@synkro-sh/cli 1.3.35 → 1.3.37

package/dist/bootstrap.js

@@ -790,6 +790,7 @@ if [ "$SYNKRO_CAPTURE_DEPTH" = "local_only" ] && [ -n "$VERDICT_KIND" ]; then
       --arg category "$CATEGORY" \\
       --arg model "\${CC_MODEL:-claude-sonnet-4-6}" \\
       --arg tool_name "$TOOL_NAME" \\
+      --arg repo "\${GIT_REPO:-}" \\
       '{
         event_id: $event_id,
         timestamp: $timestamp,
@@ -800,7 +801,7 @@ if [ "$SYNKRO_CAPTURE_DEPTH" = "local_only" ] && [ -n "$VERDICT_KIND" ]; then
         category: $category,
         model: $model,
         tool_name: $tool_name
-      }')
+      } + (if $repo != "" then {repo: $repo} else {} end)')
     curl -sS -X POST "\${GATEWAY_URL}/api/v1/events/local-verdict" \\
       -H "Content-Type: application/json" \\
       -H "Authorization: Bearer $JWT" \\
@@ -1267,6 +1268,7 @@ if [ "$SYNKRO_CAPTURE_DEPTH" = "local_only" ] && [ -n "$DECISION" ]; then
       --arg category "$LOCAL_CATEGORY" \\
       --arg model "\${CC_MODEL:-claude-sonnet-4-6}" \\
       --arg tool_name "$TOOL_NAME" \\
+      --arg repo "\${GIT_REPO:-}" \\
       '{
         event_id: $event_id,
         timestamp: $timestamp,
@@ -1276,7 +1278,7 @@ if [ "$SYNKRO_CAPTURE_DEPTH" = "local_only" ] && [ -n "$DECISION" ]; then
         category: $category,
         model: $model,
         tool_name: $tool_name
-      }')
+      } + (if $repo != "" then {repo: $repo} else {} end)')
     curl -sS -X POST "\${GATEWAY_URL}/api/v1/events/local-verdict" \\
       -H "Content-Type: application/json" \\
       -H "Authorization: Bearer $JWT" \\
@@ -1573,11 +1575,12 @@ if [ "$SYNKRO_CAPTURE_DEPTH" = "local_only" ]; then
       --arg category "$CATEGORY" \\
       --arg model "\${CC_MODEL:-claude-sonnet-4-6}" \\
       --arg tool_name "$TOOL_NAME" \\
+      --arg repo "\${GIT_REPO:-}" \\
       '{
         event_id: $event_id, timestamp: $timestamp, hook_type: $hook_type,
         verdict: $verdict, severity: $severity, risk_level: $risk_level,
         category: $category, model: $model, tool_name: $tool_name
-      }')
+      } + (if $repo != "" then {repo: $repo} else {} end)')
     curl -sS -X POST "\${GATEWAY_URL}/api/v1/events/local-verdict" \\
       -H "Content-Type: application/json" \\
       -H "Authorization: Bearer $JWT" \\
@@ -1986,25 +1989,73 @@ def _read_jwt():
     except Exception:
         return ""
 
+def _refresh_jwt():
+    """Refresh the access token using the saved refresh_token. Writes new
+    tokens back to credentials.json. Returns the new access_token or ''."""
+    try:
+        with open(CREDS_PATH) as f:
+            creds = json.load(f)
+        rt = creds.get("refresh_token", "")
+        if not rt:
+            return ""
+        req = urllib.request.Request(
+            f"{GATEWAY_URL}/api/auth/refresh",
+            data=json.dumps({"refresh_token": rt}).encode("utf-8"),
+            headers={
+                "Content-Type": "application/json",
+                "User-Agent": "synkro-cli-grader-daemon/1",
+            },
+        )
+        with urllib.request.urlopen(req, timeout=5) as resp:
+            data = json.loads(resp.read().decode("utf-8"))
+        new_at = data.get("access_token", "")
+        new_rt = data.get("refresh_token", "") or rt
+        if not new_at:
+            return ""
+        creds["access_token"] = new_at
+        creds["refresh_token"] = new_rt
+        tmp = str(CREDS_PATH) + ".synkro.tmp"
+        with open(tmp, "w") as f:
+            json.dump(creds, f)
+        os.replace(tmp, str(CREDS_PATH))
+        return new_at
+    except Exception:
+        return ""
+
 def fetch_primer(mode):
-    """Fetch primer text for {bash,edit} from /cli/judge-prompts. In-memory only."""
+    """Fetch primer text for {bash,edit} from /cli/judge-prompts. In-memory only.
+    Auto-refreshes JWT on 401 and retries once."""
     _load_gateway_url()
-    jwt = _read_jwt()
-    if not jwt:
-        return ""
     field = "grader_primer_bash" if mode == "bash" else "grader_primer_edit"
-    try:
+
+    def _do_fetch(jwt):
         req = urllib.request.Request(
             f"{GATEWAY_URL}/api/v1/cli/judge-prompts",
             headers={
                 "Authorization": f"Bearer {jwt}",
-                # CF rejects requests without UA \u2014 without this we get 403.
                 "User-Agent": "synkro-cli-grader-daemon/1",
             },
         )
         with urllib.request.urlopen(req, timeout=5) as resp:
             data = json.loads(resp.read().decode("utf-8"))
         return data.get(field, "") or ""
+
+    jwt = _read_jwt()
+    if not jwt:
+        return ""
+    try:
+        return _do_fetch(jwt)
+    except urllib.error.HTTPError as e:
+        if e.code != 401:
+            return ""
+        # Token expired \u2014 refresh and retry once.
+        new_jwt = _refresh_jwt()
+        if not new_jwt:
+            return ""
+        try:
+            return _do_fetch(new_jwt)
+        except Exception:
+            return ""
     except Exception:
         return ""
 
@@ -2111,6 +2162,7 @@ class WarmGrader:
     def __init__(self, primer):
         self.primer = primer or ""
         self._warm_proc = None
+        self._warm_ready_at = 0.0
         self._warm_thread = None
         self._lock = threading.Lock()
         self._total_grades = 0
@@ -2149,6 +2201,7 @@ class WarmGrader:
                 with self._lock:
                     old = self._warm_proc
                     self._warm_proc = proc
+                    self._warm_ready_at = time.time()
                     self._prewarm_ok = True
                 if old:
                     self._kill_proc(old)
@@ -2173,8 +2226,16 @@ class WarmGrader:
 
         with self._lock:
             proc = self._warm_proc
+            ready_at = self._warm_ready_at
             self._warm_proc = None
-
+            self._warm_ready_at = 0.0
+
+        # Warm-process TTL: claude --print holds an HTTP/2 conn to Anthropic
+        # that goes stale after ~20s idle. The subprocess doesn't notice the
+        # broken pipe and just hangs forever when given a prompt. Force cold
+        # if the warm has been sitting idle too long \u2014 still faster than
+        # eating a 10s stall timeout + cold fallback.
+        WARM_TTL_SEC = int(os.environ.get("SYNKRO_DAEMON_WARM_TTL", "15"))
         warm = True
         if not proc or proc.poll() is not None:
             log("no warm process, cold fallback")
@@ -2185,6 +2246,12 @@ class WarmGrader:
             self._kill_proc(proc)
             proc = self._make_proc()
             warm = False
+        elif ready_at and (time.time() - ready_at) > WARM_TTL_SEC:
+            age = time.time() - ready_at
+            log(f"warm process stale ({age:.0f}s > {WARM_TTL_SEC}s), cold fallback")
+            self._kill_proc(proc)
+            proc = self._make_proc()
+            warm = False
 
         wall_limit = int(os.environ.get("SYNKRO_DAEMON_WALL_TIMEOUT", "12"))
         t0 = time.time()
@@ -3651,7 +3718,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.3.35")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.3.37")}`
   ];
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
   if (safeOrgId) lines.push(`SYNKRO_ORG_ID=${shellQuoteSingle(safeOrgId)}`);