cycode 3.25.1.dev4__tar.gz → 3.25.1.dev6__tar.gz

{cycode-3.25.1.dev4 → cycode-3.25.1.dev6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.25.1.dev4
+Version: 3.25.1.dev6
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE

{cycode-3.25.1.dev4 → cycode-3.25.1.dev6}/cycode/__init__.py

@@ -5,4 +5,4 @@ import time as _time
 # end-to-end scan duration from the moment the user actually triggered it.
 _BOOT_WALL: float = _time.time()
 
-__version__ = '3.25.1.dev4'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
+__version__ = '3.25.1.dev6'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

{cycode-3.25.1.dev4 → cycode-3.25.1.dev6}/cycode/cli/apps/ai_guardrails/ides/codex.py

@@ -269,21 +269,18 @@ class Codex(IDE):
         )
 
     def build_hook_response(self, decision: HookDecision) -> dict:
-        # Codex accepts the same hook response shapes as Claude Code:
-        #  - PROMPT: empty for allow, {"decision": "block", "reason": ...} for deny
-        #  - PreToolUse: hookSpecificOutput.permissionDecision
+        # Codex hook response shapes:
+        #  - allow: empty (no objection). Older Codex runtimes reject an explicit
+        #    PreToolUse permissionDecision "allow" as unsupported and report a
+        #    failed hook on every call, so never send it.
+        #  - PROMPT deny: {"decision": "block", "reason": ...}
+        #  - PreToolUse deny: hookSpecificOutput.permissionDecision
+        if decision.action == DecisionAction.ALLOW:
+            return {}
+
         if decision.event_type == AiHookEventType.PROMPT:
-            if decision.action == DecisionAction.ALLOW:
-                return {}
             return {'decision': 'block', 'reason': decision.user_message or ''}
 
-        if decision.action == DecisionAction.ALLOW:
-            return {
-                'hookSpecificOutput': {
-                    'hookEventName': 'PreToolUse',
-                    'permissionDecision': 'allow',
-                }
-            }
         return {
             'hookSpecificOutput': {
                 'hookEventName': 'PreToolUse',

{cycode-3.25.1.dev4 → cycode-3.25.1.dev6}/cycode/cli/apps/ai_guardrails/scan/handlers.py

@@ -10,10 +10,9 @@ touching any handler in this module.
 
 import json
 import os
+import threading
 from dataclasses import dataclass
-from multiprocessing.pool import ThreadPool
-from multiprocessing.pool import TimeoutError as PoolTimeoutError
-from typing import TYPE_CHECKING, Callable, NamedTuple, Optional
+from typing import TYPE_CHECKING, Any, Callable, NamedTuple, Optional
 
 import typer
 
@@ -370,6 +369,13 @@ def _setup_scan_context(ctx: typer.Context) -> typer.Context:
     return ctx
 
 
+def _run_scan(scan_func: Callable, documents: list[Document], scan_result: dict[str, Any]) -> None:
+    try:
+        scan_result['value'] = scan_func(documents)
+    except BaseException as e:
+        scan_result['error'] = e
+
+
 def _perform_scan(
     ctx: typer.Context, documents: list[Document], scan_parameters: dict, timeout_seconds: float
 ) -> ScanOutcome:
@@ -384,15 +390,17 @@ def _perform_scan(
         ctx, is_git_diff=False, is_commit_range=False, scan_parameters=scan_parameters
     )
 
-    # Use ThreadPool.apply_async with timeout to abort if scan takes too long
-    # This uses the same ThreadPool mechanism as run_parallel_batched_scan but with timeout support
-    with ThreadPool(processes=1) as pool:
-        result = pool.apply_async(scan_batch_thread_func, (documents,))
-        try:
-            _, error, local_scan_result = result.get(timeout=timeout_seconds)
-        except PoolTimeoutError:
-            logger.debug('Scan timed out after %s seconds', timeout_seconds)
-            raise RuntimeError(f'Scan timed out after {timeout_seconds} seconds') from None
+    scan_result: dict[str, Any] = {}
+    scan_thread = threading.Thread(target=_run_scan, args=(scan_batch_thread_func, documents, scan_result), daemon=True)
+    scan_thread.start()
+    scan_thread.join(timeout_seconds)
+    if scan_thread.is_alive():
+        logger.debug('Scan timed out after %s seconds', timeout_seconds)
+        raise RuntimeError(f'Scan timed out after {timeout_seconds} seconds')
+    if 'error' in scan_result:
+        raise scan_result['error']
+
+    _, error, local_scan_result = scan_result['value']
 
     # Check if scan failed - raise exception to trigger fail_open policy
     if error:

{cycode-3.25.1.dev4 → cycode-3.25.1.dev6}/cycode/cli/utils/git_proxy.py

@@ -1,5 +1,6 @@
 import types
 from abc import ABC, abstractmethod
+from functools import cache
 from typing import TYPE_CHECKING, Optional
 
 _GIT_ERROR_MESSAGE = """
@@ -10,11 +11,6 @@ You can help Cycode CLI to locate the Git executable
 by setting the GIT_PYTHON_GIT_EXECUTABLE=<path/to/git> environment variable.
 """.strip().replace('\n', ' ')
 
-try:
-    import git
-except ImportError:
-    git = None
-
 if TYPE_CHECKING:
     from git import PathLike, Repo
 
@@ -23,6 +19,16 @@ class GitProxyError(Exception):
     pass
 
 
+# GitPython runs `git version` on import, so it is imported on first use rather than at CLI startup
+@cache
+def _import_git() -> Optional[types.ModuleType]:
+    try:
+        import git
+    except ImportError:
+        return None
+    return git
+
+
 class _AbstractGitProxy(ABC):
     @abstractmethod
     def get_repo(self, path: Optional['PathLike'] = None, *args, **kwargs) -> 'Repo': ...
@@ -52,46 +58,54 @@ class _DummyGitProxy(_AbstractGitProxy):
 
 
 class _GitProxy(_AbstractGitProxy):
+    def __init__(self, git_module: types.ModuleType) -> None:
+        self._git = git_module
+
     def get_repo(self, path: Optional['PathLike'] = None, *args, **kwargs) -> 'Repo':
-        return git.Repo(path, *args, **kwargs)
+        return self._git.Repo(path, *args, **kwargs)
 
     def get_null_tree(self) -> object:
-        return git.NULL_TREE
+        return self._git.NULL_TREE
 
     def get_invalid_git_repository_error(self) -> type[BaseException]:
-        return git.InvalidGitRepositoryError
+        return self._git.InvalidGitRepositoryError
 
     def get_git_command_error(self) -> type[BaseException]:
-        return git.GitCommandError
+        return self._git.GitCommandError
 
 
 def get_git_proxy(git_module: Optional[types.ModuleType]) -> _AbstractGitProxy:
-    return _GitProxy() if git_module else _DummyGitProxy()
+    return _GitProxy(git_module) if git_module else _DummyGitProxy()
 
 
 class GitProxyManager(_AbstractGitProxy):
     """We are using this manager for easy unit testing and mocking of the git module."""
 
     def __init__(self) -> None:
-        self._git_proxy = get_git_proxy(git)
+        self._git_proxy: Optional[_AbstractGitProxy] = None
+
+    def _get_git_proxy(self) -> _AbstractGitProxy:
+        if self._git_proxy is None:
+            self._git_proxy = get_git_proxy(_import_git())
+        return self._git_proxy
 
     def _set_dummy_git_proxy(self) -> None:
         self._git_proxy = _DummyGitProxy()
 
     def _set_git_proxy(self) -> None:
-        self._git_proxy = _GitProxy()
+        self._git_proxy = _GitProxy(_import_git())
 
     def get_repo(self, path: Optional['PathLike'] = None, *args, **kwargs) -> 'Repo':
-        return self._git_proxy.get_repo(path, *args, **kwargs)
+        return self._get_git_proxy().get_repo(path, *args, **kwargs)
 
     def get_null_tree(self) -> object:
-        return self._git_proxy.get_null_tree()
+        return self._get_git_proxy().get_null_tree()
 
     def get_invalid_git_repository_error(self) -> type[BaseException]:
-        return self._git_proxy.get_invalid_git_repository_error()
+        return self._get_git_proxy().get_invalid_git_repository_error()
 
     def get_git_command_error(self) -> type[BaseException]:
-        return self._git_proxy.get_git_command_error()
+        return self._get_git_proxy().get_git_command_error()
 
 
 git_proxy = GitProxyManager()

{cycode-3.25.1.dev4 → cycode-3.25.1.dev6}/pyproject.toml

@@ -21,7 +21,7 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
 ]
 dynamic = ["dependencies"]
-version = "3.25.1.dev4"
+version = "3.25.1.dev6"
 
 [project.scripts]
 cycode = "cycode.cli.app:app"