@synkro-sh/cli 1.7.87 → 1.7.88

package/dist/bootstrap.js

@@ -147,7 +147,7 @@ function getIdentity() {
   if (cached2) return cached2;
   let cliVersion = "0.0.0";
   try {
-    cliVersion = "1.7.87";
+    cliVersion = "1.7.88";
   } catch {
   }
   const creds = loadCredentialsIdentity();
@@ -5478,6 +5478,7 @@ __export(dockerInstall_exports, {
   normalizeProvider: () => normalizeProvider,
   poolLabel: () => poolLabel,
   readContainerConfig: () => readContainerConfig,
+  resolveConductorProvider: () => resolveConductorProvider,
   resolveGraderPool: () => resolveGraderPool,
   resolveWorkerConfig: () => resolveWorkerConfig,
   splitWorkers: () => splitWorkers,
@@ -5488,6 +5489,15 @@ import { copyFileSync, existsSync as existsSync19, mkdirSync as mkdirSync12, rea
 import { homedir as homedir16 } from "os";
 import { join as join14 } from "path";
 import { execSync as execSync3, spawnSync as spawnSync3 } from "child_process";
+function resolveConductorProvider(pool, counts) {
+  if (pool !== "auto") return pool;
+  const ranked = [
+    ["claude_code", counts.claudeWorkers],
+    ["cursor", counts.cursorWorkers],
+    ["codex", counts.codexWorkers]
+  ];
+  return ranked.reduce((best, candidate) => candidate[1] > best[1] ? candidate : best, ranked[0])[0];
+}
 function splitWorkers(total, providers) {
   const t = Math.max(0, Math.floor(total));
   const selected = ["claude_code", "cursor", "codex"].filter((provider) => providers.includes(provider));
@@ -5634,7 +5644,10 @@ function resolveWorkerConfig(rest) {
       const cw = sc.claudeWorkers || 0;
       const curw = sc.cursorWorkers || 0;
       const codw = sc.codexWorkers || 0;
-      if (cw + curw + codw > 0) return { claudeWorkers: cw, cursorWorkers: curw, codexWorkers: codw, explicit };
+      if (cw + curw + codw > 0) {
+        const counts2 = { claudeWorkers: cw, cursorWorkers: curw, codexWorkers: codw };
+        return { ...counts2, conductorProvider: resolveConductorProvider(sc.pool, counts2), explicit };
+      }
     }
     if (sc.pool === "cursor") {
       provs = ["cursor"];
@@ -5647,7 +5660,9 @@ function resolveWorkerConfig(rest) {
       if (provs.length === 0) provs = ["claude_code"];
     }
   }
-  return { ...splitWorkers(workers, provs), explicit };
+  const counts = splitWorkers(workers, provs);
+  const pool = provs.length === 1 ? provs[0] : "auto";
+  return { ...counts, conductorProvider: resolveConductorProvider(pool, counts), explicit };
 }
 function imageTag() {
   const registry = process.env.SYNKRO_IMAGE_REGISTRY || "";
@@ -5721,8 +5736,13 @@ async function dockerInstall(opts = {}) {
   const cursorWorkers = opts.cursorWorkers ?? 0;
   const codexWorkers = opts.codexWorkers ?? 0;
   const totalWorkers = claudeWorkers + cursorWorkers + codexWorkers;
+  const workerCounts = { claudeWorkers, cursorWorkers, codexWorkers };
+  const conductorProvider = opts.conductorProvider ?? resolveConductorProvider("auto", workerCounts);
+  const usesClaude = claudeWorkers > 0 || conductorProvider === "claude_code";
+  const usesCursor = cursorWorkers > 0 || conductorProvider === "cursor";
+  const usesCodex = codexWorkers > 0 || conductorProvider === "codex";
   const codexHomeDir = opts.codexHomeDir ?? join14(SYNKRO_DIR7, "codex-local-session");
-  if (codexWorkers > 0 && !existsSync19(join14(codexHomeDir, "auth.json"))) {
+  if (usesCodex && !existsSync19(join14(codexHomeDir, "auth.json"))) {
     throw new DockerInstallError(
       "Codex grader credentials are missing. Re-run `synkro install` to authorize an isolated Codex session."
     );
@@ -5743,14 +5763,14 @@ async function dockerInstall(opts = {}) {
   if (needsKeychainBridge()) {
     const claudeCredsPath = exportKeychainCreds();
     if (!claudeCredsPath) {
-      if (claudeWorkers > 0) {
+      if (usesClaude) {
         throw new DockerInstallError(
           "Claude Code keychain entry not found. Run `claude login` (or open Claude Code and sign in) before installing the container."
         );
       }
       console.warn("  \u26A0 Claude Code keychain entry not found \u2014 live usage telemetry stays off until you sign in to Claude Code (grading is unaffected).");
     }
-    if (cursorWorkers > 0 && !cursorApiKeyConfigured()) {
+    if (usesCursor && !cursorApiKeyConfigured()) {
       console.warn("  \u26A0 No Cursor API key found \u2014 Cursor grader workers will be idle.");
       console.warn("    Generate a key at cursor.com \u2192 Settings \u2192 API Keys, then:");
       console.warn(`      echo 'YOUR_KEY' > ~/.synkro/cursor-creds/api-key && chmod 600 ~/.synkro/cursor-creds/api-key`);
@@ -5821,8 +5841,8 @@ async function dockerInstall(opts = {}) {
     `${CLAUDE_HOST_STATE_DIR}:/data/claude-host-state:ro`,
     // Cursor creds — mounted RW so the in-container refresher can rotate the
     // access token in place. Only mounted when the install includes Cursor.
-    ...cursorWorkers > 0 ? ["-v", `${CURSOR_CREDS_DIR}:/home/synkro/.cursor-creds:rw`] : [],
-    ...codexWorkers > 0 ? ["-v", `${codexHomeDir}:/home/synkro/.codex:rw`] : [],
+    ...usesCursor ? ["-v", `${CURSOR_CREDS_DIR}:/home/synkro/.cursor-creds:rw`] : [],
+    ...usesCodex ? ["-v", `${codexHomeDir}:/home/synkro/.codex:rw`] : [],
     "-e",
     `WORKERS_PER_POOL=${totalWorkers}`,
     "-e",
@@ -5831,6 +5851,8 @@ async function dockerInstall(opts = {}) {
     `CURSOR_WORKERS=${cursorWorkers}`,
     "-e",
     `CODEX_WORKERS=${codexWorkers}`,
+    "-e",
+    `SYNKRO_CONDUCTOR_PROVIDER=${conductorProvider}`,
     // Pass through the batch-size lever if the operator set it. Defaults
     // inside the container to 5; clamped to [1, 20] by synkro-server.ts.
     ...process.env.SYNKRO_MAX_BATCH_SIZE ? ["-e", `SYNKRO_MAX_BATCH_SIZE=${process.env.SYNKRO_MAX_BATCH_SIZE}`] : [],
@@ -5949,6 +5971,7 @@ function readContainerConfig() {
     claudeWorkers: num(get("CLAUDE_WORKERS")),
     cursorWorkers: num(get("CURSOR_WORKERS")),
     codexWorkers: num(get("CODEX_WORKERS")),
+    conductorProvider: normalizeProvider(get("SYNKRO_CONDUCTOR_PROVIDER") || "") || void 0,
     connectedRepo: get("SYNKRO_CONNECTED_REPO") || void 0
   };
 }
@@ -6645,6 +6668,19 @@ exit $RC
   }
 });
 
+// cli/installer/graderSmoke.ts
+function isPrimerAckVerdict(value) {
+  return /<category>\s*primer_ack\s*<\/category>/i.test(value) || /<reason>\s*(?:batch )?primer received\s*<\/reason>/i.test(value);
+}
+function isValidRiskyEditSmokeVerdict(value) {
+  return /<synkro-verdict(?:\s[^>]*)?>[\s\S]*<\/synkro-verdict>/i.test(value) && /<ok>\s*false\s*<\/ok>/i.test(value) && !isPrimerAckVerdict(value);
+}
+var init_graderSmoke = __esm({
+  "cli/installer/graderSmoke.ts"() {
+    "use strict";
+  }
+});
+
 // cli/commands/install.ts
 var install_exports = {};
 __export(install_exports, {
@@ -6908,7 +6944,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle2(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle2(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle2(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle2("1.7.87")}`
+    `SYNKRO_VERSION=${shellQuoteSingle2("1.7.88")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle2(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle2(safeUserId)}`);
@@ -6997,9 +7033,13 @@ async function provisionCloudContainer(opts) {
     ({ claudeWorkers, cursorWorkers, codexWorkers } = splitWorkers(totalWorkers, providers));
   }
   if (claudeWorkers + cursorWorkers + codexWorkers === 0) codexWorkers = totalWorkers;
-  const selectedKind = codexWorkers > 0 && claudeWorkers === 0 && cursorWorkers === 0 ? "codex" : cursorWorkers > 0 && claudeWorkers === 0 ? "cursor" : "claude_code";
+  const selectedKind = resolveConductorProvider(sf?.grader.pool || "auto", {
+    claudeWorkers,
+    cursorWorkers,
+    codexWorkers
+  });
   let setupToken = "";
-  if (claudeWorkers > 0) {
+  if (claudeWorkers > 0 || selectedKind === "claude_code") {
     try {
       console.log("  Authorize your Claude account for the hosted Claude worker \u2014");
       console.log("  a browser window will open for approval...\n");
@@ -7050,7 +7090,7 @@ async function provisionCloudContainer(opts) {
   if (opts.hasCursor) harness.push("cursor");
   if (opts.hasCodex) harness.push("codex");
   let cursorApiKey = "";
-  if (cursorWorkers > 0) {
+  if (cursorWorkers > 0 || selectedKind === "cursor") {
     try {
       cursorApiKey = readFileSync20(join18(SYNKRO_DIR11, "cursor-creds", "api-key"), "utf-8").trim();
     } catch {
@@ -7062,7 +7102,7 @@ async function provisionCloudContainer(opts) {
   } catch (e) {
     console.warn(`  (cloud token unavailable, using session token: ${e.message})`);
   }
-  if (codexWorkers > 0) {
+  if (codexWorkers > 0 || selectedKind === "codex") {
     const codex = await setupCodexCloud(opts.gatewayUrl, opts.jwt, (message) => console.log(`  ${message}`));
     if (!codex.ok) {
       console.error(`  \u2717 ${codex.error || "Codex cloud authorization failed"}`);
@@ -7081,6 +7121,7 @@ async function provisionCloudContainer(opts) {
         claude_workers: claudeWorkers,
         cursor_workers: cursorWorkers,
         codex_workers: codexWorkers,
+        conductor_provider: selectedKind,
         cursor_api_key: cursorApiKey,
         // never logged; gateway stores it as the org secret
         connected_repo: repo,
@@ -7206,11 +7247,12 @@ async function verifyCloudGrader(jwt2, requestedKind) {
       body = JSON.parse(raw);
     } catch {
     }
-    if (r.ok && typeof body.result === "string" && body.result.includes("<synkro-verdict>")) {
+    if (r.ok && typeof body.result === "string" && isValidRiskyEditSmokeVerdict(body.result)) {
       console.log("  \u2713 smoke grade passed \u2014 cloud grading is live\n");
       return true;
     }
-    const detail = (body.error || raw || "").trim().slice(0, 300) || "(empty response)";
+    const invalidVerdict = r.ok && typeof body.result === "string" ? `invalid smoke verdict: ${body.result}` : "";
+    const detail = (body.error || invalidVerdict || raw || "").trim().slice(0, 300) || "(empty response)";
     console.warn(`  \u2717 smoke grade FAILED (HTTP ${r.status}): ${detail}`);
     if (body.error_code) {
       console.warn(`    \u25B8 ${body.error_code}: ${body.hint || ""}`);
@@ -7644,7 +7686,7 @@ async function installCommand(opts = {}) {
   await setTelemetryState({ enabled: true, remoteFlushEnabled: telemetryConsent });
   emit("install", {
     phase: "started",
-    cli_version_to: "1.7.87",
+    cli_version_to: "1.7.88",
     agents_detected: agents.map((a) => a.kind),
     with_github: false,
     with_local_cc: false,
@@ -7985,8 +8027,13 @@ async function installCommand(opts = {}) {
       ({ claudeWorkers, cursorWorkers, codexWorkers } = splitWorkers(totalWorkers, providers));
       if (synkroFilePool !== "auto") console.log(`  synkro.toml: grader pool set to ${poolLabel(synkroFilePool)}`);
     }
+    const conductorProvider = resolveConductorProvider(sf?.grader.pool || "auto", {
+      claudeWorkers,
+      cursorWorkers,
+      codexWorkers
+    });
     let codexHomeDir;
-    if (codexWorkers > 0) {
+    if (codexWorkers > 0 || conductorProvider === "codex") {
       const codexSetup = await setupCodexLocal((message) => console.log(`  ${message}`));
       if (!codexSetup.ok || !codexSetup.home) {
         console.error(`  \u2717 ${codexSetup.error || "Codex grader authorization failed"}`);
@@ -7996,7 +8043,7 @@ async function installCommand(opts = {}) {
     }
     console.log(`  worker pool: ${claudeWorkers} claude + ${cursorWorkers} cursor + ${codexWorkers} codex`);
     const connectedRepo = detectGitRepo2() || void 0;
-    const { image, hostMcpPort, hostGraderPort, hostCwePort, hostPglitePort } = await dockerInstall({ claudeWorkers, cursorWorkers, codexWorkers, codexHomeDir, connectedRepo });
+    const { image, hostMcpPort, hostGraderPort, hostCwePort, hostPglitePort } = await dockerInstall({ claudeWorkers, cursorWorkers, codexWorkers, conductorProvider, codexHomeDir, connectedRepo });
     console.log(`  \u2713 pulled ${image}`);
     console.log(`  container started \u2014 MCP=${hostMcpPort} general=${hostGraderPort} CWE=${hostCwePort} pglite=${hostPglitePort}`);
     console.log("  waiting for container to be ready...");
@@ -8421,7 +8468,10 @@ function reconcileHarness() {
     const cw = Math.max(0, Math.floor(sf.workers.claude || 0));
     const curw = Math.max(0, Math.floor(sf.workers.cursor || 0));
     const codw = Math.max(0, Math.floor(sf.workers.codex || 0));
-    if (cw + curw + codw > 0) return { claudeWorkers: cw, cursorWorkers: curw, codexWorkers: codw };
+    if (cw + curw + codw > 0) {
+      const counts2 = { claudeWorkers: cw, cursorWorkers: curw, codexWorkers: codw };
+      return { ...counts2, conductorProvider: resolveConductorProvider(sf.grader.pool, counts2) };
+    }
   }
   const total = parseInt(process.env.SYNKRO_WORKERS_PER_POOL || "8", 10);
   const providers = [];
@@ -8437,7 +8487,8 @@ function reconcileHarness() {
     if (wantCodex) providers.push("codex");
   }
   if (providers.length === 0) providers.push("claude_code");
-  return splitWorkers(total, providers);
+  const counts = splitWorkers(total, providers);
+  return { ...counts, conductorProvider: resolveConductorProvider(sf.grader.pool, counts) };
 }
 async function ingestSkillTasks(tasks, mcpPort) {
   const summary = { ingested: 0, rules: 0, rejected: [] };
@@ -9169,6 +9220,7 @@ var init_install = __esm({
     init_setupToken();
     init_codexCloudSetup();
     init_ptyShim();
+    init_graderSmoke();
     SYNKRO_DIR11 = join18(homedir20(), ".synkro");
     HOOKS_DIR = join18(SYNKRO_DIR11, "hooks");
     BIN_DIR = join18(SYNKRO_DIR11, "bin");
@@ -11719,9 +11771,9 @@ async function warmChannels(ready1, ready2) {
 async function cmdStart(rest = []) {
   if (inDockerMode()) {
     if (rest.length > 0) {
-      const { claudeWorkers, cursorWorkers, codexWorkers } = resolveWorkerConfig(rest);
+      const { claudeWorkers, cursorWorkers, codexWorkers, conductorProvider } = resolveWorkerConfig(rest);
       console.log(`Starting synkro-server container (${claudeWorkers} claude + ${cursorWorkers} cursor + ${codexWorkers} codex)...`);
-      await dockerUpdate({ claudeWorkers, cursorWorkers, codexWorkers });
+      await dockerUpdate({ claudeWorkers, cursorWorkers, codexWorkers, conductorProvider });
       const ready3 = await waitForContainerReady(6e4);
       console.log(ready3 ? "\u2713 container ready" : "\u26A0 container did not pass /healthz within 60s");
       return;
@@ -11768,18 +11820,19 @@ async function cmdRestart(rest = []) {
     let claudeWorkers;
     let cursorWorkers;
     let codexWorkers;
+    let conductorProvider;
     if (explicit) {
-      ({ claudeWorkers, cursorWorkers, codexWorkers } = resolveWorkerConfig(rest));
+      ({ claudeWorkers, cursorWorkers, codexWorkers, conductorProvider } = resolveWorkerConfig(rest));
     } else {
       const reconciled = reconcileHarness();
       if (reconciled) {
-        ({ claudeWorkers, cursorWorkers, codexWorkers } = reconciled);
+        ({ claudeWorkers, cursorWorkers, codexWorkers, conductorProvider } = reconciled);
       } else {
-        ({ claudeWorkers, cursorWorkers, codexWorkers } = resolveWorkerConfig(rest));
+        ({ claudeWorkers, cursorWorkers, codexWorkers, conductorProvider } = resolveWorkerConfig(rest));
       }
     }
     console.log(`Restarting synkro-server container (${claudeWorkers} claude + ${cursorWorkers} cursor + ${codexWorkers} codex, pulling latest image)...`);
-    await dockerUpdate({ claudeWorkers, cursorWorkers, codexWorkers });
+    await dockerUpdate({ claudeWorkers, cursorWorkers, codexWorkers, conductorProvider });
     const ready = await waitForContainerReady(6e4);
     console.log(ready ? "\u2713 container ready" : "\u26A0 container did not pass /healthz within 60s");
     if (ready) {
@@ -13134,7 +13187,7 @@ async function startCommand(rest = []) {
   if (cfg.explicit) {
     console.log(`Synkro: starting server (${cfg.claudeWorkers} claude + ${cfg.cursorWorkers} cursor + ${cfg.codexWorkers} codex)
 `);
-    await dockerUpdate({ claudeWorkers: cfg.claudeWorkers, cursorWorkers: cfg.cursorWorkers, codexWorkers: cfg.codexWorkers, connectedRepo: resolveConnectedRepo() });
+    await dockerUpdate({ claudeWorkers: cfg.claudeWorkers, cursorWorkers: cfg.cursorWorkers, codexWorkers: cfg.codexWorkers, conductorProvider: cfg.conductorProvider, connectedRepo: resolveConnectedRepo() });
     const ready = await waitForContainerReady(6e4);
     if (!ready) {
       console.error("\n\u26A0 container did not pass /healthz within 60s");
@@ -13162,10 +13215,11 @@ async function updateCommand() {
   const claudeWorkers = cfg.claudeWorkers ?? 8;
   const cursorWorkers = cfg.cursorWorkers ?? 0;
   const codexWorkers = cfg.codexWorkers ?? 0;
+  const conductorProvider = cfg.conductorProvider;
   console.log("Synkro: updating to the latest container image");
   console.log(`  preserving pool: ${claudeWorkers} claude + ${cursorWorkers} cursor + ${codexWorkers} codex worker(s)
 `);
-  await dockerUpdate({ claudeWorkers, cursorWorkers, codexWorkers, connectedRepo: resolveConnectedRepo() });
+  await dockerUpdate({ claudeWorkers, cursorWorkers, codexWorkers, conductorProvider, connectedRepo: resolveConnectedRepo() });
   const ready = await waitForContainerReady(9e4);
   if (!ready) {
     console.error("\n\u26A0 container did not pass its health check within 90s \u2014 check: docker logs synkro-server");
@@ -13190,17 +13244,19 @@ async function restartCommand(rest = []) {
   let claudeWorkers = cfg.claudeWorkers;
   let cursorWorkers = cfg.cursorWorkers;
   let codexWorkers = cfg.codexWorkers;
+  let conductorProvider = cfg.conductorProvider;
   if (!cfg.explicit) {
     const reconciled = reconcileHarness();
     if (reconciled) {
       claudeWorkers = reconciled.claudeWorkers;
       cursorWorkers = reconciled.cursorWorkers;
       codexWorkers = reconciled.codexWorkers;
+      conductorProvider = reconciled.conductorProvider;
     }
   }
   console.log(`Synkro: restarting server (${claudeWorkers} claude + ${cursorWorkers} cursor + ${codexWorkers} codex)
 `);
-  await dockerUpdate({ claudeWorkers, cursorWorkers, codexWorkers, connectedRepo: resolveConnectedRepo() });
+  await dockerUpdate({ claudeWorkers, cursorWorkers, codexWorkers, conductorProvider, connectedRepo: resolveConnectedRepo() });
   const ready = await waitForContainerReady(6e4);
   if (!ready) {
     console.error("\n\u26A0 container did not pass /healthz within 60s");
@@ -13630,7 +13686,7 @@ var subArgs = args.slice(1);
 var isDetachedChild = process.env.SYNKRO_TELEMETRY_DETACHED === "1";
 var FLUSH_SKIP = /* @__PURE__ */ new Set(["grade", "version", "--version", "-v", "help", "--help", "-h", ""]);
 function printVersion() {
-  console.log("1.7.87");
+  console.log("1.7.88");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents