@synkro-sh/cli 1.6.76 → 1.6.78

package/dist/bootstrap.js

@@ -957,6 +957,10 @@ function validateGatewayUrl(raw: string): string {
 }
 export const GATEWAY_URL = validateGatewayUrl(process.env.SYNKRO_GATEWAY_URL || 'https://api.synkro.sh');
 export const CREDS_PATH = process.env.SYNKRO_CREDENTIALS_PATH || join(HOME, '.synkro', 'credentials.json');
+// The long-lived (1yr) Synkro-signed MCP token, minted + stored at install time.
+// In cloud mode the hook authenticates grade/scan/telemetry calls with THIS,
+// not the ~5-min WorkOS access token \u2014 so a long session never 401s the grader.
+export const MCP_JWT_PATH = process.env.SYNKRO_MCP_JWT_PATH || join(HOME, '.synkro', '.mcp-jwt');
 const LAST_PROMPT_FILE = join(HOME, '.synkro', '.last-prompt');
 
 // \u2500\u2500\u2500 Path Validation \u2500\u2500\u2500
@@ -1046,6 +1050,16 @@ export function log(msg: string): void {
 // \u2500\u2500\u2500 JWT Management \u2500\u2500\u2500
 
 export function loadJwt(): string | null {
+  // Cloud mode: prefer the long-lived (1yr) MCP token. It's org+user scoped and
+  // accepted on the whole cloud-hook surface (grade/submit, cwe-rules, hook/*,
+  // cli/*), so grading survives sessions far longer than the ~5-min WorkOS token.
+  // jwtIsExpired sees a year of runway, so ensureFreshJwt never needs to refresh.
+  if (process.env.SYNKRO_STORAGE_MODE === 'cloud') {
+    try {
+      const mcp = readFileSync(MCP_JWT_PATH, 'utf-8').trim();
+      if (mcp) return mcp;
+    } catch { /* no mcp token on disk \u2014 fall back to the login token below */ }
+  }
   try {
     if (!existsSync(CREDS_PATH)) return null;
     const creds = JSON.parse(readFileSync(CREDS_PATH, 'utf-8'));
@@ -1603,7 +1617,13 @@ export async function route(config: HookConfig, synkroFile?: SynkroFileConfig):
   if (process.env.SYNKRO_DEPLOY_LOCATION === 'cloud') return 'local';
   if (config.captureDepth === 'local_only') return 'local';
   if (await channelUp()) return 'local';
-  return 'cloud';
+  // Local channel down. Do NOT silently fall back to cloud grading when in local
+  // mode \u2014 the cloud judge endpoint (/api/v1/hook/judge) writes guard_checks /
+  // guard_violations to Timescale, leaking local activity into the cloud
+  // dashboard. Only an explicit cloud storage posture (which install couples to
+  // grader location = cloud) may route to the cloud judge; otherwise stay local
+  // (localGrade emits a grader-unavailable message if the container is truly down).
+  return process.env.SYNKRO_STORAGE_MODE === 'cloud' ? 'cloud' : 'local';
 }
 
 export async function cweRoute(config: HookConfig, synkroFile?: SynkroFileConfig): Promise<'local' | 'byok' | 'skip'> {
@@ -1724,6 +1744,34 @@ async function hostedGrade(role: GradeRole, prompt: string, jwt: string, timeout
   return String(data.result || '');
 }
 
+// Cloud transcript capture \u2014 the cloud mirror of the local /api/conversation-sync
+// + /api/session-action telemetry. Posts to the API /api/v1/cli/sync-transcripts
+// (the org is derived from the login JWT, same one cloud grading uses). Best-effort:
+// never throws into the hook path. messages/actions must already be in the route
+// shape: message {message_index,type,content,model?,timestamp?,tool_calls?};
+// action {step,tool,summary,file,outcome}.
+async function syncTranscriptCloud(
+  sessionId: string,
+  repo: string,
+  messages: Array<Record<string, unknown>>,
+  actions: Array<Record<string, unknown>>,
+): Promise<boolean> {
+  if (!sessionId || (messages.length === 0 && actions.length === 0)) return false;
+  const jwt = loadJwt();
+  if (!jwt) return false;
+  try {
+    const resp = await fetch(GATEWAY_URL + '/api/v1/cli/sync-transcripts', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
+      body: JSON.stringify({ repo: repo || '', sessions: [{ cc_session_id: sessionId, messages, actions }] }),
+      signal: AbortSignal.timeout(5000),
+    });
+    return resp.ok;
+  } catch {
+    return false;
+  }
+}
+
 // Local-channel default 24s \u2014 MUST stay below the CC hook timeout (50s for
 // edit/bash/cwe in ccHookConfig.ts) so the AbortSignal fires and the caller's
 // catch fails open cleanly. A hung on-device worker should fail open fast; only
@@ -2025,6 +2073,12 @@ interface SessionAction {
   outcome?: string;
 }
 
+// True when the grader runs in Synkro Cloud (CF Containers) vs the on-device
+// container. Defined here in the FULL common module too \u2014 it's referenced by
+// appendSessionAction/dispatch helpers below; previously it lived only in the
+// stub common, so the real editGuard hook hit a ReferenceError in cloud mode.
+function deployIsCloud(): boolean { return process.env.SYNKRO_DEPLOY_LOCATION === 'cloud'; }
+
 function sessionLogPath(sessionId: string): string | null {
   if (!sessionId || !SAFE_SESSION_ID.test(sessionId)) return null;
   return join(SESSIONS_DIR, sessionId + '.jsonl');
@@ -2040,6 +2094,12 @@ export function appendSessionAction(sessionId: string, entry: SessionAction): vo
     appendFileSync(logPath, JSON.stringify(entry) + '\\n', 'utf-8');
   } catch {}
 
+  // Cloud: ship the action to the API transcript-sync (org from login JWT) with an
+  // explicit step so streamed single-action sends stay idempotent + ordered.
+  if (deployIsCloud()) {
+    void syncTranscriptCloud(sessionId, '', [], [{ step, tool: entry.tool, summary: entry.summary, file: entry.file, outcome: entry.outcome }]);
+    return;
+  }
   const mcpPort = process.env.SYNKRO_MCP_PORT || '18931';
   let mcpToken = '';
   try { mcpToken = readFileSync(join(HOME, '.synkro', '.mcp-jwt'), 'utf-8').trim(); } catch {}
@@ -2811,15 +2871,23 @@ export async function pushConversationMessage(
   const text = content.trim().slice(0, 8000);
   if (!sessionId || !text || isProviderRedactedPlaceholder(text)) return false;
 
+  const seq = typeof opts.seq === 'number'
+    ? opts.seq
+    : Date.now() % 1_000_000_000;
+
+  // Cloud: send to the API transcript-sync (org from login JWT) instead of the
+  // local MCP server.
+  if (deployIsCloud()) {
+    return syncTranscriptCloud(sessionId, opts.gitRepo || '', [{
+      message_index: seq, type: role, content: text, timestamp: new Date().toISOString(),
+    }], []);
+  }
+
   const mcpPort = process.env.SYNKRO_MCP_PORT || '18931';
   let mcpToken = '';
   try { mcpToken = readFileSync(join(HOME, '.synkro', '.mcp-jwt'), 'utf-8').trim(); } catch {}
   if (!mcpToken) return false;
 
-  const seq = typeof opts.seq === 'number'
-    ? opts.seq
-    : Date.now() % 1_000_000_000;
-
   try {
     const body: Record<string, unknown> = {
       session_id: sessionId,
@@ -2973,6 +3041,22 @@ export async function syncConversationTranscript(
     return { ingested: 0, messages: [] };
   }
 
+  // Cloud: ship the tail to the API transcript-sync (org from login JWT). Map the
+  // local message shape (ts) to the cloud route's (timestamp).
+  if (deployIsCloud()) {
+    const cloudMsgs = messages.map((m) => ({
+      message_index: m.message_index,
+      type: m.type,
+      content: m.content,
+      model: (m.model as string | null) ?? undefined,
+      timestamp: (m.ts as string | null) ?? undefined,
+      tool_calls: m.tool_calls,
+    }));
+    const ok = await syncTranscriptCloud(sessionId, gitRepo, cloudMsgs, []);
+    if (ok) writeFileSync(offsetFile, String(totalLines), 'utf-8');
+    return { ingested: ok ? messages.length : 0, messages };
+  }
+
   const rawPort = parseInt(process.env.SYNKRO_MCP_PORT || '18931', 10);
   const mcpPort = (rawPort > 0 && rawPort < 65536) ? rawPort : 18931;
   let mcpToken = '';
@@ -10592,7 +10676,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.76")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.78")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -14267,7 +14351,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.76");
+  console.log("1.6.78");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents