@synkro-sh/cli 1.7.93 → 1.7.94

package/dist/bootstrap.js

@@ -147,7 +147,7 @@ function getIdentity() {
   if (cached2) return cached2;
   let cliVersion = "0.0.0";
   try {
-    cliVersion = "1.7.93";
+    cliVersion = "1.7.94";
   } catch {
   }
   const creds = loadCredentialsIdentity();
@@ -2147,7 +2147,7 @@ var init_codexHookConfig = __esm({
 
 // cli/installer/codexHookTrust.ts
 import { spawn as spawn2 } from "child_process";
-function parseCodexHookTrustOutput(stdout) {
+function parseCodexHookTrustRecords(stdout) {
   for (const line of stdout.split("\n")) {
     let message;
     try {
@@ -2159,20 +2159,41 @@ function parseCodexHookTrustOutput(stdout) {
     if (!Array.isArray(data)) continue;
     const hooks = data.flatMap((entry) => Array.isArray(entry?.hooks) ? entry.hooks : []).filter((hook) => typeof hook.command === "string" && isSynkroHookCommand(hook.command));
     if (!hooks.length) return null;
-    return {
-      total: hooks.length,
-      trusted: hooks.filter((hook) => hook.trustStatus === "trusted" || hook.trustStatus === "managed").length,
-      needsReview: hooks.filter((hook) => hook.trustStatus === "modified" || hook.trustStatus === "untrusted").length,
-      disabled: hooks.filter((hook) => hook.enabled === false).length
-    };
+    return hooks;
   }
   return null;
 }
-function inspectCodexHookTrust(codexBinary = "codex", cwd = process.cwd()) {
+function summarizeCodexHookTrust(hooks) {
+  return {
+    total: hooks.length,
+    trusted: hooks.filter((hook) => hook.trustStatus === "trusted" || hook.trustStatus === "managed").length,
+    needsReview: hooks.filter((hook) => hook.trustStatus === "modified" || hook.trustStatus === "untrusted").length,
+    disabled: hooks.filter((hook) => hook.enabled === false).length
+  };
+}
+function parseCodexHookTrustOutput(stdout) {
+  const hooks = parseCodexHookTrustRecords(stdout);
+  return hooks ? summarizeCodexHookTrust(hooks) : null;
+}
+function buildCodexHookTrustEdits(hooks) {
+  const edits = /* @__PURE__ */ new Map();
+  for (const hook of hooks) {
+    if (typeof hook.command !== "string" || !isSynkroHookCommand(hook.command) || typeof hook.key !== "string" || !hook.key || typeof hook.currentHash !== "string" || !/^sha256:[0-9a-f]{64}$/i.test(hook.currentHash)) continue;
+    const edit = {
+      keyPath: `hooks.state.${JSON.stringify(hook.key)}.trusted_hash`,
+      value: hook.currentHash,
+      mergeStrategy: "upsert"
+    };
+    edits.set(edit.keyPath, edit);
+  }
+  return [...edits.values()];
+}
+function queryCodexHookTrust(codexBinary = "codex", cwd = process.cwd(), autoTrust = false) {
   return new Promise((resolve6) => {
     let settled = false;
     let stdout = "";
     let pending = "";
+    let hooks = null;
     let child;
     const finish = (summary) => {
       if (settled) return;
@@ -2217,7 +2238,32 @@ function inspectCodexHookTrust(codexBinary = "codex", cwd = process.cwd()) {
               params: { cwds: [cwd] }
             }) + "\n");
           } else if (message?.id === 2) {
-            finish(parseCodexHookTrustOutput(line));
+            hooks = parseCodexHookTrustRecords(line);
+            if (!hooks || !autoTrust) {
+              finish(hooks ? summarizeCodexHookTrust(hooks) : null);
+              continue;
+            }
+            const edits = buildCodexHookTrustEdits(hooks);
+            if (!edits.length) {
+              finish(summarizeCodexHookTrust(hooks));
+              continue;
+            }
+            child.stdin.write(JSON.stringify({
+              id: 3,
+              method: "config/batchWrite",
+              params: { edits, reloadUserConfig: true }
+            }) + "\n");
+          } else if (message?.id === 3) {
+            if (message?.result?.status !== "ok" || !hooks) {
+              finish(hooks ? summarizeCodexHookTrust(hooks) : null);
+              continue;
+            }
+            finish({
+              total: hooks.length,
+              trusted: hooks.length,
+              needsReview: 0,
+              disabled: hooks.filter((hook) => hook.enabled === false).length
+            });
           }
         }
       });
@@ -2234,6 +2280,9 @@ function inspectCodexHookTrust(codexBinary = "codex", cwd = process.cwd()) {
     }
   });
 }
+function trustCodexHooks(codexBinary = "codex", cwd = process.cwd()) {
+  return queryCodexHookTrust(codexBinary, cwd, true);
+}
 function codexHookTrustLines(summary) {
   if (!summary) {
     return [
@@ -2254,7 +2303,7 @@ function codexHookTrustLines(summary) {
   ];
 }
 async function reportCodexHookTrust(codexBinary, cwd) {
-  const summary = await inspectCodexHookTrust(codexBinary || "codex", cwd);
+  const summary = await trustCodexHooks(codexBinary || "codex", cwd);
   for (const line of codexHookTrustLines(summary)) console.log(line);
   return summary;
 }
@@ -2428,9 +2477,54 @@ function removeCodexManagedBlock(content, path) {
   if (inside) throw new Error(`Incomplete Synkro MCP marker block in ${path}`);
   return { content: out.join("\n").replace(/\n{3,}$/g, "\n\n"), removed };
 }
-function hasUnmanagedCodexEntry(content) {
-  const section = /^\s*\[\s*mcp_servers\s*\.\s*(?:"synkro-guardrails"|'synkro-guardrails'|synkro-guardrails)\s*\]\s*(?:#.*)?$/m;
-  return section.test(content);
+function findCodexMcpSection(content) {
+  const section = /^\s*\[\s*mcp_servers\s*\.\s*(?:"synkro-guardrails"|'synkro-guardrails'|synkro-guardrails)\s*\]\s*(?:#.*)?$/gm;
+  const match = section.exec(content);
+  if (!match) return null;
+  const nextSection = /^\s*\[{1,2}[^\r\n]+?\]{1,2}\s*(?:#.*)?$/gm;
+  nextSection.lastIndex = match.index + match[0].length;
+  const next = nextSection.exec(content);
+  return {
+    start: match.index,
+    end: next?.index ?? content.length,
+    body: content.slice(match.index, next?.index ?? content.length)
+  };
+}
+function readTomlString(block, key) {
+  const match = block.match(new RegExp(`^\\s*${key}\\s*=\\s*("(?:[^"\\\\]|\\\\.)*")\\s*$`, "m"));
+  if (!match) return null;
+  try {
+    return JSON.parse(match[1]);
+  } catch {
+    return null;
+  }
+}
+function isRecognizedCodexEntry(block, expectedUrl) {
+  const command = readTomlString(block, "command");
+  const argsLine = block.match(/^\s*args\s*=\s*(\[[^\r\n]*\])\s*$/m);
+  if (command && argsLine) {
+    try {
+      const args2 = JSON.parse(argsLine[1]);
+      if (/(?:^|[\\/])bun(?:\.exe)?$/i.test(command) && Array.isArray(args2) && args2.length === 2 && args2[0] === "run" && args2[1] === MCP_STDIO_PROXY_PATH) return true;
+    } catch {
+    }
+  }
+  const url = readTomlString(block, "url");
+  return Boolean(expectedUrl && url === expectedUrl);
+}
+function stripDetachedCodexMarkers(content) {
+  return content.split("\n").filter((line) => line.trim() !== CODEX_MCP_BEGIN && line.trim() !== CODEX_MCP_END).join("\n");
+}
+function removeRecognizedCodexEntry(content, path, expectedUrl) {
+  const range = findCodexMcpSection(content);
+  if (!range) return { content, removed: false };
+  if (!isRecognizedCodexEntry(range.body, expectedUrl)) {
+    throw new Error(
+      `${path} already defines ${CODEX_MCP_SECTION}; remove or rename that unmanaged entry before installing Synkro`
+    );
+  }
+  const next = `${content.slice(0, range.start)}${content.slice(range.end)}`;
+  return { content: next.replace(/\n{3,}$/g, "\n\n"), removed: true };
 }
 function tomlString(value) {
   return JSON.stringify(value);
@@ -2438,16 +2532,17 @@ function tomlString(value) {
 function installCodexMcpConfig(opts) {
   const path = codexConfigPath(opts.configPath);
   const current = readCodexToml(path);
-  const withoutManaged = removeCodexManagedBlock(current, path).content;
-  if (hasUnmanagedCodexEntry(withoutManaged)) {
-    throw new Error(
-      `${path} already defines ${CODEX_MCP_SECTION}; remove or rename that unmanaged entry before installing Synkro`
-    );
-  }
+  const targetUrl = opts.local ? `stdio://${MCP_STDIO_PROXY_PATH}` : `${opts.gatewayUrl.replace(/\/$/, "")}/api/v1/mcp/guardrails`;
+  const withoutManaged = stripDetachedCodexMarkers(removeCodexManagedBlock(current, path).content);
+  const withoutExisting = removeRecognizedCodexEntry(
+    withoutManaged,
+    path,
+    opts.local ? void 0 : targetUrl
+  ).content;
   let url;
   let body;
   if (opts.local) {
-    url = `stdio://${MCP_STDIO_PROXY_PATH}`;
+    url = targetUrl;
     body = [
       `[${CODEX_MCP_SECTION}]`,
       `command = ${tomlString(opts.bunBin || resolveBunBin2())}`,
@@ -2456,7 +2551,7 @@ function installCodexMcpConfig(opts) {
     ];
   } else {
     if (!opts.bearerToken) throw new Error("Codex cloud MCP registration requires a bearer token");
-    url = `${opts.gatewayUrl.replace(/\/$/, "")}/api/v1/mcp/guardrails`;
+    url = targetUrl;
     body = [
       `[${CODEX_MCP_SECTION}]`,
       `url = ${tomlString(url)}`,
@@ -2464,7 +2559,7 @@ function installCodexMcpConfig(opts) {
       "enabled = true"
     ];
   }
-  const prefix = withoutManaged.trimEnd();
+  const prefix = withoutExisting.trimEnd();
   const managed = [CODEX_MCP_BEGIN, ...body, CODEX_MCP_END].join("\n");
   writeCodexTomlAtomic(path, `${prefix}${prefix ? "\n\n" : ""}${managed}
 `);
@@ -2475,8 +2570,19 @@ function uninstallCodexMcpConfig(configPath) {
   if (!existsSync13(path)) return false;
   const current = readCodexToml(path);
   const next = removeCodexManagedBlock(current, path);
-  if (!next.removed) return false;
-  writeCodexTomlAtomic(path, next.content.trimEnd() ? `${next.content.trimEnd()}
+  let content = stripDetachedCodexMarkers(next.content);
+  let removed = next.removed;
+  if (!removed) {
+    try {
+      const recognized = removeRecognizedCodexEntry(content, path);
+      content = recognized.content;
+      removed = recognized.removed;
+    } catch {
+      return false;
+    }
+  }
+  if (!removed) return false;
+  writeCodexTomlAtomic(path, content.trimEnd() ? `${content.trimEnd()}
 ` : "");
   return true;
 }
@@ -6765,7 +6871,7 @@ var init_dockerInstall = __esm({
     HOST_PGLITE_PORT = parseInt(process.env.SYNKRO_HOST_PGLITE_PORT || "15433", 10);
     CONTAINER_NAME = resolveContainerName();
     defaultImageVersion = () => {
-      if (true) return "1.7.93";
+      if (true) return "1.7.94";
       try {
         const pkg = JSON.parse(readFileSync17(new URL("../../package.json", import.meta.url), "utf8"));
         if (pkg.version) return pkg.version;
@@ -7734,7 +7840,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle2(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle2(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle2(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle2("1.7.93")}`
+    `SYNKRO_VERSION=${shellQuoteSingle2("1.7.94")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle2(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle2(safeUserId)}`);
@@ -8476,7 +8582,7 @@ async function installCommand(opts = {}) {
   await setTelemetryState({ enabled: true, remoteFlushEnabled: telemetryConsent });
   emit("install", {
     phase: "started",
-    cli_version_to: "1.7.93",
+    cli_version_to: "1.7.94",
     agents_detected: agents.map((a) => a.kind),
     with_github: false,
     with_local_cc: false,
@@ -14233,7 +14339,7 @@ var subArgs = args.slice(1);
 var isDetachedChild = process.env.SYNKRO_TELEMETRY_DETACHED === "1";
 var FLUSH_SKIP = /* @__PURE__ */ new Set(["grade", "version", "--version", "-v", "help", "--help", "-h", ""]);
 function printVersion() {
-  console.log("1.7.93");
+  console.log("1.7.94");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents