@synkro-sh/cli 1.7.0 → 1.7.2

package/dist/bootstrap.js

@@ -1966,7 +1966,7 @@ export async function filterRules(commandText: string, allRules: Rule[]): Promis
   if (allRules.length <= 3) return allRules;
 
   // Cloud: the embedding index lives server-side (the container grade path can't
-  // reach 127.0.0.1), so ask the gateway for the top-3 relevant rules \u2014 same
+  // reach 127.0.0.1), so ask the gateway for the top-5 relevant rules \u2014 same
   // CF/BYOK bge-base vectors, same behavior as local. Without this, cloud grades
   // dumped EVERY rule into the prompt (9KB+), the dominant cause of grade
   // timeouts. Any failure falls back to all rules (status quo), never blocks.
@@ -1977,7 +1977,7 @@ export async function filterRules(commandText: string, allRules: Rule[]): Promis
       const resp = await fetch(GATEWAY_URL + '/api/v1/hook/filter-rules', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
-        body: JSON.stringify({ text: commandText, top_k: 3 }),
+        body: JSON.stringify({ text: commandText, top_k: 5 }),
         signal: AbortSignal.timeout(2000),
       });
       if (!resp.ok) return allRules;
@@ -1996,7 +1996,7 @@ export async function filterRules(commandText: string, allRules: Rule[]): Promis
     const resp = await fetch('http://127.0.0.1:' + mcpPort + '/api/local/filter-rules', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ text: commandText, top_k: 3 }),
+      body: JSON.stringify({ text: commandText, top_k: 5 }),
       signal: AbortSignal.timeout(500),
     });
     if (!resp.ok) return allRules;
@@ -4619,8 +4619,16 @@ async function main() {
         const cweFindings = [...cweMap.values()];
         const editContent = 'file=' + filePath + ' content=' + proposed.slice(0, 2000);
         const violatedRules = ruleVerdict.ruleId ? [ruleVerdict.ruleId] : [];
-        const cweBlock = cweFindings.slice(0, 5)
-          .map(f => '[' + f.id + '] ' + (f.reason || 'weakness') + (f.suggestedFix ? ' Fix: ' + f.suggestedFix : ''))
+        // Include EVERY flagged CWE's description (not a 5-cap) so the agent can fix
+        // all of them \u2014 even 30 in one edit. Per-finding fallback: reason -> CWE name.
+        const cweClean = (s) => String(s == null ? '' : s).split('').map(c => { const k = c.charCodeAt(0); return (k < 32 || k === 127) ? ' ' : c; }).join('').replace(/  +/g, ' ').trim().slice(0, 400);
+        const cweId = (s) => String(s == null ? 'CWE-UNKNOWN' : s).replace(/[^A-Za-z0-9_-]/g, '').slice(0, 20) || 'CWE-UNKNOWN';
+        // One sentence each (trim at first . ! or ?) so several CWEs in one edit stay tight.
+        const cweOne = (s) => { const t = cweClean(s); const i = t.search(/[.!?]( [A-Z]|$)/); return (i >= 0 ? t.slice(0, i + 1) : t).slice(0, 220); };
+        // One line per CWE: explanation + Fix. Drop the Fix when it just restates the
+        // explanation so a single CWE never double-prints the same prose.
+        const cweBlock = cweFindings
+          .map(f => { const why = cweOne(f.reason || f.name || 'code weakness'); const fix = f.suggestedFix ? cweOne(f.suggestedFix) : ''; const showFix = fix && why.toLowerCase().indexOf(fix.slice(0, 40).toLowerCase()) === -1; return '[' + cweId(f.id) + '] ' + why + (showFix ? ' Fix: ' + fix : ''); })
           .join('\\n');
         for (const f of cweFindings) {
           dispatchFinding(jwt, { session_id: sessionId, file_path: filePath, finding_type: 'cwe', finding_id: f.id, status: 'open' }, config.captureDepth);
@@ -5143,12 +5151,41 @@ async function main() {
         const label = count === 1 ? 'match' : 'matches';
         const cweMsg = cweTag + ' ' + fileShort + ' \u2192 ' + count + ' CWE ' + label + ' (' + displayIds + ')';
 
-        const fixLines = findings
-          .filter((f: any) => activeCweIds.includes(f.cwe) && f.suggested_fix)
-          .map((f: any) => '[' + f.cwe + '] Fix: ' + f.suggested_fix);
-        const fixHint = fixLines.length > 0 ? '\n' + fixLines.join('\n') : '';
-        const denyDetail = '[' + displayIds + '] ' + (findings[0]?.reason || 'code weakness detected');
-        const ctx = 'CWE: ' + denyDetail + fixHint + '\nFix all issues before retrying. Do NOT ask the user to make the edit manually \u2014 resolve the weakness in code yourself.';
+        // Sanitize any scan-derived text before embedding it in the agent message
+        // (CWE-20): bound length + strip control chars; constrain the CWE id shape.
+        const sanitizeDesc = (s: any) => String(s == null ? '' : s).replace(/[\x00-\x1F\x7F]/g, ' ').replace(/\s{2,}/g, ' ').trim().slice(0, 400);
+        const sanitizeId = (s: any) => String(s == null ? '' : s).replace(/[^A-Za-z0-9_-]/g, '').slice(0, 20).toUpperCase() || 'CWE-UNKNOWN';
+        // ONE sentence, hard-capped \u2014 keeps each line tight so 4+ CWEs in a single edit
+        // never blow the message-size limit. Trims at the first sentence terminator.
+        const oneSentence = (s: any) => { const t = sanitizeDesc(s); const m = t.match(/^[\s\S]*?[.!?](\s+(?=[A-Z])|$)/); return (m ? m[0] : t).trim().slice(0, 220); };
+        // ONE line per flagged CWE: a one-sentence explanation + a one-sentence Fix.
+        // The Fix is dropped when it merely restates the explanation (the grader
+        // sometimes echoes it) so the line never double-prints the same prose.
+        const cweSeen = new Set<string>();
+        const cweBlocks = activeCweIds
+          .map((cweId: string) => {
+            const sid = sanitizeId(cweId);
+            if (cweSeen.has(sid)) return '';
+            cweSeen.add(sid);
+            const f = findings.find((x: any) => x.cwe === cweId);
+            const why = oneSentence(f && (f.reason || f.name) ? (f.reason || f.name) : 'code weakness detected');
+            const fix = f && f.suggested_fix ? oneSentence(f.suggested_fix) : '';
+            const showFix = !!fix && !why.toLowerCase().includes(fix.slice(0, 40).toLowerCase());
+            return '[' + sid + '] ' + why + (showFix ? ' Fix: ' + fix : '');
+          })
+          .filter((line: string) => line.length > 0);
+        // Bound the total: list as many CWEs as fit, spill the rest to a "+N more" note
+        // (agent fixes the listed ones, then re-runs to surface the remainder).
+        const MAX_CWE_CHARS = 4000;
+        let denyDetail = cweBlocks.join('\n');
+        if (denyDetail.length > MAX_CWE_CHARS) {
+          const kept: string[] = [];
+          let used = 0;
+          for (const b of cweBlocks) { if (used + b.length + 1 > MAX_CWE_CHARS) break; kept.push(b); used += b.length + 1; }
+          const more = cweBlocks.length - kept.length;
+          denyDetail = kept.join('\n') + (more > 0 ? '\n(+' + more + ' more CWE weakness' + (more === 1 ? '' : 'es') + ' \u2014 fix these first, then re-run to surface the rest)' : '');
+        }
+        const ctx = 'CWE weaknesses to fix (' + count + '):\n' + denyDetail + '\nFix ALL of the above before retrying. Do NOT ask the user to make the edit manually \u2014 resolve every weakness in code yourself.';
 
         emitBlockScanFindings(
           jwt,
@@ -5294,6 +5331,7 @@ async function main() {
 
       const cweIds: string[] = [];
       const fixes: Record<string, string> = {};
+      const reasons: Record<string, string> = {};
       const snippets: Record<string, string> = {};
       let mergedReason = '';
       let mergedSeverity = '';
@@ -5301,6 +5339,35 @@ async function main() {
       let anyFailed = false;
 
       for (const gradeResp of gradeResponses) {
+        // PRIMARY shape — the live CWE grader returns ONE JSON object:
+        //   {"cweIds":[..],"reasons":{id:..},"fixes":{id:..},"snippets":{id:..},"mergedReason":".."}
+        // Parse it directly so each CWE keeps its OWN contextual reason + specific
+        // fix. Critically this also bounds detection to cweIds — NOT a regex scrape of
+        // the prose (which used to grab CWE-### tokens out of mergedReason, e.g. a
+        // "no CWE-502 found" sentence, and over-report findings).
+        try {
+          const objM = gradeResp.match(/\{[\s\S]*"cweIds"[\s\S]*\}/);
+          if (objM) {
+            const p = JSON.parse(objM[0]);
+            if (Array.isArray(p.cweIds)) {
+              const ids = p.cweIds.map((x: any) => String(x).trim().replace(/^cwe-/i, 'CWE-')).filter((id: string) => /^CWE-\d+$/.test(id));
+              if (ids.length > 0) {
+                anyFailed = true;
+                if (!mergedReason && typeof p.mergedReason === 'string') mergedReason = p.mergedReason;
+                for (const id of ids) {
+                  if (!cweIds.includes(id)) cweIds.push(id);
+                  const rsn = p.reasons && typeof p.reasons[id] === 'string' ? p.reasons[id] : '';
+                  const fx = p.fixes && typeof p.fixes[id] === 'string' ? p.fixes[id] : '';
+                  const sn = p.snippets && typeof p.snippets[id] === 'string' ? p.snippets[id] : '';
+                  if (rsn && !reasons[id]) reasons[id] = rsn;
+                  if (fx && !fixes[id]) fixes[id] = fx;
+                  if (sn && !snippets[id]) snippets[id] = sn;
+                }
+                continue;
+              }
+            }
+          }
+        } catch { /* not the JSON-object shape — fall through to legacy parsing */ }
         // The CWE grader emits findings, but its wrapper VARIES per call:
         //   {"findings":[...]}  |  <findings>[...]</findings>  |  a bare [...] array.
         // Extract findings from any of them. Without this, parseVerdict sees no
@@ -5326,7 +5393,8 @@ async function main() {
               // real CWE id (also blocks __proto__/constructor key injection).
               if (!/^CWE-\d+$/.test(id)) continue;
               if (!cweIds.includes(id)) cweIds.push(id);
-              if (f.detail && !fixes[id]) fixes[id] = String(f.detail);
+              if (f.suggested_fix && !fixes[id]) fixes[id] = String(f.suggested_fix);
+              if ((f.reason || f.summary || f.detail) && !reasons[id]) reasons[id] = String(f.reason || f.summary || f.detail);
               if (f.code_snippet && !snippets[id]) snippets[id] = String(f.code_snippet);
               if (!mergedReason && (f.summary || f.detail)) mergedReason = String(f.summary || f.detail);
               if (!mergedSeverity && f.severity) mergedSeverity = String(f.severity);
@@ -5363,6 +5431,10 @@ async function main() {
               const snip = snM[1].replace(/^\n+|\n+$/g, '');
               if (snip.trim()) snippets[id] = snip;
             }
+            // Capture THIS violation's own reason so the deny can show a per-CWE
+            // explanation, not just one merged reason for the whole batch.
+            const rM = block.match(/<reason>([\s\S]*?)<\/reason>/);
+            if (rM && !reasons[id]) { const rs = rM[1].trim(); if (rs) reasons[id] = rs; }
           }
         }
       }
@@ -5387,12 +5459,28 @@ async function main() {
         const count = activeCweIds.length;
         const label = count === 1 ? 'match' : 'matches';
         const cweMsg = cweTag + ' ' + fileShort + ' \u2192 ' + count + ' CWE ' + label + ' (' + displayIds + ')';
-        const denyDetail = '[' + displayIds + '] ' + (verdict.reason || 'code weakness detected');
-        const fixLines = activeCweIds
-          .filter(id => fixes[id])
-          .map(id => '[' + id + '] Fix: ' + fixes[id]);
-        const fixHint = fixLines.length > 0 ? '\n' + fixLines.join('\n') : '';
-        const ctx = 'CWE: ' + denyDetail + fixHint + '\nFix all issues before retrying. Do NOT ask the user to make the edit manually — resolve the weakness in code yourself.';
+        // ONE sentence, hard-capped (strip control chars, trim at first terminator) so
+        // the deny stays tight even with several CWEs in one edit.
+        const oneSentence = (s: any) => { const t = String(s == null ? '' : s).replace(/[\x00-\x1F\x7F]/g, ' ').replace(/\s{2,}/g, ' ').trim().slice(0, 400); const m = t.match(/^[\s\S]*?[.!?](\s+(?=[A-Z])|$)/); return (m ? m[0] : t).trim().slice(0, 220); };
+        // ONE line per flagged CWE: its own one-sentence explanation + a one-sentence Fix.
+        // Per-CWE reason (reasons[id]) → merged reason → CWE name → generic fallback. The
+        // Fix is dropped when it just restates the explanation so no line double-prints.
+        const cweBlocks = activeCweIds.map(id => {
+          const why = oneSentence(reasons[id] || verdict.reason || cweNameMap.get(id.toUpperCase()) || 'code weakness detected');
+          const fix = fixes[id] ? oneSentence(fixes[id]) : '';
+          const showFix = !!fix && !why.toLowerCase().includes(fix.slice(0, 40).toLowerCase());
+          return '[' + id + '] ' + why + (showFix ? ' Fix: ' + fix : '');
+        });
+        // Bound the total: list as many CWEs as fit, spill the rest to a "+N more" note.
+        let denyDetail = cweBlocks.join('\n');
+        if (denyDetail.length > 4000) {
+          const kept: string[] = [];
+          let used = 0;
+          for (const b of cweBlocks) { if (used + b.length + 1 > 4000) break; kept.push(b); used += b.length + 1; }
+          const more = cweBlocks.length - kept.length;
+          denyDetail = kept.join('\n') + (more > 0 ? '\n(+' + more + ' more CWE weakness' + (more === 1 ? '' : 'es') + ' — fix these first, then re-run to surface the rest)' : '');
+        }
+        const ctx = 'CWE weaknesses to fix (' + count + '):\n' + denyDetail + '\nFix ALL of the above before retrying. Do NOT ask the user to make the edit manually — resolve every weakness in code yourself.';
 
         emitBlockScanFindings(
           jwt,
@@ -11450,7 +11538,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.7.0")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.7.2")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -15513,7 +15601,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.7.0");
+  console.log("1.7.2");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents