cycode 3.19.0__tar.gz → 3.19.1__tar.gz

{cycode-3.19.0 → cycode-3.19.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.19.0
+Version: 3.19.1
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE

{cycode-3.19.0 → cycode-3.19.1}/cycode/__init__.py

@@ -5,4 +5,4 @@ import time as _time
 # end-to-end scan duration from the moment the user actually triggered it.
 _BOOT_WALL: float = _time.time()
 
-__version__ = '3.19.0'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
+__version__ = '3.19.1'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

{cycode-3.19.0 → cycode-3.19.1}/cycode/cli/apps/ai_guardrails/ides/claude_code.py

@@ -284,9 +284,13 @@ class ClaudeCode(IDE):
     def matches_payload(self, raw_payload: dict) -> bool:
         # transcript_path is a documented Claude Code common field, present on every
         # hook event. VS Code Copilot emits near-identical payloads (same event names,
-        # snake_case fields) without it — requiring it keeps those from being
-        # processed as Claude Code events.
-        return raw_payload.get('hook_event_name', '') in _CLAUDE_CODE_EVENT_NAMES and 'transcript_path' in raw_payload
+        # snake_case fields) — Copilot additionally carries a top-level
+        # timestamp, which Claude Code never sends.
+        return (
+            raw_payload.get('hook_event_name', '') in _CLAUDE_CODE_EVENT_NAMES
+            and 'transcript_path' in raw_payload
+            and 'timestamp' not in raw_payload
+        )
 
     def is_synthetic_prompt(self, raw_payload: dict) -> bool:
         if raw_payload.get('hook_event_name') != 'UserPromptSubmit':

{cycode-3.19.0 → cycode-3.19.1}/cycode/cli/apps/ai_guardrails/ides/copilot.py

@@ -7,8 +7,9 @@ VS Code payload dialect is parsed here — CLI payloads (camelCase, no event nam
 are rejected by ``matches_payload`` and fall through to the allow-and-skip path.
 
 VS Code sends Claude-style payloads (``hook_event_name``, ``tool_name``,
-``tool_input``) with structural differences that ``matches_payload`` keys on:
-a top-level ISO ``timestamp`` and no ``transcript_path``. Copilot hooks have no
+``tool_input``), told apart by the one field Claude Code never sends: a top-level
+ISO ``timestamp``. VS Code also sends a ``transcript_path`` of its own once a
+workspace has chat history, so that field cannot discriminate. Copilot hooks have no
 matchers, so ``preToolUse`` fires for every tool; tools we don't scan pass
 through as raw event names, which match no handler and allow immediately.
 """
@@ -340,14 +341,9 @@ class Copilot(IDE):
         }
 
     def matches_payload(self, raw_payload: dict) -> bool:
-        # Structural discrimination, no magic strings: VS Code Copilot events carry
-        # a top-level ISO timestamp and no transcript_path; real Claude Code events
-        # always carry transcript_path; Copilot CLI payloads have no hook_event_name.
-        return (
-            raw_payload.get('hook_event_name', '') in _COPILOT_SCAN_EVENT_NAMES
-            and 'timestamp' in raw_payload
-            and 'transcript_path' not in raw_payload
-        )
+        # Structural discrimination, no magic strings: Copilot events carry a top-level
+        # timestamp, Claude Code events never do.
+        return raw_payload.get('hook_event_name', '') in _COPILOT_SCAN_EVENT_NAMES and 'timestamp' in raw_payload
 
     def parse_hook_payload(self, raw_payload: dict) -> AIHookPayload:
         hook_event_name = raw_payload.get('hook_event_name', '')

{cycode-3.19.0 → cycode-3.19.1}/pyproject.toml

@@ -21,7 +21,7 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
 ]
 dynamic = ["dependencies"]
-version = "3.19.0"
+version = "3.19.1"
 
 [project.scripts]
 cycode = "cycode.cli.app:app"