AST-180812 - Honour the VS Code Checkmarx Self-Healing setting in Copilot agent hooks by cx-rahul-pidde · Pull Request #1601 · Checkmarx/ast-cli

cx-rahul-pidde · 2026-10-26T08:52:10Z

Summary

Epic: AST-180812 · Design: TDD · Host detection based on the AST-186850 PoC (feature/AST-186850-vsCodeInstallItself)

GitHub Copilot in VS Code runs the cx-devassist Copilot plugin's hooks (cx hooks copilot-cli-*). The Checkmarx VS Code extension writes its Checkmarx Self-Healing setting and scanner switches to ~/.checkmarx/cx-onboarding-ide.properties. This PR lets the agent hooks honour that file for Copilot inside VS Code only.

Changes (`internal/commands/agenthooks`)

cx/hooks.go
- pluginHost(): host from the PLUGIN_ROOT the host injects — /.copilot/installed-plugins/ → terminal (checked first), /agentplugins/ → VS Code (Windows/macOS/Linux, Insiders); fallback GITHUB_COPILOT_INTEGRATION_ID=vscode-chat.
- selfHealingOff() in cxBeforeFileEdit only: Copilot in VS Code + cx_self_healing_enabled=false → ASCA / KICS / SCA-manifest / Secrets skipped, no telemetry, verbose log skip_reason=self_healing_disabled. Shell-command policy (blacklist / ask-user), the SCA package-install scan and prompt guardrails are unchanged.
- scannerOn(): Copilot in VS Code takes scanner switches from the IDE file while it is valid, else from cx-onboarding.properties.
scannerconfig/scannerconfig.go: IDE file reader (IDEPath, SelfHealingEnabled, IDEEnabled). Missing, unreadable, > 8 KB or unknown cx_schema_version → on / fallback.

The terminal Copilot CLI and all other agents never read the IDE file. No go.mod / ast-cx-hooks change.

This is a backup for hooks that call cx directly (e.g. cx hooks install copilot); the plugin already stops before running cx when Self-Healing is off.

Companion PRs: cx-agentic-ai (Copilot plugin) and ast-vscode-extension.

Test plan

go vet ./internal/commands/agenthooks/...
go test ./internal/commands/agenthooks/... — all packages pass
New cx/vscode_self_healing_test.go: pluginHost table (incl. terminal-first order), OFF skips file-write scans, ON / missing / invalid file scans, terminal and other agents ignore the file, IDE scanner flags with fallback; existing blacklist / ask-user / SCA-install tests unchanged
scannerconfig tests for the IDE file rules
End-to-end with the Copilot plugin in VS Code

🤖 Generated with Claude Code

…ilot agent hooks GitHub Copilot in VS Code runs the cx-devassist Copilot plugin's hooks, which call `cx hooks copilot-cli-*`. The Checkmarx VS Code extension writes its "Checkmarx Self-Healing" setting and scanner switches to ~/.checkmarx/cx-onboarding-ide.properties. - pluginHost(): where a Copilot hook runs, from the PLUGIN_ROOT the host injects (AST-186850 PoC): ~/.copilot/installed-plugins → terminal (checked first), <VS Code user data>/agentPlugins → VS Code (all OSes, Insiders); fallback GITHUB_COPILOT_INTEGRATION_ID=vscode-chat. - selfHealingOff(): for Copilot in VS Code with a valid IDE file saying cx_self_healing_enabled=false, the file-write handler skips ASCA / KICS / SCA-manifest / Secrets without telemetry. Shell-command policy, the SCA package-install scan and prompt guardrails are unchanged. Backup for hooks that call cx directly; the plugin already stops before running cx. - scannerOn(): Copilot in VS Code takes scanner switches from the IDE file while it is valid, else from cx-onboarding.properties. - scannerconfig: IDE file reader (IDEPath, SelfHealingEnabled, IDEEnabled); missing, unreadable, > 8 KB or unknown cx_schema_version means on. The terminal Copilot CLI never reads the IDE file. No ast-cx-hooks change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Rahul Pidde <206018639+cx-rahul-pidde@users.noreply.github.com>

github-actions · 2026-10-26T08:52:37Z

⚠️ Potential secret(s) detected (unverified)

@cx-rahul-pidde — TruffleHog found 12 potential secret(s) in this PR (0 verified, 12 unverified).

Secret Type	Status	Commit	File Path	View
URI	⚠️ unverified	`6fb5248d7e`	`internal/commands/gitmetadata_test.go`	🔎 View secret
URI	⚠️ unverified	`6fb5248d7e`	`internal/commands/gitmetadata_test.go`	🔎 View secret
URI	⚠️ unverified	`6fb5248d7e`	`internal/commands/gitmetadata_test.go`	🔎 View secret
URI	⚠️ unverified	`6fb5248d7e`	`internal/commands/gitmetadata_test.go`	🔎 View secret
URI	⚠️ unverified	`6fb5248d7e`	`internal/commands/gitmetadata_test.go`	🔎 View secret
URI	⚠️ unverified	`6fb5248d7e`	`internal/commands/gitmetadata_test.go`	🔎 View secret
URI	⚠️ unverified	`0996fc220b`	`internal/commands/gitmetadata_test.go`	🔎 View secret
URI	⚠️ unverified	`0996fc220b`	`internal/commands/gitmetadata_test.go`	🔎 View secret
URI	⚠️ unverified	`0996fc220b`	`internal/commands/gitmetadata_test.go`	🔎 View secret
URI	⚠️ unverified	`0996fc220b`	`internal/commands/gitmetadata_test.go`	🔎 View secret
URI	⚠️ unverified	`0996fc220b`	`internal/commands/gitmetadata_test.go`	🔎 View secret
URI	⚠️ unverified	`0996fc220b`	`internal/commands/gitmetadata_test.go`	🔎 View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Immediately rotate/revoke the exposed secret. (https://howtorotate.com/docs/introduction/getting-started/)
Remove it from git history ( a new "remove secret" commit is NOT enough e.g. with git-filter-repo).

To avoid such incidents in the future consider:

Following the best practices for managing and storing secrets, including API keys and other credentials.
Re-scan after cleanup before merging.

⚠️ These are unverified matches and do not block the merge — please review and confirm they are not real secrets.

cx-rahul-pidde · 2026-10-26T08:53:25Z

Companion PRs for AST-180812: Checkmarx/cx-agentic-ai#38 (Copilot plugin, needs #37 first) · #1601 (agent hooks) · Checkmarx/ast-vscode-extension#1558 (VS Code setting)

… host detection to VS Code - New package agenthooks/hostenv: PluginHost() (moved from cx/hooks.go) and TelemetryAgent(). Only VS Code's own agentPlugins folder (Code, Code - Insiders) counts as VS Code; ~/.copilot/installed-plugins is the terminal (checked first); any other PLUGIN_ROOT (VS Code forks, JetBrains, Visual Studio, ...) is another editor; GITHUB_COPILOT_INTEGRATION_ID=vscode-chat is used only when PLUGIN_ROOT is not set. - Telemetry agent for GitHub Copilot inside VS Code, by the extension that wrote the IDE file (cx_ide_extension): Copilot-VSCode-OneAssist (ast-results), Copilot-VSCode-DevAssist (cx-dev-assist), Copilot-VSCode (no valid file). Terminal Copilot and every other agent keep "<agent>-cli"; aiProvider is unchanged. Used by the ASCA, KICS, Secrets and remediation telemetry. - scannerconfig.IDEExtension() reads cx_ide_extension from a valid IDE file. - Self-Healing OFF only skips the file-write scans; shell-command policy, the SCA package-install scan and prompt guardrails always run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Rahul Pidde <206018639+cx-rahul-pidde@users.noreply.github.com>

VS Code has no severity threshold setting, so Copilot hooks running in VS Code now take cx_severity_threshold only from ~/.checkmarx/cx-onboarding-ide.properties, which is unset today and therefore low (nothing filtered). The terminal's cx-onboarding.properties threshold no longer relaxes VS Code denies; the terminal Copilot CLI and other agents are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Rahul Pidde <206018639+cx-rahul-pidde@users.noreply.github.com>

cx-rahul-pidde requested a review from a team October 26, 2026 08:52

cx-rahul-pidde mentioned this pull request Oct 26, 2026

AST-180812 - Respect the VS Code Checkmarx Self-Healing setting in the Copilot plugin Checkmarx/cx-agentic-ai#38

Open

2 of 3 tasks

cx-rahul-pidde mentioned this pull request Oct 26, 2026

AST-180812 - Add Checkmarx Self-Healing setting for the Copilot CLI plugin in VS Code Checkmarx/ast-vscode-extension#1558

Open

3 of 4 tasks

cx-rahul-pidde and others added 2 commits October 26, 2026 15:33

Navigation Menu

Repository navigation

AST-180812 - Honour the VS Code Checkmarx Self-Healing setting in Copilot agent hooks - #1601

AST-180812 - Honour the VS Code Checkmarx Self-Healing setting in Copilot agent hooks#1601
cx-rahul-pidde wants to merge 3 commits into
mainfrom
feature/AST-180812-vscode-self-healing

cx-rahul-pidde commented Oct 26, 2026 •

edited by atlassian Bot

Loading

Uh oh!

github-actions Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

cx-rahul-pidde commented Oct 26, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

cx-rahul-pidde commented Oct 26, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes (internal/commands/agenthooks)

Test plan

Uh oh!

github-actions Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Potential secret(s) detected (unverified)

🛠 Guidelines to remediate hardcoded secrets

Uh oh!

cx-rahul-pidde commented Oct 26, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

cx-rahul-pidde commented Oct 26, 2026 •

edited by atlassian Bot

Loading

Changes (`internal/commands/agenthooks`)

github-actions Bot commented Oct 26, 2026 •

edited

Loading