@synkro-sh/cli 1.6.93 → 1.6.94

package/dist/bootstrap.js

@@ -1775,6 +1775,27 @@ async function hostedGrade(role: GradeRole, prompt: string, jwt: string, timeout
   return String(data.result || '');
 }
 
+// Cloud task-adherence: fire the task-only 'task-drift' surface on the org's
+// container and return ONLY the progress systemMessage (informational \u2014 never
+// blocks an edit). Fail-silent: any hiccup returns '' so task tracking can't
+// break grading. The payload IS a ScanEnvelope; the container runs getActiveTask
+// (resolved per (org,user,repo) via active_tasks) + taskDrift and returns the
+// decision. Secrets are scrubbed before the envelope crosses the network.
+export async function cloudTaskDrift(envelope: Record<string, unknown>, jwt: string, timeoutMs = 20000): Promise<string> {
+  try {
+    const body = JSON.stringify({ role: 'task-drift', payload: scrubSecrets(JSON.stringify(envelope)), content: '' });
+    const resp = await fetch(CONTAINERS_URL + '/grade/submit', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
+      body,
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (!resp.ok) return '';
+    const j = await resp.json() as { systemMessage?: unknown };
+    return typeof j?.systemMessage === 'string' ? j.systemMessage : '';
+  } catch { return ''; }
+}
+
 // Option B: when a cloud grade fails (esp. a timeout), the REAL reason lives
 // inside the container, not on the wire \u2014 the client only ever sees "timed out".
 // Pull the org's per-worker claude/cursor sick reasons + log tails from the
@@ -4265,7 +4286,7 @@ export function outputEmpty(): void {
 `;
     EDIT_PRECHECK_TS = `#!/usr/bin/env bun
 import {
-  loadJwt, ensureFreshJwt, detectRepo, loadConfig, route, tag, localGrade,
+  loadJwt, ensureFreshJwt, detectRepo, loadConfig, route, tag, localGrade, cloudTaskDrift,
   parseVerdict, parseCombinedVerdict, combinedEditGradeEnabled, dispatchCapture, dispatchFinding, ruleMode, reconstructContent, editSecretDenial, isPathUnder, postWithRetry,
   readStdin, extractTranscript, readLastPrompt, findNearestDeps, filePathFromToolInput,
   appendSessionAction, readSessionLog, compressSessionLog, sessionLogForGrade, log,
@@ -4422,6 +4443,15 @@ async function main() {
       ].join('\\n');
       const graderPrompt = buildGraderPrompt(proposedShort);
 
+      // Cloud task-adherence (additive, informational): fire the task-only grade in
+      // PARALLEL with the rule grade so it adds no latency, then merge its progress
+      // message into the pass output. Fail-silent ('' on any issue). Sent as a
+      // synthetic Write of the reconstructed content so the container needs no base
+      // bytes. cwd = the repo identifier the container keys active_tasks on.
+      const taskDriftP: Promise<string> = process.env.SYNKRO_DEPLOY_LOCATION === 'cloud'
+        ? cloudTaskDrift({ payload: { tool_name: 'Write', tool_input: { file_path: filePath, content: proposedShort } }, harness: agentKind, cwd: gitRepo, sessionId }, jwt)
+        : Promise.resolve('');
+
       // \u2500\u2500\u2500 Combined org-rules + CWE in ONE inference (SYNKRO_COMBINED_EDIT_GRADE) \u2500\u2500\u2500
       // Self-contained early-return branch \u2014 the default two-grade path below is
       // left untouched. Appends the CWE rule set to the rules prompt, runs one
@@ -4527,7 +4557,8 @@ async function main() {
             ccModel: captureModel, ...lineMetrics,
           });
         const cPassLine = tagStr + ' editGuard ' + fileShort + ' \u2192 pass: ' + (ruleVerdict.reason || 'clean (rules + CWE)');
-        outputJson({ systemMessage: cPassLine, hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: 'Synkro combined edit judge (rules + CWE). ' + (ruleVerdict.reason || 'clean') } });
+        const cTaskMsg = await taskDriftP;
+        outputJson({ systemMessage: cPassLine + (cTaskMsg ? '\\n' + cTaskMsg : ''), hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: 'Synkro combined edit judge (rules + CWE). ' + (ruleVerdict.reason || 'clean') } });
         return;
       }
 
@@ -4573,7 +4604,8 @@ async function main() {
           ccModel: captureModel, ...lineMetrics,
         });
       const passLine = tagStr + ' editGuard ' + fileShort + ' \u2192 pass: ' + (verdict.reason || 'no policy violations detected');
-      outputJson({ systemMessage: passLine, hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: 'Synkro local edit judge. ' + (verdict.reason || 'no policy violations detected') } });
+      const rTaskMsg = await taskDriftP;
+      outputJson({ systemMessage: passLine + (rTaskMsg ? '\\n' + rTaskMsg : ''), hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: 'Synkro local edit judge. ' + (verdict.reason || 'no policy violations detected') } });
       return;
     }
 
@@ -11237,7 +11269,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.93")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.94")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -15302,7 +15334,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.93");
+  console.log("1.6.94");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents