@synkro-sh/cli 1.4.73 → 1.4.75

package/dist/bootstrap.js

@@ -536,21 +536,15 @@ function installMcpConfig(opts) {
     if (entry?.[SYNKRO_MARKER3] === true) delete config.mcpServers[name];
   }
   if (opts.local) {
-    const url2 = "http://127.0.0.1:8931/";
-    const tokenPath = join2(homedir3(), ".synkro", ".mcp-local-token");
-    let localToken = "";
-    try {
-      localToken = readFileSync3(tokenPath, "utf-8").trim();
-    } catch {
-    }
+    const proxyScript = join2(homedir3(), ".synkro", "hooks", "mcp-stdio-proxy.ts");
     config.mcpServers[SYNKRO_SERVER_NAME] = {
-      type: "http",
-      url: url2,
-      ...localToken ? { headers: { Authorization: `Bearer ${localToken}` } } : {},
+      type: "stdio",
+      command: "bun",
+      args: ["run", proxyScript],
       [SYNKRO_MARKER3]: true
     };
     writeClaudeJsonAtomic(config);
-    return { path: CC_CONFIG_PATH, url: url2 };
+    return { path: CC_CONFIG_PATH, url: `stdio://${proxyScript}` };
   }
   const url = `${opts.gatewayUrl.replace(/\/$/, "")}/api/v1/mcp/guardrails`;
   config.mcpServers[SYNKRO_SERVER_NAME] = {
@@ -612,15 +606,15 @@ function installCursorMcpConfig(opts) {
   }
   if (opts.local) {
     const url2 = "http://127.0.0.1:8931/";
-    const tokenPath = join2(homedir3(), ".synkro", ".mcp-local-token");
-    let localToken = "";
+    const jwtPath = join2(homedir3(), ".synkro", ".mcp-jwt");
+    let jwt2 = "";
     try {
-      localToken = readFileSync3(tokenPath, "utf-8").trim();
+      jwt2 = readFileSync3(jwtPath, "utf-8").trim();
     } catch {
     }
     config.mcpServers[SYNKRO_SERVER_NAME] = {
       url: url2,
-      ...localToken ? { headers: { Authorization: `Bearer ${localToken}` } } : {},
+      ...jwt2 ? { headers: { Authorization: `Bearer ${jwt2}` } } : {},
       [SYNKRO_MARKER3]: true
     };
     writeCursorMcpJsonAtomic(config);
@@ -6267,6 +6261,7 @@ function writeHookScripts() {
   const cursorBashJudgePath = join11(HOOKS_DIR, "cursor-bash-judge.ts");
   const cursorEditCapturePath = join11(HOOKS_DIR, "cursor-edit-capture.ts");
   const mcpLocalServerPath = join11(HOOKS_DIR, "mcp-local-server.ts");
+  const mcpStdioProxyPath = join11(HOOKS_DIR, "mcp-stdio-proxy.ts");
   writeFileSync7(bashScriptPath, BASH_JUDGE_TS, "utf-8");
   writeFileSync7(bashFollowupScriptPath, BASH_FOLLOWUP_TS, "utf-8");
   writeFileSync7(editPrecheckScriptPath, EDIT_PRECHECK_TS, "utf-8");
@@ -6292,30 +6287,17 @@ import { existsSync, readFileSync, writeFileSync, renameSync, appendFileSync, mk
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 
-import { randomBytes } from 'node:crypto';
-
 const PORT = parseInt(process.env.SYNKRO_MCP_PORT || '8931', 10);
 const HOME = homedir();
 const RULES_PATH = join(HOME, '.synkro', 'rules.json');
 const TELEMETRY_PATH = join(HOME, '.synkro', 'telemetry.jsonl');
-const TOKEN_PATH = join(HOME, '.synkro', '.mcp-local-token');
+const JWT_TOKEN_PATH = join(HOME, '.synkro', '.mcp-jwt');
 
-// File-based shared secret \u2014 generated once, required on all POST requests.
-function getOrCreateToken(): string {
-  try {
-    return readFileSync(TOKEN_PATH, 'utf-8').trim();
-  } catch {}
-  const token = randomBytes(32).toString('hex');
-  mkdirSync(join(HOME, '.synkro'), { recursive: true });
-  try {
-    writeFileSync(TOKEN_PATH, token + '\\n', { mode: 0o600, flag: 'wx' });
-    return token;
-  } catch {
-    return readFileSync(TOKEN_PATH, 'utf-8').trim();
-  }
-}
-
-const SERVER_TOKEN = getOrCreateToken();
+// Synkro-signed long-lived JWT \u2014 minted during \`synkro install\`, required on all POST requests.
+// If missing, the server still starts (for GET health checks) but rejects all tool calls.
+let SERVER_TOKEN = '';
+try { SERVER_TOKEN = readFileSync(JWT_TOKEN_PATH, 'utf-8').trim(); } catch {}
+if (!SERVER_TOKEN) console.warn('[synkro] \u26A0 No MCP JWT found \u2014 run \`synkro install\` to authenticate.');
 const MAX_BODY_BYTES = 1_048_576;
 
 let _writeLock: Promise<void> = Promise.resolve();
@@ -7370,6 +7352,7 @@ const server = Bun.serve({
 
