|
1 | 1 | """ |
2 | 2 | Utility functions for AI guardrails. |
3 | 3 |
|
4 | | -Includes JSON parsing, path matching, and text handling utilities. |
| 4 | +Includes JSON parsing, path matching, text handling and hook-message utilities. |
5 | 5 | """ |
6 | 6 |
|
7 | 7 | import json |
8 | 8 | import os |
9 | 9 | import sys |
| 10 | +from collections import defaultdict |
10 | 11 | from pathlib import Path |
| 12 | +from typing import TYPE_CHECKING |
11 | 13 |
|
12 | 14 | from cycode.cli.apps.ai_guardrails.scan.policy import get_policy_value |
| 15 | +from cycode.cli.cli_types import SeverityOption |
| 16 | + |
| 17 | +if TYPE_CHECKING: |
| 18 | + from cycode.cli.models import LocalScanResult |
| 19 | + |
| 20 | +# Keeps the hook message readable when a single file trips dozens of detections |
| 21 | +MAX_VIOLATION_DETAIL_LINES = 5 |
13 | 22 |
|
14 | 23 |
|
15 | 24 | def read_stdin_text() -> str: |
@@ -87,3 +96,52 @@ def is_denied_path(file_path: str, policy: dict) -> bool: |
87 | 96 | def output_json(obj: dict) -> None: |
88 | 97 | """Write JSON response to stdout (for IDE to read).""" |
89 | 98 | print(json.dumps(obj), end='') # noqa: T201 |
| 99 | + |
| 100 | + |
| 101 | +def _build_detection_lines( |
| 102 | + local_scan_results: list['LocalScanResult'], max_lines: int = MAX_VIOLATION_DETAIL_LINES |
| 103 | +) -> str: |
| 104 | + """One line per distinct finding: what it is, and the value hash identifying it. |
| 105 | +
|
| 106 | + The value hash is safe to display; the value itself is not. Detections excluded by an existing |
| 107 | + ignore rule are already gone from `document_detections`, so only what actually blocked is listed. |
| 108 | + """ |
| 109 | + type_by_sha = {} |
| 110 | + for local_scan_result in local_scan_results: |
| 111 | + for document_detections in local_scan_result.document_detections: |
| 112 | + for detection in document_detections.detections: |
| 113 | + sha = detection.detection_details.get('sha512') |
| 114 | + if sha and sha not in type_by_sha: |
| 115 | + type_by_sha[sha] = detection.type or detection.message |
| 116 | + |
| 117 | + if not type_by_sha: |
| 118 | + return '' |
| 119 | + |
| 120 | + lines = [f' - {detection_type}: {sha}' for sha, detection_type in list(type_by_sha.items())[:max_lines]] |
| 121 | + remaining = len(type_by_sha) - len(lines) |
| 122 | + if remaining: |
| 123 | + lines.append(f' - ...and {remaining} more') |
| 124 | + |
| 125 | + return '\n' + '\n'.join(lines) |
| 126 | + |
| 127 | + |
| 128 | +def build_violation_summary(local_scan_results: list['LocalScanResult']) -> str: |
| 129 | + """Build violation summary string with severity breakdown and emojis.""" |
| 130 | + detections_count = 0 |
| 131 | + severity_counts = defaultdict(int) |
| 132 | + |
| 133 | + for local_scan_result in local_scan_results: |
| 134 | + for document_detections in local_scan_result.document_detections: |
| 135 | + for detection in document_detections.detections: |
| 136 | + if detection.severity: |
| 137 | + detections_count += 1 |
| 138 | + severity_counts[SeverityOption(detection.severity)] += 1 |
| 139 | + |
| 140 | + severity_parts = [] |
| 141 | + for severity in reversed(SeverityOption): |
| 142 | + emoji = SeverityOption.get_member_unicode_emoji(severity) |
| 143 | + count = severity_counts[severity] |
| 144 | + severity_parts.append(f'{emoji} {severity.upper()} - {count}') |
| 145 | + |
| 146 | + summary = f'Cycode found {detections_count} violations: {" | ".join(severity_parts)}' |
| 147 | + return summary + _build_detection_lines(local_scan_results) |
0 commit comments