@synkro-sh/cli 1.6.56 → 1.6.57

package/dist/bootstrap.js

@@ -440,6 +440,7 @@ function installCursorHooks(hooksJsonPath, config) {
     timeout: 10,
     matcher: "Shell|Bash|terminal|run_terminal_cmd|execute_command|delete_file"
   });
+  pushCcHook(h, "beforeMCPExecution", config.mcpGateScriptPath, { timeout: 30 });
   h.afterAgentThought = h.afterAgentThought ?? [];
   h.afterAgentThought.push({
     command: bunRunCmd(config.agentCaptureScriptPath),
@@ -497,6 +498,7 @@ var init_cursorHookConfig = __esm({
       "preToolUse",
       "afterFileEdit",
       "postToolUse",
+      "beforeMCPExecution",
       "afterAgentThought",
       "afterAgentResponse"
     ];
@@ -7514,7 +7516,7 @@ async function runClaudeDesktopTap() {
   await new Promise((resolve4) => {
     const child = spawn("bash", [runnerPath], {
       stdio: "inherit",
-      env: { ...process.env, SYNKRO_CAPTURE_URL: CAPTURE_URL, SYNKRO_SCAN_URL: SCAN_URL, SYNKRO_TAP_TOKEN: token, SYNKRO_TAP_TOKEN_FILE: JWT_PATH }
+      env: { ...process.env, SYNKRO_CAPTURE_URL: CAPTURE_URL, SYNKRO_SCAN_URL: SCAN_URL, SYNKRO_SCAN_TURN_URL: SCAN_TURN_URL, SYNKRO_DLP_POLICY_URL: DLP_POLICY_URL, SYNKRO_TAP_TOKEN: token, SYNKRO_TAP_TOKEN_FILE: JWT_PATH }
     });
     const forward = (sig) => {
       try {
@@ -7531,12 +7533,14 @@ async function runClaudeDesktopTap() {
     });
   });
 }
-var CAPTURE_URL, SCAN_URL, JWT_PATH, ADDON_PY, MCP_PROXY_PY, MCP_PATCH_PY;
+var CAPTURE_URL, SCAN_URL, SCAN_TURN_URL, DLP_POLICY_URL, JWT_PATH, ADDON_PY, MCP_PROXY_PY, MCP_PATCH_PY;
 var init_claudeDesktopTap = __esm({
   "cli/installer/claudeDesktopTap.ts"() {
     "use strict";
     CAPTURE_URL = "http://127.0.0.1:18931/api/local/capture";
     SCAN_URL = "http://127.0.0.1:18931/api/local/scan-upload";
+    SCAN_TURN_URL = "http://127.0.0.1:18931/api/local/scan-turn";
+    DLP_POLICY_URL = "http://127.0.0.1:18931/api/local/dlp-policy";
     JWT_PATH = join5(homedir5(), ".synkro", ".mcp-jwt");
     ADDON_PY = `import os, json, threading, urllib.request, urllib.error, re, base64
 from mitmproxy import http
@@ -7544,6 +7548,8 @@ from mitmproxy import http
 CAPTURE_URL = os.environ.get("SYNKRO_CAPTURE_URL", "")
 TOKEN = os.environ.get("SYNKRO_TAP_TOKEN", "")
 SCAN_URL = os.environ.get("SYNKRO_SCAN_URL", "")
+SCAN_TURN_URL = os.environ.get("SYNKRO_SCAN_TURN_URL", "")
+POLICY_URL = os.environ.get("SYNKRO_DLP_POLICY_URL", "")
 # Token file path \u2014 the SERVER_TOKEN rotates whenever the container is recreated,
 # so we re-read it from disk on a 401 instead of needing a tap restart.
 TOKEN_FILE = os.environ.get("SYNKRO_TAP_TOKEN_FILE", "")
@@ -7609,6 +7615,122 @@ def _fmt_tool_name(raw):
         pass
     return raw
 
+# \u2500\u2500 M3 live-hold state \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+# Whether to HOLD connector turns (buffer the live completion until graded).
+# Fetched once from the server: True only when a BLOCK-mode rule exists (+ not
+# silent). Audit-only orgs get False \u2192 stream + async audit, ZERO added latency.
+_dlp_hold = None
+_dlp_lock = threading.Lock()
+# Shown live in place of a held connector turn while the single grader (the tree
+# GET) runs; replaced by the real content (if clean) or the block notice.
+REVIEWING_NOTICE = "\\U0001F6E1\\uFE0F  Synkro is reviewing this response for policy compliance\\u2026"
+
+def _should_hold():
+    global _dlp_hold
+    with _dlp_lock:
+        if _dlp_hold is not None:
+            return _dlp_hold
+    val = False
+    if POLICY_URL:
+        try:
+            with urllib.request.urlopen(urllib.request.Request(POLICY_URL), timeout=4) as resp:
+                val = bool(json.loads(resp.read().decode("utf-8", "replace")).get("hold"))
+        except Exception:
+            val = False
+    with _dlp_lock:
+        _dlp_hold = val
+    return val
+
+def _scan_turn_call(cid, msgs, connector):
+    # Synchronous DLP grade. Returns the block reason (str) on BLOCK, else None.
+    # Fail-OPEN \u2014 a scan error never blocks the turn.
+    if not (SCAN_TURN_URL and TOKEN): return None
+    try:
+        vb = _post_json(SCAN_TURN_URL, json.dumps({"conversation_id": str(cid)[:80], "messages": msgs, "connector": connector}).encode(), 18)
+        vd = json.loads((vb or b"{}").decode("utf-8", "replace"))
+        if vd.get("block"):
+            return str(vd.get("reason", "restricted data"))[:300]
+    except Exception as e:
+        print("[synkro] turn scan error (fail-open): " + str(e))
+    return None
+
+def _scan_sse_line(line, st):
+    # Extract governance metadata (usage window + web-search sources/citations)
+    # from one completion SSE line. Shared by the streaming + buffered paths.
+    if st["usage"] is None:
+        um = re.search(r'"5h":\\{"status":"([^"]*)","resets_at":(\\d+),"utilization":([0-9.]+)', line)
+        if um:
+            st["usage"] = {"window": "5h", "status": um.group(1), "resets_at": int(um.group(2)), "utilization": float(um.group(3))}
+    if len(st["sources"]) < 50:
+        for sm in re.finditer(r'"webpage_metadata","site_domain":"([^"]*)"(?:,"favicon_url":"[^"]*")?,"site_name":"([^"]*)"', line):
+            d = sm.group(1)
+            if d and d not in st["seen"] and len(st["sources"]) < 50:
+                st["seen"].add(d)
+                st["sources"].append({"domain": d, "name": sm.group(2)})
+    if "citation_start_delta" in line and line.startswith("data: ") and len(st["citations"]) < 50:
+        try:
+            cit = json.loads(line[6:]).get("delta", {}).get("citation", {})
+            url = cit.get("url", "")
+            if url and url not in st["cseen"]:
+                st["cseen"].add(url)
+                md = cit.get("metadata") or {}
+                st["citations"].append({"title": cit.get("title", ""), "url": url, "domain": md.get("site_domain", "")})
+        except Exception:
+            pass
+
+def _new_scan_state():
+    return {"carry": "", "usage": None, "sources": [], "seen": set(), "citations": [], "cseen": set()}
+
+def _extract_sse_text(body):
+    # Pull all visible text out of a buffered completion SSE (assistant text +
+    # tool_result content) for grading, and detect whether a tool/connector ran.
+    parts = []
+    tool = ("tool_use" in body) or ("tool_result" in body)
+    total = 0
+    for line in body.split("\\n"):
+        if total > 2000000: break
+        if not line.startswith("data: "): continue
+        try: obj = json.loads(line[6:])
+        except Exception: continue
+        d = obj.get("delta")
+        if isinstance(d, dict) and isinstance(d.get("text"), str):
+            parts.append(d["text"]); total += len(d["text"])
+        cb = obj.get("content_block")
+        if isinstance(cb, dict):
+            if isinstance(cb.get("text"), str): parts.append(cb["text"]); total += len(cb["text"])
+            c = cb.get("content")
+            if isinstance(c, str): parts.append(c); total += len(c)
+            elif isinstance(c, list):
+                for x in c:
+                    if isinstance(x, dict) and isinstance(x.get("text"), str): parts.append(x["text"]); total += len(x["text"])
+    return ("".join(parts)[:2000000], tool)
+
+def _neutralize_sse(body, notice):
+    # Rewrite a buffered completion SSE: blank every text/content field (inject the
+    # notice into the FIRST text delta), leaving all structural events intact so
+    # Claude Desktop still renders a valid \u2014 but content-free \u2014 turn.
+    out = []
+    injected = [False]
+    for line in body.split("\\n"):
+        if not line.startswith("data: "):
+            out.append(line); continue
+        try: obj = json.loads(line[6:])
+        except Exception:
+            out.append(line); continue
+        changed = False
+        d = obj.get("delta")
+        if isinstance(d, dict) and isinstance(d.get("text"), str):
+            d["text"] = (notice if not injected[0] else "")
+            injected[0] = True; changed = True
+        cb = obj.get("content_block")
+        if isinstance(cb, dict):
+            if isinstance(cb.get("text"), str) and cb["text"]:
+                cb["text"] = ""; changed = True
+            if cb.get("content"):
+                cb["content"] = ""; changed = True
+        out.append(("data: " + json.dumps(obj)) if changed else line)
+    return "\\n".join(out)
+
 class SynkroTap:
     def request(self, flow):
         # \u2500\u2500 Upload DLP gate \u2500\u2500 Scan file uploads BEFORE they reach claude.ai and
@@ -7662,10 +7784,10 @@ class SynkroTap:
             print("[synkro] upload scan error (fail-open): " + str(e))
             return
         if verdict.get("block"):
-            reason = str(verdict.get("reason", "Blocked by Synkro DLP policy"))[:300]
+            reason = str(verdict.get("reason", "Blocked by Synkro policy"))[:300]
             flow.response = http.Response.make(
                 403,
-                json.dumps({"error": {"type": "blocked_by_synkro_dlp", "message": "Blocked by Synkro DLP: " + reason}}).encode(),
+                json.dumps({"error": {"type": "blocked_by_synkro", "message": "Blocked by Synkro: " + reason}}).encode(),
                 {"Content-Type": "application/json"},
             )
             print("[synkro] BLOCKED upload (size=" + str(payload.get("size", 0)) + " rule=" + str(verdict.get("ruleId", "")) + ")")
@@ -7685,34 +7807,19 @@ class SynkroTap:
             if r.method == "POST" and "completion" in r.path:
                 cm = re.search(r"chat_conversations/([0-9a-fA-F-]+)", r.path)
                 cid = cm.group(1) if cm else ""
-                # Incremental parse: scan complete SSE lines for the small governance
-                # signals AS THEY STREAM and keep only the extracted results \u2014 never
-                # buffer the body. The carry holds at most one partial line (bounded),
-                # so there's NO cap on total stream length and no source is dropped.
-                st = {"carry": "", "usage": None, "sources": [], "seen": set(), "citations": [], "cseen": set()}
-                def _scan(line, _st=st):
-                    if _st["usage"] is None:
-                        um = re.search(r'"5h":\\{"status":"([^"]*)","resets_at":(\\d+),"utilization":([0-9.]+)', line)
-                        if um:
-                            _st["usage"] = {"window": "5h", "status": um.group(1), "resets_at": int(um.group(2)), "utilization": float(um.group(3))}
-                    if len(_st["sources"]) < 50:
-                        for sm in re.finditer(r'"webpage_metadata","site_domain":"([^"]*)"(?:,"favicon_url":"[^"]*")?,"site_name":"([^"]*)"', line):
-                            d = sm.group(1)
-                            if d and d not in _st["seen"] and len(_st["sources"]) < 50:
-                                _st["seen"].add(d)
-                                _st["sources"].append({"domain": d, "name": sm.group(2)})
-                    # Citations: the specific pages the model cited (title + url +
-                    # domain) \u2014 the real "tool result" for web search.
-                    if "citation_start_delta" in line and line.startswith("data: ") and len(_st["citations"]) < 50:
-                        try:
-                            cit = json.loads(line[6:]).get("delta", {}).get("citation", {})
-                            url = cit.get("url", "")
-                            if url and url not in _st["cseen"]:
-                                _st["cseen"].add(url)
-                                md = cit.get("metadata") or {}
-                                _st["citations"].append({"title": cit.get("title", ""), "url": url, "domain": md.get("site_domain", "")})
-                        except Exception:
-                            pass
+                with _mcp_lock:
+                    has_servers = len(_mcp_registry) > 0
+                # M3 LIVE HOLD: only when a BLOCK-mode rule exists AND connectors are
+                # connected, BUFFER the whole completion (leave .stream unset) so
+                # response() can grade it and neutralize restricted content BEFORE the
+                # user sees a single token. Audit-only / no-connector turns skip this
+                # entirely and stream as before \u2014 zero added latency.
+                if has_servers and _should_hold():
+                    flow.metadata["synkro_hold_cid"] = cid
+                    return
+                # Streaming path (unchanged behaviour): tap chunk-by-chunk, extract
+                # governance metadata only, never buffer the body. Audit stays async.
+                st = _new_scan_state()
                 def _tap(data, _st=st, _cid=cid):
                     if data:
                         try:
@@ -7722,9 +7829,9 @@ class SynkroTap:
                         lines = txt.split("\\n")
                         _st["carry"] = lines[-1][-200000:]  # bound the carried partial line (CWE-400)
                         for ln in lines[:-1]:
-                            _scan(ln)
+                            _scan_sse_line(ln, _st)
                     else:  # end of stream \u2014 flush carry + publish
-                        _scan(_st["carry"])
+                        _scan_sse_line(_st["carry"], _st)
                         if (_st["usage"] or _st["sources"] or _st["citations"]) and _cid:
                             with _sse_lock:
                                 _sse_meta[_cid] = {"usage": _st["usage"], "sources": _st["sources"], "citations": _st["citations"]}
@@ -7738,6 +7845,36 @@ class SynkroTap:
     def response(self, flow):
         r = flow.request
         if "claude.ai" not in (r.pretty_host or ""): return
+        # \u2500\u2500 M3: a HELD completion (buffered for inline grading) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+        # We have the full SSE body now. Re-derive governance metadata (same as the
+        # streaming path), then \u2014 if the turn used a tool/connector \u2014 grade it
+        # SYNCHRONOUSLY and, on a block, NEUTRALIZE the response so the user never
+        # sees the restricted content. Verdict is cached for the tree GET to reuse.
+        hold_cid = (flow.metadata.get("synkro_hold_cid") if hasattr(flow, "metadata") else None)
+        if hold_cid is not None and "completion" in r.path and flow.response:
+            try:
+                body = flow.response.get_text() or ""
+            except Exception:
+                body = ""
+            st = _new_scan_state()
+            for ln in body.split("\\n"):
+                _scan_sse_line(ln, st)
+            if (st["usage"] or st["sources"] or st["citations"]) and hold_cid:
+                with _sse_lock:
+                    _sse_meta[hold_cid] = {"usage": st["usage"], "sources": st["sources"], "citations": st["citations"]}
+            text, has_tool = _extract_sse_text(body)
+            if has_tool:
+                # The turn used a connector \u2014 HOLD the live view: replace the streamed
+                # content with a "reviewing" placeholder so the user never sees the raw
+                # response. The tree GET is the SINGLE grader and renders the final
+                # state (real content if clean, block notice if restricted) \u2014 so there
+                # is exactly one full-document grade per turn (no double-grade race).
+                try:
+                    flow.response.text = _neutralize_sse(body, REVIEWING_NOTICE)
+                    print("[synkro] HELD completion -> reviewing placeholder")
+                except Exception as e:
+                    print("[synkro] hold placeholder failed (fail-open): " + str(e))
+            return
         # MCP server registry from the bootstrap SSE stream.
         if "mcp" in r.path and "bootstrap" in r.path and flow.response:
             try:
@@ -7854,6 +7991,35 @@ class SynkroTap:
             ntools += len(mm.get("tool_calls") or [])
         nsrc = len((sm or {}).get("sources") or [])
         print("[synkro] captured chat (msgs=" + str(len(messages)) + " tools=" + str(ntools) + " sources=" + str(nsrc) + " model=" + model + ")")
+
+        # \u2500\u2500 Tier-2 connector DLP gate \u2500\u2500 If this turn pulled content via an MCP
+        # connector, scan it SYNCHRONOUSLY against blocking org rules. On a block
+        # verdict we HOLD this tree GET (the authoritative render) until the verdict
+        # and then SCRUB the turn from the tree the renderer sees \u2014 the employee
+        # never sees the restricted content. The REAL content is still captured
+        # below for audit (record-everything-even-when-blocked). Fail-OPEN.
+        blocked_reason = None
+        has_connector = any(m.get("role") == "tool" and m.get("content") for m in messages)
+        # SINGLE grader: the held completion only shows a "reviewing" placeholder, so
+        # the tree GET is the one and only place a turn is graded \u2014 exactly one
+        # full-document grade per turn (no double-grade). Gated on a BLOCK-mode rule
+        # existing; audit-only orgs (_should_hold False) skip this and stay async.
+        if _should_hold() and SCAN_TURN_URL and TOKEN and has_connector:
+            # CWE-20/CWE-400: bounded, shape-validated payload (<=200 msgs, <=2MB).
+            scan_msgs = []
+            budget = 2000000
+            for m in messages[:200]:
+                if budget <= 0: break
+                c = str(m.get("content", ""))[:min(500000, budget)]
+                budget -= len(c)
+                scan_msgs.append({"role": str(m.get("role", "user"))[:20], "content": c, "name": str(m.get("name", ""))[:200]})
+            connector = ""
+            for m in scan_msgs:
+                if m["role"] == "tool" and m["name"]:
+                    nm = m["name"]; connector = (nm.split(":")[0] if ":" in nm else nm); break
+            blocked_reason = _scan_turn_call(convo_id, scan_msgs, connector)
+
+        # Capture the REAL content for audit regardless of the block decision.
         def send(_d=data):
             try:
                 _post_json(CAPTURE_URL, json.dumps(_d).encode(), 5)
@@ -7861,6 +8027,20 @@ class SynkroTap:
                 print("[synkro] capture error: " + str(e))
         threading.Thread(target=send, daemon=True).start()
 
+        # Block the rendered view: replace this turn's assistant message content in
+        # the tree (everything after the last human turn) with a Synkro notice, so
+        # the restricted content + any model output derived from it is never shown.
+        if blocked_reason is not None:
+            notice = "[Blocked by Synkro] " + blocked_reason
+            for i in range(last_human + 1, len(all_msgs)):
+                if all_msgs[i].get("sender") != "human":
+                    all_msgs[i]["content"] = [{"type": "text", "text": notice}]
+            try:
+                flow.response.text = json.dumps(convo)
+                print("[synkro] BLOCKED turn view (reason=" + blocked_reason[:80] + ")")
+            except Exception as e:
+                print("[synkro] block scrub failed (fail-open): " + str(e))
+
 addons = [SynkroTap()]
 `;
     MCP_PROXY_PY = `#!/usr/bin/env python3
@@ -9515,7 +9695,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.56")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.57")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -9814,7 +9994,8 @@ async function installCommand(opts = {}) {
         sessionStartScriptPath: scripts.sessionStartScript,
         userPromptSubmitScriptPath: scripts.userPromptSubmitScript,
         transcriptSyncScriptPath: scripts.transcriptSyncScript,
-        installScanScriptPath: scripts.installScanScript
+        installScanScriptPath: scripts.installScanScript,
+        mcpGateScriptPath: scripts.mcpGateScript
       });
       console.log(`Configured ${agent.name} hooks at ${agent.settingsPath}`);
     }
@@ -10298,7 +10479,8 @@ function reconcileHarness() {
       sessionStartScriptPath: scripts.sessionStartScript,
       userPromptSubmitScriptPath: scripts.userPromptSubmitScript,
       transcriptSyncScriptPath: scripts.transcriptSyncScript,
-      installScanScriptPath: scripts.installScanScript
+      installScanScriptPath: scripts.installScanScript,
+      mcpGateScriptPath: scripts.mcpGateScript
     });
     console.log("  \u2713 Cursor hooks registered");
     try {
@@ -12771,7 +12953,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.56");
+  console.log("1.6.57");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents