AST-163480: Add Gemini AI provider support for agent hook remediation

[cx-rahul-pidde]

Summary

Add support for Google Gemini as an AI provider in the Checkmarx AST CLI agent hooks system, enabling Gemini-based agents to perform real-time security remediation alongside the existing Claude support. This change introduces agent-agnostic remediation routing that adapts MCP tool names and skill invocation patterns based on the AI provider.

What Changed

1. Agent-Agnostic Remediation Routing (delta.go)

• New function: remediationTargets(agent string) — Returns provider-specific:
  • Skill invocation format (e.g., /cx-security-asca for Gemini vs cx-devassist:cx-devassist-asca for Claude)
  • MCP tool name convention (e.g., mcp_Checkmarx_codeRemediation for Gemini vs mcp__Checkmarx__codeRemediation for Claude)
• Updated: additionalContext() — Now calls remediationTargets() to generate provider-specific instructions injected into the agent's context window
• Key insight: Gemini CLI uses different naming conventions (single underscores, bare slash commands) compared to Claude Code

2. Shell-Safe JSON Quoting Utility (shellquote.go + shellquote_test.go)

• New function: ignore.QuoteDataFlag(data) — Safely escapes JSON data for shell arguments
• Windows handling: Converts " to \" for PowerShell native-exe argument parsing
• Unix handling: Returns unescaped JSON for POSIX shells
• Used by: SCA and ASCA ignore commands to ensure --data arguments survive shell parsing

3. Cross-Provider Hook Integration (asca_test.go)

• Expanded test coverage: Added TestAdditionalContext_GeminiUsesGeminiSkillAndMCPTool() to verify Gemini-specific routing
• Maintained: All existing Claude-specific tests (provenance flags, filename edge cases, multiple findings)
• Enhanced: Comprehensive ASCA finding analysis and severity ranking tests

4. SCA Vulnerability Suppression (prompts.go)

• Updated: SCA ignore command now uses ignore.QuoteDataFlag() for cross-platform shell safety (same pattern as ASCA)

Technical Details

Provider Detection

Agent name parameter passed through hook pipeline determines routing:

• "Claude" → Claude Code conventions
• "Gemini" → Gemini CLI conventions
• Default → Claude (backward compatible)

MCP Tool Naming Convention Difference

Claude Code:   mcp__Checkmarx__codeRemediation  (double underscores, namespaced)
Gemini CLI:    mcp_Checkmarx_codeRemediation    (single underscores, flattened)

Skill Invocation Difference

Claude Code:   cx-devassist:cx-devassist-asca  (plugin:skill format)
Gemini CLI:    /cx-security-asca                (bare slash command)

Files Changed

File	Changes
internal/commands/agenthooks/guardrails/asca/delta.go	Added remediationTargets(), updated additionalContext() for provider routing
internal/services/realtimeengine/ignore/shellquote.go	New utility for shell-safe JSON escaping
internal/services/realtimeengine/ignore/shellquote_test.go	Comprehensive tests for Windows/Unix quote handling
internal/commands/agenthooks/sca/prompts.go	Updated SCA suppression command to use QuoteDataFlag()
internal/commands/agenthooks/guardrails/asca/asca_test.go	Added Gemini-specific tests, resolved merge conflicts

Testing

New Tests

• TestAdditionalContext_GeminiUsesGeminiSkillAndMCPTool() — Verifies Gemini routing works correctly
• QuoteDataFlag() edge cases — Windows escaping, special characters, JSON preservation

Existing Tests (Maintained)

• All Claude-specific context generation tests
• ASCA finding detection and severity ranking
• Shell command suppression format validation

Coverage

• Unit tests: Run with go test ./internal/commands/agenthooks/... -v
• Integration: go test -tags integration ./test/integration -timeout 210m
• Linting: golangci-lint run -c .golangci.yml

Backward Compatibility

✅ No breaking changes

• Default agent routing still uses Claude conventions
• Existing Claude hooks continue to work unchanged
• New Gemini support is additive only
• Shell quoting is transparent to callers

Downstream Impact

This change prepares the CLI for:

• Gemini-based IDE extensions (VS Code, JetBrains)
• Gemini-based CI/CD integrations
• Language wrapper support for Gemini (Java, JavaScript wrappers)
• Cross-cloud AI provider flexibility in the plugin ecosystem

Related Issues

• Depends on: ast-cx-hooks Gemini adapter for BeforeTool hook handling
• Follow-up: Update downstream plugins to specify agent parameter in hook calls

[stepsecurity-app]

✅ Resolved — a later workflow run passed this policy check.

Original alert (resolved)

Security Policy Alert: Secret Policy Violation

This workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch.

Secret references detected:

• secrets.STEP_SECURITY_API_KEY at line 83
• secrets.SECRET_MANAGER_ROLE_ARN at line 96
• secrets.SECRET_MANAGER_AWS_REGION at line 97
• secrets.SECRET_MANAGER_SECRET_NAME at line 103
• secrets.AWS_ASSUME_ROLE_ARN at line 151
• secrets.AWS_ASSUME_ROLE_REGION at line 152
• secrets.GITHUB_TOKEN at line 184
• secrets.PERSONAL_ACCESS_TOKEN at line 185
• secrets.S3_BUCKET_NAME at line 186
• secrets.S3_BUCKET_REGION at line 187
• secrets.SIGNING_REMOTE_SSH_USER at line 188
• secrets.SIGNING_REMOTE_SSH_HOST at line 189
• secrets.SIGNING_REMOTE_SSH_PRIVATE_KEY at line 190
• secrets.SIGNING_HSM_CREDS at line 191
• secrets.COSIGN_PUBLIC_KEY at line 202
• secrets.COSIGN_PASSWORD at line 205

To approve this workflow, please add the workflows-approved label to this PR.

Note: The label must be added by someone other than the PR author (cx-sumit-morchhale) or automation bots to ensure proper security review.

After the label is added, you can re-run the blocked workflow to proceed.

This workflow will be automatically approved once merged into the default branch.

For more information, see StepSecurity's Secret Exfiltration Policy documentation.

[cx-sumit-morchhale]

ok