cycode 3.25.1.dev6__py3-none-any.whl → 3.25.2.dev2__py3-none-any.whl

cycode/cli/apps/ai_guardrails/scan/handlers.py

@@ -11,8 +11,9 @@ touching any handler in this module.
 import json
 import os
 import threading
+from collections.abc import Callable
 from dataclasses import dataclass
-from typing import TYPE_CHECKING, Any, Callable, NamedTuple, Optional
+from typing import TYPE_CHECKING, Any, NamedTuple
 
 import typer
 
@@ -21,6 +22,7 @@ if TYPE_CHECKING:
 
 from cycode.cli.apps.ai_guardrails.consts import GuardrailsMode, PolicyMode
 from cycode.cli.apps.ai_guardrails.ides.base import HookDecision
+from cycode.cli.apps.ai_guardrails.scan.mcp_server_status import is_enforced, load_mcp_server_statuses
 from cycode.cli.apps.ai_guardrails.scan.payload import AIHookPayload
 from cycode.cli.apps.ai_guardrails.scan.policy import get_policy_value
 from cycode.cli.apps.ai_guardrails.scan.types import (
@@ -47,15 +49,15 @@ HandlerFn = Callable[[typer.Context, AIHookPayload, dict], HookDecision]
 class ScanOutcome(NamedTuple):
     """What one guardrail scan came back with; the verdict is the server's, which applied the tenant's floors."""
 
-    violation_summary: Optional[str] = None
-    scan_id: Optional[str] = None
-    verdict: Optional[GuardrailsMode] = None
+    violation_summary: str | None = None
+    scan_id: str | None = None
+    verdict: GuardrailsMode | None = None
 
 
 NO_SCAN = ScanOutcome()
 
 
-def _parse_verdict(verdict: Optional[str]) -> Optional[GuardrailsMode]:
+def _parse_verdict(verdict: str | None) -> GuardrailsMode | None:
     """The server spells the verdict "Block"/"Report" and omits it when the scan found nothing to decide on."""
     if not verdict:
         return None
@@ -104,7 +106,7 @@ def handle_before_submit_prompt(ctx: typer.Context, payload: AIHookPayload, poli
         )
         block_reason = BlockReason.SCAN_FAILURE
         error_message = str(e)
-        raise e
+        raise
     finally:
         ai_client.create_event(
             payload,
@@ -191,7 +193,7 @@ def handle_before_read_file(ctx: typer.Context, payload: AIHookPayload, policy:
         )
         block_reason = BlockReason.SCAN_FAILURE
         error_message = str(e)
-        raise e
+        raise
     finally:
         ai_client.create_event(
             payload,
@@ -217,6 +219,16 @@ class _ArgScanFeature:
     deny_agent_message: str
     ask_message: Callable[[str], str]
     ask_agent_message: str
+    scan_enabled: bool = True
+
+
+class _PreScanFinding(NamedTuple):
+    """A finding on the call itself (e.g. an unauthorized MCP server), made before the text scan."""
+
+    block_reason: BlockReason
+    mode: GuardrailsMode
+    deny_message: str
+    deny_agent_message: str
 
 
 def _handle_arg_scan(
@@ -225,8 +237,12 @@ def _handle_arg_scan(
     policy: dict,
     feature: _ArgScanFeature,
     scan_text: str,
+    pre_scan_finding: _PreScanFinding | None = None,
 ) -> HookDecision:
-    """Shared scan + decision flow for MCP_EXECUTION and COMMAND_EXEC events."""
+    """Shared scan + decision flow for MCP_EXECUTION and COMMAND_EXEC events.
+
+    A Report-mode pre-scan finding still scans, and a secret found then takes over the response.
+    """
     ai_client = ctx.obj['ai_security_client']
 
     max_bytes = get_policy_value(policy, 'secrets', 'max_bytes', default=200000)
@@ -239,6 +255,18 @@ def _handle_arg_scan(
     error_message = None
 
     try:
+        if pre_scan_finding is not None:
+            block_reason = pre_scan_finding.block_reason
+            if pre_scan_finding.mode == GuardrailsMode.BLOCK:
+                outcome = AIHookOutcome.BLOCKED
+                return HookDecision.deny(
+                    feature.event_type, pre_scan_finding.deny_message, pre_scan_finding.deny_agent_message
+                )
+            outcome = AIHookOutcome.WARNED
+
+        if not feature.scan_enabled:
+            return HookDecision.allow(feature.event_type)
+
         scan_outcome = _scan_text_for_secrets(
             ctx,
             clipped,
@@ -270,7 +298,7 @@ def _handle_arg_scan(
         )
         block_reason = BlockReason.SCAN_FAILURE
         error_message = str(e)
-        raise e
+        raise
     finally:
         ai_client.create_event(
             payload,
@@ -282,8 +310,43 @@ def _handle_arg_scan(
         )
 
 
+def _check_mcp_server_authorization(payload: AIHookPayload, policy: dict) -> _PreScanFinding | None:
+    """Fails open: no server name or no cached statuses lets the call through."""
+    mcp_config = get_policy_value(policy, 'mcp', default={})
+    if not get_policy_value(mcp_config, 'check_server', default=False):
+        return None
+
+    server_name = payload.mcp_server_name
+    if not server_name:
+        logger.debug('No MCP server name in the payload; skipping the server authorization check')
+        return None
+
+    statuses = load_mcp_server_statuses()
+    if statuses is None:
+        logger.debug('No cached MCP server statuses; skipping the server authorization check')
+        return None
+
+    status = statuses.status_of(server_name)
+    if not is_enforced(status):
+        return None
+
+    logger.debug('MCP server is not authorized, %s', {'mcp_server_name': server_name, 'status': status})
+    return _PreScanFinding(
+        block_reason=BlockReason.UNAUTHORIZED_MCP_SERVER,
+        mode=get_effective_mode(mcp_config, action_key='server_action'),
+        deny_message=(
+            f"Cycode blocked MCP server '{server_name}': it is not authorized in your organization. "
+            'Contact your admin to authorize it.'
+        ),
+        deny_agent_message=(
+            f"The MCP server '{server_name}' is not authorized in this organization. "
+            'Do not retry its tools or reach it another way.'
+        ),
+    )
+
+
 def handle_before_mcp_execution(ctx: typer.Context, payload: AIHookPayload, policy: dict) -> HookDecision:
-    """Scan MCP tool arguments for secrets before execution."""
+    """Check the MCP server is authorized, then scan the tool arguments for secrets."""
     tool = payload.mcp_tool_name or 'unknown'
     args = payload.mcp_arguments or {}
     args_text = args if isinstance(args, str) else json.dumps(args)
@@ -297,12 +360,14 @@ def handle_before_mcp_execution(ctx: typer.Context, payload: AIHookPayload, poli
             deny_agent_message='Do not pass secrets to tools. Use secret references (name/id) instead.',
             ask_message=lambda v: f'Allow MCP tool call "{tool}"? {v}',
             ask_agent_message='Possible secrets detected in tool arguments; proceed with caution.',
+            scan_enabled=get_policy_value(policy, 'mcp', 'scan_args', default=True),
         ),
         scan_text=args_text,
+        pre_scan_finding=_check_mcp_server_authorization(payload, policy),
     )
 
 
-def get_handler_for_event(event_type: str) -> Optional[HandlerFn]:
+def get_handler_for_event(event_type: str) -> HandlerFn | None:
     """Look up the handler for a canonical event type."""
     handlers: dict[str, HandlerFn] = {
         AiHookEventType.PROMPT.value: handle_before_submit_prompt,
@@ -319,10 +384,10 @@ def get_effective_mode(feature_config: dict, action_key: str = 'action') -> Guar
 
 
 def should_detach_scan(
-    config: Optional['GuardrailConfig'],
+    config: 'GuardrailConfig | None',
     policy: dict,
     event_name: str,
-    ide_name: Optional[str],
+    ide_name: str | None,
 ) -> bool:
     """Whether this event's scan is safe to run detached.
 
@@ -339,7 +404,7 @@ def should_detach_scan(
 
 def build_ai_guardrails_scan_parameters(
     ctx: typer.Context,
-    paths: Optional[tuple[str, ...]],
+    paths: tuple[str, ...] | None,
     payload: AIHookPayload,
     event_type: AiHookEventType,
 ) -> dict:

cycode/cli/apps/ai_guardrails/scan/mcp_server_status.py

@@ -0,0 +1,103 @@
+"""MCP server authorization status cache: session-start writes it, the pre-MCP-execution hook reads it.
+
+An absent or corrupt cache means no status is known, so the guardrail fails open.
+"""
+
+import json
+import time
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any
+
+from marshmallow import EXCLUDE, Schema, fields, post_load
+
+from cycode.cli.apps.ai_guardrails.scan.guardrail_config import DEFAULT_TTL_SECONDS
+from cycode.cli.consts import CYCODE_CONFIGURATION_DIRECTORY
+from cycode.cli.utils.path_utils import atomic_write_text, quarantine_corrupt_file
+from cycode.cyclient.models import McpServerAuthorizationStatus, McpServerStatus, McpServerStatusSchema
+from cycode.logger import get_logger
+
+logger = get_logger('AI Guardrails')
+
+MCP_SERVER_STATUSES_FILE_NAME = 'ai-guardrails-mcp-servers.json'
+
+
+# An alias shared by several servers (e.g. configured differently per device) gets the most restrictive status.
+_RESTRICTIVENESS = {
+    McpServerAuthorizationStatus.AUTHORIZED: 0,
+    McpServerAuthorizationStatus.UNREVIEWED: 1,
+    McpServerAuthorizationStatus.UNAUTHORIZED: 2,
+}
+
+
+def get_mcp_server_statuses_cache_path() -> Path:
+    return Path.home() / CYCODE_CONFIGURATION_DIRECTORY / MCP_SERVER_STATUSES_FILE_NAME
+
+
+def is_enforced(status: McpServerAuthorizationStatus | None) -> bool:
+    """``status`` is None when the platform never saw the server."""
+    return status == McpServerAuthorizationStatus.UNAUTHORIZED
+
+
+@dataclass
+class McpServerStatuses:
+    servers: list[McpServerStatus]
+    fetched_at: float
+    tenant_id: str | None = None
+    ttl_seconds: float = DEFAULT_TTL_SECONDS
+    _by_alias: dict = field(init=False, repr=False)
+
+    def __post_init__(self) -> None:
+        # The platform matches aliases case-insensitively, so the CLI does too.
+        self._by_alias = {}
+        for server in self.servers:
+            if not server.alias:
+                continue
+            key = server.alias.lower()
+            known = self._by_alias.get(key)
+            if known is None or _RESTRICTIVENESS[server.status] > _RESTRICTIVENESS[known]:
+                self._by_alias[key] = server.status
+
+    def status_of(self, alias: str) -> McpServerAuthorizationStatus | None:
+        return self._by_alias.get(alias.lower())
+
+
+class McpServerStatusesSchema(Schema):
+    class Meta:
+        unknown = EXCLUDE
+
+    servers = fields.List(fields.Nested(McpServerStatusSchema), required=True)
+    fetched_at = fields.Float(required=True)
+    tenant_id = fields.String(allow_none=True, load_default=None)
+    ttl_seconds = fields.Float(allow_none=True, load_default=None)
+
+    @post_load
+    def build_dto(self, data: dict[str, Any], **_) -> McpServerStatuses:
+        data['ttl_seconds'] = data['ttl_seconds'] or DEFAULT_TTL_SECONDS
+        return McpServerStatuses(**data)
+
+
+def save_mcp_server_statuses(
+    servers: list[McpServerStatus], tenant_id: str | None, ttl_seconds: float = DEFAULT_TTL_SECONDS
+) -> None:
+    path = get_mcp_server_statuses_cache_path()
+    statuses = McpServerStatuses(servers=servers, fetched_at=time.time(), tenant_id=tenant_id, ttl_seconds=ttl_seconds)
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        atomic_write_text(str(path), json.dumps(McpServerStatusesSchema().dump(statuses)))
+    except Exception as e:
+        logger.debug('Failed to save MCP server statuses cache', exc_info=e)
+
+
+def load_mcp_server_statuses() -> McpServerStatuses | None:
+    path = get_mcp_server_statuses_cache_path()
+    if not path.exists():
+        return None
+
+    try:
+        with open(path, encoding='UTF-8') as file:
+            return McpServerStatusesSchema().load(json.load(file))
+    except Exception as e:
+        logger.warning('MCP server statuses cache is corrupt and will be moved aside', exc_info=e)
+        quarantine_corrupt_file(str(path))
+        return None

cycode/cli/apps/ai_guardrails/scan/payload.py

@@ -7,7 +7,6 @@ respective IDE class.
 
 import uuid
 from dataclasses import dataclass, field
-from typing import Optional
 
 
 @dataclass
@@ -15,9 +14,9 @@ class AIHookPayload:
     """Unified payload that normalizes field names across IDEs."""
 
     # Event identification
-    event_name: Optional[str] = None  # Canonical event type from AiHookEventType
-    conversation_id: Optional[str] = None
-    generation_id: Optional[str] = None
+    event_name: str | None = None  # Canonical event type from AiHookEventType
+    conversation_id: str | None = None
+    generation_id: str | None = None
 
     # Minted here rather than by the server: the guardrail scan and the hook event are reported in two
     # separate requests, and both have to name the same event. A generation id can't stand in for it - the
@@ -25,16 +24,16 @@ class AIHookPayload:
     hook_event_id: str = field(default_factory=lambda: str(uuid.uuid4()))
 
     # User and IDE information
-    ide_user_email: Optional[str] = None
-    model: Optional[str] = None
-    ide_provider: Optional[str] = None  # Matches IDE.name (e.g. 'cursor', 'claude-code')
-    ide_version: Optional[str] = None
+    ide_user_email: str | None = None
+    model: str | None = None
+    ide_provider: str | None = None  # Matches IDE.name (e.g. 'cursor', 'claude-code')
+    ide_version: str | None = None
 
-    source: Optional[str] = None
+    source: str | None = None
 
     # Event-specific data
-    prompt: Optional[str] = None  # PROMPT events
-    file_path: Optional[str] = None  # FILE_READ events
-    mcp_server_name: Optional[str] = None  # MCP_EXECUTION events
-    mcp_tool_name: Optional[str] = None
-    mcp_arguments: Optional[dict] = None
+    prompt: str | None = None  # PROMPT events
+    file_path: str | None = None  # FILE_READ events
+    mcp_server_name: str | None = None  # MCP_EXECUTION events
+    mcp_tool_name: str | None = None
+    mcp_arguments: dict | None = None

cycode/cli/apps/ai_guardrails/scan/policy.py

@@ -15,7 +15,7 @@ import json
 import os
 import sys
 from pathlib import Path
-from typing import Any, Optional
+from typing import Any
 
 import yaml
 
@@ -71,7 +71,7 @@ def deep_merge(base: dict, override: dict) -> dict:
     return result
 
 
-def load_yaml_file(path: Path) -> Optional[dict]:
+def load_yaml_file(path: Path) -> dict | None:
     """Load a YAML or JSON config file."""
     if not path.exists():
         return None
@@ -101,7 +101,7 @@ def get_policy_value(policy: dict, *keys: str, default: Any = None) -> Any:
     return current
 
 
-def load_policy(workspace_root: Optional[str] = None) -> dict:
+def load_policy(workspace_root: str | None = None) -> dict:
     """
     Load policy by merging configs in order of precedence.
 

cycode/cli/apps/ai_guardrails/scan/scan_command.py

@@ -7,7 +7,7 @@ The handlers in ``handlers.py`` are agent-agnostic (they return
 ``HookDecision``); ``IDE.build_hook_response`` is the per-IDE translation step.
 """
 
-from typing import Annotated, Optional, Union
+from typing import Annotated
 from uuid import uuid4
 
 import click
@@ -46,9 +46,9 @@ def _get_auth_error_message(error: Exception) -> str:
 
 
 def _deny_for_event(
-    event_name: Optional[Union[str, AiHookEventType]],
+    event_name: str | AiHookEventType | None,
     user_message: str,
-    agent_message: Optional[str] = None,
+    agent_message: str | None = None,
 ) -> HookDecision:
     """Build a deny decision matched to ``event_name``'s response shape.
 
@@ -62,7 +62,7 @@ def _deny_for_event(
     return HookDecision.deny(target, user_message, agent_message)
 
 
-def _should_skip_payload(ide_integration: IDE, payload: Optional[dict]) -> bool:
+def _should_skip_payload(ide_integration: IDE, payload: dict | None) -> bool:
     """Fast exits that never scan: empty/foreign/synthetic payloads all answer a plain allow."""
     if not payload:
         logger.debug('Empty or invalid JSON payload received')

cycode/cli/apps/ai_guardrails/scan/types.py

@@ -40,6 +40,7 @@ class BlockReason(StrEnum):
     SECRETS_IN_FILE = 'secrets_in_file'
     SECRETS_IN_MCP_ARGS = 'secrets_in_mcp_args'
     SENSITIVE_PATH = 'sensitive_path'
+    UNAUTHORIZED_MCP_SERVER = 'unauthorized_mcp_server'
     SCAN_FAILURE = 'scan_failure'
 
 

cycode/cli/apps/ai_guardrails/session_start_command.py

@@ -5,7 +5,7 @@ import json
 import sys
 import time
 from pathlib import Path
-from typing import TYPE_CHECKING, Annotated, Optional
+from typing import TYPE_CHECKING, Annotated
 
 import typer
 
@@ -15,7 +15,14 @@ from cycode.cli.apps.ai_guardrails.ides import (
     collect_all_skills,
     get_ide,
 )
-from cycode.cli.apps.ai_guardrails.scan.guardrail_config import load_guardrail_config, save_guardrail_config
+from cycode.cli.apps.ai_guardrails.scan.guardrail_config import (
+    DEFAULT_TTL_SECONDS,
+    GuardrailConfig,
+    load_guardrail_config,
+    save_guardrail_config,
+)
+from cycode.cli.apps.ai_guardrails.scan.mcp_server_status import save_mcp_server_statuses
+from cycode.cli.apps.ai_guardrails.scan.types import BlockReason
 from cycode.cli.apps.ai_guardrails.scan.utils import read_stdin_text, safe_json_parse
 from cycode.cli.apps.auth.auth_common import get_authorization_info
 from cycode.cli.apps.auth.auth_manager import AuthManager
@@ -49,21 +56,28 @@ def _session_context_digest(report: dict) -> str:
     return hashlib.sha256(canonical.encode('utf-8')).hexdigest()
 
 
-def _should_skip_report(digest: str, tenant_id: Optional[str]) -> bool:
+def _report_ttl_seconds(config: GuardrailConfig | None) -> float:
+    """The response carries the MCP server statuses, so the guardrail's TTL applies while it is enabled."""
+    if config is None or config.is_off_for_every_agent(BlockReason.UNAUTHORIZED_MCP_SERVER):
+        return _SESSION_CONTEXT_TTL_SECONDS
+    return config.ttl_seconds
+
+
+def _should_skip_report(digest: str, tenant_id: str | None, ttl_seconds: float) -> bool:
     """Skip when the same payload was already sent for this tenant and the TTL hasn't expired."""
     try:
         cache = json.loads(_session_context_cache_path().read_text(encoding='utf-8'))
         return (
             cache.get('hash') == digest
             and cache.get('tenant_id') == tenant_id
-            and time.time() - float(cache.get('sent_at', 0)) < _SESSION_CONTEXT_TTL_SECONDS
+            and time.time() - float(cache.get('sent_at', 0)) < ttl_seconds
         )
     except Exception:
         # Missing/corrupt cache reads as a miss - over-sending is harmless
         return False
 
 
-def _save_report_cache(digest: str, tenant_id: Optional[str]) -> None:
+def _save_report_cache(digest: str, tenant_id: str | None) -> None:
     try:
         cache_path = _session_context_cache_path()
         cache_path.parent.mkdir(parents=True, exist_ok=True)
@@ -76,8 +90,9 @@ def _save_report_cache(digest: str, tenant_id: Optional[str]) -> None:
 
 def _report_session_context(
     ai_client: 'AISecurityManagerClient',
-    user_email: Optional[str],
-    tenant_id: Optional[str],
+    user_email: str | None,
+    tenant_id: str | None,
+    config: GuardrailConfig | None,
 ) -> None:
     """Report the device + cross-IDE session context to the AI security manager. Never raises.
 
@@ -86,7 +101,7 @@ def _report_session_context(
     until the TTL expires.
     """
     try:
-        config_files_by_ide, enabled_plugins = collect_all_session_contexts()
+        config_files, enabled_plugins = collect_all_session_contexts()
         report = {
             'hostname': get_hostname(),
             'platform_name': get_platform_name(),
@@ -94,7 +109,7 @@ def _report_session_context(
             'serial_number': get_serial_number(),
             'last_login_user': get_last_login_user(),
             # Sorted by path so the digest is stable regardless of IDE registry order.
-            'config_files': sorted(config_files_by_ide.values(), key=lambda f: f['path']),
+            'config_files': sorted(config_files, key=lambda f: f['path']),
             'enabled_plugins': enabled_plugins,
             # Already deduplicated and sorted by path, for the same digest-stability reason.
             # Editing a skill body changes the digest and so re-reports the device's inventory.
@@ -103,12 +118,19 @@ def _report_session_context(
         }
 
         digest = _session_context_digest(report)
-        if _should_skip_report(digest, tenant_id):
+        if _should_skip_report(digest, tenant_id, _report_ttl_seconds(config)):
             logger.debug('Session context unchanged; skipping report')
             return
 
-        if ai_client.report_session_context(**report):
-            _save_report_cache(digest, tenant_id)
+        response = ai_client.report_session_context(**report)
+        if response is None:
+            return
+
+        _save_report_cache(digest, tenant_id)
+        if response.mcp_servers is not None:
+            ttl_seconds = config.ttl_seconds if config is not None else DEFAULT_TTL_SECONDS
+            save_mcp_server_statuses(response.mcp_servers, tenant_id, ttl_seconds)
+            logger.debug('MCP server statuses cache updated')
     except Exception as e:
         logger.debug('Failed to report session context', exc_info=e)
 
@@ -166,14 +188,14 @@ def session_start_command(
     except Exception as e:
         logger.debug('Failed to create conversation during session start', exc_info=e)
 
-    # Report session context (device + cross-IDE MCP servers and plugins)
-    _report_session_context(ai_client, session_payload.ide_user_email, auth_info.tenant_id)
-
     # SessionStart precedes the first prompt hook in every IDE, so scans normally find a cache.
-    _sync_guardrail_config(ai_client, auth_info.tenant_id)
+    config = _sync_guardrail_config(ai_client, auth_info.tenant_id)
+
+    # Report session context (device + cross-IDE MCP servers and plugins)
+    _report_session_context(ai_client, session_payload.ide_user_email, auth_info.tenant_id, config)
 
 
-def _sync_guardrail_config(ai_client: 'AISecurityManagerClient', tenant_id: Optional[str]) -> None:
+def _sync_guardrail_config(ai_client: 'AISecurityManagerClient', tenant_id: str | None) -> GuardrailConfig | None:
     """Refresh the guardrail config cache when it is expired or belongs to another tenant.
 
     Every step here swallows its own failures - a broken cache or an unreachable platform
@@ -182,9 +204,12 @@ def _sync_guardrail_config(ai_client: 'AISecurityManagerClient', tenant_id: Opti
     cached = load_guardrail_config()
     if cached is not None and not cached.needs_refresh(tenant_id):
         logger.debug('Guardrail config cache is fresh, skipping fetch')
-        return
+        return cached
 
     resolved = ai_client.get_resolved_guardrails()
-    if resolved:
-        save_guardrail_config(resolved, tenant_id)
-        logger.debug('Guardrail config cache updated')
+    if not resolved:
+        return cached
+
+    save_guardrail_config(resolved, tenant_id)
+    logger.debug('Guardrail config cache updated')
+    return GuardrailConfig(payload=resolved, fetched_at=time.time(), tenant_id=tenant_id)

cycode/cli/apps/ai_guardrails/status_command.py

@@ -2,7 +2,7 @@
 
 import os
 from pathlib import Path
-from typing import Annotated, Optional
+from typing import Annotated
 
 import typer
 from rich.table import Table
@@ -30,7 +30,7 @@ def status_command(
         ),
     ] = DEFAULT_IDE_NAME,
     repo_path: Annotated[
-        Optional[Path],
+        Path | None,
         typer.Option(
             '--repo-path',
             help='Repository path for repo-scoped status (defaults to current directory).',

cycode/cli/apps/ai_guardrails/uninstall_command.py

@@ -1,7 +1,7 @@
 """Uninstall command for AI guardrails hooks."""
 
 from pathlib import Path
-from typing import Annotated, Optional
+from typing import Annotated
 
 import typer
 
@@ -28,7 +28,7 @@ def uninstall_command(
         ),
     ] = DEFAULT_IDE_NAME,
     repo_path: Annotated[
-        Optional[Path],
+        Path | None,
         typer.Option(
             '--repo-path',
             help='Repository path for repo-scoped uninstallation (defaults to current directory).',

cycode/cli/apps/api/__init__.py

@@ -5,7 +5,7 @@ The spec is fetched lazily — only when the user invokes `cycode platform ...`
 and cached locally for 24 hours.
 """
 
-from typing import Any, Optional
+from typing import Any
 
 import click
 
@@ -32,7 +32,7 @@ class PlatformGroup(click.Group):
         super().__init__(*args, **kwargs)
         self._loaded: bool = False
 
-    def _ensure_loaded(self, ctx: Optional[click.Context]) -> None:
+    def _ensure_loaded(self, ctx: click.Context | None) -> None:
         if self._loaded:
             return
         self._loaded = True  # set first to avoid re-entrancy on errors
@@ -59,7 +59,7 @@ class PlatformGroup(click.Group):
         self._ensure_loaded(ctx)
         return super().list_commands(ctx)
 
-    def get_command(self, ctx: click.Context, cmd_name: str) -> Optional[click.Command]:
+    def get_command(self, ctx: click.Context, cmd_name: str) -> click.Command | None:
         self._ensure_loaded(ctx)
         return super().get_command(ctx, cmd_name)
 

cycode/cli/apps/api/api_command.py

@@ -2,7 +2,7 @@
 
 import json
 import re
-from typing import Any, Optional
+from typing import Any
 
 import click
 
@@ -60,7 +60,7 @@ def _path_to_command_name(path: str, common_prefix: str, has_path_params: bool)
         /v4/violations/count  (prefix=/v4/violations) -> count
     """
     # Strip common prefix
-    relative = path[len(common_prefix) :] if path.startswith(common_prefix) else path
+    relative = path.removeprefix(common_prefix)
     relative = relative.strip('/')
 
     # Remove path parameter segments and empty parts
@@ -91,8 +91,8 @@ def _make_api_request(
     method: str,
     path_params: dict[str, str],
     query_params: dict[str, Any],
-    client_id: Optional[str] = None,
-    client_secret: Optional[str] = None,
+    client_id: str | None = None,
+    client_secret: str | None = None,
 ) -> dict:
     """Execute an API request using the CLI's standard auth client."""
     from urllib.parse import quote
@@ -115,8 +115,8 @@ def _make_api_request(
 
 
 def build_api_command_groups(
-    client_id: Optional[str] = None,
-    client_secret: Optional[str] = None,
+    client_id: str | None = None,
+    client_secret: str | None = None,
 ) -> list[tuple[click.Group, str]]:
     """Build Click command groups from the OpenAPI spec.