cycode 3.17.1.dev10__tar.gz → 3.17.2__tar.gz

{cycode-3.17.1.dev10 → cycode-3.17.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.17.1.dev10
+Version: 3.17.2
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE

{cycode-3.17.1.dev10 → cycode-3.17.2}/cycode/__init__.py

@@ -5,4 +5,4 @@ import time as _time
 # end-to-end scan duration from the moment the user actually triggered it.
 _BOOT_WALL: float = _time.time()
 
-__version__ = '3.17.1.dev10'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
+__version__ = '3.17.2'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

{cycode-3.17.1.dev10 → cycode-3.17.2}/cycode/cli/apps/ai_guardrails/ides/__init__.py

@@ -34,6 +34,25 @@ def get_ide(name: str) -> IDE:
     return ide
 
 
+def collect_all_session_contexts() -> tuple[dict[str, dict], dict]:
+    """Sweep every registered IDE's session context, regardless of which IDE triggered the hook.
+
+    Returns ``(config_files_by_ide, plugins)``: the global MCP config file of each IDE that has
+    one (keyed by IDE name), and the enabled plugins merged across IDEs (first registered IDE
+    wins on a duplicate plugin key - plugins are IDE-agnostic marketplace artifacts).
+    """
+    config_files_by_ide: dict[str, dict] = {}
+    plugins: dict = {}
+    for ide in IDES.values():
+        global_config_file, enabled_plugins = ide.get_session_context()
+        if global_config_file:
+            config_files_by_ide[ide.name] = global_config_file
+        for plugin_key, plugin in (enabled_plugins or {}).items():
+            plugins.setdefault(plugin_key, plugin)
+
+    return config_files_by_ide, plugins
+
+
 def resolve_ides(name: str) -> list[IDE]:
     """Resolve an ``--ide`` argument to one or all IDE instances.
 

{cycode-3.17.1.dev10 → cycode-3.17.2}/cycode/cli/apps/ai_guardrails/ides/_plugin_utils.py

@@ -15,6 +15,22 @@ from cycode.logger import get_logger
 logger = get_logger('AI Guardrails Plugins')
 
 
+def resolve_cached_plugin_dir(cache_root: Path, marketplace: str, plugin_name: str) -> Optional[Path]:
+    """Find ``<cache_root>/<marketplace>/<plugin>/<version-or-hash>/``.
+
+    Both Claude Code and Codex cache installed plugin content in this layout (the trailing
+    segment is a version for Claude, a content hash for Codex). If multiple are cached, pick
+    the most recently modified (name as a deterministic tie-breaker).
+    """
+    base = cache_root / marketplace / plugin_name
+    if not base.is_dir():
+        return None
+    candidates = [d for d in base.iterdir() if d.is_dir()]
+    if not candidates:
+        return None
+    return max(candidates, key=lambda d: (d.stat().st_mtime, d.name))
+
+
 def load_plugin_json(path: Path) -> Optional[dict]:
     """Load a JSON file inside a plugin directory; None if missing or invalid."""
     if not path.exists():

{cycode-3.17.1.dev10 → cycode-3.17.2}/cycode/cli/apps/ai_guardrails/ides/claude_code.py

@@ -10,6 +10,7 @@ from cycode.cli.apps.ai_guardrails.consts import CYCODE_SCAN_PROMPT_COMMAND, CYC
 from cycode.cli.apps.ai_guardrails.ides._plugin_utils import (
     build_global_config_file,
     load_plugin_json,
+    resolve_cached_plugin_dir,
     walk_enabled_plugins,
 )
 from cycode.cli.apps.ai_guardrails.ides.base import IDE, DecisionAction, HookDecision
@@ -164,6 +165,11 @@ def load_claude_settings(settings_path: Optional[Path] = None) -> Optional[dict]
         return None
 
 
+def _plugins_cache_dir() -> Path:
+    """Claude Code's local plugin content cache: ``~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/``."""
+    return Path.home() / '.claude' / 'plugins' / 'cache'
+
+
 def _resolve_marketplace_path(marketplace: dict) -> Optional[Path]:
     """Resolve filesystem path for a directory-type marketplace."""
     source = marketplace.get('source', {})
@@ -194,25 +200,29 @@ def _read_claude_plugin(plugin_dir: Path) -> tuple[dict, dict]:
     if servers:
         entry['mcp_server_names'] = list(servers.keys())
         entry['mcp_config_file_path'] = str(mcp_config_path)
-        entry['mcp_config_file'] = json.dumps(mcp_config)
+        entry['mcp_config_file'] = json.dumps({'mcpServers': servers})
     return entry, servers
 
 
 def resolve_plugins(settings: dict) -> dict:
     """Walk Claude Code's ``enabledPlugins`` via the shared plugin walker.
 
-    Each enabled plugin's marketplace is resolved through
-    ``extraKnownMarketplaces`` to a directory; the rest of the work
-    (manifest + ``.mcp.json``) is the shared ``_read_claude_plugin``.
+    Directory-type marketplaces resolve through ``extraKnownMarketplaces``; all
+    other source types (git, github, ...) resolve through the local plugin cache.
+    The rest of the work (manifest + ``.mcp.json``) is the shared ``_read_claude_plugin``.
     """
     enabled = settings.get('enabledPlugins') or {}
     marketplaces = settings.get('extraKnownMarketplaces') or {}
 
-    def _locate(_plugin_name: str, marketplace_name: str) -> Optional[Path]:
+    def _locate(plugin_name: str, marketplace_name: str) -> Optional[Path]:
+        # Directory-type marketplaces point straight at the plugin source; every other source
+        # type (git, github, ...) is cloned into the local plugin cache.
         marketplace = marketplaces.get(marketplace_name)
-        if not marketplace:
-            return None
-        return _resolve_marketplace_path(marketplace)
+        if marketplace:
+            marketplace_path = _resolve_marketplace_path(marketplace)
+            if marketplace_path is not None:
+                return marketplace_path
+        return resolve_cached_plugin_dir(_plugins_cache_dir(), marketplace_name, plugin_name)
 
     return walk_enabled_plugins(
         plugin_entries=enabled,

{cycode-3.17.1.dev10 → cycode-3.17.2}/cycode/cli/apps/ai_guardrails/ides/codex.py

@@ -17,6 +17,7 @@ from cycode.cli.apps.ai_guardrails.consts import CYCODE_SCAN_PROMPT_COMMAND, CYC
 from cycode.cli.apps.ai_guardrails.ides._plugin_utils import (
     build_global_config_file,
     load_plugin_json,
+    resolve_cached_plugin_dir,
     walk_enabled_plugins,
 )
 from cycode.cli.apps.ai_guardrails.ides.base import IDE, DecisionAction, HookDecision
@@ -100,18 +101,8 @@ def _email_from_auth(auth_path: Optional[Path] = None) -> Optional[str]:
 
 
 def _resolve_codex_plugin_dir(plugin_name: str, marketplace: str) -> Optional[Path]:
-    """Find ``~/.codex/plugins/cache/<marketplace>/<plugin>/<hash>/``.
-
-    The trailing segment is a content hash. If multiple are cached, pick the
-    most recently modified.
-    """
-    base = _codex_home() / 'plugins' / 'cache' / marketplace / plugin_name
-    if not base.is_dir():
-        return None
-    candidates = [d for d in base.iterdir() if d.is_dir()]
-    if not candidates:
-        return None
-    return max(candidates, key=lambda d: d.stat().st_mtime)
+    """Find ``~/.codex/plugins/cache/<marketplace>/<plugin>/<hash>/``."""
+    return resolve_cached_plugin_dir(_codex_home() / 'plugins' / 'cache', marketplace, plugin_name)
 
 
 def _read_codex_plugin(plugin_dir: Path) -> tuple[dict, dict]:
@@ -141,7 +132,7 @@ def _read_codex_plugin(plugin_dir: Path) -> tuple[dict, dict]:
     if servers:
         entry['mcp_server_names'] = list(servers.keys())
         entry['mcp_config_file_path'] = str(mcp_config_path)
-        entry['mcp_config_file'] = json.dumps(mcp_doc)
+        entry['mcp_config_file'] = json.dumps({'mcpServers': servers})
     return entry, servers
 
 

cycode-3.17.2/cycode/cli/apps/ai_guardrails/session_start_command.py

@@ -0,0 +1,160 @@
+"""Handle AI guardrails session start: auth, conversation creation, session context."""
+
+import hashlib
+import json
+import sys
+import time
+from pathlib import Path
+from typing import TYPE_CHECKING, Annotated, Optional
+
+import typer
+
+from cycode.cli.apps.ai_guardrails.ides import DEFAULT_IDE_NAME, collect_all_session_contexts, get_ide
+from cycode.cli.apps.ai_guardrails.scan.utils import read_stdin_text, safe_json_parse
+from cycode.cli.apps.auth.auth_common import get_authorization_info
+from cycode.cli.apps.auth.auth_manager import AuthManager
+from cycode.cli.exceptions.handle_auth_errors import handle_auth_exception
+from cycode.cli.utils.get_api_client import get_ai_security_manager_client
+from cycode.cli.utils.host_info import (
+    get_hostname,
+    get_last_login_user,
+    get_os_version,
+    get_platform_name,
+    get_serial_number,
+)
+from cycode.logger import get_logger
+
+if TYPE_CHECKING:
+    from cycode.cyclient.ai_security_manager_client import AISecurityManagerClient
+
+logger = get_logger('AI Guardrails')
+
+_SESSION_CONTEXT_CACHE_FILE = '.session-context-cache'
+_SESSION_CONTEXT_TTL_SECONDS = 7 * 24 * 60 * 60
+
+
+def _session_context_cache_path() -> Path:
+    return Path.home() / '.cycode' / _SESSION_CONTEXT_CACHE_FILE
+
+
+def _session_context_digest(report: dict) -> str:
+    """Deterministic hash of the outgoing payload (not the raw config files, which churn)."""
+    canonical = json.dumps(report, sort_keys=True, separators=(',', ':'), default=str)
+    return hashlib.sha256(canonical.encode('utf-8')).hexdigest()
+
+
+def _should_skip_report(digest: str, tenant_id: Optional[str]) -> bool:
+    """Skip when the same payload was already sent for this tenant and the TTL hasn't expired."""
+    try:
+        cache = json.loads(_session_context_cache_path().read_text(encoding='utf-8'))
+        return (
+            cache.get('hash') == digest
+            and cache.get('tenant_id') == tenant_id
+            and time.time() - float(cache.get('sent_at', 0)) < _SESSION_CONTEXT_TTL_SECONDS
+        )
+    except Exception:
+        # Missing/corrupt cache reads as a miss - over-sending is harmless
+        return False
+
+
+def _save_report_cache(digest: str, tenant_id: Optional[str]) -> None:
+    try:
+        cache_path = _session_context_cache_path()
+        cache_path.parent.mkdir(parents=True, exist_ok=True)
+        cache_path.write_text(
+            json.dumps({'hash': digest, 'tenant_id': tenant_id, 'sent_at': time.time()}), encoding='utf-8'
+        )
+    except Exception as e:
+        logger.debug('Failed to write session context cache', exc_info=e)
+
+
+def _report_session_context(
+    ai_client: 'AISecurityManagerClient',
+    user_email: Optional[str],
+    tenant_id: Optional[str],
+) -> None:
+    """Report the device + cross-IDE session context to the AI security manager. Never raises.
+
+    The device context is always reported. MCP configs are collected from every registered IDE,
+    not just the triggering one. Unchanged payloads are skipped via a hash cache until the TTL expires.
+    """
+    try:
+        config_files_by_ide, enabled_plugins = collect_all_session_contexts()
+        report = {
+            'hostname': get_hostname(),
+            'platform_name': get_platform_name(),
+            'os_version': get_os_version(),
+            'serial_number': get_serial_number(),
+            'last_login_user': get_last_login_user(),
+            # Sorted by path so the digest is stable regardless of IDE registry order.
+            'config_files': sorted(config_files_by_ide.values(), key=lambda f: f['path']),
+            'enabled_plugins': enabled_plugins,
+            'user_email': user_email,
+        }
+
+        digest = _session_context_digest(report)
+        if _should_skip_report(digest, tenant_id):
+            logger.debug('Session context unchanged; skipping report')
+            return
+
+        if ai_client.report_session_context(**report):
+            _save_report_cache(digest, tenant_id)
+    except Exception as e:
+        logger.debug('Failed to report session context', exc_info=e)
+
+
+def session_start_command(
+    ctx: typer.Context,
+    ide: Annotated[
+        str,
+        typer.Option(
+            '--ide',
+            help='IDE that triggered the session start.',
+            hidden=True,
+        ),
+    ] = DEFAULT_IDE_NAME,
+) -> None:
+    """Handle session start: ensure auth, create conversation, report session context."""
+    ide_integration = get_ide(ide)
+
+    # Ensure authentication
+    auth_info = get_authorization_info(ctx)
+    if auth_info is None:
+        logger.debug('Not authenticated, starting authentication')
+        try:
+            AuthManager().authenticate()
+        except Exception as err:
+            handle_auth_exception(ctx, err)
+            return
+        auth_info = get_authorization_info(ctx)
+    else:
+        logger.debug('Already authenticated')
+
+    # Read stdin payload (backward compat: old hooks pipe no stdin)
+    if sys.stdin.isatty():
+        logger.debug('No stdin payload (TTY), skipping session initialization')
+        return
+
+    stdin_data = read_stdin_text().strip()
+    payload = safe_json_parse(stdin_data)
+    if not payload:
+        logger.debug('Empty or invalid stdin payload, skipping session initialization')
+        return
+
+    # Build session payload + initialize API client
+    session_payload = ide_integration.build_session_payload(payload)
+
+    try:
+        ai_client = get_ai_security_manager_client(ctx)
+    except Exception as e:
+        logger.debug('Failed to initialize AI security client', exc_info=e)
+        return
+
+    # Create conversation
+    try:
+        ai_client.create_conversation(session_payload)
+    except Exception as e:
+        logger.debug('Failed to create conversation during session start', exc_info=e)
+
+    # Report session context (device + cross-IDE MCP servers and plugins)
+    _report_session_context(ai_client, session_payload.ide_user_email, auth_info.tenant_id)

{cycode-3.17.1.dev10 → cycode-3.17.2}/cycode/cli/files_collector/sca/maven/restore_gradle_dependencies.py

@@ -1,4 +1,5 @@
 import os
+import platform
 import re
 from typing import Optional
 
@@ -12,19 +13,32 @@ from cycode.cli.utils.shell_executor import shell
 BUILD_GRADLE_FILE_NAME = 'build.gradle'
 BUILD_GRADLE_KTS_FILE_NAME = 'build.gradle.kts'
 BUILD_GRADLE_DEP_TREE_FILE_NAME = 'gradle-dependencies-generated.txt'
-BUILD_GRADLE_ALL_PROJECTS_COMMAND = ['gradle', 'projects']
 ALL_PROJECTS_REGEX = r"[+-]{3} Project '(.*?)'"
 
+GRADLE_EXECUTABLE = 'gradle'
+GRADLEW_FILE_NAME = 'gradlew'
+GRADLEW_BAT_FILE_NAME = 'gradlew.bat'
+
 
 class RestoreGradleDependencies(BaseRestoreDependencies):
     def __init__(
         self, ctx: typer.Context, is_git_diff: bool, command_timeout: int, projects: Optional[set[str]] = None
     ) -> None:
         super().__init__(ctx, is_git_diff, command_timeout, create_output_file_manually=True)
+        self.gradle_executable = self._resolve_gradle_executable()
         if projects is None:
             projects = set()
         self.projects = self.get_all_projects() if self.is_gradle_sub_projects() else projects
 
+    def _resolve_gradle_executable(self) -> str:
+        scan_root = get_path_from_context(self.ctx)
+        if scan_root:
+            wrapper_name = GRADLEW_BAT_FILE_NAME if platform.system() == 'Windows' else GRADLEW_FILE_NAME
+            wrapper_path = os.path.join(scan_root, wrapper_name)
+            if os.path.isfile(wrapper_path):
+                return wrapper_path
+        return GRADLE_EXECUTABLE
+
     def is_gradle_sub_projects(self) -> bool:
         return self.ctx.obj.get('gradle_all_sub_projects', False)
 
@@ -35,7 +49,7 @@ class RestoreGradleDependencies(BaseRestoreDependencies):
         return (
             self.get_commands_for_sub_projects(manifest_file_path)
             if self.is_gradle_sub_projects()
-            else [['gradle', 'dependencies', '-b', manifest_file_path, '-q', '--console', 'plain']]
+            else [[self.gradle_executable, 'dependencies', '-b', manifest_file_path, '-q', '--console', 'plain']]
         )
 
     def get_lock_file_name(self) -> str:
@@ -49,7 +63,7 @@ class RestoreGradleDependencies(BaseRestoreDependencies):
 
     def get_all_projects(self) -> set[str]:
         output = shell(
-            command=BUILD_GRADLE_ALL_PROJECTS_COMMAND,
+            command=[self.gradle_executable, 'projects'],
             timeout=self.command_timeout,
             working_directory=get_path_from_context(self.ctx),
         )
@@ -62,7 +76,7 @@ class RestoreGradleDependencies(BaseRestoreDependencies):
         project_name = os.path.basename(os.path.dirname(manifest_file_path))
         project_name = f':{project_name}'
         return (
-            [['gradle', f'{project_name}:dependencies', '-q', '--console', 'plain']]
+            [[self.gradle_executable, f'{project_name}:dependencies', '-q', '--console', 'plain']]
             if project_name in self.projects
             else []
         )

{cycode-3.17.1.dev10 → cycode-3.17.2}/cycode/cyclient/ai_security_manager_client.py

@@ -98,11 +98,11 @@ class AISecurityManagerClient:
         os_version: Optional[str] = None,
         serial_number: Optional[str] = None,
         last_login_user: Optional[str] = None,
-        global_config_file: Optional[dict] = None,
+        config_files: Optional[list[dict]] = None,
         enabled_plugins: Optional[dict] = None,
         user_email: Optional[str] = None,
-    ) -> None:
-        """Report session context to the backend."""
+    ) -> bool:
+        """Report session context to the backend. Returns whether the report was accepted."""
         body: dict = {
             'hostname': hostname,
             'platform_name': platform_name,
@@ -110,12 +110,14 @@ class AISecurityManagerClient:
             'serial_number': serial_number,
             'last_login_user': last_login_user,
             'user_email': user_email,
-            'global_config_file': global_config_file,
+            'config_files': config_files,
             'enabled_plugins': enabled_plugins,
         }
 
         try:
             self.client.post(self._build_endpoint_path(self._SESSION_CONTEXT_PATH), body=body)
+            return True
         except Exception as e:
             logger.debug('Failed to report session context', exc_info=e)
             # Don't fail the session if reporting fails
+            return False

{cycode-3.17.1.dev10 → cycode-3.17.2}/pyproject.toml

@@ -21,7 +21,7 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
 ]
 dynamic = ["dependencies"]
-version = "3.17.1.dev10"
+version = "3.17.2"
 
 [project.scripts]
 cycode = "cycode.cli.app:app"

cycode-3.17.1.dev10/cycode/cli/apps/ai_guardrails/session_start_command.py

@@ -1,103 +0,0 @@
-"""Handle AI guardrails session start: auth, conversation creation, session context."""
-
-import sys
-from typing import TYPE_CHECKING, Annotated, Optional
-
-import typer
-
-from cycode.cli.apps.ai_guardrails.ides import DEFAULT_IDE_NAME, get_ide
-from cycode.cli.apps.ai_guardrails.ides.base import IDE
-from cycode.cli.apps.ai_guardrails.scan.utils import read_stdin_text, safe_json_parse
-from cycode.cli.apps.auth.auth_common import get_authorization_info
-from cycode.cli.apps.auth.auth_manager import AuthManager
-from cycode.cli.exceptions.handle_auth_errors import handle_auth_exception
-from cycode.cli.utils.get_api_client import get_ai_security_manager_client
-from cycode.cli.utils.host_info import (
-    get_hostname,
-    get_last_login_user,
-    get_os_version,
-    get_platform_name,
-    get_serial_number,
-)
-from cycode.logger import get_logger
-
-if TYPE_CHECKING:
-    from cycode.cyclient.ai_security_manager_client import AISecurityManagerClient
-
-logger = get_logger('AI Guardrails')
-
-
-def _report_session_context(ai_client: 'AISecurityManagerClient', ide: IDE, user_email: Optional[str]) -> None:
-    """Report IDE session context to the AI security manager. Never raises."""
-    try:
-        global_config_file, enabled_plugins = ide.get_session_context()
-        if not global_config_file and not enabled_plugins:
-            return
-        ai_client.report_session_context(
-            hostname=get_hostname(),
-            platform_name=get_platform_name(),
-            os_version=get_os_version(),
-            serial_number=get_serial_number(),
-            last_login_user=get_last_login_user(),
-            global_config_file=global_config_file,
-            enabled_plugins=enabled_plugins,
-            user_email=user_email,
-        )
-    except Exception as e:
-        logger.debug('Failed to report session context', exc_info=e)
-
-
-def session_start_command(
-    ctx: typer.Context,
-    ide: Annotated[
-        str,
-        typer.Option(
-            '--ide',
-            help='IDE that triggered the session start.',
-            hidden=True,
-        ),
-    ] = DEFAULT_IDE_NAME,
-) -> None:
-    """Handle session start: ensure auth, create conversation, report session context."""
-    ide_integration = get_ide(ide)
-
-    # Step 1: Ensure authentication
-    auth_info = get_authorization_info(ctx)
-    if auth_info is None:
-        logger.debug('Not authenticated, starting authentication')
-        try:
-            AuthManager().authenticate()
-        except Exception as err:
-            handle_auth_exception(ctx, err)
-            return
-    else:
-        logger.debug('Already authenticated')
-
-    # Step 2: Read stdin payload (backward compat: old hooks pipe no stdin)
-    if sys.stdin.isatty():
-        logger.debug('No stdin payload (TTY), skipping session initialization')
-        return
-
-    stdin_data = read_stdin_text().strip()
-    payload = safe_json_parse(stdin_data)
-    if not payload:
-        logger.debug('Empty or invalid stdin payload, skipping session initialization')
-        return
-
-    # Step 3: Build session payload + initialize API client
-    session_payload = ide_integration.build_session_payload(payload)
-
-    try:
-        ai_client = get_ai_security_manager_client(ctx)
-    except Exception as e:
-        logger.debug('Failed to initialize AI security client', exc_info=e)
-        return
-
-    # Step 4: Create conversation
-    try:
-        ai_client.create_conversation(session_payload)
-    except Exception as e:
-        logger.debug('Failed to create conversation during session start', exc_info=e)
-
-    # Step 5: Report session context (MCP servers, enabled plugins)
-    _report_session_context(ai_client, ide_integration, session_payload.ide_user_email)