Skip to content

Feature/ast 180812 vscode copilot cli host - #1607

Merged
cx-rahul-pidde merged 3 commits into
stagingfrom
feature/AST-180812-vscode-copilot-cli-host
Nov 2, 2026
Merged

Feature/ast 180812 vscode copilot cli host#1607
cx-rahul-pidde merged 3 commits into
stagingfrom
feature/AST-180812-vscode-copilot-cli-host

Conversation

@cx-rahul-pidde

@cx-rahul-pidde cx-rahul-pidde commented Nov 2, 2026

Copy link
Copy Markdown
Contributor

By submitting this pull request, you agree to the terms within the Checkmarx Code of Conduct. Please review the contributing guidelines for guidance on creating high-quality pull requests.

Description

Please provide a summary of the changes and the related issue. Include relevant motivation and context.

Type of Change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation update

Related Issues

Link any related issues or tickets.

Checklist

  • I have performed a self-review of my code
  • I have added tests that prove my fix is effective or that my feature works
  • I have added necessary documentation (if appropriate)
  • Any dependent changes have been merged and published in downstream modules
  • I have updated the CLI help for new/changed functionality in this PR (if applicable)
  • All active GitHub checks for tests, formatting, and security are passing
  • The correct base branch is being used

Screenshots (if applicable)

Add screenshots to help explain your changes.

Additional Notes

Add any other relevant information.

cx-rahul-pidde and others added 2 commits October 30, 2026 19:57
@cx-rahul-pidde @claude
AST-180812 - Detect VS Code Copilot CLI sessions from GITHUB_COPILOT_…
509b430 
…INTEGRATION_ID

VS Code's Copilot CLI chat sessions run the cx-devassist hooks without a
VS Code PLUGIN_ROOT, so hostenv.PluginHost reported HostUnknown there and
cx used the terminal scanner switches and threshold instead of the VS Code
extension's cx-onboarding-ide.properties.

When PLUGIN_ROOT is not set, GITHUB_COPILOT_INTEGRATION_ID=vscode-chat (set
by VS Code on the Copilot CLI engine it bundles) is HostVSCode again. A
PLUGIN_ROOT still decides first, so the terminal Copilot CLI and other
hosts are unchanged. Matches the cx-devassist Copilot plugin's _in_vscode.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@cx-rahul-pidde @claude
AST-180812 - Honour CX_COPILOT_HOST=vscode from the Copilot plugin
ce924a6 
VS Code's Copilot CLI chat sessions run the plugin from
~/.copilot/installed-plugins/ without GITHUB_COPILOT_INTEGRATION_ID, so
PluginHost returned HostCLI and the hooks read the terminal's
cx-onboarding.properties instead of cx-onboarding-ide.properties.

The cx-devassist plugin's cx_run.sh now exports CX_COPILOT_HOST=vscode
when its own host check (which also reads the process tree) finds VS
Code. PluginHost treats that as VS Code when PLUGIN_ROOT is under
~/.copilot/installed-plugins/ or not set; a VS Code fork's or another
host's plugin folder is still never VS Code.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@cx-rahul-pidde
cx-rahul-pidde requested a review from a team as a code owner November 2, 2026 10:28
@cx-rahul-pidde
Merge remote-tracking branch 'origin/staging' into feature/AST-180812…
d76496a 
…-vscode-copilot-cli-host

# Conflicts:
#	internal/commands/agenthooks/hostenv/hostenv.go
@cx-rahul-pidde
cx-rahul-pidde merged commit b773cb4 into staging Nov 2, 2026
6 of 9 checks passed
cx-aniket-shinde added a commit that referenced this pull request Nov 5, 2026
@cx-rahul-pidde @cx-anurag-dalke
@claude @cx-atish-jadhav @cx-sumit-morchhale @cx-aniket-shinde
Staging (#1606)
16701c0 
* Honour the VS Code Checkmarx Self-Healing setting in Copilot agent hooks (AST-180812) (#1603)

* AST-180812 - Detect VS Code Copilot CLI sessions from GITHUB_COPILOT_INTEGRATION_ID (#1604)

* Feature/ast 180812 vscode copilot cli host (#1607)

* Update brotli dependency to v1.2.7 (AST-189161) (#1610)

* Update github.com/andybalholm/brotli from v1.2.0 to v1.2.7 (AST-189161)

Indirect dependency pulled in via anchore/syft -> anchore/archiver.
No API removals; archiver only uses NewWriterLevel/NewReader, which are unchanged.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Update Docker base image checkmarx/bash:5.3 to latest digest (AST-189161)

Bumps the SHA256-pinned base image to the 5.3-r14 build pushed on 2026-11-04.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Replace .trivyignore entries with current binary findings (AST-189161)

Ignore GO-2026-5932 (x/crypto/openpgp via helm provenance), CVE-2026-78661 and
CVE-2026-97045 (x/net/html via syft Maven cataloger). Remove the previous Wolfi
base-image and syft/docker entries, which no longer apply.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Restore syft and docker entries in .trivyignore (AST-189161)

CVE-2026-33481 (syft temp cleanup) and CVE-2026-33997 (moby plugin privilege
bypass) are still reported against the binary. Neither has an adoptable fix:
syft >= 1.42.3 reintroduces the binary-size regression reverted in AST-188320
and docker/docker has no 29.x release on its module path. Justifications and
reachability analysis are recorded in the file.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Bump golang.org/x/net to v0.62.0 and trim .trivyignore (AST-189161)

Bump the indirect golang.org/x/net dependency to v0.62.0, which fixes
CVE-2026-78661 and CVE-2026-97045, so their ignore entries are dropped.
Keep only the ignores that cannot be fixed directly: GO-2026-5932
(x/crypto openpgp, via helm), CVE-2026-33481 (syft) and CVE-2026-33997
(docker).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Co-authored-by: atishj99 <atish.jadhav@checkmarx.com>

* revret exclude git config changes (#1609)

Co-authored-by: Aniket Shinde <aniket.shinde@checkmarx.com>

* Use self-repository syntax for reusable workflow in nightly-parallel (AST-189161)

Replace `uses: ./.github/workflows/ci-tests.yml` with the `$/` form to
satisfy the zizmor `self-repository` audit (added in zizmor v1.30.0).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Anurag Dalke <anurag.dalke@checkmarx.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Co-authored-by: atishj99 <atish.jadhav@checkmarx.com>
Co-authored-by: Sumit Morchhale <sumit.morchhale@checkmarx.com>
Co-authored-by: Aniket Shinde <aniket.shinde@checkmarx.com>
cx-aniket-shinde added a commit that referenced this pull request Nov 12, 2026
@cx-sumit-morchhale @cx-rahul-pidde
@cx-anurag-dalke @claude @cx-atish-jadhav @cx-aniket-shinde
Merge staging branch into main(AST-0000) (#1614)
288727f 
* Honour the VS Code Checkmarx Self-Healing setting in Copilot agent hooks (AST-180812) (#1603)

* AST-180812 - Detect VS Code Copilot CLI sessions from GITHUB_COPILOT_INTEGRATION_ID (#1604)

* Feature/ast 180812 vscode copilot cli host (#1607)

* Update brotli dependency to v1.2.7 (AST-189161) (#1610)

* Update github.com/andybalholm/brotli from v1.2.0 to v1.2.7 (AST-189161)

Indirect dependency pulled in via anchore/syft -> anchore/archiver.
No API removals; archiver only uses NewWriterLevel/NewReader, which are unchanged.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Update Docker base image checkmarx/bash:5.3 to latest digest (AST-189161)

Bumps the SHA256-pinned base image to the 5.3-r14 build pushed on 2026-11-04.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Replace .trivyignore entries with current binary findings (AST-189161)

Ignore GO-2026-5932 (x/crypto/openpgp via helm provenance), CVE-2026-78661 and
CVE-2026-97045 (x/net/html via syft Maven cataloger). Remove the previous Wolfi
base-image and syft/docker entries, which no longer apply.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Restore syft and docker entries in .trivyignore (AST-189161)

CVE-2026-33481 (syft temp cleanup) and CVE-2026-33997 (moby plugin privilege
bypass) are still reported against the binary. Neither has an adoptable fix:
syft >= 1.42.3 reintroduces the binary-size regression reverted in AST-188320
and docker/docker has no 29.x release on its module path. Justifications and
reachability analysis are recorded in the file.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Bump golang.org/x/net to v0.62.0 and trim .trivyignore (AST-189161)

Bump the indirect golang.org/x/net dependency to v0.62.0, which fixes
CVE-2026-78661 and CVE-2026-97045, so their ignore entries are dropped.
Keep only the ignores that cannot be fixed directly: GO-2026-5932
(x/crypto openpgp, via helm), CVE-2026-33481 (syft) and CVE-2026-33997
(docker).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Co-authored-by: atishj99 <atish.jadhav@checkmarx.com>

* revret exclude git config changes (#1609)

Co-authored-by: Aniket Shinde <aniket.shinde@checkmarx.com>

* Use self-repository syntax for reusable workflow in nightly-parallel (AST-189161)

Replace `uses: ./.github/workflows/ci-tests.yml` with the `$/` form to
satisfy the zizmor `self-repository` audit (added in zizmor v1.30.0).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Handle missing feature flags(AST-188568) (#1613)

* Handle missing feature flags gracefully (code 100 response)

When the API returns a 404 with error code 100 and message
"flag with the given name is not found", return a disabled flag
model instead of nil to prevent nil pointer dereference panics
in calling code. Missing flags are treated as enabled (default)
to ensure safe feature flag fallback behavior.

Fixes panic: runtime error: invalid memory address or nil pointer dereference
when GetSpecificFlag is called and the flag doesn't exist on the server.

* Refactor: use existing WebError struct instead of inline type

Replace inline error response struct with the existing WebError struct
from ast.go for consistency with the rest of the codebase. This improves
maintainability and follows the established pattern in wrappers like
bfl-http.go and codebashing-http.go.

* handle remove ff

* Remove INCREASE_FILE_UPLOAD_LIMIT flag - now always enabled for large files

Removed the INCREASE_FILE_UPLOAD_LIMIT feature flag that controlled multipart
uploads. The flag is now permanently enabled - files > 5GB always use multipart
upload, smaller files use single upload. This simplifies the code by removing
the flag check and associated tests.

Changes:
- Removed flag constant from feature-flags.go
- Updated scan.go to always check file size (no flag check)
- Consolidated 5 tests to 3 tests (removed redundant flag-based tests)
- Behavior unchanged: multipart for >5GB, single for <=5GB

No regression - functionality preserved, code simplified.

* removed status code handling

* updated docker image

---------

Co-authored-by: Anurag Dalke <120229307+cx-anurag-dalke@users.noreply.github.com>

* Undo merge conflict resolution commit

This removes the problematic merge commit a1df4b1 that resolved
the Dockerfile conflict. Going back to the clean state before
that merge attempt.

All code is preserved - reverting to e3250aa state.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

* Ignore glibc CVE-2026-84243 and Go stdlib CVE-2026-97054 in Trivy

Both are newly disclosed. glibc comes from the checkmarx/bash base image
(fix in 2.44-r16, no rebuilt image yet); stdlib is fixed in Go 1.26.11.
Remove once the base image is rebuilt and the Go toolchain is bumped.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Rahul Pidde <206018639+cx-rahul-pidde@users.noreply.github.com>
Co-authored-by: Anurag Dalke <anurag.dalke@checkmarx.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Co-authored-by: atishj99 <atish.jadhav@checkmarx.com>
Co-authored-by: Aniket Shinde <aniket.shinde@checkmarx.com>
Co-authored-by: Anurag Dalke <120229307+cx-anurag-dalke@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@cx-rahul-pidde