AST-164154: Fix KICS agent-hook guardrail never scanning (empty container engine) - #1528
Closed
cx-avi-sabzerou wants to merge 4 commits into
Closed
AST-164154: Fix KICS agent-hook guardrail never scanning (empty container engine)#1528cx-avi-sabzerou wants to merge 4 commits into
cx-avi-sabzerou wants to merge 4 commits into
Conversation
…iner engine) The KICS file-edit guardrail passed an empty container engine name to RunIacRealtimeScan instead of "docker", causing engine resolution to always fail and the scan to silently fail open on every file edit. Now resolves the engine via CX_HOOKS_CONTAINER_ENGINE override, then PATH auto-detection (docker/podman), falling back to "docker". Also logs the swallowed scan errors via --debug so a future regression here is diagnosable instead of silently invisible. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
cx-avi-sabzerou
requested review from
cx-anurag-dalke and
cx-umesh-waghode
as code owners
July 23, 2026 13:18
Contributor
Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-avi-sabzerou) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
Contributor
Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-avi-sabzerou) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
Dockerfile and docker-compose findings were sent through codeRemediation like any other IaC misconfiguration, but they need imageRemediation for base-image CVEs/hardening. Route by KICS's own platform field on the finding (Dockerfile/DockerCompose), falling back to filename heuristics only when platform metadata is unavailable. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Contributor
|
I have raised new pr to merge this branch into other/release_2_3_59 version , hence closing it. |
cx-lior-poterman
pushed a commit
that referenced
this pull request
Aug 5, 2026
…iner engine)- #1528 #1528 (#1531) * AST-164154: Fix KICS agent-hook guardrail never scanning (empty container engine) The KICS file-edit guardrail passed an empty container engine name to RunIacRealtimeScan instead of "docker", causing engine resolution to always fail and the scan to silently fail open on every file edit. Now resolves the engine via CX_HOOKS_CONTAINER_ENGINE override, then PATH auto-detection (docker/podman), falling back to "docker". Also logs the swallowed scan errors via --debug so a future regression here is diagnosable instead of silently invisible. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Fix KICS guardrail to route Docker image findings to imageRemediation Dockerfile and docker-compose findings were sent through codeRemediation like any other IaC misconfiguration, but they need imageRemediation for base-image CVEs/hardening. Route by KICS's own platform field on the finding (Dockerfile/DockerCompose), falling back to filename heuristics only when platform metadata is unavailable. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix lint issue. --------- Co-authored-by: avisab-cx <53776974+cx-avi-sabzerou@users.noreply.github.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
cx-atish-jadhav
added a commit
that referenced
this pull request
Aug 6, 2026
commit cf88a5f Author: Anurag Dalke <anurag.dalke@checkmarx.com> Date: Wed Aug 5 18:49:02 2026 +0530 AST-164154: Fix KICS agent-hook guardrail never scanning (empty container engine)- #1528 #1528 (#1531) * AST-164154: Fix KICS agent-hook guardrail never scanning (empty container engine) The KICS file-edit guardrail passed an empty container engine name to RunIacRealtimeScan instead of "docker", causing engine resolution to always fail and the scan to silently fail open on every file edit. Now resolves the engine via CX_HOOKS_CONTAINER_ENGINE override, then PATH auto-detection (docker/podman), falling back to "docker". Also logs the swallowed scan errors via --debug so a future regression here is diagnosable instead of silently invisible. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Fix KICS guardrail to route Docker image findings to imageRemediation Dockerfile and docker-compose findings were sent through codeRemediation like any other IaC misconfiguration, but they need imageRemediation for base-image CVEs/hardening. Route by KICS's own platform field on the finding (Dockerfile/DockerCompose), falling back to filename heuristics only when platform metadata is unavailable. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix lint issue. --------- Co-authored-by: avisab-cx <53776974+cx-avi-sabzerou@users.noreply.github.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
cx-atish-jadhav
added a commit
that referenced
this pull request
Aug 6, 2026
) * Add --skip-default-filter flag to scan Introduce a new --skip-default-filter flag to bypass the CLI's base include/exclude file filters. Changes: - Add flag constant and usage (internal/params/flags.go). - Wire the flag into scan create command and log when set (internal/commands/scan.go). - Extend compressFolder and related helpers to accept skipDefaultFilter and honor it when building include/exclude filters; callers updated accordingly. Also adjust unzip condition to preserve container-local-resolution behavior when skipping defaults. - Add unit tests covering filter behavior and zip compression permutations (internal/commands/scan_test.go). - Add integration tests to verify the flag path and log output (test/integration/scan_test.go). This preserves existing behavior by default and enables users to include files normally excluded by base filters (e.g., node_modules, binaries) when explicitly requested. * Add timeout wrapper for SCA realtime integration test Introduce executeCommandWithTimeout in test/integration/util_command.go and update TestRunScaRealtimeScan in test/integration/scan_test.go to use it with a 15-minute timeout. This avoids flaky failures/timeouts during SCA resolver downloads by allowing longer execution time while preserving the existing error+output buffer behavior. * Revert "Add timeout wrapper for SCA realtime integration test" This reverts commit da1f4cd. * Run SCA Realtime tests in isolated CI job Move the SCA Realtime integration test out of the parallel test groups into a dedicated integration-sca-realtime job. The new job builds the binary, launches a Squid proxy, downloads ScaResolver, runs TestRunScaRealtimeScan with up to two retries, merges coverage with gocovmerge, and uploads coverage/log artifacts. Removed TestScaRealtime from the group run patterns and added the new job as a dependency of merge-coverage so its coverage is included in the final merge. This reduces resource contention and timeouts for the realtime SCA test. * Skip SCA realtime test and remove isolated CI job Address flaky SCA realtime failures by skipping the integration test and cleaning up CI. Add t.Skip to TestRunScaRealtimeScan to avoid "context deadline exceeded" failures. Remove the dedicated integration-sca-realtime job from .github/workflows/ci-tests.yml, reintroduce TestScaRealtime into the scan group run patterns, and update merge-coverage dependencies accordingly. Files changed: .github/workflows/ci-tests.yml, test/integration/scan_test.go. * fixing validate in integration check * Remove unnecessary check * Skip flaky sca-realtime integration test Mark TestRunScaRealtimeScan as skipped in integration tests due to repeated "context deadline exceeded" failures. Adds a t.Skip call in test/integration/scan_test.go to avoid unstable test runs while root cause is investigated. * Fix t.Skip call in TestRunScaRealtimeScan Correct a malformed t.Skip invocation in test/integration/scan_test.go. Replaced the invalid `t.Skip( args ...; "..." )` syntax with a proper `t.Skip("Skip this test cases due to context deadline exceeded")` and kept the args assignment after the skip. Prevents a syntax error during build/tests. * Add .trivyignore entry for CVE-2026-58055 Add Trivy ignore entry for CVE-2026-58055 (libnghttp2) with context notes: affects libnghttp2-14 v1.69.0-r0 in base image checkmarx/bash:5.3-r12, fixed in libnghttp2-14 >= 1.70.0-r0. Notes include risk (MEDIUM), impact (awaiting base image patch), tracking ticket AST-166372, and expiry date exp:2027-02-28. * AST-164154: Fix KICS agent-hook guardrail never scanning (empty container engine)- #1528 #1528 (#1531) * AST-164154: Fix KICS agent-hook guardrail never scanning (empty container engine) The KICS file-edit guardrail passed an empty container engine name to RunIacRealtimeScan instead of "docker", causing engine resolution to always fail and the scan to silently fail open on every file edit. Now resolves the engine via CX_HOOKS_CONTAINER_ENGINE override, then PATH auto-detection (docker/podman), falling back to "docker". Also logs the swallowed scan errors via --debug so a future regression here is diagnosable instead of silently invisible. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Fix KICS guardrail to route Docker image findings to imageRemediation Dockerfile and docker-compose findings were sent through codeRemediation like any other IaC misconfiguration, but they need imageRemediation for base-image CVEs/hardening. Route by KICS's own platform field on the finding (Dockerfile/DockerCompose), falling back to filename heuristics only when platform metadata is unavailable. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix lint issue. --------- Co-authored-by: avisab-cx <53776974+cx-avi-sabzerou@users.noreply.github.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> * Add --skip-default-filter flag to scan Introduce a new --skip-default-filter flag to bypass the CLI's base include/exclude file filters. Changes: - Add flag constant and usage (internal/params/flags.go). - Wire the flag into scan create command and log when set (internal/commands/scan.go). - Extend compressFolder and related helpers to accept skipDefaultFilter and honor it when building include/exclude filters; callers updated accordingly. Also adjust unzip condition to preserve container-local-resolution behavior when skipping defaults. - Add unit tests covering filter behavior and zip compression permutations (internal/commands/scan_test.go). - Add integration tests to verify the flag path and log output (test/integration/scan_test.go). This preserves existing behavior by default and enables users to include files normally excluded by base filters (e.g., node_modules, binaries) when explicitly requested. * Add timeout wrapper for SCA realtime integration test Introduce executeCommandWithTimeout in test/integration/util_command.go and update TestRunScaRealtimeScan in test/integration/scan_test.go to use it with a 15-minute timeout. This avoids flaky failures/timeouts during SCA resolver downloads by allowing longer execution time while preserving the existing error+output buffer behavior. * Revert "Add timeout wrapper for SCA realtime integration test" This reverts commit da1f4cd. * Run SCA Realtime tests in isolated CI job Move the SCA Realtime integration test out of the parallel test groups into a dedicated integration-sca-realtime job. The new job builds the binary, launches a Squid proxy, downloads ScaResolver, runs TestRunScaRealtimeScan with up to two retries, merges coverage with gocovmerge, and uploads coverage/log artifacts. Removed TestScaRealtime from the group run patterns and added the new job as a dependency of merge-coverage so its coverage is included in the final merge. This reduces resource contention and timeouts for the realtime SCA test. * Skip SCA realtime test and remove isolated CI job Address flaky SCA realtime failures by skipping the integration test and cleaning up CI. Add t.Skip to TestRunScaRealtimeScan to avoid "context deadline exceeded" failures. Remove the dedicated integration-sca-realtime job from .github/workflows/ci-tests.yml, reintroduce TestScaRealtime into the scan group run patterns, and update merge-coverage dependencies accordingly. Files changed: .github/workflows/ci-tests.yml, test/integration/scan_test.go. * fixing validate in integration check * Remove unnecessary check * Skip flaky sca-realtime integration test Mark TestRunScaRealtimeScan as skipped in integration tests due to repeated "context deadline exceeded" failures. Adds a t.Skip call in test/integration/scan_test.go to avoid unstable test runs while root cause is investigated. * Fix t.Skip call in TestRunScaRealtimeScan Correct a malformed t.Skip invocation in test/integration/scan_test.go. Replaced the invalid `t.Skip( args ...; "..." )` syntax with a proper `t.Skip("Skip this test cases due to context deadline exceeded")` and kept the args assignment after the skip. Prevents a syntax error during build/tests. * Add .trivyignore entry for CVE-2026-58055 Add Trivy ignore entry for CVE-2026-58055 (libnghttp2) with context notes: affects libnghttp2-14 v1.69.0-r0 in base image checkmarx/bash:5.3-r12, fixed in libnghttp2-14 >= 1.70.0-r0. Notes include risk (MEDIUM), impact (awaiting base image patch), tracking ticket AST-166372, and expiry date exp:2027-02-28. * trivy fixes --------- Co-authored-by: Anurag Dalke <anurag.dalke@checkmarx.com> Co-authored-by: avisab-cx <53776974+cx-avi-sabzerou@users.noreply.github.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
cx-atish-jadhav
added a commit
that referenced
this pull request
Aug 6, 2026
* AST-164236: Simplify cx auth login to single yaml credential slot Remove the multi-mode session subsystem added in d3b436c (AST-160121) and return credential storage to the pre-2.3.54 single cx_apikey slot. Drop --session local/global/yaml; login/logout use cx_apikey only Remove session_global, active_mode, shell_output, LoadActiveCredential startup hook (cmd/main.go + MCP bridge) Remove login-time revoke/nuke phase and logout server-side revoke Replace OIDC .well-known discovery with realm-derived endpoints Add configuration.PromptAuthConnection() interactive fallback Update MCP degraded notice to drop --session references * AST-160986 - Bug fix sast sarif file * Fix vorpal issue for windows machine AST-164137 * AST-164236 store cx_apikey and cx_client_secret in go keyring with yaml fallback Persist the CLI's long-lived secrets (cx_apikey refresh token, cx_client_secret) in the OS secret store — macOS Keychain, Windows Credential Manager, Linux Secret Service — via github.com/zalando/go-keyring, instead of plaintext in ~/.checkmarx/checkmarxcli.yaml. Falls back transparently to the yaml file when no keyring is available (headless Linux without D-Bus, WSL, locked keychain). New internal/wrappers/credentialstore package: a CredentialStore interface (Get/Set/DeleteSecret by viper key) with three implementations — keyringStore (go-keyring, service "checkmarx-cli"), fileStore (yaml config), and chainStore (keyring-first, yaml-fallback). A successful keyring write scrubs any plaintext copy left in the yaml file. Default is file-backed until main() installs the chain via Install(), which also wires configuration.Secrets so cx configure routes through the same store. The read path stays viper-based: LoadStoredSecrets copies stored secrets into viper at startup so every wrapper resolves the credential unchanged, skipping any key whose CX_* env var is set (env keeps precedence). configuration.go grows a SecretStore hook plus setSecretQuiet/clearSecretQuiet so PromptConfiguration writes secrets to the store and blanks their yaml keys. Command wiring: - auth login now stores the refresh token via credentialstore.Default (persistLogin replacing persistYamlLogin); chmod 0600 still applied in case it fell back to yaml. - auth logout clears cx_apikey and cx_client_secret from both backends and blanks the non-secret cx_client_id best-effort; env credentials untouched. - utils config set routes cx_apikey / cx_client_secret through SetSecretProperty. - CheckPreferredCredentials re-asserts explicit --apikey / --client-secret flags over the viper-loaded stored value so a flag still wins. - MCP bridge re-runs LoadStoredSecrets on config reload to pick up a rotated keyring token, keeping its 3s poll cheap. Adds go-keyring to the depguard allowlist. No secret value is logged. * Add agent-specific reconnect phrases and session telemetry for SCA hooks & Fix Copilot CLI ASCA guardrail Fix Copilot CLI ASCA guardrail: CRLF/LF mismatch and non-ASCII silent failure Added normLF() in content.go to normalise CRLF/CR disk files against LF-only old_str/new_str sent by Copilot CLI on Windows, gated on AgentCopilotCLI Added asciiSafe() in stage.go to replace non-ASCII runes (e.g. EM dash in Copilot-generated comments) with spaces before ASCA scan, gated on AgentCopilotCLI Passed ev.Agent through ProposedContent() and stageForScan() to enable both fixes Removed touchSessionFindingsMarker() and its marker file infrastructure to avoid creating unnecessary files in ~/.checkmarx/ Restored TestAdditionalContext_EmitsProvenanceOptionalFlags and TestAdditionalContext_FileNameWithPercent_NotMisformatted tests Introduced McpReconnect function to provide tailored reconnect instructions for various agents. Updated SCA and ASCA hooks to utilize agent-specific reconnect phrases instead of generic instructions. Enhanced DenyMalicious and DenyVulnerable functions to include session ID and agent context in remediation messages. Refactored CheckBashInstall and CheckManifestEdit methods to pass agent and session ID parameters for improved telemetry tracking. Added unit tests to validate the new functionality and ensure proper behavior across different agents. * updated ast-cx-hooks version * Add Apache Ant-style file filtering with glob patterns Introduce comprehensive file and directory filtering for scan uploads using Apache Ant-style glob patterns. Changes: - Add new internal/filtering package with Matcher interface and AntMatcher implementation - Support ordered include/exclude rules with last-match-wins semantics - Add --file-filter-ext CLI flag for specifying filter patterns - Integrate ant-style filtering into scan compression workflow - Support pattern features: *, **, ?, [abc], {a,b} with implicit depth anchoring - Directory pruning optimization when no descendant can be re-included - Comprehensive test coverage for matcher logic and edge cases The matcher intelligently handles sub-tree pruning and respects negation rules to avoid incorrectly excluding files that may be explicitly included by later rules. * fix issue -no-scan flag is passed - creates empty project * skipped teams notification from workflow * skipping test cases which require secrets * trivy fixes * zizmor and lint fixes * pushed missing file for lint fixes * fix release.yml * updating the available mac runner * Add Swift/CocoaPods/Carthage support Enable OSS Realtime scanner to handle Swift ecosystem manifests and map CocoaPods/Carthage packages to the Swift package manager. Changes in internal/services/realtimeengine/ossrealtime/oss-realtime.go: add new pkg manager constants (cocoapods, carthage, swift); expand supported extensions and filenames (Podfile, Podfile.lock, Cartfile, Cartfile.resolved, Package.swift, .podspec.json handling, etc.); map cocoapods/carthage packages to swift in package map and request conversion. Update go.mod/go.sum to use a local manifest-parser replacement for development: comment out the previous remote requirement, add a placeholder require entry and a replace pointing to C:/Users/AtishJ/GitHub_Repo/manifest-parser. go.sum updated accordingly. * Gate macOS release steps with dev input Add conditional checks (if: inputs.dev == false) to macOS-specific release steps: Import Code-Signing Certificates, Updating/upgrading brew, and Install gon. This ensures those steps are skipped when the workflow is run in dev mode (inputs.dev=true), avoiding unnecessary or platform-specific operations during dev releases. * Remove credentialstore/keyring; persist creds to YAML Remove the credentialstore abstraction and OS keyring dependency, routing credential storage to the YAML config instead. Update auth login/logout to write/clear cx_apikey in the config (persistYamlLogin, runAuthLogout) and restrict config file permissions. Remove keyring-related code, mocks and tests, and related startup wiring (Install/LoadStoredSecrets). Clean up imports and go.mod/.golangci.yml entries. Rationale: simplify credential handling by eliminating platform keyring complexity and keep credentials in the CLI config file (with best-effort file perms). * lint issue fix * Squashed commit of the following: commit bfdca5a Author: atishj99 <atish.jadhav@checkmarx.com> Date: Tue Jul 28 16:40:43 2026 +0530 lint issue fix commit 04b26b0 Author: atishj99 <atish.jadhav@checkmarx.com> Date: Tue Jul 28 16:17:42 2026 +0530 Remove credentialstore/keyring; persist creds to YAML Remove the credentialstore abstraction and OS keyring dependency, routing credential storage to the YAML config instead. Update auth login/logout to write/clear cx_apikey in the config (persistYamlLogin, runAuthLogout) and restrict config file permissions. Remove keyring-related code, mocks and tests, and related startup wiring (Install/LoadStoredSecrets). Clean up imports and go.mod/.golangci.yml entries. Rationale: simplify credential handling by eliminating platform keyring complexity and keep credentials in the CLI config file (with best-effort file perms). commit c4a7722 Author: atishj99 <atish.jadhav@checkmarx.com> Date: Tue Jul 28 14:50:39 2026 +0530 Gate macOS release steps with dev input Add conditional checks (if: inputs.dev == false) to macOS-specific release steps: Import Code-Signing Certificates, Updating/upgrading brew, and Install gon. This ensures those steps are skipped when the workflow is run in dev mode (inputs.dev=true), avoiding unnecessary or platform-specific operations during dev releases. * Add Swift/CocoaPods/Carthage support Enable OSS Realtime scanner to handle Swift ecosystem manifests and map CocoaPods/Carthage packages to the Swift package manager. Changes in internal/services/realtimeengine/ossrealtime/oss-realtime.go: add new pkg manager constants (cocoapods, carthage, swift); expand supported extensions and filenames (Podfile, Podfile.lock, Cartfile, Cartfile.resolved, Package.swift, .podspec.json handling, etc.); map cocoapods/carthage packages to swift in package map and request conversion. Update go.mod/go.sum to use a local manifest-parser replacement for development: comment out the previous remote requirement, add a placeholder require entry and a replace pointing to C:/Users/AtishJ/GitHub_Repo/manifest-parser. go.sum updated accordingly. * Bump manifest-parser; extend OSS manifest support Update go.mod to use github.com/Checkmarx/manifest-parser v0.1.3-prerelease (remove local replace) and add corresponding go.sum entries. Update OSS realtime manifest validation: simplify supported extensions, add Cartfile.private and Package.resolved filename support, and add special-case handling for .podspec.json and Package@swift-*.swift variants. These changes enable the prerelease manifest-parser and broaden supported manifest filename/variant coverage for OSS realtime scanning. * Update manifest-parser and supported files Upgrade github.com/Checkmarx/manifest-parser to v0.1.3-prerelease2 (go.mod/go.sum). Remove several lock/resolved files from the OSS realtime manifest whitelist (Podfile.lock, Cartfile.resolved, pubspec.lock, Package.resolved) so they are no longer treated as supported manifest inputs. * Bump manifest-parser to v0.1.3-prerelease3 Upgrade github.com/Checkmarx/manifest-parser from v0.1.3-prerelease2 to v0.1.3-prerelease3 and update go.sum with the new module checksums. * delete zizmor scan * revert release.yml changes * Squashed commit of the following: commit cf88a5f Author: Anurag Dalke <anurag.dalke@checkmarx.com> Date: Wed Aug 5 18:49:02 2026 +0530 AST-164154: Fix KICS agent-hook guardrail never scanning (empty container engine)- #1528 #1528 (#1531) * AST-164154: Fix KICS agent-hook guardrail never scanning (empty container engine) The KICS file-edit guardrail passed an empty container engine name to RunIacRealtimeScan instead of "docker", causing engine resolution to always fail and the scan to silently fail open on every file edit. Now resolves the engine via CX_HOOKS_CONTAINER_ENGINE override, then PATH auto-detection (docker/podman), falling back to "docker". Also logs the swallowed scan errors via --debug so a future regression here is diagnosable instead of silently invisible. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Fix KICS guardrail to route Docker image findings to imageRemediation Dockerfile and docker-compose findings were sent through codeRemediation like any other IaC misconfiguration, but they need imageRemediation for base-image CVEs/hardening. Route by KICS's own platform field on the finding (Dockerfile/DockerCompose), falling back to filename heuristics only when platform metadata is unavailable. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix lint issue. --------- Co-authored-by: avisab-cx <53776974+cx-avi-sabzerou@users.noreply.github.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> * realtime: remove CocoaPods/Swift; bump deps Remove support for CocoaPods/Carthage/Swift package managers and related manifest handlers from the OSS realtime scanner (drops Podfile/Cartfile/Gemfile/composer.json/pubspec/Package.swift and special .podspec.json / Package@swift-* handling). Add yarn.lock to supported manifest list and tidy extension/filename checks. Also update module dependencies: bump github.com/Checkmarx/manifest-parser to v0.1.4, golang.org/x/sync to v0.22.0 and oras.land/oras-go/v2 to v2.6.2 (go.sum updated). This aligns runtime behavior with upstream parser changes and dependency updates. --------- Co-authored-by: Anurag Dalke <anurag.dalke@checkmarx.com> Co-authored-by: Anurag Dalke <120229307+cx-anurag-dalke@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The KICS agent-hook guardrail (used by AI-agent plugins like Claude Code via
cx hooks claude-pre-file-write) was passing an empty container engine name ("") toRunIacRealtimeScaninstead of a real engine like"docker". This caused container-engine resolution to fail on every invocation, and becauseScanFileEditfails open on scan errors, the guardrail silently allowed every IaC file edit without ever actually running KICS — with no visible error or log output under normal operation.Verified live: with the bug, writing a Terraform file with an obviously public S3 bucket ACL was silently allowed. After the fix, the same write is correctly denied with full KICS findings and remediation guidance.
Changes
internal/commands/agenthooks/guardrails/kics/scanner.go: Resolve the container engine via, in order:CX_HOOKS_CONTAINER_ENGINEenv var override → PATH auto-detection (dockerthenpodman) →"docker"fallback default (matching the existing--engineflag default oncx scan iac-realtime). This also gives Podman-only users a working path, since the guardrail has no CLI flag surface to read--enginefrom (it's invoked ascx hooks <route>with only stdin JSON).internal/commands/agenthooks/guardrails/kics/kics.go: Added--debug-gated logging (logger.PrintfIfVerbose) at the previously-silent fail-open branches (bothsvc.scanerror paths, and the panic-recovery deferred func), so a future regression in this path is diagnosable instead of invisible.internal/params/envs.go: AddedHooksContainerEngineEnv = "CX_HOOKS_CONTAINER_ENGINE"constant.internal/commands/agenthooks/guardrails/kics/scanner_test.go: New unit tests for the engine-resolution priority order (env override wins, auto-detects from PATH, falls back to default when nothing resolves).Type of Change
Related Issues
AST-164154: https://checkmarx.atlassian.net/browse/AST-164154
Testing
main).scanner_test.gocovers the resolution priority order in isolation.CX_BINARYoverride) and a real Claude Code session: KICS guardrail now correctly detects and blocks an IaC misconfiguration that was previously silently allowed.Checklist