@synkro-sh/cli 1.6.59 → 1.6.61

package/dist/bootstrap.js

@@ -1593,6 +1593,13 @@ export async function loadConfig(jwt: string, query?: string): Promise<HookConfi
 export async function route(config: HookConfig, synkroFile?: SynkroFileConfig): Promise<'local' | 'cloud'> {
   const gradingMode = synkroFile?.grader?.mode || process.env.SYNKRO_GRADING_MODE || config.gradingMode || 'local';
   if (gradingMode === 'byok') return 'cloud';
+  // Cloud-container deploy ([grader] location = cloud): grade via localGrade(),
+  // which routes to the hosted container (containers.synkro.sh) and emits the
+  // same rich systemMessage. Return 'local' so the hook takes that branch \u2014 NOT
+  // the legacy BYOK 'cloud' branch (which a non-BYOK org can't use, so it would
+  // silently produce no verdict / no system message). channelUp() is false in
+  // cloud (no local container), so without this it would wrongly fall to 'cloud'.
+  if (process.env.SYNKRO_DEPLOY_LOCATION === 'cloud') return 'local';
   if (config.captureDepth === 'local_only') return 'local';
   if (await channelUp()) return 'local';
   return 'cloud';
@@ -1601,6 +1608,10 @@ export async function route(config: HookConfig, synkroFile?: SynkroFileConfig):
 export async function cweRoute(config: HookConfig, synkroFile?: SynkroFileConfig): Promise<'local' | 'byok' | 'skip'> {
   const gradingMode = synkroFile?.grader?.mode || process.env.SYNKRO_GRADING_MODE || config.gradingMode || 'local';
   if (gradingMode === 'byok') return 'byok';
+  // Cloud-container: CWE scanning runs on the hosted container via localGradeCwe()
+  // (which honors SYNKRO_DEPLOY_LOCATION). Without this, cweChannelUp() is false in
+  // cloud and we'd fall to 'skip' \u2014 silently disabling CWE scanning in cloud mode.
+  if (process.env.SYNKRO_DEPLOY_LOCATION === 'cloud') return 'local';
   if (await cweChannelUp()) return 'local';
   return 'skip';
 }
@@ -5671,7 +5682,8 @@ async function main() {
     const isChannelUp = await channelUp();
     const synkroFile = loadSynkroFile(cwd);
     const gradingMode = synkroFile.grader.mode || process.env.SYNKRO_GRADING_MODE || 'local';
-    const rt = gradingMode === 'byok' ? 'cloud' : (isChannelUp ? 'local' : 'cloud');
+    const deployCloud = process.env.SYNKRO_DEPLOY_LOCATION === 'cloud';
+    const rt = gradingMode === 'byok' ? 'cloud' : (isChannelUp || deployCloud ? 'local' : 'cloud');
 
     let policyName = '';
     let silent = false;
@@ -5705,7 +5717,7 @@ async function main() {
 
     const fakeConfig: HookConfig = { captureDepth: 'local_only', tier: 'standard', silent, policyName, rules: [], scanExemptions: [], gradingMode, storageMode: process.env.SYNKRO_STORAGE_MODE || 'local' };
     const tagStr = tag(rt, fakeConfig);
-    const routeLine = tagStr + ' inference: ' + (gradingMode === 'byok' ? 'cloud (BYOK)' : isChannelUp ? 'local-cc (channel reachable on 127.0.0.1:18929)' : 'cloud (local-cc channel not reachable)');
+    const routeLine = tagStr + ' inference: ' + (gradingMode === 'byok' ? 'cloud (BYOK)' : deployCloud ? 'cloud container (containers.synkro.sh)' : isChannelUp ? 'local-cc (channel reachable on 127.0.0.1:18929)' : 'cloud (local-cc channel not reachable)');
 
     if (!jwt) {
       outputJson({ systemMessage: routeLine });
@@ -9977,6 +9989,7 @@ __export(install_exports, {
   detectGitRepo: () => detectGitRepo2,
   installCommand: () => installCommand,
   parseArgs: () => parseArgs,
+  reconcileDeployLocation: () => reconcileDeployLocation,
   reconcileHarness: () => reconcileHarness,
   syncSkillFiles: () => syncSkillFiles,
   writeHookScripts: () => writeHookScripts
@@ -10304,7 +10317,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.59")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.61")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -10372,6 +10385,171 @@ async function provisionCloudContainer(opts) {
     setupToken = "";
   }
 }
+async function verifyCloudGrader(jwt2) {
+  const base = (process.env.SYNKRO_CONTAINERS_URL || "https://containers.synkro.sh").replace(/\/$/, "");
+  console.log("  Warming the cloud grader (booting container + checking workers)...");
+  const deadline = Date.now() + 18e4;
+  let healthy = 0;
+  while (Date.now() < deadline) {
+    try {
+      const r = await fetch(`${base}/diag`, { headers: { Authorization: `Bearer ${jwt2}` }, signal: AbortSignal.timeout(6e4) });
+      if (r.ok) {
+        const j = await r.json();
+        healthy = j.claude_code?.healthy ?? 0;
+        if (healthy >= 1) break;
+      }
+    } catch {
+    }
+    await new Promise((res) => setTimeout(res, 5e3));
+  }
+  if (healthy < 1) {
+    console.warn("  \u26A0 cloud grader did not report a healthy worker within ~3m.");
+    console.warn("    Grading is NOT verified \u2014 check the container or re-run `synkro install`.\n");
+    return false;
+  }
+  console.log(`  \u2713 ${healthy} Claude worker(s) healthy`);
+  try {
+    const probe = 'Grade this edit. File: t.py. Change: os.system(request.args["cmd"])';
+    const r = await fetch(`${base}/grade/submit`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${jwt2}`, "Content-Type": "application/json" },
+      body: JSON.stringify({ role: "grade-edit", payload: probe, content: probe, agent_kind: "claude_code" }),
+      signal: AbortSignal.timeout(12e4)
+    });
+    const body = await r.json().catch(() => ({}));
+    if (r.ok && typeof body.result === "string" && body.result.includes("<synkro-verdict>")) {
+      console.log("  \u2713 smoke grade passed \u2014 cloud grading is live\n");
+      return true;
+    }
+    console.warn(`  \u26A0 smoke grade did not return a verdict (HTTP ${r.status}).`);
+    console.warn("    The container is provisioned but grading is not healthy \u2014 likely the Claude");
+    console.warn("    setup-token. Re-run `synkro install` to re-authorize the hosted worker.\n");
+    return false;
+  } catch {
+    console.warn("  \u26A0 smoke grade timed out / connection dropped \u2014 grading is not responding.");
+    console.warn("    The container is provisioned but not grading; re-run `synkro install`.\n");
+    return false;
+  }
+}
+function readPersistedDeployLocation() {
+  try {
+    if (existsSync11(CONFIG_PATH2)) {
+      const m = readFileSync10(CONFIG_PATH2, "utf-8").match(/^SYNKRO_DEPLOY_LOCATION='([^']*)'/m);
+      if (m?.[1] === "cloud") return "cloud";
+    }
+  } catch {
+  }
+  return "local";
+}
+function updateConfigEnvLocation(location) {
+  if (!existsSync11(CONFIG_PATH2)) return;
+  let env = readFileSync10(CONFIG_PATH2, "utf-8");
+  const set = (k, v) => {
+    const re = new RegExp(`^${k}=.*$`, "m");
+    const line = `${k}='${v}'`;
+    env = re.test(env) ? env.replace(re, line) : `${env.replace(/\n?$/, "\n")}${line}`;
+  };
+  set("SYNKRO_DEPLOY_LOCATION", location);
+  set("SYNKRO_STORAGE_MODE", location === "cloud" ? "cloud" : "local");
+  writeFileSync8(CONFIG_PATH2, env, "utf-8");
+  chmodSync2(CONFIG_PATH2, 384);
+}
+async function applyMcpConfig(opts) {
+  if (!opts.hasClaudeCode && !opts.hasCursor) return;
+  let mcpJwt = "";
+  try {
+    mcpJwt = readFileSync10(join10(SYNKRO_DIR5, ".mcp-jwt"), "utf-8").trim();
+  } catch {
+  }
+  if (!mcpJwt) {
+    try {
+      const r = await fetch(`${opts.gatewayUrl}/api/v1/cli/mcp-token`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${opts.jwt}`, "Content-Type": "application/json" },
+        body: "{}"
+      });
+      if (r.ok) mcpJwt = (await r.json()).token;
+      else console.warn(`  \u26A0 MCP token mint failed (${r.status}) \u2014 run \`synkro install\` to set MCP up.`);
+    } catch {
+      console.warn("  \u26A0 MCP token mint failed (network) \u2014 run `synkro install` to set MCP up.");
+    }
+  }
+  if (opts.hasClaudeCode) {
+    try {
+      const mcp = installMcpConfig({ gatewayUrl: opts.gatewayUrl, bearerToken: mcpJwt, local: opts.local });
+      console.log(`  \u2713 Claude Code MCP \u2192 ${mcp.url}`);
+    } catch (err) {
+      console.warn(`  \u26A0 Claude Code MCP config failed: ${err.message}`);
+    }
+  }
+  if (opts.hasCursor) {
+    try {
+      const mcp = installCursorMcpConfig({ gatewayUrl: opts.gatewayUrl, bearerToken: opts.local ? "" : mcpJwt, local: opts.local });
+      console.log(`  \u2713 Cursor MCP \u2192 ${mcp.url}`);
+    } catch (err) {
+      console.warn(`  \u26A0 Cursor MCP config failed: ${err.message}`);
+    }
+  }
+}
+async function reconcileDeployLocation() {
+  const sf = readFullSynkroFile();
+  const desired = sf?.grader.location === "cloud" ? "cloud" : "local";
+  const current = readPersistedDeployLocation();
+  if (desired === current) return desired;
+  const hasClaudeCode = sf ? sf.harness.includes("claude-code") : true;
+  const hasCursor = sf ? sf.harness.includes("cursor") : false;
+  console.log(`
+synkro.toml: deploy location changed ${current} \u2192 ${desired}
+`);
+  if (!isAuthenticated()) {
+    console.log("  Opening browser for Synkro auth...");
+    const ok = await authenticate(() => {
+    });
+    if (!ok) {
+      console.error("  \u2717 authentication failed");
+      process.exit(1);
+    }
+  }
+  await ensureValidToken();
+  const token = getAccessToken();
+  if (!token) {
+    console.error("  \u2717 no access token \u2014 run `synkro login`");
+    process.exit(1);
+  }
+  const gatewayUrl = sanitizeGatewayCandidate(process.env.SYNKRO_GATEWAY_URL) || "https://api.synkro.sh";
+  try {
+    assertGatewayAllowed(gatewayUrl);
+  } catch (err) {
+    console.error(err.message);
+    process.exit(1);
+  }
+  if (desired === "cloud") {
+    if (dockerStatus().running) {
+      console.log("  Stopping local grader container (snapshotting state first)...");
+      await dockerSafeStop();
+    }
+    dockerRemove();
+    console.log("  \u2713 local container stopped + removed");
+    let orgId, userId, email;
+    try {
+      const info = getUserInfo();
+      userId = info.id;
+      orgId = info.org_id;
+      email = info.email;
+    } catch {
+    }
+    await provisionCloudContainer({ gatewayUrl, jwt: token, orgId, userId, email, hasClaudeCode, hasCursor });
+    updateConfigEnvLocation("cloud");
+    await applyMcpConfig({ gatewayUrl, jwt: token, hasClaudeCode, hasCursor, local: false });
+    await verifyCloudGrader(token);
+    console.log("  \u2713 grading + rules/MCP now served from Synkro Cloud\n");
+  } else {
+    updateConfigEnvLocation("local");
+    await applyMcpConfig({ gatewayUrl, jwt: token, hasClaudeCode, hasCursor, local: true });
+    console.log("  \u2713 switched to local \u2014 bringing the local grader + MCP up\n");
+  }
+  return desired;
+}
 function resolveDeploymentMode() {
   const envOverride = process.env.SYNKRO_DEPLOYMENT_MODE?.toLowerCase();
   if (envOverride === "bare-host" || envOverride === "docker") return envOverride;
@@ -10877,6 +11055,7 @@ async function installCommand(opts = {}) {
     console.log();
   } else if (target === "cloud-container") {
     await provisionCloudContainer({ gatewayUrl, jwt: token, orgId, userId, email, hasClaudeCode, hasCursor });
+    await verifyCloudGrader(token);
   }
   if (transcriptConsent) {
     const repo = detectGitRepo2();
@@ -13420,6 +13599,11 @@ async function updateCommand() {
   console.log("\nSynkro updated \u2014 now running the latest version.");
 }
 async function restartCommand(rest = []) {
+  const location = await reconcileDeployLocation();
+  if (location === "cloud") {
+    console.log("Synkro: grading runs on Synkro Cloud \u2014 no local container to restart.");
+    return;
+  }
   assertDockerAvailable();
   const cfg = resolveWorkerConfig(rest);
   let claudeWorkers = cfg.claudeWorkers;
@@ -13629,7 +13813,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.59");
+  console.log("1.6.61");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents