host" || val === "docker") return val;
     }
@@ -8174,14 +8230,14 @@ function collectLocalMetadata(includeClaudeCode = true) {
   }
   const claudeDir = join8(homedir8(), ".claude");
   try {
-    const settings = JSON.parse(readFileSync8(join8(claudeDir, "settings.json"), "utf-8"));
+    const settings = JSON.parse(readFileSync9(join8(claudeDir, "settings.json"), "utf-8"));
     const plugins = Object.keys(settings.enabledPlugins ?? {}).filter((k) => settings.enabledPlugins[k]);
     if (plugins.length) meta.enabled_plugins = plugins;
     if (settings.permissions?.defaultMode) meta.permissions_mode = settings.permissions.defaultMode;
   } catch {
   }
   try {
-    const mcpCache = JSON.parse(readFileSync8(join8(claudeDir, "mcp-needs-auth-cache.json"), "utf-8"));
+    const mcpCache = JSON.parse(readFileSync9(join8(claudeDir, "mcp-needs-auth-cache.json"), "utf-8"));
     const mcpNames = Object.keys(mcpCache);
     if (mcpNames.length) meta.mcp_servers = mcpNames;
   } catch {
@@ -8196,7 +8252,7 @@ function collectLocalMetadata(includeClaudeCode = true) {
     const sessionsDir = join8(claudeDir, "sessions");
     const files = readdirSync3(sessionsDir).filter((f) => f.endsWith(".json")).slice(-5);
     for (const f of files) {
-      const s = JSON.parse(readFileSync8(join8(sessionsDir, f), "utf-8"));
+      const s = JSON.parse(readFileSync9(join8(sessionsDir, f), "utf-8"));
       if (s.version) {
         meta.cc_version = meta.cc_version || s.version;
         break;
@@ -8328,7 +8384,7 @@ async function installCommand(opts = {}) {
   for (const mode of ["edit", "bash"]) {
     const pidFile = join8(SYNKRO_DIR4, "daemon", mode, "daemon.pid");
     try {
-      const pid = parseInt(readFileSync8(pidFile, "utf-8").trim(), 10);
+      const pid = parseInt(readFileSync9(pidFile, "utf-8").trim(), 10);
       if (pid > 0) {
         process.kill(pid, "SIGTERM");
         console.log(`Stopped stale ${mode} grader daemon (pid ${pid})`);
@@ -8462,7 +8518,7 @@ async function installCommand(opts = {}) {
     try {
       if (useLocalMcp) {
         const jwtPath = join8(SYNKRO_DIR4, ".mcp-jwt");
-        if (!existsSync9(jwtPath)) {
+        if (!existsSync10(jwtPath)) {
           const mintResp = await fetch(`${gatewayUrl}/api/v1/cli/mcp-token`, {
             method: "POST",
             headers: { "Authorization": `Bearer ${token}`, "Content-Type": "application/json" },
@@ -8552,7 +8608,7 @@ async function installCommand(opts = {}) {
     const ready = await waitForContainerReady(6e4);
     if (ready) {
       console.log("  \u2713 container ready");
-      const mcpJwt = readFileSync8(join8(SYNKRO_DIR4, ".mcp-jwt"), "utf-8").trim();
+      const mcpJwt = readFileSync9(join8(SYNKRO_DIR4, ".mcp-jwt"), "utf-8").trim();
       try {
         const ingestResp = await fetch(`http://127.0.0.1:${hostMcpPort}/api/ingest`, {
           method: "POST",
@@ -8569,6 +8625,7 @@ async function installCommand(opts = {}) {
       } catch {
         console.warn("  \u26A0 ingest endpoint unreachable \u2014 telemetry spool may not drain.");
       }
+      await syncSkillFiles();
     } else {
       console.error("  \u2717 container did not become healthy within 60s");
       console.error("    Run `docker logs synkro-server` to debug.");
@@ -8583,7 +8640,7 @@ async function installCommand(opts = {}) {
         try {
           let mcpToken = "";
           try {
-            mcpToken = readFileSync8(join8(SYNKRO_DIR4, ".mcp-jwt"), "utf-8").trim();
+            mcpToken = readFileSync9(join8(SYNKRO_DIR4, ".mcp-jwt"), "utf-8").trim();
           } catch {
           }
           if (mcpToken) {
@@ -8652,7 +8709,7 @@ function writeSynkroFileIfMissing(opts) {
     const root = execSync6("git rev-parse --show-toplevel", { encoding: "utf-8", timeout: 3e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
     if (!root) return;
     const fp = join8(root, ".synkro");
-    if (existsSync9(fp)) {
+    if (existsSync10(fp)) {
       console.log(`  .synkro: ${fp} (existing, respected)`);
       return;
     }
@@ -8686,8 +8743,8 @@ function readSynkroFilePool2() {
     const root = execSync6("git rev-parse --show-toplevel", { encoding: "utf-8", timeout: 3e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
     if (!root) return "auto";
     const fp = join8(root, ".synkro");
-    if (!existsSync9(fp)) return "auto";
-    const parsed = JSON.parse(readFileSync8(fp, "utf-8"));
+    if (!existsSync10(fp)) return "auto";
+    const parsed = JSON.parse(readFileSync9(fp, "utf-8"));
     const pool = parsed?.grader?.pool;
     if (pool === "cursor" || pool === "claude") return pool;
   } catch {
@@ -8699,8 +8756,8 @@ function readFullSynkroFile() {
     const root = execSync6("git rev-parse --show-toplevel", { encoding: "utf-8", timeout: 3e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
     if (!root) return null;
     const fp = join8(root, ".synkro");
-    if (!existsSync9(fp)) return null;
-    const parsed = JSON.parse(readFileSync8(fp, "utf-8"));
+    if (!existsSync10(fp)) return null;
+    const parsed = JSON.parse(readFileSync9(fp, "utf-8"));
     const valid = ["claude-code", "cursor"];
     const harness = Array.isArray(parsed.harness) ? parsed.harness.filter((h) => valid.includes(h)) : ["claude-code", "cursor"];
     return {
@@ -8710,7 +8767,9 @@ function readFullSynkroFile() {
         mode: ["local", "byok"].includes(parsed.grader?.mode) ? parsed.grader.mode : "local"
       },
       ruleset: parsed.ruleset || "default",
-      scanning: { cwe: parsed.scanning?.cwe !== false, cve: parsed.scanning?.cve !== false }
+      skills: Array.isArray(parsed.skills) ? parsed.skills.filter((s) => typeof s === "string" && s.endsWith(".md")) : [],
+      scanning: { cwe: parsed.scanning?.cwe !== false, cve: parsed.scanning?.cve !== false },
+      _repoRoot: root
     };
   } catch {
     return null;
@@ -8745,7 +8804,7 @@ function reconcileHarness() {
     });
     console.log("  \u2713 Claude Code hooks registered");
     try {
-      const mcpJwt = readFileSync8(join8(SYNKRO_DIR4, ".mcp-jwt"), "utf-8").trim();
+      const mcpJwt = readFileSync9(join8(SYNKRO_DIR4, ".mcp-jwt"), "utf-8").trim();
       if (mcpJwt) {
         installMcpConfig({ gatewayUrl: "", bearerToken: mcpJwt, local: true });
         console.log("  \u2713 Claude Code MCP registered");
@@ -8797,6 +8856,33 @@ function reconcileHarness() {
   if (providers.length === 0) providers.push("claude_code");
   return splitWorkers(total, providers);
 }
+async function syncSkillFiles() {
+  const sf = readFullSynkroFile();
+  if (!sf || sf.skills.length === 0) return;
+  const resolved = resolveSkillPaths(sf.skills, sf._repoRoot);
+  if (resolved.length === 0) return;
+  const mcpPort = process.env.SYNKRO_MCP_PORT || "18931";
+  for (const fp of resolved) {
+    const skill = parseSkillFile(fp);
+    if (!skill || skill.rules.length === 0) continue;
+    try {
+      const resp = await fetch(`http://127.0.0.1:${mcpPort}/api/local/skills/sync`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(skill),
+        signal: AbortSignal.timeout(1e4)
+      });
+      if (resp.ok) {
+        const result = await resp.json();
+        console.log(`  \u2713 skill ${skill.source}: ${result.created} rules synced (${result.removed} removed)`);
+      } else {
+        console.warn(`  \u26A0 skill ${skill.source}: sync failed (${resp.status})`);
+      }
+    } catch (e) {
+      console.warn(`  \u26A0 skill ${skill.source}: ${e.message}`);
+    }
+  }
+}
 function detectGitRepo2() {
   const run = (cmd2) => {
     try {
@@ -8816,7 +8902,7 @@ function getClaudeProjectsFolder() {
   const cwd = process.cwd();
   const sanitized = "-" + cwd.replace(/\//g, "-");
   const projectsDir = join8(homedir8(), ".claude", "projects", sanitized);
-  return existsSync9(projectsDir) ? projectsDir : null;
+  return existsSync10(projectsDir) ? projectsDir : null;
 }
 function extractSessionInsights(projectsDir) {
   const insights = [];
@@ -8825,7 +8911,7 @@ function extractSessionInsights(projectsDir) {
     const sessionId = file.replace(".jsonl", "");
     const filePath = join8(projectsDir, file);
     try {
-      const content = readFileSync8(filePath, "utf-8");
+      const content = readFileSync9(filePath, "utf-8");
       const lines = content.split("\n").filter(Boolean);
       for (let i = 0; i < lines.length; i++) {
         try {
@@ -8901,7 +8987,7 @@ function extractTextContent(content) {
   return "";
 }
 function parseTranscriptFile(filePath) {
-  const content = readFileSync8(filePath, "utf-8");
+  const content = readFileSync9(filePath, "utf-8");
   const lines = content.split("\n").filter(Boolean);
   const messages = [];
   for (let i = 0; i < lines.length; i++) {
@@ -8971,7 +9057,7 @@ async function syncTranscriptsLocal(mcpPort, mcpToken, repo) {
       process.stdout.write(`\r  Progress: ${i + 1}/${files.length} sessions (${totalMessages} messages embedded)   `);
     }
     try {
-      const content = readFileSync8(join8(projectsDir, file), "utf-8");
+      const content = readFileSync9(join8(projectsDir, file), "utf-8");
       const lineCount = content.split("\n").filter(Boolean).length;
       writeFileSync7(join8(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
     } catch {
@@ -9025,7 +9111,7 @@ async function syncTranscriptsBulk(gatewayUrl, token, repo) {
       const sessionId = file.replace(".jsonl", "");
       const filePath = join8(projectsDir, file);
       try {
-        const content = readFileSync8(filePath, "utf-8");
+        const content = readFileSync9(filePath, "utf-8");
         const lineCount = content.split("\n").filter(Boolean).length;
         writeFileSync7(join8(OFFSETS_DIR, sessionId), String(lineCount), "utf-8");
       } catch {
@@ -9042,6 +9128,7 @@ var init_install = __esm({
     init_ccHookConfig();
     init_cursorHookConfig();
     init_mcpConfig();
+    init_skillParser();
     init_hookScripts();
     init_hookScriptsTs();
     init_stub();
@@ -9104,7 +9191,7 @@ rl.on('line', async (line) => {
 });
 
 // cli/local-cc/install.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, readFileSync as readFileSync9, chmodSync as chmodSync3, copyFileSync as copyFileSync2, renameSync as renameSync4, unlinkSync as unlinkSync4, openSync, fsyncSync, closeSync } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, readFileSync as readFileSync10, chmodSync as chmodSync3, copyFileSync as copyFileSync2, renameSync as renameSync4, unlinkSync as unlinkSync4, openSync, fsyncSync, closeSync } from "fs";
 import { join as join9 } from "path";
 import { homedir as homedir9 } from "os";
 import { spawnSync as spawnSync4 } from "child_process";
@@ -9140,10 +9227,10 @@ function runBunInstall() {
   }
 }
 function safelyMutateClaudeJson(mutator) {
-  if (!existsSync10(CLAUDE_JSON_PATH)) {
+  if (!existsSync11(CLAUDE_JSON_PATH)) {
     return;
   }
-  const originalText = readFileSync9(CLAUDE_JSON_PATH, "utf-8");
+  const originalText = readFileSync10(CLAUDE_JSON_PATH, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(originalText);
@@ -9594,7 +9681,7 @@ var disconnect_exports = {};
 __export(disconnect_exports, {
   disconnectCommand: () => disconnectCommand
 });
-import { existsSync as existsSync11, rmSync, readdirSync as readdirSync4 } from "fs";
+import { existsSync as existsSync12, rmSync, readdirSync as readdirSync4 } from "fs";
 import { homedir as homedir10 } from "os";
 import { join as join10 } from "path";
 import { spawnSync as spawnSync5 } from "child_process";
@@ -9635,10 +9722,10 @@ function confirmPurge() {
     return Promise.resolve(false);
   }
   const rl = createInterface4({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     rl.question("   Type 'yes' to wipe everything (anything else cancels): ", (answer) => {
       rl.close();
-      resolve3(answer.trim().toLowerCase() === "yes");
+      resolve4(answer.trim().toLowerCase() === "yes");
     });
   });
 }
@@ -9670,7 +9757,7 @@ async function disconnectCommand(args2 = []) {
     const cursorMcpRemoved = uninstallCursorMcpConfig();
     console.log(`${cursorMcpRemoved ? "\u2713" : "\xB7"} MCP guardrails (Cursor): ${cursorMcpRemoved ? "removed from ~/.cursor/mcp.json" : "no entry found"}`);
   }
-  if (existsSync11(SYNKRO_DIR5)) {
+  if (existsSync12(SYNKRO_DIR5)) {
     if (purge) {
       rmSync(SYNKRO_DIR5, { recursive: true, force: true });
       console.log(`\u2713 wiped ${SYNKRO_DIR5} entirely \u2014 including all scan data and backups`);
@@ -9713,7 +9800,7 @@ var init_disconnect = __esm({
 });
 
 // cli/local-cc/turnLog.ts
-import { appendFileSync, existsSync as existsSync12, mkdirSync as mkdirSync10, openSync as openSync2, readFileSync as readFileSync10, readSync, closeSync as closeSync2, statSync as statSync2, watchFile, unwatchFile } from "fs";
+import { appendFileSync, existsSync as existsSync13, mkdirSync as mkdirSync10, openSync as openSync2, readFileSync as readFileSync11, readSync, closeSync as closeSync2, statSync as statSync2, watchFile, unwatchFile } from "fs";
 import { dirname as dirname6, join as join11 } from "path";
 import { homedir as homedir11 } from "os";
 function truncate(s, max = PREVIEW_MAX) {
@@ -9751,11 +9838,11 @@ function appendTurn(args2) {
   }
 }
 function readRecentTurns(n = 20) {
-  if (!existsSync12(TURN_LOG_PATH)) return [];
+  if (!existsSync13(TURN_LOG_PATH)) return [];
   try {
     const size = statSync2(TURN_LOG_PATH).size;
     if (size === 0) return [];
-    const text = readFileSync10(TURN_LOG_PATH, "utf-8");
+    const text = readFileSync11(TURN_LOG_PATH, "utf-8");
     const lines = text.split("\n").filter(Boolean);
     const lastN = lines.slice(-n).reverse();
     return lastN.map((line) => {
@@ -9772,7 +9859,7 @@ function readRecentTurns(n = 20) {
 function followTurns(onEntry) {
   try {
     mkdirSync10(dirname6(TURN_LOG_PATH), { recursive: true });
-    if (!existsSync12(TURN_LOG_PATH)) {
+    if (!existsSync13(TURN_LOG_PATH)) {
       appendFileSync(TURN_LOG_PATH, "", "utf-8");
     }
   } catch {
@@ -9848,7 +9935,7 @@ async function submitToChannel(role, payload, opts = {}) {
   const port = opts.port ?? CHANNEL_PORT;
   const startedAt = Date.now();
   try {
-    const result = await new Promise((resolve3, reject) => {
+    const result = await new Promise((resolve4, reject) => {
       const req = httpRequest({
         host: CHANNEL_HOST,
         port,
@@ -9874,7 +9961,7 @@ async function submitToChannel(role, payload, opts = {}) {
               reject(new LocalCCError(parsed.error));
               return;
             }
-            resolve3(String(parsed.result ?? ""));
+            resolve4(String(parsed.result ?? ""));
           } catch (err) {
             reject(new LocalCCError(`malformed channel response: ${text.slice(0, 200)}`, err));
           }
@@ -9900,14 +9987,14 @@ async function submitToChannel(role, payload, opts = {}) {
   }
 }
 function isChannelAvailable(port = CHANNEL_PORT, timeoutMs = 500) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     const sock = connect(port, CHANNEL_HOST);
     const done = (ok) => {
       try {
         sock.destroy();
       } catch {
       }
-      resolve3(ok);
+      resolve4(ok);
     };
     sock.once("connect", () => done(true));
     sock.once("error", () => done(false));
@@ -9939,10 +10026,10 @@ __export(grade_exports, {
   gradeCommand: () => gradeCommand
 });
 async function readStdin() {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const chunks = [];
     process.stdin.on("data", (c) => chunks.push(c));
-    process.stdin.on("end", () => resolve3(Buffer.concat(chunks).toString("utf-8")));
+    process.stdin.on("end", () => resolve4(Buffer.concat(chunks).toString("utf-8")));
     process.stdin.on("error", reject);
   });
 }
@@ -10101,14 +10188,14 @@ function ensureRunning(opts = {}) {
   return startTask(opts);
 }
 function probePort(host, port, timeoutMs = 500) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     const sock = connect2(port, host);
     const done = (ok) => {
       try {
         sock.destroy();
       } catch {
       }
-      resolve3(ok);
+      resolve4(ok);
     };
     sock.once("connect", () => done(true));
     sock.once("error", () => done(false));
@@ -10201,13 +10288,13 @@ var init_pueue = __esm({
 });
 
 // cli/local-cc/settings.ts
-import { existsSync as existsSync13, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync12 } from "fs";
 import { homedir as homedir13 } from "os";
 import { join as join13 } from "path";
 function isLocalCCEnabled() {
-  if (!existsSync13(CONFIG_PATH3)) return false;
+  if (!existsSync14(CONFIG_PATH3)) return false;
   try {
-    const content = readFileSync11(CONFIG_PATH3, "utf-8");
+    const content = readFileSync12(CONFIG_PATH3, "utf-8");
     const match = content.match(/^SYNKRO_LOCAL_INFERENCE='([^']*)'/m);
     return match?.[1] === "yes";
   } catch {
@@ -10231,7 +10318,7 @@ import { spawnSync as spawnSync7 } from "child_process";
 import { homedir as homedir14 } from "os";
 import { join as join14 } from "path";
 import { readFileSync as fsReadFileSync, existsSync as fsExistsSync } from "fs";
-import { existsSync as existsSync14, readFileSync as readFileSync12, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync13, writeFileSync as writeFileSync9 } from "fs";
 function deploymentMode() {
   const env = (process.env.SYNKRO_DEPLOYMENT_MODE || "").toLowerCase();
   if (env === "docker") return "docker";
@@ -10337,15 +10424,15 @@ TROUBLESHOOTING
 `);
 }
 function readGatewayUrl() {
-  if (existsSync14(CONFIG_PATH4)) {
-    const m = readFileSync12(CONFIG_PATH4, "utf-8").match(/^SYNKRO_GATEWAY_URL='([^']*)'/m);
+  if (existsSync15(CONFIG_PATH4)) {
+    const m = readFileSync13(CONFIG_PATH4, "utf-8").match(/^SYNKRO_GATEWAY_URL='([^']*)'/m);
     if (m) return m[1];
   }
   return "https://api.synkro.sh";
 }
 function updateLocalInferenceFlag(enabled) {
-  if (!existsSync14(CONFIG_PATH4)) return;
-  let content = readFileSync12(CONFIG_PATH4, "utf-8");
+  if (!existsSync15(CONFIG_PATH4)) return;
+  let content = readFileSync13(CONFIG_PATH4, "utf-8");
   const flag = enabled ? "yes" : "no";
   if (content.includes("SYNKRO_LOCAL_INFERENCE=")) {
     content = content.replace(/^SYNKRO_LOCAL_INFERENCE='[^']*'/m, `SYNKRO_LOCAL_INFERENCE='${flag}'`);
@@ -10537,6 +10624,7 @@ async function cmdRestart(rest = []) {
     await dockerUpdate({ claudeWorkers, cursorWorkers });
     const ready = await waitForContainerReady(6e4);
     console.log(ready ? "\u2713 container ready" : "\u26A0 container did not pass /healthz within 60s");
+    if (ready) await syncSkillFiles();
     return;
   }
   stopTask(CHANNEL_PRIMARY);
@@ -10651,7 +10739,7 @@ function cmdLogs(rest) {
     if (!raw) console.log("  " + colorize("(use --raw / -r to see full payloads, --live / -f to follow)", 90));
     return;
   }
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     console.log("  " + colorize("\u2014 following new turns (Ctrl-C to exit) \u2014", 90));
     const stop = followTurns((t) => {
       console.log("  " + formatTurn(t, raw));
@@ -10659,7 +10747,7 @@ function cmdLogs(rest) {
     const onSigint = () => {
       stop();
       process.removeListener("SIGINT", onSigint);
-      resolve3();
+      resolve4();
     };
     process.on("SIGINT", onSigint);
   });
@@ -10887,13 +10975,13 @@ var config_exports = {};
 __export(config_exports, {
   configCommand: () => configCommand
 });
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync10, existsSync as existsSync15 } from "fs";
+import { readFileSync as readFileSync14, writeFileSync as writeFileSync10, existsSync as existsSync16 } from "fs";
 import { join as join15 } from "path";
 import { homedir as homedir15 } from "os";
 function readConfigEnv() {
-  if (!existsSync15(CONFIG_PATH5)) return {};
+  if (!existsSync16(CONFIG_PATH5)) return {};
   const out = {};
-  for (const line of readFileSync13(CONFIG_PATH5, "utf-8").split("\n")) {
+  for (const line of readFileSync14(CONFIG_PATH5, "utf-8").split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#")) continue;
     const eq = t.indexOf("=");
@@ -10902,11 +10990,11 @@ function readConfigEnv() {
   return out;
 }
 function updateConfigValue(key, value) {
-  if (!existsSync15(CONFIG_PATH5)) {
+  if (!existsSync16(CONFIG_PATH5)) {
     console.error("No config found. Run `synkro install` first.");
     process.exit(1);
   }
-  const lines = readFileSync13(CONFIG_PATH5, "utf-8").split("\n");
+  const lines = readFileSync14(CONFIG_PATH5, "utf-8").split("\n");
   const pattern = new RegExp(`^${key}=`);
   let found = false;
   const updated = lines.map((line) => {
@@ -11033,14 +11121,14 @@ var init_config = __esm({
 });
 
 // cli/bootstrap.js
-import { readFileSync as readFileSync14, existsSync as existsSync16 } from "fs";
-import { resolve as resolve2 } from "path";
+import { readFileSync as readFileSync15, existsSync as existsSync17 } from "fs";
+import { resolve as resolve3 } from "path";
 var envCandidates = [
-  resolve2(process.env.HOME ?? "", ".synkro", "config.env")
+  resolve3(process.env.HOME ?? "", ".synkro", "config.env")
 ];
 for (const envPath of envCandidates) {
-  if (!existsSync16(envPath)) continue;
-  const envContent = readFileSync14(envPath, "utf-8");
+  if (!existsSync17(envPath)) continue;
+  const envContent = readFileSync15(envPath, "utf-8");
   for (const line of envContent.split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -11055,7 +11143,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.33");
+  console.log("1.6.34");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents