cycode 3.25.1.dev3__tar.gz → 3.25.1.dev5__tar.gz

{cycode-3.25.1.dev3 → cycode-3.25.1.dev5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.25.1.dev3
+Version: 3.25.1.dev5
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE

{cycode-3.25.1.dev3 → cycode-3.25.1.dev5}/cycode/__init__.py

@@ -5,4 +5,4 @@ import time as _time
 # end-to-end scan duration from the moment the user actually triggered it.
 _BOOT_WALL: float = _time.time()
 
-__version__ = '3.25.1.dev3'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
+__version__ = '3.25.1.dev5'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

{cycode-3.25.1.dev3 → cycode-3.25.1.dev5}/cycode/cli/apps/ai_guardrails/ides/codex.py

@@ -269,21 +269,18 @@ class Codex(IDE):
         )
 
     def build_hook_response(self, decision: HookDecision) -> dict:
-        # Codex accepts the same hook response shapes as Claude Code:
-        #  - PROMPT: empty for allow, {"decision": "block", "reason": ...} for deny
-        #  - PreToolUse: hookSpecificOutput.permissionDecision
+        # Codex hook response shapes:
+        #  - allow: empty (no objection). Older Codex runtimes reject an explicit
+        #    PreToolUse permissionDecision "allow" as unsupported and report a
+        #    failed hook on every call, so never send it.
+        #  - PROMPT deny: {"decision": "block", "reason": ...}
+        #  - PreToolUse deny: hookSpecificOutput.permissionDecision
+        if decision.action == DecisionAction.ALLOW:
+            return {}
+
         if decision.event_type == AiHookEventType.PROMPT:
-            if decision.action == DecisionAction.ALLOW:
-                return {}
             return {'decision': 'block', 'reason': decision.user_message or ''}
 
-        if decision.action == DecisionAction.ALLOW:
-            return {
-                'hookSpecificOutput': {
-                    'hookEventName': 'PreToolUse',
-                    'permissionDecision': 'allow',
-                }
-            }
         return {
             'hookSpecificOutput': {
                 'hookEventName': 'PreToolUse',

{cycode-3.25.1.dev3 → cycode-3.25.1.dev5}/cycode/cli/files_collector/sca/npm/restore_bun_dependencies.py

@@ -6,15 +6,19 @@ from typing import Optional
 import typer
 
 from cycode.cli.files_collector.sca.base_restore_dependencies import BaseRestoreDependencies, build_dep_tree_path
+from cycode.cli.files_collector.sca.npm.workspace import (
+    BUN_LOCK_FILE_NAME,
+    MANIFEST_FILE_NAME,
+    is_covered_workspace_member,
+)
 from cycode.cli.models import Document
-from cycode.cli.utils.path_utils import get_file_content
+from cycode.cli.utils.path_utils import get_file_content, get_scan_roots_from_context
 from cycode.cli.utils.shell_executor import shell
 from cycode.logger import get_logger
 
 logger = get_logger('Bun Restore Dependencies')
 
-BUN_MANIFEST_FILE_NAME = 'package.json'
-BUN_LOCK_FILE_NAME = 'bun.lock'
+BUN_MANIFEST_FILE_NAME = MANIFEST_FILE_NAME
 
 # Only Bun >=1.2 produces the text-based `bun.lock` lockfile that we parse.
 # Older Bun versions emit a binary `bun.lockb`, which is not supported.
@@ -61,6 +65,9 @@ class RestoreBunDependencies(BaseRestoreDependencies):
         if manifest_dir and (Path(manifest_dir) / BUN_LOCK_FILE_NAME).is_file():
             return True
 
+        if is_covered_workspace_member(manifest_dir, document.path, get_scan_roots_from_context(self.ctx)):
+            return False
+
         return _indicates_bun(document.content)
 
     def _is_supported_bun_version(self) -> bool:

{cycode-3.25.1.dev3 → cycode-3.25.1.dev5}/cycode/cli/files_collector/sca/npm/restore_deno_dependencies.py

@@ -4,6 +4,7 @@ from typing import Optional
 import typer
 
 from cycode.cli.files_collector.sca.base_restore_dependencies import BaseRestoreDependencies, build_dep_tree_path
+from cycode.cli.files_collector.sca.npm.workspace import DENO_LOCK_FILE_NAME
 from cycode.cli.models import Document
 from cycode.cli.utils.path_utils import get_file_content
 from cycode.logger import get_logger
@@ -11,7 +12,6 @@ from cycode.logger import get_logger
 logger = get_logger('Deno Restore Dependencies')
 
 DENO_MANIFEST_FILE_NAMES = ('deno.json', 'deno.jsonc')
-DENO_LOCK_FILE_NAME = 'deno.lock'
 
 
 class RestoreDenoDependencies(BaseRestoreDependencies):

{cycode-3.25.1.dev3 → cycode-3.25.1.dev5}/cycode/cli/files_collector/sca/npm/restore_npm_dependencies.py

@@ -3,15 +3,25 @@ from pathlib import Path
 import typer
 
 from cycode.cli.files_collector.sca.base_restore_dependencies import BaseRestoreDependencies
+from cycode.cli.files_collector.sca.npm.workspace import (
+    BUN_LOCK_FILE_NAME,
+    DENO_LOCK_FILE_NAME,
+    MANIFEST_FILE_NAME,
+    NPM_LOCK_FILE_NAME,
+    NPM_SHRINKWRAP_FILE_NAME,
+    PNPM_LOCK_FILE_NAME,
+    YARN_LOCK_FILE_NAME,
+    is_covered_workspace_member,
+)
 from cycode.cli.models import Document
+from cycode.cli.utils.path_utils import get_scan_roots_from_context
 from cycode.logger import get_logger
 
 logger = get_logger('NPM Restore Dependencies')
 
-NPM_MANIFEST_FILE_NAME = 'package.json'
-NPM_LOCK_FILE_NAME = 'package-lock.json'
+NPM_MANIFEST_FILE_NAME = MANIFEST_FILE_NAME
 # These lockfiles indicate another package manager owns the project — NPM should not run
-_ALTERNATIVE_LOCK_FILES = ('yarn.lock', 'pnpm-lock.yaml', 'deno.lock', 'bun.lock')
+_ALTERNATIVE_LOCK_FILES = (YARN_LOCK_FILE_NAME, PNPM_LOCK_FILE_NAME, DENO_LOCK_FILE_NAME, BUN_LOCK_FILE_NAME)
 
 
 class RestoreNpmDependencies(BaseRestoreDependencies):
@@ -24,6 +34,9 @@ class RestoreNpmDependencies(BaseRestoreDependencies):
         Yarn and pnpm projects are handled by their dedicated handlers, which run before
         this one in the handler list. This handler is the npm fallback.
 
+        A manifest is also declined when a lockfile further up already resolves it, whichever
+        package manager wrote that lockfile; see the workspace package for how that is decided.
+
         NOTE: this guard only excludes a project when an alternative lockfile is *physically
         present on disk*. It does not inspect the `packageManager`/`engines` signal in
         package.json. So a project that declares e.g. `packageManager: "bun@..."` (or pnpm)
@@ -37,16 +50,18 @@ class RestoreNpmDependencies(BaseRestoreDependencies):
             return False
 
         manifest_dir = self.get_manifest_dir(document)
-        if manifest_dir:
-            for lock_file in _ALTERNATIVE_LOCK_FILES:
-                if (Path(manifest_dir) / lock_file).is_file():
-                    logger.debug(
-                        'Skipping npm restore: alternative lockfile detected, %s',
-                        {'path': document.path, 'lockfile': lock_file},
-                    )
-                    return False
+        if not manifest_dir:
+            return True
+
+        for lock_file in _ALTERNATIVE_LOCK_FILES:
+            if (Path(manifest_dir) / lock_file).is_file():
+                logger.debug(
+                    'Skipping npm restore: alternative lockfile detected, %s',
+                    {'path': document.path, 'lockfile': lock_file},
+                )
+                return False
 
-        return True
+        return not is_covered_workspace_member(manifest_dir, document.path, get_scan_roots_from_context(self.ctx))
 
     def get_commands(self, manifest_file_path: str) -> list[list[str]]:
         return [
@@ -65,7 +80,11 @@ class RestoreNpmDependencies(BaseRestoreDependencies):
         return NPM_LOCK_FILE_NAME
 
     def get_lock_file_names(self) -> list[str]:
-        return [NPM_LOCK_FILE_NAME]
+        return [NPM_LOCK_FILE_NAME, NPM_SHRINKWRAP_FILE_NAME]
+
+    def get_restored_lock_file_name(self, restore_file_path: str) -> str:
+        name = Path(restore_file_path).name
+        return name if name in self.get_lock_file_names() else self.get_lock_file_name()
 
     @staticmethod
     def prepare_manifest_file_path_for_command(manifest_file_path: str) -> str:

{cycode-3.25.1.dev3 → cycode-3.25.1.dev5}/cycode/cli/files_collector/sca/npm/restore_pnpm_dependencies.py

@@ -5,14 +5,18 @@ from typing import Optional
 import typer
 
 from cycode.cli.files_collector.sca.base_restore_dependencies import BaseRestoreDependencies, build_dep_tree_path
+from cycode.cli.files_collector.sca.npm.workspace import (
+    MANIFEST_FILE_NAME,
+    PNPM_LOCK_FILE_NAME,
+    is_covered_workspace_member,
+)
 from cycode.cli.models import Document
-from cycode.cli.utils.path_utils import get_file_content
+from cycode.cli.utils.path_utils import get_file_content, get_scan_roots_from_context
 from cycode.logger import get_logger
 
 logger = get_logger('Pnpm Restore Dependencies')
 
-PNPM_MANIFEST_FILE_NAME = 'package.json'
-PNPM_LOCK_FILE_NAME = 'pnpm-lock.yaml'
+PNPM_MANIFEST_FILE_NAME = MANIFEST_FILE_NAME
 
 
 def _indicates_pnpm(package_json_content: Optional[str]) -> bool:
@@ -44,6 +48,9 @@ class RestorePnpmDependencies(BaseRestoreDependencies):
         if manifest_dir and (Path(manifest_dir) / PNPM_LOCK_FILE_NAME).is_file():
             return True
 
+        if is_covered_workspace_member(manifest_dir, document.path, get_scan_roots_from_context(self.ctx)):
+            return False
+
         return _indicates_pnpm(document.content)
 
     def try_restore_dependencies(self, document: Document) -> Optional[Document]:

{cycode-3.25.1.dev3 → cycode-3.25.1.dev5}/cycode/cli/files_collector/sca/npm/restore_yarn_dependencies.py

@@ -5,14 +5,18 @@ from typing import Optional
 import typer
 
 from cycode.cli.files_collector.sca.base_restore_dependencies import BaseRestoreDependencies, build_dep_tree_path
+from cycode.cli.files_collector.sca.npm.workspace import (
+    MANIFEST_FILE_NAME,
+    YARN_LOCK_FILE_NAME,
+    is_covered_workspace_member,
+)
 from cycode.cli.models import Document
-from cycode.cli.utils.path_utils import get_file_content
+from cycode.cli.utils.path_utils import get_file_content, get_scan_roots_from_context
 from cycode.logger import get_logger
 
 logger = get_logger('Yarn Restore Dependencies')
 
-YARN_MANIFEST_FILE_NAME = 'package.json'
-YARN_LOCK_FILE_NAME = 'yarn.lock'
+YARN_MANIFEST_FILE_NAME = MANIFEST_FILE_NAME
 
 
 def _indicates_yarn(package_json_content: Optional[str]) -> bool:
@@ -44,6 +48,9 @@ class RestoreYarnDependencies(BaseRestoreDependencies):
         if manifest_dir and (Path(manifest_dir) / YARN_LOCK_FILE_NAME).is_file():
             return True
 
+        if is_covered_workspace_member(manifest_dir, document.path, get_scan_roots_from_context(self.ctx)):
+            return False
+
         return _indicates_yarn(document.content)
 
     def try_restore_dependencies(self, document: Document) -> Optional[Document]:

cycode-3.25.1.dev5/cycode/cli/files_collector/sca/npm/workspace/__init__.py

@@ -0,0 +1,49 @@
+"""Deciding whether a lockfile above a manifest already resolves that manifest's dependencies.
+
+The lockfile is the authority wherever it can name its members; the manifest's workspaces globs
+are a fallback for the formats that cannot. See resolvers.py for the per-format readers.
+"""
+
+from cycode.cli.files_collector.sca.npm.workspace import coverage as _coverage
+from cycode.cli.files_collector.sca.npm.workspace import globs as _globs
+from cycode.cli.files_collector.sca.npm.workspace import resolvers as _resolvers
+from cycode.cli.files_collector.sca.npm.workspace.coverage import (
+    WorkspaceCoverage,
+    find_covering_workspace,
+    is_covered_workspace_member,
+)
+from cycode.cli.files_collector.sca.npm.workspace.names import (
+    BUN_BINARY_LOCK_FILE_NAME,
+    BUN_LOCK_FILE_NAME,
+    DENO_LOCK_FILE_NAME,
+    MANIFEST_FILE_NAME,
+    NPM_LOCK_FILE_NAME,
+    NPM_SHRINKWRAP_FILE_NAME,
+    PNPM_LOCK_FILE_NAME,
+    YARN_LOCK_FILE_NAME,
+)
+from cycode.cli.files_collector.sca.npm.workspace.resolvers import MEMBER_RESOLVERS
+
+
+def clear_cache() -> None:
+    """Drop every memo, so one scan never inherits another scan's view of the filesystem."""
+    _resolvers.clear_cache()
+    _globs.clear_cache()
+    _coverage.clear_cache()
+
+
+__all__ = [
+    'BUN_BINARY_LOCK_FILE_NAME',
+    'BUN_LOCK_FILE_NAME',
+    'DENO_LOCK_FILE_NAME',
+    'MANIFEST_FILE_NAME',
+    'MEMBER_RESOLVERS',
+    'NPM_LOCK_FILE_NAME',
+    'NPM_SHRINKWRAP_FILE_NAME',
+    'PNPM_LOCK_FILE_NAME',
+    'YARN_LOCK_FILE_NAME',
+    'WorkspaceCoverage',
+    'clear_cache',
+    'find_covering_workspace',
+    'is_covered_workspace_member',
+]

cycode-3.25.1.dev5/cycode/cli/files_collector/sca/npm/workspace/coverage.py

@@ -0,0 +1,142 @@
+"""Walking up from a manifest to the lockfile that already resolves it."""
+
+import os
+from pathlib import Path
+from typing import TYPE_CHECKING, NamedTuple, Optional
+
+from cycode.cli.files_collector.sca.npm.workspace.files import logger, resolved_path
+from cycode.cli.files_collector.sca.npm.workspace.globs import declares_workspace_member
+from cycode.cli.files_collector.sca.npm.workspace.resolvers import MEMBER_RESOLVERS
+from cycode.cli.utils.path_utils import is_sub_path
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+_GIT_DIR_NAME = '.git'
+
+_reported_unscanned_roots: set = set()
+
+
+def clear_cache() -> None:
+    _reported_unscanned_roots.clear()
+
+
+class WorkspaceCoverage(NamedTuple):
+    package_manager: str
+    lock_file: Path
+
+
+def _scan_root_directories(scan_roots: tuple) -> list:
+    """The directory each scanned path stands for; scanning a file scans its directory."""
+    directories = []
+    for scan_root in scan_roots:
+        resolved = resolved_path(scan_root)
+        if os.path.isfile(resolved):
+            resolved = os.path.dirname(resolved)
+
+        if resolved:
+            directories.append(resolved)
+
+    return directories
+
+
+def _containing_scan_roots(manifest_dir: Path, scan_roots: tuple) -> list:
+    resolved_manifest_dir = resolved_path(manifest_dir)
+    return [
+        Path(directory)
+        for directory in _scan_root_directories(scan_roots)
+        if is_sub_path(directory, resolved_manifest_dir)
+    ]
+
+
+def _resolve_walk_boundary(manifest_dir: Path, scan_roots: tuple) -> Optional[Path]:
+    for root_dir in manifest_dir.parents:
+        if (root_dir / _GIT_DIR_NAME).exists():
+            return root_dir
+
+    containing = _containing_scan_roots(manifest_dir, scan_roots)
+    if containing:
+        return min(containing, key=lambda scan_root: len(scan_root.parts))
+
+    if scan_roots:
+        return manifest_dir
+
+    return None
+
+
+def _workspace_root_candidates(manifest_dir: Path, scan_roots: tuple) -> 'Iterator[Path]':
+    boundary = _resolve_walk_boundary(manifest_dir, scan_roots)
+    resolved_boundary = resolved_path(boundary) if boundary is not None else None
+    if resolved_boundary == resolved_path(manifest_dir):
+        return
+
+    for root_dir in manifest_dir.parents:
+        yield root_dir
+        if resolved_boundary is not None and resolved_path(root_dir) == resolved_boundary:
+            return
+
+
+def _find_covering_workspace(manifest_dir: Path, scan_roots: tuple) -> Optional[WorkspaceCoverage]:
+    for root_dir in _workspace_root_candidates(manifest_dir, scan_roots):
+        member_path = manifest_dir.relative_to(root_dir).as_posix()
+
+        for resolver in MEMBER_RESOLVERS:
+            for lock_file_name in resolver.lock_file_names:
+                lock_file = root_dir / lock_file_name
+                if not lock_file.is_file():
+                    continue
+
+                member_names = resolver.resolve(lock_file)
+                if member_names is not None:
+                    if member_path in member_names:
+                        return WorkspaceCoverage(resolver.package_manager, lock_file)
+                    continue
+
+                if resolver.may_use_workspace_globs and declares_workspace_member(root_dir, member_path):
+                    return WorkspaceCoverage(resolver.package_manager, lock_file)
+
+    return None
+
+
+def find_covering_workspace(manifest_dir: Optional[str], scan_roots: tuple = ()) -> Optional[WorkspaceCoverage]:
+    if not manifest_dir:
+        return None
+
+    return _find_covering_workspace(Path(manifest_dir), scan_roots)
+
+
+def _is_inside_scanned_paths(scan_roots: tuple, root_dir: Path) -> bool:
+    directories = _scan_root_directories(scan_roots)
+    if not directories:
+        logger.debug('No scanned paths in context; treating the workspace root as scanned, %s', {'root': str(root_dir)})
+        return True
+
+    resolved_root_dir = resolved_path(root_dir)
+    return any(is_sub_path(directory, resolved_root_dir) for directory in directories)
+
+
+def is_covered_workspace_member(manifest_dir: Optional[str], document_path: str, scan_roots: tuple = ()) -> bool:
+    coverage = find_covering_workspace(manifest_dir, scan_roots)
+    if coverage is None:
+        return False
+
+    details = {
+        'path': document_path,
+        'root_lockfile': str(coverage.lock_file),
+        'workspace': coverage.package_manager,
+    }
+    if _is_inside_scanned_paths(scan_roots, coverage.lock_file.parent):
+        logger.debug('Skipping restore: the workspace root lockfile already covers this member, %s', details)
+        return True
+
+    report_key = (document_path, str(coverage.lock_file))
+    if report_key not in _reported_unscanned_roots:
+        _reported_unscanned_roots.add(report_key)
+        logger.warning(
+            'The workspace root lockfile is outside the scanned path and will not be collected, '
+            'so this member is restored on its own. Scan the workspace root for the versions it '
+            'actually installs, %s',
+            details,
+        )
+
+    return False

cycode-3.25.1.dev5/cycode/cli/files_collector/sca/npm/workspace/files.py

@@ -0,0 +1,38 @@
+"""Filesystem access shared by the readers: identity for caching, and tolerant parsing."""
+
+import json
+import os
+from pathlib import Path
+from typing import Optional
+
+from cycode.cli.utils.path_utils import get_absolute_path
+from cycode.logger import get_logger
+
+logger = get_logger('SCA NPM Workspace')
+
+FileStamp = tuple[str, int, int]
+
+
+def resolved_path(path: object) -> str:
+    return os.path.realpath(get_absolute_path(str(path)))
+
+
+def file_stamp(path: Path) -> Optional[FileStamp]:
+    try:
+        stat_result = path.stat()
+    except OSError:
+        return None
+
+    return str(path), stat_result.st_mtime_ns, stat_result.st_size
+
+
+def read_json_object(path: Path) -> Optional[dict]:
+    try:
+        content = json.loads(path.read_text(encoding='UTF-8'))
+    except FileNotFoundError:
+        return None
+    except (OSError, ValueError) as e:
+        logger.debug('Could not read an npm workspace file, %s', {'path': str(path), 'error': e})
+        return None
+
+    return content if isinstance(content, dict) else None

cycode-3.25.1.dev5/cycode/cli/files_collector/sca/npm/workspace/globs.py

@@ -0,0 +1,116 @@
+"""Matching a member against the manifest's workspaces globs.
+
+Only reached for lockfiles that cannot name their own members: classic yarn.lock and the
+binary bun.lockb. Every other format answers from the lockfile itself.
+"""
+
+import fnmatch
+from functools import lru_cache
+from pathlib import Path
+from typing import NamedTuple
+
+from cycode.cli.files_collector.sca.npm.workspace.files import FileStamp, file_stamp, read_json_object
+from cycode.cli.files_collector.sca.npm.workspace.names import MANIFEST_FILE_NAME
+
+_MANIFEST_WORKSPACES_SECTION = 'workspaces'
+_MANIFEST_WORKSPACE_PACKAGES_SECTION = 'packages'
+_NEGATION_PREFIX = '!'
+_GLOBSTAR = '**'
+_SEGMENT_MATCH_CACHE_SIZE = 4096
+
+
+class _WorkspacePatterns(NamedTuple):
+    included: tuple[str, ...]
+    excluded: tuple[str, ...]
+
+
+_EMPTY_WORKSPACE_PATTERNS = _WorkspacePatterns((), ())
+
+_workspace_patterns_cache: dict[FileStamp, _WorkspacePatterns] = {}
+
+
+def clear_cache() -> None:
+    _workspace_patterns_cache.clear()
+
+
+def _matches_workspace_pattern(pattern: str, member_path: str) -> bool:
+    """Match a workspace glob against a member path, one path segment at a time.
+
+    fnmatch is wrong for a whole path because its * crosses a separator, but inside one
+    segment there is no separator, so it is exactly right there - and it brings character
+    classes with it. Only ** needs handling here, because only ** spans segments.
+    """
+    return _match_segments(tuple(pattern.split('/')), tuple(member_path.split('/')))
+
+
+@lru_cache(maxsize=_SEGMENT_MATCH_CACHE_SIZE)
+def _match_segments(pattern_segments: tuple, path_segments: tuple) -> bool:
+    """Memoised so that several ** in one pattern cannot make this exponential.
+
+    Each ** tries every split of the remaining path, so without memoisation a pattern such as
+    **/**/**/x against a deep tree multiplies out. The arguments are plain tuples of strings,
+    so a result can never go stale.
+    """
+    if not pattern_segments:
+        return not path_segments
+
+    head, rest = pattern_segments[0], pattern_segments[1:]
+    if head == _GLOBSTAR:
+        # ** spans zero or more segments, and spanning zero is what makes dir/** match dir
+        return any(_match_segments(rest, path_segments[index:]) for index in range(len(path_segments) + 1))
+
+    if not path_segments:
+        return False
+
+    return fnmatch.fnmatchcase(path_segments[0], head) and _match_segments(rest, path_segments[1:])
+
+
+def _split_workspace_patterns(declared: list) -> _WorkspacePatterns:
+    included = []
+    excluded = []
+    for entry in declared:
+        stripped = entry.strip()
+        is_excluded = stripped.startswith(_NEGATION_PREFIX)
+        normalized = (stripped[1:] if is_excluded else stripped).strip()
+        if normalized.startswith('./'):
+            normalized = normalized[2:]
+
+        normalized = normalized.rstrip('/')
+        if not normalized:
+            continue
+
+        if is_excluded:
+            excluded.append(normalized)
+        else:
+            included.append(normalized)
+
+    return _WorkspacePatterns(tuple(included), tuple(excluded))
+
+
+def _read_manifest_workspace_patterns(root_dir: Path) -> _WorkspacePatterns:
+    manifest = root_dir / MANIFEST_FILE_NAME
+    stamp = file_stamp(manifest)
+    if stamp is None:
+        return _EMPTY_WORKSPACE_PATTERNS
+
+    cached = _workspace_patterns_cache.get(stamp)
+    if cached is not None:
+        return cached
+
+    content = read_json_object(manifest)
+    workspaces = content.get(_MANIFEST_WORKSPACES_SECTION) if content is not None else None
+    if isinstance(workspaces, dict):
+        workspaces = workspaces.get(_MANIFEST_WORKSPACE_PACKAGES_SECTION)
+
+    declared = [entry for entry in workspaces if isinstance(entry, str)] if isinstance(workspaces, list) else []
+    patterns = _split_workspace_patterns(declared)
+    _workspace_patterns_cache[stamp] = patterns
+    return patterns
+
+
+def declares_workspace_member(root_dir: Path, member_path: str) -> bool:
+    patterns = _read_manifest_workspace_patterns(root_dir)
+    if not any(_matches_workspace_pattern(pattern, member_path) for pattern in patterns.included):
+        return False
+
+    return not any(_matches_workspace_pattern(pattern, member_path) for pattern in patterns.excluded)

cycode-3.25.1.dev5/cycode/cli/files_collector/sca/npm/workspace/names.py

@@ -0,0 +1,16 @@
+"""File names and package-manager identifiers shared across the workspace package."""
+
+MANIFEST_FILE_NAME = 'package.json'
+
+NPM_PACKAGE_MANAGER = 'npm'
+YARN_PACKAGE_MANAGER = 'yarn'
+PNPM_PACKAGE_MANAGER = 'pnpm'
+BUN_PACKAGE_MANAGER = 'bun'
+
+NPM_LOCK_FILE_NAME = 'package-lock.json'
+NPM_SHRINKWRAP_FILE_NAME = 'npm-shrinkwrap.json'
+YARN_LOCK_FILE_NAME = 'yarn.lock'
+PNPM_LOCK_FILE_NAME = 'pnpm-lock.yaml'
+BUN_LOCK_FILE_NAME = 'bun.lock'
+BUN_BINARY_LOCK_FILE_NAME = 'bun.lockb'
+DENO_LOCK_FILE_NAME = 'deno.lock'