@synkro-sh/cli 1.6.96 → 1.6.97

package/dist/bootstrap.js

@@ -1750,7 +1750,7 @@ async function cloudGrade(surface: string, prompt: string, jwt: string, timeoutM
 // to the org's dispatcher /submit), but to the hosted ingress with the gateway
 // JWT (the Worker derives the org from the token and routes to that org's
 // container). Any non-2xx throws so the caller's catch fails open.
-const CONTAINERS_URL = process.env.SYNKRO_CONTAINERS_URL || 'https://containers.synkro.sh';
+const CONTAINERS_URL = process.env.SYNKRO_CONTAINERS_URL || 'https://api.synkro.sh';
 // Cloud grades cross the network and can hit a cold/queued worker, so they get a
 // longer leash than on-device channel grades. The hook chain is sized around it:
 // grade abort (45s) < watchdog (48s) < CC hook budget (50s) \u2014 the grade aborts
@@ -1832,6 +1832,39 @@ export async function cloudTaskDrift(envelope: Record<string, unknown>, jwt: str
   }
 }
 
+// Cloud task COMPLETION sweep \u2014 the end-of-turn FINAL CHECK (fired from the Stop hook).
+// Hits the org container's 'task-complete' surface: verify EVERY requirement against the
+// actual written code (file snapshots + transcript), mark met/open, and retire if all
+// met. Returns the result systemMessage ("complete \u2713 N/N retired" or "N/M \u2014 missing: \u2026").
+// payload.stop_hook_active MUST be falsey or handleTaskComplete bails (stop-loop guard).
+// Fail-silent: any hiccup returns '' so a flaky sweep never blocks the agent stopping.
+export async function cloudTaskComplete(envelope: Record<string, unknown>, jwt: string, timeoutMs = CLOUD_GRADE_TIMEOUT_MS): Promise<string> {
+  const sid = typeof envelope.sessionId === 'string' ? envelope.sessionId : undefined;
+  const repo = typeof envelope.cwd === 'string' ? envelope.cwd : undefined;
+  try {
+    const body = JSON.stringify({ role: 'task-complete', payload: scrubSecrets(JSON.stringify(envelope)), content: '' });
+    const resp = await fetch(CONTAINERS_URL + '/grade/submit', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
+      body,
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (!resp.ok) {
+      void logGraderUnavailable('taskComplete', 'task-complete', 'http ' + resp.status, undefined, { sessionId: sid, repo }).catch(() => {});
+      return '';
+    }
+    const j = await resp.json() as { systemMessage?: unknown };
+    return typeof j?.systemMessage === 'string' ? j.systemMessage : '';
+  } catch (e) {
+    const err = e as { name?: string; message?: string };
+    const reason = err?.name === 'TimeoutError'
+      ? 'task-complete timed out after ' + timeoutMs + 'ms'
+      : (err?.message || 'task-complete failed');
+    void logGraderUnavailable('taskComplete', 'task-complete', reason, undefined, { sessionId: sid, repo }).catch(() => {});
+    return '';
+  }
+}
+
 // Option B: when a cloud grade fails (esp. a timeout), the REAL reason lives
 // inside the container, not on the wire \u2014 the client only ever sees "timed out".
 // Pull the org's per-worker claude/cursor sick reasons + log tails from the
@@ -6533,6 +6566,7 @@ import {
   loadJwt, detectRepo, loadConfig, tag, readStdin, aggregateUsage, cleanupSessionLog,
   outputJson, outputEmpty, shipCloud, setupCursorHookSignals, hookSessionId, GATEWAY_URL,
   resolveTranscriptPath, emitUsageTick, cursorModelFromPayload, log, synkroFilePresent,
+  cloudTaskComplete,
 } from './_synkro-common.ts';
 
 async function main() {
@@ -6584,10 +6618,20 @@ async function main() {
 
     cleanupSessionLog(sessionId);
 
+    // Cloud FINAL CHECK: the agent stopped after editing \u2014 sweep the active task,
+    // verify EVERY requirement against the actual written code, and retire if all met.
+    // Returns '' when there's no active task (cheap getActiveTask short-circuit) or in
+    // local mode. stop_hook_active passes through so handleTaskComplete's stop-loop guard
+    // works (it bails when already inside a stop loop).
+    const taskMsg = process.env.SYNKRO_DEPLOY_LOCATION === 'cloud'
+      ? await cloudTaskComplete({ payload: { stop_hook_active: payload.stop_hook_active === true }, harness: 'claude_code', cwd: gitRepo, sessionId }, jwt)
+      : '';
+    const taskSuffix = taskMsg ? '\\n' + taskMsg : '';
+
     if (!findings) {
-      outputJson({ systemMessage: tagStr + ' stop \u2192 0 issues across ' + edits + ' edit(s), session complete' });
+      outputJson({ systemMessage: tagStr + ' stop \u2192 0 issues across ' + edits + ' edit(s), session complete' + taskSuffix });
     } else {
-      outputJson({ systemMessage: tagStr + ' stop \u2192 ' + findings + ' finding(s): ' + autoFixed + ' auto-fixed, ' + open + ' open' });
+      outputJson({ systemMessage: tagStr + ' stop \u2192 ' + findings + ' finding(s): ' + autoFixed + ' auto-fixed, ' + open + ' open' + taskSuffix });
     }
   } catch (err) {
     log('stopSummary error: ' + String(err));
@@ -6659,7 +6703,7 @@ async function main() {
 
     const fakeConfig: HookConfig = { captureDepth: 'local_only', tier: 'standard', silent, policyName, rules: [], scanExemptions: [], gradingMode, storageMode: process.env.SYNKRO_STORAGE_MODE || 'local' };
     const tagStr = tag(rt, fakeConfig);
-    const routeLine = tagStr + ' inference: ' + (gradingMode === 'byok' ? 'cloud (BYOK)' : deployCloud ? 'cloud container (containers.synkro.sh)' : isChannelUp ? 'local-cc (channel reachable on 127.0.0.1:18929)' : 'cloud (local-cc channel not reachable)');
+    const routeLine = tagStr + ' inference: ' + (gradingMode === 'byok' ? 'cloud (BYOK)' : deployCloud ? 'cloud container' : isChannelUp ? 'local-cc (channel reachable on 127.0.0.1:18929)' : 'cloud (local-cc channel not reachable)');
 
     if (!jwt) {
       outputJson({ systemMessage: routeLine });
@@ -11366,7 +11410,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.96")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.97")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -11539,7 +11583,7 @@ async function printWorkerDebug(base, jwt2) {
   }
 }
 async function verifyCloudGrader(jwt2) {
-  const base = (process.env.SYNKRO_CONTAINERS_URL || "https://containers.synkro.sh").replace(/\/$/, "");
+  const base = (process.env.SYNKRO_CONTAINERS_URL || "https://api.synkro.sh").replace(/\/$/, "");
   console.log("  Warming the cloud grader (booting container + checking workers)...");
   const deadline = Date.now() + 18e4;
   let healthy = 0;
@@ -11743,7 +11787,7 @@ async function recycleCloudContainer() {
     console.error("No access token \u2014 run `synkro login`.");
     return;
   }
-  const base = (process.env.SYNKRO_CONTAINERS_URL || "https://containers.synkro.sh").replace(/\/$/, "");
+  const base = (process.env.SYNKRO_CONTAINERS_URL || "https://api.synkro.sh").replace(/\/$/, "");
   console.log("Synkro: recycling the cloud grader container (destroy \u2192 fresh boot)\u2026");
   try {
     const r = await fetch(`${base}/recycle`, { method: "POST", headers: { Authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(3e4) });
@@ -15394,7 +15438,7 @@ To change:`);
     console.log("  BYOK grading uses your own provider key \u2014 register one in the");
     console.log("  dashboard under Settings \u2192 Provider Keys if you have not already.");
   } else if (inferenceValue === "cloud") {
-    console.log("  Grading runs on the Synkro cloud worker pool (containers.synkro.sh).");
+    console.log("  Grading runs on the Synkro cloud worker pool.");
   }
   if (inferenceValue !== "cloud") await reconcileContainer();
 }
@@ -15431,7 +15475,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.96");
+  console.log("1.6.97");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents