@synkro-sh/cli 1.7.6 → 1.7.8

package/dist/bootstrap.js

@@ -1975,6 +1975,10 @@ export async function localGradeCwe(prompt: string, agentKind: AgentKind = 'clau
 // directive to poll the user + call record_fix_choice. PURELY ADDITIVE \u2014 any
 // failure returns '' so enforcement behaves exactly as before.
 export async function buildFixPollDirective(o: { candA: string; code: string; ruleId: string; sessionId: string; filePath: string; model: string; graderPrompt: string; graderPool?: AgentKind }): Promise<string> {
+  // Kill switch (container/agent env, NOT user-toggleable via MCP): headless/benchmark
+  // runs (e.g. sec-code-bench) set SYNKRO_FIX_POLL=0 to suppress the AskUserQuestion poll
+  // so grading runs non-interactively. The container endpoint enforces the same flag.
+  if (process.env.SYNKRO_FIX_POLL === '0') return '';
   try {
     const candA = (o.candA || '').trim();
     if (!candA) return '';
@@ -4798,7 +4802,7 @@ async function main() {
         // than re-deriving. ask mode: no fix in the deny text; the poll directive
         // (below) lets the HUMAN choose among candidates.
         const denyReason = mode === 'fix'
-          ? 'Guard: ' + guardReason + (verdict.suggestedFix ? '\\nSuggested fix (apply this): ' + verdict.suggestedFix : '') + '\\nFix all issues before retrying. Do NOT ask the user to make the edit manually \u2014 resolve the violation in code yourself.'
+          ? 'Guard: ' + guardReason + (verdict.suggestedFix ? '\\nRequired fix (apply this exactly): ' + verdict.suggestedFix : '') + '\\nFix all issues before retrying. Do NOT ask the user to make the edit manually \u2014 resolve the violation in code yourself.'
           : 'Guard: ' + guardReason + '\\nAsk the user for explicit consent before retrying.';
         dispatchCapture(jwt, 'edit', 'block', verdict.severity || 'critical', verdict.category || 'security',
           toolName, gitRepo, sessionId, config.captureDepth, {
@@ -10637,6 +10641,11 @@ async function dockerInstall(opts = {}) {
     ...process.env.SYNKRO_MAX_BATCH_SIZE ? ["-e", `SYNKRO_MAX_BATCH_SIZE=${process.env.SYNKRO_MAX_BATCH_SIZE}`] : [],
     // Cursor grading model — tunable like SYNKRO_MAX_BATCH_SIZE.
     ...process.env.SYNKRO_CURSOR_MODEL ? ["-e", `SYNKRO_CURSOR_MODEL=${process.env.SYNKRO_CURSOR_MODEL}`] : [],
+    // Fix-poll kill switch. Default ON in the image; a benchmark/headless run
+    // (e.g. sec-code-bench) sets SYNKRO_FIX_POLL=0 so ask-mode violations skip the
+    // interactive AskUserQuestion poll and fall through to generate-the-fix. Only
+    // passed when the operator set it; otherwise the image default (1) applies.
+    ...process.env.SYNKRO_FIX_POLL ? ["-e", `SYNKRO_FIX_POLL=${process.env.SYNKRO_FIX_POLL}`] : [],
     // Connected repo — the server seeds the local app + ruleset named after it.
     ...opts.connectedRepo ? ["-e", `SYNKRO_CONNECTED_REPO=${opts.connectedRepo}`] : [],
     // Real account identity (from config.env via process.env) — telemetry is
@@ -11634,7 +11643,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.7.6")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.7.8")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
@@ -13596,7 +13605,7 @@ tmux kill-session -t "=$SESSION" 2>/dev/null || true
 # Start claude inside a detached tmux session so it has a real pty.
 # Redirect stderr to the log so we can see why it dies.
 tmux new-session -d -s "$SESSION" \\
-  "SYNKRO_CHANNEL_PORT=${CHANNEL_1_PORT} CLAUDE_CODE_DISABLE_THINKING=1 claude --dangerously-load-development-channels server:synkro-local --dangerously-skip-permissions --setting-sources project,local --model claude-sonnet-4-6 2>>$LOG; echo 'claude exited with code '$'?' >> $LOG"
+  "SYNKRO_CHANNEL_PORT=${CHANNEL_1_PORT} CLAUDE_CODE_DISABLE_THINKING=1 claude --dangerously-load-development-channels server:synkro-local --dangerously-skip-permissions --setting-sources project,local --model claude-sonnet-5 2>>$LOG; echo 'claude exited with code '$'?' >> $LOG"
 
 # Claude's --dangerously-load-development-channels shows a confirmation
 # prompt: option 1 = "I am using this for local development" (accept),
@@ -13658,7 +13667,7 @@ log "claude version: $(claude --version 2>&1 | head -1)"
 tmux kill-session -t "=$SESSION" 2>/dev/null || true
 
 tmux new-session -d -s "$SESSION" \\
-  "SYNKRO_CHANNEL_PORT=${CHANNEL_2_PORT} CLAUDE_CODE_DISABLE_THINKING=1 claude --dangerously-load-development-channels server:synkro-local --dangerously-skip-permissions --setting-sources project,local --model claude-sonnet-4-6 2>>$LOG; echo 'claude exited with code '$'?' >> $LOG"
+  "SYNKRO_CHANNEL_PORT=${CHANNEL_2_PORT} CLAUDE_CODE_DISABLE_THINKING=1 claude --dangerously-load-development-channels server:synkro-local --dangerously-skip-permissions --setting-sources project,local --model claude-sonnet-5 2>>$LOG; echo 'claude exited with code '$'?' >> $LOG"
 
 sleep 3
 if tmux has-session -t "=$SESSION" 2>/dev/null; then
@@ -13714,7 +13723,7 @@ log "claude version: $(claude --version 2>&1 | head -1)"
 tmux kill-session -t "=$SESSION" 2>/dev/null || true
 
 tmux new-session -d -s "$SESSION" \\
-  "SYNKRO_CHANNEL_PORT=${CHANNEL_3_PORT} CLAUDE_CODE_DISABLE_THINKING=1 claude --dangerously-load-development-channels server:synkro-local --dangerously-skip-permissions --setting-sources project,local --model claude-sonnet-4-6 2>>$LOG; echo 'claude exited with code '$'?' >> $LOG"
+  "SYNKRO_CHANNEL_PORT=${CHANNEL_3_PORT} CLAUDE_CODE_DISABLE_THINKING=1 claude --dangerously-load-development-channels server:synkro-local --dangerously-skip-permissions --setting-sources project,local --model claude-sonnet-5 2>>$LOG; echo 'claude exited with code '$'?' >> $LOG"
 
 sleep 3
 if tmux has-session -t "=$SESSION" 2>/dev/null; then
@@ -13770,7 +13779,7 @@ log "claude version: $(claude --version 2>&1 | head -1)"
 tmux kill-session -t "=$SESSION" 2>/dev/null || true
 
 tmux new-session -d -s "$SESSION" \\
-  "SYNKRO_CHANNEL_PORT=${CHANNEL_4_PORT} CLAUDE_CODE_DISABLE_THINKING=1 claude --dangerously-load-development-channels server:synkro-local --dangerously-skip-permissions --setting-sources project,local --model claude-sonnet-4-6 2>>$LOG; echo 'claude exited with code '$'?' >> $LOG"
+  "SYNKRO_CHANNEL_PORT=${CHANNEL_4_PORT} CLAUDE_CODE_DISABLE_THINKING=1 claude --dangerously-load-development-channels server:synkro-local --dangerously-skip-permissions --setting-sources project,local --model claude-sonnet-5 2>>$LOG; echo 'claude exited with code '$'?' >> $LOG"
 
 sleep 3
 if tmux has-session -t "=$SESSION" 2>/dev/null; then
@@ -15697,7 +15706,7 @@ var args = process.argv.slice(2);
 var cmd = args[0] || "";
 var subArgs = args.slice(1);
 function printVersion() {
-  console.log("1.7.6");
+  console.log("1.7.8");
 }
 function printHelp2() {
   console.log(`Synkro CLI \u2014 runtime safety for AI coding agents