 console.log(\`[synkro] local MCP guardrails server listening on http://127.0.0.1:\${server.port}\`);
 `, "utf-8");
+  writeFileSync7(mcpStdioProxyPath, MCP_STDIO_PROXY_SRC, "utf-8");
   chmodSync2(bashScriptPath, 493);
   chmodSync2(bashFollowupScriptPath, 493);
   chmodSync2(editPrecheckScriptPath, 493);
@@ -7386,6 +7369,7 @@ console.log(\`[synkro] local MCP guardrails server listening on http://127.0.0.1
   chmodSync2(cursorBashJudgePath, 493);
   chmodSync2(cursorEditCapturePath, 493);
   chmodSync2(mcpLocalServerPath, 493);
+  chmodSync2(mcpStdioProxyPath, 493);
   return {
     bashScript: bashScriptPath,
     bashFollowupScript: bashFollowupScriptPath,
@@ -7432,7 +7416,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.4.73")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.4.75")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -7915,7 +7899,20 @@ async function installCommand(opts = {}) {
   if (hasClaudeCode && !opts.noMcp) {
     if (useLocalMcp) {
       try {
-        const mcp = installMcpConfig({ gatewayUrl, bearerToken: "", local: true });
+        const mintResp = await fetch(`${gatewayUrl}/api/v1/cli/mcp-token`, {
+          method: "POST",
+          headers: { "Authorization": `Bearer ${token}`, "Content-Type": "application/json" },
+          body: "{}"
+        });
+        let mcpJwt = "";
+        if (mintResp.ok) {
+          const minted = await mintResp.json();
+          mcpJwt = minted.token;
+          writeFileSync7(join11(SYNKRO_DIR2, ".mcp-jwt"), mcpJwt + "\n", { mode: 384 });
+        } else {
+          console.warn("  \u26A0 Could not mint MCP token \u2014 local server will reject requests until re-installed.");
+        }
+        const mcp = installMcpConfig({ gatewayUrl, bearerToken: mcpJwt, local: true });
         console.log(`Registered local MCP guardrails server in ${mcp.path}`);
         console.log(`  url:        ${mcp.url}`);
         console.log("  (rules stored in ~/.synkro/rules.json)");
@@ -7942,6 +7939,7 @@ async function installCommand(opts = {}) {
           throw new Error(`mcp-token mint failed (${mintResp.status}): ${errText.slice(0, 200)}`);
         }
         const minted = await mintResp.json();
+        writeFileSync7(join11(SYNKRO_DIR2, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
         const mcp = installMcpConfig({ gatewayUrl, bearerToken: minted.token });
         console.log(`Registered Synkro guardrails MCP server in ${mcp.path}`);
         console.log(`  url:        ${mcp.url}`);
@@ -7958,6 +7956,18 @@ async function installCommand(opts = {}) {
   if (hasCursor && !opts.noMcp) {
     try {
       if (useLocalMcp) {
+        const jwtPath = join11(SYNKRO_DIR2, ".mcp-jwt");
+        if (!existsSync10(jwtPath)) {
+          const mintResp = await fetch(`${gatewayUrl}/api/v1/cli/mcp-token`, {
+            method: "POST",
+            headers: { "Authorization": `Bearer ${token}`, "Content-Type": "application/json" },
+            body: "{}"
+          });
+          if (mintResp.ok) {
+            const minted = await mintResp.json();
+            writeFileSync7(jwtPath, minted.token + "\n", { mode: 384 });
+          }
+        }
         const mcp = installCursorMcpConfig({ gatewayUrl, bearerToken: "", local: true });
         console.log(`Registered local MCP guardrails server in ${mcp.path}`);
         console.log(`  url:        ${mcp.url}`);
@@ -7975,6 +7985,7 @@ async function installCommand(opts = {}) {
           throw new Error(`mcp-token mint failed (${mintResp.status}): ${errText.slice(0, 200)}`);
         }
         const minted = await mintResp.json();
+        writeFileSync7(join11(SYNKRO_DIR2, ".mcp-jwt"), minted.token + "\n", { mode: 384 });
         const mcp = installCursorMcpConfig({ gatewayUrl, bearerToken: minted.token });
         console.log(`Registered Synkro guardrails MCP server in ${mcp.path}`);
         console.log(`  url:        ${mcp.url}`);
@@ -8314,7 +8325,7 @@ async function syncTranscriptsBulk(gatewayUrl, token, repo) {
   }
   return { sessions: totalSessions, messages: totalMessages };
 }
-var SYNKRO_DIR2, HOOKS_DIR, BIN_DIR, CONFIG_PATH3, OFFSETS_DIR, RULES_PATH, MCP_LOCAL_PORT;
+var SYNKRO_DIR2, HOOKS_DIR, BIN_DIR, CONFIG_PATH3, MCP_STDIO_PROXY_SRC, OFFSETS_DIR, RULES_PATH, MCP_LOCAL_PORT;
 var init_install2 = __esm({
   "cli/commands/install.ts"() {
     "use strict";
@@ -8337,6 +8348,52 @@ var init_install2 = __esm({
     HOOKS_DIR = join11(SYNKRO_DIR2, "hooks");
     BIN_DIR = join11(SYNKRO_DIR2, "bin");
     CONFIG_PATH3 = join11(SYNKRO_DIR2, "config.env");
+    MCP_STDIO_PROXY_SRC = `#!/usr/bin/env bun
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { createInterface } from 'node:readline';
+
+const HOME = homedir();
+const TOKEN_PATH = join(HOME, '.synkro', '.mcp-jwt');
+const PORT = parseInt(process.env.SYNKRO_MCP_PORT || '8931', 10);
+const URL = \`http://127.0.0.1:\${PORT}\`;
+
+let token = '';
+try { token = readFileSync(TOKEN_PATH, 'utf-8').trim(); } catch {}
+
+const rl = createInterface({ input: process.stdin, terminal: false });
+
+rl.on('line', async (line) => {
+  if (!line.trim()) return;
+  let msg;
+  try { msg = JSON.parse(line); } catch { return; }
+  if (!msg.id && msg.method?.startsWith('notifications/')) return;
+
+  try {
+    const resp = await fetch(URL, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Authorization': \`Bearer \${token}\`,
+      },
+      body: line,
+      signal: AbortSignal.timeout(30000),
+    });
+    if (resp.status === 204) return;
+    const body = await resp.text();
+    process.stdout.write(body + '\\n');
+  } catch (err) {
+    if (msg.id != null) {
+      process.stdout.write(JSON.stringify({
+        jsonrpc: '2.0',
+        id: msg.id,
+        error: { code: -32603, message: 'MCP proxy: HTTP server unreachable' },
+      }) + '\\n');
+    }
+  }
+});
+`;
     OFFSETS_DIR = join11(SYNKRO_DIR2, ".transcript-offsets");
     RULES_PATH = join11(SYNKRO_DIR2, "rules.json");
     MCP_LOCAL_PORT = 8931;