@synkro-sh/cli 1.6.90 → 1.6.92

package/dist/bootstrap.js

@@ -1415,8 +1415,19 @@ export function loadSynkroFile(cwd?: string): SynkroFileConfig {
   }
 }
 
-export function effectiveGraderPool(synkroFile: SynkroFileConfig, hookAgentKind: AgentKind): AgentKind {
-  const pool = normalizePoolToken(synkroFile.grader.pool);
+export function effectiveGraderPool(synkroFile: SynkroFileConfig, hookAgentKind: AgentKind, config?: HookConfig): AgentKind {
+  // Source of truth for the pool SPLIT depends on grading location:
+  //   \u2022 cloud / byok \u2192 SERVER-managed (the user's dashboard choice, delivered as
+  //     config.graderPool from /v1/hook/config). synkro.toml isn't even written
+  //     for cloud installs, so it can't be the source there.
+  //   \u2022 local        \u2192 synkro.toml [grader] pool (on-device, user-owned).
+  // Falls back to synkro.toml whenever the server pool is absent, so a missing
+  // value never breaks grading \u2014 it just reverts to today's behavior.
+  const managed = process.env.SYNKRO_DEPLOY_LOCATION === 'cloud'
+    || (process.env.SYNKRO_GRADING_MODE || synkroFile.grader?.mode || config?.gradingMode) === 'byok';
+  const pool = (managed && config?.graderPool)
+    ? normalizePoolToken(config.graderPool)
+    : normalizePoolToken(synkroFile.grader.pool);
   if (pool === 'auto') return hookAgentKind;
   if (pool === 'claude') return 'claude_code';
   return 'cursor';
@@ -1517,6 +1528,11 @@ export interface HookConfig {
   // value from /v1/hook/config is only a fallback when the env var is unset.
   gradingMode: string;
   storageMode: string;
+  // Server-managed pool SPLIT (auto | claude | cursor) + canonical grading
+  // location, from /v1/hook/config. Authoritative ONLY for cloud/byok grading
+  // (synkro.toml governs local). Undefined when the gateway didn't report one.
+  graderPool?: string;
+  inferenceMode?: string;
 }
 
 /** True when telemetry + rules must stay on-machine (PGLite). Default: local. */
@@ -1597,6 +1613,9 @@ export async function loadConfig(jwt: string, query?: string): Promise<HookConfi
     config.silent = data.silent_mode === true || data.silent_mode === 'true';
     if (!process.env.SYNKRO_GRADING_MODE && data.grading_mode) config.gradingMode = data.grading_mode;
     if (!process.env.SYNKRO_STORAGE_MODE && data.storage_mode) config.storageMode = data.storage_mode;
+    // Server-managed pool split + location (cloud/byok only \u2014 see effectiveGraderPool).
+    if (data.grader_pool) config.graderPool = data.grader_pool;
+    if (data.inference_mode) config.inferenceMode = data.inference_mode;
     config.policyName = data.active_policy_name || '';
     if (Array.isArray(data.scan_exemptions)) {
       config.scanExemptions = data.scan_exemptions
@@ -2218,6 +2237,44 @@ function isPlaceholderSecret(v: string): boolean {
   const tail = v.replace(/^(sk-ant-|[rs]k_(?:live|test)_|sk-|AKIA|gh[posru]_|AIza|xox[baprs]-|Bearer[ ]+)/, '');
   return /^(x+|0+|a+|placeholder|example|changeme|your[-_a-z0-9]*|dummy|test|fake|redacted|sample)$/i.test(tail);
 }
+// \u2500\u2500 Opaque-secret heuristic (catches the FORMAT-LESS tail the regex can't) \u2500\u2500
+// A high-entropy value sitting in a SECRET CONTEXT \u2014 assigned to a secret-named
+// variable, in an auth header, or as a connection-string password. Local +
+// deterministic, no model. Char-class regexes only (template-literal backslash safe).
+function shannonEntropy(s: string): number {
+  const m: Record<string, number> = {};
+  for (const ch of s) m[ch] = (m[ch] || 0) + 1;
+  let h = 0;
+  for (const k in m) { const p = m[k] / s.length; h -= p * Math.log2(p); }
+  return h;
+}
+function looksOpaqueSecret(v: string): boolean {
+  if (v.length < 16) return false;
+  if (/[$<>{}]/.test(v)) return false;                                                            // env ref / placeholder
+  if (/^[0-9a-f]{32,}$/i.test(v)) return false;                                                    // hex hash / sha
+  if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v)) return false;     // uuid
+  if (!(/[a-zA-Z]/.test(v) && /[0-9]/.test(v))) return false;                                      // real tokens mix letters+digits
+  return shannonEntropy(v) >= 3.2;
+}
+const OPAQUE_CTX_PATTERNS: RegExp[] = [
+  /[A-Za-z_][A-Za-z0-9_-]*(?:secret|token|key|password|passwd|api[_-]?key|auth|credential)[A-Za-z0-9_-]*[ ]*[=:][ ]*["']?([^ "'&|;]+)/gi,
+  /(?:authorization|x-api-key|x-auth-token|api-key)[ ]*:[ ]*(?:bearer[ ]+)?([^ "']+)/gi,
+  /[a-z][a-z0-9+.-]*:[/][/][^:/@ ]+:([^@/ ]+)@/gi,
+];
+export function detectOpaqueSecrets(text: string): SecretHit[] {
+  if (!text) return [];
+  const hits: SecretHit[] = [];
+  const seen = new Set<string>();
+  for (const re of OPAQUE_CTX_PATTERNS) {
+    re.lastIndex = 0;
+    let m: RegExpExecArray | null;
+    while ((m = re.exec(text)) !== null) {
+      const v = m[1];
+      if (v && !seen.has(v) && looksOpaqueSecret(v)) { seen.add(v); hits.push({ type: 'opaque-secret', value: v }); }
+    }
+  }
+  return hits;
+}
 export function detectHardSecrets(text: string): SecretHit[] {
   if (!text) return [];
   const hits: SecretHit[] = [];
@@ -2232,6 +2289,10 @@ export function detectHardSecrets(text: string): SecretHit[] {
       hits.push({ type, value: v });
     }
   }
+  // Union the format-less opaque-secret tail (entropy + secret context).
+  for (const h of detectOpaqueSecrets(text)) {
+    if (!seen.has(h.value)) { seen.add(h.value); hits.push(h); }
+  }
   return hits;
 }
 // Shape-preserving redaction for persist/log/grade boundaries: the reader still
@@ -2247,6 +2308,8 @@ export function scrubSecrets(text: string): string {
     if (/[$<>{}]/.test(val)) return full;
     return pfx + '<redacted:credential>';
   });
+  // Format-less opaque secrets (entropy + secret context) the patterns above miss.
+  for (const h of detectOpaqueSecrets(out)) out = out.split(h.value).join('<redacted:opaque-secret>');
   return out;
 }
 function guessEnvName(type: string, i: number): string {
@@ -4320,7 +4383,7 @@ async function main() {
     // Load config and decide route
     const config = await loadConfig(jwt);
     const synkroFile = loadSynkroFile(cwd);
-    const graderPool = effectiveGraderPool(synkroFile, agentKind);
+    const graderPool = effectiveGraderPool(synkroFile, agentKind, config);
     const rt = await route(config, synkroFile);
     const tagStr = tag(rt, config, graderPool);
 
@@ -4814,7 +4877,7 @@ async function main() {
 
     const config = await loadConfig(jwt);
     const synkroFile = loadSynkroFile(cwd);
-    const graderPool = effectiveGraderPool(synkroFile, agentKind);
+    const graderPool = effectiveGraderPool(synkroFile, agentKind, config);
     const rt = await cweRoute(config, synkroFile);
 
     // Combined-grade mode: the edit-precheck hook runs CWE inside its single
@@ -5542,7 +5605,7 @@ async function main() {
     const config = await loadConfig(jwt);
     const isCursor = isCursorHookFormat();
     const synkroFile = loadSynkroFile(cwd);
-    const graderPool = effectiveGraderPool(synkroFile, isCursor ? 'cursor' : 'claude_code');
+    const graderPool = effectiveGraderPool(synkroFile, isCursor ? 'cursor' : 'claude_code', config);
     const rt = await route(config, synkroFile);
     const tagStr = tag(rt, config, graderPool);
 
@@ -5724,7 +5787,7 @@ async function main() {
 
     const config = await loadConfig(jwt);
     const synkroFile = loadSynkroFile(cwd);
-    const graderPool = effectiveGraderPool(synkroFile, 'claude_code');
+    const graderPool = effectiveGraderPool(synkroFile, 'claude_code', config);
     const rt = await route(config, synkroFile);
     const tagStr = tag(rt, config, graderPool);
 
@@ -6014,7 +6077,7 @@ async function main() {
 
     const config = await loadConfig(jwt);
     const synkroFile = loadSynkroFile(cwd);
-    const graderPool = effectiveGraderPool(synkroFile, agentKind);
+    const graderPool = effectiveGraderPool(synkroFile, agentKind, config);
     const rt = await route(config, synkroFile);
     const tagStr = tag(rt, config, graderPool);
 
@@ -6233,7 +6296,7 @@ async function main() {
 
     const config = await loadConfig(jwt);
     const synkroFile = loadSynkroFile(cwd);
-    const graderPool = effectiveGraderPool(synkroFile, agentKind);
+    const graderPool = effectiveGraderPool(synkroFile, agentKind, config);
     const rt = await route(config, synkroFile);
     const tagStr = tag(rt, config, graderPool);
 
@@ -6469,12 +6532,15 @@ async function main() {
       return;
     }
 
-    // Sync grading mode to API profile so the dashboard reflects the actual config
-    const fastInference = gradingMode === 'byok';
+    // Sync the canonical 3-state grading location to the API profile so the
+    // dashboard reflects the machine's ACTUAL config. byok (own API key) wins;
+    // else the cloud worker pool; else on-device workers. The API derives the
+    // legacy fast_inference boolean from this, so we only send one field.
+    const inferenceMode = gradingMode === 'byok' ? 'byok' : (deployCloud ? 'cloud' : 'local');
     fetch(GATEWAY_URL + '/api/v1/cli/me', {
       method: 'PATCH',
       headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
-      body: JSON.stringify({ fast_inference: fastInference }),
+      body: JSON.stringify({ inference_mode: inferenceMode }),
       signal: AbortSignal.timeout(3000),
     }).catch(() => {});
 
@@ -6829,7 +6895,7 @@ async function main() {
     if (config.silent) finishAllow();
 
     const synkroFile = loadSynkroFile(cwd);
-    const graderPool = effectiveGraderPool(synkroFile, 'cursor');
+    const graderPool = effectiveGraderPool(synkroFile, 'cursor', config);
     const rt = await route(config, synkroFile);
     const tagStr = tag(rt, config, graderPool);
 
@@ -11164,7 +11230,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.90")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.92")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -15071,6 +15137,11 @@ function updateConfigValue(key, value) {
   if (!found) updated.splice(updated.length - 1, 0, `${key}='${value}'`);
   writeFileSync13(CONFIG_PATH6, updated.join("\n"), "utf-8");
 }
+function resolveInferenceMode(cfg) {
+  if ((cfg.SYNKRO_GRADING_MODE || "local") === "byok") return "byok";
+  if (cfg.SYNKRO_DEPLOY_LOCATION === "cloud") return "cloud";
+  return "local";
+}
 async function reconcileContainer() {
   const cfg = readConfigEnv2();
   const cloudOnly = (cfg.SYNKRO_GRADING_MODE || "local") === "byok" && (cfg.SYNKRO_STORAGE_MODE || "local") === "cloud";
@@ -15098,17 +15169,18 @@ async function configCommand(args2) {
   if (args2.length === 0) {
     const config2 = readConfigEnv2();
     console.log("Synkro config:\n");
-    console.log(`  grading:    ${config2.SYNKRO_GRADING_MODE || "local"}`);
+    console.log(`  inference:  ${resolveInferenceMode(config2)}`);
     console.log(`  storage:    ${config2.SYNKRO_STORAGE_MODE || "local"}`);
-    console.log(`  inference:  ${config2.SYNKRO_INFERENCE || "fast"}`);
     console.log(`  tier:       ${config2.SYNKRO_TIER || "pro"}`);
     console.log(`  gateway:    ${config2.SYNKRO_GATEWAY_URL || "https://api.synkro.sh"}`);
     console.log(`  version:    ${config2.SYNKRO_VERSION || "?"}`);
     console.log(`
 To change:`);
-    console.log(`  synkro config grading <local|byok>    \u2014 where grading runs`);
-    console.log(`  synkro config storage <local|cloud>   \u2014 where telemetry is stored`);
-    console.log(`  synkro config --inference fast|standard`);
+    console.log(`  synkro config --inference <local|cloud|byok>  \u2014 where grading runs`);
+    console.log(`      local  \u2014 Claude/Cursor workers on this machine (your subscription)`);
+    console.log(`      cloud  \u2014 Claude/Cursor workers in the Synkro cloud pool`);
+    console.log(`      byok   \u2014 graded via your own provider API key`);
+    console.log(`  synkro config storage <local|cloud>           \u2014 where telemetry is stored`);
     return;
   }
   if (args2[0] === "grading") {
@@ -15142,8 +15214,8 @@ To change:`);
     if (a.startsWith("--inference=")) inferenceValue = a.slice("--inference=".length);
     else if (a === "--inference" && args2.indexOf(a) + 1 < args2.length) inferenceValue = args2[args2.indexOf(a) + 1];
   }
-  if (!inferenceValue || !["fast", "standard"].includes(inferenceValue)) {
-    console.error("Usage: synkro config --inference fast|standard");
+  if (!inferenceValue || !["local", "cloud", "byok"].includes(inferenceValue)) {
+    console.error("Usage: synkro config --inference <local|cloud|byok>");
     process.exit(1);
   }
   if (!isAuthenticated()) {
@@ -15160,7 +15232,7 @@ To change:`);
         "Authorization": `Bearer ${token}`,
         "Content-Type": "application/json"
       },
-      body: JSON.stringify({ fast_inference: inferenceValue === "fast" })
+      body: JSON.stringify({ inference_mode: inferenceValue })
     });
     if (!resp.ok) {
       const errText = await resp.text().catch(() => "");
@@ -15171,8 +15243,24 @@ To change:`);
     console.error(`Failed to reach server: ${err.message}`);
     process.exit(1);
   }
-  updateConfigValue("SYNKRO_INFERENCE", inferenceValue);
+  if (inferenceValue === "byok") {
+    updateConfigValue("SYNKRO_GRADING_MODE", "byok");
+    updateConfigValue("SYNKRO_DEPLOY_LOCATION", "local");
+  } else if (inferenceValue === "cloud") {
+    updateConfigValue("SYNKRO_GRADING_MODE", "local");
+    updateConfigValue("SYNKRO_DEPLOY_LOCATION", "cloud");
+  } else {
+    updateConfigValue("SYNKRO_GRADING_MODE", "local");
+    updateConfigValue("SYNKRO_DEPLOY_LOCATION", "local");
+  }
   console.log(`\u2713 Inference set to '${inferenceValue}'.`);
+  if (inferenceValue === "byok") {
+    console.log("  BYOK grading uses your own provider key \u2014 register one in the");
+    console.log("  dashboard under Settings \u2192 Provider Keys if you have not already.");
+  } else if (inferenceValue === "cloud") {
+    console.log("  Grading runs on the Synkro cloud worker pool (containers.synkro.sh).");
+  }
+  if (inferenceValue !== "cloud") await reconcileContainer();
 }
 var SYNKRO_DIR7, CONFIG_PATH6;
 var init_config = __esm({
@@ -15207,7 +15295,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.90");
+  console.log("1.6.92");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents