cycode 3.15.3.dev8__tar.gz → 3.15.4.dev1__tar.gz

{cycode-3.15.3.dev8 → cycode-3.15.4.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.15.3.dev8
+Version: 3.15.4.dev1
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE

cycode-3.15.4.dev1/cycode/__init__.py

@@ -0,0 +1 @@
+__version__ = '3.15.4.dev1'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

cycode-3.15.4.dev1/cycode/cli/apps/ai_guardrails/command_utils.py

@@ -0,0 +1,25 @@
+"""Common utilities for AI guardrails commands."""
+
+import os
+from pathlib import Path
+from typing import Optional
+
+import typer
+from rich.console import Console
+
+console = Console()
+
+
+def validate_scope(scope: str, allowed_scopes: tuple[str, ...] = ('user', 'repo')) -> None:
+    """Validate scope parameter."""
+    if scope not in allowed_scopes:
+        scopes_list = ', '.join(f'"{s}"' for s in allowed_scopes)
+        console.print(f'[red]Error:[/] Invalid scope. Use {scopes_list}.', style='bold red')
+        raise typer.Exit(1)
+
+
+def resolve_repo_path(scope: str, repo_path: Optional[Path]) -> Optional[Path]:
+    """Default repo_path to cwd for 'repo' scope; leave None for 'user' scope."""
+    if scope == 'repo' and repo_path is None:
+        return Path(os.getcwd())
+    return repo_path

cycode-3.15.4.dev1/cycode/cli/apps/ai_guardrails/consts.py

@@ -0,0 +1,23 @@
+"""Shared constants and policy/mode enums for AI guardrails."""
+
+from enum import Enum
+
+
+class PolicyMode(str, Enum):
+    """Policy enforcement mode for global mode and per-feature actions."""
+
+    BLOCK = 'block'
+    WARN = 'warn'
+
+
+class InstallMode(str, Enum):
+    """Installation mode for ai-guardrails install command."""
+
+    REPORT = 'report'
+    BLOCK = 'block'
+
+
+# Base CLI commands invoked from installed hooks. IDE classes append --ide flags
+# (and any other suffix) on top of these.
+CYCODE_SCAN_PROMPT_COMMAND = 'cycode ai-guardrails scan'
+CYCODE_SESSION_START_COMMAND = 'cycode ai-guardrails session-start'

{cycode-3.15.3.dev8 → cycode-3.15.4.dev1}/cycode/cli/apps/ai_guardrails/hooks_manager.py

@@ -1,8 +1,8 @@
-"""
-Hooks manager for AI guardrails.
+"""Hooks manager for AI guardrails.
 
-Handles installation, removal, and status checking of AI IDE hooks.
-Supports multiple IDEs: Cursor, Claude Code (future).
+Generic install/uninstall/status logic. All IDE-specific concerns (settings
+paths, hooks template shape) live on the `IDE` instance; this module is
+agent-agnostic.
 """
 
 import copy
@@ -12,47 +12,45 @@ from typing import Optional
 
 import yaml
 
-from cycode.cli.apps.ai_guardrails.consts import (
-    DEFAULT_IDE,
-    IDE_CONFIGS,
-    AIIDEType,
-    PolicyMode,
-    get_hooks_config,
-)
+from cycode.cli.apps.ai_guardrails.consts import PolicyMode
+from cycode.cli.apps.ai_guardrails.ides.base import IDE
 from cycode.cli.apps.ai_guardrails.scan.consts import DEFAULT_POLICY, POLICY_FILE_NAME
 from cycode.logger import get_logger
 
 logger = get_logger('AI Guardrails Hooks')
 
 
-def get_hooks_path(scope: str, repo_path: Optional[Path] = None, ide: AIIDEType = DEFAULT_IDE) -> Path:
-    """Get the hooks.json path for the given scope and IDE.
+_CYCODE_COMMAND_MARKERS = ('cycode ai-guardrails',)
+
 
-    Args:
-        scope: 'user' for user-level hooks, 'repo' for repository-level hooks
-        repo_path: Repository path (required if scope is 'repo')
-        ide: The AI IDE type (default: Cursor)
-    """
-    config = IDE_CONFIGS[ide]
-    if scope == 'repo' and repo_path:
-        return repo_path / config.repo_hooks_subdir / config.hooks_file_name
-    return config.hooks_dir / config.hooks_file_name
+def _is_cycode_command(command: str) -> bool:
+    return any(marker in command for marker in _CYCODE_COMMAND_MARKERS)
+
+
+def is_cycode_hook_entry(entry: dict) -> bool:
+    """Detect Cycode hook entries in both Cursor (flat) and Claude Code (nested) shapes."""
+    command = entry.get('command', '')
+    if _is_cycode_command(command):
+        return True
+
+    for hook in entry.get('hooks', []):
+        if isinstance(hook, dict) and _is_cycode_command(hook.get('command', '')):
+            return True
+
+    return False
 
 
-def load_hooks_file(hooks_path: Path) -> Optional[dict]:
-    """Load existing hooks.json file."""
+def _load_hooks_file(hooks_path: Path) -> Optional[dict]:
     if not hooks_path.exists():
         return None
     try:
-        content = hooks_path.read_text(encoding='utf-8')
-        return json.loads(content)
+        return json.loads(hooks_path.read_text(encoding='utf-8'))
     except Exception as e:
         logger.debug('Failed to load hooks file', exc_info=e)
         return None
 
 
-def save_hooks_file(hooks_path: Path, hooks_config: dict) -> bool:
-    """Save hooks.json file."""
+def _save_hooks_file(hooks_path: Path, hooks_config: dict) -> bool:
     try:
         hooks_path.parent.mkdir(parents=True, exist_ok=True)
         hooks_path.write_text(json.dumps(hooks_config, indent=2), encoding='utf-8')
@@ -62,39 +60,7 @@ def save_hooks_file(hooks_path: Path, hooks_config: dict) -> bool:
         return False
 
 
-_CYCODE_COMMAND_MARKERS = ('cycode ai-guardrails',)
-
-
-def _is_cycode_command(command: str) -> bool:
-    return any(marker in command for marker in _CYCODE_COMMAND_MARKERS)
-
-
-def is_cycode_hook_entry(entry: dict) -> bool:
-    """Check if a hook entry is from cycode-cli.
-
-    Handles both Cursor format (flat) and Claude Code format (nested).
-
-    Cursor format: {"command": "cycode ai-guardrails scan"}
-    Claude Code format: {"hooks": [{"type": "command", "command": "cycode ai-guardrails scan --ide claude-code"}]}
-    """
-    # Check Cursor format (flat command)
-    command = entry.get('command', '')
-    if _is_cycode_command(command):
-        return True
-
-    # Check Claude Code format (nested hooks array)
-    hooks = entry.get('hooks', [])
-    for hook in hooks:
-        if isinstance(hook, dict):
-            hook_command = hook.get('command', '')
-            if _is_cycode_command(hook_command):
-                return True
-
-    return False
-
-
-def _load_policy(policy_path: Path) -> dict:
-    """Load existing policy file merged with defaults, or return defaults if not found."""
+def _load_policy_dict(policy_path: Path) -> dict:
     if not policy_path.exists():
         return copy.deepcopy(DEFAULT_POLICY)
     try:
@@ -107,22 +73,13 @@ def _load_policy(policy_path: Path) -> dict:
 def create_policy_file(scope: str, mode: PolicyMode, repo_path: Optional[Path] = None) -> tuple[bool, str]:
     """Create or update the ai-guardrails.yaml policy file.
 
-    If the file already exists, only the mode field is updated.
-    If it doesn't exist, a new file is created from the default policy.
-
-    Args:
-        scope: 'user' for user-level, 'repo' for repository-level
-        mode: The policy mode to set
-        repo_path: Repository path (required if scope is 'repo')
-
-    Returns:
-        Tuple of (success, message)
+    If the file already exists, only the mode field is updated; otherwise a new
+    file is created from the default policy.
     """
     config_dir = repo_path / '.cycode' if scope == 'repo' and repo_path else Path.home() / '.cycode'
     policy_path = config_dir / POLICY_FILE_NAME
 
-    policy = _load_policy(policy_path)
-
+    policy = _load_policy_dict(policy_path)
     policy['mode'] = mode.value
 
     try:
@@ -135,35 +92,21 @@ def create_policy_file(scope: str, mode: PolicyMode, repo_path: Optional[Path] =
 
 
 def install_hooks(
+    ide: IDE,
     scope: str = 'user',
     repo_path: Optional[Path] = None,
-    ide: AIIDEType = DEFAULT_IDE,
     report_mode: bool = False,
 ) -> tuple[bool, str]:
-    """
-    Install Cycode AI guardrails hooks.
-
-    Args:
-        scope: 'user' for user-level hooks, 'repo' for repository-level hooks
-        repo_path: Repository path (required if scope is 'repo')
-        ide: The AI IDE type (default: Cursor)
-        report_mode: If True, install hooks in async mode (non-blocking)
+    """Install Cycode AI guardrails hooks for ``ide``."""
+    hooks_path = ide.settings_path(scope, repo_path)
 
-    Returns:
-        Tuple of (success, message)
-    """
-    hooks_path = get_hooks_path(scope, repo_path, ide)
-
-    # Load existing hooks or create new
-    existing = load_hooks_file(hooks_path) or {'version': 1, 'hooks': {}}
+    existing = _load_hooks_file(hooks_path) or {'version': 1, 'hooks': {}}
     existing.setdefault('version', 1)
     existing.setdefault('hooks', {})
 
-    # Get IDE-specific hooks configuration
-    hooks_config = get_hooks_config(ide, async_mode=report_mode)
+    rendered = ide.render_hooks_config(async_mode=report_mode)
 
-    # Add/update Cycode hooks
-    for event, entries in hooks_config['hooks'].items():
+    for event, entries in rendered['hooks'].items():
         existing['hooks'].setdefault(event, [])
 
         # Remove any existing Cycode entries for this event
@@ -173,47 +116,31 @@ def install_hooks(
         for entry in entries:
             existing['hooks'][event].append(entry)
 
-    # Save
-    if save_hooks_file(hooks_path, existing):
+    if _save_hooks_file(hooks_path, existing):
         return True, f'AI guardrails hooks installed: {hooks_path}'
     return False, f'Failed to install hooks to {hooks_path}'
 
 
-def uninstall_hooks(
-    scope: str = 'user', repo_path: Optional[Path] = None, ide: AIIDEType = DEFAULT_IDE
-) -> tuple[bool, str]:
-    """
-    Remove Cycode AI guardrails hooks.
-
-    Args:
-        scope: 'user' for user-level hooks, 'repo' for repository-level hooks
-        repo_path: Repository path (required if scope is 'repo')
-        ide: The AI IDE type (default: Cursor)
-
-    Returns:
-        Tuple of (success, message)
-    """
-    hooks_path = get_hooks_path(scope, repo_path, ide)
+def uninstall_hooks(ide: IDE, scope: str = 'user', repo_path: Optional[Path] = None) -> tuple[bool, str]:
+    """Remove Cycode AI guardrails hooks for ``ide``."""
+    hooks_path = ide.settings_path(scope, repo_path)
 
-    existing = load_hooks_file(hooks_path)
+    existing = _load_hooks_file(hooks_path)
     if existing is None:
         return True, f'No hooks file found at {hooks_path}'
 
-    # Remove Cycode entries from all events
     modified = False
     for event in list(existing.get('hooks', {}).keys()):
         original_count = len(existing['hooks'][event])
         existing['hooks'][event] = [e for e in existing['hooks'][event] if not is_cycode_hook_entry(e)]
         if len(existing['hooks'][event]) != original_count:
             modified = True
-        # Remove empty event lists
         if not existing['hooks'][event]:
             del existing['hooks'][event]
 
     if not modified:
         return True, 'No Cycode hooks found to remove'
 
-    # Save or delete if empty
     if not existing.get('hooks'):
         try:
             hooks_path.unlink()
@@ -222,48 +149,35 @@ def uninstall_hooks(
             logger.debug('Failed to delete hooks file', exc_info=e)
             return False, f'Failed to remove hooks file: {hooks_path}'
 
-    if save_hooks_file(hooks_path, existing):
+    if _save_hooks_file(hooks_path, existing):
         return True, f'Cycode hooks removed from: {hooks_path}'
     return False, f'Failed to update hooks file: {hooks_path}'
 
 
-def get_hooks_status(scope: str = 'user', repo_path: Optional[Path] = None, ide: AIIDEType = DEFAULT_IDE) -> dict:
-    """
-    Get the status of AI guardrails hooks.
-
-    Args:
-        scope: 'user' for user-level hooks, 'repo' for repository-level hooks
-        repo_path: Repository path (required if scope is 'repo')
-        ide: The AI IDE type (default: Cursor)
-
-    Returns:
-        Dict with status information
-    """
-    hooks_path = get_hooks_path(scope, repo_path, ide)
+def get_hooks_status(ide: IDE, scope: str = 'user', repo_path: Optional[Path] = None) -> dict:
+    """Return installation status of Cycode hooks for ``ide``."""
+    hooks_path = ide.settings_path(scope, repo_path)
 
-    status = {
+    status: dict = {
         'scope': scope,
-        'ide': ide.value,
-        'ide_name': IDE_CONFIGS[ide].name,
+        'ide': ide.name,
+        'ide_name': ide.display_name,
         'hooks_path': str(hooks_path),
         'file_exists': hooks_path.exists(),
         'cycode_installed': False,
         'hooks': {},
     }
 
-    existing = load_hooks_file(hooks_path)
+    existing = _load_hooks_file(hooks_path)
     if existing is None:
         return status
 
-    # Check each hook event for this IDE
-    ide_config = IDE_CONFIGS[ide]
     has_cycode_hooks = False
-    for event in ide_config.hook_events:
-        # Handle event:matcher format
+    for event in ide.hook_events:
+        # '<event>:<matcher>' filters entries to a specific tool/matcher.
         if ':' in event:
             actual_event, matcher_prefix = event.split(':', 1)
             all_entries = existing.get('hooks', {}).get(actual_event, [])
-            # Filter entries by matcher
             entries = [e for e in all_entries if e.get('matcher', '').startswith(matcher_prefix)]
         else:
             entries = existing.get('hooks', {}).get(event, [])
@@ -278,5 +192,4 @@ def get_hooks_status(scope: str = 'user', repo_path: Optional[Path] = None, ide:
         }
 
     status['cycode_installed'] = has_cycode_hooks
-
     return status

cycode-3.15.4.dev1/cycode/cli/apps/ai_guardrails/ides/__init__.py

@@ -0,0 +1,44 @@
+"""Registry of supported AI guardrails IDE integrations.
+
+Adding a new IDE: create `ides/<name>.py` with a subclass of `IDE`, import it
+here, and include an instance in the `IDES` tuple. Nothing else in the package
+needs to change.
+"""
+
+import typer
+
+from cycode.cli.apps.ai_guardrails.ides.base import IDE
+from cycode.cli.apps.ai_guardrails.ides.claude_code import ClaudeCode
+from cycode.cli.apps.ai_guardrails.ides.cursor import Cursor
+
+# Single source of truth: name → singleton instance.
+# `--ide` choices and install/uninstall/status iteration both derive from this.
+IDES: dict[str, IDE] = {ide.name: ide for ide in (Cursor(), ClaudeCode())}
+
+# Default IDE used when `--ide` is omitted. Kept here so the value is colocated
+# with the registry; no module outside `ides/` needs to know which IDE wins.
+DEFAULT_IDE_NAME = 'cursor'
+
+
+def get_ide(name: str) -> IDE:
+    """Look up the IDE integration registered under ``name``.
+
+    Raises ``typer.BadParameter`` when the name is unknown — surfaces as a
+    user-friendly CLI error rather than a KeyError stack trace.
+    """
+    ide = IDES.get(name.lower())
+    if ide is None:
+        valid = ', '.join(IDES.keys())
+        raise typer.BadParameter(f'Unknown IDE "{name}". Supported: {valid}.')
+    return ide
+
+
+def resolve_ides(name: str) -> list[IDE]:
+    """Resolve an ``--ide`` argument to one or all IDE instances.
+
+    ``"all"`` returns every registered IDE; anything else returns a single
+    matching IDE (raising ``typer.BadParameter`` for unknown names).
+    """
+    if name.lower() == 'all':
+        return list(IDES.values())
+    return [get_ide(name)]

cycode-3.15.4.dev1/cycode/cli/apps/ai_guardrails/ides/base.py

@@ -0,0 +1,156 @@
+"""Base abstractions for AI guardrails IDE integrations.
+
+Each AI IDE (Cursor, Claude Code, …) is represented by a subclass of `IDE`
+that consolidates every IDE-specific concern in a single module: settings file
+paths, hooks template rendering, payload parsing, response building, and any
+IDE-specific session-context lookup.
+
+Adding a new IDE is a matter of:
+  1. Subclassing `IDE` and implementing the abstract methods.
+  2. Registering the instance in `cycode/cli/apps/ai_guardrails/ides/__init__.py`.
+
+The `HookDecision` dataclass is the canonical, IDE-agnostic return type for
+event handlers; `IDE.build_hook_response` translates it into the IDE-specific
+JSON response shape that the IDE expects on stdout.
+"""
+
+from abc import ABC, abstractmethod
+from dataclasses import dataclass
+from enum import Enum
+from pathlib import Path
+from typing import ClassVar, Optional
+
+from cycode.cli.apps.ai_guardrails.scan.payload import AIHookPayload
+from cycode.cli.apps.ai_guardrails.scan.types import AiHookEventType
+
+
+class DecisionAction(str, Enum):
+    """Canonical decision action returned by event handlers."""
+
+    ALLOW = 'allow'
+    DENY = 'deny'
+    ASK = 'ask'
+
+
+@dataclass(frozen=True)
+class HookDecision:
+    """Canonical, IDE-agnostic decision returned by event handlers.
+
+    Carries the event type so `IDE.build_hook_response` can pick the right
+    IDE-specific response shape (Cursor's "permission" style for tool events
+    vs. "continue" style for prompts; Claude Code's "hookSpecificOutput"
+    vs. "decision: block").
+    """
+
+    action: DecisionAction
+    event_type: AiHookEventType
+    user_message: Optional[str] = None
+    agent_message: Optional[str] = None
+
+    @classmethod
+    def allow(cls, event_type: AiHookEventType) -> 'HookDecision':
+        return cls(action=DecisionAction.ALLOW, event_type=event_type)
+
+    @classmethod
+    def deny(
+        cls, event_type: AiHookEventType, user_message: str, agent_message: Optional[str] = None
+    ) -> 'HookDecision':
+        return cls(
+            action=DecisionAction.DENY,
+            event_type=event_type,
+            user_message=user_message,
+            agent_message=agent_message,
+        )
+
+    @classmethod
+    def ask(cls, event_type: AiHookEventType, user_message: str, agent_message: Optional[str] = None) -> 'HookDecision':
+        return cls(
+            action=DecisionAction.ASK,
+            event_type=event_type,
+            user_message=user_message,
+            agent_message=agent_message,
+        )
+
+
+class IDE(ABC):
+    """Per-IDE integration. Owns every IDE-specific concern in a single module.
+
+    Subclasses declare identity via class attributes and implement the abstract
+    methods. Defaults are provided for `get_user_email` and `get_session_context`
+    so IDEs without those capabilities (e.g. no plugin system, no local
+    account file) can skip them.
+    """
+
+    # CLI value passed to --ide (e.g. 'cursor', 'claude-code').
+    name: ClassVar[str]
+    # Human-friendly name for output ('Cursor', 'Claude Code').
+    display_name: ClassVar[str]
+    # Event names for status display. Use '<event>:<matcher>' for IDEs that
+    # qualify a single hook by a sub-matcher (e.g. Claude Code's PreToolUse:Read).
+    hook_events: ClassVar[list[str]]
+
+    # --- install / status ---
+
+    @abstractmethod
+    def settings_path(self, scope: str, repo_path: Optional[Path] = None) -> Path:
+        """Return the hooks/settings file path for the given scope.
+
+        `scope` is 'user' or 'repo'. `repo_path` is required when scope == 'repo'.
+        """
+
+    @abstractmethod
+    def render_hooks_config(self, async_mode: bool = False) -> dict:
+        """Return the settings blob to merge into the IDE's settings file.
+
+        Shape is IDE-specific (Cursor uses a flat ``{event: [{command}]}`` dict;
+        Claude Code uses a nested ``{event: [{hooks: [{type, command}]}]}``
+        dict). Both share the outer ``{"hooks": ...}`` wrapper so
+        ``hooks_manager`` can treat them uniformly.
+        """
+
+    # --- runtime scan ---
+
+    @abstractmethod
+    def matches_payload(self, raw_payload: dict) -> bool:
+        """Return True if ``raw_payload`` originated from this IDE.
+
+        Prevents double-processing when an IDE forwards another IDE's hook
+        event (e.g. Cursor reading Claude Code hooks from ~/.claude/settings.json).
+        """
+
+    @abstractmethod
+    def parse_hook_payload(self, raw_payload: dict) -> AIHookPayload:
+        """Normalize a raw stdin payload into the canonical ``AIHookPayload``."""
+
+    @abstractmethod
+    def build_hook_response(self, decision: HookDecision) -> dict:
+        """Translate a canonical ``HookDecision`` into the IDE-specific JSON.
+
+        The result is what ``scan_command`` writes to stdout for the IDE to
+        act on.
+        """
+
+    # --- session lifecycle (optional; sensible defaults) ---
+
+    def build_session_payload(self, raw_payload: dict) -> AIHookPayload:
+        """Build a session-start payload from the raw stdin payload.
+
+        Default: a minimal payload tagged with this IDE's ``name``. IDEs
+        that need to enrich with transcript/version info should override.
+        """
+        return AIHookPayload(ide_provider=self.name)
+
+    def get_user_email(self) -> Optional[str]:
+        """Best-effort read of the user's email from IDE-specific config.
+
+        Default: None. Override if the IDE stores a usable account locally.
+        """
+        return None
+
+    def get_session_context(self) -> tuple[dict, dict]:
+        """Return ``(mcp_servers, enabled_plugins)`` for session-context reporting.
+
+        Default: empty dicts (no plugin system, no discoverable MCP config).
+        Override to surface MCP/plugin inventory.
+        """
+        return {}, {}