@synkro-sh/cli 1.6.100 → 1.7.1

package/dist/bootstrap.js

@@ -1050,16 +1050,18 @@ export function log(msg: string): void {
 // \u2500\u2500\u2500 JWT Management \u2500\u2500\u2500
 
 export function loadJwt(): string | null {
-  // Cloud mode: prefer the long-lived (1yr) MCP token. It's org+user scoped and
-  // accepted on the whole cloud-hook surface (grade/submit, cwe-rules, hook/*,
-  // cli/*), so grading survives sessions far longer than the ~5-min WorkOS token.
-  // jwtIsExpired sees a year of runway, so ensureFreshJwt never needs to refresh.
-  if (process.env.SYNKRO_STORAGE_MODE === 'cloud') {
-    try {
-      const mcp = readFileSync(MCP_JWT_PATH, 'utf-8').trim();
-      if (mcp) return mcp;
-    } catch { /* no mcp token on disk \u2014 fall back to the login token below */ }
-  }
+  // Prefer the long-lived (1yr) Synkro MCP token in BOTH cloud and local mode.
+  // It's org+user scoped and accepted across the hook surface (grade/submit,
+  // cwe-rules, hook/*, cli/*), so a single 'synkro login' keeps grading + CWE
+  // detection alive for a year with NO refresh. The alternative \u2014 the ~5-min
+  // WorkOS access_token \u2014 rides a rotating refresh chain that dies with the
+  // WorkOS session (invalid_grant "session has already ended"), which silently
+  // disabled CWE findings while editGuard/cveScan (which don't need this token)
+  // kept working. jwtIsExpired sees a year of runway, so we never hit refreshJwt.
+  try {
+    const mcp = readFileSync(MCP_JWT_PATH, 'utf-8').trim();
+    if (mcp) return mcp;
+  } catch { /* no mcp token on disk \u2014 fall back to the login token below */ }
   try {
     if (!existsSync(CREDS_PATH)) return null;
     const creds = JSON.parse(readFileSync(CREDS_PATH, 'utf-8'));
@@ -4617,8 +4619,16 @@ async function main() {
         const cweFindings = [...cweMap.values()];
         const editContent = 'file=' + filePath + ' content=' + proposed.slice(0, 2000);
         const violatedRules = ruleVerdict.ruleId ? [ruleVerdict.ruleId] : [];
-        const cweBlock = cweFindings.slice(0, 5)
-          .map(f => '[' + f.id + '] ' + (f.reason || 'weakness') + (f.suggestedFix ? ' Fix: ' + f.suggestedFix : ''))
+        // Include EVERY flagged CWE's description (not a 5-cap) so the agent can fix
+        // all of them \u2014 even 30 in one edit. Per-finding fallback: reason -> CWE name.
+        const cweClean = (s) => String(s == null ? '' : s).split('').map(c => { const k = c.charCodeAt(0); return (k < 32 || k === 127) ? ' ' : c; }).join('').replace(/  +/g, ' ').trim().slice(0, 400);
+        const cweId = (s) => String(s == null ? 'CWE-UNKNOWN' : s).replace(/[^A-Za-z0-9_-]/g, '').slice(0, 20) || 'CWE-UNKNOWN';
+        // One sentence each (trim at first . ! or ?) so several CWEs in one edit stay tight.
+        const cweOne = (s) => { const t = cweClean(s); const i = t.search(/[.!?]( [A-Z]|$)/); return (i >= 0 ? t.slice(0, i + 1) : t).slice(0, 220); };
+        // One line per CWE: explanation + Fix. Drop the Fix when it just restates the
+        // explanation so a single CWE never double-prints the same prose.
+        const cweBlock = cweFindings
+          .map(f => { const why = cweOne(f.reason || f.name || 'code weakness'); const fix = f.suggestedFix ? cweOne(f.suggestedFix) : ''; const showFix = fix && why.toLowerCase().indexOf(fix.slice(0, 40).toLowerCase()) === -1; return '[' + cweId(f.id) + '] ' + why + (showFix ? ' Fix: ' + fix : ''); })
           .join('\\n');
         for (const f of cweFindings) {
           dispatchFinding(jwt, { session_id: sessionId, file_path: filePath, finding_type: 'cwe', finding_id: f.id, status: 'open' }, config.captureDepth);
@@ -5126,7 +5136,9 @@ async function main() {
       const findings = Array.isArray(cweResp?.findings) ? cweResp.findings : [];
       if (cweResp?.action === 'deny' && findings.length > 0) {
         const activeCweIds = findings
-          .filter((f: any) => f.mode === 'blocking' || f.mode === 'ask')
+          // CWE is a separate, always-ask grader — a detected weakness is ALWAYS
+          // surfaced regardless of the rule's stored mode (fix/blocking/ask).
+          // Only path exemptions suppress it (matches the local-route branch).
           .map((f: any) => f.cwe)
           .filter((id: string) => !exemptedCwes.has(id.toUpperCase()));
 
@@ -5139,12 +5151,41 @@ async function main() {
         const label = count === 1 ? 'match' : 'matches';
         const cweMsg = cweTag + ' ' + fileShort + ' \u2192 ' + count + ' CWE ' + label + ' (' + displayIds + ')';
 
-        const fixLines = findings
-          .filter((f: any) => activeCweIds.includes(f.cwe) && f.suggested_fix)
-          .map((f: any) => '[' + f.cwe + '] Fix: ' + f.suggested_fix);
-        const fixHint = fixLines.length > 0 ? '\n' + fixLines.join('\n') : '';
-        const denyDetail = '[' + displayIds + '] ' + (findings[0]?.reason || 'code weakness detected');
-        const ctx = 'CWE: ' + denyDetail + fixHint + '\nFix all issues before retrying. Do NOT ask the user to make the edit manually \u2014 resolve the weakness in code yourself.';
+        // Sanitize any scan-derived text before embedding it in the agent message
+        // (CWE-20): bound length + strip control chars; constrain the CWE id shape.
+        const sanitizeDesc = (s: any) => String(s == null ? '' : s).replace(/[\x00-\x1F\x7F]/g, ' ').replace(/\s{2,}/g, ' ').trim().slice(0, 400);
+        const sanitizeId = (s: any) => String(s == null ? '' : s).replace(/[^A-Za-z0-9_-]/g, '').slice(0, 20).toUpperCase() || 'CWE-UNKNOWN';
+        // ONE sentence, hard-capped \u2014 keeps each line tight so 4+ CWEs in a single edit
+        // never blow the message-size limit. Trims at the first sentence terminator.
+        const oneSentence = (s: any) => { const t = sanitizeDesc(s); const m = t.match(/^[\s\S]*?[.!?](\s+(?=[A-Z])|$)/); return (m ? m[0] : t).trim().slice(0, 220); };
+        // ONE line per flagged CWE: a one-sentence explanation + a one-sentence Fix.
+        // The Fix is dropped when it merely restates the explanation (the grader
+        // sometimes echoes it) so the line never double-prints the same prose.
+        const cweSeen = new Set<string>();
+        const cweBlocks = activeCweIds
+          .map((cweId: string) => {
+            const sid = sanitizeId(cweId);
+            if (cweSeen.has(sid)) return '';
+            cweSeen.add(sid);
+            const f = findings.find((x: any) => x.cwe === cweId);
+            const why = oneSentence(f && (f.reason || f.name) ? (f.reason || f.name) : 'code weakness detected');
+            const fix = f && f.suggested_fix ? oneSentence(f.suggested_fix) : '';
+            const showFix = !!fix && !why.toLowerCase().includes(fix.slice(0, 40).toLowerCase());
+            return '[' + sid + '] ' + why + (showFix ? ' Fix: ' + fix : '');
+          })
+          .filter((line: string) => line.length > 0);
+        // Bound the total: list as many CWEs as fit, spill the rest to a "+N more" note
+        // (agent fixes the listed ones, then re-runs to surface the remainder).
+        const MAX_CWE_CHARS = 4000;
+        let denyDetail = cweBlocks.join('\n');
+        if (denyDetail.length > MAX_CWE_CHARS) {
+          const kept: string[] = [];
+          let used = 0;
+          for (const b of cweBlocks) { if (used + b.length + 1 > MAX_CWE_CHARS) break; kept.push(b); used += b.length + 1; }
+          const more = cweBlocks.length - kept.length;
+          denyDetail = kept.join('\n') + (more > 0 ? '\n(+' + more + ' more CWE weakness' + (more === 1 ? '' : 'es') + ' \u2014 fix these first, then re-run to surface the rest)' : '');
+        }
+        const ctx = 'CWE weaknesses to fix (' + count + '):\n' + denyDetail + '\nFix ALL of the above before retrying. Do NOT ask the user to make the edit manually \u2014 resolve every weakness in code yourself.';
 
         emitBlockScanFindings(
           jwt,
@@ -5290,6 +5331,7 @@ async function main() {
 
       const cweIds: string[] = [];
       const fixes: Record<string, string> = {};
+      const reasons: Record<string, string> = {};
       const snippets: Record<string, string> = {};
       let mergedReason = '';
       let mergedSeverity = '';
@@ -5297,6 +5339,70 @@ async function main() {
       let anyFailed = false;
 
       for (const gradeResp of gradeResponses) {
+        // PRIMARY shape — the live CWE grader returns ONE JSON object:
+        //   {"cweIds":[..],"reasons":{id:..},"fixes":{id:..},"snippets":{id:..},"mergedReason":".."}
+        // Parse it directly so each CWE keeps its OWN contextual reason + specific
+        // fix. Critically this also bounds detection to cweIds — NOT a regex scrape of
+        // the prose (which used to grab CWE-### tokens out of mergedReason, e.g. a
+        // "no CWE-502 found" sentence, and over-report findings).
+        try {
+          const objM = gradeResp.match(/\{[\s\S]*"cweIds"[\s\S]*\}/);
+          if (objM) {
+            const p = JSON.parse(objM[0]);
+            if (Array.isArray(p.cweIds)) {
+              const ids = p.cweIds.map((x: any) => String(x).trim().replace(/^cwe-/i, 'CWE-')).filter((id: string) => /^CWE-\d+$/.test(id));
+              if (ids.length > 0) {
+                anyFailed = true;
+                if (!mergedReason && typeof p.mergedReason === 'string') mergedReason = p.mergedReason;
+                for (const id of ids) {
+                  if (!cweIds.includes(id)) cweIds.push(id);
+                  const rsn = p.reasons && typeof p.reasons[id] === 'string' ? p.reasons[id] : '';
+                  const fx = p.fixes && typeof p.fixes[id] === 'string' ? p.fixes[id] : '';
+                  const sn = p.snippets && typeof p.snippets[id] === 'string' ? p.snippets[id] : '';
+                  if (rsn && !reasons[id]) reasons[id] = rsn;
+                  if (fx && !fixes[id]) fixes[id] = fx;
+                  if (sn && !snippets[id]) snippets[id] = sn;
+                }
+                continue;
+              }
+            }
+          }
+        } catch { /* not the JSON-object shape — fall through to legacy parsing */ }
+        // The CWE grader emits findings, but its wrapper VARIES per call:
+        //   {"findings":[...]}  |  <findings>[...]</findings>  |  a bare [...] array.
+        // Extract findings from any of them. Without this, parseVerdict sees no
+        // <synkro-verdict> wrapper and defaults to ok:true, silently dropping every
+        // detected CWE (a format mismatch). The <synkro-verdict> XML path below is
+        // the fallback for the legacy format.
+        let jsonFindings: any[] | null = null;
+        try {
+          const tagM = gradeResp.match(/<findings>([\s\S]*?)<\/findings>/);
+          const src = tagM ? tagM[1] : gradeResp;
+          const objM = src.match(/\{[\s\S]*"findings"[\s\S]*\}/);
+          const arrM = src.match(/\[[\s\S]*\]/);
+          if (objM) { const p = JSON.parse(objM[0]); if (Array.isArray(p.findings)) jsonFindings = p.findings; }
+          if (!jsonFindings && arrM) { const p = JSON.parse(arrM[0]); if (Array.isArray(p)) jsonFindings = p; }
+        } catch { /* not parseable JSON — fall through to XML parsing */ }
+        if (jsonFindings) {
+          if (jsonFindings.length > 0) {
+            anyFailed = true;
+            for (const f of jsonFindings.slice(0, 8)) {
+              const id = String(f.cwe || f.rule_id || '').trim().replace(/^cwe-/i, 'CWE-');
+              // Validate the shape (CWE-<number>) before using it as an object key —
+              // the grade response is model output, so reject anything that isn't a
+              // real CWE id (also blocks __proto__/constructor key injection).
+              if (!/^CWE-\d+$/.test(id)) continue;
+              if (!cweIds.includes(id)) cweIds.push(id);
+              if (f.suggested_fix && !fixes[id]) fixes[id] = String(f.suggested_fix);
+              if ((f.reason || f.summary || f.detail) && !reasons[id]) reasons[id] = String(f.reason || f.summary || f.detail);
+              if (f.code_snippet && !snippets[id]) snippets[id] = String(f.code_snippet);
+              if (!mergedReason && (f.summary || f.detail)) mergedReason = String(f.summary || f.detail);
+              if (!mergedSeverity && f.severity) mergedSeverity = String(f.severity);
+              if (!mergedCategory && f.category) mergedCategory = String(f.category);
+            }
+          }
+          continue;
+        }
         const v = parseVerdict(gradeResp);
         if (!v.ok) {
           anyFailed = true;
@@ -5325,6 +5431,10 @@ async function main() {
               const snip = snM[1].replace(/^\n+|\n+$/g, '');
               if (snip.trim()) snippets[id] = snip;
             }
+            // Capture THIS violation's own reason so the deny can show a per-CWE
+            // explanation, not just one merged reason for the whole batch.
+            const rM = block.match(/<reason>([\s\S]*?)<\/reason>/);
+            if (rM && !reasons[id]) { const rs = rM[1].trim(); if (rs) reasons[id] = rs; }
           }
         }
       }
@@ -5349,12 +5459,28 @@ async function main() {
         const count = activeCweIds.length;
         const label = count === 1 ? 'match' : 'matches';
         const cweMsg = cweTag + ' ' + fileShort + ' \u2192 ' + count + ' CWE ' + label + ' (' + displayIds + ')';
-        const denyDetail = '[' + displayIds + '] ' + (verdict.reason || 'code weakness detected');
-        const fixLines = activeCweIds
-          .filter(id => fixes[id])
-          .map(id => '[' + id + '] Fix: ' + fixes[id]);
-        const fixHint = fixLines.length > 0 ? '\n' + fixLines.join('\n') : '';
-        const ctx = 'CWE: ' + denyDetail + fixHint + '\nFix all issues before retrying. Do NOT ask the user to make the edit manually — resolve the weakness in code yourself.';
+        // ONE sentence, hard-capped (strip control chars, trim at first terminator) so
+        // the deny stays tight even with several CWEs in one edit.
+        const oneSentence = (s: any) => { const t = String(s == null ? '' : s).replace(/[\x00-\x1F\x7F]/g, ' ').replace(/\s{2,}/g, ' ').trim().slice(0, 400); const m = t.match(/^[\s\S]*?[.!?](\s+(?=[A-Z])|$)/); return (m ? m[0] : t).trim().slice(0, 220); };
+        // ONE line per flagged CWE: its own one-sentence explanation + a one-sentence Fix.
+        // Per-CWE reason (reasons[id]) → merged reason → CWE name → generic fallback. The
+        // Fix is dropped when it just restates the explanation so no line double-prints.
+        const cweBlocks = activeCweIds.map(id => {
+          const why = oneSentence(reasons[id] || verdict.reason || cweNameMap.get(id.toUpperCase()) || 'code weakness detected');
+          const fix = fixes[id] ? oneSentence(fixes[id]) : '';
+          const showFix = !!fix && !why.toLowerCase().includes(fix.slice(0, 40).toLowerCase());
+          return '[' + id + '] ' + why + (showFix ? ' Fix: ' + fix : '');
+        });
+        // Bound the total: list as many CWEs as fit, spill the rest to a "+N more" note.
+        let denyDetail = cweBlocks.join('\n');
+        if (denyDetail.length > 4000) {
+          const kept: string[] = [];
+          let used = 0;
+          for (const b of cweBlocks) { if (used + b.length + 1 > 4000) break; kept.push(b); used += b.length + 1; }
+          const more = cweBlocks.length - kept.length;
+          denyDetail = kept.join('\n') + (more > 0 ? '\n(+' + more + ' more CWE weakness' + (more === 1 ? '' : 'es') + ' — fix these first, then re-run to surface the rest)' : '');
+        }
+        const ctx = 'CWE weaknesses to fix (' + count + '):\n' + denyDetail + '\nFix ALL of the above before retrying. Do NOT ask the user to make the edit manually — resolve every weakness in code yourself.';
 
         emitBlockScanFindings(
           jwt,
@@ -11412,7 +11538,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.100")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.7.1")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -15475,7 +15601,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.100");
+  console.log("1.7.1");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents