@synkro-sh/cli 1.7.37 → 1.7.38

package/dist/bootstrap.js

@@ -839,34 +839,6 @@ function filePathFromToolInput(ti: any): string {
   return ti.file_path || ti.notebook_path || ti.path || ti.target_file || '';
 }
 
-// Latest real human message from a CC transcript (JSONL). Scans from the end for a
-// user turn, skipping sidechain (sub-agent) turns, meta entries, tool-result-only
-// turns, and the synthetic local-command/caveat wrappers. Returns '' if none found.
-function latestUserText(transcript: string): string {
-  const lines = transcript.split('\n');
-  for (let i = lines.length - 1; i >= 0; i--) {
-    const ln = lines[i].trim();
-    if (!ln) continue;
-    let o: any;
-    try { o = JSON.parse(ln); } catch { continue; }
-    if (o && (o.isSidechain || o.isMeta)) continue;
-    const m = o && o.message;
-    const role = (m && m.role) || (o && o.type);
-    if (role !== 'user') continue;
-    const c = m && m.content;
-    let text = '';
-    if (typeof c === 'string') text = c;
-    else if (Array.isArray(c)) {
-      text = c.filter((b: any) => b && b.type === 'text' && typeof b.text === 'string').map((b: any) => b.text).join(' ');
-    }
-    text = text.trim();
-    if (!text) continue;
-    if (text.startsWith('<local-command') || text.startsWith('<command-') || text.startsWith('Caveat:') || text.startsWith('<system-reminder')) continue;
-    return text;
-  }
-  return '';
-}
-
 interface StubOpts {
   needsFile?: boolean;
   needsTranscript?: boolean;
@@ -914,29 +886,6 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
     // Gather host-only inputs the container can't read.
     const envelope: any = { payload, harness, cwd: root || cwd, sessionId, synkroFileText };
 
-    // Sub-agent attribution (host-side — the container has no access to ~/.claude).
-    // A spawned sub-agent's tool-call hooks carry the ROOT session_id but a sidechain
-    // transcript at agent-<id>.jsonl (vs the main <session_id>.jsonl). Detect it from
-    // transcript_path, and read the ROOT transcript for the human turn that dispatched
-    // this (the sub-agent's own transcript starts with the task prompt, not the human).
-    try {
-      const tpath = typeof payload.transcript_path === 'string' ? payload.transcript_path : '';
-      const tbase = tpath.split('/').pop() || '';
-      const am = tbase.match(/^agent-(.+)\.jsonl$/);
-      if (am) {
-        envelope.isSubagent = true;
-        envelope.agentId = am[1];
-        try {
-          const dir = tpath.slice(0, tpath.length - tbase.length);
-          const rootPath = dir + sessionId + '.jsonl';
-          if (rootPath !== tpath && existsSync(rootPath)) {
-            const msg = latestUserText(readFileSync(rootPath, 'utf-8'));
-            if (msg) envelope.triggeringMessage = msg.slice(0, 2000);
-          }
-        } catch {}
-      }
-    } catch {}
-
     if (opts.needsFile) {
       const fp = filePathFromToolInput(payload.tool_input || {});
       if (fp && existsSync(fp)) {
@@ -961,7 +910,12 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
     // result (the server waits up to 30s for the completion grade), so it needs a
     // wait above that budget — not the 6s telemetry default — or the stub abandons
     // the request before the result lands and the completion shows up a hook late.
-    const timeoutMs = surface === 'bash-followup' ? 32000 : (opts.telemetry ? 6000 : 28000);
+    // prompt-submit is the opposite: it's INTERACTIVE (blocks the user's prompt from
+    // being sent) under a short 5s hook timeout, so it gets ONE short attempt (below)
+    // and a tight per-attempt budget that fits inside 5s — never the 6s×3 telemetry path.
+    const timeoutMs = surface === 'bash-followup' ? 32000
+      : surface === 'prompt-submit' ? 3500
+      : (opts.telemetry ? 6000 : 28000);
     // Cloud has no local container to reach. Post the SAME envelope to the org's grader
     // via the gateway's /grade/submit as role 'scan:<surface>'; the container runs
     // scanRouter (runScan) server-side and returns the SAME shaped decision — so cloud
@@ -987,7 +941,11 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
     // — the server side is idempotent-ish (completion in-flight guard, dup evidence
     // is harmless). Blocking hooks make ONE attempt: their response IS the verdict
     // and a retry would double-grade. Normal case: first attempt wins, no delay.
-    const attempts = opts.telemetry ? 3 : 1;
+    // prompt-submit is EXCLUDED from the retry: it runs on the interactive prompt
+    // path under a 5s hook timeout, and 3×6s+backoff (19.5s) blew that budget and
+    // fired "hook timed out after 5s" on every prompt whenever the server was slow.
+    // Dropping an occasional prompt tick is harmless; stalling the user is not.
+    const attempts = (opts.telemetry && surface !== 'prompt-submit') ? 3 : 1;
     let text = '';
     for (let i = 0; i < attempts; i++) {
       try {
@@ -3815,6 +3773,10 @@ async function dockerInstall(opts = {}) {
     // interactive AskUserQuestion poll and fall through to generate-the-fix. Only
     // passed when the operator set it; otherwise the image default (1) applies.
     ...process.env.SYNKRO_FIX_POLL ? ["-e", `SYNKRO_FIX_POLL=${process.env.SYNKRO_FIX_POLL}`] : [],
+    // Route CWE grades to the cloud /api/v1/cwe-scan endpoint (arm-C: full-catalog
+    // retrieval + ensemble) instead of the local single-prompt path. Grading stays
+    // local for every other surface. Benchmark lever; default off.
+    ...process.env.SYNKRO_CWE_VIA_ENDPOINT ? ["-e", `SYNKRO_CWE_VIA_ENDPOINT=${process.env.SYNKRO_CWE_VIA_ENDPOINT}`] : [],
     // Connected repo — the server seeds the local app + ruleset named after it.
     ...opts.connectedRepo ? ["-e", `SYNKRO_CONNECTED_REPO=${opts.connectedRepo}`] : [],
     // Real account identity (from config.env via process.env) — telemetry is
@@ -4829,7 +4791,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.7.37")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.7.38")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -9027,7 +8989,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.7.37");
+  console.log("1.7.38");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents