@synkro-sh/cli 1.7.3 → 1.7.5

package/dist/bootstrap.js

@@ -1426,7 +1426,7 @@ export function effectiveGraderPool(synkroFile: SynkroFileConfig, hookAgentKind:
   // Falls back to synkro.toml whenever the server pool is absent, so a missing
   // value never breaks grading \u2014 it just reverts to today's behavior.
   const managed = process.env.SYNKRO_DEPLOY_LOCATION === 'cloud'
-    || (process.env.SYNKRO_GRADING_MODE || synkroFile.grader?.mode || config?.gradingMode) === 'byok';
+    || (process.env.SYNKRO_GRADING_MODE || config?.gradingMode || synkroFile.grader?.mode) === 'byok';
   const pool = (managed && config?.graderPool)
     ? normalizePoolToken(config.graderPool)
     : normalizePoolToken(synkroFile.grader.pool);
@@ -1632,7 +1632,7 @@ export async function loadConfig(jwt: string, query?: string): Promise<HookConfi
 // \u2500\u2500\u2500 Routing \u2500\u2500\u2500
 
 export async function route(config: HookConfig, synkroFile?: SynkroFileConfig): Promise<'local' | 'cloud'> {
-  const gradingMode = synkroFile?.grader?.mode || process.env.SYNKRO_GRADING_MODE || config.gradingMode || 'local';
+  const gradingMode = process.env.SYNKRO_GRADING_MODE || config.gradingMode || synkroFile?.grader?.mode || 'local';
   if (gradingMode === 'byok') return 'cloud';
   // Cloud-container deploy ([grader] location = cloud): grade via localGrade(),
   // which routes to the hosted container (containers.synkro.sh) and emits the
@@ -1653,7 +1653,7 @@ export async function route(config: HookConfig, synkroFile?: SynkroFileConfig):
 }
 
 export async function cweRoute(config: HookConfig, synkroFile?: SynkroFileConfig): Promise<'local' | 'byok' | 'skip'> {
-  const gradingMode = synkroFile?.grader?.mode || process.env.SYNKRO_GRADING_MODE || config.gradingMode || 'local';
+  const gradingMode = process.env.SYNKRO_GRADING_MODE || config.gradingMode || synkroFile?.grader?.mode || 'local';
   if (gradingMode === 'byok') return 'byok';
   // Cloud-container: CWE scanning runs on the hosted container via localGradeCwe()
   // (which honors SYNKRO_DEPLOY_LOCATION). Without this, cweChannelUp() is false in
@@ -5487,10 +5487,10 @@ async function main() {
             const id = m.replace(/<\/?rule_id>/g, '').trim().replace(/^cwe-/, 'CWE-');
             if (id && !cweIds.includes(id)) cweIds.push(id);
           }
-          const fMatches = gradeResp.match(/<suggested_fix>([^<]+)<\/suggested_fix>/g) || [];
+          const fMatches = gradeResp.match(/<(?:suggested_fix|required_fix)>([\s\S]*?)<\/(?:suggested_fix|required_fix)>/g) || [];
           const respIds = ruleIdMatches.map(rm => rm.replace(/<\/?rule_id>/g, '').trim().replace(/^cwe-/, 'CWE-'));
           for (let i = 0; i < Math.min(respIds.length, fMatches.length); i++) {
-            if (!fixes[respIds[i]]) fixes[respIds[i]] = fMatches[i].replace(/<\/?suggested_fix>/g, '').trim();
+            if (!fixes[respIds[i]]) fixes[respIds[i]] = fMatches[i].replace(/<\/?(?:suggested_fix|required_fix)>/g, '').trim();
           }
           // Per-<violation> pass for the verbatim snippet (code may contain '<'),
           // paired with its rule_id so each finding carries its own offending code.
@@ -5540,9 +5540,9 @@ async function main() {
         // Fix is dropped when it just restates the explanation so no line double-prints.
         const cweBlocks = activeCweIds.map(id => {
           const why = oneSentence(reasons[id] || verdict.reason || cweNameMap.get(id.toUpperCase()) || 'code weakness detected');
-          const fix = fixes[id] ? oneSentence(fixes[id]) : '';
+          const fix = fixes[id] ? String(fixes[id]).replace(/[\x00-\x08\x0B-\x1F\x7F]/g, ' ').trim().slice(0, 1200) : '';
           const showFix = !!fix && !why.toLowerCase().includes(fix.slice(0, 40).toLowerCase());
-          return '[' + id + '] ' + why + (showFix ? ' Fix: ' + fix : '');
+          return '[' + id + '] ' + why + (showFix ? ' REQUIRED FIX (apply exactly — do not substitute a different library/format/approach): ' + fix : '');
         });
         // Bound the total: list as many CWEs as fit, spill the rest to a "+N more" note.
         let denyDetail = cweBlocks.join('\n');
@@ -5553,7 +5553,7 @@ async function main() {
           const more = cweBlocks.length - kept.length;
           denyDetail = kept.join('\n') + (more > 0 ? '\n(+' + more + ' more CWE weakness' + (more === 1 ? '' : 'es') + ' — fix these first, then re-run to surface the rest)' : '');
         }
-        const ctx = 'CWE weaknesses to fix (' + count + '):\n' + denyDetail + '\nFix ALL of the above before retrying. Do NOT ask the user to make the edit manually — resolve every weakness in code yourself.';
+        const ctx = 'CWE weaknesses to fix (' + count + '):\n' + denyDetail + '\nThese are REQUIRED FIXES — apply each one exactly as given; do NOT substitute your own approach or a different library/format. Do NOT ask the user to make the edit manually — resolve every weakness in code yourself.';
 
         emitBlockScanFindings(
           jwt,
@@ -11611,7 +11611,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.7.3")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.7.5")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -15674,7 +15674,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.7.3");
+  console.log("1.7.5");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents