@synkro-sh/cli 1.3.57 → 1.3.59

package/dist/bootstrap.js

@@ -3186,50 +3186,15 @@ jobs:
 
 // cli/installer/githubSetup.ts
 import { existsSync as existsSync5, mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "fs";
+import { execSync as execSync2 } from "child_process";
 import { join as join4 } from "path";
-async function encryptSecret(publicKeyBase64, secret) {
-  const sodium = await import("libsodium-wrappers").then((m) => m.default ?? m);
-  await sodium.ready;
-  const keyBytes = sodium.from_base64(publicKeyBase64, sodium.base64_variants.ORIGINAL);
-  const messageBytes = sodium.from_string(secret);
-  const encryptedBytes = sodium.crypto_box_seal(messageBytes, keyBytes);
-  return sodium.to_base64(encryptedBytes, sodium.base64_variants.ORIGINAL);
-}
-async function getRepoPublicKey(opts, owner, repo) {
-  const url = `https://api.github.com/repos/${owner}/${repo}/actions/secrets/public-key`;
-  const resp = await fetch(url, {
-    headers: {
-      Authorization: `Bearer ${opts.token}`,
-      Accept: "application/vnd.github+json",
-      "X-GitHub-Api-Version": "2022-11-28"
-    }
-  });
-  if (!resp.ok) {
-    const text = await resp.text().catch(() => "");
-    throw new Error(`GitHub API ${resp.status} fetching public key for ${owner}/${repo}: ${text.slice(0, 200)}`);
-  }
-  return await resp.json();
-}
-async function putRepoSecret(opts, owner, repo, secretName, secretValue, publicKey) {
-  const encryptedValue = await encryptSecret(publicKey.key, secretValue);
-  const url = `https://api.github.com/repos/${owner}/${repo}/actions/secrets/${encodeURIComponent(secretName)}`;
-  const resp = await fetch(url, {
-    method: "PUT",
-    headers: {
-      Authorization: `Bearer ${opts.token}`,
-      Accept: "application/vnd.github+json",
-      "X-GitHub-Api-Version": "2022-11-28",
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify({
-      encrypted_value: encryptedValue,
-      key_id: publicKey.key_id
-    })
+function ghSecretSet(token, owner, repo, name, value) {
+  execSync2(`gh secret set ${name} --repo ${owner}/${repo} --body -`, {
+    input: value,
+    env: { ...process.env, GH_TOKEN: token },
+    stdio: ["pipe", "ignore", "pipe"],
+    timeout: 3e4
   });
-  if (!resp.ok) {
-    const text = await resp.text().catch(() => "");
-    throw new Error(`GitHub API ${resp.status} setting secret ${secretName}: ${text.slice(0, 200)}`);
-  }
 }
 async function listAccessibleRepos(opts) {
   const repos = [];
@@ -3257,11 +3222,15 @@ async function listAccessibleRepos(opts) {
   return repos;
 }
 async function pushSecretsToRepo(opts, owner, repo, secrets) {
-  const pubkey = await getRepoPublicKey(opts, owner, repo);
+  try {
+    execSync2("gh --version", { stdio: "ignore", timeout: 5e3 });
+  } catch {
+    throw new Error("GitHub CLI (gh) not found. Install it: https://cli.github.com");
+  }
   if (secrets.claudeCodeOauthToken) {
-    await putRepoSecret(opts, owner, repo, "CLAUDE_CODE_OAUTH_TOKEN", secrets.claudeCodeOauthToken, pubkey);
+    ghSecretSet(opts.token, owner, repo, "CLAUDE_CODE_OAUTH_TOKEN", secrets.claudeCodeOauthToken);
   }
-  await putRepoSecret(opts, owner, repo, "SYNKRO_API_KEY", secrets.synkroApiKey, pubkey);
+  ghSecretSet(opts.token, owner, repo, "SYNKRO_API_KEY", secrets.synkroApiKey);
 }
 function writeWorkflowFile(repoRootPath) {
   const workflowDir = join4(repoRootPath, ".github", "workflows");
@@ -3294,12 +3263,12 @@ var init_githubSetup = __esm({
 });
 
 // cli/commands/repoConnect.ts
-import { execSync as execSync2 } from "child_process";
+import { execSync as execSync3 } from "child_process";
 import { createServer as createServer2 } from "http";
 import { createInterface } from "readline";
 function detectGitRepo() {
   try {
-    const remoteUrl = execSync2("git remote get-url origin", { encoding: "utf-8", timeout: 5e3 }).trim();
+    const remoteUrl = execSync3("git remote get-url origin", { encoding: "utf-8", timeout: 5e3 }).trim();
     const sshMatch = remoteUrl.match(/^git@[^:]+:(.+?)(?:\.git)?$/);
     const httpMatch = remoteUrl.match(/^https?:\/\/[^/]+\/(.+?)(?:\.git)?$/);
     const match = sshMatch || httpMatch;
@@ -3515,7 +3484,7 @@ __export(setupGithub_exports, {
 });
 import { createInterface as createInterface2 } from "readline/promises";
 import { stdin as input, stdout as output } from "process";
-import { execSync as execSync3, spawn as nodeSpawn } from "child_process";
+import { execSync as execSync4, spawn as nodeSpawn } from "child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync4, unlinkSync as unlinkSync3 } from "fs";
 import { homedir as homedir4, platform as platform2 } from "os";
 import { join as join5 } from "path";
@@ -3594,7 +3563,9 @@ function captureClaudeSetupToken() {
       let raw = "";
       try {
         raw = readFileSync4(tmpFile, "utf-8");
-      } catch {
+      } catch (e) {
+        reject(new Error(`Could not read script output file: ${e.message}`));
+        return;
       }
       try {
         unlinkSync3(tmpFile);
@@ -3604,20 +3575,16 @@ function captureClaudeSetupToken() {
         reject(new Error(`claude setup-token exited with code ${code}`));
         return;
       }
-      const stripped = raw.replace(/\x1B\[[0-9;]*[A-Za-z]|\x1B\][^\x07]*\x07/g, "");
-      const startIdx = stripped.indexOf("Your OAuth token");
-      const endIdx = stripped.indexOf("Store this token");
-      if (startIdx === -1 || endIdx === -1) {
-        reject(new Error("Could not find token in claude setup-token output"));
-        return;
-      }
-      const section = stripped.slice(startIdx, endIdx).replace(/\s/g, "");
-      const match = section.match(/sk-ant-oat01-[A-Za-z0-9_-]+/);
-      if (!match) {
-        reject(new Error("Could not find token in claude setup-token output"));
+      const yellowRe = /\x1B\[38;2;255;193;7m([^\x1B]*)/g;
+      let yellow = "";
+      let m;
+      while ((m = yellowRe.exec(raw)) !== null) yellow += m[1];
+      const token = yellow.replace(/\s/g, "").match(/sk-ant-oat01-[A-Za-z0-9_-]+/);
+      if (!token) {
+        reject(new Error(`Could not find token in claude setup-token output (file=${raw.length}b, yellow=${yellow.length}b)`));
         return;
       }
-      resolve2(match[0]);
+      resolve2(token[0]);
     });
   });
 }
@@ -3727,7 +3694,7 @@ async function setupGithubCommand(opts = {}) {
       }
     } catch {
       try {
-        ghToken = execSync3("gh auth token", { encoding: "utf-8", timeout: 5e3 }).trim();
+        ghToken = execSync4("gh auth token", { encoding: "utf-8", timeout: 5e3 }).trim();
       } catch {
         console.error("GitHub not connected. Run `synkro-cli setup-github` interactively to connect.");
         return;
@@ -3761,7 +3728,7 @@ async function setupGithubCommand(opts = {}) {
     }
     console.log("  Validating token...");
     try {
-      const validateResult = execSync3(
+      const validateResult = execSync4(
         'claude --print --output-format json "say ok"',
         { env: { ...process.env, CLAUDE_CODE_OAUTH_TOKEN: claudeToken }, encoding: "utf-8", timeout: 3e4, stdio: ["ignore", "pipe", "pipe"] }
       );
@@ -3778,7 +3745,7 @@ async function setupGithubCommand(opts = {}) {
   if (opts.nonInteractive) {
     let currentFullName = null;
     try {
-      const remoteUrl = execSync3("git remote get-url origin", { encoding: "utf-8", timeout: 5e3 }).trim();
+      const remoteUrl = execSync4("git remote get-url origin", { encoding: "utf-8", timeout: 5e3 }).trim();
       const m = remoteUrl.match(/(?:github\.com)[:/](.+?)(?:\.git)?$/);
       if (m) currentFullName = m[1];
     } catch {
@@ -3881,7 +3848,7 @@ __export(install_exports, {
 import { existsSync as existsSync7, mkdirSync as mkdirSync5, writeFileSync as writeFileSync5, chmodSync, readFileSync as readFileSync5, readdirSync } from "fs";
 import { homedir as homedir5 } from "os";
 import { join as join6 } from "path";
-import { execSync as execSync4 } from "child_process";
+import { execSync as execSync5 } from "child_process";
 import { createInterface as createInterface3 } from "readline";
 function sanitizeGatewayCandidate(raw) {
   if (!raw) return void 0;
@@ -3987,7 +3954,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.3.57")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.3.59")}`
   ];
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
   if (safeOrgId) lines.push(`SYNKRO_ORG_ID=${shellQuoteSingle(safeOrgId)}`);
@@ -4002,11 +3969,11 @@ function writeConfigEnv(opts) {
 function collectLocalMetadata() {
   const meta = { platform: process.platform };
   try {
-    meta.display_name = execSync4("git config user.name", { encoding: "utf-8", timeout: 3e3 }).trim();
+    meta.display_name = execSync5("git config user.name", { encoding: "utf-8", timeout: 3e3 }).trim();
   } catch {
   }
   try {
-    const remote = execSync4("git remote get-url origin", { encoding: "utf-8", timeout: 3e3 }).trim();
+    const remote = execSync5("git remote get-url origin", { encoding: "utf-8", timeout: 3e3 }).trim();
     const sshMatch = remote.match(/^git@[^:]+:(.+?)(?:\.git)?$/);
     const httpMatch = remote.match(/^https?:\/\/[^/]+\/(.+?)(?:\.git)?$/);
     const m = sshMatch || httpMatch;
@@ -4014,7 +3981,7 @@ function collectLocalMetadata() {
   } catch {
   }
   try {
-    meta.cc_version = execSync4("claude --version", { encoding: "utf-8", timeout: 5e3 }).trim().split("\n")[0];
+    meta.cc_version = execSync5("claude --version", { encoding: "utf-8", timeout: 5e3 }).trim().split("\n")[0];
   } catch {
   }
   const claudeDir = join6(homedir5(), ".claude");
@@ -4032,7 +3999,7 @@ function collectLocalMetadata() {
   } catch {
   }
   try {
-    const mcpList = execSync4("claude mcp list 2>/dev/null", { encoding: "utf-8", timeout: 1e4 });
+    const mcpList = execSync5("claude mcp list 2>/dev/null", { encoding: "utf-8", timeout: 1e4 });
     const connected = mcpList.split("\n").filter((l) => l.includes("Connected")).map((l) => l.split(":")[0].trim()).filter(Boolean);
     if (connected.length) meta.mcp_servers_connected = connected;
   } catch {
@@ -4335,7 +4302,7 @@ async function installCommand(opts = {}) {
 }
 function detectGitRepo2() {
   try {
-    const remoteUrl = execSync4("git remote get-url origin", { encoding: "utf-8", timeout: 5e3 }).trim();
+    const remoteUrl = execSync5("git remote get-url origin", { encoding: "utf-8", timeout: 5e3 }).trim();
     const sshMatch = remoteUrl.match(/^git@[^:]+:(.+?)(?:\.git)?$/);
     const httpMatch = remoteUrl.match(/^https?:\/\/[^/]+\/(.+?)(?:\.git)?$/);
     const match = sshMatch || httpMatch;
@@ -4917,7 +4884,7 @@ var scanPr_exports = {};
 __export(scanPr_exports, {
   scanPrCommand: () => scanPrCommand
 });
-import { execSync as execSync5, spawn } from "child_process";
+import { execSync as execSync6, spawn } from "child_process";
 import { readFileSync as readFileSync8, existsSync as existsSync10 } from "fs";
 import { join as join9 } from "path";
 function parseMatchSpec(condition) {
@@ -5025,7 +4992,7 @@ function shouldSkipFile(filename) {
   return SKIP_FILE_PATTERNS.some((p) => p.test(filename));
 }
 function ghJson(args2) {
-  const out = execSync5(`gh ${args2.map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(" ")}`, {
+  const out = execSync6(`gh ${args2.map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(" ")}`, {
     encoding: "utf-8",
     maxBuffer: 16 * 1024 * 1024
   });
@@ -5323,7 +5290,7 @@ function postPrReview(repo, prNumber, sha, review, skipLineReview = false) {
 ${review.summary}
 
 ` + review.comments.map((c) => `**${c.path}:${c.line}** \u2014 ${c.body}`).join("\n\n");
-      execSync5(`gh api -X POST /repos/${repo}/issues/${prNumber}/comments --input -`, {
+      execSync6(`gh api -X POST /repos/${repo}/issues/${prNumber}/comments --input -`, {
         encoding: "utf-8",
         input: JSON.stringify({ body }),
         stdio: ["pipe", "ignore", "pipe"]
@@ -5348,7 +5315,7 @@ ${review.summary}`,
       comments: review.comments
     });
     try {
-      execSync5(`gh api -X POST /repos/${repo}/pulls/${prNumber}/reviews --input -`, {
+      execSync6(`gh api -X POST /repos/${repo}/pulls/${prNumber}/reviews --input -`, {
         encoding: "utf-8",
         input: body,
         stdio: ["pipe", "pipe", "pipe"]
@@ -5383,7 +5350,7 @@ function postCheckRun(repo, sha, conclusion, findings) {
     }
   });
   try {
-    execSync5(`gh api -X POST /repos/${repo}/check-runs --input -`, {
+    execSync6(`gh api -X POST /repos/${repo}/check-runs --input -`, {
       encoding: "utf-8",
       input: body,
       stdio: ["pipe", "ignore", "pipe"]
@@ -5409,7 +5376,7 @@ function readRepoDeps() {
 }
 function getFullFileContent(filename) {
   try {
-    return execSync5(`git show HEAD:${filename}`, { encoding: "utf-8", maxBuffer: 128 * 1024 });
+    return execSync6(`git show HEAD:${filename}`, { encoding: "utf-8", maxBuffer: 128 * 1024 });
   } catch {
     return null;
   }