@synkro-sh/cli 1.3.23 → 1.3.25

package/dist/bootstrap.js

@@ -3333,7 +3333,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.3.23")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.3.25")}`
   ];
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
   if (safeOrgId) lines.push(`SYNKRO_ORG_ID=${shellQuoteSingle(safeOrgId)}`);
@@ -4381,14 +4381,38 @@ function getPrFiles(repo, prNumber) {
   ]);
   return data;
 }
+function getLastReviewedSha(repo, prNumber) {
+  try {
+    const reviews = ghJson([
+      "api",
+      `/repos/${repo}/pulls/${prNumber}/reviews?per_page=100`
+    ]);
+    const synkro = reviews.filter((r) => r.body?.includes("Synkro Security Review")).sort((a, b) => new Date(b.submitted_at).getTime() - new Date(a.submitted_at).getTime());
+    return synkro.length > 0 ? synkro[0].commit_id : null;
+  } catch {
+    return null;
+  }
+}
+function getChangedFilesSince(repo, baseSha, headSha) {
+  try {
+    const data = ghJson([
+      "api",
+      `/repos/${repo}/compare/${baseSha}...${headSha}`
+    ]);
+    return (data.files || []).map((f) => f.filename);
+  } catch {
+    return null;
+  }
+}
 async function fetchScanContext(gatewayUrl, apiKey, repo, prNumber, sha) {
+  const lastSha = getLastReviewedSha(repo, prNumber);
+  const changedFiles = lastSha && lastSha !== sha ? getChangedFilesSince(repo, lastSha, sha) : void 0;
   try {
-    const url = `${gatewayUrl.replace(/\/$/, "")}/api/pr-scans/scan-context?repo=${encodeURIComponent(repo)}&pr_number=${prNumber}&sha=${sha}`;
-    const headers = { "x-synkro-api-key": apiKey };
-    const ghToken = process.env.GH_TOKEN || process.env.GITHUB_TOKEN || "";
-    if (ghToken) headers["x-github-token"] = ghToken;
+    const url = `${gatewayUrl.replace(/\/$/, "")}/api/pr-scans/scan-context`;
     const resp = await fetch(url, {
-      headers,
+      method: "POST",
+      headers: { "x-synkro-api-key": apiKey, "Content-Type": "application/json" },
+      body: JSON.stringify({ sha, last_reviewed_sha: lastSha, changed_files: changedFiles }),
       signal: AbortSignal.timeout(15e3)
     });
     if (!resp.ok) return { scan_all: true };