@synkro-sh/cli 1.3.40 → 1.3.42

package/dist/bootstrap.js

@@ -1988,7 +1988,7 @@ Commands:
   status   - print "running"/"stopped"
 """
 
-import os, sys, json, socket, time, signal, fcntl, re, select
+import os, sys, json, socket, time, signal, fcntl, re, select, queue
 import subprocess, threading, urllib.request, urllib.error
 from pathlib import Path
 
@@ -2119,13 +2119,18 @@ def log(msg):
 
 STALL_TIMEOUT_SEC = int(os.environ.get("SYNKRO_DAEMON_STALL_TIMEOUT", "10"))
 
-def _read_response(proc, timeout=45):
+def _read_response(proc, timeout=45, stop_event=None):
+    """Read stream-json from proc.stdout until a 'result' message arrives.
+    If stop_event is set externally, returns immediately with empty string \u2014
+    used by the parallel-race grade path to abort the loser."""
     acc = []
     deadline = time.time() + timeout
     last_data = time.time()
     fd = proc.stdout.fileno()
     buf = ""
     while True:
+        if stop_event is not None and stop_event.is_set():
+            return ""
         remaining = deadline - time.time()
         if remaining <= 0:
             log("read timeout")
@@ -2133,7 +2138,7 @@ def _read_response(proc, timeout=45):
         if time.time() - last_data > STALL_TIMEOUT_SEC:
             log(f"stall timeout: no data for {STALL_TIMEOUT_SEC}s")
             return ""
-        ready, _, _ = select.select([fd], [], [], min(remaining, 2.0))
+        ready, _, _ = select.select([fd], [], [], min(remaining, 1.0))
         if not ready:
             if proc.poll() is not None:
                 log("process exited during read")
@@ -2262,39 +2267,71 @@ class WarmGrader:
             self._warm_proc = None
             self._warm_ready_at = 0.0
 
-        # Discard warm processes that have been idle too long.
         WARM_TTL_SEC = int(os.environ.get("SYNKRO_DAEMON_WARM_TTL", "15"))
-        warm = True
-        if not proc or proc.poll() is not None:
-            log("no warm process, cold fallback")
-            proc = self._make_proc()
-            warm = False
-        elif proc.stdin.closed:
-            log("warm process stdin closed, cold fallback")
+        # Decide if the warm process is usable for the race.
+        warm_usable = bool(proc) and proc.poll() is None and not proc.stdin.closed
+        if warm_usable and ready_at and (time.time() - ready_at) > WARM_TTL_SEC:
             self._kill_proc(proc)
-            proc = self._make_proc()
-            warm = False
-        elif ready_at and (time.time() - ready_at) > WARM_TTL_SEC:
-            age = time.time() - ready_at
-            log(f"warm process stale ({age:.0f}s > {WARM_TTL_SEC}s), cold fallback")
+            warm_usable = False
+        if not warm_usable and proc:
             self._kill_proc(proc)
-            proc = self._make_proc()
-            warm = False
+            proc = None
 
         wall_limit = int(os.environ.get("SYNKRO_DAEMON_WALL_TIMEOUT", "12"))
+        race_timeout = min(GRADE_TIMEOUT_SEC, wall_limit)
+
+        # Race a warm and a fresh cold process. Whichever returns a non-empty
+        # response first wins; the other is killed. If we have no warm, just
+        # run cold solo (no benefit to racing two cold spawns of the same age).
+        cold_proc = self._make_proc() if warm_usable else proc or self._make_proc()
+        warm_proc = proc if warm_usable else None
+
+        result_q = queue.Queue()
+        stop_event = threading.Event()
+
+        def grade_worker(p, label):
+            try:
+                _send_msg(p, prompt)
+                r = _read_response(p, timeout=race_timeout, stop_event=stop_event)
+                if r:
+                    result_q.put((label, r))
+            except Exception as e:
+                log(f"grade {label} error: {e}")
+
+        threads = []
+        if warm_proc is not None:
+            t = threading.Thread(target=grade_worker, args=(warm_proc, "warm"), daemon=True)
+            t.start()
+            threads.append(t)
+        t = threading.Thread(target=grade_worker, args=(cold_proc, "cold"), daemon=True)
+        t.start()
+        threads.append(t)
+
         t0 = time.time()
+        winner_label = None
+        resp = ""
         try:
-            _send_msg(proc, prompt)
-            resp = _read_response(proc, timeout=min(GRADE_TIMEOUT_SEC, wall_limit))
-        except Exception as e:
-            log(f"grade error: {e}")
-            resp = ""
+            deadline = time.time() + race_timeout + 2
+            while time.time() < deadline:
+                try:
+                    label, r = result_q.get(timeout=0.5)
+                    if r:
+                        resp = r
+                        winner_label = label
+                        break
+                except queue.Empty:
+                    if all(not th.is_alive() for th in threads):
+                        break
         finally:
-            self._kill_proc(proc)
+            stop_event.set()
+            if warm_proc is not None:
+                self._kill_proc(warm_proc)
+            self._kill_proc(cold_proc)
 
         elapsed = (time.time() - t0) * 1000
         self._total_grades += 1
-        log(f"grade #{self._total_grades} {'warm' if warm else 'cold'} elapsed={elapsed:.0f}ms resp={len(resp)}ch")
+        winner = winner_label or "none"
+        log(f"grade #{self._total_grades} race={'warm+cold' if warm_proc else 'cold'} won={winner} elapsed={elapsed:.0f}ms resp={len(resp)}ch")
 
         self._start_prewarm()
         return resp
@@ -3746,7 +3783,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.3.40")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.3.42")}`
   ];
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
   if (safeOrgId) lines.push(`SYNKRO_ORG_ID=${shellQuoteSingle(safeOrgId)}`);
@@ -4793,54 +4830,9 @@ async function ensureOpenPr(repo, prNumber, sha) {
   try {
     pr = ghJson(["api", `/repos/${repo}/pulls/${prNumber}`]);
   } catch {
-    return { prNumber, sha, branched: false };
-  }
-  if (pr.state === "open") {
-    return { prNumber, sha, branched: false };
-  }
-  if (pr.merged) {
-    console.log(`PR #${prNumber} is merged. Scanning original diff and posting findings there.
-`);
-    return { prNumber, sha: pr.head.sha, branched: false };
-  }
-  console.log(`PR #${prNumber} is closed. Creating a scan branch...
-`);
-  const scanBranch = `synkro/scan-${pr.head.ref}-${Date.now()}`;
-  try {
-    execSync5(`gh api -X POST /repos/${repo}/git/refs --input -`, {
-      encoding: "utf-8",
-      input: JSON.stringify({ ref: `refs/heads/${scanBranch}`, sha: pr.head.sha }),
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-  } catch (err) {
-    console.warn(`Failed to create scan branch: ${err.message}`);
-    return { prNumber, sha, branched: false };
-  }
-  try {
-    const newPrBody = `Security scan of closed PR #${prNumber} (\`${pr.head.ref}\`).
-
-This PR contains no code changes \u2014 it exists so Synkro can post review findings on an active PR.`;
-    const result = ghJson([
-      "api",
-      "-X",
-      "POST",
-      `/repos/${repo}/pulls`,
-      "-f",
-      `title=Synkro Scan: ${pr.title}`,
-      "-f",
-      `body=${newPrBody}`,
-      "-f",
-      `head=${scanBranch}`,
-      "-f",
-      `base=${pr.base.ref}`
-    ]);
-    console.log(`Opened PR #${result.number} for scan findings.
-`);
-    return { prNumber: result.number, sha: result.head.sha, branched: true };
-  } catch (err) {
-    console.warn(`Failed to open scan PR: ${err.message}`);
-    return { prNumber, sha, branched: false };
+    return { prNumber, sha, branched: false, prState: "unknown", merged: false };
   }
+  return { prNumber, sha: pr.head.sha, branched: false, prState: pr.state, merged: pr.merged };
 }
 function getPrFiles(repo, prNumber) {
   const data = ghJson([
@@ -5117,7 +5109,28 @@ ${linesStr}: ${first.description}
     severity: maxSeverity
   };
 }
-function postPrReview(repo, prNumber, sha, review) {
+function postPrReview(repo, prNumber, sha, review, skipLineReview = false) {
+  function postIssueComment() {
+    try {
+      const body = `## \u{1F512} Synkro Security Review
+
+${review.summary}
+
+` + review.comments.map((c) => `**${c.path}:${c.line}** \u2014 ${c.body}`).join("\n\n");
+      execSync5(`gh api -X POST /repos/${repo}/issues/${prNumber}/comments --input -`, {
+        encoding: "utf-8",
+        input: JSON.stringify({ body }),
+        stdio: ["pipe", "ignore", "pipe"]
+      });
+      console.log("  \u2713 Posted issue comment with findings.");
+    } catch (err) {
+      console.warn("Failed to post issue comment:", err.message);
+    }
+  }
+  if (skipLineReview) {
+    postIssueComment();
+    return;
+  }
   const preferredEvent = review.severity === "critical" || review.severity === "high" ? "REQUEST_CHANGES" : "COMMENT";
   function tryPost(event) {
     const body = JSON.stringify({
@@ -5143,27 +5156,12 @@ ${review.summary}`,
       if (combined.includes("own pull request") && event === "REQUEST_CHANGES") {
         return false;
       }
-      console.warn(`Failed to post review: ${(stderr || stdout || err.message).slice(0, 200)}`);
       return false;
     }
   }
   if (tryPost(preferredEvent)) return;
   if (preferredEvent === "REQUEST_CHANGES" && tryPost("COMMENT")) return;
-  try {
-    const fallbackBody = `## \u{1F512} Synkro Security Review
-
-${review.summary}
-
-` + review.comments.map((c) => `**${c.path}:${c.line}** \u2014 ${c.body}`).join("\n\n");
-    execSync5(`gh api -X POST /repos/${repo}/issues/${prNumber}/comments --input -`, {
-      encoding: "utf-8",
-      input: JSON.stringify({ body: fallbackBody }),
-      stdio: ["pipe", "ignore", "pipe"]
-    });
-    console.log("  \u2713 Posted fallback issue comment.");
-  } catch (err2) {
-    console.warn("Failed to post fallback comment:", err2.message);
-  }
+  postIssueComment();
 }
 function postCheckRun(repo, sha, conclusion, findings) {
   const summary = findings.length === 0 ? "No security findings." : `${findings.length} finding(s):
@@ -5318,7 +5316,8 @@ Total: ${allFindings.length} finding(s) across ${eligible.length} file(s) in ${t
     const review = await spawnOpusConsolidator(allFindings, claudeToken);
     console.log(`  \u2192 ${review.comments.length} review comment(s), severity: ${review.severity}`);
     if (review.comments.length > 0) {
-      postPrReview(repo, activePrNumber, activeSha, review);
+      const skipLineReview = prTarget.prState === "closed" && !prTarget.merged;
+      postPrReview(repo, activePrNumber, activeSha, review, skipLineReview);
     }
   }
   const conclusion = shouldFail(allFindings, failThreshold) ? "failure" : "success";