cycode 3.24.1.dev1__py3-none-any.whl → 3.24.1.dev2__py3-none-any.whl

cycode/__init__.py

@@ -5,4 +5,4 @@ import time as _time
 # end-to-end scan duration from the moment the user actually triggered it.
 _BOOT_WALL: float = _time.time()
 
-__version__ = '3.24.1.dev1'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
+__version__ = '3.24.1.dev2'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

cycode/cli/apps/ai_guardrails/scan/handlers.py

@@ -30,7 +30,7 @@ from cycode.cli.apps.ai_guardrails.scan.types import (
     AIHookOutcome,
     BlockReason,
 )
-from cycode.cli.apps.ai_guardrails.scan.utils import is_denied_path, truncate_utf8
+from cycode.cli.apps.ai_guardrails.scan.utils import build_violation_summary, is_denied_path, truncate_utf8
 from cycode.cli.apps.scan.code_scanner import _get_scan_documents_thread_func
 from cycode.cli.apps.scan.scan_parameters import get_scan_parameters
 from cycode.cli.cli_types import ScanTypeOption, SeverityOption
@@ -38,7 +38,6 @@ from cycode.cli.files_collector.file_excluder import is_path_configured_in_exclu
 from cycode.cli.models import Document
 from cycode.cli.utils.host_info import get_hostname, get_serial_number
 from cycode.cli.utils.progress_bar import DummyProgressBar, ScanProgressBarSection
-from cycode.cli.utils.scan_utils import build_violation_summary
 from cycode.logger import get_logger
 
 logger = get_logger('AI Guardrails')
@@ -76,7 +75,7 @@ def handle_before_submit_prompt(ctx: typer.Context, payload: AIHookPayload, poli
             block_reason = SECRETS_BLOCK_REASON_BY_EVENT_TYPE[AiHookEventType.PROMPT]
             if effective_mode == GuardrailsMode.BLOCK:
                 outcome = AIHookOutcome.BLOCKED
-                user_message = f'{violation_summary}. Remove secrets before sending.'
+                user_message = f'Remove secrets before sending. {violation_summary}'
                 return HookDecision.deny(AiHookEventType.PROMPT, user_message)
             outcome = AIHookOutcome.WARNED
         return HookDecision.allow(AiHookEventType.PROMPT)
@@ -283,7 +282,7 @@ def handle_before_mcp_execution(ctx: typer.Context, payload: AIHookPayload, poli
             event_type=AiHookEventType.MCP_EXECUTION,
             deny_message=lambda v: f'Cycode blocked MCP tool call "{tool}". {v}',
             deny_agent_message='Do not pass secrets to tools. Use secret references (name/id) instead.',
-            ask_message=lambda v: f'{v} in MCP tool call "{tool}". Allow execution?',
+            ask_message=lambda v: f'Allow MCP tool call "{tool}"? {v}',
             ask_agent_message='Possible secrets detected in tool arguments; proceed with caution.',
         ),
         scan_text=args_text,

cycode/cli/apps/ai_guardrails/scan/utils.py

@@ -1,15 +1,24 @@
 """
 Utility functions for AI guardrails.
 
-Includes JSON parsing, path matching, and text handling utilities.
+Includes JSON parsing, path matching, text handling and hook-message utilities.
 """
 
 import json
 import os
 import sys
+from collections import defaultdict
 from pathlib import Path
+from typing import TYPE_CHECKING
 
 from cycode.cli.apps.ai_guardrails.scan.policy import get_policy_value
+from cycode.cli.cli_types import SeverityOption
+
+if TYPE_CHECKING:
+    from cycode.cli.models import LocalScanResult
+
+# Keeps the hook message readable when a single file trips dozens of detections
+MAX_VIOLATION_DETAIL_LINES = 5
 
 
 def read_stdin_text() -> str:
@@ -87,3 +96,52 @@ def is_denied_path(file_path: str, policy: dict) -> bool:
 def output_json(obj: dict) -> None:
     """Write JSON response to stdout (for IDE to read)."""
     print(json.dumps(obj), end='')  # noqa: T201
+
+
+def _build_detection_lines(
+    local_scan_results: list['LocalScanResult'], max_lines: int = MAX_VIOLATION_DETAIL_LINES
+) -> str:
+    """One line per distinct finding: what it is, and the value hash identifying it.
+
+    The value hash is safe to display; the value itself is not. Detections excluded by an existing
+    ignore rule are already gone from `document_detections`, so only what actually blocked is listed.
+    """
+    type_by_sha = {}
+    for local_scan_result in local_scan_results:
+        for document_detections in local_scan_result.document_detections:
+            for detection in document_detections.detections:
+                sha = detection.detection_details.get('sha512')
+                if sha and sha not in type_by_sha:
+                    type_by_sha[sha] = detection.type or detection.message
+
+    if not type_by_sha:
+        return ''
+
+    lines = [f'  - {detection_type}: {sha}' for sha, detection_type in list(type_by_sha.items())[:max_lines]]
+    remaining = len(type_by_sha) - len(lines)
+    if remaining:
+        lines.append(f'  - ...and {remaining} more')
+
+    return '\n' + '\n'.join(lines)
+
+
+def build_violation_summary(local_scan_results: list['LocalScanResult']) -> str:
+    """Build violation summary string with severity breakdown and emojis."""
+    detections_count = 0
+    severity_counts = defaultdict(int)
+
+    for local_scan_result in local_scan_results:
+        for document_detections in local_scan_result.document_detections:
+            for detection in document_detections.detections:
+                if detection.severity:
+                    detections_count += 1
+                    severity_counts[SeverityOption(detection.severity)] += 1
+
+    severity_parts = []
+    for severity in reversed(SeverityOption):
+        emoji = SeverityOption.get_member_unicode_emoji(severity)
+        count = severity_counts[severity]
+        severity_parts.append(f'{emoji} {severity.upper()} - {count}')
+
+    summary = f'Cycode found {detections_count} violations: {" | ".join(severity_parts)}'
+    return summary + _build_detection_lines(local_scan_results)

cycode/cli/utils/scan_utils.py

@@ -1,12 +1,10 @@
 import os
-from collections import defaultdict
 from typing import TYPE_CHECKING, Optional
 from uuid import UUID, uuid4
 
 import typer
 
 from cycode.cli import consts
-from cycode.cli.cli_types import SeverityOption
 
 if TYPE_CHECKING:
     from cycode.cli.models import LocalScanResult
@@ -41,24 +39,3 @@ def generate_unique_scan_id() -> UUID:
         return UUID(os.environ['PYTEST_TEST_UNIQUE_ID'])
 
     return uuid4()
-
-
-def build_violation_summary(local_scan_results: list['LocalScanResult']) -> str:
-    """Build violation summary string with severity breakdown and emojis."""
-    detections_count = 0
-    severity_counts = defaultdict(int)
-
-    for local_scan_result in local_scan_results:
-        for document_detections in local_scan_result.document_detections:
-            for detection in document_detections.detections:
-                if detection.severity:
-                    detections_count += 1
-                    severity_counts[SeverityOption(detection.severity)] += 1
-
-    severity_parts = []
-    for severity in reversed(SeverityOption):
-        emoji = SeverityOption.get_member_unicode_emoji(severity)
-        count = severity_counts[severity]
-        severity_parts.append(f'{emoji} {severity.upper()} - {count}')
-
-    return f'Cycode found {detections_count} violations: {" | ".join(severity_parts)}'

{cycode-3.24.1.dev1.dist-info → cycode-3.24.1.dev2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.24.1.dev1
+Version: 3.24.1.dev2
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE

{cycode-3.24.1.dev1.dist-info → cycode-3.24.1.dev2.dist-info}/RECORD

@@ -1,4 +1,4 @@
-cycode/__init__.py,sha256=I-iQNkQ_J9hG3RTJGySCJrSBiqdRU1jt3DxF46X8qaw,396
+cycode/__init__.py,sha256=TGnaJP0fWShd83OGAGzngPbjXG-1A9ACQThCYV9aIOc,396
 cycode/__main__.py,sha256=Z3bD5yrA7yPvAChcADQrqCaZd0ChGI1gdiwALwbWJ6U,104
 cycode/cli/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 cycode/cli/app.py,sha256=AlR2durAEbsa47PDfIj7JtMvJDWA_Dq6wPtVuMJYSCs,10250
@@ -21,12 +21,12 @@ cycode/cli/apps/ai_guardrails/scan/__init__.py,sha256=qJc82XiQGiAuc1sYY8Ij_A-qXp
 cycode/cli/apps/ai_guardrails/scan/consts.py,sha256=8H8JXlgm65sYkgTXqsBInHhHe80UPjqY4vumZXB4GGM,1060
 cycode/cli/apps/ai_guardrails/scan/detach.py,sha256=8BRgBq9Qi8nXEx6NKlE8scSRPkO30XCfsiI5PLvq6Gk,2700
 cycode/cli/apps/ai_guardrails/scan/guardrail_config.py,sha256=QSBwmkTdlC9zXIqI3gIiOlefviJWrpeJHzFu1Cs-zgE,7051
-cycode/cli/apps/ai_guardrails/scan/handlers.py,sha256=vOAvknrlCN-G_AUE7adlZAg0V7BhtGTYKB4r1yZDBu0,17695
+cycode/cli/apps/ai_guardrails/scan/handlers.py,sha256=i8fJ_K3m2v45DRSfkK0Wt4yEZfYIxOaLtZXiGna--5A,17641
 cycode/cli/apps/ai_guardrails/scan/payload.py,sha256=sWsWq5yXP54MVCajsb180kLuprI_M2kspMOzQGh7r_o,1534
 cycode/cli/apps/ai_guardrails/scan/policy.py,sha256=3HuDoL_NYE3lyHRAlIMleq6pi-stIDQwotHsKhUFhTQ,5000
 cycode/cli/apps/ai_guardrails/scan/scan_command.py,sha256=fgV32phgkBPwqSau7oFDISZ58CVpq214JlYwZQM9bnM,8318
 cycode/cli/apps/ai_guardrails/scan/types.py,sha256=ybQm242QN0l_4SSNX4xMHXxzqEK-MW-hfIOixI7zvGU,1497
-cycode/cli/apps/ai_guardrails/scan/utils.py,sha256=QzR_zmivDYwg2-F8g4bFfsycHhNo-pPuJly0P_l0gm8,2879
+cycode/cli/apps/ai_guardrails/scan/utils.py,sha256=4CIZAILS9m5-JsFbUderwBVzFAjqAVVVRhWgE9oLPhM,5292
 cycode/cli/apps/ai_guardrails/session_start_command.py,sha256=oEW-OsHXkf8P7SX1vKa9Ddlv_hASRiQ42JZR3MnJfRg,7171
 cycode/cli/apps/ai_guardrails/status_command.py,sha256=Uqss68TEPCYPXpLix6Bh-4J3g-khxWsAqlIGYH5x4bQ,3203
 cycode/cli/apps/ai_guardrails/uninstall_command.py,sha256=dOmePfZmlHAPy2zEJM1yMtSuDqvzDwtqgmLKYK-T9PI,2698
@@ -186,7 +186,7 @@ cycode/cli/utils/jwt_utils.py,sha256=EGI-0CKhCGY8hIcZ9b9diq9hqtOUf8Ha8ukeVJIf974
 cycode/cli/utils/path_utils.py,sha256=zc48CSU7hxqjSgfH6h5M1B0kIcKW44BOJrUa_6z-mAo,4317
 cycode/cli/utils/progress_bar.py,sha256=bKBWHHdZsVkdDdWMJLfgLGR0cBYeB44P_DpRM8pvWqU,9528
 cycode/cli/utils/scan_batch.py,sha256=5xKGVDVqoRxdKhuZkK11x4QrNqKmU20Q83E_fy8Nndk,5188
-cycode/cli/utils/scan_utils.py,sha256=sTj7j9dVHcgeMqfYp8sO78ZiWX8LnhpgjCOi1N1gmAM,2248
+cycode/cli/utils/scan_utils.py,sha256=_VkZ7maLVST6J8dsqDsKYWQj2EVfqI3iPPsA1QJOGEU,1259
 cycode/cli/utils/shell_executor.py,sha256=VkzzQPZCmTkFvDjhgJrkv-Icej3U1wLW9LLN6k6OahA,1848
 cycode/cli/utils/string_utils.py,sha256=KyPSAHDRPEGNCCcKTF0v99vad5z9djpVGc8nxpBqdYo,2445
 cycode/cli/utils/task_timer.py,sha256=wxfM2TtJGjc1F17CIja_Qmt6zd4a1qdMwuz0ltgTDAg,2722
@@ -217,8 +217,8 @@ cycode/cyclient/report_client.py,sha256=Scq30NeJPzgXv0hPLO1U05AdE9i_2iu6cIrSKpEJ
 cycode/cyclient/scan_client.py,sha256=DqAZ7u6Z_cvw9A9RlLkAQUgLRwPCCAsUq5U9umt4F7Y,16955
 cycode/cyclient/scan_config_base.py,sha256=mXsPZGYCtp85rv5GIige40yQZXuRcEKUW-VQJ0vgFzk,1201
 cycode/logger.py,sha256=EfZGRK6VC5rE_LAjIcRrHFiQCueylCDXoG6bvGkrIME,2111
-cycode-3.24.1.dev1.dist-info/METADATA,sha256=Q_CfNk0EX1rgA3ndLHucRys9j-AqsPED4kmveNVm5eY,93687
-cycode-3.24.1.dev1.dist-info/WHEEL,sha256=zp0Cn7JsFoX2ATtOhtaFYIiE2rmFAD4OcMhtUki8W3U,88
-cycode-3.24.1.dev1.dist-info/entry_points.txt,sha256=iDcVJM8ByLElVgvBgtYxDjw1kT7O8Mo0LcWZIT5L3Ig,45
-cycode-3.24.1.dev1.dist-info/licenses/LICENCE,sha256=2Wx4N6mD_4xB7-E3hPkZ3MPhpJy__k_I8MaCSO-PDRo,1068
-cycode-3.24.1.dev1.dist-info/RECORD,,
+cycode-3.24.1.dev2.dist-info/METADATA,sha256=AxXWfRpzaPJHwREMYa_RvGp_-JGo4iGbXkzEPbZBMGM,93687
+cycode-3.24.1.dev2.dist-info/WHEEL,sha256=zp0Cn7JsFoX2ATtOhtaFYIiE2rmFAD4OcMhtUki8W3U,88
+cycode-3.24.1.dev2.dist-info/entry_points.txt,sha256=iDcVJM8ByLElVgvBgtYxDjw1kT7O8Mo0LcWZIT5L3Ig,45
+cycode-3.24.1.dev2.dist-info/licenses/LICENCE,sha256=2Wx4N6mD_4xB7-E3hPkZ3MPhpJy__k_I8MaCSO-PDRo,1068
+cycode-3.24.1.dev2.dist-info/RECORD,,