@synkro-sh/cli 1.4.39 → 1.4.41

package/dist/bootstrap.js

@@ -520,11 +520,13 @@ synkro_load_config() {
   SYNKRO_RULES=$(echo "$resp" | jq -c '[.rules[]? | select(.hook_stage == "pre" or .hook_stage == "both" or .hook_stage == null) | {rule_id,text,severity,category,mode}]' 2>/dev/null || echo "[]")
 }
 
-# Build the tag prefix for system messages: [synkro] or [synkro:PolicyName] or [synkro:silent]
+# Build the tag prefix: [synkro:route:ruleset] or [synkro:silent]
+# Accepts optional $1 = route override; otherwise calls synkro_route().
 synkro_tag() {
   if [ "$SYNKRO_SILENT" = "true" ]; then echo "[synkro:silent]"; return; fi
-  if [ -n "\${SYNKRO_POLICY_NAME:-}" ]; then echo "[synkro:\${SYNKRO_POLICY_NAME}]"; return; fi
-  echo "[synkro]"
+  local route="\${1:-$(synkro_route)}"
+  local rs="\${SYNKRO_POLICY_NAME:-all}"
+  echo "[synkro:\${route}:\${rs}]"
 }
 
 # Decide routing: "local" (grade on device) or "cloud" (POST to server)
@@ -750,20 +752,19 @@ IS_HEADLESS="\${SYNKRO_HEADLESS:-0}"
 case "$PERMISSION_MODE" in acceptEdits|bypassPermissions|plan|auto) IS_HEADLESS="1" ;; esac
 
 synkro_load_config
-TAG=$(synkro_tag)
+ROUTE=$(synkro_route)
+TAG=$(synkro_tag "$ROUTE")
 
 if [ "$SYNKRO_SILENT" = "true" ]; then
   jq -n --arg m "$TAG bashGuard \u2192 skipped (silent mode)" '{systemMessage: $m}'
   exit 0
 fi
 
-ROUTE=$(synkro_route)
-
 if [ "$ROUTE" = "local" ]; then
   # \u2500\u2500\u2500 Local grading (local_only privacy or local-cc channel) \u2500\u2500\u2500
   GRADER_FILE=$(mktemp -t synkro-bash.XXXXXX)
   trap "rm -f \\"$GRADER_FILE\\"" EXIT
-  printf 'Working directory: %s\\nRepo: %s\\nCommand: %s\\nUser intent: %s\\nOrg rules: %s\\n' "\${CWD:-.}" "\${GIT_REPO:-unknown}" "$COMMAND" "\${USER_INTENT:-none stated}" "\${SYNKRO_RULES:-[]}" > "$GRADER_FILE"
+  printf 'Working directory: %s\\nRepo: %s\\nCommand: %s\\nUser intent (last human message): %s\\nOrg rules: %s\\n' "\${CWD:-.}" "\${GIT_REPO:-unknown}" "$COMMAND" "\${USER_INTENT:-none stated}" "\${SYNKRO_RULES:-[]}" > "$GRADER_FILE"
 
   CC_RESP=$(synkro_local_grade bash < "$GRADER_FILE" 2>&1)
   if [ $? -ne 0 ]; then
@@ -784,10 +785,9 @@ if [ "$ROUTE" = "local" ]; then
       synkro_dispatch_capture "bash" "warning" "\${LOCAL_SEV}" "\${LOCAL_CAT}" "$TOOL_NAME" "$GIT_REPO" "$SESSION_ID" \\
         "$COMMAND" "$LOCAL_REASON" "\${SYNKRO_RULES:-[]}" "$VIOLATED_JSON" "\${RECENT_USER_MESSAGES:-[]}"
     else
-      if [ "$IS_HEADLESS" = "1" ]; then DEC="deny"; else DEC="ask"; fi
-      REASON="$TAG bashGuard \u2192 block\${LOCAL_RULE_ID:+ ($LOCAL_RULE_ID)}: \${LOCAL_REASON:-policy violation}"
-      jq -n --arg dec "$DEC" --arg reason "$REASON" --arg ctx "$REASON" \\
-        '{systemMessage:$reason,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:$dec,permissionDecisionReason:$reason,additionalContext:$ctx}}'
+      REASON="$TAG bashGuard \u2192 blocked\${LOCAL_RULE_ID:+ ($LOCAL_RULE_ID)}: \${LOCAL_REASON:-policy violation}. Ask the user for explicit consent before retrying."
+      jq -n --arg reason "$REASON" \\
+        '{systemMessage:$reason,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:$reason,additionalContext:$reason}}'
       synkro_dispatch_capture "bash" "block" "\${LOCAL_SEV}" "\${LOCAL_CAT}" "$TOOL_NAME" "$GIT_REPO" "$SESSION_ID" \\
         "$COMMAND" "$LOCAL_REASON" "\${SYNKRO_RULES:-[]}" "$VIOLATED_JSON" "\${RECENT_USER_MESSAGES:-[]}"
     fi
@@ -947,20 +947,19 @@ if [ -n "$TRANSCRIPT_PATH" ] && [ -f "$TRANSCRIPT_PATH" ]; then
 fi
 
 synkro_load_config
-TAG=$(synkro_tag)
+ROUTE=$(synkro_route)
+TAG=$(synkro_tag "$ROUTE")
 
 if [ "$SYNKRO_SILENT" = "true" ]; then
   jq -n --arg m "$TAG editGuard \u2192 skipped (silent mode)" '{systemMessage: $m}'
   exit 0
 fi
 
-ROUTE=$(synkro_route)
-
 if [ "$ROUTE" = "local" ]; then
   # \u2500\u2500\u2500 Local grading (local_only privacy or local-cc channel) \u2500\u2500\u2500
   GRADER_FILE=$(mktemp -t synkro-edit.XXXXXX)
   trap "rm -f \\"$GRADER_FILE\\"" EXIT
-  printf 'Working directory: %s\\nRepo: %s\\nFile: %s\\nProposed content (first 4000 chars):\\n%s\\nUser intent: %s\\nOrg rules: %s\\n' "\${CWD:-.}" "\${GIT_REPO:-unknown}" "$FILE_PATH" "$(printf '%s' "$PROPOSED" | head -c 4000)" "\${USER_INTENT:-none stated}" "\${SYNKRO_RULES:-[]}" > "$GRADER_FILE"
+  printf 'Working directory: %s\\nRepo: %s\\nFile: %s\\nProposed content (first 4000 chars):\\n%s\\nUser intent (last human message): %s\\nOrg rules: %s\\n' "\${CWD:-.}" "\${GIT_REPO:-unknown}" "$FILE_PATH" "$(printf '%s' "$PROPOSED" | head -c 4000)" "\${USER_INTENT:-none stated}" "\${SYNKRO_RULES:-[]}" > "$GRADER_FILE"
 
   CC_RESP=$(synkro_local_grade edit < "$GRADER_FILE" 2>&1)
   if [ $? -ne 0 ]; then
@@ -982,10 +981,9 @@ if [ "$ROUTE" = "local" ]; then
       synkro_dispatch_capture "edit" "warning" "\${LOCAL_SEV}" "\${LOCAL_CAT}" "$TOOL_NAME" "$GIT_REPO" "$SESSION_ID" \\
         "$EDIT_CONTENT" "$LOCAL_REASON" "\${SYNKRO_RULES:-[]}" "$VIOLATED_JSON" "[]"
     else
-      if [ "$IS_HEADLESS" = "1" ]; then DEC="deny"; else DEC="ask"; fi
-      REASON="$TAG editGuard $FILE_SHORT \u2192 block\${LOCAL_RULE_ID:+ ($LOCAL_RULE_ID)}: \${LOCAL_REASON:-policy violation}"
-      jq -n --arg dec "$DEC" --arg reason "$REASON" --arg ctx "$REASON" \\
-        '{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:$dec,permissionDecisionReason:$reason,additionalContext:$ctx}}'
+      REASON="$TAG editGuard $FILE_SHORT \u2192 blocked\${LOCAL_RULE_ID:+ ($LOCAL_RULE_ID)}: \${LOCAL_REASON:-policy violation}. Ask the user for explicit consent before retrying."
+      jq -n --arg reason "$REASON" \\
+        '{systemMessage:$reason,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:$reason,additionalContext:$reason}}'
       synkro_dispatch_capture "edit" "block" "\${LOCAL_SEV}" "\${LOCAL_CAT}" "$TOOL_NAME" "$GIT_REPO" "$SESSION_ID" \\
         "$EDIT_CONTENT" "$LOCAL_REASON" "\${SYNKRO_RULES:-[]}" "$VIOLATED_JSON" "[]"
     fi
@@ -1115,14 +1113,13 @@ while [ "$_PKG_DIR" != "/" ]; do
 done
 
 synkro_load_config
-TAG=$(synkro_tag)
+ROUTE=$(synkro_route)
+TAG=$(synkro_tag "$ROUTE")
 
 if [ "$SYNKRO_SILENT" = "true" ]; then
   echo '{}'; exit 0
 fi
 
-ROUTE=$(synkro_route)
-
 if [ "$ROUTE" = "local" ]; then
   # \u2500\u2500\u2500 Local edit scan (local_only privacy or local-cc channel) \u2500\u2500\u2500
   GRADER_FILE=$(mktemp -t synkro-escan.XXXXXX)
@@ -1227,15 +1224,14 @@ PLAN_SHORT=$(printf '%s' "$PLAN" | head -c 80)
 synkro_log "planReview checking: $PLAN_SHORT..."
 
 synkro_load_config
-TAG=$(synkro_tag)
+ROUTE=$(synkro_route)
+TAG=$(synkro_tag "$ROUTE")
 
 if [ "$SYNKRO_SILENT" = "true" ]; then
   jq -n --arg m "$TAG planReview \u2192 skipped (silent mode)" '{systemMessage: $m}'
   exit 0
 fi
 
-ROUTE=$(synkro_route)
-
 if [ "$ROUTE" = "local" ]; then
   GRADER_FILE=$(mktemp -t synkro-plan.XXXXXX)
   trap "rm -f \\"$GRADER_FILE\\"" EXIT
@@ -1404,12 +1400,12 @@ if [ -n "$JWT" ]; then
   fi
 fi
 
-TAG=$(synkro_tag)
-
 if (exec 3<>/dev/tcp/127.0.0.1/"$SYNKRO_PORT") 2>/dev/null; then
   exec 3<&- 3>&- 2>/dev/null || true
+  TAG=$(synkro_tag "local")
   ROUTE_LINE="$TAG inference: local-cc (channel reachable on 127.0.0.1:$SYNKRO_PORT)"
 else
+  TAG=$(synkro_tag "cloud")
   ROUTE_LINE="$TAG inference: cloud (local-cc channel not reachable)"
 fi
 
@@ -1604,7 +1600,9 @@ CMD_SHORT=$(printf '%s' "$COMMAND" | head -c 80)
 synkro_log "bashGuard checking: $CMD_SHORT"
 
 synkro_load_config
-if [ "$SYNKRO_SILENT" = "true" ]; then echo '{}'; exit 0; fi
+if [ "$SYNKRO_SILENT" = "true" ]; then
+  echo '{}'; exit 0
+fi
 
 BODY=$(jq -n \\
   --arg cmd "$COMMAND" \\
@@ -1660,7 +1658,9 @@ BASENAME=$(basename "$FILE_PATH" 2>/dev/null || echo "$FILE_PATH")
 synkro_log "editGuard checking: $BASENAME"
 
 synkro_load_config
-if [ "$SYNKRO_SILENT" = "true" ]; then echo '{}'; exit 0; fi
+if [ "$SYNKRO_SILENT" = "true" ]; then
+  echo '{}'; exit 0
+fi
 
 BODY=$(jq -n \\
   --arg file_path "$FILE_PATH" \\
@@ -3987,7 +3987,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.4.39")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.4.41")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);