cycode 3.17.3.dev3__tar.gz → 3.17.3.dev5__tar.gz

{cycode-3.17.3.dev3 → cycode-3.17.3.dev5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.17.3.dev3
+Version: 3.17.3.dev5
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE

{cycode-3.17.3.dev3 → cycode-3.17.3.dev5}/cycode/__init__.py

@@ -5,4 +5,4 @@ import time as _time
 # end-to-end scan duration from the moment the user actually triggered it.
 _BOOT_WALL: float = _time.time()
 
-__version__ = '3.17.3.dev3'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
+__version__ = '3.17.3.dev5'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

{cycode-3.17.3.dev3 → cycode-3.17.3.dev5}/cycode/cli/apps/ai_guardrails/ides/base.py

@@ -157,6 +157,15 @@ class IDE(ABC):
         event (e.g. Cursor reading Claude Code hooks from ~/.claude/settings.json).
         """
 
+    def is_synthetic_prompt(self, raw_payload: dict) -> bool:
+        """Return True when a prompt event carries IDE/harness-generated content
+        rather than text the user typed.
+
+        Synthetic prompts are skipped without scanning or telemetry.
+        Default: False. Override for IDEs that inject synthetic user turns.
+        """
+        return False
+
     @abstractmethod
     def parse_hook_payload(self, raw_payload: dict) -> AIHookPayload:
         """Normalize a raw stdin payload into the canonical ``AIHookPayload``."""

{cycode-3.17.3.dev3 → cycode-3.17.3.dev5}/cycode/cli/apps/ai_guardrails/ides/claude_code.py

@@ -22,6 +22,10 @@ logger = get_logger('AI Guardrails Claude Code')
 
 _CLAUDE_CODE_EVENT_NAMES = frozenset({'UserPromptSubmit', 'PreToolUse'})
 
+# When a fork/subagent completes, the harness injects its result into the parent
+# session as a synthetic user turn, which fires UserPromptSubmit.
+_SYNTHETIC_PROMPT_PREFIXES = ('<task-notification>',)
+
 _USER_HOOKS_DIR = Path.home() / '.claude'
 _HOOKS_FILE_NAME = 'settings.json'
 _REPO_SUBDIR = '.claude'
@@ -284,6 +288,12 @@ class ClaudeCode(IDE):
         # processed as Claude Code events.
         return raw_payload.get('hook_event_name', '') in _CLAUDE_CODE_EVENT_NAMES and 'transcript_path' in raw_payload
 
+    def is_synthetic_prompt(self, raw_payload: dict) -> bool:
+        if raw_payload.get('hook_event_name') != 'UserPromptSubmit':
+            return False
+        prompt = raw_payload.get('prompt') or ''
+        return prompt.lstrip().startswith(_SYNTHETIC_PROMPT_PREFIXES)
+
     def parse_hook_payload(self, raw_payload: dict) -> AIHookPayload:
         hook_event_name = raw_payload.get('hook_event_name', '')
         tool_name = raw_payload.get('tool_name', '')

{cycode-3.17.3.dev3 → cycode-3.17.3.dev5}/cycode/cli/apps/ai_guardrails/scan/handlers.py

@@ -26,6 +26,7 @@ from cycode.cli.apps.ai_guardrails.scan.utils import is_denied_path, truncate_ut
 from cycode.cli.apps.scan.code_scanner import _get_scan_documents_thread_func
 from cycode.cli.apps.scan.scan_parameters import get_scan_parameters
 from cycode.cli.cli_types import ScanTypeOption, SeverityOption
+from cycode.cli.files_collector.file_excluder import is_path_configured_in_exclusions
 from cycode.cli.models import Document
 from cycode.cli.utils.progress_bar import DummyProgressBar, ScanProgressBarSection
 from cycode.cli.utils.scan_utils import build_violation_summary
@@ -337,7 +338,7 @@ def _perform_scan(
 
     scan_id = local_scan_result.scan_id
 
-    if local_scan_result.detections_count > 0:
+    if local_scan_result.issue_detected:
         violation_summary = build_violation_summary([local_scan_result])
         return violation_summary, scan_id
 
@@ -360,6 +361,10 @@ def _scan_path_for_secrets(ctx: typer.Context, file_path: str, policy: dict) ->
     if not file_path or not os.path.isfile(file_path):
         return None, None
 
+    if is_path_configured_in_exclusions(str(ScanTypeOption.SECRET), os.path.abspath(file_path)):
+        logger.debug('Skipping scan; the path is in the ignore paths list, %s', {'file_path': file_path})
+        return None, None
+
     max_bytes = get_policy_value(policy, 'secrets', 'max_bytes', default=200000)
 
     with open(file_path, encoding='utf-8', errors='replace') as f:

{cycode-3.17.3.dev3 → cycode-3.17.3.dev5}/cycode/cli/apps/ai_guardrails/scan/scan_command.py

@@ -116,6 +116,14 @@ def scan_command(
         output_json(ide_integration.build_hook_response(HookDecision.allow(AiHookEventType.PROMPT)))
         return
 
+    # Fork/subagent completions arrive as synthetic user turns (e.g. Claude Code's
+    # <task-notification>); they are agent-generated, not user prompts - skip before
+    # parse_hook_payload, which reads the transcript and IDE config from disk.
+    if ide_integration.is_synthetic_prompt(payload):
+        logger.debug('Synthetic prompt detected, skipping scan')
+        output_json(ide_integration.build_hook_response(HookDecision.allow(AiHookEventType.PROMPT)))
+        return
+
     unified_payload = ide_integration.parse_hook_payload(payload)
     event_name = unified_payload.event_name
     logger.debug(

{cycode-3.17.3.dev3 → cycode-3.17.3.dev5}/cycode/cli/files_collector/file_excluder.py

@@ -25,7 +25,7 @@ def _is_subpath_of_cycode_configuration_folder(filename: str) -> bool:
     )
 
 
-def _is_path_configured_in_exclusions(scan_type: str, file_path: str) -> bool:
+def is_path_configured_in_exclusions(scan_type: str, file_path: str) -> bool:
     exclusions_by_path = configuration_manager.get_exclusions_by_scan_type(scan_type).get(
         consts.EXCLUSIONS_BY_PATH_SECTION_NAME, []
     )
@@ -106,7 +106,7 @@ class Excluder:
             )
             return False
 
-        if _is_path_configured_in_exclusions(scan_type, filename):
+        if is_path_configured_in_exclusions(scan_type, filename):
             logger.debug(
                 'The document is irrelevant because its path is in the ignore paths list, %s', {'filename': filename}
             )

{cycode-3.17.3.dev3 → cycode-3.17.3.dev5}/pyproject.toml

@@ -21,7 +21,7 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
 ]
 dynamic = ["dependencies"]
-version = "3.17.3.dev3"
+version = "3.17.3.dev5"
 
 [project.scripts]
 cycode = "cycode.cli.app:app"