@synkro-sh/cli 1.6.92 → 1.6.93

package/dist/bootstrap.js

@@ -5796,35 +5796,14 @@ async function main() {
       return;
     }
 
-    if (isSafeInRepoRead(toolName, command, cwd)) {
-      log('bashGuard ' + cmdShort + ' → instant allow (safe in-repo read)');
-      appendLocalTelemetry({
-        capture_type: 'local_verdict',
-        verdict: 'pass',
-        hook_type: 'bash',
-        category: 'safe_read',
-        tool_name: toolName,
-        command: command.slice(0, 200),
-        session_id: sessionId,
-        repo: gitRepo || cwd,
-        cc_model: transcript.ccModel,
-        reasoning: 'Safe in-repo read — auto-allowed without an LLM grade.',
-      });
-      outputJson({
-        systemMessage: tagStr + ' bashGuard → pass: safe in-repo read',
-        hookSpecificOutput: {
-          hookEventName: 'PreToolUse',
-          additionalContext: tagStr + ' bashGuard pass: safe in-repo read.',
-        },
-      });
-      return;
-    }
-
     // ─── Secret firewall: BLOCK a literal credential in the command BEFORE it runs
     // or reaches the grader — the value never lands in a file, shell history, OR the
     // LLM provider (no leak to Anthropic/Cursor). Deterministic + local, no model
     // call. High-confidence formats only (a false block stops the user), and
-    // $VAR / placeholder refs never trip it. ───
+    // $VAR / placeholder refs never trip it. MUST run BEFORE the safe-read fast-path
+    // below — otherwise an echo/printf of a literal secret is treated as a safe read
+    // and waved through. A genuine read carries no literal secret, so this never
+    // false-blocks legitimate reads. ───
     const secretHits = detectHardSecrets(command);
     if (secretHits.length) {
       const types = secretHits.map(h => h.type).join(', ');
@@ -5849,6 +5828,32 @@ async function main() {
       return;
     }
 
+    // Safe in-repo read fast-path — runs AFTER the secret firewall above so a
+    // literal credential is never waved through as a "safe read".
+    if (isSafeInRepoRead(toolName, command, cwd)) {
+      log('bashGuard ' + cmdShort + ' → instant allow (safe in-repo read)');
+      appendLocalTelemetry({
+        capture_type: 'local_verdict',
+        verdict: 'pass',
+        hook_type: 'bash',
+        category: 'safe_read',
+        tool_name: toolName,
+        command: command.slice(0, 200),
+        session_id: sessionId,
+        repo: gitRepo || cwd,
+        cc_model: transcript.ccModel,
+        reasoning: 'Safe in-repo read — auto-allowed without an LLM grade.',
+      });
+      outputJson({
+        systemMessage: tagStr + ' bashGuard → pass: safe in-repo read',
+        hookSpecificOutput: {
+          hookEventName: 'PreToolUse',
+          additionalContext: tagStr + ' bashGuard pass: safe in-repo read.',
+        },
+      });
+      return;
+    }
+
     // ─── Install protection: install-scan runs first and owns block traces ───
     let scanConcern = '';
     let scanBlockContext = '';
@@ -6872,6 +6877,25 @@ async function main() {
 
     // Instant-allow read-only tool calls + safe in-repo bash reads \u2014 no grade,
     // no network. Critical under Cursor's tight 15s beforeShellExecution budget.
+    // \u2500\u2500\u2500 Secret firewall: BLOCK a literal credential in the command BEFORE it runs
+    // or reaches the grader \u2014 never leaks to a file, shell history, or the model
+    // (Anthropic/Cursor). Local + deterministic; $VAR / placeholder refs never trip
+    // it. MUST run BEFORE the safe-read fast-path below \u2014 else an echo/printf of a
+    // literal secret is waved through as a "safe read". \u2500\u2500\u2500
+    const secretHits = detectHardSecrets(command);
+    if (secretHits.length) {
+      const types = secretHits.map(h => h.type).join(', ');
+      const remediation = secretRemediation(command, secretHits);
+      log('bashGuard ' + cmdShort + ' \u2192 BLOCKED: literal credential (' + types + ')');
+      appendLocalTelemetry({
+        capture_type: 'local_verdict', verdict: 'block', hook_type: 'bash',
+        category: 'secret_exposure', tool_name: toolName, command: scrubSecrets(command).slice(0, 200),
+        session_id: sessionId, repo: repo || cwd, cc_model: model,
+        reasoning: 'Literal credential (' + types + ') in the proposed command \u2014 blocked locally before grading; never sent to the model.',
+      });
+      finishWith({ permission: 'deny', user_message: '[synkro] bashGuard \u2192 BLOCKED: literal credential in command (' + types + '). Use an env var reference instead.', agent_message: remediation });
+    }
+
     if (isSafeInRepoRead(toolName, command, cwd)) {
       log('bashGuard ' + cmdShort + ' \u2192 instant allow (safe in-repo read)');
       appendLocalTelemetry({
@@ -6899,23 +6923,6 @@ async function main() {
     const rt = await route(config, synkroFile);
     const tagStr = tag(rt, config, graderPool);
 
-    // Secret firewall: BLOCK a literal credential in the command BEFORE it runs or
-    // reaches the grader \u2014 never leaks to a file, shell history, or the model
-    // (Anthropic/Cursor). Local + deterministic; $VAR / placeholder refs never trip it.
-    const secretHits = detectHardSecrets(command);
-    if (secretHits.length) {
-      const types = secretHits.map(h => h.type).join(', ');
-      const remediation = secretRemediation(command, secretHits);
-      log('bashGuard ' + cmdShort + ' \u2192 BLOCKED: literal credential (' + types + ')');
-      appendLocalTelemetry({
-        capture_type: 'local_verdict', verdict: 'block', hook_type: 'bash',
-        category: 'secret_exposure', tool_name: toolName, command: scrubSecrets(command).slice(0, 200),
-        session_id: sessionId, repo: repo || cwd, cc_model: model,
-        reasoning: 'Literal credential (' + types + ') in the proposed command \u2014 blocked locally before grading; never sent to the model.',
-      });
-      finishWith({ permission: 'deny', user_message: tagStr + ' bashGuard \u2192 BLOCKED: literal credential in command (' + types + '). Use an env var reference instead.', agent_message: remediation });
-    }
-
     // Install protection \u2014 install-scan runs first and owns block traces.
     let scanConcern = '';
     let scanBlockContext = '';
@@ -11230,7 +11237,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.92")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.93")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -15295,7 +15302,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.92");
+  console.log("1.6.93");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents