@synkro-sh/cli 1.6.72 → 1.6.74

package/dist/bootstrap.js

@@ -145,7 +145,7 @@ function installCCHooks(settingsPath, config) {
       {
         type: "command",
         command: config.bashJudgeScriptPath,
-        timeout: 30
+        timeout: 50
       }
     ],
     [SYNKRO_MARKER]: true
@@ -156,12 +156,12 @@ function installCCHooks(settingsPath, config) {
       {
         type: "command",
         command: config.editPrecheckScriptPath,
-        timeout: 30
+        timeout: 50
       },
       {
         type: "command",
         command: config.cwePrecheckScriptPath,
-        timeout: 30
+        timeout: 50
       },
       {
         type: "command",
@@ -177,7 +177,7 @@ function installCCHooks(settingsPath, config) {
       {
         type: "command",
         command: config.agentJudgeScriptPath,
-        timeout: 30
+        timeout: 50
       }
     ],
     [SYNKRO_MARKER]: true
@@ -188,7 +188,7 @@ function installCCHooks(settingsPath, config) {
       {
         type: "command",
         command: config.planJudgeScriptPath,
-        timeout: 45
+        timeout: 50
       }
     ],
     [SYNKRO_MARKER]: true
@@ -200,7 +200,7 @@ function installCCHooks(settingsPath, config) {
         {
           type: "command",
           command: config.mcpGateScriptPath,
-          timeout: 30
+          timeout: 50
         }
       ],
       [SYNKRO_MARKER]: true
@@ -1272,7 +1272,7 @@ export function findGitRoot(cwd: string): string {
 export interface SynkroFileConfig {
   version: number;
   harness: ('claude-code' | 'cursor')[];
-  grader: { pool: 'auto' | 'claude' | 'cursor'; mode?: string };
+  grader: { pool: 'auto' | 'claude' | 'cursor'; mode?: string; combinedEditGrade?: boolean };
   workers: { claude?: number; cursor?: number };
   ruleset: string;
   skills: string[];
@@ -1379,6 +1379,7 @@ export function loadSynkroFile(cwd?: string): SynkroFileConfig {
       grader: {
         pool: normalizePoolToken(parsed.grader?.pool),
         mode: ['local', 'byok'].includes(parsed.grader?.mode) ? parsed.grader.mode : undefined,
+        combinedEditGrade: parsed.grader?.combined_edit_grade === true,
       },
       workers: {
         // Counts may live under the grader block (unified form) or the legacy
@@ -1632,7 +1633,7 @@ export function tag(rt: string, config: HookConfig, grader?: string): string {
 
 // \u2500\u2500\u2500 Local Grading (direct channel call) \u2500\u2500\u2500
 
-type GradeRole = 'grade-edit' | 'grade-bash' | 'grade-plan' | 'grade-cwe';
+type GradeRole = 'grade-edit' | 'grade-bash' | 'grade-plan' | 'grade-cwe' | 'grade-edit-cwe';
 
 // Which coding agent fired this grade. The dispatcher routes grades to a
 // worker pool of the matching kind so a Cursor grade is judged by Cursor and
@@ -1642,8 +1643,21 @@ export type AgentKind = 'claude_code' | 'cursor';
 
 const ROLE_MAP: Record<string, GradeRole> = {
   edit: 'grade-edit', bash: 'grade-bash', plan: 'grade-plan', cwe: 'grade-cwe',
+  'edit-cwe': 'grade-edit-cwe',
 };
 
+// Combined edit-time grade (org rules + CWE in one inference). OFF by default;
+// flipped on by env var or synkro.toml [grader] combined_edit_grade = true.
+// When on: the edit-precheck hook runs ONE grade-edit-cwe call and the
+// cwe-precheck hook no-ops (the combined call owns CWE) \u2014 halving inferences
+// per edit. See GRADER_PRIMER_EDIT_CWE.
+export function combinedEditGradeEnabled(synkroFile?: SynkroFileConfig): boolean {
+  const env = process.env.SYNKRO_COMBINED_EDIT_GRADE;
+  if (env === '1' || env === 'true') return true;
+  if (env === '0' || env === 'false') return false;
+  return synkroFile?.grader?.combinedEditGrade === true;
+}
+
 async function channelGrade(role: GradeRole, prompt: string, _jwt: string, port: number, timeoutMs = 30000, agentKind: AgentKind = 'claude_code'): Promise<string> {
   const body = JSON.stringify({ role, payload: prompt, content: prompt, agent_kind: agentKind });
 
@@ -1689,7 +1703,12 @@ async function cloudGrade(surface: string, prompt: string, jwt: string, timeoutM
 // JWT (the Worker derives the org from the token and routes to that org's
 // container). Any non-2xx throws so the caller's catch fails open.
 const CONTAINERS_URL = process.env.SYNKRO_CONTAINERS_URL || 'https://containers.synkro.sh';
-async function hostedGrade(role: GradeRole, prompt: string, jwt: string, timeoutMs = 24000, agentKind: AgentKind = 'claude_code'): Promise<string> {
+// Cloud grades cross the network and can hit a cold/queued worker, so they get a
+// longer leash than on-device channel grades. The hook chain is sized around it:
+// grade abort (45s) < watchdog (48s) < CC hook budget (50s) \u2014 the grade aborts
+// FIRST so the caller's catch fails open cleanly before CC ever force-kills us.
+const CLOUD_GRADE_TIMEOUT_MS = 45000;
+async function hostedGrade(role: GradeRole, prompt: string, jwt: string, timeoutMs = CLOUD_GRADE_TIMEOUT_MS, agentKind: AgentKind = 'claude_code'): Promise<string> {
   const resp = await fetch(CONTAINERS_URL + '/grade/submit', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
@@ -1705,18 +1724,20 @@ async function hostedGrade(role: GradeRole, prompt: string, jwt: string, timeout
   return String(data.result || '');
 }
 
-// Default 24s \u2014 MUST stay below the CC hook timeout (30s for edit/bash/cwe in
-// ccHookConfig.ts) so the AbortSignal fires and the caller's catch fails open
-// cleanly. If this matches or exceeds the CC budget, CC force-kills the bun
-// process mid-fetch (exit 142 / SIGALRM) and surfaces the in-flight grader
-// prompt as a hook error instead of a clean pass.
+// Local-channel default 24s \u2014 MUST stay below the CC hook timeout (50s for
+// edit/bash/cwe in ccHookConfig.ts) so the AbortSignal fires and the caller's
+// catch fails open cleanly. A hung on-device worker should fail open fast; only
+// cloud grades (network + cold workers) get the longer 45s leash below.
 export async function localGrade(surface: string, prompt: string, timeoutMs = 24000, agentKind: AgentKind = 'claude_code'): Promise<string> {
   const jwt = loadJwt();
   if (!jwt) throw new Error('NO_JWT');
   // Cloud-container: the grader runs on Cloudflare Containers \u2014 route to the
   // hosted ingress instead of the local channel. Same prompt + parseVerdict.
+  // Cloud grades get the full 45s (not the local 24s): the round-trip + a cold
+  // worker routinely needs >24s, which is exactly what was timing out and
+  // failing open on big bash prompts.
   if (process.env.SYNKRO_DEPLOY_LOCATION === 'cloud') {
-    return hostedGrade(ROLE_MAP[surface] || 'grade-edit', prompt, jwt, timeoutMs, agentKind);
+    return hostedGrade(ROLE_MAP[surface] || 'grade-edit', prompt, jwt, CLOUD_GRADE_TIMEOUT_MS, agentKind);
   }
   // BYOK grading mode routes the grade through an LLM API instead of the
   // on-device channel worker pool. The grader prompt + parseVerdict are shared.
@@ -1727,14 +1748,14 @@ export async function localGrade(surface: string, prompt: string, timeoutMs = 24
   return channelGrade(ROLE_MAP[surface] || 'grade-edit', prompt, jwt, 18929, timeoutMs, agentKind);
 }
 
-// Default 24s \u2014 was 45000, which EXCEEDED the CC cwe hook timeout (30s) and
-// guaranteed a force-kill on any slow grade. Two cwe chunks grade in parallel
-// within the same CC budget, so each must finish well under it.
+// Local-channel default 24s. Two cwe chunks grade in parallel within the same CC
+// budget (now 50s), so each must finish under it. Cloud cwe grades take the 45s
+// hosted leash (parallel chunks \u2192 wall-clock ~45s, still inside the 50s budget).
 export async function localGradeCwe(prompt: string, agentKind: AgentKind = 'claude_code', timeoutMs = 24000): Promise<string> {
   const jwt = loadJwt();
   if (!jwt) throw new Error('NO_JWT');
   if (process.env.SYNKRO_DEPLOY_LOCATION === 'cloud') {
-    return hostedGrade('grade-cwe', prompt, jwt, timeoutMs, agentKind);
+    return hostedGrade('grade-cwe', prompt, jwt, CLOUD_GRADE_TIMEOUT_MS, agentKind);
   }
   return channelGrade('grade-cwe', prompt, jwt, 18930, timeoutMs, agentKind);
 }
@@ -2181,6 +2202,67 @@ export function parseVerdict(resp: string): Verdict {
   return verdict;
 }
 
+export interface CombinedFinding {
+  id: string;
+  reason: string;
+  suggestedFix: string;
+  severity: string;
+  ruleMode: string;
+  codeSnippet: string;
+}
+
+// Splits a grade-edit-cwe verdict (one <synkro-verdict> whose <violation> blocks
+// MIX org-rule ids and cwe-### ids) into (a) a rules Verdict the existing rule
+// enforcement consumes verbatim and (b) a list of CWE findings for the CWE block
+// path. A block whose rule_id starts with "cwe-" is a CWE finding; anything else
+// is an org-rule violation (org rules take precedence). Org-rule verdict is ok
+// UNLESS a non-cwe violation is present \u2014 so a CWE-only failure still passes the
+// rule gate while blocking on CWE.
+export function parseCombinedVerdict(resp: string): { ruleVerdict: Verdict; cweFindings: CombinedFinding[] } {
+  const base = parseVerdict(resp);
+  const ruleVerdict: Verdict = { ok: true, reason: '', suggestedFix: '', ruleId: '', ruleMode: '', severity: 'low', category: 'clean' };
+  const cweFindings: CombinedFinding[] = [];
+  const blocks = resp.match(/<violation>[\\s\\S]*?<\\/violation>/g) || [];
+  let firstRule: CombinedFinding | null = null;
+  for (const b of blocks) {
+    const idRaw = (b.match(/<rule_id>([^<]+)<\\/rule_id>/) || [])[1];
+    if (!idRaw) continue;
+    const id = idRaw.trim();
+    const finding: CombinedFinding = {
+      id,
+      reason: ((b.match(/<reason>([\\s\\S]*?)<\\/reason>/) || [])[1] || '').trim(),
+      suggestedFix: ((b.match(/<suggested_fix>([\\s\\S]*?)<\\/suggested_fix>/) || [])[1] || '').trim(),
+      severity: ((b.match(/<severity>([^<]+)<\\/severity>/) || [])[1] || '').trim(),
+      ruleMode: ((b.match(/<rule_mode>([^<]+)<\\/rule_mode>/) || [])[1] || '').trim(),
+      codeSnippet: ((b.match(/<code_snippet>([\\s\\S]*?)<\\/code_snippet>/) || [])[1] || '').replace(/^\\n+|\\n+$/g, ''),
+    };
+    if (/^cwe-/i.test(id)) {
+      finding.id = id.replace(/^cwe-/i, 'CWE-');
+      if (!cweFindings.some(f => f.id === finding.id)) cweFindings.push(finding);
+    } else if (!firstRule) {
+      firstRule = finding;
+    }
+  }
+  if (firstRule) {
+    ruleVerdict.ok = false;
+    ruleVerdict.ruleId = firstRule.id;
+    ruleVerdict.reason = firstRule.reason;
+    ruleVerdict.suggestedFix = firstRule.suggestedFix;
+    ruleVerdict.ruleMode = firstRule.ruleMode;
+    ruleVerdict.severity = firstRule.severity || 'high';
+    ruleVerdict.category = base.category || 'uncategorized';
+  } else if (base.ok === false && base.ruleId && !/^cwe-/i.test(base.ruleId)) {
+    // No <violation> blocks but a top-level rule_id failure (defensive).
+    ruleVerdict.ok = false;
+    ruleVerdict.ruleId = base.ruleId;
+    ruleVerdict.reason = base.reason;
+    ruleVerdict.suggestedFix = base.suggestedFix;
+    ruleVerdict.ruleMode = base.ruleMode;
+    ruleVerdict.severity = base.severity || 'high';
+  }
+  return { ruleVerdict, cweFindings };
+}
+
 // \u2500\u2500\u2500 Telemetry Dispatch \u2500\u2500\u2500
 
 // Gated cloud telemetry POST \u2014 fires only when storage mode is 'cloud'. The
@@ -3540,6 +3622,16 @@ export function graderUnavailableMessage(hook: string, target: string, errorMess
     const agent = agentKind === 'cursor' ? 'Cursor' : 'Claude Code';
     return hook + ' ' + target + ' \u2192 local grader not configured for ' + agent + '. Add this agent to your synkro.toml file and run \`synkro install\`.';
   }
+  // In cloud-container mode the grade ran against the hosted ingress, NOT a local
+  // worker \u2014 say so, and distinguish a timeout (slow/cold grade) from a true
+  // outage so "local grader unavailable" stops masquerading as a dead grader.
+  if (process.env.SYNKRO_DEPLOY_LOCATION === 'cloud') {
+    const isTimeout = /tim(e|ed)\\s*out|aborted|the operation was aborted/i.test(errorMessage);
+    if (isTimeout) {
+      return hook + ' ' + target + ' \u2192 cloud grade timed out (45s), skipped';
+    }
+    return hook + ' ' + target + ' \u2192 cloud grader unavailable, skipped';
+  }
   return hook + ' ' + target + ' \u2192 local grader unavailable, skipped';
 }
 
@@ -3619,7 +3711,7 @@ export function outputEmpty(): void {
     EDIT_PRECHECK_TS = `#!/usr/bin/env bun
 import {
   loadJwt, ensureFreshJwt, detectRepo, loadConfig, route, tag, localGrade,
-  parseVerdict, dispatchCapture, ruleMode, reconstructContent, isPathUnder, postWithRetry,
+  parseVerdict, parseCombinedVerdict, combinedEditGradeEnabled, dispatchCapture, dispatchFinding, ruleMode, reconstructContent, isPathUnder, postWithRetry,
   readStdin, extractTranscript, readLastPrompt, findNearestDeps, filePathFromToolInput,
   appendSessionAction, readSessionLog, compressSessionLog, log,
   outputJson, outputEmpty, setupCursorHookSignals, installHookWatchdog, isEditTool, hookSessionId, GATEWAY_URL,
@@ -3635,7 +3727,7 @@ const agentKind = (process.env.SYNKRO_HOOK_FORMAT === 'cursor' || process.argv.i
 
 async function main() {
   setupCursorHookSignals();
-  installHookWatchdog(27000);
+  installHookWatchdog(48000);
   try {
     const input = await readStdin();
     if (!input.trim()) { outputEmpty(); return; }
@@ -3769,6 +3861,90 @@ async function main() {
         'The rules shown were pre-selected as the ones relevant to this edit \u2014 every rule here IS relevant, do not label any "not relevant". When passing (ok=true), give a terse, specific reason each rule passes. Format: "R003: no hardcoded secrets in file. R005: in-repo path only." Cover every rule shown.',
       ].join('\\n');
 
+      // \u2500\u2500\u2500 Combined org-rules + CWE in ONE inference (SYNKRO_COMBINED_EDIT_GRADE) \u2500\u2500\u2500
+      // Self-contained early-return branch \u2014 the default two-grade path below is
+      // left untouched. Appends the CWE rule set to the rules prompt, runs one
+      // grade-edit-cwe call, then splits the verdict: org-rule violations drive
+      // the same ask/fix enforcement; cwe-### violations drive a fix-mode block.
+      // The cwe-precheck hook no-ops when this flag is on (see CWE_PRECHECK_TS).
+      if (combinedEditGradeEnabled(synkroFile)) {
+        const fileExt = (filePath.match(/\\.([^.\\/]+)$/) || ['', ''])[1].toLowerCase();
+        let cweRules: any[] = [];
+        try {
+          const cr = await fetch(GATEWAY_URL + '/api/v1/cwe-rules?ext=' + encodeURIComponent(fileExt), {
+            headers: { Authorization: 'Bearer ' + jwt },
+            signal: AbortSignal.timeout(4000),
+          });
+          if (cr.ok) cweRules = ((await cr.json() as any) || {}).rules || [];
+        } catch { /* CWE rules optional \u2014 rule grading still runs in the combined pass */ }
+
+        const combinedPrompt = graderPrompt
+          + '\\n\\nCWE rules to ALSO check the proposed content against (emit cwe-### violations with a <code_snippet>): '
+          + JSON.stringify(cweRules);
+
+        let cResp: string;
+        try {
+          cResp = await localGrade('edit-cwe', combinedPrompt, undefined, graderPool);
+        } catch (err) {
+          const errMsg = (err as Error).message || String(err);
+          logGraderUnavailable('editGuard', fileShort, errMsg);
+          outputJson({ systemMessage: tagStr + ' ' + graderUnavailableMessage('editGuard', fileShort, errMsg, graderPool) });
+          return;
+        }
+
+        const { ruleVerdict, cweFindings } = parseCombinedVerdict(cResp);
+        const editContent = 'file=' + filePath + ' content=' + proposed.slice(0, 2000);
+        const violatedRules = ruleVerdict.ruleId ? [ruleVerdict.ruleId] : [];
+        const cweBlock = cweFindings.slice(0, 5)
+          .map(f => '[' + f.id + '] ' + (f.reason || 'weakness') + (f.suggestedFix ? ' Fix: ' + f.suggestedFix : ''))
+          .join('\\n');
+        for (const f of cweFindings) {
+          dispatchFinding(jwt, { session_id: sessionId, file_path: filePath, finding_type: 'cwe', finding_id: f.id, status: 'open' }, config.captureDepth);
+        }
+
+        // Org-rule violation \u2192 ask/fix enforcement (CWE findings appended to the deny).
+        if (!ruleVerdict.ok) {
+          const mode = normalizeMode(ruleVerdict.ruleMode || ruleMode(ruleVerdict.ruleId, config.rules));
+          const guardReason = (ruleVerdict.ruleId ? '(' + ruleVerdict.ruleId + ') ' : '') + (ruleVerdict.reason || 'policy violation');
+          let denyReason = mode === 'fix'
+            ? 'Guard: ' + guardReason + '\\nFix all issues before retrying. Do NOT ask the user to make the edit manually \u2014 resolve the violation in code yourself.'
+            : 'Guard: ' + guardReason + '\\nAsk the user for explicit consent before retrying.';
+          if (cweBlock) denyReason += '\\nAlso resolve these CWE weaknesses in code:\\n' + cweBlock;
+          dispatchCapture(jwt, 'edit', 'block', ruleVerdict.severity || 'critical', ruleVerdict.category || 'security',
+            toolName, gitRepo, sessionId, config.captureDepth, {
+              command: editContent, reasoning: guardReason,
+              rulesChecked: relevantRules, violatedRules,
+              ccModel: captureModel, ...lineMetrics,
+            });
+          outputJson({
+            systemMessage: tagStr + ' editGuard ' + fileShort + ' \u2192 blocked: ' + guardReason + (cweFindings.length ? ' (+' + cweFindings.length + ' CWE)' : ''),
+            hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: denyReason, additionalContext: denyReason },
+          });
+          return;
+        }
+
+        // Rules clean but CWE weakness(es) \u2192 fix-mode block (resolve in code).
+        if (cweFindings.length > 0) {
+          const ctx = 'CWE: ' + cweBlock + '\\nFix all issues before retrying. Do NOT ask the user to make the edit manually \u2014 resolve the weakness in code yourself.';
+          outputJson({
+            systemMessage: tagStr + ' editGuard ' + fileShort + ' \u2192 blocked (' + cweFindings.map(f => f.id).join(', ') + ')',
+            hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: ctx, additionalContext: ctx },
+          });
+          return;
+        }
+
+        // Both clean.
+        dispatchCapture(jwt, 'edit', 'pass', 'clean', ruleVerdict.category || 'trivial_edit',
+          toolName, gitRepo, sessionId, config.captureDepth, {
+            command: editContent, reasoning: ruleVerdict.reason || 'no violations (rules + CWE)',
+            rulesChecked: relevantRules, violatedRules: [],
+            ccModel: captureModel, ...lineMetrics,
+          });
+        const cPassLine = tagStr + ' editGuard ' + fileShort + ' \u2192 pass: ' + (ruleVerdict.reason || 'clean (rules + CWE)');
+        outputJson({ systemMessage: cPassLine, hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: 'Synkro combined edit judge (rules + CWE). ' + (ruleVerdict.reason || 'clean') } });
+        return;
+      }
+
       let gradeResp: string;
       try {
         gradeResp = await localGrade('edit', graderPrompt, undefined, graderPool);
@@ -3890,7 +4066,7 @@ import {
   outputJson, outputEmpty, setupCursorHookSignals, installHookWatchdog, isEditTool, isShellTool, isCursorHookFormat,
   extractShellCodeWrites, hookSessionId, filePathFromToolInput, emitBlockScanFindings, cweSnippetLines, dispatchFinding, dispatchCapture, GATEWAY_URL,
   logGraderUnavailable, graderUnavailableMessage, resolveTranscriptPath, isCursorInvokingCcHook,
-  loadSynkroFile, effectiveGraderPool, synkroFilePresent, noSynkroSkipMessage,
+  loadSynkroFile, effectiveGraderPool, synkroFilePresent, noSynkroSkipMessage, combinedEditGradeEnabled,
 } from './_synkro-common.ts';
 import { basename, extname, resolve, join, dirname } from 'node:path';
 import { readFileSync, readdirSync, existsSync } from 'node:fs';
@@ -4029,7 +4205,7 @@ function scanPackageCapabilities(pkgName: string, cwd: string): PackageCapabilit
 
 async function main() {
   setupCursorHookSignals();
-  installHookWatchdog(27000);
+  installHookWatchdog(48000);
   try {
     const input = await readStdin();
     if (!input.trim()) { outputEmpty(); return; }
@@ -4118,6 +4294,11 @@ async function main() {
     const graderPool = effectiveGraderPool(synkroFile, agentKind);
     const rt = await cweRoute(config, synkroFile);
 
+    // Combined-grade mode: the edit-precheck hook runs CWE inside its single
+    // grade-edit-cwe call, so this standalone CWE scan must no-op — otherwise the
+    // edit would be graded for CWE twice (defeating the inference-merge).
+    if (combinedEditGradeEnabled(synkroFile)) { outputEmpty(); return; }
+
     if (config.silent) {
       outputJson({ systemMessage: '[synkro:' + rt + ':cweScan:' + (graderPool === 'claude_code' ? 'claude' : graderPool) + '] skipped (silent mode)' });
       return;
@@ -4543,14 +4724,16 @@ async function main() {
     jwt = await ensureFreshJwt(jwt);
 
     const config = await loadConfig(jwt);
-    const rt = await route(config);
 
     if (config.silent) {
-      outputJson({ systemMessage: '[synkro:' + rt + ':cveScan] ' + fileShort + ' \u2192 skipped (silent mode)' });
+      outputJson({ systemMessage: '[synkro:cveScan] ' + fileShort + ' \u2192 skipped (silent mode)' });
       return;
     }
 
-    const cveTag = '[synkro:' + rt + ':cveScan]';
+    // CVE scanning has no local/cloud distinction from the user's view \u2014 it's an
+    // OSV database lookup that always runs server-side \u2014 so the tag omits the
+    // location segment that grading/CWE carry. Just [synkro:cveScan].
+    const cveTag = '[synkro:cveScan]';
 
     // Reconstruct proposed content
     const proposed = reconstructContent(toolName, toolInput, filePath, cwd);
@@ -4650,7 +4833,7 @@ async function main() {
               finding_ids: violatedIds, severity: 'critical',
               repo: gitRepo || undefined,
             });
-            const tagStr = '[synkro:' + rt + ':pkgScan]';
+            const tagStr = '[synkro:pkgScan]';
             const denyReason = tagStr + ' BLOCKED: ' + summary + '\\nDo not write this version. Pick a fixed/safe version instead.';
             outputJson({
               systemMessage: denyReason,
@@ -4942,7 +5125,7 @@ function isDuplicate(command: string, sessionId: string): boolean {
 
 async function main() {
   setupCursorHookSignals();
-  installHookWatchdog(27000);
+  installHookWatchdog(48000);
   try {
     const input = await readStdin();
     if (!input.trim()) { outputEmpty(); return; }
@@ -5214,7 +5397,7 @@ const agentKind = (process.env.SYNKRO_HOOK_FORMAT === 'cursor' || process.argv.i
 
 async function main() {
   setupCursorHookSignals();
-  installHookWatchdog(27000);
+  installHookWatchdog(48000);
   try {
     const input = await readStdin();
     if (!input.trim()) { outputEmpty(); return; }
@@ -5451,7 +5634,7 @@ function appendReviewToPlan(planFile: string, verdict: string): void {
 
 async function main() {
   setupCursorHookSignals();
-  installHookWatchdog(42000);
+  installHookWatchdog(48000);
   try {
     const input = await readStdin();
     if (!input.trim()) { outputEmpty(); return; }
@@ -10386,7 +10569,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.72")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.74")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -12075,7 +12258,14 @@ function writePluginFiles() {
       c.pluginSettingsPath,
       JSON.stringify({
         fastMode: true,
-        enabledMcpjsonServers: ["synkro-local"]
+        enabledMcpjsonServers: ["synkro-local"],
+        // Extended thinking is pure latency tax on a structured verdict grade and
+        // emits reasoning the verdict parser isn't tuned for. effortLevel only
+        // SOFTENS it; CLAUDE_CODE_DISABLE_THINKING=1 is the authoritative off
+        // switch. Mirror the cloud pool (pool-config.sh) so local + cloud graders
+        // behave identically.
+        effortLevel: "low",
+        env: { CLAUDE_CODE_DISABLE_THINKING: "1" }
       }, null, 2) + "\n",
       "utf-8"
     );
@@ -12316,7 +12506,7 @@ tmux kill-session -t "=$SESSION" 2>/dev/null || true
 # Start claude inside a detached tmux session so it has a real pty.
 # Redirect stderr to the log so we can see why it dies.
 tmux new-session -d -s "$SESSION" \\
-  "SYNKRO_CHANNEL_PORT=${CHANNEL_1_PORT} claude --dangerously-load-development-channels server:synkro-local --dangerously-skip-permissions --setting-sources project,local --model claude-sonnet-4-6 2>>$LOG; echo 'claude exited with code '$'?' >> $LOG"
+  "SYNKRO_CHANNEL_PORT=${CHANNEL_1_PORT} CLAUDE_CODE_DISABLE_THINKING=1 claude --dangerously-load-development-channels server:synkro-local --dangerously-skip-permissions --setting-sources project,local --model claude-sonnet-4-6 2>>$LOG; echo 'claude exited with code '$'?' >> $LOG"
 
 # Claude's --dangerously-load-development-channels shows a confirmation
 # prompt: option 1 = "I am using this for local development" (accept),
@@ -12378,7 +12568,7 @@ log "claude version: $(claude --version 2>&1 | head -1)"
 tmux kill-session -t "=$SESSION" 2>/dev/null || true
 
 tmux new-session -d -s "$SESSION" \\
-  "SYNKRO_CHANNEL_PORT=${CHANNEL_2_PORT} claude --dangerously-load-development-channels server:synkro-local --dangerously-skip-permissions --setting-sources project,local --model claude-sonnet-4-6 2>>$LOG; echo 'claude exited with code '$'?' >> $LOG"
+  "SYNKRO_CHANNEL_PORT=${CHANNEL_2_PORT} CLAUDE_CODE_DISABLE_THINKING=1 claude --dangerously-load-development-channels server:synkro-local --dangerously-skip-permissions --setting-sources project,local --model claude-sonnet-4-6 2>>$LOG; echo 'claude exited with code '$'?' >> $LOG"
 
 sleep 3
 if tmux has-session -t "=$SESSION" 2>/dev/null; then
@@ -12434,7 +12624,7 @@ log "claude version: $(claude --version 2>&1 | head -1)"
 tmux kill-session -t "=$SESSION" 2>/dev/null || true
 
 tmux new-session -d -s "$SESSION" \\
-  "SYNKRO_CHANNEL_PORT=${CHANNEL_3_PORT} claude --dangerously-load-development-channels server:synkro-local --dangerously-skip-permissions --setting-sources project,local --model claude-sonnet-4-6 2>>$LOG; echo 'claude exited with code '$'?' >> $LOG"
+  "SYNKRO_CHANNEL_PORT=${CHANNEL_3_PORT} CLAUDE_CODE_DISABLE_THINKING=1 claude --dangerously-load-development-channels server:synkro-local --dangerously-skip-permissions --setting-sources project,local --model claude-sonnet-4-6 2>>$LOG; echo 'claude exited with code '$'?' >> $LOG"
 
 sleep 3
 if tmux has-session -t "=$SESSION" 2>/dev/null; then
@@ -12490,7 +12680,7 @@ log "claude version: $(claude --version 2>&1 | head -1)"
 tmux kill-session -t "=$SESSION" 2>/dev/null || true
 
 tmux new-session -d -s "$SESSION" \\
-  "SYNKRO_CHANNEL_PORT=${CHANNEL_4_PORT} claude --dangerously-load-development-channels server:synkro-local --dangerously-skip-permissions --setting-sources project,local --model claude-sonnet-4-6 2>>$LOG; echo 'claude exited with code '$'?' >> $LOG"
+  "SYNKRO_CHANNEL_PORT=${CHANNEL_4_PORT} CLAUDE_CODE_DISABLE_THINKING=1 claude --dangerously-load-development-channels server:synkro-local --dangerously-skip-permissions --setting-sources project,local --model claude-sonnet-4-6 2>>$LOG; echo 'claude exited with code '$'?' >> $LOG"
 
 sleep 3
 if tmux has-session -t "=$SESSION" 2>/dev/null; then
@@ -14031,7 +14221,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.72");
+  console.log("1.6.74");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents