CM-73403: Report the device a hook ran on with each AI hook event

The platform opens the unauthorized MCP server violation on this device
instead of guessing among the user's devices.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: Altruistus

cycode/cyclient/ai_security_manager_client.py

@@ -3,6 +3,7 @@
 from typing import TYPE_CHECKING, Optional
 
 from cycode.cli.exceptions.custom_exceptions import HttpUnauthorizedError
+from cycode.cli.utils.host_info import get_serial_number
 from cycode.cyclient.cycode_client_base import CycodeClientBase
 from cycode.cyclient.logger import logger
 
@@ -87,6 +88,9 @@ def create_event(
             'mcp_tool_name': payload.mcp_tool_name,
             'error_message': error_message,
             'file_path': file_path,
+            # The device the hook ran on, so a guardrail violation lands on it rather than on any of
+            # the user's devices. None where no serial can be resolved (e.g. Linux).
+            'device_id': get_serial_number(),
         }
 
         try:

tests/cyclient/test_ai_security_manager_client.py

@@ -1,5 +1,8 @@
 from unittest.mock import MagicMock
 
+import pytest
+from pytest_mock import MockerFixture
+
 from cycode.cli.apps.ai_guardrails.scan.payload import AIHookPayload
 from cycode.cli.apps.ai_guardrails.scan.types import AiHookEventType, AIHookOutcome
 from cycode.cyclient.ai_security_manager_client import AISecurityManagerClient
@@ -13,6 +16,12 @@ def _build_client() -> tuple[AISecurityManagerClient, MagicMock]:
     return AISecurityManagerClient(http_client, service_config), http_client
 
 
+@pytest.fixture(autouse=True)
+def serial_number(mocker: MockerFixture) -> MagicMock:
+    """Resolving the real serial shells out and caches under the home directory."""
+    return mocker.patch('cycode.cyclient.ai_security_manager_client.get_serial_number', return_value='SERIAL-1')
+
+
 def _posted_body(http_client: MagicMock) -> dict:
     return http_client.post.call_args.kwargs['body']
 
@@ -27,6 +36,26 @@ def test_create_event_reports_the_payload_hook_event_id_as_the_event_id() -> Non
     assert _posted_body(http_client)['id'] == payload.hook_event_id
 
 
+def test_create_event_reports_the_device_it_ran_on() -> None:
+    """The guardrail violation is attributed to this device, not to any of the user's devices."""
+    client, http_client = _build_client()
+    payload = AIHookPayload(event_name='Prompt', conversation_id='conv-1', generation_id='gen-1')
+
+    client.create_event(payload, AiHookEventType.PROMPT, AIHookOutcome.ALLOWED)
+
+    assert _posted_body(http_client)['device_id'] == 'SERIAL-1'
+
+
+def test_create_event_without_a_resolvable_serial_reports_none(serial_number: MagicMock) -> None:
+    serial_number.return_value = None
+    client, http_client = _build_client()
+    payload = AIHookPayload(event_name='Prompt', conversation_id='conv-1', generation_id='gen-1')
+
+    client.create_event(payload, AiHookEventType.PROMPT, AIHookOutcome.ALLOWED)
+
+    assert _posted_body(http_client)['device_id'] is None
+
+
 def test_create_event_reports_a_distinct_id_per_hook_event() -> None:
     client, http_client = _build_client()
     conversation_id = 'conv-1'