cycode 3.17.1.dev7__tar.gz → 3.17.1.dev9__tar.gz

{cycode-3.17.1.dev7 → cycode-3.17.1.dev9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.17.1.dev7
+Version: 3.17.1.dev9
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE

{cycode-3.17.1.dev7 → cycode-3.17.1.dev9}/cycode/__init__.py

@@ -5,4 +5,4 @@ import time as _time
 # end-to-end scan duration from the moment the user actually triggered it.
 _BOOT_WALL: float = _time.time()
 
-__version__ = '3.17.1.dev7'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
+__version__ = '3.17.1.dev9'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

{cycode-3.17.1.dev7 → cycode-3.17.1.dev9}/cycode/cli/apps/ai_guardrails/scan/policy.py

@@ -3,11 +3,14 @@ Policy loading and configuration management for AI guardrails.
 
 Policies are loaded and merged in order (later overrides earlier):
 1. Built-in defaults (consts.DEFAULT_POLICY)
-2. User-level config (~/.cycode/ai-guardrails.yaml)
-3. Repo-level config (<workspace>/.cycode/ai-guardrails.yaml)
+2. Machine-wide config (admin/MDM-provisioned; see get_machine_policy_path)
+3. User-level config (~/.cycode/ai-guardrails.yaml)
+4. Repo-level config (<workspace>/.cycode/ai-guardrails.yaml)
 """
 
 import json
+import os
+import sys
 from pathlib import Path
 from typing import Any, Optional
 
@@ -16,6 +19,16 @@ import yaml
 from cycode.cli.apps.ai_guardrails.scan.consts import DEFAULT_POLICY, POLICY_FILE_NAME
 
 
+def get_machine_policy_path() -> Path:
+    """Machine-wide (admin/MDM-provisioned) policy path, by platform."""
+    if sys.platform == 'darwin':
+        return Path('/Library/Application Support/Cycode') / POLICY_FILE_NAME
+    if sys.platform == 'win32':
+        program_data = os.environ.get('PROGRAMDATA', 'C:\\ProgramData')
+        return Path(program_data) / 'Cycode' / POLICY_FILE_NAME
+    return Path('/etc/cycode') / POLICY_FILE_NAME
+
+
 def deep_merge(base: dict, override: dict) -> dict:
     """Deep merge two dictionaries, with override taking precedence."""
     result = base.copy()
@@ -61,7 +74,7 @@ def load_policy(workspace_root: Optional[str] = None) -> dict:
     """
     Load policy by merging configs in order of precedence.
 
-    Merge order: defaults <- user config <- repo config
+    Merge order: defaults <- machine <- user config <- repo config
 
     Args:
         workspace_root: Workspace root path for repo-level config lookup.
@@ -69,6 +82,11 @@ def load_policy(workspace_root: Optional[str] = None) -> dict:
     # Start with defaults
     policy = load_defaults()
 
+    # Merge machine-wide config (admin/MDM-provisioned) - overrides defaults, below user/repo.
+    machine_config = load_yaml_file(get_machine_policy_path())
+    if machine_config:
+        policy = deep_merge(policy, machine_config)
+
     # Merge user-level config (if exists)
     user_policy_path = Path.home() / '.cycode' / POLICY_FILE_NAME
     user_config = load_yaml_file(user_policy_path)

{cycode-3.17.1.dev7 → cycode-3.17.1.dev9}/pyproject.toml

@@ -21,7 +21,7 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
 ]
 dynamic = ["dependencies"]
-version = "3.17.1.dev7"
+version = "3.17.1.dev9"
 
 [project.scripts]
 cycode = "cycode.cli.app:app"