@synkro-sh/cli 1.7.36 → 1.7.38

package/dist/bootstrap.js

@@ -910,7 +910,12 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
     // result (the server waits up to 30s for the completion grade), so it needs a
     // wait above that budget — not the 6s telemetry default — or the stub abandons
     // the request before the result lands and the completion shows up a hook late.
-    const timeoutMs = surface === 'bash-followup' ? 32000 : (opts.telemetry ? 6000 : 28000);
+    // prompt-submit is the opposite: it's INTERACTIVE (blocks the user's prompt from
+    // being sent) under a short 5s hook timeout, so it gets ONE short attempt (below)
+    // and a tight per-attempt budget that fits inside 5s — never the 6s×3 telemetry path.
+    const timeoutMs = surface === 'bash-followup' ? 32000
+      : surface === 'prompt-submit' ? 3500
+      : (opts.telemetry ? 6000 : 28000);
     // Cloud has no local container to reach. Post the SAME envelope to the org's grader
     // via the gateway's /grade/submit as role 'scan:<surface>'; the container runs
     // scanRouter (runScan) server-side and returns the SAME shaped decision — so cloud
@@ -936,7 +941,11 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
     // — the server side is idempotent-ish (completion in-flight guard, dup evidence
     // is harmless). Blocking hooks make ONE attempt: their response IS the verdict
     // and a retry would double-grade. Normal case: first attempt wins, no delay.
-    const attempts = opts.telemetry ? 3 : 1;
+    // prompt-submit is EXCLUDED from the retry: it runs on the interactive prompt
+    // path under a 5s hook timeout, and 3×6s+backoff (19.5s) blew that budget and
+    // fired "hook timed out after 5s" on every prompt whenever the server was slow.
+    // Dropping an occasional prompt tick is harmless; stalling the user is not.
+    const attempts = (opts.telemetry && surface !== 'prompt-submit') ? 3 : 1;
     let text = '';
     for (let i = 0; i < attempts; i++) {
       try {
@@ -3764,6 +3773,10 @@ async function dockerInstall(opts = {}) {
     // interactive AskUserQuestion poll and fall through to generate-the-fix. Only
     // passed when the operator set it; otherwise the image default (1) applies.
     ...process.env.SYNKRO_FIX_POLL ? ["-e", `SYNKRO_FIX_POLL=${process.env.SYNKRO_FIX_POLL}`] : [],
+    // Route CWE grades to the cloud /api/v1/cwe-scan endpoint (arm-C: full-catalog
+    // retrieval + ensemble) instead of the local single-prompt path. Grading stays
+    // local for every other surface. Benchmark lever; default off.
+    ...process.env.SYNKRO_CWE_VIA_ENDPOINT ? ["-e", `SYNKRO_CWE_VIA_ENDPOINT=${process.env.SYNKRO_CWE_VIA_ENDPOINT}`] : [],
     // Connected repo — the server seeds the local app + ruleset named after it.
     ...opts.connectedRepo ? ["-e", `SYNKRO_CONNECTED_REPO=${opts.connectedRepo}`] : [],
     // Real account identity (from config.env via process.env) — telemetry is
@@ -4778,7 +4791,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.7.36")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.7.38")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -8976,7 +8989,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.7.36");
+  console.log("1.7.38");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents