@synkro-sh/cli 1.4.70 → 1.4.71

package/dist/bootstrap.js

@@ -147,11 +147,6 @@ function installCCHooks(settingsPath, config) {
         command: config.editPrecheckScriptPath,
         timeout: 30
       },
-      {
-        type: "command",
-        command: config.cwePrecheckScriptPath,
-        timeout: 30
-      },
       {
         type: "command",
         command: config.cvePrecheckScriptPath,
@@ -369,15 +364,15 @@ function installCursorHooks(hooksJsonPath, config) {
   });
   pushCcHook(h, "preToolUse", config.editPrecheckScriptPath, {
     timeout: 15,
-    matcher: "Write|Edit|StrReplace|MultiEdit|NotebookEdit|edit_file|reapply|edit_notebook"
+    matcher: "Write|Edit|StrReplace|MultiEdit|NotebookEdit|edit_file|reapply|edit_notebook|ApplyPatch|apply_patch"
   });
   pushCcHook(h, "preToolUse", config.cwePrecheckScriptPath, {
-    timeout: 15,
-    matcher: "Write|Edit|StrReplace|MultiEdit|NotebookEdit|edit_file|reapply|edit_notebook"
+    timeout: 60,
+    matcher: "Write|Edit|StrReplace|MultiEdit|NotebookEdit|edit_file|reapply|edit_notebook|ApplyPatch|apply_patch"
   });
   pushCcHook(h, "preToolUse", config.cvePrecheckScriptPath, {
-    timeout: 10,
-    matcher: "Write|Edit|StrReplace|MultiEdit|NotebookEdit|edit_file|reapply|edit_notebook"
+    timeout: 20,
+    matcher: "Write|Edit|StrReplace|MultiEdit|NotebookEdit|edit_file|reapply|edit_notebook|ApplyPatch|apply_patch"
   });
   pushCcHook(h, "preToolUse", config.agentJudgeScriptPath, {
     timeout: 15,
@@ -1437,11 +1432,40 @@ export function ruleMode(ruleId: string, rules: Rule[]): 'blocking' | 'audit' {
 
 // \u2500\u2500\u2500 Content Reconstruction \u2500\u2500\u2500
 
+function patchTextFromToolInput(toolInput: any): string {
+  return String(toolInput.patch ?? toolInput.content ?? toolInput.code_edit ?? toolInput.new_string ?? toolInput.input ?? toolInput.diff ?? '');
+}
+
+function filePathFromPatch(patchText: string): string {
+  const match = patchText.match(/^\\*\\*\\* (?:Add|Update|Delete) File:\\s*(.+)$/m);
+  return match?.[1]?.trim() || '';
+}
+
+function contentFromPatch(patchText: string): string {
+  const addedOrContext = patchText
+    .split('\\n')
+    .filter(line => (line.startsWith('+') && !line.startsWith('+++')) || line.startsWith(' '))
+    .map(line => line.slice(1))
+    .join('\\n')
+    .trim();
+  return addedOrContext || patchText;
+}
+
+export function filePathFromToolInput(toolInput: any): string {
+  return toolInput.file_path || toolInput.notebook_path || toolInput.path || toolInput.target_file || filePathFromPatch(patchTextFromToolInput(toolInput));
+}
+
 export function reconstructContent(toolName: string, toolInput: any, filePath: string, cwd?: string): string {
   const canRead = filePath && cwd && isPathUnder(filePath, cwd);
   switch (toolName) {
+    case 'ApplyPatch':
+    case 'apply_patch':
+      return contentFromPatch(patchTextFromToolInput(toolInput));
     case 'Write':
       return toolInput.content || '';
+    case 'edit_file':
+    case 'reapply':
+      return toolInput.content || toolInput.new_string || toolInput.code_edit || '';
     case 'Edit': {
       let content = '';
       try {
@@ -1475,6 +1499,7 @@ export function reconstructContent(toolName: string, toolInput: any, filePath: s
       return content;
     }
     case 'NotebookEdit':
+    case 'edit_notebook':
       return toolInput.new_source || '';
     case 'StrReplace':
       return toolInput.new_string || toolInput.content || toolInput.code_edit || '';
@@ -1797,6 +1822,7 @@ export function dispatchFinding(
 
 export const EDIT_TOOL_NAMES = new Set([
   'Edit', 'Write', 'MultiEdit', 'NotebookEdit', 'StrReplace',
+  'edit_file', 'reapply', 'edit_notebook', 'ApplyPatch', 'apply_patch',
 ]);
 export const SHELL_TOOL_NAMES = new Set([
   'Bash', 'Shell', 'Read', 'Grep', 'Glob', 'terminal', 'run_terminal_cmd', 'execute_command',
@@ -1896,7 +1922,7 @@ export function outputEmpty(): void {
 import {
   loadJwt, ensureFreshJwt, detectRepo, loadConfig, route, tag, localGrade,
   parseVerdict, dispatchCapture, ruleMode, reconstructContent, isPathUnder, postWithRetry,
-  readStdin, extractTranscript, readLastPrompt, findNearestDeps, log,
+  readStdin, extractTranscript, readLastPrompt, findNearestDeps, filePathFromToolInput, log,
   outputJson, outputEmpty, setupCursorHookSignals, isEditTool, hookSessionId, GATEWAY_URL,
   type HookConfig, type Rule,
 } from './_synkro-common.ts';
@@ -1923,7 +1949,7 @@ async function main() {
     const permissionMode = payload.permission_mode || '';
     const transcriptPath = payload.transcript_path || '';
 
-    const filePath = toolInput.file_path || toolInput.notebook_path || toolInput.path || '';
+    const filePath = filePathFromToolInput(toolInput);
     if (!filePath) { outputEmpty(); return; }
 
     if (filePath.includes('/.synkro/hooks/')) { outputEmpty(); return; }
@@ -2105,11 +2131,11 @@ async function main() {
 
 main();
 `;
-    CWE_PRECHECK_TS = `#!/usr/bin/env bun
+    CWE_PRECHECK_TS = String.raw`#!/usr/bin/env bun
 import {
   loadJwt, ensureFreshJwt, detectRepo, loadConfig, cweRoute, tag,
   localGradeCwe, parseVerdict, reconstructContent, readStdin, log,
-  outputJson, outputEmpty, setupCursorHookSignals, isEditTool, hookSessionId, dispatchFinding, GATEWAY_URL,
+  outputJson, outputEmpty, setupCursorHookSignals, isEditTool, hookSessionId, filePathFromToolInput, dispatchFinding, dispatchCapture, GATEWAY_URL,
 } from './_synkro-common.ts';
 import { basename, extname } from 'node:path';
 
@@ -2131,29 +2157,28 @@ async function main() {
     const cwd = payload.cwd || '';
     const gitRepo = detectRepo(cwd || '.');
 
-    const filePath = toolInput.file_path || toolInput.notebook_path || toolInput.path || '';
+    const filePath = filePathFromToolInput(toolInput);
     if (!filePath) { outputEmpty(); return; }
 
     if (filePath.includes('/.synkro/hooks/')) { outputEmpty(); return; }
 
     const fileShort = basename(filePath);
-    const fileExt = extname(filePath); // e.g. ".ts"
+    const fileExt = extname(filePath);
 
     let jwt = loadJwt();
     if (!jwt) { outputEmpty(); return; }
     jwt = await ensureFreshJwt(jwt);
 
-    // Reconstruct proposed content
     const proposed = reconstructContent(toolName, toolInput, filePath, cwd);
     if (!proposed) { outputEmpty(); return; }
 
-    // Change-anchored window: for Edit/MultiEdit send context around the diff,
-    // for Write send first 4000 chars (new files have patterns at the top).
     let cweContent: string;
-    if (toolName === 'Edit' || toolName === 'MultiEdit') {
-      const newStr = toolName === 'Edit'
+    if (toolName === 'Edit' || toolName === 'MultiEdit' || toolName === 'edit_file' || toolName === 'reapply' || toolName === 'ApplyPatch' || toolName === 'apply_patch') {
+      const newStr = toolName === 'Edit' || toolName === 'edit_file' || toolName === 'reapply'
         ? (toolInput.new_string || '')
-        : (Array.isArray(toolInput.edits) ? toolInput.edits.map((e: any) => e?.new_string || '').join('\\n') : '');
+        : toolName === 'ApplyPatch' || toolName === 'apply_patch'
+          ? (toolInput.patch || toolInput.content || toolInput.code_edit || '')
+        : (Array.isArray(toolInput.edits) ? toolInput.edits.map((e: any) => e?.new_string || '').join('\n') : '');
       const changeIdx = proposed.indexOf(newStr);
       if (changeIdx >= 0 && proposed.length > 6000) {
         const start = Math.max(0, changeIdx - 2000);
@@ -2169,7 +2194,6 @@ async function main() {
     const config = await loadConfig(jwt);
     const rt = await cweRoute(config);
 
-    // Build set of exempted CWE IDs for this file path
     const exemptedCwes = new Set<string>();
     for (const ex of config.scanExemptions) {
       if (ex.cwe_id && filePath.includes(ex.path)) {
@@ -2177,14 +2201,13 @@ async function main() {
       }
     }
     if (config.silent) {
-      outputJson({ systemMessage: '[synkro:' + rt + ':cweScan] ' + fileShort + ' \\u2192 skipped (silent mode)' });
+      outputJson({ systemMessage: '[synkro:' + rt + ':cweScan] ' + fileShort + ' \u2192 skipped (silent mode)' });
       return;
     }
 
     const cweTag = '[synkro:' + rt + ':cweScan]';
 
     if (rt === 'local') {
-      // \u2500\u2500\u2500 Local CWE grading on channel 2 (port 8930) \u2500\u2500\u2500
       let cweRules: any[] = [];
       try {
         const resp = await fetch(GATEWAY_URL + '/api/v1/cwe-rules?ext=' + encodeURIComponent(fileExt), {
@@ -2196,7 +2219,7 @@ async function main() {
       } catch {}
 
       if (cweRules.length === 0) {
-        outputJson({ systemMessage: cweTag + ' ' + fileShort + ' \\u2192 clean (no CWE rules for ' + fileExt + ')' });
+        outputJson({ systemMessage: cweTag + ' ' + fileShort + ' \u2192 clean (no CWE rules for ' + fileExt + ')' });
         return;
       }
 
@@ -2207,38 +2230,37 @@ async function main() {
         '',
         'CWE rules to check against:',
         JSON.stringify(cweRules),
-      ].join('\\n');
+      ].join('\n');
 
       let gradeResp: string;
       try {
         gradeResp = await localGradeCwe(graderPrompt);
       } catch (gradeErr: any) {
         const reason = gradeErr?.message || String(gradeErr);
-        outputJson({ systemMessage: cweTag + ' ' + fileShort + ' \\u2192 grader unavailable (' + reason + '), skipped' });
+        outputJson({ systemMessage: cweTag + ' ' + fileShort + ' \u2192 grader unavailable (' + reason + '), skipped' });
         return;
       }
 
       const verdict = parseVerdict(gradeResp);
 
       if (!verdict.ok) {
-        const ruleIdMatches = gradeResp.match(/<rule_id>([^<]+)<\\/rule_id>/g) || [];
+        const ruleIdMatches = gradeResp.match(/<rule_id>([^<]+)<\/rule_id>/g) || [];
         const cweIds: string[] = [];
         for (const match of ruleIdMatches.slice(0, 5)) {
-          const id = match.replace(/<\\/?rule_id>/g, '').trim().replace(/^cwe-/, 'CWE-');
+          const id = match.replace(/<\/?rule_id>/g, '').trim().replace(/^cwe-/, 'CWE-');
           if (id && !cweIds.includes(id)) cweIds.push(id);
         }
 
-        const fixMatches = gradeResp.match(/<suggested_fix>([^<]+)<\\/suggested_fix>/g) || [];
+        const fixMatches = gradeResp.match(/<suggested_fix>([^<]+)<\/suggested_fix>/g) || [];
         const fixes: Record<string, string> = {};
         for (let i = 0; i < Math.min(cweIds.length, fixMatches.length); i++) {
-          fixes[cweIds[i]] = fixMatches[i].replace(/<\\/?suggested_fix>/g, '').trim();
+          fixes[cweIds[i]] = fixMatches[i].replace(/<\/?suggested_fix>/g, '').trim();
         }
 
-        // Filter out exempted CWEs for this file
         const activeCweIds = cweIds.filter(id => !exemptedCwes.has(id.toUpperCase()));
 
         if (activeCweIds.length === 0) {
-          outputJson({ systemMessage: cweTag + ' ' + fileShort + ' \\u2192 clean (exempted: ' + cweIds.join(', ') + ')' });
+          outputJson({ systemMessage: cweTag + ' ' + fileShort + ' \u2192 clean (exempted: ' + cweIds.join(', ') + ')' });
           return;
         }
 
@@ -2250,13 +2272,13 @@ async function main() {
         const displayIds = activeCweIds.slice(0, 3).join(', ');
         const count = activeCweIds.length;
         const label = count === 1 ? 'match' : 'matches';
-        const cweMsg = cweTag + ' ' + fileShort + ' \\u2192 ' + count + ' CWE ' + label + ' (' + displayIds + ')';
+        const cweMsg = cweTag + ' ' + fileShort + ' \u2192 ' + count + ' CWE ' + label + ' (' + displayIds + ')';
         const denyDetail = '[' + displayIds + '] ' + (verdict.reason || 'code weakness detected');
         const fixLines = activeCweIds
           .filter(id => fixes[id])
           .map(id => '[' + id + '] Fix: ' + fixes[id]);
-        const fixHint = fixLines.length > 0 ? '\\n' + fixLines.join('\\n') : '';
-        const ctx = 'CWE: ' + denyDetail + fixHint + '\\nFix all issues before retrying. Do NOT ask the user to make the edit manually \u2014 resolve the weakness in code yourself.';
+        const fixHint = fixLines.length > 0 ? '\n' + fixLines.join('\n') : '';
+        const ctx = 'CWE: ' + denyDetail + fixHint + '\nFix all issues before retrying. Do NOT ask the user to make the edit manually — resolve the weakness in code yourself.';
 
         for (const cweId of activeCweIds) {
           dispatchFinding(jwt, {
@@ -2299,16 +2321,14 @@ async function main() {
           reasoning: verdict.reason || 'no CWE weaknesses detected',
         });
 
-      const cleanMsg = cweTag + ' ' + fileShort + ' \\u2192 clean' + (verdict.reason ? ' (' + verdict.reason + ')' : '');
+      const cleanMsg = cweTag + ' ' + fileShort + ' \u2192 clean' + (verdict.reason ? ' (' + verdict.reason + ')' : '');
       outputJson({ systemMessage: cleanMsg, hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: cleanMsg } });
       return;
     }
 
-    // \u2500\u2500\u2500 Cloud CWE grading (handled by server) \u2500\u2500\u2500
-    // Cloud edit precheck already includes CWE \u2014 this hook is a no-op for cloud.
     outputEmpty();
   } catch (err) {
-    process.stderr.write('[synkro] cweGuard error: ' + String(err) + '\\n');
+    process.stderr.write('[synkro] cweGuard error: ' + String(err) + '\n');
     outputEmpty();
   }
 }
@@ -2318,7 +2338,7 @@ main();
     CVE_PRECHECK_TS = `#!/usr/bin/env bun
 import {
   loadJwt, ensureFreshJwt, detectRepo, loadConfig, route, tag,
-  reconstructContent, readStdin, findNearestDeps, log,
+  reconstructContent, readStdin, findNearestDeps, filePathFromToolInput, log,
   outputJson, outputEmpty, setupCursorHookSignals, isEditTool, hookSessionId, dispatchFinding, dispatchCapture, GATEWAY_URL,
 } from './_synkro-common.ts';
 import { basename } from 'node:path';
@@ -2354,7 +2374,7 @@ async function main() {
     const cwd = payload.cwd || '';
     const gitRepo = detectRepo(cwd || '.');
 
-    const filePath = toolInput.file_path || toolInput.notebook_path || toolInput.path || '';
+    const filePath = filePathFromToolInput(toolInput);
     if (!filePath) { outputEmpty(); return; }
 
     if (filePath.includes('/.synkro/hooks/')) { outputEmpty(); return; }
@@ -3924,7 +3944,7 @@ async function main() {
     if (!input.trim()) finish();
 
     const payload = JSON.parse(input);
-    const filePath = payload.file_path || '';
+    const filePath = payload.file_path || payload.path || payload.target_file || '';
     if (!filePath) finish();
 
     const cwd = payload.cwd || payload.workspace_roots?.[0] || '';
@@ -6229,7 +6249,6 @@ function writeHookScripts() {
   const bashScriptPath = join11(HOOKS_DIR, "cc-bash-judge.ts");
   const bashFollowupScriptPath = join11(HOOKS_DIR, "cc-bash-followup.ts");
   const editPrecheckScriptPath = join11(HOOKS_DIR, "cc-edit-precheck.ts");
-  const cwePrecheckScriptPath = join11(HOOKS_DIR, "cc-cwe-precheck.ts");
   const cvePrecheckScriptPath = join11(HOOKS_DIR, "cc-cve-precheck.ts");
   const planJudgeScriptPath = join11(HOOKS_DIR, "cc-plan-judge.ts");
   const agentJudgeScriptPath = join11(HOOKS_DIR, "cc-agent-judge.ts");
@@ -6245,7 +6264,6 @@ function writeHookScripts() {
   writeFileSync7(bashScriptPath, BASH_JUDGE_TS, "utf-8");
   writeFileSync7(bashFollowupScriptPath, BASH_FOLLOWUP_TS, "utf-8");
   writeFileSync7(editPrecheckScriptPath, EDIT_PRECHECK_TS, "utf-8");
-  writeFileSync7(cwePrecheckScriptPath, CWE_PRECHECK_TS, "utf-8");
   writeFileSync7(cvePrecheckScriptPath, CVE_PRECHECK_TS, "utf-8");
   writeFileSync7(planJudgeScriptPath, PLAN_JUDGE_TS, "utf-8");
   writeFileSync7(agentJudgeScriptPath, AGENT_JUDGE_TS, "utf-8");
@@ -7061,7 +7079,6 @@ console.log(\`[synkro] local MCP guardrails server listening on http://127.0.0.1
   chmodSync2(bashScriptPath, 493);
   chmodSync2(bashFollowupScriptPath, 493);
   chmodSync2(editPrecheckScriptPath, 493);
-  chmodSync2(cwePrecheckScriptPath, 493);
   chmodSync2(cvePrecheckScriptPath, 493);
   chmodSync2(planJudgeScriptPath, 493);
   chmodSync2(agentJudgeScriptPath, 493);
@@ -7078,7 +7095,6 @@ console.log(\`[synkro] local MCP guardrails server listening on http://127.0.0.1
     bashScript: bashScriptPath,
     bashFollowupScript: bashFollowupScriptPath,
     editPrecheckScript: editPrecheckScriptPath,
-    cwePrecheckScript: cwePrecheckScriptPath,
     cvePrecheckScript: cvePrecheckScriptPath,
     planJudgeScript: planJudgeScriptPath,
     agentJudgeScript: agentJudgeScriptPath,
@@ -7120,7 +7136,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.4.70")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.4.71")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -7249,7 +7265,6 @@ function isAlreadyInstalled() {
     join11(HOOKS_DIR, "cc-bash-judge.ts"),
     join11(HOOKS_DIR, "cc-bash-followup.ts"),
     join11(HOOKS_DIR, "cc-edit-precheck.ts"),
-    join11(HOOKS_DIR, "cc-cwe-precheck.ts"),
     join11(HOOKS_DIR, "cc-cve-precheck.ts"),
     join11(HOOKS_DIR, "cc-plan-judge.ts"),
     join11(HOOKS_DIR, "cc-stop-summary.ts"),
@@ -7556,7 +7571,6 @@ async function installCommand(opts = {}) {
         bashJudgeScriptPath: scripts.bashScript,
         bashFollowupScriptPath: scripts.bashFollowupScript,
         editPrecheckScriptPath: scripts.editPrecheckScript,
-        cwePrecheckScriptPath: scripts.cwePrecheckScript,
         cvePrecheckScriptPath: scripts.cvePrecheckScript,
         planJudgeScriptPath: scripts.planJudgeScript,
         agentJudgeScriptPath: scripts.agentJudgeScript,
@@ -7574,7 +7588,6 @@ async function installCommand(opts = {}) {
         editCaptureScriptPath: scripts.cursorEditCaptureScript,
         bashFollowupScriptPath: scripts.bashFollowupScript,
         editPrecheckScriptPath: scripts.editPrecheckScript,
-        cwePrecheckScriptPath: scripts.cwePrecheckScript,
         cvePrecheckScriptPath: scripts.cvePrecheckScript,
         planJudgeScriptPath: scripts.planJudgeScript,
         agentJudgeScriptPath: scripts.agentJudgeScript,
@@ -8207,7 +8220,6 @@ async function statusCommand() {
     "cc-bash-judge.ts",
     "cc-bash-followup.ts",
     "cc-edit-precheck.ts",
-    "cc-cwe-precheck.ts",
     "cc-cve-precheck.ts",
     "cc-plan-judge.ts",
     "cc-agent-judge.ts",
@@ -8221,7 +8233,6 @@ async function statusCommand() {
     "cursor-bash-judge.ts",
     "cursor-edit-capture.ts",
     "cc-edit-precheck.ts",
-    "cc-cwe-precheck.ts",
     "cc-cve-precheck.ts",
     "cc-agent-judge.ts",
     "cc-plan-judge.ts",