@synkro-sh/cli 1.6.60 → 1.6.61

package/dist/bootstrap.js

@@ -1593,6 +1593,13 @@ export async function loadConfig(jwt: string, query?: string): Promise<HookConfi
 export async function route(config: HookConfig, synkroFile?: SynkroFileConfig): Promise<'local' | 'cloud'> {
   const gradingMode = synkroFile?.grader?.mode || process.env.SYNKRO_GRADING_MODE || config.gradingMode || 'local';
   if (gradingMode === 'byok') return 'cloud';
+  // Cloud-container deploy ([grader] location = cloud): grade via localGrade(),
+  // which routes to the hosted container (containers.synkro.sh) and emits the
+  // same rich systemMessage. Return 'local' so the hook takes that branch \u2014 NOT
+  // the legacy BYOK 'cloud' branch (which a non-BYOK org can't use, so it would
+  // silently produce no verdict / no system message). channelUp() is false in
+  // cloud (no local container), so without this it would wrongly fall to 'cloud'.
+  if (process.env.SYNKRO_DEPLOY_LOCATION === 'cloud') return 'local';
   if (config.captureDepth === 'local_only') return 'local';
   if (await channelUp()) return 'local';
   return 'cloud';
@@ -1601,6 +1608,10 @@ export async function route(config: HookConfig, synkroFile?: SynkroFileConfig):
 export async function cweRoute(config: HookConfig, synkroFile?: SynkroFileConfig): Promise<'local' | 'byok' | 'skip'> {
   const gradingMode = synkroFile?.grader?.mode || process.env.SYNKRO_GRADING_MODE || config.gradingMode || 'local';
   if (gradingMode === 'byok') return 'byok';
+  // Cloud-container: CWE scanning runs on the hosted container via localGradeCwe()
+  // (which honors SYNKRO_DEPLOY_LOCATION). Without this, cweChannelUp() is false in
+  // cloud and we'd fall to 'skip' \u2014 silently disabling CWE scanning in cloud mode.
+  if (process.env.SYNKRO_DEPLOY_LOCATION === 'cloud') return 'local';
   if (await cweChannelUp()) return 'local';
   return 'skip';
 }
@@ -5671,7 +5682,8 @@ async function main() {
     const isChannelUp = await channelUp();
     const synkroFile = loadSynkroFile(cwd);
     const gradingMode = synkroFile.grader.mode || process.env.SYNKRO_GRADING_MODE || 'local';
-    const rt = gradingMode === 'byok' ? 'cloud' : (isChannelUp ? 'local' : 'cloud');
+    const deployCloud = process.env.SYNKRO_DEPLOY_LOCATION === 'cloud';
+    const rt = gradingMode === 'byok' ? 'cloud' : (isChannelUp || deployCloud ? 'local' : 'cloud');
 
     let policyName = '';
     let silent = false;
@@ -5705,7 +5717,7 @@ async function main() {
 
     const fakeConfig: HookConfig = { captureDepth: 'local_only', tier: 'standard', silent, policyName, rules: [], scanExemptions: [], gradingMode, storageMode: process.env.SYNKRO_STORAGE_MODE || 'local' };
     const tagStr = tag(rt, fakeConfig);
-    const routeLine = tagStr + ' inference: ' + (gradingMode === 'byok' ? 'cloud (BYOK)' : isChannelUp ? 'local-cc (channel reachable on 127.0.0.1:18929)' : 'cloud (local-cc channel not reachable)');
+    const routeLine = tagStr + ' inference: ' + (gradingMode === 'byok' ? 'cloud (BYOK)' : deployCloud ? 'cloud container (containers.synkro.sh)' : isChannelUp ? 'local-cc (channel reachable on 127.0.0.1:18929)' : 'cloud (local-cc channel not reachable)');
 
     if (!jwt) {
       outputJson({ systemMessage: routeLine });
@@ -10305,7 +10317,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.60")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.61")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -10373,6 +10385,52 @@ async function provisionCloudContainer(opts) {
     setupToken = "";
   }
 }
+async function verifyCloudGrader(jwt2) {
+  const base = (process.env.SYNKRO_CONTAINERS_URL || "https://containers.synkro.sh").replace(/\/$/, "");
+  console.log("  Warming the cloud grader (booting container + checking workers)...");
+  const deadline = Date.now() + 18e4;
+  let healthy = 0;
+  while (Date.now() < deadline) {
+    try {
+      const r = await fetch(`${base}/diag`, { headers: { Authorization: `Bearer ${jwt2}` }, signal: AbortSignal.timeout(6e4) });
+      if (r.ok) {
+        const j = await r.json();
+        healthy = j.claude_code?.healthy ?? 0;
+        if (healthy >= 1) break;
+      }
+    } catch {
+    }
+    await new Promise((res) => setTimeout(res, 5e3));
+  }
+  if (healthy < 1) {
+    console.warn("  \u26A0 cloud grader did not report a healthy worker within ~3m.");
+    console.warn("    Grading is NOT verified \u2014 check the container or re-run `synkro install`.\n");
+    return false;
+  }
+  console.log(`  \u2713 ${healthy} Claude worker(s) healthy`);
+  try {
+    const probe = 'Grade this edit. File: t.py. Change: os.system(request.args["cmd"])';
+    const r = await fetch(`${base}/grade/submit`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${jwt2}`, "Content-Type": "application/json" },
+      body: JSON.stringify({ role: "grade-edit", payload: probe, content: probe, agent_kind: "claude_code" }),
+      signal: AbortSignal.timeout(12e4)
+    });
+    const body = await r.json().catch(() => ({}));
+    if (r.ok && typeof body.result === "string" && body.result.includes("<synkro-verdict>")) {
+      console.log("  \u2713 smoke grade passed \u2014 cloud grading is live\n");
+      return true;
+    }
+    console.warn(`  \u26A0 smoke grade did not return a verdict (HTTP ${r.status}).`);
+    console.warn("    The container is provisioned but grading is not healthy \u2014 likely the Claude");
+    console.warn("    setup-token. Re-run `synkro install` to re-authorize the hosted worker.\n");
+    return false;
+  } catch {
+    console.warn("  \u26A0 smoke grade timed out / connection dropped \u2014 grading is not responding.");
+    console.warn("    The container is provisioned but not grading; re-run `synkro install`.\n");
+    return false;
+  }
+}
 function readPersistedDeployLocation() {
   try {
     if (existsSync11(CONFIG_PATH2)) {
@@ -10483,6 +10541,7 @@ synkro.toml: deploy location changed ${current} \u2192 ${desired}
     await provisionCloudContainer({ gatewayUrl, jwt: token, orgId, userId, email, hasClaudeCode, hasCursor });
     updateConfigEnvLocation("cloud");
     await applyMcpConfig({ gatewayUrl, jwt: token, hasClaudeCode, hasCursor, local: false });
+    await verifyCloudGrader(token);
     console.log("  \u2713 grading + rules/MCP now served from Synkro Cloud\n");
   } else {
     updateConfigEnvLocation("local");
@@ -10996,6 +11055,7 @@ async function installCommand(opts = {}) {
     console.log();
   } else if (target === "cloud-container") {
     await provisionCloudContainer({ gatewayUrl, jwt: token, orgId, userId, email, hasClaudeCode, hasCursor });
+    await verifyCloudGrader(token);
   }
   if (transcriptConsent) {
     const repo = detectGitRepo2();
@@ -13753,7 +13813,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.60");
+  console.log("1.6.61");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents