@synkro-sh/cli 1.6.14 → 1.6.15

package/dist/bootstrap.js

@@ -1322,9 +1322,15 @@ export async function runInstallScan(command: string, jwt: string): Promise<Inst
     const summary = scanResp?.summary || '';
     const scannedLabel = pkgResults.map((p: any) => p.name + '@' + p.version).join(', ');
     if (action === 'block') {
-      const blockSignals = pkgResults
-        .flatMap((p: any) => (p.signals || []).filter((s: any) => s.severity === 'critical' || s.severity === 'high'))
-        .slice(0, 5);
+      // Every critical/high signal (uncapped) + the true CVE total. The grader
+      // only sees what we put in blockContext \u2014 so the real count must be
+      // STATED here; a bare preview lets it under-report (the count is data,
+      // not something the grader should infer from a truncated list).
+      const highSignals = pkgResults
+        .flatMap((p: any) => (p.signals || []).filter((s: any) => s.severity === 'critical' || s.severity === 'high'));
+      const cveCount = pkgResults
+        .flatMap((p: any) => (p.signals || []))
+        .filter((s: any) => s.type === 'cve').length;
       const findings: InstallScanResult['findings'] = [];
       for (const p of pkgResults) {
         for (const s of (p.signals || [])) {
@@ -1337,10 +1343,20 @@ export async function runInstallScan(command: string, jwt: string): Promise<Inst
           }
         }
       }
-      const details = blockSignals.map((s: any) => s.detail).join('\\n') || summary;
+      // Preview the top 5 detail lines; the headline carries the true total.
+      const blockSignals = highSignals.slice(0, 5);
+      const headline = cveCount > 0
+        ? cveCount + ' known CVE' + (cveCount === 1 ? '' : 's') + ' found in ' + (scannedLabel || 'the requested install') + '.\\n'
+        : '';
+      const preview = blockSignals.map((s: any) => s.detail).join('\\n') || summary;
+      const more = highSignals.length > blockSignals.length
+        ? '\\n(+' + (highSignals.length - blockSignals.length) + ' more critical/high findings not shown)'
+        : '';
       return {
         scanned: true, action: 'block',
-        blockContext: details + '\\nDo NOT install packages with security risks. Use a patched version or a different package.',
+        blockContext: headline + preview + more
+          + '\\nReport the CVE count and fix version exactly as stated above \u2014 do not estimate.'
+          + '\\nDo NOT install packages with security risks. Use a patched version or a different package.',
         summary, scannedLabel, findings,
         violatedIds: blockSignals.map((s: any) => s.type + ':' + (s.detail || '').slice(0, 40)),
       };
@@ -6504,7 +6520,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.14")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.6.15")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -9169,7 +9185,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.14");
+  console.log("1.6.15");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents