cycode 3.17.3.dev3__tar.gz → 3.17.3.dev4__tar.gz

{cycode-3.17.3.dev3 → cycode-3.17.3.dev4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.17.3.dev3
+Version: 3.17.3.dev4
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE

{cycode-3.17.3.dev3 → cycode-3.17.3.dev4}/cycode/__init__.py

@@ -5,4 +5,4 @@ import time as _time
 # end-to-end scan duration from the moment the user actually triggered it.
 _BOOT_WALL: float = _time.time()
 
-__version__ = '3.17.3.dev3'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
+__version__ = '3.17.3.dev4'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

{cycode-3.17.3.dev3 → cycode-3.17.3.dev4}/cycode/cli/apps/ai_guardrails/ides/base.py

@@ -157,6 +157,15 @@ class IDE(ABC):
         event (e.g. Cursor reading Claude Code hooks from ~/.claude/settings.json).
         """
 
+    def is_synthetic_prompt(self, raw_payload: dict) -> bool:
+        """Return True when a prompt event carries IDE/harness-generated content
+        rather than text the user typed.
+
+        Synthetic prompts are skipped without scanning or telemetry.
+        Default: False. Override for IDEs that inject synthetic user turns.
+        """
+        return False
+
     @abstractmethod
     def parse_hook_payload(self, raw_payload: dict) -> AIHookPayload:
         """Normalize a raw stdin payload into the canonical ``AIHookPayload``."""

{cycode-3.17.3.dev3 → cycode-3.17.3.dev4}/cycode/cli/apps/ai_guardrails/ides/claude_code.py

@@ -22,6 +22,10 @@ logger = get_logger('AI Guardrails Claude Code')
 
 _CLAUDE_CODE_EVENT_NAMES = frozenset({'UserPromptSubmit', 'PreToolUse'})
 
+# When a fork/subagent completes, the harness injects its result into the parent
+# session as a synthetic user turn, which fires UserPromptSubmit.
+_SYNTHETIC_PROMPT_PREFIXES = ('<task-notification>',)
+
 _USER_HOOKS_DIR = Path.home() / '.claude'
 _HOOKS_FILE_NAME = 'settings.json'
 _REPO_SUBDIR = '.claude'
@@ -284,6 +288,12 @@ class ClaudeCode(IDE):
         # processed as Claude Code events.
         return raw_payload.get('hook_event_name', '') in _CLAUDE_CODE_EVENT_NAMES and 'transcript_path' in raw_payload
 
+    def is_synthetic_prompt(self, raw_payload: dict) -> bool:
+        if raw_payload.get('hook_event_name') != 'UserPromptSubmit':
+            return False
+        prompt = raw_payload.get('prompt') or ''
+        return prompt.lstrip().startswith(_SYNTHETIC_PROMPT_PREFIXES)
+
     def parse_hook_payload(self, raw_payload: dict) -> AIHookPayload:
         hook_event_name = raw_payload.get('hook_event_name', '')
         tool_name = raw_payload.get('tool_name', '')

{cycode-3.17.3.dev3 → cycode-3.17.3.dev4}/cycode/cli/apps/ai_guardrails/scan/scan_command.py

@@ -116,6 +116,14 @@ def scan_command(
         output_json(ide_integration.build_hook_response(HookDecision.allow(AiHookEventType.PROMPT)))
         return
 
+    # Fork/subagent completions arrive as synthetic user turns (e.g. Claude Code's
+    # <task-notification>); they are agent-generated, not user prompts - skip before
+    # parse_hook_payload, which reads the transcript and IDE config from disk.
+    if ide_integration.is_synthetic_prompt(payload):
+        logger.debug('Synthetic prompt detected, skipping scan')
+        output_json(ide_integration.build_hook_response(HookDecision.allow(AiHookEventType.PROMPT)))
+        return
+
     unified_payload = ide_integration.parse_hook_payload(payload)
     event_name = unified_payload.event_name
     logger.debug(

{cycode-3.17.3.dev3 → cycode-3.17.3.dev4}/pyproject.toml

@@ -21,7 +21,7 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
 ]
 dynamic = ["dependencies"]
-version = "3.17.3.dev3"
+version = "3.17.3.dev4"
 
 [project.scripts]
 cycode = "cycode.cli.app:app"