@synkro-sh/cli 1.4.53 → 1.4.55

package/dist/bootstrap.js

@@ -1617,6 +1617,8 @@ async function main() {
     const filePath = toolInput.file_path || toolInput.notebook_path || toolInput.path || '';
     if (!filePath) { outputEmpty(); return; }
 
+    if (filePath.includes('/.synkro/hooks/')) { outputEmpty(); return; }
+
     const fileShort = basename(filePath);
     log('editGuard checking: ' + fileShort);
 
@@ -1690,7 +1692,7 @@ async function main() {
         const guardReason = (verdict.ruleId ? '(' + verdict.ruleId + ') ' : '') + (verdict.reason || 'policy violation');
 
         if (mode !== 'audit') {
-          const denyReason = 'Guard: ' + guardReason + '\\nFix all issues before retrying.';
+          const denyReason = 'Guard: ' + guardReason + '\\nFix all issues before retrying. Do NOT ask the user to make the edit manually \u2014 resolve the violation in code yourself.';
           dispatchCapture(jwt, 'edit', 'block', verdict.severity || 'critical', verdict.category || 'security',
             toolName, gitRepo, sessionId, config.captureDepth, {
               command: editContent, reasoning: guardReason,
@@ -1699,7 +1701,7 @@ async function main() {
             });
           outputJson({
             systemMessage: tagStr + ' editGuard ' + fileShort + ' \\u2192 blocked: ' + guardReason,
-            hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: denyReason },
+            hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: denyReason, additionalContext: denyReason },
           });
           return;
         }
@@ -1821,6 +1823,8 @@ async function main() {
     const filePath = toolInput.file_path || toolInput.notebook_path || toolInput.path || '';
     if (!filePath) { outputEmpty(); return; }
 
+    if (filePath.includes('/.synkro/hooks/')) { outputEmpty(); return; }
+
     const fileShort = basename(filePath);
     const fileExt = extname(filePath); // e.g. ".ts"
 
@@ -1892,11 +1896,11 @@ async function main() {
         const label = count === 1 ? 'match' : 'matches';
         const cweMsg = cweTag + ' ' + fileShort + ' \\u2192 ' + count + ' CWE ' + label + ' (' + displayIds + ')';
         const denyDetail = '[' + displayIds + '] ' + (verdict.reason || 'code weakness detected');
-        const ctx = 'CWE: ' + denyDetail + '\\nFix all issues before retrying.';
+        const ctx = 'CWE: ' + denyDetail + '\\nFix all issues before retrying. Do NOT ask the user to make the edit manually \u2014 resolve the weakness in code yourself.';
 
         outputJson({
           systemMessage: cweMsg,
-          hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: ctx },
+          hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: ctx, additionalContext: ctx },
         });
         return;
       }
@@ -1955,6 +1959,8 @@ async function main() {
     const filePath = toolInput.file_path || toolInput.notebook_path || toolInput.path || '';
     if (!filePath) { outputEmpty(); return; }
 
+    if (filePath.includes('/.synkro/hooks/')) { outputEmpty(); return; }
+
     const fileShort = basename(filePath);
 
     let jwt = loadJwt();
@@ -2020,11 +2026,11 @@ async function main() {
       const count = findings.length;
       const label = count === 1 ? 'advisory' : 'advisories';
       const cveMsg = cveTag + ' ' + fileShort + ' \\u2192 ' + count + ' ' + label;
-      const ctx = 'CVE: ' + top3 + '\\nFix all issues before retrying.';
+      const ctx = 'CVE: ' + top3 + '\\nFix all issues before retrying. Do NOT ask the user to make the edit manually \u2014 upgrade the vulnerable dependencies yourself.';
 
       outputJson({
         systemMessage: cveMsg,
-        hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: ctx },
+        hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: ctx, additionalContext: ctx },
       });
       return;
     }
@@ -5045,7 +5051,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.4.53")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.4.55")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);