cycode 3.16.3.dev5__tar.gz → 3.17.1__tar.gz

{cycode-3.16.3.dev5 → cycode-3.17.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.16.3.dev5
+Version: 3.17.1
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE
@@ -26,7 +26,7 @@ Requires-Dist: click (>=8.1.0,<8.2.0)
 Requires-Dist: colorama (>=0.4.3,<0.5.0)
 Requires-Dist: gitpython (>=3.1.50,<3.2.0)
 Requires-Dist: marshmallow (>=3.15.0,<4.0.0)
-Requires-Dist: mcp (>=1.9.3,<2.0.0) ; python_version >= "3.10"
+Requires-Dist: mcp (>=1.28.1,<2.0.0) ; python_version >= "3.10"
 Requires-Dist: patch-ng (==1.19.1)
 Requires-Dist: pathvalidate (>=3.3.1,<4.0.0)
 Requires-Dist: pydantic (>=2.11.5,<3.0.0)

{cycode-3.16.3.dev5 → cycode-3.17.1}/cycode/__init__.py

@@ -5,4 +5,4 @@ import time as _time
 # end-to-end scan duration from the moment the user actually triggered it.
 _BOOT_WALL: float = _time.time()
 
-__version__ = '3.16.3.dev5'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
+__version__ = '3.17.1'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

{cycode-3.16.3.dev5 → cycode-3.17.1}/cycode/cli/apps/ai_guardrails/scan/policy.py

@@ -3,11 +3,14 @@ Policy loading and configuration management for AI guardrails.
 
 Policies are loaded and merged in order (later overrides earlier):
 1. Built-in defaults (consts.DEFAULT_POLICY)
-2. User-level config (~/.cycode/ai-guardrails.yaml)
-3. Repo-level config (<workspace>/.cycode/ai-guardrails.yaml)
+2. Machine-wide config (admin/MDM-provisioned; see get_machine_policy_path)
+3. User-level config (~/.cycode/ai-guardrails.yaml)
+4. Repo-level config (<workspace>/.cycode/ai-guardrails.yaml)
 """
 
 import json
+import os
+import sys
 from pathlib import Path
 from typing import Any, Optional
 
@@ -16,6 +19,16 @@ import yaml
 from cycode.cli.apps.ai_guardrails.scan.consts import DEFAULT_POLICY, POLICY_FILE_NAME
 
 
+def get_machine_policy_path() -> Path:
+    """Machine-wide (admin/MDM-provisioned) policy path, by platform."""
+    if sys.platform == 'darwin':
+        return Path('/Library/Application Support/Cycode') / POLICY_FILE_NAME
+    if sys.platform == 'win32':
+        program_data = os.environ.get('PROGRAMDATA', 'C:\\ProgramData')
+        return Path(program_data) / 'Cycode' / POLICY_FILE_NAME
+    return Path('/etc/cycode') / POLICY_FILE_NAME
+
+
 def deep_merge(base: dict, override: dict) -> dict:
     """Deep merge two dictionaries, with override taking precedence."""
     result = base.copy()
@@ -61,7 +74,7 @@ def load_policy(workspace_root: Optional[str] = None) -> dict:
     """
     Load policy by merging configs in order of precedence.
 
-    Merge order: defaults <- user config <- repo config
+    Merge order: defaults <- machine <- user config <- repo config
 
     Args:
         workspace_root: Workspace root path for repo-level config lookup.
@@ -69,6 +82,11 @@ def load_policy(workspace_root: Optional[str] = None) -> dict:
     # Start with defaults
     policy = load_defaults()
 
+    # Merge machine-wide config (admin/MDM-provisioned) - overrides defaults, below user/repo.
+    machine_config = load_yaml_file(get_machine_policy_path())
+    if machine_config:
+        policy = deep_merge(policy, machine_config)
+
     # Merge user-level config (if exists)
     user_policy_path = Path.home() / '.cycode' / POLICY_FILE_NAME
     user_config = load_yaml_file(user_policy_path)

{cycode-3.16.3.dev5 → cycode-3.17.1}/cycode/cli/apps/ai_guardrails/scan/scan_command.py

@@ -7,7 +7,6 @@ The handlers in ``handlers.py`` are agent-agnostic (they return
 ``HookDecision``); ``IDE.build_hook_response`` is the per-IDE translation step.
 """
 
-import sys
 from typing import Annotated, Optional, Union
 
 import click
@@ -18,7 +17,7 @@ from cycode.cli.apps.ai_guardrails.ides.base import HookDecision
 from cycode.cli.apps.ai_guardrails.scan.handlers import get_handler_for_event
 from cycode.cli.apps.ai_guardrails.scan.policy import load_policy
 from cycode.cli.apps.ai_guardrails.scan.types import AiHookEventType
-from cycode.cli.apps.ai_guardrails.scan.utils import output_json, safe_json_parse
+from cycode.cli.apps.ai_guardrails.scan.utils import output_json, read_stdin_text, safe_json_parse
 from cycode.cli.exceptions.custom_exceptions import HttpUnauthorizedError
 from cycode.cli.utils.get_api_client import get_ai_security_manager_client, get_scan_cycode_client
 from cycode.logger import get_logger
@@ -91,7 +90,7 @@ def scan_command(
     """
     ide_integration = get_ide(ide)
 
-    stdin_data = sys.stdin.read().strip()
+    stdin_data = read_stdin_text().strip()
     payload = safe_json_parse(stdin_data)
 
     if not payload:
@@ -113,7 +112,8 @@ def scan_command(
     event_name = unified_payload.event_name
     logger.debug('Processing AI guardrails hook', extra={'event_name': event_name, 'ide': ide_integration.name})
 
-    workspace_roots = payload.get('workspace_roots', ['.'])
+    # `or` (not a .get default) - Cursor sends workspace_roots=[] when no folder is open.
+    workspace_roots = payload.get('workspace_roots') or ['.']
     policy = load_policy(workspace_roots[0])
 
     try:

{cycode-3.16.3.dev5 → cycode-3.17.1}/cycode/cli/apps/ai_guardrails/scan/utils.py

@@ -6,11 +6,28 @@ Includes JSON parsing, path matching, and text handling utilities.
 
 import json
 import os
+import sys
 from pathlib import Path
 
 from cycode.cli.apps.ai_guardrails.scan.policy import get_policy_value
 
 
+def read_stdin_text() -> str:
+    """Read the hook payload from stdin as UTF-8 text.
+
+    Reads bytes and decodes with utf-8-sig: hook payloads are UTF-8 JSON, but on Windows
+    Python decodes piped stdin with the ANSI code page (mojibake for non-ASCII prompts),
+    and Cursor on Windows prefixes the payload with a UTF-8 BOM - the -sig codec strips it.
+    """
+    buffer = getattr(sys.stdin, 'buffer', None)
+    if buffer is not None:
+        return buffer.read().decode('utf-8-sig', errors='replace')
+    # No .buffer (tests mocking sys.stdin with StringIO, exotic streams) - text-mode fallback.
+    # lstrip the BOM here too: an already-decoded stream leaves it as U+FEFF, which json.loads
+    # rejects (and .strip() doesn't remove - it is not whitespace).
+    return sys.stdin.read().lstrip('\ufeff')
+
+
 def safe_json_parse(s: str) -> dict:
     """Parse JSON string, returning empty dict on failure."""
     try:

{cycode-3.16.3.dev5 → cycode-3.17.1}/cycode/cli/apps/ai_guardrails/session_start_command.py

@@ -7,7 +7,7 @@ import typer
 
 from cycode.cli.apps.ai_guardrails.ides import DEFAULT_IDE_NAME, get_ide
 from cycode.cli.apps.ai_guardrails.ides.base import IDE
-from cycode.cli.apps.ai_guardrails.scan.utils import safe_json_parse
+from cycode.cli.apps.ai_guardrails.scan.utils import read_stdin_text, safe_json_parse
 from cycode.cli.apps.auth.auth_common import get_authorization_info
 from cycode.cli.apps.auth.auth_manager import AuthManager
 from cycode.cli.exceptions.handle_auth_errors import handle_auth_exception
@@ -78,7 +78,7 @@ def session_start_command(
         logger.debug('No stdin payload (TTY), skipping session initialization')
         return
 
-    stdin_data = sys.stdin.read().strip()
+    stdin_data = read_stdin_text().strip()
     payload = safe_json_parse(stdin_data)
     if not payload:
         logger.debug('Empty or invalid stdin payload, skipping session initialization')

{cycode-3.16.3.dev5 → cycode-3.17.1}/cycode/cli/apps/scan/code_scanner.py

@@ -279,7 +279,10 @@ def scan_documents(
 
     scan_batch_thread_func = _get_scan_documents_thread_func(ctx, is_git_diff, is_commit_range, scan_parameters)
 
-    if should_use_presigned_upload(scan_type):
+    # Presigned single-file upload is async-only; a --sync scan must stay on the batched inline path
+    # so it never builds one oversized zip to POST synchronously.
+    should_use_sync_flow = _should_use_sync_flow(ctx.info_name, scan_type, ctx.obj['sync'])
+    if should_use_presigned_upload(scan_type) and not should_use_sync_flow:
         errors, local_scan_results = _run_presigned_upload_scan(
             scan_batch_thread_func, scan_type, documents_to_scan, progress_bar, printer
         )
@@ -388,7 +391,11 @@ def _perform_scan(
                 is_commit_range,
                 on_upload_progress,
             )
-        except requests.exceptions.RequestException:
+        except (
+            requests.exceptions.RequestException,
+            custom_exceptions.RequestError,
+            custom_exceptions.SlowUploadConnectionError,
+        ):
             logger.warning('Direct upload to object storage failed. Falling back to upload via Cycode API. ')
 
     return _perform_scan_async(

{cycode-3.16.3.dev5 → cycode-3.17.1}/cycode/cli/apps/scan/commit_range_scanner.py

@@ -19,6 +19,7 @@ from cycode.cli.apps.scan.scan_result import (
     print_local_scan_results,
 )
 from cycode.cli.config import configuration_manager
+from cycode.cli.exceptions import custom_exceptions
 from cycode.cli.exceptions.handle_scan_errors import handle_scan_exception
 from cycode.cli.files_collector.commit_range_documents import (
     collect_commit_range_diff_documents,
@@ -162,7 +163,11 @@ def _scan_commit_range_documents(
                         scan_parameters,
                         timeout,
                     )
-                except requests.exceptions.RequestException:
+                except (
+                    requests.exceptions.RequestException,
+                    custom_exceptions.RequestError,
+                    custom_exceptions.SlowUploadConnectionError,
+                ):
                     logger.warning('Direct upload to object storage failed. Falling back to upload via Cycode API. ')
                     scan_result = _perform_commit_range_scan_async(
                         cycode_client,

{cycode-3.16.3.dev5 → cycode-3.17.1}/cycode/cli/consts.py

@@ -222,12 +222,13 @@ EXCLUSIONS_BY_CVE_SECTION_NAME = 'cves'
 FILE_MAX_SIZE_LIMIT_IN_BYTES = 5000000
 
 PRESIGNED_LINK_UPLOADED_ZIP_MAX_SIZE_LIMIT_IN_BYTES = 5 * 1024 * 1024 * 1024  # 5 GB (S3 presigned POST limit)
-PRESIGNED_UPLOAD_SCAN_TYPES = {SAST_SCAN_TYPE}
+PRESIGNED_UPLOAD_SCAN_TYPES = {SAST_SCAN_TYPE, SECRET_SCAN_TYPE}
 
 DEFAULT_ZIP_MAX_SIZE_LIMIT_IN_BYTES = 20 * 1024 * 1024
 ZIP_MAX_SIZE_LIMIT_IN_BYTES = {
     SCA_SCAN_TYPE: 200 * 1024 * 1024,
     SAST_SCAN_TYPE: PRESIGNED_LINK_UPLOADED_ZIP_MAX_SIZE_LIMIT_IN_BYTES,
+    SECRET_SCAN_TYPE: PRESIGNED_LINK_UPLOADED_ZIP_MAX_SIZE_LIMIT_IN_BYTES,
 }
 
 # scan in batches

{cycode-3.16.3.dev5 → cycode-3.17.1}/cycode/cli/files_collector/sca/maven/restore_gradle_dependencies.py

@@ -1,4 +1,5 @@
 import os
+import platform
 import re
 from typing import Optional
 
@@ -12,19 +13,32 @@ from cycode.cli.utils.shell_executor import shell
 BUILD_GRADLE_FILE_NAME = 'build.gradle'
 BUILD_GRADLE_KTS_FILE_NAME = 'build.gradle.kts'
 BUILD_GRADLE_DEP_TREE_FILE_NAME = 'gradle-dependencies-generated.txt'
-BUILD_GRADLE_ALL_PROJECTS_COMMAND = ['gradle', 'projects']
 ALL_PROJECTS_REGEX = r"[+-]{3} Project '(.*?)'"
 
+GRADLE_EXECUTABLE = 'gradle'
+GRADLEW_FILE_NAME = 'gradlew'
+GRADLEW_BAT_FILE_NAME = 'gradlew.bat'
+
 
 class RestoreGradleDependencies(BaseRestoreDependencies):
     def __init__(
         self, ctx: typer.Context, is_git_diff: bool, command_timeout: int, projects: Optional[set[str]] = None
     ) -> None:
         super().__init__(ctx, is_git_diff, command_timeout, create_output_file_manually=True)
+        self.gradle_executable = self._resolve_gradle_executable()
         if projects is None:
             projects = set()
         self.projects = self.get_all_projects() if self.is_gradle_sub_projects() else projects
 
+    def _resolve_gradle_executable(self) -> str:
+        scan_root = get_path_from_context(self.ctx)
+        if scan_root:
+            wrapper_name = GRADLEW_BAT_FILE_NAME if platform.system() == 'Windows' else GRADLEW_FILE_NAME
+            wrapper_path = os.path.join(scan_root, wrapper_name)
+            if os.path.isfile(wrapper_path):
+                return wrapper_path
+        return GRADLE_EXECUTABLE
+
     def is_gradle_sub_projects(self) -> bool:
         return self.ctx.obj.get('gradle_all_sub_projects', False)
 
@@ -35,7 +49,7 @@ class RestoreGradleDependencies(BaseRestoreDependencies):
         return (
             self.get_commands_for_sub_projects(manifest_file_path)
             if self.is_gradle_sub_projects()
-            else [['gradle', 'dependencies', '-b', manifest_file_path, '-q', '--console', 'plain']]
+            else [[self.gradle_executable, 'dependencies', '-b', manifest_file_path, '-q', '--console', 'plain']]
         )
 
     def get_lock_file_name(self) -> str:
@@ -49,7 +63,7 @@ class RestoreGradleDependencies(BaseRestoreDependencies):
 
     def get_all_projects(self) -> set[str]:
         output = shell(
-            command=BUILD_GRADLE_ALL_PROJECTS_COMMAND,
+            command=[self.gradle_executable, 'projects'],
             timeout=self.command_timeout,
             working_directory=get_path_from_context(self.ctx),
         )
@@ -62,7 +76,7 @@ class RestoreGradleDependencies(BaseRestoreDependencies):
         project_name = os.path.basename(os.path.dirname(manifest_file_path))
         project_name = f':{project_name}'
         return (
-            [['gradle', f'{project_name}:dependencies', '-q', '--console', 'plain']]
+            [[self.gradle_executable, f'{project_name}:dependencies', '-q', '--console', 'plain']]
             if project_name in self.projects
             else []
         )

{cycode-3.16.3.dev5 → cycode-3.17.1}/pyproject.toml

@@ -21,7 +21,7 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
 ]
 dynamic = ["dependencies"]
-version = "3.16.3.dev5"
+version = "3.17.1"
 
 [project.scripts]
 cycode = "cycode.cli.app:app"
@@ -46,7 +46,7 @@ rich = ">=13.9.4, <14"
 patch-ng = "1.19.1"
 typer = "^0.15.3"
 tenacity = ">=9.0.0,<9.1.0"
-mcp = { version = ">=1.9.3,<2.0.0", markers = "python_version >= '3.10'" }
+mcp = { version = ">=1.28.1,<2.0.0", markers = "python_version >= '3.10'" }
 pydantic = ">=2.11.5,<3.0.0"
 pathvalidate = ">=3.3.1,<4.0.0"
 tomli-w = ">=1.0.0,<2.0.0"
@@ -54,7 +54,7 @@ tomli = {version = ">=2.0.0,<3.0.0", python = "<3.11"}
 anyio = ">=4.0.0, <4.13.0"
 
 [tool.poetry.group.test.dependencies]
-mock = ">=4.0.3,<4.1.0"
+mock = ">=5.2.0,<5.3.0"
 pytest = ">=7.3.1,<8.5.0"
 pytest-mock = ">=3.10.0,<3.11.0"
 coverage = ">=7.2.3,<7.11.0"
@@ -66,7 +66,7 @@ pyinstaller = {version=">=6.20.0,<7.0.0", python=">=3.9,<3.15"}
 dunamai = ">=1.26.1,<1.27.0"
 
 [tool.poetry.group.dev.dependencies]
-ruff = "0.15.15"
+ruff = "0.15.20"
 
 [tool.pytest.ini_options]
 log_cli = true