@synkro-sh/cli 1.7.24 → 1.7.30

package/dist/bootstrap.js

@@ -269,14 +269,10 @@ function installCCHooks(settingsPath, config) {
     ],
     [SYNKRO_MARKER]: true
   });
-  settings.env = settings.env ?? {};
-  const existingBaseUrl = settings.env.ANTHROPIC_BASE_URL;
-  if (!existingBaseUrl || existingBaseUrl === USAGE_PROXY_URL) {
-    settings.env.ANTHROPIC_BASE_URL = USAGE_PROXY_URL;
-  } else {
-    console.warn(`  \u26A0 ANTHROPIC_BASE_URL already set to ${existingBaseUrl} \u2014 leaving it; live usage capture is off for this agent.`);
+  if (settings.env && settings.env.ANTHROPIC_BASE_URL === USAGE_PROXY_URL) {
+    delete settings.env.ANTHROPIC_BASE_URL;
+    if (Object.keys(settings.env).length === 0) delete settings.env;
   }
-  if (Object.keys(settings.env).length === 0) delete settings.env;
   writeSettingsAtomic(settingsPath, settings);
 }
 function uninstallCCHooks(settingsPath) {
@@ -7146,6 +7142,15 @@ async function main() {
       const usage = aggregateUsage(transcriptPath, { modelFallback });
       emitUsageTick({ sessionId, usage, hookType: 'prompt_submit', gitRepo, modelFallback });
     }
+    // Nudge the local container to refresh account-wide coding-agent usage OUT OF BAND.
+    // The endpoint returns 202 immediately and does its own Anthropic ping, so this
+    // never gates the prompt; a stopped container just fails the fetch fast (caught).
+    try {
+      const usagePort = process.env.SYNKRO_MCP_HOST_PORT || '18931';
+      await fetch('http://127.0.0.1:' + usagePort + '/api/local/usage-poll', {
+        method: 'POST', signal: AbortSignal.timeout(1200),
+      }).catch(() => {});
+    } catch {}
     outputEmpty();
   } catch {
     outputEmpty();
@@ -7821,8 +7826,22 @@ export async function runStub(surface: string, opts: StubOpts = {}): Promise<voi
     // wait above that budget — not the 6s telemetry default — or the stub abandons
     // the request before the result lands and the completion shows up a hook late.
     const timeoutMs = surface === 'bash-followup' ? 32000 : (opts.telemetry ? 6000 : 28000);
-    const url = 'http://127.0.0.1:' + PORT + '/api/scan/' + surface + (harness === 'cursor' ? '?harness=cursor' : '');
-    const body = JSON.stringify(envelope);
+    // Cloud has no local container to reach. Post the SAME envelope to the org's grader
+    // via the gateway's /grade/submit as role 'scan:<surface>'; the container runs
+    // scanRouter (runScan) server-side and returns the SAME shaped decision — so cloud
+    // and local share ONE grading implementation, no client-side parsing. The gateway
+    // accepts the durable 1yr MCP token (verifyOrg → org-derived, tenant-safe).
+    const cloud = deployIsCloud();
+    // Regex-free trailing-slash trim — this is inside a template literal, where a
+    // regex like /\\/+$/ mis-escapes into broken emitted code (smoke:hooks catches it).
+    let gwBase = cfgVal('SYNKRO_GATEWAY_URL') || 'https://api.synkro.sh';
+    while (gwBase.endsWith('/')) gwBase = gwBase.slice(0, -1);
+    const url = cloud
+      ? gwBase + '/grade/submit'
+      : 'http://127.0.0.1:' + PORT + '/api/scan/' + surface + (harness === 'cursor' ? '?harness=cursor' : '');
+    const body = cloud
+      ? JSON.stringify({ role: 'scan:' + surface, payload: JSON.stringify(envelope), content: '' })
+      : JSON.stringify(envelope);
     const headers = { 'Content-Type': 'application/json', Authorization: 'Bearer ' + loadMcpJwt() };
     // Telemetry hooks (bash-followup, transcript-sync, session telemetry) IGNORE the
     // response and the server processes them DETACHED, so delivery RELIABILITY beats
@@ -10563,13 +10582,14 @@ async function dockerInstall(opts = {}) {
   }
   mkdirSync8(CURSOR_CREDS_DIR, { recursive: true });
   if (needsKeychainBridge()) {
-    if (claudeWorkers > 0) {
-      const path = exportKeychainCreds();
-      if (!path) {
+    const claudeCredsPath = exportKeychainCreds();
+    if (!claudeCredsPath) {
+      if (claudeWorkers > 0) {
         throw new DockerInstallError(
           "Claude Code keychain entry not found. Run `claude login` (or open Claude Code and sign in) before installing the container."
         );
       }
+      console.warn("  \u26A0 Claude Code keychain entry not found \u2014 live usage telemetry stays off until you sign in to Claude Code (grading is unaffected).");
     }
     if (cursorWorkers > 0 && !cursorApiKeyConfigured()) {
       console.warn("  \u26A0 No Cursor API key found \u2014 Cursor grader workers will be idle.");
@@ -10623,8 +10643,6 @@ async function dockerInstall(opts = {}) {
     "-p",
     `127.0.0.1:${HOST_CWE_PORT}:8930`,
     "-p",
-    `127.0.0.1:${HOST_USAGE_PROXY_PORT}:8927`,
-    "-p",
     `127.0.0.1:${HOST_PGLITE_PORT}:5433`,
     "-v",
     `${PGDATA_PATH}:/data/pgdata`,
@@ -10875,7 +10893,7 @@ function checkPgdata() {
   if (!hasPgControl) return { healthy: false, details: "pg_control/global directory missing" };
   return { healthy: true, details: `${entries.length} entries, WAL present, no stale PID` };
 }
-var SYNKRO_DIR2, MCP_JWT_PATH, PGDATA_PATH, CLAUDE_HOST_STATE_DIR, CLAUDE_HOST_STATE_FILE, HOST_MCP_PORT, HOST_GRADER_PORT, HOST_CWE_PORT, HOST_USAGE_PROXY_PORT, HOST_PGLITE_PORT, CONTAINER_NAME, DEFAULT_IMAGE, DockerInstallError, BACKUP_DIR;
+var SYNKRO_DIR2, MCP_JWT_PATH, PGDATA_PATH, CLAUDE_HOST_STATE_DIR, CLAUDE_HOST_STATE_FILE, HOST_MCP_PORT, HOST_GRADER_PORT, HOST_CWE_PORT, HOST_PGLITE_PORT, CONTAINER_NAME, DEFAULT_IMAGE, DockerInstallError, BACKUP_DIR;
 var init_dockerInstall = __esm({
   "cli/local-cc/dockerInstall.ts"() {
     "use strict";
@@ -10889,7 +10907,6 @@ var init_dockerInstall = __esm({
     HOST_MCP_PORT = parseInt(process.env.SYNKRO_HOST_MCP_PORT || "18931", 10);
     HOST_GRADER_PORT = parseInt(process.env.SYNKRO_HOST_GRADER_PORT || "18929", 10);
     HOST_CWE_PORT = parseInt(process.env.SYNKRO_HOST_CWE_PORT || "18930", 10);
-    HOST_USAGE_PROXY_PORT = parseInt(process.env.SYNKRO_HOST_USAGE_PROXY_PORT || "18927", 10);
     HOST_PGLITE_PORT = parseInt(process.env.SYNKRO_HOST_PGLITE_PORT || "15433", 10);
     CONTAINER_NAME = "synkro-server";
     DEFAULT_IMAGE = "ghcr.io/synkro-sh/synkro-server:latest";
@@ -11756,7 +11773,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.7.24")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.7.30")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -12378,13 +12395,7 @@ async function installCommand(opts = {}) {
   }
   const transcriptConsent = transcriptCC || transcriptCursor;
   ensureSynkroDir();
-  let hookMode = opts.hookMode || resolvePersistedHookMode();
-  if (target === "cloud-container" && hookMode === "stub") {
-    if (opts.hookMode === "stub") {
-      console.log("  \u24D8 Cloud mode needs full hooks (stub hooks require a local container) \u2014 using full.\n");
-    }
-    hookMode = "full";
-  }
+  const hookMode = opts.hookMode || resolvePersistedHookMode();
   const scripts = writeHookScripts(hookMode);
   console.log("Wrote hook scripts to ~/.synkro/hooks/\n");
   for (const mode of ["edit", "bash"]) {
@@ -15962,7 +15973,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.7.24");
+  console.log("1.7.30");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents