@synkro-sh/cli 1.7.38 → 1.7.41

package/dist/bootstrap.js

@@ -146,7 +146,15 @@ function installCCHooks(settingsPath, config) {
         type: "command",
         command: config.bashJudgeScriptPath,
         timeout: 50
-      }
+      },
+      // skill-judge shares this entry so CC runs it in parallel and waits for it
+      // before processing denies — its verdict is its OWN system-message block,
+      // separate from bashGuard. No-ops on pure reads (empty command).
+      ...config.skillJudgeScriptPath ? [{
+        type: "command",
+        command: config.skillJudgeScriptPath,
+        timeout: 50
+      }] : []
     ],
     [SYNKRO_MARKER]: true
   });
@@ -167,7 +175,13 @@ function installCCHooks(settingsPath, config) {
         type: "command",
         command: config.cvePrecheckScriptPath,
         timeout: 10
-      }
+      },
+      // skill-judge — its OWN system-message block, parallel with edit-precheck.
+      ...config.skillJudgeScriptPath ? [{
+        type: "command",
+        command: config.skillJudgeScriptPath,
+        timeout: 50
+      }] : []
     ],
     [SYNKRO_MARKER]: true
   });
@@ -395,6 +409,12 @@ function installCursorHooks(hooksJsonPath, config) {
     failClosed: false,
     [SYNKRO_MARKER2]: true
   });
+  if (config.skillJudgeScriptPath) h.beforeShellExecution.push({
+    command: bunRunCmd(config.skillJudgeScriptPath),
+    timeout: 30,
+    failClosed: false,
+    [SYNKRO_MARKER2]: true
+  });
   pushCcHook(h, "afterShellExecution", config.bashFollowupScriptPath, { timeout: 10 });
   h.preToolUse = h.preToolUse ?? [];
   h.preToolUse.push({
@@ -418,10 +438,21 @@ function installCursorHooks(hooksJsonPath, config) {
     matcher: "Shell|Bash|Read|ReadFile|Grep|Glob|terminal|run_terminal_cmd|execute_command|read_file|grep_search|file_search|list_dir|codebase_search|delete_file",
     [SYNKRO_MARKER2]: true
   });
+  if (config.skillJudgeScriptPath) h.preToolUse.push({
+    command: bunRunCmd(config.skillJudgeScriptPath),
+    timeout: 30,
+    failClosed: false,
+    matcher: "Shell|Bash|terminal|run_terminal_cmd|execute_command",
+    [SYNKRO_MARKER2]: true
+  });
   pushCcHook(h, "preToolUse", config.editPrecheckScriptPath, {
     timeout: 30,
     matcher: "Write|Edit|StrReplace|MultiEdit|NotebookEdit|edit_file|reapply|edit_notebook|ApplyPatch|apply_patch"
   });
+  if (config.skillJudgeScriptPath) pushCcHook(h, "preToolUse", config.skillJudgeScriptPath, {
+    timeout: 30,
+    matcher: "Write|Edit|StrReplace|MultiEdit|NotebookEdit|edit_file|reapply|edit_notebook|ApplyPatch|apply_patch"
+  });
   pushCcHook(h, "preToolUse", config.cwePrecheckScriptPath, {
     timeout: 30,
     matcher: "Write|Edit|StrReplace|MultiEdit|NotebookEdit|edit_file|reapply|edit_notebook|ApplyPatch|apply_patch"
@@ -738,7 +769,7 @@ var init_skillParser = __esm({
 function stubHook(surface, optsLiteral) {
   return "#!/usr/bin/env bun\nimport { runStub } from './_synkro-stub-common.ts';\nrunStub(" + JSON.stringify(surface) + ", " + optsLiteral + ");\n";
 }
-var STUB_COMMON_TS, STUB_EDIT_PRECHECK_TS, STUB_CWE_PRECHECK_TS, STUB_CVE_PRECHECK_TS, STUB_BASH_JUDGE_TS, STUB_INSTALL_SCAN_TS, STUB_AGENT_JUDGE_TS, STUB_MCP_GATE_TS, STUB_PLAN_JUDGE_TS, STUB_STOP_SUMMARY_TS, STUB_SESSION_START_TS, STUB_TRANSCRIPT_SYNC_TS, STUB_USER_PROMPT_SUBMIT_TS, STUB_BASH_FOLLOWUP_TS, STUB_TASK_ACTIVATE_INTENT_TS, STUB_CURSOR_BASH_JUDGE_TS, STUB_CURSOR_EDIT_CAPTURE_TS, STUB_CURSOR_AGENT_CAPTURE_TS;
+var STUB_COMMON_TS, STUB_EDIT_PRECHECK_TS, STUB_CWE_PRECHECK_TS, STUB_CVE_PRECHECK_TS, STUB_BASH_JUDGE_TS, STUB_SKILL_JUDGE_TS, STUB_INSTALL_SCAN_TS, STUB_AGENT_JUDGE_TS, STUB_MCP_GATE_TS, STUB_PLAN_JUDGE_TS, STUB_STOP_SUMMARY_TS, STUB_SESSION_START_TS, STUB_TRANSCRIPT_SYNC_TS, STUB_USER_PROMPT_SUBMIT_TS, STUB_BASH_FOLLOWUP_TS, STUB_TASK_ACTIVATE_INTENT_TS, STUB_CURSOR_BASH_JUDGE_TS, STUB_CURSOR_SKILL_JUDGE_TS, STUB_CURSOR_EDIT_CAPTURE_TS, STUB_CURSOR_AGENT_CAPTURE_TS;
 var init_hookScriptsTs = __esm({
   "cli/installer/hookScriptsTs.ts"() {
     "use strict";
@@ -964,6 +995,7 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
     STUB_CWE_PRECHECK_TS = stubHook("cwe-precheck", "{ needsFile: true, needsTranscript: true }");
     STUB_CVE_PRECHECK_TS = stubHook("cve-precheck", "{ needsFile: true, needsTranscript: true }");
     STUB_BASH_JUDGE_TS = stubHook("bash-judge", "{ needsTranscript: true }");
+    STUB_SKILL_JUDGE_TS = stubHook("skill-judge", "{ needsFile: true, needsTranscript: true }");
     STUB_INSTALL_SCAN_TS = stubHook("install-scan", "{ needsTranscript: true }");
     STUB_AGENT_JUDGE_TS = stubHook("agent-judge", "{ needsTranscript: true }");
     STUB_MCP_GATE_TS = stubHook("mcp-gate", "{ needsTranscript: true }");
@@ -993,6 +1025,7 @@ try {
 process.stdout.write('{}\\n');
 `;
     STUB_CURSOR_BASH_JUDGE_TS = stubHook("bash-judge", "{ needsTranscript: true, harness: 'cursor' }");
+    STUB_CURSOR_SKILL_JUDGE_TS = stubHook("skill-judge", "{ needsFile: true, needsTranscript: true, harness: 'cursor' }");
     STUB_CURSOR_EDIT_CAPTURE_TS = stubHook("edit-precheck", "{ needsFile: true, needsTranscript: true, harness: 'cursor' }");
     STUB_CURSOR_AGENT_CAPTURE_TS = stubHook("agent-judge", "{ needsTranscript: true, harness: 'cursor' }");
   }
@@ -3773,10 +3806,6 @@ async function dockerInstall(opts = {}) {
     // interactive AskUserQuestion poll and fall through to generate-the-fix. Only
     // passed when the operator set it; otherwise the image default (1) applies.
     ...process.env.SYNKRO_FIX_POLL ? ["-e", `SYNKRO_FIX_POLL=${process.env.SYNKRO_FIX_POLL}`] : [],
-    // Route CWE grades to the cloud /api/v1/cwe-scan endpoint (arm-C: full-catalog
-    // retrieval + ensemble) instead of the local single-prompt path. Grading stays
-    // local for every other surface. Benchmark lever; default off.
-    ...process.env.SYNKRO_CWE_VIA_ENDPOINT ? ["-e", `SYNKRO_CWE_VIA_ENDPOINT=${process.env.SYNKRO_CWE_VIA_ENDPOINT}`] : [],
     // Connected repo — the server seeds the local app + ruleset named after it.
     ...opts.connectedRepo ? ["-e", `SYNKRO_CONNECTED_REPO=${opts.connectedRepo}`] : [],
     // Real account identity (from config.env via process.env) — telemetry is
@@ -4690,6 +4719,8 @@ function ensureSynkroDir() {
 function writeHookScripts() {
   const installExtractCorePath = join11(HOOKS_DIR, "installExtractCore.ts");
   const bashScriptPath = join11(HOOKS_DIR, "cc-bash-judge.ts");
+  const skillJudgeScriptPath = join11(HOOKS_DIR, "cc-skill-judge.ts");
+  const cursorSkillJudgePath = join11(HOOKS_DIR, "cursor-skill-judge.ts");
   const bashFollowupScriptPath = join11(HOOKS_DIR, "cc-bash-followup.ts");
   const editPrecheckScriptPath = join11(HOOKS_DIR, "cc-edit-precheck.ts");
   const cwePrecheckScriptPath = join11(HOOKS_DIR, "cc-cwe-precheck.ts");
@@ -4713,6 +4744,8 @@ function writeHookScripts() {
   const stubFiles = [
     [stubCommonPath, STUB_COMMON_TS],
     [bashScriptPath, STUB_BASH_JUDGE_TS],
+    [skillJudgeScriptPath, STUB_SKILL_JUDGE_TS],
+    [cursorSkillJudgePath, STUB_CURSOR_SKILL_JUDGE_TS],
     [bashFollowupScriptPath, STUB_BASH_FOLLOWUP_TS],
     [editPrecheckScriptPath, STUB_EDIT_PRECHECK_TS],
     [cwePrecheckScriptPath, STUB_CWE_PRECHECK_TS],
@@ -4744,6 +4777,8 @@ function writeHookScripts() {
   }
   return {
     bashScript: bashScriptPath,
+    skillJudgeScript: skillJudgeScriptPath,
+    cursorSkillJudgeScript: cursorSkillJudgePath,
     bashFollowupScript: bashFollowupScriptPath,
     editPrecheckScript: editPrecheckScriptPath,
     cwePrecheckScript: cwePrecheckScriptPath,
@@ -4791,7 +4826,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.7.38")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.7.41")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -5434,6 +5469,7 @@ async function installCommand(opts = {}) {
       hasClaudeCode = true;
       installCCHooks(agent.settingsPath, {
         bashJudgeScriptPath: scripts.bashScript,
+        skillJudgeScriptPath: scripts.skillJudgeScript,
         bashFollowupScriptPath: scripts.bashFollowupScript,
         editPrecheckScriptPath: scripts.editPrecheckScript,
         cwePrecheckScriptPath: scripts.cwePrecheckScript,
@@ -5454,6 +5490,7 @@ async function installCommand(opts = {}) {
       hasCursor = true;
       installCursorHooks(agent.settingsPath, {
         bashJudgeScriptPath: scripts.cursorBashJudgeScript,
+        skillJudgeScriptPath: scripts.cursorSkillJudgeScript,
         editCaptureScriptPath: scripts.cursorEditCaptureScript,
         agentCaptureScriptPath: scripts.cursorAgentCaptureScript,
         bashFollowupScriptPath: scripts.bashFollowupScript,
@@ -5932,6 +5969,7 @@ function reconcileHarness() {
   if (wantCC) {
     installCCHooks(ccSettings, {
       bashJudgeScriptPath: scripts.bashScript,
+      skillJudgeScriptPath: scripts.skillJudgeScript,
       bashFollowupScriptPath: scripts.bashFollowupScript,
       editPrecheckScriptPath: scripts.editPrecheckScript,
       cwePrecheckScriptPath: scripts.cwePrecheckScript,
@@ -5964,6 +6002,7 @@ function reconcileHarness() {
   if (wantCursor) {
     installCursorHooks(cursorHooks, {
       bashJudgeScriptPath: scripts.cursorBashJudgeScript,
+      skillJudgeScriptPath: scripts.cursorSkillJudgeScript,
       editCaptureScriptPath: scripts.cursorEditCaptureScript,
       agentCaptureScriptPath: scripts.cursorAgentCaptureScript,
       bashFollowupScriptPath: scripts.bashFollowupScript,
@@ -8989,7 +9028,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.7.38");
+  console.log("1.7.41");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents