@synkro-sh/cli 1.0.9 → 1.0.11

package/dist/bootstrap.js

@@ -667,39 +667,43 @@ case "$TOOL_NAME" in
   Write)
     # Write replaces the entire file \u2014 content IS the full post-edit file.
     PROPOSED=$(echo "$TOOL_INPUT" | jq -r '.content // ""' 2>/dev/null) ;;
-  Edit)
+  Edit|MultiEdit)
     # Reconstruct the full post-edit file by applying the diff to file_before.
     # Sending only new_string (the diff hunk) blinds the local grader to
     # violations elsewhere in the file \u2014 the grader needs whole-file context
-    # to identify multi-violation edits and cross-line patterns. Fall back
-    # to new_string only if file_before is missing (new file) or we can't
-    # locate old_string in it.
-    OLD_STR=$(echo "$TOOL_INPUT" | jq -r '.old_string // ""' 2>/dev/null)
-    NEW_STR=$(echo "$TOOL_INPUT" | jq -r '.new_string // ""' 2>/dev/null)
-    if [ -n "$FILE_BEFORE" ] && [ -n "$OLD_STR" ]; then
-      PROPOSED="\${FILE_BEFORE//"$OLD_STR"/"$NEW_STR"}"
-    else
-      PROPOSED="$NEW_STR"
+    # to identify multi-violation edits and cross-line patterns.
+    #
+    # We use python (already a daemon dependency) instead of bash parameter
+    # expansion because macOS ships bash 3.2, where the quoted-pattern form
+    # of \${var//PAT/REPL} leaks the quote characters into the result.
+    # Python's str.replace() handles arbitrary strings cleanly. Args go via
+    # env vars (not argv) so 64 KB file content doesn't trip ARG_MAX limits.
+    if [ -n "$FILE_BEFORE" ] && command -v python3 >/dev/null 2>&1; then
+      PROPOSED=$(FILE_BEFORE_LITERAL="$FILE_BEFORE" TOOL_INPUT_LITERAL="$TOOL_INPUT" python3 -c '
+import os, json, sys
+fb = os.environ.get("FILE_BEFORE_LITERAL", "")
+ti = json.loads(os.environ.get("TOOL_INPUT_LITERAL", "{}"))
+result = fb
+if "old_string" in ti and "new_string" in ti:
+    if ti["old_string"]:
+        result = result.replace(ti["old_string"], ti["new_string"], 1)
+elif "edits" in ti and isinstance(ti["edits"], list):
+    for e in ti["edits"]:
+        old = e.get("old_string", "") if isinstance(e, dict) else ""
+        new = e.get("new_string", "") if isinstance(e, dict) else ""
+        if old:
+            result = result.replace(old, new, 1)
+sys.stdout.write(result)
+' 2>/dev/null)
     fi
-    ;;
-  MultiEdit)
-    # Apply each {old,new} pair in sequence to reconstruct the full
-    # post-edit file. Same rationale as Edit \u2014 grader needs whole file.
-    if [ -n "$FILE_BEFORE" ]; then
-      PROPOSED="$FILE_BEFORE"
-      EDITS_JSON=$(echo "$TOOL_INPUT" | jq -c '.edits // []' 2>/dev/null)
-      EDIT_COUNT=$(echo "$EDITS_JSON" | jq -r 'length' 2>/dev/null)
-      i=0
-      while [ "$i" -lt "$EDIT_COUNT" ]; do
-        OLD=$(echo "$EDITS_JSON" | jq -r ".[$i].old_string // \\"\\"")
-        NEW=$(echo "$EDITS_JSON" | jq -r ".[$i].new_string // \\"\\"")
-        if [ -n "$OLD" ]; then
-          PROPOSED="\${PROPOSED//"$OLD"/"$NEW"}"
-        fi
-        i=$((i + 1))
-      done
-    else
-      PROPOSED=$(echo "$TOOL_INPUT" | jq -r '[.edits[]?.new_string // ""] | join("\\n\\n--- chunk ---\\n\\n")' 2>/dev/null)
+    # Fall back to the diff-hunk-only shape if reconstruction failed or
+    # file_before was empty (new file via Edit, etc.).
+    if [ -z "$PROPOSED" ]; then
+      if [ "$TOOL_NAME" = "MultiEdit" ]; then
+        PROPOSED=$(echo "$TOOL_INPUT" | jq -r '[.edits[]?.new_string // ""] | join("\\n\\n--- chunk ---\\n\\n")' 2>/dev/null)
+      else
+        PROPOSED=$(echo "$TOOL_INPUT" | jq -r '.new_string // ""' 2>/dev/null)
+      fi
     fi
     ;;
   NotebookEdit)
@@ -1931,7 +1935,7 @@ __export(install_exports, {
   installCommand: () => installCommand,
   parseArgs: () => parseArgs
 });
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4, chmodSync } from "fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, writeFileSync as writeFileSync4, chmodSync, readFileSync as readFileSync4 } from "fs";
 import { homedir as homedir4 } from "os";
 import { join as join4 } from "path";
 function sanitizeGatewayCandidate(raw) {
@@ -1945,6 +1949,7 @@ function parseArgs(argv) {
     else if (a.startsWith("--gateway=")) opts.gatewayUrl = a.slice("--gateway=".length);
     else if (a === "--skip-auth") opts.skipAuth = true;
     else if (a === "--no-mcp") opts.noMcp = true;
+    else if (a === "--force" || a === "-f") opts.force = true;
   }
   if (!opts.gatewayUrl) {
     const fromEnv = sanitizeGatewayCandidate(process.env.SYNKRO_GATEWAY_URL);
@@ -2016,7 +2021,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_GATEWAY_URL=${shellQuoteSingle(safeGateway)}`,
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.0.9")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.0.11")}`
   ];
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
   if (safeOrgId) lines.push(`SYNKRO_ORG_ID=${shellQuoteSingle(safeOrgId)}`);
@@ -2047,6 +2052,33 @@ function assertGatewayAllowed(gatewayUrl) {
     throw new Error(`Gateway host not in allowlist (synkro.sh or *.synkro.sh): ${host}`);
   }
 }
+function isAlreadyInstalled() {
+  const requiredScripts = [
+    join4(HOOKS_DIR, "cc-bash-judge.sh"),
+    join4(HOOKS_DIR, "cc-bash-followup.sh"),
+    join4(HOOKS_DIR, "cc-edit-precheck.sh"),
+    join4(HOOKS_DIR, "cc-edit-capture.sh"),
+    join4(HOOKS_DIR, "cc-stop-summary.sh"),
+    join4(HOOKS_DIR, "cc-session-start.sh")
+  ];
+  if (!requiredScripts.every((p) => existsSync5(p))) return false;
+  if (!existsSync5(CONFIG_PATH)) return false;
+  const settingsPath = join4(homedir4(), ".claude", "settings.json");
+  if (!existsSync5(settingsPath)) return false;
+  try {
+    const settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
+    const hooks = settings?.hooks;
+    if (!hooks || typeof hooks !== "object") return false;
+    const hasManaged = (kind) => Array.isArray(hooks[kind]) && hooks[kind].some((entry) => entry?.__synkro_managed__ === true);
+    if (!hasManaged("PreToolUse")) return false;
+    if (!hasManaged("PostToolUse")) return false;
+    if (!hasManaged("SessionEnd")) return false;
+    if (!hasManaged("SessionStart")) return false;
+  } catch {
+    return false;
+  }
+  return true;
+}
 async function installCommand(opts = {}) {
   const gatewayUrl = opts.gatewayUrl || sanitizeGatewayCandidate(process.env.SYNKRO_GATEWAY_URL) || "https://api.synkro.sh";
   try {
@@ -2055,6 +2087,12 @@ async function installCommand(opts = {}) {
     console.error(err.message);
     process.exit(1);
   }
+  if (!opts.force && isAuthenticated() && isAlreadyInstalled()) {
+    console.log("\u2713 Synkro is already installed and configured.");
+    console.log("  Run `synkro update` to refresh hook scripts and judge prompts.");
+    console.log("  Run `synkro install --force` to reinstall from scratch.");
+    return;
+  }
   console.log("Synkro install starting...\n");
   if (!isAuthenticated()) {
     console.log("Opening browser for Synkro auth...");
@@ -2108,7 +2146,7 @@ async function installCommand(opts = {}) {
   console.log(`  ${scripts.sessionStartScript}
 `);
   writeGraderDaemon();
-  console.log("Wrote free-tier grader daemon:");
+  console.log("Wrote local-tier grader daemon:");
   console.log(`  ${GRADER_DAEMON_PATH}`);
   console.log(`  ${GRADER_PRIMER_EDIT_PATH}`);
   console.log(`  ${GRADER_PRIMER_BASH_PATH}
@@ -2126,8 +2164,6 @@ async function installCommand(opts = {}) {
         sessionStartScriptPath: scripts.sessionStartScript
       });
       console.log(`Configured ${agent.name} hooks at ${agent.settingsPath}`);
-    } else if (agent.kind === "codex") {
-      console.log(`Skipping ${agent.name} for now (v1.1 \u2014 Codex hook config coming soon)`);
     }
   }
   console.log();
@@ -2149,7 +2185,6 @@ async function installCommand(opts = {}) {
       const mcp = installMcpConfig({ gatewayUrl, bearerToken: minted.token });
       console.log(`Registered Synkro guardrails MCP server in ${mcp.path}`);
       console.log(`  url:        ${mcp.url}`);
-      console.log(`  token:      Synkro-signed JWT, scope=mcp:guardrails`);
       console.log(`  expires:    ${minted.expires_at} (~1 year)`);
       console.log("  (restart any running Claude Code session for it to load)");
       console.log();
@@ -2174,21 +2209,9 @@ async function installCommand(opts = {}) {
 `);
   console.log("\u2713 Synkro installed.");
   console.log();
-  console.log("Try it:");
-  console.log("  $ claude");
-  console.log('  > Run "echo hello" for me');
-  console.log("  (no warning \u2014 safe command)");
-  console.log();
-  console.log("  > Now propose: kubectl delete namespace production");
-  console.log("  (Synkro will block with a warning)");
-  console.log();
   console.log("Next steps:");
   console.log("  \u2022 synkro setup-github   (enable PR scanning)");
   console.log("  \u2022 synkro status         (check what is configured)");
-  if (hasClaudeCode && !opts.noMcp) {
-    console.log('  \u2022 Try in CC: "Add a Stripe webhook handler" \u2014 CC should call');
-    console.log("    synkro-guardrails.get_guardrails to fetch org-specific rules.");
-  }
 }
 var SYNKRO_DIR, HOOKS_DIR, BIN_DIR, CONFIG_PATH, GRADER_DAEMON_PATH, GRADER_PRIMER_EDIT_PATH, GRADER_PRIMER_BASH_PATH;
 var init_install = __esm({
@@ -2282,13 +2305,13 @@ var status_exports = {};
 __export(status_exports, {
   statusCommand: () => statusCommand
 });
-import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
 import { homedir as homedir5 } from "os";
 import { join as join5 } from "path";
 function readConfigEnv() {
   if (!existsSync6(CONFIG_PATH2)) return {};
   const out = {};
-  const raw = readFileSync4(CONFIG_PATH2, "utf-8");
+  const raw = readFileSync5(CONFIG_PATH2, "utf-8");
   for (const line of raw.split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -2555,13 +2578,13 @@ __export(setupGithub_exports, {
 });
 import { createInterface } from "readline/promises";
 import { stdin as input, stdout as output } from "process";
-import { existsSync as existsSync8, readFileSync as readFileSync5 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
 import { homedir as homedir6 } from "os";
 import { join as join7 } from "path";
 function readConfig() {
   if (!existsSync8(CONFIG_PATH3)) return {};
   const out = {};
-  for (const line of readFileSync5(CONFIG_PATH3, "utf-8").split("\n")) {
+  for (const line of readFileSync6(CONFIG_PATH3, "utf-8").split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#")) continue;
     const eq = t.indexOf("=");
@@ -3068,13 +3091,17 @@ function disconnectCommand(args2 = []) {
     const mcpRemoved = uninstallMcpConfig();
     console.log(`${mcpRemoved ? "\u2713" : "\xB7"} MCP guardrails server: ${mcpRemoved ? "removed entry from ~/.claude.json" : "no Synkro MCP entry found"}`);
   }
-  if (purge && existsSync9(SYNKRO_DIR4)) {
-    rmSync(SYNKRO_DIR4, { recursive: true, force: true });
-    console.log(`\u2713 Removed ${SYNKRO_DIR4} (--purge)`);
-  } else {
+  if (purge) {
+    if (existsSync9(SYNKRO_DIR4)) {
+      rmSync(SYNKRO_DIR4, { recursive: true, force: true });
+      console.log(`\u2713 Removed ${SYNKRO_DIR4}`);
+    } else {
+      console.log(`\xB7 ${SYNKRO_DIR4} already gone, nothing to remove`);
+    }
+  } else if (existsSync9(SYNKRO_DIR4)) {
     console.log(`Config preserved at ${SYNKRO_DIR4}. Run with --purge to remove.`);
   }
-  console.log("\nSynkro disconnected. Your AI agents will no longer be judged.");
+  console.log("\nSynkro disconnected.");
 }
 var SYNKRO_DIR4;
 var init_disconnect = __esm({
@@ -3088,7 +3115,7 @@ var init_disconnect = __esm({
 });
 
 // cli/bootstrap.js
-import { readFileSync as readFileSync6, existsSync as existsSync10 } from "fs";
+import { readFileSync as readFileSync7, existsSync as existsSync10 } from "fs";
 import { resolve } from "path";
 var envCandidates = [
   resolve(process.cwd(), ".env"),
@@ -3096,7 +3123,7 @@ var envCandidates = [
 ];
 for (const envPath of envCandidates) {
   if (!existsSync10(envPath)) continue;
-  const envContent = readFileSync6(envPath, "utf-8");
+  const envContent = readFileSync7(envPath, "utf-8");
   for (const line of envContent.split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -3117,7 +3144,7 @@ Usage:
   synkro <command> [options]
 
 Commands:
-  install              Install Synkro hooks for detected agents (Claude Code, etc.)
+  install [--force]    Install Synkro hooks for detected agents (Claude Code, etc.)
   login                Authenticate with Synkro (browser OAuth via WorkOS)
   logout               Clear local credentials
   status               Show current setup state
@@ -3131,8 +3158,6 @@ Quick start:
   $ synkro install              # one-time setup
   $ synkro setup-github         # enable PR scanning (optional)
   $ claude                      # use Claude Code normally; Synkro judges in real time
-
-Docs: https://docs.synkro.sh
 `);
 }
 async function main() {