@synkro-sh/cli 1.6.92 → 1.6.94

package/dist/bootstrap.js

@@ -1775,6 +1775,27 @@ async function hostedGrade(role: GradeRole, prompt: string, jwt: string, timeout
   return String(data.result || '');
 }
 
+// Cloud task-adherence: fire the task-only 'task-drift' surface on the org's
+// container and return ONLY the progress systemMessage (informational \u2014 never
+// blocks an edit). Fail-silent: any hiccup returns '' so task tracking can't
+// break grading. The payload IS a ScanEnvelope; the container runs getActiveTask
+// (resolved per (org,user,repo) via active_tasks) + taskDrift and returns the
+// decision. Secrets are scrubbed before the envelope crosses the network.
+export async function cloudTaskDrift(envelope: Record<string, unknown>, jwt: string, timeoutMs = 20000): Promise<string> {
+  try {
+    const body = JSON.stringify({ role: 'task-drift', payload: scrubSecrets(JSON.stringify(envelope)), content: '' });
+    const resp = await fetch(CONTAINERS_URL + '/grade/submit', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
+      body,
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (!resp.ok) return '';
+    const j = await resp.json() as { systemMessage?: unknown };
+    return typeof j?.systemMessage === 'string' ? j.systemMessage : '';
+  } catch { return ''; }
+}
+
 // Option B: when a cloud grade fails (esp. a timeout), the REAL reason lives
 // inside the container, not on the wire \u2014 the client only ever sees "timed out".
 // Pull the org's per-worker claude/cursor sick reasons + log tails from the
@@ -4265,7 +4286,7 @@ export function outputEmpty(): void {
 `;
     EDIT_PRECHECK_TS = `#!/usr/bin/env bun
 import {
-  loadJwt, ensureFreshJwt, detectRepo, loadConfig, route, tag, localGrade,
+  loadJwt, ensureFreshJwt, detectRepo, loadConfig, route, tag, localGrade, cloudTaskDrift,
   parseVerdict, parseCombinedVerdict, combinedEditGradeEnabled, dispatchCapture, dispatchFinding, ruleMode, reconstructContent, editSecretDenial, isPathUnder, postWithRetry,
   readStdin, extractTranscript, readLastPrompt, findNearestDeps, filePathFromToolInput,
   appendSessionAction, readSessionLog, compressSessionLog, sessionLogForGrade, log,
@@ -4422,6 +4443,15 @@ async function main() {
       ].join('\\n');
       const graderPrompt = buildGraderPrompt(proposedShort);
 
+      // Cloud task-adherence (additive, informational): fire the task-only grade in
+      // PARALLEL with the rule grade so it adds no latency, then merge its progress
+      // message into the pass output. Fail-silent ('' on any issue). Sent as a
+      // synthetic Write of the reconstructed content so the container needs no base
+      // bytes. cwd = the repo identifier the container keys active_tasks on.
+      const taskDriftP: Promise<string> = process.env.SYNKRO_DEPLOY_LOCATION === 'cloud'
+        ? cloudTaskDrift({ payload: { tool_name: 'Write', tool_input: { file_path: filePath, content: proposedShort } }, harness: agentKind, cwd: gitRepo, sessionId }, jwt)
+        : Promise.resolve('');
+
       // \u2500\u2500\u2500 Combined org-rules + CWE in ONE inference (SYNKRO_COMBINED_EDIT_GRADE) \u2500\u2500\u2500
       // Self-contained early-return branch \u2014 the default two-grade path below is
       // left untouched. Appends the CWE rule set to the rules prompt, runs one
@@ -4527,7 +4557,8 @@ async function main() {
             ccModel: captureModel, ...lineMetrics,
           });
         const cPassLine = tagStr + ' editGuard ' + fileShort + ' \u2192 pass: ' + (ruleVerdict.reason || 'clean (rules + CWE)');
-        outputJson({ systemMessage: cPassLine, hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: 'Synkro combined edit judge (rules + CWE). ' + (ruleVerdict.reason || 'clean') } });
+        const cTaskMsg = await taskDriftP;
+        outputJson({ systemMessage: cPassLine + (cTaskMsg ? '\\n' + cTaskMsg : ''), hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: 'Synkro combined edit judge (rules + CWE). ' + (ruleVerdict.reason || 'clean') } });
         return;
       }
 
@@ -4573,7 +4604,8 @@ async function main() {
           ccModel: captureModel, ...lineMetrics,
         });
       const passLine = tagStr + ' editGuard ' + fileShort + ' \u2192 pass: ' + (verdict.reason || 'no policy violations detected');
-      outputJson({ systemMessage: passLine, hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: 'Synkro local edit judge. ' + (verdict.reason || 'no policy violations detected') } });
+      const rTaskMsg = await taskDriftP;
+      outputJson({ systemMessage: passLine + (rTaskMsg ? '\\n' + rTaskMsg : ''), hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: 'Synkro local edit judge. ' + (verdict.reason || 'no policy violations detected') } });
       return;
     }
 
@@ -5796,35 +5828,14 @@ async function main() {
       return;
     }
 
-    if (isSafeInRepoRead(toolName, command, cwd)) {
-      log('bashGuard ' + cmdShort + ' → instant allow (safe in-repo read)');
-      appendLocalTelemetry({
-        capture_type: 'local_verdict',
-        verdict: 'pass',
-        hook_type: 'bash',
-        category: 'safe_read',
-        tool_name: toolName,
-        command: command.slice(0, 200),
-        session_id: sessionId,
-        repo: gitRepo || cwd,
-        cc_model: transcript.ccModel,
-        reasoning: 'Safe in-repo read — auto-allowed without an LLM grade.',
-      });
-      outputJson({
-        systemMessage: tagStr + ' bashGuard → pass: safe in-repo read',
-        hookSpecificOutput: {
-          hookEventName: 'PreToolUse',
-          additionalContext: tagStr + ' bashGuard pass: safe in-repo read.',
-        },
-      });
-      return;
-    }
-
     // ─── Secret firewall: BLOCK a literal credential in the command BEFORE it runs
     // or reaches the grader — the value never lands in a file, shell history, OR the
     // LLM provider (no leak to Anthropic/Cursor). Deterministic + local, no model
     // call. High-confidence formats only (a false block stops the user), and
-    // $VAR / placeholder refs never trip it. ───
+    // $VAR / placeholder refs never trip it. MUST run BEFORE the safe-read fast-path
+    // below — otherwise an echo/printf of a literal secret is treated as a safe read
+    // and waved through. A genuine read carries no literal secret, so this never
+    // false-blocks legitimate reads. ───
     const secretHits = detectHardSecrets(command);
     if (secretHits.length) {
       const types = secretHits.map(h => h.type).join(', ');
@@ -5849,6 +5860,32 @@ async function main() {
       return;
     }
 
+    // Safe in-repo read fast-path — runs AFTER the secret firewall above so a
+    // literal credential is never waved through as a "safe read".
+    if (isSafeInRepoRead(toolName, command, cwd)) {
+      log('bashGuard ' + cmdShort + ' → instant allow (safe in-repo read)');
+      appendLocalTelemetry({
+        capture_type: 'local_verdict',
+        verdict: 'pass',
+        hook_type: 'bash',
+        category: 'safe_read',
+        tool_name: toolName,
+        command: command.slice(0, 200),
+        session_id: sessionId,
+        repo: gitRepo || cwd,
+        cc_model: transcript.ccModel,
+        reasoning: 'Safe in-repo read — auto-allowed without an LLM grade.',
+      });
+      outputJson({
+        systemMessage: tagStr + ' bashGuard → pass: safe in-repo read',
+        hookSpecificOutput: {
+          hookEventName: 'PreToolUse',
+          additionalContext: tagStr + ' bashGuard pass: safe in-repo read.',
+        },
+      });
+      return;
+    }
+
     // ─── Install protection: install-scan runs first and owns block traces ───
     let scanConcern = '';
     let scanBlockContext = '';
@@ -6872,6 +6909,25 @@ async function main() {
 
     // Instant-allow read-only tool calls + safe in-repo bash reads \u2014 no grade,
     // no network. Critical under Cursor's tight 15s beforeShellExecution budget.
+    // \u2500\u2500\u2500 Secret firewall: BLOCK a literal credential in the command BEFORE it runs
+    // or reaches the grader \u2014 never leaks to a file, shell history, or the model
+    // (Anthropic/Cursor). Local + deterministic; $VAR / placeholder refs never trip
+    // it. MUST run BEFORE the safe-read fast-path below \u2014 else an echo/printf of a
+    // literal secret is waved through as a "safe read". \u2500\u2500\u2500
+    const secretHits = detectHardSecrets(command);
+    if (secretHits.length) {
+      const types = secretHits.map(h => h.type).join(', ');
+      const remediation = secretRemediation(command, secretHits);
+      log('bashGuard ' + cmdShort + ' \u2192 BLOCKED: literal credential (' + types + ')');
+      appendLocalTelemetry({
+        capture_type: 'local_verdict', verdict: 'block', hook_type: 'bash',
+        category: 'secret_exposure', tool_name: toolName, command: scrubSecrets(command).slice(0, 200),
+        session_id: sessionId, repo: repo || cwd, cc_model: model,
+        reasoning: 'Literal credential (' + types + ') in the proposed command \u2014 blocked locally before grading; never sent to the model.',
+      });
+      finishWith({ permission: 'deny', user_message: '[synkro] bashGuard \u2192 BLOCKED: literal credential in command (' + types + '). Use an env var reference instead.', agent_message: remediation });
+    }
+
     if (isSafeInRepoRead(toolName, command, cwd)) {
       log('bashGuard ' + cmdShort + ' \u2192 instant allow (safe in-repo read)');
       appendLocalTelemetry({
@@ -6899,23 +6955,6 @@ async function main() {
     const rt = await route(config, synkroFile);
     const tagStr = tag(rt, config, graderPool);
 
-    // Secret firewall: BLOCK a literal credential in the command BEFORE it runs or
-    // reaches the grader \u2014 never leaks to a file, shell history, or the model
-    // (Anthropic/Cursor). Local + deterministic; $VAR / placeholder refs never trip it.
-    const secretHits = detectHardSecrets(command);
-    if (secretHits.length) {
-      const types = secretHits.map(h => h.type).join(', ');
-      const remediation = secretRemediation(command, secretHits);
-      log('bashGuard ' + cmdShort + ' \u2192 BLOCKED: literal credential (' + types + ')');
-      appendLocalTelemetry({
-        capture_type: 'local_verdict', verdict: 'block', hook_type: 'bash',
-        category: 'secret_exposure', tool_name: toolName, command: scrubSecrets(command).slice(0, 200),
-        session_id: sessionId, repo: repo || cwd, cc_model: model,
-        reasoning: 'Literal credential (' + types + ') in the proposed command \u2014 blocked locally before grading; never sent to the model.',
-      });
-      finishWith({ permission: 'deny', user_message: tagStr + ' bashGuard \u2192 BLOCKED: literal credential in command (' + types + '). Use an env var reference instead.', agent_message: remediation });
-    }
-
     // Install protection \u2014 install-scan runs first and owns block traces.
     let scanConcern = '';
     let scanBlockContext = '';
@@ -11230,7 +11269,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.92")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.94")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -15295,7 +15334,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.92");
+  console.log("1.6.94");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents