AST-164154: Fix KICS agent-hook guardrail never scanning (empty container engine)- #1528 #1528 - #1531
Conversation
…iner engine) The KICS file-edit guardrail passed an empty container engine name to RunIacRealtimeScan instead of "docker", causing engine resolution to always fail and the scan to silently fail open on every file edit. Now resolves the engine via CX_HOOKS_CONTAINER_ENGINE override, then PATH auto-detection (docker/podman), falling back to "docker". Also logs the swallowed scan errors via --debug so a future regression here is diagnosable instead of silently invisible. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Dockerfile and docker-compose findings were sent through codeRemediation like any other IaC misconfiguration, but they need imageRemediation for base-image CVEs/hardening. Route by KICS's own platform field on the finding (Dockerfile/DockerCompose), falling back to filename heuristics only when platform metadata is unavailable. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-anurag-dalke) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-anurag-dalke) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
2 participants
Description
The KICS agent-hook guardrail (used by AI-agent plugins like Claude Code via cx hooks claude-pre-file-write) was passing an empty container engine name ("") to RunIacRealtimeScan instead of a real engine like "docker". This caused container-engine resolution to fail on every invocation, and because ScanFileEdit fails open on scan errors, the guardrail silently allowed every IaC file edit without ever actually running KICS — with no visible error or log output under normal operation.
Verified live: with the bug, writing a Terraform file with an obviously public S3 bucket ACL was silently allowed. After the fix, the same write is correctly denied with full KICS findings and remediation guidance.
Changes
internal/commands/agenthooks/guardrails/kics/scanner.go: Resolve the container engine via, in order: CX_HOOKS_CONTAINER_ENGINE env var override → PATH auto-detection (docker then podman) → "docker" fallback default (matching the existing --engine flag default on cx scan iac-realtime). This also gives Podman-only users a working path, since the guardrail has no CLI flag surface to read --engine from (it's invoked as cx hooks with only stdin JSON).
internal/commands/agenthooks/guardrails/kics/kics.go: Added --debug-gated logging (logger.PrintfIfVerbose) at the previously-silent fail-open branches (both svc.scan error paths, and the panic-recovery deferred func), so a future regression in this path is diagnosable instead of invisible.
internal/params/envs.go: Added HooksContainerEngineEnv = "CX_HOOKS_CONTAINER_ENGINE" constant.
internal/commands/agenthooks/guardrails/kics/scanner_test.go: New unit tests for the engine-resolution priority order (env override wins, auto-detects from PATH, falls back to default when nothing resolves).
Type of Change
Related Issues
Link any related issues or tickets.
Checklist
Screenshots (if applicable)
Add screenshots to help explain your changes.
Additional Notes
Add any other relevant information.