@synkro-sh/cli 1.3.25 → 1.3.27

package/dist/bootstrap.js

@@ -1677,7 +1677,7 @@ Commands:
   status               - print "running"/"stopped"
 """
 
-import os, sys, json, socket, time, signal, fcntl, re
+import os, sys, json, socket, time, signal, fcntl, re, select
 import subprocess, threading
 from pathlib import Path
 
@@ -1707,27 +1707,49 @@ def log(msg):
         pass
 
 
+STALL_TIMEOUT_SEC = int(os.environ.get("SYNKRO_DAEMON_STALL_TIMEOUT", "10"))
+
 def _read_response(proc, timeout=45):
     acc = []
     deadline = time.time() + timeout
+    last_data = time.time()
+    fd = proc.stdout.fileno()
+    buf = ""
     while True:
-        if time.time() > deadline:
+        remaining = deadline - time.time()
+        if remaining <= 0:
             log("read timeout")
             return ""
-        line = proc.stdout.readline()
-        if not line:
+        if time.time() - last_data > STALL_TIMEOUT_SEC:
+            log(f"stall timeout: no data for {STALL_TIMEOUT_SEC}s")
             return ""
-        try:
-            obj = json.loads(line)
-        except json.JSONDecodeError:
+        ready, _, _ = select.select([fd], [], [], min(remaining, 2.0))
+        if not ready:
+            if proc.poll() is not None:
+                log("process exited during read")
+                return ""
             continue
-        t = obj.get("type")
-        if t == "assistant":
-            for c in obj.get("message", {}).get("content", []):
-                if c.get("type") == "text":
-                    acc.append(c["text"])
-        elif t == "result":
-            return "".join(acc)
+        chunk = os.read(fd, 65536)
+        if not chunk:
+            return ""
+        last_data = time.time()
+        buf += chunk.decode("utf-8", errors="replace")
+        while "\\n" in buf:
+            line, buf = buf.split("\\n", 1)
+            line = line.strip()
+            if not line:
+                continue
+            try:
+                obj = json.loads(line)
+            except json.JSONDecodeError:
+                continue
+            t = obj.get("type")
+            if t == "assistant":
+                for c in obj.get("message", {}).get("content", []):
+                    if c.get("type") == "text":
+                        acc.append(c["text"])
+            elif t == "result":
+                return "".join(acc)
 
 
 def _send_msg(proc, text):
@@ -1757,6 +1779,7 @@ class WarmGrader:
         self._warm_thread = None
         self._lock = threading.Lock()
         self._total_grades = 0
+        self._prewarm_ok = True
         self._start_prewarm()
 
     def _make_proc(self):
@@ -1786,27 +1809,32 @@ class WarmGrader:
             log("pre-warming process")
             proc = self._make_proc()
             _send_msg(proc, "Ready")
-            resp = _read_response(proc, timeout=30)
+            resp = _read_response(proc, timeout=15)
             if resp:
                 with self._lock:
                     old = self._warm_proc
                     self._warm_proc = proc
+                    self._prewarm_ok = True
                 if old:
                     self._kill_proc(old)
                 log(f"pre-warm ready ({len(resp)} chars)")
             else:
                 log("pre-warm response empty")
                 self._kill_proc(proc)
+                self._prewarm_ok = False
         except Exception as e:
             log(f"pre-warm failed: {e}")
+            self._prewarm_ok = False
 
     def _start_prewarm(self):
         self._warm_thread = threading.Thread(target=self._prewarm, daemon=True)
         self._warm_thread.start()
 
     def grade(self, prompt):
-        if self._warm_thread:
-            self._warm_thread.join(timeout=60)
+        if self._warm_thread and self._prewarm_ok:
+            self._warm_thread.join(timeout=8)
+        elif self._warm_thread and not self._prewarm_ok:
+            log("skipping prewarm join (last prewarm failed)")
 
         with self._lock:
             proc = self._warm_proc
@@ -1817,11 +1845,17 @@ class WarmGrader:
             log("no warm process, cold fallback")
             proc = self._make_proc()
             warm = False
+        elif proc.stdin.closed:
+            log("warm process stdin closed, cold fallback")
+            self._kill_proc(proc)
+            proc = self._make_proc()
+            warm = False
 
+        wall_limit = int(os.environ.get("SYNKRO_DAEMON_WALL_TIMEOUT", "12"))
         t0 = time.time()
         try:
             _send_msg(proc, prompt)
-            resp = _read_response(proc, timeout=GRADE_TIMEOUT_SEC)
+            resp = _read_response(proc, timeout=min(GRADE_TIMEOUT_SEC, wall_limit))
         except Exception as e:
             log(f"grade error: {e}")
             resp = ""
@@ -2448,6 +2482,7 @@ async function callApi(method, endpoint, body) {
     throw new Error("API URL not configured. Run `synkro install` first.");
   }
   const url = `${API_URL}${endpoint}`;
+  await ensureValidToken();
   const accessToken = getAccessToken();
   const headers = {
     "Content-Type": "application/json"
@@ -2508,7 +2543,7 @@ jobs:
   scan:
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write
       pull-requests: write
       checks: write
     steps:
@@ -3333,7 +3368,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.3.25")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.3.27")}`
   ];
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
   if (safeOrgId) lines.push(`SYNKRO_ORG_ID=${shellQuoteSingle(safeOrgId)}`);
@@ -4374,6 +4409,60 @@ function ghJson(args2) {
   });
   return JSON.parse(out);
 }
+async function ensureOpenPr(repo, prNumber, sha) {
+  let pr;
+  try {
+    pr = ghJson(["api", `/repos/${repo}/pulls/${prNumber}`]);
+  } catch {
+    return { prNumber, sha, branched: false };
+  }
+  if (pr.state === "open") {
+    return { prNumber, sha, branched: false };
+  }
+  if (pr.merged) {
+    console.log(`PR #${prNumber} is merged. Scanning original diff and posting findings there.
+`);
+    return { prNumber, sha: pr.head.sha, branched: false };
+  }
+  console.log(`PR #${prNumber} is closed. Creating a scan branch...
+`);
+  const scanBranch = `synkro/scan-${pr.head.ref}-${Date.now()}`;
+  try {
+    execSync5(`gh api -X POST /repos/${repo}/git/refs --input -`, {
+      encoding: "utf-8",
+      input: JSON.stringify({ ref: `refs/heads/${scanBranch}`, sha: pr.head.sha }),
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+  } catch (err) {
+    console.warn(`Failed to create scan branch: ${err.message}`);
+    return { prNumber, sha, branched: false };
+  }
+  try {
+    const newPrBody = `Security scan of closed PR #${prNumber} (\`${pr.head.ref}\`).
+
+This PR contains no code changes \u2014 it exists so Synkro can post review findings on an active PR.`;
+    const result = ghJson([
+      "api",
+      "-X",
+      "POST",
+      `/repos/${repo}/pulls`,
+      "-f",
+      `title=Synkro Scan: ${pr.title}`,
+      "-f",
+      `body=${newPrBody}`,
+      "-f",
+      `head=${scanBranch}`,
+      "-f",
+      `base=${pr.base.ref}`
+    ]);
+    console.log(`Opened PR #${result.number} for scan findings.
+`);
+    return { prNumber: result.number, sha: result.head.sha, branched: true };
+  } catch (err) {
+    console.warn(`Failed to open scan PR: ${err.message}`);
+    return { prNumber, sha, branched: false };
+  }
+}
 function getPrFiles(repo, prNumber) {
   const data = ghJson([
     "api",
@@ -4766,6 +4855,9 @@ async function scanPrCommand() {
   }
   console.log(`Synkro scan-pr: ${repo}#${prNumber} @ ${sha.slice(0, 7)}
 `);
+  const prTarget = await ensureOpenPr(repo, prNumber, sha);
+  const activePrNumber = prTarget.prNumber;
+  const activeSha = prTarget.sha;
   const orgRules = await fetchOrgRules(gatewayUrl, synkroApiKey);
   const auditRules = orgRules.filter((r) => r.mode === "audit");
   const literalNegativeRules = orgRules.filter((r) => {
@@ -4776,22 +4868,22 @@ async function scanPrCommand() {
   const promptHeader = buildPrPrompt(auditRules);
   let files;
   try {
-    files = getPrFiles(repo, prNumber);
+    files = getPrFiles(repo, activePrNumber);
   } catch (err) {
     console.error("Failed to fetch PR files:", err.message);
     process.exit(2);
   }
-  const scanCtx = await fetchScanContext(gatewayUrl, synkroApiKey, repo, prNumber, sha);
+  const scanCtx = await fetchScanContext(gatewayUrl, synkroApiKey, repo, activePrNumber, activeSha);
   if (scanCtx.skip) {
-    console.log(`Already scanned at ${sha.slice(0, 7)}, skipping.
+    console.log(`Already scanned at ${activeSha.slice(0, 7)}, skipping.
 `);
-    postCheckRun(repo, sha, "success", []);
+    postCheckRun(repo, activeSha, "success", []);
     await postEventToBackend({
       gatewayUrl,
       apiKey: synkroApiKey,
       repo,
-      prNumber,
-      sha,
+      prNumber: activePrNumber,
+      sha: activeSha,
       findings: [],
       filesScanned: 0,
       totalLatencyMs: 0
@@ -4814,13 +4906,13 @@ async function scanPrCommand() {
   console.log(`${files.length} files in PR, ${eligible.length} eligible for scan.
 `);
   if (eligible.length === 0) {
-    postCheckRun(repo, sha, "success", []);
+    postCheckRun(repo, activeSha, "success", []);
     await postEventToBackend({
       gatewayUrl,
       apiKey: synkroApiKey,
       repo,
-      prNumber,
-      sha,
+      prNumber: activePrNumber,
+      sha: activeSha,
       findings: [],
       filesScanned: 0,
       totalLatencyMs: 0
@@ -4847,17 +4939,17 @@ Total: ${allFindings.length} finding(s) across ${eligible.length} file(s) in ${t
     const review = await spawnOpusConsolidator(allFindings, claudeToken);
     console.log(`  \u2192 ${review.comments.length} review comment(s), severity: ${review.severity}`);
     if (review.comments.length > 0) {
-      postPrReview(repo, prNumber, sha, review);
+      postPrReview(repo, activePrNumber, activeSha, review);
     }
   }
   const conclusion = shouldFail(allFindings, failThreshold) ? "failure" : "success";
-  postCheckRun(repo, sha, conclusion, allFindings);
+  postCheckRun(repo, activeSha, conclusion, allFindings);
   await postEventToBackend({
     gatewayUrl,
     apiKey: synkroApiKey,
     repo,
-    prNumber,
-    sha,
+    prNumber: activePrNumber,
+    sha: activeSha,
     findings: allFindings,
     filesScanned: eligible.length,
     totalLatencyMs