@synkro-sh/cli 1.6.93 → 1.6.95

package/dist/bootstrap.js

@@ -1775,6 +1775,27 @@ async function hostedGrade(role: GradeRole, prompt: string, jwt: string, timeout
   return String(data.result || '');
 }
 
+// Cloud task-adherence: fire the task-only 'task-drift' surface on the org's
+// container and return ONLY the progress systemMessage (informational \u2014 never
+// blocks an edit). Fail-silent: any hiccup returns '' so task tracking can't
+// break grading. The payload IS a ScanEnvelope; the container runs getActiveTask
+// (resolved per (org,user,repo) via active_tasks) + taskDrift and returns the
+// decision. Secrets are scrubbed before the envelope crosses the network.
+export async function cloudTaskDrift(envelope: Record<string, unknown>, jwt: string, timeoutMs = 20000): Promise<string> {
+  try {
+    const body = JSON.stringify({ role: 'task-drift', payload: scrubSecrets(JSON.stringify(envelope)), content: '' });
+    const resp = await fetch(CONTAINERS_URL + '/grade/submit', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
+      body,
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (!resp.ok) return '';
+    const j = await resp.json() as { systemMessage?: unknown };
+    return typeof j?.systemMessage === 'string' ? j.systemMessage : '';
+  } catch { return ''; }
+}
+
 // Option B: when a cloud grade fails (esp. a timeout), the REAL reason lives
 // inside the container, not on the wire \u2014 the client only ever sees "timed out".
 // Pull the org's per-worker claude/cursor sick reasons + log tails from the
@@ -3666,6 +3687,31 @@ export function countEditLineDelta(source: {
   return { linesAdded, linesRemoved };
 }
 
+// Build the recorded edit diff (code_change) for the audit trail, same format as
+// the routed hook's summarizeEdit: trim the common prefix/suffix between the file
+// before the edit and the proposed full content, then emit minus/plus prefixed,
+// line-numbered rows (the dashboard CodeChangeCard colors each row by its leading
+// sign). Without this the event detail falls back to the raw file/content dump
+// instead of an added/removed diff.
+export function summarizeEditDiff(baseContent: string, proposed: string): string {
+  const EDIT_AUDIT_CAP = 16000;
+  const a = baseContent ? baseContent.split('\\n') : [];
+  const b = proposed ? proposed.split('\\n') : [];
+  let start = 0;
+  while (start < a.length && start < b.length && a[start] === b[start]) start++;
+  let endA = a.length;
+  let endB = b.length;
+  while (endA > start && endB > start && a[endA - 1] === b[endB - 1]) { endA--; endB--; }
+  const removed = a.slice(start, endA);
+  const added = b.slice(start, endB);
+  const out: string[] = [];
+  for (let i = 0; i < removed.length; i++) out.push('-' + String(start + 1 + i).padStart(5) + ' ' + removed[i]);
+  for (let i = 0; i < added.length; i++) out.push('+' + String(start + 1 + i).padStart(5) + ' ' + added[i]);
+  let diff = out.join('\\n');
+  if (diff.length > EDIT_AUDIT_CAP) diff = diff.slice(0, EDIT_AUDIT_CAP) + '\\n... [truncated]';
+  return diff;
+}
+
 /** Normalize model names so the same Cursor session doesn't split across agent buckets. */
 export function normalizeCaptureModel(model: string): string {
   const m = (model || '').trim();
@@ -4265,12 +4311,12 @@ export function outputEmpty(): void {
 `;
     EDIT_PRECHECK_TS = `#!/usr/bin/env bun
 import {
-  loadJwt, ensureFreshJwt, detectRepo, loadConfig, route, tag, localGrade,
+  loadJwt, ensureFreshJwt, detectRepo, loadConfig, route, tag, localGrade, cloudTaskDrift,
   parseVerdict, parseCombinedVerdict, combinedEditGradeEnabled, dispatchCapture, dispatchFinding, ruleMode, reconstructContent, editSecretDenial, isPathUnder, postWithRetry,
   readStdin, extractTranscript, readLastPrompt, findNearestDeps, filePathFromToolInput,
   appendSessionAction, readSessionLog, compressSessionLog, sessionLogForGrade, log,
   outputJson, outputEmpty, setupCursorHookSignals, installHookWatchdog, isEditTool, hookSessionId, GATEWAY_URL,
-  logGraderUnavailable, graderUnavailableMessage, filterRules, ruleFilterText, normalizeMode, countEditLineDelta,
+  logGraderUnavailable, graderUnavailableMessage, filterRules, ruleFilterText, normalizeMode, countEditLineDelta, summarizeEditDiff,
   captureLineMetrics, cursorModelFromPayload, resolveTranscriptPath, isCursorInvokingCcHook,
   loadSynkroFile, effectiveGraderPool, synkroFilePresent, noSynkroSkipMessage,
   type HookConfig, type Rule,
@@ -4365,6 +4411,11 @@ async function main() {
       try { fileBefore = readFileSync(fullPath, 'utf-8').slice(0, 65536); } catch {}
     }
 
+    // Audit diff (code_change): added/removed lines for the event detail's Code Change
+    // card. Base = the file before this edit (Write \u2192 file on disk if any). Captured on
+    // every edit verdict below so cloud-graded events show the diff, not a raw dump.
+    const editDiff = summarizeEditDiff(toolName === 'Write' ? existingContent : fileBefore, proposed);
+
     // Extract transcript context
     const transcript = extractTranscript(transcriptPath);
     const lastPrompt = readLastPrompt(sessionId);
@@ -4422,6 +4473,15 @@ async function main() {
       ].join('\\n');
       const graderPrompt = buildGraderPrompt(proposedShort);
 
+      // Cloud task-adherence (additive, informational): fire the task-only grade in
+      // PARALLEL with the rule grade so it adds no latency, then merge its progress
+      // message into the pass output. Fail-silent ('' on any issue). Sent as a
+      // synthetic Write of the reconstructed content so the container needs no base
+      // bytes. cwd = the repo identifier the container keys active_tasks on.
+      const taskDriftP: Promise<string> = process.env.SYNKRO_DEPLOY_LOCATION === 'cloud'
+        ? cloudTaskDrift({ payload: { tool_name: 'Write', tool_input: { file_path: filePath, content: proposedShort } }, harness: agentKind, cwd: gitRepo, sessionId }, jwt)
+        : Promise.resolve('');
+
       // \u2500\u2500\u2500 Combined org-rules + CWE in ONE inference (SYNKRO_COMBINED_EDIT_GRADE) \u2500\u2500\u2500
       // Self-contained early-return branch \u2014 the default two-grade path below is
       // left untouched. Appends the CWE rule set to the rules prompt, runs one
@@ -4500,7 +4560,7 @@ async function main() {
             toolName, gitRepo, sessionId, config.captureDepth, {
               command: editContent, reasoning: guardReason,
               rulesChecked: relevantRules, violatedRules,
-              ccModel: captureModel, ...lineMetrics,
+              ccModel: captureModel, codeChange: editDiff, ...lineMetrics,
             });
           outputJson({
             systemMessage: tagStr + ' editGuard ' + fileShort + ' \u2192 blocked: ' + guardReason + (cweFindings.length ? ' (+' + cweFindings.length + ' CWE)' : ''),
@@ -4524,10 +4584,11 @@ async function main() {
           toolName, gitRepo, sessionId, config.captureDepth, {
             command: editContent, reasoning: ruleVerdict.reason || 'no violations (rules + CWE)',
             rulesChecked: relevantRules, violatedRules: [],
-            ccModel: captureModel, ...lineMetrics,
+            ccModel: captureModel, codeChange: editDiff, ...lineMetrics,
           });
         const cPassLine = tagStr + ' editGuard ' + fileShort + ' \u2192 pass: ' + (ruleVerdict.reason || 'clean (rules + CWE)');
-        outputJson({ systemMessage: cPassLine, hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: 'Synkro combined edit judge (rules + CWE). ' + (ruleVerdict.reason || 'clean') } });
+        const cTaskMsg = await taskDriftP;
+        outputJson({ systemMessage: cPassLine + (cTaskMsg ? '\\n' + cTaskMsg : ''), hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: 'Synkro combined edit judge (rules + CWE). ' + (ruleVerdict.reason || 'clean') } });
         return;
       }
 
@@ -4556,7 +4617,7 @@ async function main() {
           toolName, gitRepo, sessionId, config.captureDepth, {
             command: editContent, reasoning: guardReason,
             rulesChecked: relevantRules, violatedRules,
-            ccModel: captureModel, ...lineMetrics,
+            ccModel: captureModel, codeChange: editDiff, ...lineMetrics,
           });
         outputJson({
           systemMessage: tagStr + ' editGuard ' + fileShort + ' \u2192 blocked: ' + guardReason,
@@ -4570,10 +4631,11 @@ async function main() {
         toolName, gitRepo, sessionId, config.captureDepth, {
           command: editContent, reasoning: verdict.reason || 'no policy violations detected',
           rulesChecked: relevantRules, violatedRules: [],
-          ccModel: captureModel, ...lineMetrics,
+          ccModel: captureModel, codeChange: editDiff, ...lineMetrics,
         });
       const passLine = tagStr + ' editGuard ' + fileShort + ' \u2192 pass: ' + (verdict.reason || 'no policy violations detected');
-      outputJson({ systemMessage: passLine, hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: 'Synkro local edit judge. ' + (verdict.reason || 'no policy violations detected') } });
+      const rTaskMsg = await taskDriftP;
+      outputJson({ systemMessage: passLine + (rTaskMsg ? '\\n' + rTaskMsg : ''), hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: 'Synkro local edit judge. ' + (verdict.reason || 'no policy violations detected') } });
       return;
     }
 
@@ -11237,7 +11299,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.93")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.95")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -15302,7 +15364,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.93");
+  console.log("1.6.95");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents