cycode 3.24.1.dev2__py3-none-any.whl → 3.24.2__py3-none-any.whl

cycode/__init__.py

@@ -5,4 +5,4 @@ import time as _time
 # end-to-end scan duration from the moment the user actually triggered it.
 _BOOT_WALL: float = _time.time()
 
-__version__ = '3.24.1.dev2'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
+__version__ = '3.24.2'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

cycode/cli/apps/ai_guardrails/scan/guardrail_config.py

@@ -37,19 +37,11 @@ _KNOWN_GUARDRAIL_KEYS = frozenset(
     )
 )
 
-# CLI --ide names to matrix column names; identity for names not listed.
-_AGENT_BY_IDE_NAME = {'claude-code': 'claude'}
-
 
 def get_config_cache_path() -> Path:
     return Path.home() / CYCODE_CONFIGURATION_DIRECTORY / GUARDRAILS_CONFIG_FILE_NAME
 
 
-def agent_for_ide(ide_name: Optional[str]) -> str:
-    ide_name = (ide_name or '').lower()
-    return _AGENT_BY_IDE_NAME.get(ide_name, ide_name)
-
-
 def _default_sensitive_globs() -> list:
     return list(DEFAULT_SENSITIVE_PATH_GLOBS)
 
@@ -69,8 +61,9 @@ class GuardrailConfig:
         }
 
     def mode_for(self, guardrail_key: str, ide_name: Optional[str]) -> str:
+        """The platform keys the cells by our --ide names, so the lookup is direct."""
         agents = (self._guardrails.get(guardrail_key) or {}).get('agents') or {}
-        return str(agents.get(agent_for_ide(ide_name), GuardrailCellMode.REPORT.value)).lower()
+        return str(agents.get((ide_name or '').lower(), GuardrailCellMode.REPORT.value)).lower()
 
     def _modes_for_event(self, event_name: str, ide_name: Optional[str]) -> list:
         return [

cycode/cli/apps/ai_guardrails/scan/handlers.py

@@ -13,7 +13,7 @@ import os
 from dataclasses import dataclass
 from multiprocessing.pool import ThreadPool
 from multiprocessing.pool import TimeoutError as PoolTimeoutError
-from typing import TYPE_CHECKING, Callable, Optional
+from typing import TYPE_CHECKING, Callable, NamedTuple, Optional
 
 import typer
 
@@ -45,12 +45,32 @@ logger = get_logger('AI Guardrails')
 HandlerFn = Callable[[typer.Context, AIHookPayload, dict], HookDecision]
 
 
+class ScanOutcome(NamedTuple):
+    """What one guardrail scan came back with; the verdict is the server's, which applied the tenant's floors."""
+
+    violation_summary: Optional[str] = None
+    scan_id: Optional[str] = None
+    verdict: Optional[GuardrailsMode] = None
+
+
+NO_SCAN = ScanOutcome()
+
+
+def _parse_verdict(verdict: Optional[str]) -> Optional[GuardrailsMode]:
+    """The server spells the verdict "Block"/"Report" and omits it when the scan found nothing to decide on."""
+    if not verdict:
+        return None
+    try:
+        return GuardrailsMode(verdict.lower())
+    except ValueError:
+        logger.debug('Ignoring unknown guardrail verdict, %s', {'verdict': verdict})
+        return None
+
+
 def handle_before_submit_prompt(ctx: typer.Context, payload: AIHookPayload, policy: dict) -> HookDecision:
     """Scan prompt text for secrets before it's sent to the AI model."""
     ai_client = ctx.obj['ai_security_client']
 
-    prompt_config = get_policy_value(policy, 'prompt', default={})
-    effective_mode = get_effective_mode(prompt_config)
     prompt = payload.prompt or ''
     max_bytes = get_policy_value(policy, 'secrets', 'max_bytes', default=200000)
     timeout_ms = get_policy_value(policy, 'secrets', 'timeout_ms', default=30000)
@@ -62,20 +82,20 @@ def handle_before_submit_prompt(ctx: typer.Context, payload: AIHookPayload, poli
     error_message = None
 
     try:
-        violation_summary, scan_id = _scan_text_for_secrets(
+        scan_outcome = _scan_text_for_secrets(
             ctx,
             clipped,
             timeout_ms,
             payload=payload,
             event_type=AiHookEventType.PROMPT,
-            effective_mode=effective_mode,
         )
+        scan_id = scan_outcome.scan_id
 
-        if violation_summary:
+        if scan_outcome.violation_summary:
             block_reason = SECRETS_BLOCK_REASON_BY_EVENT_TYPE[AiHookEventType.PROMPT]
-            if effective_mode == GuardrailsMode.BLOCK:
+            if scan_outcome.verdict == GuardrailsMode.BLOCK:
                 outcome = AIHookOutcome.BLOCKED
-                user_message = f'Remove secrets before sending. {violation_summary}'
+                user_message = f'Remove secrets before sending. {scan_outcome.violation_summary}'
                 return HookDecision.deny(AiHookEventType.PROMPT, user_message)
             outcome = AIHookOutcome.WARNED
         return HookDecision.allow(AiHookEventType.PROMPT)
@@ -104,7 +124,6 @@ def handle_before_read_file(ctx: typer.Context, payload: AIHookPayload, policy:
     file_read_config = get_policy_value(policy, 'file_read', default={})
     file_path = payload.file_path or ''
     path_mode = get_effective_mode(file_read_config, action_key='path_action')
-    content_mode = get_effective_mode(file_read_config)
 
     scan_id = None
     block_reason = None
@@ -138,21 +157,20 @@ def handle_before_read_file(ctx: typer.Context, payload: AIHookPayload, policy:
                 outcome = AIHookOutcome.ALLOWED
 
         if get_policy_value(file_read_config, 'scan_content', default=True):
-            violation_summary, scan_id = _scan_path_for_secrets(
-                ctx, file_path, policy, payload=payload, effective_mode=content_mode
-            )
-            if violation_summary:
+            scan_outcome = _scan_path_for_secrets(ctx, file_path, policy, payload=payload)
+            scan_id = scan_outcome.scan_id
+            if scan_outcome.violation_summary:
                 block_reason = SECRETS_BLOCK_REASON_BY_EVENT_TYPE[AiHookEventType.FILE_READ]
-                if content_mode == GuardrailsMode.BLOCK:
+                if scan_outcome.verdict == GuardrailsMode.BLOCK:
                     outcome = AIHookOutcome.BLOCKED
-                    user_message = f'Cycode blocked reading {file_path}. {violation_summary}'
+                    user_message = f'Cycode blocked reading {file_path}. {scan_outcome.violation_summary}'
                     return HookDecision.deny(
                         AiHookEventType.FILE_READ,
                         user_message,
                         'Secrets detected; do not send this file to the model.',
                     )
                 outcome = AIHookOutcome.WARNED
-                user_message = f'Cycode detected secrets in {file_path}. {violation_summary}'
+                user_message = f'Cycode detected secrets in {file_path}. {scan_outcome.violation_summary}'
                 return HookDecision.ask(
                     AiHookEventType.FILE_READ,
                     user_message,
@@ -192,10 +210,9 @@ class _ArgScanFeature:
     """Configuration for a "scan some text and decide" event.
 
     MCP execution and command exec share identical scan-and-decide logic;
-    only the policy key, event type, and user-facing messages differ.
+    only the event type and user-facing messages differ.
     """
 
-    policy_key: str  # 'mcp' or 'command_exec'
     event_type: AiHookEventType
     deny_message: Callable[[str], str]
     deny_agent_message: str
@@ -213,11 +230,9 @@ def _handle_arg_scan(
     """Shared scan + decision flow for MCP_EXECUTION and COMMAND_EXEC events."""
     ai_client = ctx.obj['ai_security_client']
 
-    feature_config = get_policy_value(policy, feature.policy_key, default={})
     max_bytes = get_policy_value(policy, 'secrets', 'max_bytes', default=200000)
     timeout_ms = get_policy_value(policy, 'secrets', 'timeout_ms', default=30000)
     clipped = truncate_utf8(scan_text, max_bytes)
-    effective_mode = get_effective_mode(feature_config)
 
     scan_id = None
     block_reason = None
@@ -225,27 +240,27 @@ def _handle_arg_scan(
     error_message = None
 
     try:
-        violation_summary, scan_id = _scan_text_for_secrets(
+        scan_outcome = _scan_text_for_secrets(
             ctx,
             clipped,
             timeout_ms,
             payload=payload,
             event_type=feature.event_type,
-            effective_mode=effective_mode,
         )
-        if violation_summary:
+        scan_id = scan_outcome.scan_id
+        if scan_outcome.violation_summary:
             block_reason = SECRETS_BLOCK_REASON_BY_EVENT_TYPE[feature.event_type]
-            if effective_mode == GuardrailsMode.BLOCK:
+            if scan_outcome.verdict == GuardrailsMode.BLOCK:
                 outcome = AIHookOutcome.BLOCKED
                 return HookDecision.deny(
                     feature.event_type,
-                    feature.deny_message(violation_summary),
+                    feature.deny_message(scan_outcome.violation_summary),
                     feature.deny_agent_message,
                 )
             outcome = AIHookOutcome.WARNED
             return HookDecision.ask(
                 feature.event_type,
-                feature.ask_message(violation_summary),
+                feature.ask_message(scan_outcome.violation_summary),
                 feature.ask_agent_message,
             )
 
@@ -278,7 +293,6 @@ def handle_before_mcp_execution(ctx: typer.Context, payload: AIHookPayload, poli
         payload,
         policy,
         _ArgScanFeature(
-            policy_key='mcp',
             event_type=AiHookEventType.MCP_EXECUTION,
             deny_message=lambda v: f'Cycode blocked MCP tool call "{tool}". {v}',
             deny_agent_message='Do not pass secrets to tools. Use secret references (name/id) instead.',
@@ -329,11 +343,9 @@ def build_ai_guardrails_scan_parameters(
     paths: Optional[tuple[str, ...]],
     payload: AIHookPayload,
     event_type: AiHookEventType,
-    effective_mode: GuardrailsMode,
 ) -> dict:
     scan_parameters = get_scan_parameters(ctx, paths)
     scan_parameters.setdefault('metadata', {})['ai_guardrails'] = {
-        'mode': effective_mode.value,
         'ide_provider': payload.ide_provider,
         'detection_source': SECRETS_BLOCK_REASON_BY_EVENT_TYPE[event_type].value,
         'device_id': get_serial_number(),
@@ -360,13 +372,13 @@ def _setup_scan_context(ctx: typer.Context) -> typer.Context:
 
 def _perform_scan(
     ctx: typer.Context, documents: list[Document], scan_parameters: dict, timeout_seconds: float
-) -> tuple[Optional[str], Optional[str]]:
-    """Run a scan on documents, returning (violation_summary, scan_id).
+) -> ScanOutcome:
+    """Run a scan on documents.
 
     Raises on scan failure / timeout so the fail-open policy can take over.
     """
     if not documents:
-        return None, None
+        return NO_SCAN
 
     scan_batch_thread_func = _get_scan_documents_thread_func(
         ctx, is_git_diff=False, is_commit_range=False, scan_parameters=scan_parameters
@@ -377,7 +389,7 @@ def _perform_scan(
     with ThreadPool(processes=1) as pool:
         result = pool.apply_async(scan_batch_thread_func, (documents,))
         try:
-            scan_id, error, local_scan_result = result.get(timeout=timeout_seconds)
+            _, error, local_scan_result = result.get(timeout=timeout_seconds)
         except PoolTimeoutError:
             logger.debug('Scan timed out after %s seconds', timeout_seconds)
             raise RuntimeError(f'Scan timed out after {timeout_seconds} seconds') from None
@@ -387,15 +399,14 @@ def _perform_scan(
         raise RuntimeError(error.message)
 
     if not local_scan_result:
-        return None, None
-
-    scan_id = local_scan_result.scan_id
+        return NO_SCAN
 
-    if local_scan_result.issue_detected:
-        violation_summary = build_violation_summary([local_scan_result])
-        return violation_summary, scan_id
-
-    return None, scan_id
+    violation_summary = build_violation_summary([local_scan_result]) if local_scan_result.issue_detected else None
+    return ScanOutcome(
+        violation_summary=violation_summary,
+        scan_id=local_scan_result.scan_id,
+        verdict=_parse_verdict(local_scan_result.verdict),
+    )
 
 
 def _scan_text_for_secrets(
@@ -404,16 +415,15 @@ def _scan_text_for_secrets(
     timeout_ms: int,
     payload: AIHookPayload,
     event_type: AiHookEventType,
-    effective_mode: GuardrailsMode,
-) -> tuple[Optional[str], Optional[str]]:
+) -> ScanOutcome:
     """Scan text content for secrets using Cycode CLI."""
     if not text:
-        return None, None
+        return NO_SCAN
 
     document = Document(path='prompt-content.txt', content=text, is_git_diff_format=False)
     scan_ctx = _setup_scan_context(ctx)
     timeout_seconds = timeout_ms / 1000.0
-    scan_parameters = build_ai_guardrails_scan_parameters(scan_ctx, None, payload, event_type, effective_mode)
+    scan_parameters = build_ai_guardrails_scan_parameters(scan_ctx, None, payload, event_type)
     return _perform_scan(scan_ctx, [document], scan_parameters, timeout_seconds)
 
 
@@ -422,15 +432,14 @@ def _scan_path_for_secrets(
     file_path: str,
     policy: dict,
     payload: AIHookPayload,
-    effective_mode: GuardrailsMode,
-) -> tuple[Optional[str], Optional[str]]:
+) -> ScanOutcome:
     """Scan a file path for secrets."""
     if not file_path or not os.path.isfile(file_path):
-        return None, None
+        return NO_SCAN
 
     if is_path_configured_in_exclusions(str(ScanTypeOption.SECRET), os.path.abspath(file_path)):
         logger.debug('Skipping scan; the path is in the ignore paths list, %s', {'file_path': file_path})
-        return None, None
+        return NO_SCAN
 
     max_bytes = get_policy_value(policy, 'secrets', 'max_bytes', default=200000)
 
@@ -442,7 +451,5 @@ def _scan_path_for_secrets(
 
     document = Document(path=os.path.basename(file_path), content=content, is_git_diff_format=False)
     scan_ctx = _setup_scan_context(ctx)
-    scan_parameters = build_ai_guardrails_scan_parameters(
-        scan_ctx, (file_path,), payload, AiHookEventType.FILE_READ, effective_mode
-    )
+    scan_parameters = build_ai_guardrails_scan_parameters(scan_ctx, (file_path,), payload, AiHookEventType.FILE_READ)
     return _perform_scan(scan_ctx, [document], scan_parameters, timeout_seconds)

cycode/cli/apps/scan/code_scanner.py

@@ -1,5 +1,6 @@
 import os
 import time
+import zipfile
 from platform import platform
 from typing import TYPE_CHECKING, Callable, Optional
 
@@ -23,6 +24,7 @@ from cycode.cli.files_collector.path_documents import get_relevant_documents
 from cycode.cli.files_collector.sca.sca_file_collector import add_sca_dependencies_tree_documents_if_needed
 from cycode.cli.files_collector.zip_documents import zip_documents
 from cycode.cli.models import CliError, Document, LocalScanResult
+from cycode.cli.utils.host_info import is_64bit
 from cycode.cli.utils.path_utils import get_absolute_path, get_path_by_os
 from cycode.cli.utils.progress_bar import ScanProgressBarSection
 from cycode.cli.utils.scan_batch import run_parallel_batched_scan
@@ -145,6 +147,7 @@ def _get_scan_documents_thread_func(
     is_git_diff: bool,
     is_commit_range: bool,
     scan_parameters: dict,
+    prezipped: Optional['InMemoryZip'] = None,
 ) -> Callable[[list[Document]], tuple[str, CliError, LocalScanResult]]:
     cycode_client = ctx.obj['client']
     scan_type = ctx.obj['scan_type']
@@ -164,9 +167,14 @@ def _get_scan_documents_thread_func(
 
         should_use_sync_flow = _should_use_sync_flow(command_scan_type, scan_type, sync_option)
 
+        # the single ZIP flow already built the archive to check that it fits; don't build it twice
+        zipped_documents = prezipped
+
         try:
-            logger.debug('Preparing local files, %s', {'batch_files_count': len(batch)})
-            zipped_documents = zip_documents(scan_type, batch)
+            if zipped_documents is None:
+                logger.debug('Preparing local files, %s', {'batch_files_count': len(batch)})
+                zipped_documents = zip_documents(scan_type, batch)
+
             zip_file_size = zipped_documents.size
             scan_result = _perform_scan(
                 cycode_client,
@@ -189,6 +197,9 @@ def _get_scan_documents_thread_func(
         except Exception as e:
             error = handle_scan_exception(ctx, e, return_exception=True)
             error_message = str(e)
+        finally:
+            if zipped_documents is not None:
+                zipped_documents.cleanup()
 
         if local_scan_result:
             detections_count = local_scan_result.detections_count
@@ -225,34 +236,77 @@ def _get_scan_documents_thread_func(
     return _scan_batch_thread_func
 
 
+def _log_selected_upload_mode(mode: str, reason: str, documents_count: int) -> None:
+    logger.debug(
+        'Selected upload mode, %s',
+        {
+            'mode': mode,
+            'reason': reason,
+            'documents_count': documents_count,
+            'max_files_count': consts.ZIP_MAX_FILES_COUNT,
+            'zip64_enabled': is_64bit(),
+        },
+    )
+
+
+def _exceeds_non_zip64_files_count(documents_to_scan: list[Document]) -> bool:
+    """Whether a single ZIP can't hold all the documents because ZIP64 is unavailable.
+
+    Without ZIP64 (32-bit interpreter) the archive is capped at 65,535 entries.
+    """
+    return not is_64bit() and len(documents_to_scan) > consts.ZIP_MAX_FILES_COUNT
+
+
 def _run_presigned_upload_scan(
-    scan_batch_thread_func: Callable,
-    scan_type: str,
+    ctx: typer.Context,
+    is_git_diff: bool,
+    is_commit_range: bool,
+    scan_parameters: dict,
     documents_to_scan: list[Document],
     progress_bar: 'BaseProgressBar',
     printer: 'ConsolePrinter',
 ) -> tuple:
-    try:
-        # Try to zip all documents as a single batch; ZipTooLargeError raised if it exceeds the scan type's limit
-        zip_documents(scan_type, documents_to_scan)
-        # It fits: skip batching and upload everything as one ZIP
+    scan_type = ctx.obj['scan_type']
+    documents_count = len(documents_to_scan)
+
+    def run_batched() -> tuple:
         return run_parallel_batched_scan(
-            scan_batch_thread_func,
+            _get_scan_documents_thread_func(ctx, is_git_diff, is_commit_range, scan_parameters),
             scan_type,
             documents_to_scan,
             progress_bar=progress_bar,
-            skip_batching=True,
         )
-    except custom_exceptions.ZipTooLargeError:
+
+    if _exceeds_non_zip64_files_count(documents_to_scan):
+        # Don't waste time zipping documents we already know won't fit into a single ZIP
+        _log_selected_upload_mode('batched', 'files_count_exceeds_non_zip64_limit', documents_count)
+        return run_batched()
+
+    zipped_documents = None
+    try:
+        # Try to zip all documents as a single batch; ZipTooLargeError raised if it exceeds the scan type's limit
+        zipped_documents = zip_documents(scan_type, documents_to_scan)
+    except (custom_exceptions.ZipTooLargeError, zipfile.LargeZipFile):
+        # LargeZipFile is a safety net: the files count pre-check above should have caught it already
+        _log_selected_upload_mode('batched', 'zip_too_large', documents_count)
+        if zipped_documents is not None:
+            zipped_documents.cleanup()
+
         printer.print_warning(
             'The scan is too large to upload as a single file. This may result in corrupted scan results.'
         )
-        return run_parallel_batched_scan(
-            scan_batch_thread_func,
-            scan_type,
-            documents_to_scan,
-            progress_bar=progress_bar,
-        )
+        return run_batched()
+
+    # It fits: skip batching and upload everything as one ZIP. The archive we just built is the one
+    # that gets uploaded, so the scan doesn't pay for compressing every document twice
+    _log_selected_upload_mode('single_zip', 'fits_single_zip', documents_count)
+    return run_parallel_batched_scan(
+        _get_scan_documents_thread_func(ctx, is_git_diff, is_commit_range, scan_parameters, zipped_documents),
+        scan_type,
+        documents_to_scan,
+        progress_bar=progress_bar,
+        skip_batching=True,
+    )
 
 
 def scan_documents(
@@ -277,18 +331,19 @@ def scan_documents(
         )
         return
 
-    scan_batch_thread_func = _get_scan_documents_thread_func(ctx, is_git_diff, is_commit_range, scan_parameters)
-
     # Presigned single-file upload is async-only; a --sync scan must stay on the batched inline path
     # so it never builds one oversized zip to POST synchronously.
     should_use_sync_flow = _should_use_sync_flow(ctx.info_name, scan_type, ctx.obj['sync'])
     if should_use_presigned_upload(scan_type) and not should_use_sync_flow:
         errors, local_scan_results = _run_presigned_upload_scan(
-            scan_batch_thread_func, scan_type, documents_to_scan, progress_bar, printer
+            ctx, is_git_diff, is_commit_range, scan_parameters, documents_to_scan, progress_bar, printer
         )
     else:
         errors, local_scan_results = run_parallel_batched_scan(
-            scan_batch_thread_func, scan_type, documents_to_scan, progress_bar=progress_bar
+            _get_scan_documents_thread_func(ctx, is_git_diff, is_commit_range, scan_parameters),
+            scan_type,
+            documents_to_scan,
+            progress_bar=progress_bar,
         )
 
     try_set_aggregation_report_url_if_needed(ctx, scan_parameters, ctx.obj['client'], scan_type)

cycode/cli/apps/scan/commit_range_scanner.py

@@ -214,6 +214,9 @@ def _scan_commit_range_documents(
 
     zip_file_size = from_commit_zipped_documents.size + to_commit_zipped_documents.size
 
+    from_commit_zipped_documents.cleanup()
+    to_commit_zipped_documents.cleanup()
+
     detections_count = relevant_detections_count = 0
     if local_scan_result:
         detections_count = local_scan_result.detections_count

cycode/cli/apps/scan/scan_result.py

@@ -79,6 +79,7 @@ def create_local_scan_result(
         issue_detected=len(relevant_document_detections_list) > 0,
         detections_count=detections_count,
         relevant_detections_count=relevant_detections_count,
+        verdict=scan_result.verdict,
     )
 
 
@@ -170,6 +171,7 @@ def get_sync_scan_result(scan_type: str, scan_results: 'ScanResultsSyncFlow') ->
         did_detect=True,
         detections_per_file=_map_detections_per_file_and_commit_id(scan_type, scan_results.detection_messages),
         scan_id=scan_results.id,
+        verdict=scan_results.verdict,
     )
 
 

cycode/cli/consts.py

@@ -227,6 +227,12 @@ FILE_MAX_SIZE_LIMIT_IN_BYTES = 5000000
 PRESIGNED_LINK_UPLOADED_ZIP_MAX_SIZE_LIMIT_IN_BYTES = 5 * 1024 * 1024 * 1024  # 5 GB (S3 presigned POST limit)
 PRESIGNED_UPLOAD_SCAN_TYPES = {SAST_SCAN_TYPE, SECRET_SCAN_TYPE}
 
+# the non-ZIP64 central directory stores the entry count in 16 bits; ZIP64 (64-bit interpreters) lifts it
+ZIP_MAX_FILES_COUNT = 65_535
+
+# the ZIP is built in memory up to this size, and spilled to a temp file beyond it
+ZIP_SPOOL_MAX_SIZE_IN_BYTES = 64 * 1024 * 1024
+
 DEFAULT_ZIP_MAX_SIZE_LIMIT_IN_BYTES = 20 * 1024 * 1024
 ZIP_MAX_SIZE_LIMIT_IN_BYTES = {
     SCA_SCAN_TYPE: 200 * 1024 * 1024,

cycode/cli/exceptions/handle_scan_errors.py

@@ -1,3 +1,4 @@
+import zipfile
 from typing import Optional
 
 import typer
@@ -26,6 +27,13 @@ def handle_scan_exception(ctx: typer.Context, err: Exception, *, return_exceptio
             'Please try ignoring irrelevant paths using the `cycode ignore --by-path` command '
             'and execute the scan again',
         ),
+        zipfile.LargeZipFile: CliError(
+            soft_fail=True,
+            code='zip_too_large_error',
+            message='The path you attempted to scan contains too many files to pack into a single archive. '
+            'Scanning such paths requires a 64-bit Python interpreter. '
+            'Please try ignoring irrelevant paths using a .cycodeignore file and execute the scan again',
+        ),
         custom_exceptions.FileCollectionError: CliError(
             soft_fail=False,
             code='file_collection_error',

cycode/cli/files_collector/models/in_memory_zip.py

@@ -1,20 +1,48 @@
+import shutil
+import tempfile
 from collections import defaultdict
-from io import BytesIO
+from os import SEEK_END
 from pathlib import Path
-from sys import getsizeof
-from typing import Optional
+from typing import IO, Optional
 from zipfile import ZIP_DEFLATED, ZipFile
 
+from cycode.cli import consts
 from cycode.cli.user_settings.configuration_manager import ConfigurationManager
+from cycode.cli.utils.host_info import is_64bit
 from cycode.cli.utils.path_utils import concat_unique_id
+from cycode.logger import get_logger
+
+logger = get_logger('ZIP')
+
+_SPOOL_DIRECTORY_NAME = 'tmp'
+
+
+def _get_spool_directory(configuration_manager: ConfigurationManager) -> Optional[str]:
+    """Directory to spill big ZIPs into. None falls back to the system temp directory."""
+    try:
+        directory = Path(configuration_manager.global_config_file_manager.get_config_directory_path())
+        spool_directory = directory / _SPOOL_DIRECTORY_NAME
+        spool_directory.mkdir(parents=True, exist_ok=True)
+        return str(spool_directory)
+    except OSError as e:
+        logger.debug('Failed to create the spool directory; falling back to the system one', exc_info=e)
+        return None
 
 
 class InMemoryZip:
     def __init__(self) -> None:
         self.configuration_manager = ConfigurationManager()
 
-        self.in_memory_zip = BytesIO()
-        self.zip = ZipFile(self.in_memory_zip, mode='a', compression=ZIP_DEFLATED, allowZip64=False)
+        self._spool_max_size = consts.ZIP_SPOOL_MAX_SIZE_IN_BYTES
+        self._buffer = tempfile.SpooledTemporaryFile(  # noqa: SIM115  # closed by cleanup(), lives past close()
+            max_size=self._spool_max_size,
+            dir=_get_spool_directory(self.configuration_manager),
+        )
+
+        # ZIP64 lifts the 65,535 entries and 4 GiB caps of the original ZIP format.
+        # It requires 64-bit offsets, so we only enable it on a 64-bit interpreter.
+        self._allow_zip64 = is_64bit()
+        self.zip = ZipFile(self._buffer, mode='a', compression=ZIP_DEFLATED, allowZip64=self._allow_zip64)
 
         self._files_count = 0
         self._extension_statistics = defaultdict(int)
@@ -35,17 +63,54 @@ class InMemoryZip:
     def close(self) -> None:
         self.zip.close()
 
+    def cleanup(self) -> None:
+        """Release the buffer, deleting the spilled temp file if there is one."""
+        self._buffer.close()
+
+    def __enter__(self) -> 'InMemoryZip':  # noqa: PYI034  # typing.Self needs Python 3.11
+        return self
+
+    def __exit__(self, *_: object) -> None:
+        self.cleanup()
+
+    def stream(self) -> IO[bytes]:
+        """The whole archive as a file object, rewound. Doesn't copy it into memory.
+
+        Note: before Python 3.11 SpooledTemporaryFile isn't a real IOBase, so the returned object
+        has no seekable()/readable()/writable(). read/seek/tell work on every supported version.
+        """
+        self._buffer.seek(0)
+        return self._buffer
+
     def read(self) -> bytes:
-        self.in_memory_zip.seek(0)
-        return self.in_memory_zip.read()
+        self._buffer.seek(0)
+        return self._buffer.read()
 
     def write_on_disk(self, path: 'Path') -> None:
         with open(path, 'wb') as f:
-            f.write(self.read())
+            shutil.copyfileobj(self.stream(), f)
 
     @property
     def size(self) -> int:
-        return getsizeof(self.in_memory_zip)
+        position = self._buffer.tell()
+        try:
+            self._buffer.seek(0, SEEK_END)
+            return self._buffer.tell()
+        finally:
+            self._buffer.seek(position)
+
+    @property
+    def is_rolled_over(self) -> bool:
+        """Whether the archive outgrew the threshold and moved from memory to the disk.
+
+        SpooledTemporaryFile spills on the write that crosses max_size, and the archive only grows,
+        so the size says it without reaching into the private _rolled flag.
+        """
+        return self.size > self._spool_max_size
+
+    @property
+    def allow_zip64(self) -> bool:
+        return self._allow_zip64
 
     @property
     def files_count(self) -> int:

cycode/cli/models.py

@@ -58,6 +58,7 @@ class LocalScanResult(NamedTuple):
     issue_detected: bool
     detections_count: int
     relevant_detections_count: int
+    verdict: Optional[str] = None
 
 
 @dataclass

cycode/cli/utils/host_info.py

@@ -49,6 +49,11 @@ def _read_text_file(path: str) -> Optional[str]:
         return None
 
 
+def is_64bit() -> bool:
+    """Whether the running Python interpreter is 64-bit (not the OS)."""
+    return sys.maxsize > 2**32
+
+
 def get_hostname() -> Optional[str]:
     try:
         return socket.gethostname() or None

cycode/cyclient/models.py

@@ -76,6 +76,7 @@ class ZippedFileScanResult(Schema):
         report_url: Optional[str] = None,
         scan_id: Optional[str] = None,
         err: Optional[str] = None,
+        verdict: Optional[str] = None,
     ) -> None:
         super().__init__()
         self.did_detect = did_detect
@@ -83,6 +84,7 @@ class ZippedFileScanResult(Schema):
         self.scan_id = scan_id
         self.report_url = report_url
         self.err = err
+        self.verdict = verdict
 
 
 class ScanResult(Schema):
@@ -506,6 +508,7 @@ class DetectionRuleSchema(Schema):
 class ScanResultsSyncFlow:
     id: str
     detection_messages: list[dict]
+    verdict: Optional[str] = None
 
 
 class ScanResultsSyncFlowSchema(Schema):
@@ -514,6 +517,7 @@ class ScanResultsSyncFlowSchema(Schema):
 
     id = fields.String()
     detection_messages = fields.List(fields.Dict())
+    verdict = fields.String(allow_none=True, load_default=None)
 
     @post_load
     def build_dto(self, data: dict[str, Any], **_) -> ScanResultsSyncFlow:

{cycode-3.24.1.dev2.dist-info → cycode-3.24.2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.24.1.dev2
+Version: 3.24.2
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE

{cycode-3.24.1.dev2.dist-info → cycode-3.24.2.dist-info}/RECORD

@@ -1,4 +1,4 @@
-cycode/__init__.py,sha256=TGnaJP0fWShd83OGAGzngPbjXG-1A9ACQThCYV9aIOc,396
+cycode/__init__.py,sha256=SNu9CKymlQOWGqEVBu23DySn2Aolsz1weuSM2GeCUto,391
 cycode/__main__.py,sha256=Z3bD5yrA7yPvAChcADQrqCaZd0ChGI1gdiwALwbWJ6U,104
 cycode/cli/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 cycode/cli/app.py,sha256=AlR2durAEbsa47PDfIj7JtMvJDWA_Dq6wPtVuMJYSCs,10250
@@ -20,8 +20,8 @@ cycode/cli/apps/ai_guardrails/install_command.py,sha256=3T-Wj_Fr871uhfTe77CGqrke
 cycode/cli/apps/ai_guardrails/scan/__init__.py,sha256=qJc82XiQGiAuc1sYY8Ij_A-qXpxgLPuayQq8xWlouMA,48
 cycode/cli/apps/ai_guardrails/scan/consts.py,sha256=8H8JXlgm65sYkgTXqsBInHhHe80UPjqY4vumZXB4GGM,1060
 cycode/cli/apps/ai_guardrails/scan/detach.py,sha256=8BRgBq9Qi8nXEx6NKlE8scSRPkO30XCfsiI5PLvq6Gk,2700
-cycode/cli/apps/ai_guardrails/scan/guardrail_config.py,sha256=QSBwmkTdlC9zXIqI3gIiOlefviJWrpeJHzFu1Cs-zgE,7051
-cycode/cli/apps/ai_guardrails/scan/handlers.py,sha256=i8fJ_K3m2v45DRSfkK0Wt4yEZfYIxOaLtZXiGna--5A,17641
+cycode/cli/apps/ai_guardrails/scan/guardrail_config.py,sha256=KHYZCiF86zpuUScex46oQ8dsA5zu30WmCXU54O6Pphg,6871
+cycode/cli/apps/ai_guardrails/scan/handlers.py,sha256=pHs_T6uTAT4QlJ_MMhc-EdjdfH9IdVczZ6XMdmaWPKg,17760
 cycode/cli/apps/ai_guardrails/scan/payload.py,sha256=sWsWq5yXP54MVCajsb180kLuprI_M2kspMOzQGh7r_o,1534
 cycode/cli/apps/ai_guardrails/scan/policy.py,sha256=3HuDoL_NYE3lyHRAlIMleq6pi-stIDQwotHsKhUFhTQ,5000
 cycode/cli/apps/ai_guardrails/scan/scan_command.py,sha256=fgV32phgkBPwqSau7oFDISZ58CVpq214JlYwZQM9bnM,8318
@@ -68,10 +68,10 @@ cycode/cli/apps/report_import/sbom/sbom_command.py,sha256=uWvBhVdROHcHsjoR3l44h3
 cycode/cli/apps/sca_options.py,sha256=-3iXoJV5qOkfjr-WGIWuAgaeNYeItJIbm2n6O2Kg5D8,1666
 cycode/cli/apps/scan/__init__.py,sha256=-q1AIBnrQ4GP0CVKFLr_2CdWf9TBQC90ejSL4I7rxuA,2444
 cycode/cli/apps/scan/aggregation_report.py,sha256=8f9kPfO7biNf5OsDZG6UhMPqG6ymoFrX5GBtlEIfFAg,1540
-cycode/cli/apps/scan/code_scanner.py,sha256=e5jAsDp99VyeSoiLLIkm7P3HOYOInaTq8qZ-OytsO3w,17513
+cycode/cli/apps/scan/code_scanner.py,sha256=kCCt08MHye3UIJo1cgSz2uP3E-6EZfAwsR7mNU6S_8g,19741
 cycode/cli/apps/scan/commit_history/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 cycode/cli/apps/scan/commit_history/commit_history_command.py,sha256=zTVmN8yeLXGAiCbyDL-EyEzSPNLzcRpP2q6Qq7p4uZA,1011
-cycode/cli/apps/scan/commit_range_scanner.py,sha256=OB7mmgRrEptvXxwyTeyfTWzq2iFry3-uTVZPIbbs13w,17283
+cycode/cli/apps/scan/commit_range_scanner.py,sha256=kUth9ksOHmoarseE8EhAzVCycs0Tqz2g1E6WGKhMCtE,17368
 cycode/cli/apps/scan/detection_excluder.py,sha256=0zaNa1PxVshATHv8axp4e-xWvmuNQdg_r5DYsdQ9EVo,6432
 cycode/cli/apps/scan/path/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 cycode/cli/apps/scan/path/path_command.py,sha256=x4HXqq1Wy6onziKMc6ELQxqeI5k-m3t_T3RG9kQxrq0,591
@@ -89,7 +89,7 @@ cycode/cli/apps/scan/scan_ci/ci_integrations.py,sha256=3ZUv1uLsHC13KTNQ4erQKKDXA
 cycode/cli/apps/scan/scan_ci/scan_ci_command.py,sha256=37I6YTs5UWYtbnDe1EeYZnhV1twFTDUrniZ4Sf2_6Kk,562
 cycode/cli/apps/scan/scan_command.py,sha256=_XN1Pz21-rRFKYxN-Bn_iDtEd1zE4drcSfSa1b4b5Us,7988
 cycode/cli/apps/scan/scan_parameters.py,sha256=F7SCTuTR_iGfztvwapVJjjq9mXhuQv9EvcaX-YyiILI,1481
-cycode/cli/apps/scan/scan_result.py,sha256=hTPB2wnsbqSNqAxhWN4P7_ygDN_j5Mufs_shIb0FJU4,8624
+cycode/cli/apps/scan/scan_result.py,sha256=_JtcNYtyX39CzJDk-KtpoAP5JdKSdk1I1r315bmjvNA,8699
 cycode/cli/apps/status/__init__.py,sha256=uxfkEBafO7Da0mPc1fZhwoO0RTtyXp2a5T3LJTZxubU,371
 cycode/cli/apps/status/get_cli_status.py,sha256=1UAVyKPpYk2S8nQYshKD1x5xgWR-hCTchLChxNU0JVA,2577
 cycode/cli/apps/status/models.py,sha256=2SBpJlh_MNCPxv8aXMV5D4GfK6-G-XB0GlMFZ3Nep_o,1907
@@ -98,14 +98,14 @@ cycode/cli/apps/status/version_command.py,sha256=c6Iko_rmZo9T_kQSd3HUloBi40Qv7cj
 cycode/cli/cli_types.py,sha256=Xqf2eSx3yUvFoQG29ObUZ3QLVBhtZ4mkqxf_cJXpntU,3406
 cycode/cli/config.py,sha256=Op-lX_neanJtvPvoOEx4ByBdveh5ygElIga1FdSHhOI,299
 cycode/cli/console.py,sha256=vp-DHwlkwpwdsPyfwGdjsPF-6-Bi3f8W7G-W_YXCMH8,1914
-cycode/cli/consts.py,sha256=bSP2N_deQnRgFMik6rQkYzyenezdZjFBB-5DDX_q6ZA,10001
+cycode/cli/consts.py,sha256=7RXx2ezNO7Ss_tEBcNsjklYt0esldiqM0iKhgIFrDt8,10268
 cycode/cli/exceptions/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 cycode/cli/exceptions/custom_exceptions.py,sha256=SImny5zXhnKocTw6GDaTm9x4I3bWRZW4wZEXg2Q-NTI,4742
 cycode/cli/exceptions/handle_ai_remediation_errors.py,sha256=mA70upSYXK3rL_fmanzKYeUzLENhpXdkW8k3aIHrKzU,785
 cycode/cli/exceptions/handle_auth_errors.py,sha256=m3q9keRUKAg6OnFlOlzpNUFzdQHGEeyq8N2Ywqs-QQ4,597
 cycode/cli/exceptions/handle_errors.py,sha256=za3vQcM_eFTvbT-53tTc6ky-J0wav6lupD1hXWw0e54,881
 cycode/cli/exceptions/handle_report_sbom_errors.py,sha256=bi0EizHtQLL-ovhHRH98CZ7qXdDPLTYnI59Jn1Y5c0E,926
-cycode/cli/exceptions/handle_scan_errors.py,sha256=1KkBFb7LniflYRr0vMl1FPIZDALPZu1LiXhORGl0jhs,2195
+cycode/cli/exceptions/handle_scan_errors.py,sha256=po91RQgRi0beQChSrjuiV2DXVARb-NOqzpVDhbvRKmw,2617
 cycode/cli/files_collector/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 cycode/cli/files_collector/commit_range_documents.py,sha256=Bvv9MJBoiraXI396A46412x9zgusjPS3g3nWdSFprPE,21095
 cycode/cli/files_collector/documents_walk_ignore.py,sha256=G4e-3vfP4WZ7wa9-VbZ66xCKCioTXnPBfbrs4_hh8xY,4705
@@ -113,7 +113,7 @@ cycode/cli/files_collector/file_excluder.py,sha256=atua_L2qDbmhFXj4nB6rDqSn5--Mu
 cycode/cli/files_collector/iac/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 cycode/cli/files_collector/iac/tf_content_generator.py,sha256=a65zA0Ejv_LSA5jac2omHck4IKoNS5MX6v6ltF2wo4E,2873
 cycode/cli/files_collector/models/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-cycode/cli/files_collector/models/in_memory_zip.py,sha256=a56bTdOgg7E3PpWRh0ixVX8laY_3ifWilPZoQRMNFYs,1838
+cycode/cli/files_collector/models/in_memory_zip.py,sha256=jYLb8P2tcHWyvnDjDdREIpDXUTZxvgFdEZoB77RnXss,4411
 cycode/cli/files_collector/path_documents.py,sha256=7oNLcFZFHC_3sO34iD9FaKdS6_0lCogAl-nh11ejT_w,5040
 cycode/cli/files_collector/repository_documents.py,sha256=53QQsfCzXXSV6F3EcInaN8G6aCwEVzceWiYwasG8CgM,860
 cycode/cli/files_collector/sca/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -147,7 +147,7 @@ cycode/cli/files_collector/walk_ignore.py,sha256=nvOM6oDmT2SxSI4pU-bLlc9LwTgkfTd
 cycode/cli/files_collector/zip_documents.py,sha256=FMzbA2Vog7Zl_ntizNQJK8AFqoGu0QlPIMIBpgmBiVI,1852
 cycode/cli/logger.py,sha256=mlaYEQGYd582fTCc3SC3cFMj0PKTB6EsaI12Q4VL1z8,65
 cycode/cli/main.py,sha256=QTPqIZsJsNK_vun8---vP2jP4ljlNJ15xidNrQ-Y0Rc,316
-cycode/cli/models.py,sha256=fuFjEXdH5QUpu4iwo5eMDgfJ9FzVtjTlTJNvBqPaBjE,1850
+cycode/cli/models.py,sha256=gkutKkjhXyrzRr26jJEDQfxsKMbwUBXW2n0orWN3CPM,1884
 cycode/cli/printers/__init__.py,sha256=ALwAXSZy2lNXWC3NfCIxf8K0F6eFrbZa9PLZwPINi5E,93
 cycode/cli/printers/console_printer.py,sha256=3WjPIRYHVrnPt4n6p84-YB3_fmrYL3_kdK3X42tYTx0,6141
 cycode/cli/printers/json_printer.py,sha256=kqCH_C0llPADwbXRBni0wq1kjVz08kbc7R6cGd8fWVI,2447
@@ -180,7 +180,7 @@ cycode/cli/utils/binary_utils.py,sha256=PxP-rVJ1lEiOam-DQ1XU68oWtfwup4sCFHXv54cf
 cycode/cli/utils/enum_utils.py,sha256=h_VTCfJ-0hnhwDsEznmx56rJrCb5FQ8u6PrI6p8MP3E,187
 cycode/cli/utils/get_api_client.py,sha256=wwHabfVCDbFjcIwOn5Raho8MEPiOAgkHlGUEfXKpl8U,3542
 cycode/cli/utils/git_proxy.py,sha256=FPHMBiyLFK9X9vKYpKySRKJH6Dc9Cb3nO241Q95dASE,2911
-cycode/cli/utils/host_info.py,sha256=ba3scmnOJQOtNpVT-rf2-FKb0ocGzpPUONsG-uxmhro,6249
+cycode/cli/utils/host_info.py,sha256=Clln3qCJR00rw6HndD0bAIv329n_bOEx42TKW6FqXFQ,6379
 cycode/cli/utils/ignore_utils.py,sha256=cODqhnOHA2kRo8rMY0YcmcKkmXNPOC9UTCmFu62RRqE,15567
 cycode/cli/utils/jwt_utils.py,sha256=EGI-0CKhCGY8hIcZ9b9diq9hqtOUf8Ha8ukeVJIf974,818
 cycode/cli/utils/path_utils.py,sha256=zc48CSU7hxqjSgfH6h5M1B0kIcKW44BOJrUa_6z-mAo,4317
@@ -212,13 +212,13 @@ cycode/cyclient/cycode_token_based_client.py,sha256=frbrv1jzF388SXqHNNkZ95Hbx7Vj
 cycode/cyclient/headers.py,sha256=NMlVH9hAxZ-CyWaZJio29Mc5KFcFvNvnJTshueM3hFI,1337
 cycode/cyclient/import_sbom_client.py,sha256=M0RAn2dDh9woI3SUkgSHCQxhbARoLpyAM3amOausz8E,2749
 cycode/cyclient/logger.py,sha256=oTkay7QzoOIVQ71cGOy4ukkijYGA3IKJlHkL24Px5ds,70
-cycode/cyclient/models.py,sha256=pHiJpj9TVPmn7bAK3uhx4Yc4unyo9llUoCoJKeDhDnM,15493
+cycode/cyclient/models.py,sha256=Bv3K10KmUlF_VG81GGMeyFbJWOR3sQZh6j-EDdeeKK4,15661
 cycode/cyclient/report_client.py,sha256=Scq30NeJPzgXv0hPLO1U05AdE9i_2iu6cIrSKpEJ-cM,4399
 cycode/cyclient/scan_client.py,sha256=DqAZ7u6Z_cvw9A9RlLkAQUgLRwPCCAsUq5U9umt4F7Y,16955
 cycode/cyclient/scan_config_base.py,sha256=mXsPZGYCtp85rv5GIige40yQZXuRcEKUW-VQJ0vgFzk,1201
 cycode/logger.py,sha256=EfZGRK6VC5rE_LAjIcRrHFiQCueylCDXoG6bvGkrIME,2111
-cycode-3.24.1.dev2.dist-info/METADATA,sha256=AxXWfRpzaPJHwREMYa_RvGp_-JGo4iGbXkzEPbZBMGM,93687
-cycode-3.24.1.dev2.dist-info/WHEEL,sha256=zp0Cn7JsFoX2ATtOhtaFYIiE2rmFAD4OcMhtUki8W3U,88
-cycode-3.24.1.dev2.dist-info/entry_points.txt,sha256=iDcVJM8ByLElVgvBgtYxDjw1kT7O8Mo0LcWZIT5L3Ig,45
-cycode-3.24.1.dev2.dist-info/licenses/LICENCE,sha256=2Wx4N6mD_4xB7-E3hPkZ3MPhpJy__k_I8MaCSO-PDRo,1068
-cycode-3.24.1.dev2.dist-info/RECORD,,
+cycode-3.24.2.dist-info/METADATA,sha256=pq5GUnFBB0PJjCvESRjnd5RgJ6TAC2c8fkNG7bcxPIY,93682
+cycode-3.24.2.dist-info/WHEEL,sha256=zp0Cn7JsFoX2ATtOhtaFYIiE2rmFAD4OcMhtUki8W3U,88
+cycode-3.24.2.dist-info/entry_points.txt,sha256=iDcVJM8ByLElVgvBgtYxDjw1kT7O8Mo0LcWZIT5L3Ig,45
+cycode-3.24.2.dist-info/licenses/LICENCE,sha256=2Wx4N6mD_4xB7-E3hPkZ3MPhpJy__k_I8MaCSO-PDRo,1068
+cycode-3.24.2.dist-info/RECORD,,