@synkro-sh/cli 1.6.99 → 1.7.0

package/dist/bootstrap.js

@@ -1050,16 +1050,18 @@ export function log(msg: string): void {
 // \u2500\u2500\u2500 JWT Management \u2500\u2500\u2500
 
 export function loadJwt(): string | null {
-  // Cloud mode: prefer the long-lived (1yr) MCP token. It's org+user scoped and
-  // accepted on the whole cloud-hook surface (grade/submit, cwe-rules, hook/*,
-  // cli/*), so grading survives sessions far longer than the ~5-min WorkOS token.
-  // jwtIsExpired sees a year of runway, so ensureFreshJwt never needs to refresh.
-  if (process.env.SYNKRO_STORAGE_MODE === 'cloud') {
-    try {
-      const mcp = readFileSync(MCP_JWT_PATH, 'utf-8').trim();
-      if (mcp) return mcp;
-    } catch { /* no mcp token on disk \u2014 fall back to the login token below */ }
-  }
+  // Prefer the long-lived (1yr) Synkro MCP token in BOTH cloud and local mode.
+  // It's org+user scoped and accepted across the hook surface (grade/submit,
+  // cwe-rules, hook/*, cli/*), so a single 'synkro login' keeps grading + CWE
+  // detection alive for a year with NO refresh. The alternative \u2014 the ~5-min
+  // WorkOS access_token \u2014 rides a rotating refresh chain that dies with the
+  // WorkOS session (invalid_grant "session has already ended"), which silently
+  // disabled CWE findings while editGuard/cveScan (which don't need this token)
+  // kept working. jwtIsExpired sees a year of runway, so we never hit refreshJwt.
+  try {
+    const mcp = readFileSync(MCP_JWT_PATH, 'utf-8').trim();
+    if (mcp) return mcp;
+  } catch { /* no mcp token on disk \u2014 fall back to the login token below */ }
   try {
     if (!existsSync(CREDS_PATH)) return null;
     const creds = JSON.parse(readFileSync(CREDS_PATH, 'utf-8'));
@@ -5126,7 +5128,9 @@ async function main() {
       const findings = Array.isArray(cweResp?.findings) ? cweResp.findings : [];
       if (cweResp?.action === 'deny' && findings.length > 0) {
         const activeCweIds = findings
-          .filter((f: any) => f.mode === 'blocking' || f.mode === 'ask')
+          // CWE is a separate, always-ask grader — a detected weakness is ALWAYS
+          // surfaced regardless of the rule's stored mode (fix/blocking/ask).
+          // Only path exemptions suppress it (matches the local-route branch).
           .map((f: any) => f.cwe)
           .filter((id: string) => !exemptedCwes.has(id.toUpperCase()));
 
@@ -5297,6 +5301,40 @@ async function main() {
       let anyFailed = false;
 
       for (const gradeResp of gradeResponses) {
+        // The CWE grader emits findings, but its wrapper VARIES per call:
+        //   {"findings":[...]}  |  <findings>[...]</findings>  |  a bare [...] array.
+        // Extract findings from any of them. Without this, parseVerdict sees no
+        // <synkro-verdict> wrapper and defaults to ok:true, silently dropping every
+        // detected CWE (a format mismatch). The <synkro-verdict> XML path below is
+        // the fallback for the legacy format.
+        let jsonFindings: any[] | null = null;
+        try {
+          const tagM = gradeResp.match(/<findings>([\s\S]*?)<\/findings>/);
+          const src = tagM ? tagM[1] : gradeResp;
+          const objM = src.match(/\{[\s\S]*"findings"[\s\S]*\}/);
+          const arrM = src.match(/\[[\s\S]*\]/);
+          if (objM) { const p = JSON.parse(objM[0]); if (Array.isArray(p.findings)) jsonFindings = p.findings; }
+          if (!jsonFindings && arrM) { const p = JSON.parse(arrM[0]); if (Array.isArray(p)) jsonFindings = p; }
+        } catch { /* not parseable JSON — fall through to XML parsing */ }
+        if (jsonFindings) {
+          if (jsonFindings.length > 0) {
+            anyFailed = true;
+            for (const f of jsonFindings.slice(0, 8)) {
+              const id = String(f.cwe || f.rule_id || '').trim().replace(/^cwe-/i, 'CWE-');
+              // Validate the shape (CWE-<number>) before using it as an object key —
+              // the grade response is model output, so reject anything that isn't a
+              // real CWE id (also blocks __proto__/constructor key injection).
+              if (!/^CWE-\d+$/.test(id)) continue;
+              if (!cweIds.includes(id)) cweIds.push(id);
+              if (f.detail && !fixes[id]) fixes[id] = String(f.detail);
+              if (f.code_snippet && !snippets[id]) snippets[id] = String(f.code_snippet);
+              if (!mergedReason && (f.summary || f.detail)) mergedReason = String(f.summary || f.detail);
+              if (!mergedSeverity && f.severity) mergedSeverity = String(f.severity);
+              if (!mergedCategory && f.category) mergedCategory = String(f.category);
+            }
+          }
+          continue;
+        }
         const v = parseVerdict(gradeResp);
         if (!v.ok) {
           anyFailed = true;
@@ -10668,6 +10706,7 @@ function captureClaudeSetupToken() {
   const isMac = platform3() === "darwin";
   const bin = "script";
   const args2 = isMac ? ["-q", tmpFile, "claude", "setup-token"] : ["-qec", "claude setup-token", tmpFile];
+  const OAUTH_HINT = 'The browser approval did not return a token. This usually means claude.ai rejected the OAuth request (its "Authorization failed \u2014 Unsupported media type" page), most often because a browser extension (Grammarly, ad/script blockers, AI-assistant toolbars) stripped the request headers, or you approved on the wrong Claude account. Fix: retry in a clean incognito window with extensions disabled, and approve on the Claude account you want the cloud workers to use.';
   return new Promise((resolve4, reject) => {
     const proc = nodeSpawn(bin, args2, {
       stdio: "inherit",
@@ -10687,7 +10726,7 @@ function captureClaudeSetupToken() {
       } catch {
       }
       if (code !== 0) {
-        reject(new Error(`claude setup-token exited with code ${code}`));
+        reject(new Error(`claude setup-token exited with code ${code}. ${OAUTH_HINT}`));
         return;
       }
       const TOKEN_YELLOW = "2;255;193;7";
@@ -10731,7 +10770,8 @@ function captureClaudeSetupToken() {
         i += 1;
       }
       if (!token) {
-        reject(new Error(`Captured no yellow token text from claude setup-token output (raw=${raw.length}b \u2014 is the terminal emitting color?)`));
+        const reason = raw.length < 200 ? OAUTH_HINT : `is the terminal emitting color? (captured ${raw.length}b but no token-yellow run)`;
+        reject(new Error(`Captured no setup token from claude setup-token output. ${reason}`));
         return;
       }
       resolve4(token);
@@ -11410,7 +11450,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.6.99")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.7.0")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -15473,7 +15513,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.6.99");
+  console.log("1.7.0");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents