cycode 3.17.1.dev8__py3-none-any.whl → 3.17.1.dev10__py3-none-any.whl

cycode/__init__.py

@@ -5,4 +5,4 @@ import time as _time
 # end-to-end scan duration from the moment the user actually triggered it.
 _BOOT_WALL: float = _time.time()
 
-__version__ = '3.17.1.dev8'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
+__version__ = '3.17.1.dev10'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

cycode/cli/apps/ai_guardrails/scan/policy.py

@@ -3,11 +3,14 @@ Policy loading and configuration management for AI guardrails.
 
 Policies are loaded and merged in order (later overrides earlier):
 1. Built-in defaults (consts.DEFAULT_POLICY)
-2. User-level config (~/.cycode/ai-guardrails.yaml)
-3. Repo-level config (<workspace>/.cycode/ai-guardrails.yaml)
+2. Machine-wide config (admin/MDM-provisioned; see get_machine_policy_path)
+3. User-level config (~/.cycode/ai-guardrails.yaml)
+4. Repo-level config (<workspace>/.cycode/ai-guardrails.yaml)
 """
 
 import json
+import os
+import sys
 from pathlib import Path
 from typing import Any, Optional
 
@@ -16,6 +19,16 @@ import yaml
 from cycode.cli.apps.ai_guardrails.scan.consts import DEFAULT_POLICY, POLICY_FILE_NAME
 
 
+def get_machine_policy_path() -> Path:
+    """Machine-wide (admin/MDM-provisioned) policy path, by platform."""
+    if sys.platform == 'darwin':
+        return Path('/Library/Application Support/Cycode') / POLICY_FILE_NAME
+    if sys.platform == 'win32':
+        program_data = os.environ.get('PROGRAMDATA', 'C:\\ProgramData')
+        return Path(program_data) / 'Cycode' / POLICY_FILE_NAME
+    return Path('/etc/cycode') / POLICY_FILE_NAME
+
+
 def deep_merge(base: dict, override: dict) -> dict:
     """Deep merge two dictionaries, with override taking precedence."""
     result = base.copy()
@@ -61,7 +74,7 @@ def load_policy(workspace_root: Optional[str] = None) -> dict:
     """
     Load policy by merging configs in order of precedence.
 
-    Merge order: defaults <- user config <- repo config
+    Merge order: defaults <- machine <- user config <- repo config
 
     Args:
         workspace_root: Workspace root path for repo-level config lookup.
@@ -69,6 +82,11 @@ def load_policy(workspace_root: Optional[str] = None) -> dict:
     # Start with defaults
     policy = load_defaults()
 
+    # Merge machine-wide config (admin/MDM-provisioned) - overrides defaults, below user/repo.
+    machine_config = load_yaml_file(get_machine_policy_path())
+    if machine_config:
+        policy = deep_merge(policy, machine_config)
+
     # Merge user-level config (if exists)
     user_policy_path = Path.home() / '.cycode' / POLICY_FILE_NAME
     user_config = load_yaml_file(user_policy_path)

cycode/cli/apps/ai_guardrails/scan/scan_command.py

@@ -7,7 +7,6 @@ The handlers in ``handlers.py`` are agent-agnostic (they return
 ``HookDecision``); ``IDE.build_hook_response`` is the per-IDE translation step.
 """
 
-import sys
 from typing import Annotated, Optional, Union
 
 import click
@@ -18,7 +17,7 @@ from cycode.cli.apps.ai_guardrails.ides.base import HookDecision
 from cycode.cli.apps.ai_guardrails.scan.handlers import get_handler_for_event
 from cycode.cli.apps.ai_guardrails.scan.policy import load_policy
 from cycode.cli.apps.ai_guardrails.scan.types import AiHookEventType
-from cycode.cli.apps.ai_guardrails.scan.utils import output_json, safe_json_parse
+from cycode.cli.apps.ai_guardrails.scan.utils import output_json, read_stdin_text, safe_json_parse
 from cycode.cli.exceptions.custom_exceptions import HttpUnauthorizedError
 from cycode.cli.utils.get_api_client import get_ai_security_manager_client, get_scan_cycode_client
 from cycode.logger import get_logger
@@ -91,7 +90,7 @@ def scan_command(
     """
     ide_integration = get_ide(ide)
 
-    stdin_data = sys.stdin.read().strip()
+    stdin_data = read_stdin_text().strip()
     payload = safe_json_parse(stdin_data)
 
     if not payload:
@@ -113,7 +112,8 @@ def scan_command(
     event_name = unified_payload.event_name
     logger.debug('Processing AI guardrails hook', extra={'event_name': event_name, 'ide': ide_integration.name})
 
-    workspace_roots = payload.get('workspace_roots', ['.'])
+    # `or` (not a .get default) - Cursor sends workspace_roots=[] when no folder is open.
+    workspace_roots = payload.get('workspace_roots') or ['.']
     policy = load_policy(workspace_roots[0])
 
     try:

cycode/cli/apps/ai_guardrails/scan/utils.py

@@ -6,11 +6,28 @@ Includes JSON parsing, path matching, and text handling utilities.
 
 import json
 import os
+import sys
 from pathlib import Path
 
 from cycode.cli.apps.ai_guardrails.scan.policy import get_policy_value
 
 
+def read_stdin_text() -> str:
+    """Read the hook payload from stdin as UTF-8 text.
+
+    Reads bytes and decodes with utf-8-sig: hook payloads are UTF-8 JSON, but on Windows
+    Python decodes piped stdin with the ANSI code page (mojibake for non-ASCII prompts),
+    and Cursor on Windows prefixes the payload with a UTF-8 BOM - the -sig codec strips it.
+    """
+    buffer = getattr(sys.stdin, 'buffer', None)
+    if buffer is not None:
+        return buffer.read().decode('utf-8-sig', errors='replace')
+    # No .buffer (tests mocking sys.stdin with StringIO, exotic streams) - text-mode fallback.
+    # lstrip the BOM here too: an already-decoded stream leaves it as U+FEFF, which json.loads
+    # rejects (and .strip() doesn't remove - it is not whitespace).
+    return sys.stdin.read().lstrip('\ufeff')
+
+
 def safe_json_parse(s: str) -> dict:
     """Parse JSON string, returning empty dict on failure."""
     try:

cycode/cli/apps/ai_guardrails/session_start_command.py

@@ -7,7 +7,7 @@ import typer
 
 from cycode.cli.apps.ai_guardrails.ides import DEFAULT_IDE_NAME, get_ide
 from cycode.cli.apps.ai_guardrails.ides.base import IDE
-from cycode.cli.apps.ai_guardrails.scan.utils import safe_json_parse
+from cycode.cli.apps.ai_guardrails.scan.utils import read_stdin_text, safe_json_parse
 from cycode.cli.apps.auth.auth_common import get_authorization_info
 from cycode.cli.apps.auth.auth_manager import AuthManager
 from cycode.cli.exceptions.handle_auth_errors import handle_auth_exception
@@ -78,7 +78,7 @@ def session_start_command(
         logger.debug('No stdin payload (TTY), skipping session initialization')
         return
 
-    stdin_data = sys.stdin.read().strip()
+    stdin_data = read_stdin_text().strip()
     payload = safe_json_parse(stdin_data)
     if not payload:
         logger.debug('Empty or invalid stdin payload, skipping session initialization')

{cycode-3.17.1.dev8.dist-info → cycode-3.17.1.dev10.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.17.1.dev8
+Version: 3.17.1.dev10
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE

{cycode-3.17.1.dev8.dist-info → cycode-3.17.1.dev10.dist-info}/RECORD

@@ -1,4 +1,4 @@
-cycode/__init__.py,sha256=YSdPg9fgxcpkKFNF7rovN0Z4AUob6WOpHT85BhbE94o,396
+cycode/__init__.py,sha256=UjdGx8D2pbm-DIgUO0-gvR92y-C7W85PfkiKjo0b-eg,397
 cycode/__main__.py,sha256=Z3bD5yrA7yPvAChcADQrqCaZd0ChGI1gdiwALwbWJ6U,104
 cycode/cli/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 cycode/cli/app.py,sha256=AlR2durAEbsa47PDfIj7JtMvJDWA_Dq6wPtVuMJYSCs,10250
@@ -19,11 +19,11 @@ cycode/cli/apps/ai_guardrails/scan/__init__.py,sha256=qJc82XiQGiAuc1sYY8Ij_A-qXp
 cycode/cli/apps/ai_guardrails/scan/consts.py,sha256=drAslw6vW3kxmbCs2qPCUbUPR7PJouT2lsXtu5sD-lQ,1094
 cycode/cli/apps/ai_guardrails/scan/handlers.py,sha256=pf5PrUIVnGLEEE6QKPny9at5V6Ms5u2IEtFP72hKgqA,15523
 cycode/cli/apps/ai_guardrails/scan/payload.py,sha256=pvT3UUqNMvdK3EVzzPjy4JMlOrF-WgxZ3fHN2AtN5eA,1126
-cycode/cli/apps/ai_guardrails/scan/policy.py,sha256=39s8hnxgjny1l6XAO59wsRcAlpW-LG00GUnO0PfqvuY,2566
-cycode/cli/apps/ai_guardrails/scan/scan_command.py,sha256=-Gl7cHELF1wlwLGno6ZVukFtK6NI6Z3-dTpIOsz8ors,6079
+cycode/cli/apps/ai_guardrails/scan/policy.py,sha256=BZoNNdDQ9tqnfwhB4X1-bDtudaOQc_gXizm3IVwa28o,3351
+cycode/cli/apps/ai_guardrails/scan/scan_command.py,sha256=uiBCDGcshqgvwkdqrlwNbaGZQnjpAvuTZ9T7UI09YJY,6178
 cycode/cli/apps/ai_guardrails/scan/types.py,sha256=lDttkYFBfOkdMEEaRbq1IT2QTK0R-7Ht3T8vZdyB3b4,1038
-cycode/cli/apps/ai_guardrails/scan/utils.py,sha256=KVfX-NrcM-QW4quLtoNqfmz4GF0FlDs-TkqUOu1hAWM,2057
-cycode/cli/apps/ai_guardrails/session_start_command.py,sha256=vZKcThgD6qLpPrTlnE9dyakLUti-EcGgOw1zL35gZ5U,3682
+cycode/cli/apps/ai_guardrails/scan/utils.py,sha256=QzR_zmivDYwg2-F8g4bFfsycHhNo-pPuJly0P_l0gm8,2879
+cycode/cli/apps/ai_guardrails/session_start_command.py,sha256=_N7dDi2bv7IykvB7xtCFFZgP0YmvT8-jxeSywBM57Os,3700
 cycode/cli/apps/ai_guardrails/status_command.py,sha256=Uqss68TEPCYPXpLix6Bh-4J3g-khxWsAqlIGYH5x4bQ,3203
 cycode/cli/apps/ai_guardrails/uninstall_command.py,sha256=dOmePfZmlHAPy2zEJM1yMtSuDqvzDwtqgmLKYK-T9PI,2698
 cycode/cli/apps/ai_remediation/__init__.py,sha256=8vYthY9RQeJqEni3AIF5sryz8n-XJQ6VNqG4aEFBAdY,553
@@ -209,8 +209,8 @@ cycode/cyclient/report_client.py,sha256=Scq30NeJPzgXv0hPLO1U05AdE9i_2iu6cIrSKpEJ
 cycode/cyclient/scan_client.py,sha256=6TK5FQkfrvV7PHqRnUzEn1PBNd2oPYVamvIixcUfe3c,16755
 cycode/cyclient/scan_config_base.py,sha256=mXsPZGYCtp85rv5GIige40yQZXuRcEKUW-VQJ0vgFzk,1201
 cycode/logger.py,sha256=EfZGRK6VC5rE_LAjIcRrHFiQCueylCDXoG6bvGkrIME,2111
-cycode-3.17.1.dev8.dist-info/METADATA,sha256=iQ503XsITIxsWVpG8_jQa2nNvVLlDEDZe0vM5S1cApM,89246
-cycode-3.17.1.dev8.dist-info/WHEEL,sha256=zp0Cn7JsFoX2ATtOhtaFYIiE2rmFAD4OcMhtUki8W3U,88
-cycode-3.17.1.dev8.dist-info/entry_points.txt,sha256=iDcVJM8ByLElVgvBgtYxDjw1kT7O8Mo0LcWZIT5L3Ig,45
-cycode-3.17.1.dev8.dist-info/licenses/LICENCE,sha256=2Wx4N6mD_4xB7-E3hPkZ3MPhpJy__k_I8MaCSO-PDRo,1068
-cycode-3.17.1.dev8.dist-info/RECORD,,
+cycode-3.17.1.dev10.dist-info/METADATA,sha256=CUUCwEIh2CKhigEh5u90CphxtOsYx7vLfutsxfaTKkE,89247
+cycode-3.17.1.dev10.dist-info/WHEEL,sha256=zp0Cn7JsFoX2ATtOhtaFYIiE2rmFAD4OcMhtUki8W3U,88
+cycode-3.17.1.dev10.dist-info/entry_points.txt,sha256=iDcVJM8ByLElVgvBgtYxDjw1kT7O8Mo0LcWZIT5L3Ig,45
+cycode-3.17.1.dev10.dist-info/licenses/LICENCE,sha256=2Wx4N6mD_4xB7-E3hPkZ3MPhpJy__k_I8MaCSO-PDRo,1068
+cycode-3.17.1.dev10.dist-info/RECORD,,