cycode 3.24.0__tar.gz → 3.24.1.dev2__tar.gz

{cycode-3.24.0 → cycode-3.24.1.dev2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.24.0
+Version: 3.24.1.dev2
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE

{cycode-3.24.0 → cycode-3.24.1.dev2}/cycode/__init__.py

@@ -5,4 +5,4 @@ import time as _time
 # end-to-end scan duration from the moment the user actually triggered it.
 _BOOT_WALL: float = _time.time()
 
-__version__ = '3.24.0'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
+__version__ = '3.24.1.dev2'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

{cycode-3.24.0 → cycode-3.24.1.dev2}/cycode/cli/apps/ai_guardrails/scan/handlers.py

@@ -30,7 +30,7 @@ from cycode.cli.apps.ai_guardrails.scan.types import (
     AIHookOutcome,
     BlockReason,
 )
-from cycode.cli.apps.ai_guardrails.scan.utils import is_denied_path, truncate_utf8
+from cycode.cli.apps.ai_guardrails.scan.utils import build_violation_summary, is_denied_path, truncate_utf8
 from cycode.cli.apps.scan.code_scanner import _get_scan_documents_thread_func
 from cycode.cli.apps.scan.scan_parameters import get_scan_parameters
 from cycode.cli.cli_types import ScanTypeOption, SeverityOption
@@ -38,7 +38,6 @@ from cycode.cli.files_collector.file_excluder import is_path_configured_in_exclu
 from cycode.cli.models import Document
 from cycode.cli.utils.host_info import get_hostname, get_serial_number
 from cycode.cli.utils.progress_bar import DummyProgressBar, ScanProgressBarSection
-from cycode.cli.utils.scan_utils import build_violation_summary
 from cycode.logger import get_logger
 
 logger = get_logger('AI Guardrails')
@@ -76,7 +75,7 @@ def handle_before_submit_prompt(ctx: typer.Context, payload: AIHookPayload, poli
             block_reason = SECRETS_BLOCK_REASON_BY_EVENT_TYPE[AiHookEventType.PROMPT]
             if effective_mode == GuardrailsMode.BLOCK:
                 outcome = AIHookOutcome.BLOCKED
-                user_message = f'{violation_summary}. Remove secrets before sending.'
+                user_message = f'Remove secrets before sending. {violation_summary}'
                 return HookDecision.deny(AiHookEventType.PROMPT, user_message)
             outcome = AIHookOutcome.WARNED
         return HookDecision.allow(AiHookEventType.PROMPT)
@@ -283,7 +282,7 @@ def handle_before_mcp_execution(ctx: typer.Context, payload: AIHookPayload, poli
             event_type=AiHookEventType.MCP_EXECUTION,
             deny_message=lambda v: f'Cycode blocked MCP tool call "{tool}". {v}',
             deny_agent_message='Do not pass secrets to tools. Use secret references (name/id) instead.',
-            ask_message=lambda v: f'{v} in MCP tool call "{tool}". Allow execution?',
+            ask_message=lambda v: f'Allow MCP tool call "{tool}"? {v}',
             ask_agent_message='Possible secrets detected in tool arguments; proceed with caution.',
         ),
         scan_text=args_text,

{cycode-3.24.0 → cycode-3.24.1.dev2}/cycode/cli/apps/ai_guardrails/scan/utils.py

@@ -1,15 +1,24 @@
 """
 Utility functions for AI guardrails.
 
-Includes JSON parsing, path matching, and text handling utilities.
+Includes JSON parsing, path matching, text handling and hook-message utilities.
 """
 
 import json
 import os
 import sys
+from collections import defaultdict
 from pathlib import Path
+from typing import TYPE_CHECKING
 
 from cycode.cli.apps.ai_guardrails.scan.policy import get_policy_value
+from cycode.cli.cli_types import SeverityOption
+
+if TYPE_CHECKING:
+    from cycode.cli.models import LocalScanResult
+
+# Keeps the hook message readable when a single file trips dozens of detections
+MAX_VIOLATION_DETAIL_LINES = 5
 
 
 def read_stdin_text() -> str:
@@ -87,3 +96,52 @@ def is_denied_path(file_path: str, policy: dict) -> bool:
 def output_json(obj: dict) -> None:
     """Write JSON response to stdout (for IDE to read)."""
     print(json.dumps(obj), end='')  # noqa: T201
+
+
+def _build_detection_lines(
+    local_scan_results: list['LocalScanResult'], max_lines: int = MAX_VIOLATION_DETAIL_LINES
+) -> str:
+    """One line per distinct finding: what it is, and the value hash identifying it.
+
+    The value hash is safe to display; the value itself is not. Detections excluded by an existing
+    ignore rule are already gone from `document_detections`, so only what actually blocked is listed.
+    """
+    type_by_sha = {}
+    for local_scan_result in local_scan_results:
+        for document_detections in local_scan_result.document_detections:
+            for detection in document_detections.detections:
+                sha = detection.detection_details.get('sha512')
+                if sha and sha not in type_by_sha:
+                    type_by_sha[sha] = detection.type or detection.message
+
+    if not type_by_sha:
+        return ''
+
+    lines = [f'  - {detection_type}: {sha}' for sha, detection_type in list(type_by_sha.items())[:max_lines]]
+    remaining = len(type_by_sha) - len(lines)
+    if remaining:
+        lines.append(f'  - ...and {remaining} more')
+
+    return '\n' + '\n'.join(lines)
+
+
+def build_violation_summary(local_scan_results: list['LocalScanResult']) -> str:
+    """Build violation summary string with severity breakdown and emojis."""
+    detections_count = 0
+    severity_counts = defaultdict(int)
+
+    for local_scan_result in local_scan_results:
+        for document_detections in local_scan_result.document_detections:
+            for detection in document_detections.detections:
+                if detection.severity:
+                    detections_count += 1
+                    severity_counts[SeverityOption(detection.severity)] += 1
+
+    severity_parts = []
+    for severity in reversed(SeverityOption):
+        emoji = SeverityOption.get_member_unicode_emoji(severity)
+        count = severity_counts[severity]
+        severity_parts.append(f'{emoji} {severity.upper()} - {count}')
+
+    summary = f'Cycode found {detections_count} violations: {" | ".join(severity_parts)}'
+    return summary + _build_detection_lines(local_scan_results)

{cycode-3.24.0 → cycode-3.24.1.dev2}/cycode/cli/utils/scan_utils.py

@@ -1,12 +1,10 @@
 import os
-from collections import defaultdict
 from typing import TYPE_CHECKING, Optional
 from uuid import UUID, uuid4
 
 import typer
 
 from cycode.cli import consts
-from cycode.cli.cli_types import SeverityOption
 
 if TYPE_CHECKING:
     from cycode.cli.models import LocalScanResult
@@ -41,24 +39,3 @@ def generate_unique_scan_id() -> UUID:
         return UUID(os.environ['PYTEST_TEST_UNIQUE_ID'])
 
     return uuid4()
-
-
-def build_violation_summary(local_scan_results: list['LocalScanResult']) -> str:
-    """Build violation summary string with severity breakdown and emojis."""
-    detections_count = 0
-    severity_counts = defaultdict(int)
-
-    for local_scan_result in local_scan_results:
-        for document_detections in local_scan_result.document_detections:
-            for detection in document_detections.detections:
-                if detection.severity:
-                    detections_count += 1
-                    severity_counts[SeverityOption(detection.severity)] += 1
-
-    severity_parts = []
-    for severity in reversed(SeverityOption):
-        emoji = SeverityOption.get_member_unicode_emoji(severity)
-        count = severity_counts[severity]
-        severity_parts.append(f'{emoji} {severity.upper()} - {count}')
-
-    return f'Cycode found {detections_count} violations: {" | ".join(severity_parts)}'

{cycode-3.24.0 → cycode-3.24.1.dev2}/cycode/cyclient/base_token_auth_client.py

@@ -1,3 +1,5 @@
+import secrets
+import time
 from abc import ABC, abstractmethod
 from threading import Lock
 from typing import Any, Optional
@@ -5,6 +7,7 @@ from typing import Any, Optional
 import arrow
 from requests import Response
 
+from cycode.cli.exceptions.custom_exceptions import HttpUnauthorizedError
 from cycode.cli.user_settings.credentials_manager import CredentialsManager
 from cycode.cli.user_settings.jwt_creator import JwtCreator
 from cycode.cyclient.cycode_client import CycodeClient
@@ -15,6 +18,11 @@ _NGINX_PLAIN_ERRORS = [
     b'JWT Token validation failed',
 ]
 
+# Identity provider brute-force protection rejects logins for the same user that land within
+# milliseconds of each other, so when several processes mint at once all but one are refused.
+_MINT_CONFLICT_RETRY_MIN_MS = 50
+_MINT_CONFLICT_RETRY_SPREAD_MS = 100
+
 
 class BaseTokenAuthClient(CycodeClient, ABC):
     """Base client for token-based authentication flows with cached JWTs."""
@@ -49,7 +57,20 @@ class BaseTokenAuthClient(CycodeClient, ABC):
         self._load_token_from_disk()
         if self._has_valid_token():
             return
-        self.refresh_access_token()
+
+        try:
+            self.refresh_access_token()
+        except HttpUnauthorizedError:
+            # Processes sharing one cached token all expire at the same instant, so a burst of
+            # them mints together and the identity provider refuses all but the first as a
+            # too-fast login. The winner persists a usable token, so prefer re-reading it over
+            # minting again. The wait is randomized to keep the losers from colliding a second
+            # time. A genuinely invalid token still raises on the retry.
+            time.sleep((_MINT_CONFLICT_RETRY_MIN_MS + secrets.randbelow(_MINT_CONFLICT_RETRY_SPREAD_MS)) / 1000)
+            self._load_token_from_disk()
+            if self._has_valid_token():
+                return
+            self.refresh_access_token()
 
     def _has_valid_token(self) -> bool:
         return self._access_token is not None and self._expires_in is not None and arrow.utcnow() < self._expires_in

{cycode-3.24.0 → cycode-3.24.1.dev2}/pyproject.toml

@@ -21,7 +21,7 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
 ]
 dynamic = ["dependencies"]
-version = "3.24.0"
+version = "3.24.1.dev2"
 
 [project.scripts]
 cycode = "cycode.cli.app:app"