AST-xxx: Add Gemini AI provider support for agent hook remediation

[cx-rahul-pidde]

Summary

Add support for Google Gemini as an AI provider in the Checkmarx AST CLI agent hooks system, enabling Gemini-based agents to perform real-time security remediation alongside the existing Claude support. This change introduces agent-agnostic remediation routing that adapts MCP tool names and skill invocation patterns based on the AI provider.

What Changed

1. Agent-Agnostic Remediation Routing (delta.go)

• New function: remediationTargets(agent string) — Returns provider-specific:
  • Skill invocation format (e.g., /cx-security-asca for Gemini vs cx-devassist:cx-devassist-asca for Claude)
  • MCP tool name convention (e.g., mcp_Checkmarx_codeRemediation for Gemini vs mcp__Checkmarx__codeRemediation for Claude)
• Updated: additionalContext() — Now calls remediationTargets() to generate provider-specific instructions injected into the agent's context window
• Key insight: Gemini CLI uses different naming conventions (single underscores, bare slash commands) compared to Claude Code

2. Shell-Safe JSON Quoting Utility (shellquote.go + shellquote_test.go)

• New function: ignore.QuoteDataFlag(data) — Safely escapes JSON data for shell arguments
• Windows handling: Converts " to \" for PowerShell native-exe argument parsing
• Unix handling: Returns unescaped JSON for POSIX shells
• Used by: SCA and ASCA ignore commands to ensure --data arguments survive shell parsing

3. Cross-Provider Hook Integration (asca_test.go)

• Expanded test coverage: Added TestAdditionalContext_GeminiUsesGeminiSkillAndMCPTool() to verify Gemini-specific routing
• Maintained: All existing Claude-specific tests (provenance flags, filename edge cases, multiple findings)
• Enhanced: Comprehensive ASCA finding analysis and severity ranking tests

4. SCA Vulnerability Suppression (prompts.go)

• Updated: SCA ignore command now uses ignore.QuoteDataFlag() for cross-platform shell safety (same pattern as ASCA)

Technical Details

Provider Detection

Agent name parameter passed through hook pipeline determines routing:

• "Claude" → Claude Code conventions
• "Gemini" → Gemini CLI conventions
• Default → Claude (backward compatible)

MCP Tool Naming Convention Difference

Claude Code:   mcp__Checkmarx__codeRemediation  (double underscores, namespaced)
Gemini CLI:    mcp_Checkmarx_codeRemediation    (single underscores, flattened)

Skill Invocation Difference

Claude Code:   cx-devassist:cx-devassist-asca  (plugin:skill format)
Gemini CLI:    /cx-security-asca                (bare slash command)

Files Changed

File	Changes
internal/commands/agenthooks/guardrails/asca/delta.go	Added remediationTargets(), updated additionalContext() for provider routing
internal/services/realtimeengine/ignore/shellquote.go	New utility for shell-safe JSON escaping
internal/services/realtimeengine/ignore/shellquote_test.go	Comprehensive tests for Windows/Unix quote handling
internal/commands/agenthooks/sca/prompts.go	Updated SCA suppression command to use QuoteDataFlag()
internal/commands/agenthooks/guardrails/asca/asca_test.go	Added Gemini-specific tests, resolved merge conflicts

Testing

New Tests

• TestAdditionalContext_GeminiUsesGeminiSkillAndMCPTool() — Verifies Gemini routing works correctly
• QuoteDataFlag() edge cases — Windows escaping, special characters, JSON preservation

Existing Tests (Maintained)

• All Claude-specific context generation tests
• ASCA finding detection and severity ranking
• Shell command suppression format validation

Coverage

• Unit tests: Run with go test ./internal/commands/agenthooks/... -v
• Integration: go test -tags integration ./test/integration -timeout 210m
• Linting: golangci-lint run -c .golangci.yml

Backward Compatibility

✅ No breaking changes

• Default agent routing still uses Claude conventions
• Existing Claude hooks continue to work unchanged
• New Gemini support is additive only
• Shell quoting is transparent to callers

Downstream Impact

This change prepares the CLI for:

• Gemini-based IDE extensions (VS Code, JetBrains)
• Gemini-based CI/CD integrations
• Language wrapper support for Gemini (Java, JavaScript wrappers)
• Cross-cloud AI provider flexibility in the plugin ecosystem

Related Issues

• Depends on: ast-cx-hooks Gemini adapter for BeforeTool hook handling
• Follow-up: Update downstream plugins to specify agent parameter in hook calls