cycode 3.21.0__tar.gz → 3.21.1.dev2__tar.gz

{cycode-3.21.0 → cycode-3.21.1.dev2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.21.0
+Version: 3.21.1.dev2
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE
@@ -834,7 +834,7 @@ The Cycode CLI application offers several types of scans so that you can choose
 | `--show-secret BOOLEAN`                                    | Show secrets in plain text. See [Show/Hide Secrets](#showhide-secrets) section for more details.                                 |
 | `--soft-fail BOOLEAN`                                      | Run scan without failing, always return a non-error status code. See [Soft Fail](#soft-fail) section for more details.           |
 | `--severity-threshold [INFO\|LOW\|MEDIUM\|HIGH\|CRITICAL]` | Show only violations at the specified level or higher.                                                                           |
-| `--sca-scan`                                               | Specify the SCA scan you wish to execute (`package-vulnerabilities`/`license-compliance`). The default is both.                  |
+| `--sca-scan`                                               | Specify the SCA scan you wish to execute (`package-vulnerabilities`/`license-compliance`/`unmaintained-packages`). The default is all. |
 | `--monitor`                                                | When specified, the scan results will be recorded in Cycode.                                                                     |
 | `--cycode-report`                                          | Display a link to the scan report in the Cycode platform in the console output.                                                  |
 | `--no-restore`                                             | When specified, Cycode will not run the restore command. This will scan direct dependencies ONLY!                                |
@@ -912,6 +912,20 @@ In the previous example, if you wanted to only scan a branch named `dev`, you co
 
 `cycode scan -t sca --sca-scan license-compliance repository ~/home/git/codebase -b dev`
 
+#### Unmaintained Packages Option
+
+> [!NOTE]
+> This option is only available to SCA scans.
+
+To scan only for unmaintained packages (packages whose [OpenSSF Scorecard](https://scorecard.dev) `Maintained` check is low, meaning little or no recent commit and issue activity), add the argument `--sca-scan unmaintained-packages` following the `-t sca` or `--scan-type sca` option.
+
+> [!NOTE]
+> Whether unmaintained packages are reported at all is controlled by your organization's policy. This option narrows what a scan reports; it cannot enable a policy that is turned off for your tenant.
+
+In the previous example, if you wanted to only run an SCA scan on unmaintained packages, you could execute the following:
+
+`cycode scan -t sca --sca-scan unmaintained-packages repository ~/home/git/codebase`
+
 #### Lock Restore Option
 
 > [!NOTE]

{cycode-3.21.0 → cycode-3.21.1.dev2}/README.md

@@ -789,7 +789,7 @@ The Cycode CLI application offers several types of scans so that you can choose
 | `--show-secret BOOLEAN`                                    | Show secrets in plain text. See [Show/Hide Secrets](#showhide-secrets) section for more details.                                 |
 | `--soft-fail BOOLEAN`                                      | Run scan without failing, always return a non-error status code. See [Soft Fail](#soft-fail) section for more details.           |
 | `--severity-threshold [INFO\|LOW\|MEDIUM\|HIGH\|CRITICAL]` | Show only violations at the specified level or higher.                                                                           |
-| `--sca-scan`                                               | Specify the SCA scan you wish to execute (`package-vulnerabilities`/`license-compliance`). The default is both.                  |
+| `--sca-scan`                                               | Specify the SCA scan you wish to execute (`package-vulnerabilities`/`license-compliance`/`unmaintained-packages`). The default is all. |
 | `--monitor`                                                | When specified, the scan results will be recorded in Cycode.                                                                     |
 | `--cycode-report`                                          | Display a link to the scan report in the Cycode platform in the console output.                                                  |
 | `--no-restore`                                             | When specified, Cycode will not run the restore command. This will scan direct dependencies ONLY!                                |
@@ -867,6 +867,20 @@ In the previous example, if you wanted to only scan a branch named `dev`, you co
 
 `cycode scan -t sca --sca-scan license-compliance repository ~/home/git/codebase -b dev`
 
+#### Unmaintained Packages Option
+
+> [!NOTE]
+> This option is only available to SCA scans.
+
+To scan only for unmaintained packages (packages whose [OpenSSF Scorecard](https://scorecard.dev) `Maintained` check is low, meaning little or no recent commit and issue activity), add the argument `--sca-scan unmaintained-packages` following the `-t sca` or `--scan-type sca` option.
+
+> [!NOTE]
+> Whether unmaintained packages are reported at all is controlled by your organization's policy. This option narrows what a scan reports; it cannot enable a policy that is turned off for your tenant.
+
+In the previous example, if you wanted to only run an SCA scan on unmaintained packages, you could execute the following:
+
+`cycode scan -t sca --sca-scan unmaintained-packages repository ~/home/git/codebase`
+
 #### Lock Restore Option
 
 > [!NOTE]

{cycode-3.21.0 → cycode-3.21.1.dev2}/cycode/__init__.py

@@ -5,4 +5,4 @@ import time as _time
 # end-to-end scan duration from the moment the user actually triggered it.
 _BOOT_WALL: float = _time.time()
 
-__version__ = '3.21.0'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
+__version__ = '3.21.1.dev2'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

{cycode-3.21.0 → cycode-3.21.1.dev2}/cycode/cli/apps/ai_guardrails/scan/handlers.py

@@ -334,6 +334,7 @@ def build_ai_guardrails_scan_parameters(
         'device_hostname': get_hostname(),
         'conversation_id': payload.conversation_id,
         'generation_id': payload.generation_id,
+        'hook_event_id': payload.hook_event_id,
         'ide_user_email': payload.ide_user_email,
         'mcp_server_name': payload.mcp_server_name,
         'mcp_tool_name': payload.mcp_tool_name,

{cycode-3.21.0 → cycode-3.21.1.dev2}/cycode/cli/apps/ai_guardrails/scan/payload.py

@@ -5,7 +5,8 @@ The dataclass is populated by `IDE.parse_hook_payload` (see
 respective IDE class.
 """
 
-from dataclasses import dataclass
+import uuid
+from dataclasses import dataclass, field
 from typing import Optional
 
 
@@ -18,6 +19,11 @@ class AIHookPayload:
     conversation_id: Optional[str] = None
     generation_id: Optional[str] = None
 
+    # Minted here rather than by the server: the guardrail scan and the hook event are reported in two
+    # separate requests, and both have to name the same event. A generation id can't stand in for it - the
+    # IDE mints one per prompt, so several hook events share it, and some IDEs don't supply one at all.
+    hook_event_id: str = field(default_factory=lambda: str(uuid.uuid4()))
+
     # User and IDE information
     ide_user_email: Optional[str] = None
     model: Optional[str] = None

{cycode-3.21.0 → cycode-3.21.1.dev2}/cycode/cli/apps/scan/scan_command.py

@@ -93,7 +93,11 @@ def scan_command(
             help='Specify the type of SCA scan you wish to execute.',
             rich_help_panel=_SCA_RICH_HELP_PANEL,
         ),
-    ] = (ScaScanTypeOption.PACKAGE_VULNERABILITIES, ScaScanTypeOption.LICENSE_COMPLIANCE),
+    ] = (
+        ScaScanTypeOption.PACKAGE_VULNERABILITIES,
+        ScaScanTypeOption.LICENSE_COMPLIANCE,
+        ScaScanTypeOption.UNMAINTAINED_PACKAGES,
+    ),
     monitor: Annotated[
         bool,
         typer.Option(

{cycode-3.21.0 → cycode-3.21.1.dev2}/cycode/cli/apps/scan/scan_parameters.py

@@ -16,6 +16,7 @@ def _get_default_scan_parameters(ctx: typer.Context) -> dict:
         'report': ctx.obj.get('report'),
         'package_vulnerabilities': ctx.obj.get('package-vulnerabilities'),
         'license_compliance': ctx.obj.get('license-compliance'),
+        'maintainability': ctx.obj.get('unmaintained-packages', False),
         'command_type': ctx.info_name.replace('-', '_'),  # save backward compatibility
         'aggregation_id': str(generate_unique_scan_id()),
         'cli_start_time': _BOOT_WALL,

{cycode-3.21.0 → cycode-3.21.1.dev2}/cycode/cli/cli_types.py

@@ -40,6 +40,7 @@ class ScanTypeOption(StrEnum):
 class ScaScanTypeOption(StrEnum):
     PACKAGE_VULNERABILITIES = 'package-vulnerabilities'
     LICENSE_COMPLIANCE = 'license-compliance'
+    UNMAINTAINED_PACKAGES = 'unmaintained-packages'
 
 
 class SbomFormatOption(StrEnum):

{cycode-3.21.0 → cycode-3.21.1.dev2}/cycode/cli/consts.py

@@ -314,6 +314,7 @@ SCAN_ERROR_STATUS_CODE = 2
 
 LICENSE_COMPLIANCE_POLICY_ID = '8f681450-49e1-4f7e-85b7-0c8fe84b3a35'
 PACKAGE_VULNERABILITY_POLICY_ID = '9369d10a-9ac0-48d3-9921-5de7fe9a37a7'
+UNMAINTAINED_PACKAGE_POLICY_ID = '7b45ee1f-ee08-4353-a00a-2586db27b0f1'
 
 # Shortcut dependency paths by remove all middle dependencies
 # between direct dependency and influence/vulnerable dependency.

{cycode-3.21.0 → cycode-3.21.1.dev2}/cycode/cli/printers/rich_printer.py

@@ -16,6 +16,7 @@ from cycode.cli.printers.utils.detection_data import (
 )
 from cycode.cli.printers.utils.detection_ordering.common_ordering import sort_and_group_detections_from_scan_result
 from cycode.cli.printers.utils.rich_helpers import get_columns_in_1_to_3_ratio, get_markdown_panel, get_panel
+from cycode.cli.printers.utils.sca_policy_details import get_sca_policy_details
 
 if TYPE_CHECKING:
     from cycode.cli.models import CliError, Detection, Document, LocalScanResult
@@ -86,19 +87,14 @@ class RichPrinter(TextPrinter):
     def __add_sca_scan_related_rows(details_table: Table, detection: 'Detection') -> None:
         detection_details = detection.detection_details
 
-        details_table.add_row('CVEs', get_detection_clickable_cwe_cve(consts.SCA_SCAN_TYPE, detection))
         details_table.add_row('Package', detection_details.get('package_name'))
         details_table.add_row('Version', detection_details.get('package_version'))
 
-        if detection.has_alert:
-            patched_version = detection_details['alert'].get('first_patched_version')
-            details_table.add_row('First patched version', patched_version or 'Not fixed')
-
         dependency_path = detection_details.get('dependency_paths')
         details_table.add_row('Dependency path', dependency_path or 'N/A')
 
-        if not detection.has_alert:
-            details_table.add_row('License', detection_details.get('license'))
+        for label, value in get_sca_policy_details(detection):
+            details_table.add_row(label, value)
 
     @staticmethod
     def __add_iac_scan_related_rows(details_table: Table, detection: 'Detection') -> None:

{cycode-3.21.0 → cycode-3.21.1.dev2}/cycode/cli/printers/tables/sca_table_printer.py

@@ -2,13 +2,18 @@ from collections import defaultdict
 from typing import TYPE_CHECKING
 
 from cycode.cli.cli_types import SeverityOption
-from cycode.cli.consts import LICENSE_COMPLIANCE_POLICY_ID, PACKAGE_VULNERABILITY_POLICY_ID
+from cycode.cli.consts import (
+    LICENSE_COMPLIANCE_POLICY_ID,
+    PACKAGE_VULNERABILITY_POLICY_ID,
+    UNMAINTAINED_PACKAGE_POLICY_ID,
+)
 from cycode.cli.models import Detection
 from cycode.cli.printers.tables.table import Table
 from cycode.cli.printers.tables.table_models import ColumnInfoBuilder
 from cycode.cli.printers.tables.table_printer_base import TablePrinterBase
 from cycode.cli.printers.utils import is_git_diff_based_scan
 from cycode.cli.printers.utils.detection_ordering.sca_ordering import sort_and_group_detections
+from cycode.cli.printers.utils.sca_ossf import get_maintained_score
 from cycode.cli.utils.string_utils import shortcut_dependency_paths
 
 if TYPE_CHECKING:
@@ -23,6 +28,7 @@ CODE_PROJECT_COLUMN = column_builder.build(name='Code Project', highlight=False)
 ECOSYSTEM_COLUMN = column_builder.build(name='Ecosystem', highlight=False)
 PACKAGE_COLUMN = column_builder.build(name='Package', highlight=False)
 CVE_COLUMNS = column_builder.build(name='CVE', highlight=False)
+MAINTAINED_SCORE_COLUMN = column_builder.build(name='Maintained Score', highlight=False)
 DEPENDENCY_PATHS_COLUMN = column_builder.build(name='Dependency Paths')
 UPGRADE_COLUMN = column_builder.build(name='Upgrade')
 LICENSE_COLUMN = column_builder.build(name='License', highlight=False)
@@ -51,6 +57,8 @@ class ScaTablePrinter(TablePrinterBase):
             return 'Dependency Vulnerabilities'
         if policy_id == LICENSE_COMPLIANCE_POLICY_ID:
             return 'License Compliance'
+        if policy_id == UNMAINTAINED_PACKAGE_POLICY_ID:
+            return 'Unmaintained Packages'
 
         return 'Unknown'
 
@@ -62,6 +70,8 @@ class ScaTablePrinter(TablePrinterBase):
             table.add_column(UPGRADE_COLUMN)
         elif policy_id == LICENSE_COMPLIANCE_POLICY_ID:
             table.add_column(LICENSE_COLUMN)
+        elif policy_id == UNMAINTAINED_PACKAGE_POLICY_ID:
+            table.add_column(MAINTAINED_SCORE_COLUMN)
 
         if is_git_diff_based_scan(self.command_scan_type):
             table.add_column(REPOSITORY_COLUMN)
@@ -120,6 +130,10 @@ class ScaTablePrinter(TablePrinterBase):
         table.add_cell(CVE_COLUMNS, detection_details.get('vulnerability_id'))
         table.add_cell(LICENSE_COLUMN, detection_details.get('license'))
 
+        if detection.detection_type_id == UNMAINTAINED_PACKAGE_POLICY_ID:
+            maintained_score = get_maintained_score(detection_details)
+            table.add_cell(MAINTAINED_SCORE_COLUMN, 'N/A' if maintained_score is None else str(maintained_score))
+
     def _print_summary_issues(self, detections_count: int, title: str) -> None:
         self.console.print(f'[bold]Cycode found {detections_count} violations of type: [cyan]{title}[/]')
 

{cycode-3.21.0 → cycode-3.21.1.dev2}/cycode/cli/printers/text_printer.py

@@ -7,6 +7,7 @@ from cycode.cli.printers.printer_base import PrinterBase
 from cycode.cli.printers.utils.code_snippet_syntax import get_code_snippet_syntax, get_detection_line
 from cycode.cli.printers.utils.detection_data import get_detection_title
 from cycode.cli.printers.utils.detection_ordering.common_ordering import sort_and_group_detections_from_scan_result
+from cycode.cli.printers.utils.sca_policy_details import get_sca_policy_details
 
 if TYPE_CHECKING:
     from cycode.cli.models import Detection, LocalScanResult
@@ -82,18 +83,7 @@ class TextPrinter(PrinterBase):
 
     @staticmethod
     def __get_sca_related_summary_lines(detection: 'Detection') -> list[str]:
-        summary_lines = []
-
-        if detection.has_alert:
-            patched_version = detection.detection_details['alert'].get('first_patched_version')
-            patched_version = patched_version or 'Not fixed'
-
-            summary_lines.append(f'First patched version: [cyan]{patched_version}[/]\n')
-        else:
-            package_license = detection.detection_details.get('license', 'N/A')
-            summary_lines.append(f'License: [cyan]{package_license}[/]\n')
-
-        return summary_lines
+        return [f'{label}: [cyan]{value}[/]\n' for label, value in get_sca_policy_details(detection)]
 
     def __print_detection_code_segment(self, detection: 'Detection', document: Document) -> None:
         self.console.print(

cycode-3.21.1.dev2/cycode/cli/printers/utils/sca_ossf.py

@@ -0,0 +1,23 @@
+from typing import Any, Optional
+
+_MAINTAINED_CHECK_NAME = 'maintained'
+
+
+def _get_ossf_details(detection_details: dict) -> dict:
+    return detection_details.get('ossf') or {}
+
+
+def get_ossf_score(detection_details: dict) -> Optional[Any]:
+    return _get_ossf_details(detection_details).get('score')
+
+
+def get_ossf_report_url(detection_details: dict) -> Optional[str]:
+    return _get_ossf_details(detection_details).get('scorecard_report_url')
+
+
+def get_maintained_score(detection_details: dict) -> Optional[Any]:
+    for check in _get_ossf_details(detection_details).get('checks') or []:
+        if str(check.get('name', '')).lower() == _MAINTAINED_CHECK_NAME:
+            return check.get('score')
+
+    return None

cycode-3.21.1.dev2/cycode/cli/printers/utils/sca_policy_details.py

@@ -0,0 +1,57 @@
+from typing import TYPE_CHECKING, Callable
+
+from cycode.cli.consts import (
+    LICENSE_COMPLIANCE_POLICY_ID,
+    PACKAGE_VULNERABILITY_POLICY_ID,
+    SCA_SCAN_TYPE,
+    UNMAINTAINED_PACKAGE_POLICY_ID,
+)
+from cycode.cli.printers.utils.detection_data import get_detection_clickable_cwe_cve
+from cycode.cli.printers.utils.sca_ossf import get_maintained_score, get_ossf_report_url, get_ossf_score
+
+if TYPE_CHECKING:
+    from cycode.cyclient.models import Detection
+
+_NOT_AVAILABLE = 'N/A'
+
+
+def _package_vulnerability_details(detection: 'Detection') -> list[tuple[str, str]]:
+    alert = detection.detection_details.get('alert') or {}
+    return [
+        ('CVEs', get_detection_clickable_cwe_cve(SCA_SCAN_TYPE, detection) or _NOT_AVAILABLE),
+        ('First patched version', alert.get('first_patched_version') or 'Not fixed'),
+    ]
+
+
+def _license_compliance_details(detection: 'Detection') -> list[tuple[str, str]]:
+    return [('License', detection.detection_details.get('license') or _NOT_AVAILABLE)]
+
+
+def _unmaintained_package_details(detection: 'Detection') -> list[tuple[str, str]]:
+    detection_details = detection.detection_details
+    maintained_score = get_maintained_score(detection_details)
+    ossf_score = get_ossf_score(detection_details)
+
+    return [
+        ('Maintained score', _NOT_AVAILABLE if maintained_score is None else str(maintained_score)),
+        ('OSSF Scorecard score', _NOT_AVAILABLE if ossf_score is None else str(ossf_score)),
+        ('Scorecard report', get_ossf_report_url(detection_details) or _NOT_AVAILABLE),
+    ]
+
+
+_DETAILS_BY_POLICY: dict[str, Callable[['Detection'], list[tuple[str, str]]]] = {
+    PACKAGE_VULNERABILITY_POLICY_ID: _package_vulnerability_details,
+    LICENSE_COMPLIANCE_POLICY_ID: _license_compliance_details,
+    UNMAINTAINED_PACKAGE_POLICY_ID: _unmaintained_package_details,
+}
+
+
+def get_sca_policy_details(detection: 'Detection') -> list[tuple[str, str]]:
+    """Labelled fields specific to the SCA policy that raised the detection, in display order.
+
+    A policy with no entry contributes nothing rather than borrowing another policy's fields, so a new one shows
+    no details until it is added here.
+    """
+    build_details = _DETAILS_BY_POLICY.get(detection.detection_type_id)
+
+    return build_details(detection) if build_details else []

{cycode-3.21.0 → cycode-3.21.1.dev2}/cycode/cyclient/ai_security_manager_client.py

@@ -73,6 +73,7 @@ class AISecurityManagerClient:
             return
 
         body = {
+            'id': payload.hook_event_id,
             'conversation_id': conversation_id,
             'event_type': event_type,
             'outcome': outcome,

{cycode-3.21.0 → cycode-3.21.1.dev2}/pyproject.toml

@@ -21,7 +21,7 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
 ]
 dynamic = ["dependencies"]
-version = "3.21.0"
+version = "3.21.1.dev2"
 
 [project.scripts]
 cycode = "cycode.cli.app:app"