AST-146911 - Hooks Update

[cx-kedar-bhujade]

Summary

Refactors the agent hooks feature to delegate guardrail logic (shell guard, secret scanning, MCP server) to the shared ast-cx-hooks library, and expands agent support from Cursor-only to five AI coding agents.

Changes

Agent Support Expansion

• Before: Hook routes and install logic supported Cursor only
• After: Supports Claude Code, Cursor, Windsurf, Factory Droid, and Gemini CLI — each with their own hook routes and installer

Guardrail Delegation

• Before: Shell guard (CheckShellCommand) and secret scanning (ScanForSecrets) were implemented directly in agenthooks.go; registerGuardrails() / registerPassThrough() lived here too
• After: All logic moved to github.com/CheckmarxDev/ast-cx-hooks/cx; agenthooks.go calls cxhooks.RegisterGuardrails() / cxhooks.RegisterPassThrough()

MCP Server

• Before: MCP server implemented in internal/commands/mcp/ using github.com/mark3labs/mcp-go
• After: internal/commands/mcp/ package deleted; MCP server from github.com/CheckmarxDev/ast-cx-hooks/mcp used instead (backed by the official modelcontextprotocol/go-sdk)

Install Command

• Before: cx hooks agenthooks install patched only ~/.cursor/hooks.json
• After: Installs for all five agents by default; per-agent subcommands (install claude, install cursor, etc.) delegate to cxhooks.Installers[agent]

Dependencies (go.mod)

• Removed: github.com/mark3labs/mcp-go
• Added: github.com/modelcontextprotocol/go-sdk (indirect), github.com/segmentio/asm, github.com/segmentio/encoding
• Updated: golang-jwt/jwt/v5 v5.2.2 → v5.3.1, various golang.org/x/* packages

Flow Diagram

Before

sequenceDiagram
  participant Agent as Cursor
  participant CLI as cx hooks <route>
  participant AH as agenthooks.go
  Agent->>CLI: hook event (stdin JSON)
  CLI->>AH: registerGuardrails() [local impl]
  AH->>AH: CheckShellCommand / ScanForSecrets
  AH-->>Agent: verdict JSON (stdout)

Loading

After

sequenceDiagram
  participant Agent as Any Agent (Claude/Cursor/Windsurf/Droid/Gemini)
  participant CLI as cx hooks <route>
  participant AH as agenthooks.go
  participant Lib as ast-cx-hooks/cx
  Agent->>CLI: hook event (stdin JSON)
  CLI->>AH: isLicensed() check
  AH->>Lib: cxhooks.RegisterGuardrails()
  Lib->>Lib: shell guard + secret scan (library impl)
  Lib-->>Agent: verdict JSON (stdout)

Loading

Testing

• Existing unit tests in internal/commands/ cover hook dispatch routing
• Shell guard and secret scanning logic is tested in the ast-cx-hooks library
• Run ./internal/commands/.scripts/up.sh for local unit tests