@synkro-sh/cli 1.6.70 → 1.6.72

package/dist/bootstrap.js

@@ -9687,11 +9687,12 @@ function captureClaudeSetupToken() {
         reject(new Error(`claude setup-token exited with code ${code}`));
         return;
       }
+      const stripToToken = (s) => s.replace(/\x1B\[[0-9;?]*[a-zA-Z]/g, "").replace(/\x1B\][^\x07]*\x07/g, "").replace(/[\s\x00-\x1F\x7F]/g, "");
       const yellowRe = /\x1B\[38;2;255;193;7m([^\x1B]*)/g;
       let yellow = "";
       let m;
       while ((m = yellowRe.exec(raw)) !== null) yellow += m[1];
-      const yMatch = yellow.replace(/\s/g, "").match(/sk-ant-oat01-[A-Za-z0-9_-]+/);
+      const yToken = stripToToken(yellow);
       let lineMatch = "";
       const clean = raw.replace(/\x1B\[[0-9;?]*[a-zA-Z]/g, "").replace(/\x1B\][^\x07]*\x07/g, "");
       const lines = clean.split("\n").map((l) => l.trim());
@@ -9703,13 +9704,13 @@ function captureClaudeSetupToken() {
         lineMatch = tok;
         break;
       }
-      const candidates = [yMatch ? yMatch[0] : "", lineMatch].filter((t) => /^sk-ant-oat01-[A-Za-z0-9_-]{20,}$/.test(t));
-      const best = candidates.sort((a, b) => b.length - a.length)[0];
-      if (!best) {
-        reject(new Error(`Could not find token in claude setup-token output (file=${raw.length}b, yellow=${yellow.length}b)`));
+      const valid = (t) => /^sk-ant-oat01-[A-Za-z0-9_-]{40,}$/.test(t);
+      const token = valid(yToken) ? yToken : valid(lineMatch) ? lineMatch : "";
+      if (!token) {
+        reject(new Error(`Could not capture a full token from claude setup-token output (file=${raw.length}b, yellow=${yellow.length}b, yToken=${yToken.length}b)`));
         return;
       }
-      resolve4(best);
+      resolve4(token);
     });
   });
 }
@@ -10053,6 +10054,7 @@ var init_setupGithub = __esm({
 var install_exports = {};
 __export(install_exports, {
   detectGitRepo: () => detectGitRepo2,
+  getOrMintCloudToken: () => getOrMintCloudToken,
   installCommand: () => installCommand,
   parseArgs: () => parseArgs,
   reconcileDeployLocation: () => reconcileDeployLocation,
@@ -10384,7 +10386,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.70")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.72")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -10404,6 +10406,38 @@ function writeConfigEnv(opts) {
   writeFileSync8(CONFIG_PATH2, lines.join("\n"), "utf-8");
   chmodSync2(CONFIG_PATH2, 384);
 }
+function jwtExpired(token) {
+  try {
+    const p = JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString("utf-8"));
+    if (!p?.exp) return true;
+    return Date.now() > p.exp * 1e3 - 5 * 60 * 1e3;
+  } catch {
+    return true;
+  }
+}
+async function getOrMintCloudToken(gatewayUrl) {
+  assertGatewayAllowed(gatewayUrl);
+  let stored = "";
+  try {
+    stored = readFileSync10(CLOUD_JWT_PATH, "utf-8").trim();
+  } catch {
+  }
+  if (stored && !jwtExpired(stored)) return stored;
+  await refreshToken().catch(() => false);
+  const jwt2 = getAccessToken();
+  if (!jwt2) throw new Error("Not authenticated \u2014 run `synkro login`");
+  const resp = await fetch(`${gatewayUrl}/api/v1/cli/cloud-token`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${jwt2}`, "Content-Type": "application/json" }
+  });
+  if (!resp.ok) {
+    const t = await resp.text().catch(() => "");
+    throw new Error(`cloud-token mint failed (${resp.status}): ${t.slice(0, 200)}`);
+  }
+  const { token } = await resp.json();
+  writeFileSync8(CLOUD_JWT_PATH, token + "\n", { mode: 384 });
+  return token;
+}
 async function provisionCloudContainer(opts) {
   let setupToken;
   try {
@@ -10430,10 +10464,16 @@ async function provisionCloudContainer(opts) {
     } catch {
     }
   }
+  let cloudJwt = opts.jwt;
+  try {
+    cloudJwt = await getOrMintCloudToken(opts.gatewayUrl);
+  } catch (e) {
+    console.warn(`  (cloud token unavailable, using session token: ${e.message})`);
+  }
   try {
     const resp = await fetch(`${opts.gatewayUrl}/api/v1/cli/cloud-provision`, {
       method: "POST",
-      headers: { "Authorization": `Bearer ${opts.jwt}`, "Content-Type": "application/json" },
+      headers: { "Authorization": `Bearer ${cloudJwt}`, "Content-Type": "application/json" },
       body: JSON.stringify({
         org_id: opts.orgId,
         user_id: opts.userId,
@@ -10520,6 +10560,16 @@ async function verifyCloudGrader(jwt2) {
     return false;
   }
   console.log(`  \u2713 ${healthy} Claude worker(s) healthy`);
+  console.log("  Running smoke grade (a worker scores a known-risky edit; up to 120s)...");
+  const started = Date.now();
+  const ticker = setInterval(() => {
+    const secs = Math.round((Date.now() - started) / 1e3);
+    process.stdout.write(`\r    \u2026grading (${secs}s elapsed)   `);
+  }, 1e3);
+  const stopTicker = () => {
+    clearInterval(ticker);
+    process.stdout.write("\r\x1B[2K");
+  };
   try {
     const probe = 'Grade this edit. File: t.py. Change: os.system(request.args["cmd"])';
     const r = await fetch(`${base}/grade/submit`, {
@@ -10528,6 +10578,7 @@ async function verifyCloudGrader(jwt2) {
       body: JSON.stringify({ role: "grade-edit", payload: probe, content: probe, agent_kind: "claude_code" }),
       signal: AbortSignal.timeout(12e4)
     });
+    stopTicker();
     const raw = await r.text();
     let body = {};
     try {
@@ -10551,6 +10602,7 @@ async function verifyCloudGrader(jwt2) {
     await printWorkerDebug(base, jwt2);
     return false;
   } catch (e) {
+    stopTicker();
     const reason = e?.name === "TimeoutError" ? "the grade never returned within 120s (worker hung \u2014 usually claude auth)" : `the request failed (${e?.message || "network"})`;
     console.warn(`  \u2717 smoke grade FAILED: ${reason}.`);
     console.warn("    The container is provisioned but a grade does not complete; re-run `synkro install` \u2192 cloud.\n");
@@ -11871,7 +11923,7 @@ async function syncTranscriptsBulk(gatewayUrl, token, repo) {
   }
   return { sessions: totalSessions, messages: totalMessages };
 }
-var SYNKRO_DIR5, HOOKS_DIR, BIN_DIR, CONFIG_PATH2, MCP_STDIO_PROXY_SRC, OFFSETS_DIR;
+var SYNKRO_DIR5, HOOKS_DIR, BIN_DIR, CONFIG_PATH2, MCP_STDIO_PROXY_SRC, OFFSETS_DIR, CLOUD_JWT_PATH;
 var init_install = __esm({
   "cli/commands/install.ts"() {
     "use strict";
@@ -12005,6 +12057,7 @@ rl.on('line', async (line) => {
 });
 `;
     OFFSETS_DIR = join10(SYNKRO_DIR5, ".transcript-offsets");
+    CLOUD_JWT_PATH = join10(SYNKRO_DIR5, ".cloud-jwt");
   }
 });
 
@@ -13978,7 +14031,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.70");
+  console.log("1.6.72");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents