@synkro-sh/cli 1.6.75 → 1.6.77

package/dist/bootstrap.js

@@ -957,6 +957,10 @@ function validateGatewayUrl(raw: string): string {
 }
 export const GATEWAY_URL = validateGatewayUrl(process.env.SYNKRO_GATEWAY_URL || 'https://api.synkro.sh');
 export const CREDS_PATH = process.env.SYNKRO_CREDENTIALS_PATH || join(HOME, '.synkro', 'credentials.json');
+// The long-lived (1yr) Synkro-signed MCP token, minted + stored at install time.
+// In cloud mode the hook authenticates grade/scan/telemetry calls with THIS,
+// not the ~5-min WorkOS access token \u2014 so a long session never 401s the grader.
+export const MCP_JWT_PATH = process.env.SYNKRO_MCP_JWT_PATH || join(HOME, '.synkro', '.mcp-jwt');
 const LAST_PROMPT_FILE = join(HOME, '.synkro', '.last-prompt');
 
 // \u2500\u2500\u2500 Path Validation \u2500\u2500\u2500
@@ -1046,6 +1050,16 @@ export function log(msg: string): void {
 // \u2500\u2500\u2500 JWT Management \u2500\u2500\u2500
 
 export function loadJwt(): string | null {
+  // Cloud mode: prefer the long-lived (1yr) MCP token. It's org+user scoped and
+  // accepted on the whole cloud-hook surface (grade/submit, cwe-rules, hook/*,
+  // cli/*), so grading survives sessions far longer than the ~5-min WorkOS token.
+  // jwtIsExpired sees a year of runway, so ensureFreshJwt never needs to refresh.
+  if (process.env.SYNKRO_STORAGE_MODE === 'cloud') {
+    try {
+      const mcp = readFileSync(MCP_JWT_PATH, 'utf-8').trim();
+      if (mcp) return mcp;
+    } catch { /* no mcp token on disk \u2014 fall back to the login token below */ }
+  }
   try {
     if (!existsSync(CREDS_PATH)) return null;
     const creds = JSON.parse(readFileSync(CREDS_PATH, 'utf-8'));
@@ -1603,7 +1617,13 @@ export async function route(config: HookConfig, synkroFile?: SynkroFileConfig):
   if (process.env.SYNKRO_DEPLOY_LOCATION === 'cloud') return 'local';
   if (config.captureDepth === 'local_only') return 'local';
   if (await channelUp()) return 'local';
-  return 'cloud';
+  // Local channel down. Do NOT silently fall back to cloud grading when in local
+  // mode \u2014 the cloud judge endpoint (/api/v1/hook/judge) writes guard_checks /
+  // guard_violations to Timescale, leaking local activity into the cloud
+  // dashboard. Only an explicit cloud storage posture (which install couples to
+  // grader location = cloud) may route to the cloud judge; otherwise stay local
+  // (localGrade emits a grader-unavailable message if the container is truly down).
+  return process.env.SYNKRO_STORAGE_MODE === 'cloud' ? 'cloud' : 'local';
 }
 
 export async function cweRoute(config: HookConfig, synkroFile?: SynkroFileConfig): Promise<'local' | 'byok' | 'skip'> {
@@ -1724,6 +1744,34 @@ async function hostedGrade(role: GradeRole, prompt: string, jwt: string, timeout
   return String(data.result || '');
 }
 
+// Cloud transcript capture \u2014 the cloud mirror of the local /api/conversation-sync
+// + /api/session-action telemetry. Posts to the API /api/v1/cli/sync-transcripts
+// (the org is derived from the login JWT, same one cloud grading uses). Best-effort:
+// never throws into the hook path. messages/actions must already be in the route
+// shape: message {message_index,type,content,model?,timestamp?,tool_calls?};
+// action {step,tool,summary,file,outcome}.
+async function syncTranscriptCloud(
+  sessionId: string,
+  repo: string,
+  messages: Array<Record<string, unknown>>,
+  actions: Array<Record<string, unknown>>,
+): Promise<boolean> {
+  if (!sessionId || (messages.length === 0 && actions.length === 0)) return false;
+  const jwt = loadJwt();
+  if (!jwt) return false;
+  try {
+    const resp = await fetch(GATEWAY_URL + '/api/v1/cli/sync-transcripts', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
+      body: JSON.stringify({ repo: repo || '', sessions: [{ cc_session_id: sessionId, messages, actions }] }),
+      signal: AbortSignal.timeout(5000),
+    });
+    return resp.ok;
+  } catch {
+    return false;
+  }
+}
+
 // Local-channel default 24s \u2014 MUST stay below the CC hook timeout (50s for
 // edit/bash/cwe in ccHookConfig.ts) so the AbortSignal fires and the caller's
 // catch fails open cleanly. A hung on-device worker should fail open fast; only
@@ -2040,6 +2088,12 @@ export function appendSessionAction(sessionId: string, entry: SessionAction): vo
     appendFileSync(logPath, JSON.stringify(entry) + '\\n', 'utf-8');
   } catch {}
 
+  // Cloud: ship the action to the API transcript-sync (org from login JWT) with an
+  // explicit step so streamed single-action sends stay idempotent + ordered.
+  if (deployIsCloud()) {
+    void syncTranscriptCloud(sessionId, '', [], [{ step, tool: entry.tool, summary: entry.summary, file: entry.file, outcome: entry.outcome }]);
+    return;
+  }
   const mcpPort = process.env.SYNKRO_MCP_PORT || '18931';
   let mcpToken = '';
   try { mcpToken = readFileSync(join(HOME, '.synkro', '.mcp-jwt'), 'utf-8').trim(); } catch {}
@@ -2811,15 +2865,23 @@ export async function pushConversationMessage(
   const text = content.trim().slice(0, 8000);
   if (!sessionId || !text || isProviderRedactedPlaceholder(text)) return false;
 
+  const seq = typeof opts.seq === 'number'
+    ? opts.seq
+    : Date.now() % 1_000_000_000;
+
+  // Cloud: send to the API transcript-sync (org from login JWT) instead of the
+  // local MCP server.
+  if (deployIsCloud()) {
+    return syncTranscriptCloud(sessionId, opts.gitRepo || '', [{
+      message_index: seq, type: role, content: text, timestamp: new Date().toISOString(),
+    }], []);
+  }
+
   const mcpPort = process.env.SYNKRO_MCP_PORT || '18931';
   let mcpToken = '';
   try { mcpToken = readFileSync(join(HOME, '.synkro', '.mcp-jwt'), 'utf-8').trim(); } catch {}
   if (!mcpToken) return false;
 
-  const seq = typeof opts.seq === 'number'
-    ? opts.seq
-    : Date.now() % 1_000_000_000;
-
   try {
     const body: Record<string, unknown> = {
       session_id: sessionId,
@@ -2973,6 +3035,22 @@ export async function syncConversationTranscript(
     return { ingested: 0, messages: [] };
   }
 
+  // Cloud: ship the tail to the API transcript-sync (org from login JWT). Map the
+  // local message shape (ts) to the cloud route's (timestamp).
+  if (deployIsCloud()) {
+    const cloudMsgs = messages.map((m) => ({
+      message_index: m.message_index,
+      type: m.type,
+      content: m.content,
+      model: (m.model as string | null) ?? undefined,
+      timestamp: (m.ts as string | null) ?? undefined,
+      tool_calls: m.tool_calls,
+    }));
+    const ok = await syncTranscriptCloud(sessionId, gitRepo, cloudMsgs, []);
+    if (ok) writeFileSync(offsetFile, String(totalLines), 'utf-8');
+    return { ingested: ok ? messages.length : 0, messages };
+  }
+
   const rawPort = parseInt(process.env.SYNKRO_MCP_PORT || '18931', 10);
   const mcpPort = (rawPort > 0 && rawPort < 65536) ? rawPort : 18931;
   let mcpToken = '';
@@ -10592,7 +10670,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.75")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.77")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -10738,6 +10816,9 @@ async function printWorkerDebug(base, jwt2) {
 `);
       return;
     }
+    if (d.grader_error_code) {
+      console.warn(`    \u25B8 DIAGNOSIS [${d.grader_error_code}]: ${d.grader_error_detail || ""}`);
+    }
     for (const w of d.workers.slice(0, 2)) {
       console.warn(`    [${w.worker}] launcher log:`);
       for (const l of String(w.logTail || "").split("\n").filter((l2) => l2.trim()).slice(-6)) console.warn("      " + l.slice(0, 240));
@@ -10815,14 +10896,16 @@ async function verifyCloudGrader(jwt2) {
     }
     const detail = (body.error || raw || "").trim().slice(0, 300) || "(empty response)";
     console.warn(`  \u2717 smoke grade FAILED (HTTP ${r.status}): ${detail}`);
-    if (/no grader worker ready/i.test(detail)) {
+    if (body.error_code) {
+      console.warn(`    \u25B8 ${body.error_code}: ${body.hint || ""}`);
+    } else if (/no grader worker ready/i.test(detail)) {
       console.warn("    \u2192 the worker pool never registered (cold-start, or the pool failed to boot).");
     } else if (/connection lost|network|502/i.test(detail)) {
       console.warn("    \u2192 the container dropped the connection mid-grade \u2014 the claude worker crashed or hung (most often a bad/expired setup-token).");
     } else {
       console.warn("    \u2192 the worker returned an error; most often a bad/expired Claude setup-token.");
     }
-    console.warn("    Re-run `synkro install` \u2192 cloud to re-authorize the hosted worker.\n");
+    if (!body.error_code) console.warn("    Re-run `synkro install` \u2192 cloud to re-authorize the hosted worker.\n");
     await printWorkerDebug(base, jwt2);
     return false;
   } catch (e) {
@@ -14262,7 +14345,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.75");
+  console.log("1.6.77");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents