Add standardized CLAUDE.md documentation (AST-146797) by cx-rahul-pidde · Pull Request #323 · Checkmarx/ast-visual-studio-extension

cx-rahul-pidde · 2026-04-22T07:39:23Z

Add comprehensive CLAUDE.md file following the Cloud MD standardization template (epic AST-146798).

Includes:

Project Overview (purpose, status, key features)
Architecture (layered design, components, data flow)
Repository Structure (complete folder mapping)
Technology Stack (languages, frameworks, dependencies)
Development Setup (prerequisites, build, debug)
Coding Standards (naming, style, async/threading)
Project Rules (constraints, branch naming, commit format)
Testing Strategy (unit tests, integration tests, manual checklist)
Known Issues (compilation error, limitations, workarounds)
Database Schema (none - stateless)
External Integrations (Checkmarx API, CLI, GitHub)
Deployment Info (release process, VSIX artifacts)
Performance Considerations (scan timing, memory, optimization)
API/Endpoints/Interfaces (DTE automation, VS APIs)
Security & Access (credential storage, code signing, audit)
Logging (framework, levels, destinations, troubleshooting)
Debugging Steps (common issues, solutions, debug mode)

By submitting a PR to this repository, you agree to the terms within the Checkmarx Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.

Description

Describe the purpose of this PR along with any background information and the impacts of the proposed change.

References

Include supporting link to GitHub Issue/PR number

Testing

Describe how this change was tested. Be specific about anything not tested and reasons why. If this solution has unit and/or integration testing, tests should be added for new functionality and existing tests should complete without errors.

Please include any manual steps for testing end-to-end or functionality not covered by unit/integration tests.

Checklist

I have added documentation for new/changed functionality in this PR (if applicable).
All active GitHub checks for tests, formatting, and security are passing
The correct base branch is being used

Add comprehensive CLAUDE.md file following the Cloud MD standardization template (epic AST-146798). Includes: - Project Overview (purpose, status, key features) - Architecture (layered design, components, data flow) - Repository Structure (complete folder mapping) - Technology Stack (languages, frameworks, dependencies) - Development Setup (prerequisites, build, debug) - Coding Standards (naming, style, async/threading) - Project Rules (constraints, branch naming, commit format) - Testing Strategy (unit tests, integration tests, manual checklist) - Known Issues (compilation error, limitations, workarounds) - Database Schema (none - stateless) - External Integrations (Checkmarx API, CLI, GitHub) - Deployment Info (release process, VSIX artifacts) - Performance Considerations (scan timing, memory, optimization) - API/Endpoints/Interfaces (DTE automation, VS APIs) - Security & Access (credential storage, code signing, audit) - Logging (framework, levels, destinations, troubleshooting) - Debugging Steps (common issues, solutions, debug mode) Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

github-actions · 2026-04-22T07:43:19Z

Checkmarx One – Scan Summary & Details – c9d6577d-7196-4f5f-99a3-de271a253f6e

Policy Management Violations (2)

Policy Name	Rule(s)	Break Build
[SAST-ML0] Not allowed NEW Sast vulnerabilities		true
Commercial packages		true

Added details about the extension's compatibility and REST API restrictions.

cx-atish-jadhav

Review: CLAUDE.md Documentation

Good coverage overall — all 17 sections from the epic are present and the structure is clean. However, several sections reference files, constants, and features that do not exist in the actual codebase. These need to be corrected before merge so the document doesn't mislead contributors or AI assistants using it as a codebase map.

See inline comments for specific line-level issues.

cx-atish-jadhav · 2026-04-24T09:06:07Z

+**Real-time Scanner:**
+- `ASCAService.cs` — Monitors text changes, debounces (2000ms), executes scan
+- `ASCAUIManager.cs` — Updates error list and editor markers with diagnostics
+- Scans: .java, .cs, .go, .py, .js, .jsx files


ASCA file extension list is not enforced in code.

ASCAService.cs uses Path.GetExtension() generically — there is no hardcoded allowlist of .java, .cs, .go, .py, .js, .jsx in the file. The actual filtering logic (if any) was not found in the service.

Please verify where this list comes from and cite the actual source (e.g. a constants file or CLI behaviour), or rephrase as "primarily targets" rather than stating it as a fixed list.

cx-atish-jadhav · 2026-04-24T09:06:07Z

+
+**Settings:**
+- `CxPreferences/` — DialogPage for API key, tenant, environment configuration
+- `SettingsModule.cs` — Validates and loads settings at startup


SettingsModule.cs does not exist in this repository.

Searched the entire codebase — no file with this name was found. The settings entry point is CxPreferencesModule.cs in the CxPreferences/ folder, which exposes GetCxConfig() and IsAscaEnabled().

Please replace this line with the correct file reference.

cx-atish-jadhav · 2026-04-24T09:06:27Z

+│   │   │   ├── CxScan.cs
+│   │   │   ├── CxScanDetail.cs
+│   │   │   ├── CxAsca.cs
+│   │   │   └── [other models]


Model file names are incorrect — three of them don't match the actual codebase.

The doc references:

CxResults.cs → actual file is Results.cs

CxScan.cs → actual file is Scan.cs

CxScanDetail.cs → this file does not exist at all

Full actual list in CxWrapper/Models/: Results.cs, Scan.cs, Result.cs, CxAsca.cs, CxConfig.cs, Project.cs, CodeBashing.cs, Node.cs, Predicate.cs, State.cs, etc.

Please update the model names to match the actual files.

cx-atish-jadhav · 2026-04-24T09:06:55Z

+│   │   ├── Exceptions/                       # Custom exceptions
+│   │   └── Resources/                        # CLI configuration
+│   ├── CxPreferences/                        # Settings UI
+│   │   ├── CxOneAssistSettingsModule.cs


CxOneAssistSettingsModule.cs does not exist in the repository.

The actual files in CxPreferences/ are:

CxPreferencesModule.cs (this is the correct settings module)

CxPreferencesPackage.cs

CxPreferencesUI.cs + CxPreferencesUI.Designer.cs

Please replace CxOneAssistSettingsModule.cs with CxPreferencesModule.cs.

cx-atish-jadhav · 2026-04-24T09:06:59Z

+   - Stop when a wrapper AST-CLI command for functionality is not found.
+
+4. **Do not** execute CLI commands without timeout
+   - All CLI calls must have 30-second timeout (CxConstants.CLI_TIMEOUT)


CxConstants.CLI_TIMEOUT does not exist in the codebase.

Checked CxConstants.cs — there are no timeout-related constants defined anywhere in the file. This reference will mislead anyone looking for this constant.

Either:

Add the constant to CxConstants.cs (recommended — it enforces the rule in code), or

Remove the specific reference and just state the 30-second rule without citing a constant that doesn't exist.

cx-atish-jadhav · 2026-04-24T09:07:55Z

+   - Code review approval
+   - CI/CD pipeline success
+
+7. **Do not** modify .resx files via Visual Studio designer


Numbering bug: two items are both labeled 7.

Line 339 is also numbered 7. ("Do not deploy to production without..."). This item should be 8.

Please renumber from here to the end of the Don'ts list.

cx-atish-jadhav · 2026-04-24T09:07:57Z

+
+3. **Do not** implement any REST API invocation neither in extension or wrapper source code
+   - AST-CLI wrapper orchestrates AST-CLI command invocations instead
+   - Stop when a wrapper AST-CLI command for functionality is not found.


This rule is correct but the wording "Stop when..." is cryptic.

Verified — there are no HttpClient/WebClient calls anywhere in the repo, so the rule itself is accurate.

Suggested clearer wording:

If AST-CLI does not provide a command for required functionality, stop and request an upstream CLI change — do not add direct REST calls as a workaround.

Also note: the API / Endpoints section (line ~557) lists GET /api/projects etc. as endpoints, which contradicts this rule. Those calls happen inside cx.exe, not in this codebase. The section header there should be updated to make that clear (e.g. "Endpoints called internally by cx.exe").

cx-atish-jadhav · 2026-04-24T09:07:59Z

+
+### Don'ts
+1. **Do not** hardcode credentials, API keys, or secrets in code
+   - Use VS Settings/DialogPage and Windows Credential Manager


Inconsistency with line 575 (Security section).

This line says "Use VS Settings/DialogPage and Windows Credential Manager", but line 575 in the Security section correctly notes storage is "Windows Registry (plaintext ⚠️)".

The Credential Manager is the aspirational future state, not the current reality. This bullet in the Don'ts section should reflect what developers should do today — which is the DialogPage/Registry approach — not imply Credential Manager is already in use.

github-actions Bot added the feature label Apr 22, 2026

cx-rahul-pidde requested review from cx-anurag-dalke and cx-umesh-waghode April 22, 2026 07:39

Added extension overview, compatibility and API usage

91e45dd

Added details about the extension's compatibility and REST API restrictions.

cx-atish-jadhav requested changes Apr 24, 2026

View reviewed changes

cx-atish-jadhav reviewed Apr 24, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add standardized CLAUDE.md documentation (AST-146797)#323

Add standardized CLAUDE.md documentation (AST-146797)#323
cx-rahul-pidde wants to merge 2 commits intomainfrom
feature/AST-146797-add-claude-md

cx-rahul-pidde commented Apr 22, 2026

Uh oh!

github-actions Bot commented Apr 22, 2026 •

edited

Loading

Uh oh!

cx-atish-jadhav left a comment

Uh oh!

cx-atish-jadhav Apr 24, 2026

Uh oh!

cx-atish-jadhav Apr 24, 2026

Uh oh!

cx-atish-jadhav Apr 24, 2026

Uh oh!

cx-atish-jadhav Apr 24, 2026

Uh oh!

cx-atish-jadhav Apr 24, 2026

Uh oh!

cx-atish-jadhav Apr 24, 2026

Uh oh!

cx-atish-jadhav Apr 24, 2026

Uh oh!

cx-atish-jadhav Apr 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

cx-rahul-pidde commented Apr 22, 2026

Description

References

Testing

Checklist

Uh oh!

github-actions Bot commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cx-atish-jadhav left a comment

Choose a reason for hiding this comment

Review: CLAUDE.md Documentation

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Apr 22, 2026 •

edited

Loading