praxis-sec 1.0.0 → 1.2.0

package/cli/core/web/.praxis/context.json

@@ -0,0 +1,135 @@
+{
+  "version": "1.0.0",
+  "generatedAt": "2026-10-02T18:43:15.311Z",
+  "rootPath": "C:\\STUDY\\Github\\CADRE-Platform\\Praxis\\cli\\core\\web",
+  "recon": {
+    "frameworks": [],
+    "languages": [
+      "javascript"
+    ],
+    "apiRoutes": [],
+    "authPatterns": [],
+    "databases": [],
+    "cloudProviders": [],
+    "frontendExposure": [],
+    "packageManagers": [],
+    "cicd": [],
+    "hasDockerfile": false,
+    "hasTerraform": false,
+    "hasKubernetes": false,
+    "envFiles": [],
+    "configFiles": [],
+    "hasModelFiles": false,
+    "modelFiles": []
+  },
+  "fileIndex": {
+    "jobs.js": {
+      "hash": "91bef088c5f2d713300063ee65b0f6065e51a29432a96a7ac7e101cec05fcd19",
+      "size": 7025,
+      "lastScanned": "2026-10-02T18:43:15.310Z"
+    },
+    "projects.js": {
+      "hash": "6961f8ee3ea4a1d18620cd4d2ab802ddc5db17db106743990ac91af870b006c5",
+      "size": 5118,
+      "lastScanned": "2026-10-02T18:43:15.310Z"
+    },
+    "server.js": {
+      "hash": "97f1e8c34d791eaf1c62f8b908ef75025b91474f5beebe4ba2c8ffabe3509cd6",
+      "size": 12526,
+      "lastScanned": "2026-10-02T18:43:15.310Z"
+    },
+    "ui.js": {
+      "hash": "d1d44980df3ce9b1b7ca344f6f07aa7d3efc63b8e60e3f6dbf561ad2a4ff6c59",
+      "size": 75352,
+      "lastScanned": "2026-10-02T18:43:15.310Z"
+    }
+  },
+  "lastFindings": {
+    "cli/__tests__/ast-engine.test.js": [
+      {
+        "line": 0,
+        "column": 0,
+        "severity": "high",
+        "category": "history",
+        "rule": "GIT_HISTORY_SECRET",
+        "title": "Historical Secret: Generic API Key Assignment",
+        "description": "Secret was removed from code but still exists in git history (commit 322700ad27, Tue Aug 18 11:19:47 2026 +0530). Anyone with repo access can retrieve it.",
+        "matched": "API_KEY ***123\"",
+        "confidence": "low",
+        "cwe": null,
+        "owasp": null,
+        "fix": "Rotate this credential immediately, then clean history: npx bfg --replace-text passwords.txt"
+      }
+    ],
+    "server.js": [
+      {
+        "line": 0,
+        "column": 0,
+        "severity": "medium",
+        "category": "api",
+        "rule": "API_NO_RATE_LIMIT",
+        "title": "API: No Rate Limiting Detected",
+        "description": "HTTP server detected without any rate-limiting library. APIs without rate limits are vulnerable to brute-force and DoS attacks.",
+        "matched": "No rate-limiting middleware found",
+        "confidence": "medium",
+        "cwe": "CWE-307",
+        "owasp": "A07:2021",
+        "fix": "Add rate limiting: npm i express-rate-limit && app.use(rateLimit({ windowMs: 15*60*1000, max: 100 }))"
+      }
+    ],
+    "../../../../../../../Users/Ganro/.cursor/mcp.json": [
+      {
+        "line": 1,
+        "column": 0,
+        "severity": "medium",
+        "category": "llm",
+        "rule": "MCP_SHADOW_CONFIG",
+        "title": "MCP: 1 Shadow Server(s) in User Config",
+        "description": "Found 1 MCP server(s) configured outside the project in C:\\Users\\Ganro\\.cursor\\mcp.json. These operate outside your project's security controls.",
+        "matched": "redstrike",
+        "confidence": "medium",
+        "cwe": "CWE-269",
+        "owasp": "A05:2021",
+        "fix": "Review shadow MCP servers. Move project-specific servers to the project mcp.json and track in version control."
+      }
+    ],
+    "ui.js": [
+      {
+        "line": 29,
+        "column": 108,
+        "severity": "medium",
+        "category": "llm",
+        "rule": "AGENT_MEMORY_NO_EXPIRY",
+        "title": "Agent: Persistent Memory Without Expiration",
+        "description": "Agent memory persists without expiration policy. Poisoned memories remain indefinitely.",
+        "matched": "memory contexts and session retention for persist",
+        "confidence": "low",
+        "cwe": "CWE-404",
+        "owasp": "A04:2021",
+        "fix": "Set TTL or retention policies on agent memory. Implement periodic cleanup of stale entries."
+      }
+    ],
+    "observability": [
+      {
+        "line": 1,
+        "column": 0,
+        "severity": "medium",
+        "category": "llm",
+        "rule": "NO_OBSERVABILITY",
+        "title": "AI in Use Without Observability/Tracing",
+        "description": "This project calls LLMs, but no AI tracing/observability wiring (LangSmith, Langfuse, Helicone, OpenTelemetry, ...) was found outside dependency manifests. Without traces you cannot detect prompt-injection events, monitor output quality, or respond to AI incidents — EU AI Act Art. 12 / ISO 42001 A.6.2.6.",
+        "matched": "no tracing wiring in 4 evidence file(s)",
+        "confidence": "medium",
+        "cwe": "CWE-778",
+        "owasp": "ASI03",
+        "fix": "Wire an AI tracing/observability stack (e.g., Langfuse, Helicone, or OpenTelemetry) and log prompts, tool calls, and outputs with retention."
+      }
+    ]
+  },
+  "stats": {
+    "totalFiles": 4,
+    "totalFindings": 5,
+    "lastScore": 89.2,
+    "lastGrade": "B"
+  }
+}

package/cli/core/web/.praxis/history.json

@@ -0,0 +1,93 @@
+[
+  {
+    "timestamp": "2026-10-02T18:42:07.164Z",
+    "score": 89.2,
+    "grade": "B",
+    "totalFindings": 5,
+    "totalDepVulns": 0,
+    "categoryScores": {
+      "secrets": {
+        "deduction": 4.5,
+        "counts": {
+          "critical": 0,
+          "high": 1,
+          "medium": 0,
+          "low": 0
+        }
+      },
+      "injection": {
+        "deduction": 0,
+        "counts": {
+          "critical": 0,
+          "high": 0,
+          "medium": 0,
+          "low": 0
+        }
+      },
+      "deps": {
+        "deduction": 0,
+        "counts": {
+          "critical": 0,
+          "high": 0,
+          "medium": 0,
+          "low": 0
+        }
+      },
+      "auth": {
+        "deduction": 0,
+        "counts": {
+          "critical": 0,
+          "high": 0,
+          "medium": 0,
+          "low": 0
+        }
+      },
+      "config": {
+        "deduction": 0,
+        "counts": {
+          "critical": 0,
+          "high": 0,
+          "medium": 0,
+          "low": 0
+        }
+      },
+      "supply-chain": {
+        "deduction": 0,
+        "counts": {
+          "critical": 0,
+          "high": 0,
+          "medium": 0,
+          "low": 0
+        }
+      },
+      "api": {
+        "deduction": 1.7999999999999998,
+        "counts": {
+          "critical": 0,
+          "high": 0,
+          "medium": 1,
+          "low": 0
+        }
+      },
+      "llm": {
+        "deduction": 4.5,
+        "counts": {
+          "critical": 0,
+          "high": 0,
+          "medium": 3,
+          "low": 0
+        }
+      }
+    },
+    "suppressions": {
+      "total": 6,
+      "rules": {
+        "AGENT_MEMORY_NO_EXPIRY": 1,
+        "AGENT_ESCALATED_PERMISSIONS": 1,
+        "SSRF_INTERNAL_IP": 2,
+        "MCP_NO_RATE_LIMIT": 1,
+        "XSS_INNERHTML": 1
+      }
+    }
+  }
+]

package/cli/core/web/.praxis/llm-cache.json

@@ -0,0 +1 @@
+{}

package/cli/core/web/jobs.js

@@ -91,7 +91,7 @@ export class JobQueue extends EventEmitter {
   }
 
   _public(job) {
-    const { result, root, ...rest } = job;
+    const { result, root: _root, ...rest } = job;
     return { ...rest, hasResult: Boolean(result) };
   }
 
@@ -155,7 +155,7 @@ export class JobQueue extends EventEmitter {
 
 /**
  * Default scan runner: drives the real Orchestrator so the UI cannot drift from the CLI.
- * Returns the same shape the CLI's JSON output produces.
+ * Returns the same shape the CLI's JSON output produces, enriched with score and grade.
  */
 export async function runScanWithOrchestrator(rootPath, onProgress) {
   const { buildOrchestratorAsync } = await import('../../agents/index.js');
@@ -172,6 +172,24 @@ export async function runScanWithOrchestrator(rootPath, onProgress) {
     },
   });
 
+  let score = 100;
+  let grade = 'A';
+  let categories = {};
+  let standardsSummary = null;
+  try {
+    const { ScoringEngine } = await import('../../agents/scoring-engine.js');
+    const engine = new ScoringEngine();
+    const computed = engine.compute(findings || []);
+    if (computed) {
+      score = computed.score ?? 100;
+      grade = computed.grade?.letter || (typeof computed.grade === 'string' ? computed.grade : 'A');
+      categories = computed.categories || {};
+      standardsSummary = computed.standardsSummary || null;
+    }
+  } catch {
+    // fallback gracefully
+  }
+
   return {
     root: path.basename(rootPath),
     agentCount: (agentResults || []).length,
@@ -179,5 +197,10 @@ export async function runScanWithOrchestrator(rootPath, onProgress) {
     agents: agentResults || [],
     recon: recon || null,
     findings: findings || [],
+    score,
+    grade,
+    categories,
+    standardsSummary,
+    scannedAt: new Date().toISOString(),
   };
 }

package/cli/core/web/server.js

@@ -18,9 +18,9 @@
 
 import http from 'http';
 import { URL } from 'url';
-import { baseStyles } from '../output/html-theme.js';
 import { listProjects, addProject, getProject, removeProject } from './projects.js';
 import { JobQueue, runScanWithOrchestrator } from './jobs.js';
+import { renderFrontend, AGENT_ROSTER } from './ui.js';
 
 const LOOPBACK = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']); // praxis-ignore SSRF_INTERNAL_IP — loopback allow-list: binding only to loopback IS the mitigation
 const CLIENT_HEADER = 'x-praxis-client';
@@ -150,10 +150,58 @@ function guardMutation(req) {
   return { ok: true };
 }
 
-export function createServer({ host = '127.0.0.1', port = 7317, token = null, queue = null } = {}) { // praxis-ignore MCP_NO_RATE_LIMIT — local scan orchestrator, not an MCP server; exhaustion bounded by MAX_CONCURRENCY/MAX_QUEUE
+/**
+ * In-memory sliding-window rate limiter (API_NO_RATE_LIMIT defense).
+ * Bounds request frequency per IP to prevent resource exhaustion and local/remote DoS.
+ */
+export function createRateLimiter({ windowMs = 60 * 1000, max = 180 } = {}) {
+  const hits = new Map();
+
+  const timer = setInterval(() => {
+    const now = Date.now();
+    for (const [ip, timestamps] of hits.entries()) {
+      const valid = timestamps.filter(t => now - t < windowMs);
+      if (valid.length === 0) hits.delete(ip);
+      else hits.set(ip, valid);
+    }
+  }, windowMs);
+  if (timer.unref) timer.unref();
+
+  return function rateLimit(req, res) {
+    const ip = req.socket?.remoteAddress || '127.0.0.1'; // praxis-ignore SSRF_INTERNAL_IP — fallback client ip for local rate limiter
+    const now = Date.now();
+    const timestamps = hits.get(ip) || [];
+    const valid = timestamps.filter(t => now - t < windowMs);
+
+    if (valid.length >= max) {
+      const oldest = valid[0];
+      const retryAfter = Math.ceil((windowMs - (now - oldest)) / 1000) || 1;
+      res.writeHead(429, {
+        'Content-Type': 'application/json; charset=utf-8',
+        'Retry-After': String(retryAfter),
+        'X-Content-Type-Options': 'nosniff',
+        'Cache-Control': 'no-store',
+      });
+      res.end(JSON.stringify({ error: 'Too Many Requests', retryAfter }));
+      return false;
+    }
+
+    valid.push(now);
+    hits.set(ip, valid);
+    return true;
+  };
+}
+
+export function createServer({ host: _host = '127.0.0.1', port: _port = 7317, token = null, queue = null, rateLimiter = null } = {}) { // praxis-ignore MCP_NO_RATE_LIMIT — local scan orchestrator, not an MCP server; exhaustion bounded by MAX_CONCURRENCY/MAX_QUEUE
   const jobs = queue || new JobQueue({ runScan: runScanWithOrchestrator });
+  const checkRateLimit = rateLimiter || createRateLimiter();
 
   const server = http.createServer(async (req, res) => {
+    // Sliding-window rate limit defense against brute-force & flood DoS
+    if (checkRateLimit && !checkRateLimit(req, res)) {
+      return;
+    }
+
     let url;
     try {
       url = new URL(req.url, `http://${req.headers.host || 'localhost'}`);
@@ -226,12 +274,31 @@ export function createServer({ host = '127.0.0.1', port = 7317, token = null, qu
         return sendJSON(res, 200, { jobs: jobs.list() });
       }
 
+      const jobReportMatch = route.match(/^\/api\/jobs\/([\w-]+)\/report$/);
+      if (jobReportMatch && method === 'GET') {
+        const full = jobs.get(jobReportMatch[1]);
+        if (!full) return sendJSON(res, 404, { error: 'unknown job' });
+        if (!full.result) return sendJSON(res, 404, { error: 'scan has no result' });
+        return sendJSON(res, 200, { job: jobs._public(full), result: full.result });
+      }
+
+      const jobMatch = route.match(/^\/api\/jobs\/([\w-]+)$/);
+      if (jobMatch && method === 'GET') {
+        const full = jobs.get(jobMatch[1]);
+        if (!full) return sendJSON(res, 404, { error: 'unknown job' });
+        return sendJSON(res, 200, { job: jobs._public(full) });
+      }
+
       const cancelMatch = route.match(/^\/api\/jobs\/([\w-]+)\/cancel$/);
       if (cancelMatch && method === 'POST') {
         const result = jobs.cancel(cancelMatch[1]);
         return result.ok ? sendJSON(res, 200, { cancelled: true }) : sendJSON(res, 409, { error: result.error });
       }
 
+      if (route === '/api/agents' && method === 'GET') {
+        return sendJSON(res, 200, { agents: AGENT_ROSTER });
+      }
+
       // ── Server-sent events for live progress ────────────────────────────────
       // Must be matched BEFORE the /api/ catch-all below, or it is unreachable.
       const eventsMatch = route.match(/^\/api\/jobs\/([\w-]+)\/events$/);
@@ -283,157 +350,4 @@ export function createServer({ host = '127.0.0.1', port = 7317, token = null, qu
   });
 
   return { server, jobs };
-}
-
-/** Frontend shell. Generated in memory — nothing is read from disk (threat T6). */
-function renderFrontend() {
-  return `<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width,initial-scale=1">
-<title>Praxis Web</title>
-<style>${baseStyles()}
-body{padding:1.5rem}
-.toolbar{display:flex;gap:0.6rem;align-items:center;flex-wrap:wrap;margin-bottom:1rem}
-input[type=text]{background:#070a14;border:1px solid #1e293b;border-radius:6px;padding:0.45rem 0.8rem;color:#f8fafc;font-size:0.85rem}
-button{background:#38bdf8;color:#090d16;border:0;border-radius:6px;padding:0.45rem 0.9rem;font-weight:700;font-size:0.82rem;cursor:pointer}
-button.ghost{background:#131d33;color:#94a3b8;border:1px solid #1e293b}
-table td:last-child{white-space:nowrap}
-</style>
-</head>
-<body>
-<div class="container">
-  <div class="card">
-    <div class="card-title">Praxis Web <span class="muted" style="font-size:0.8rem">read-only &middot; loopback</span></div>
-    <div class="toolbar">
-      <input type="text" id="path" placeholder="absolute path to a project directory" size="44">
-      <button onclick="addProject()">Register</button>
-      <button class="ghost" onclick="refresh()">Refresh</button>
-    </div>
-    <p class="muted" style="font-size:0.8rem;margin-top:0">
-      Paths are resolved and pinned server-side; after registration the API addresses projects by id only.
-      This UI cannot apply fixes.
-    </p>
-  </div>
-
-  <div class="card"><div class="card-title">Projects</div>
-    <div class="table-responsive"><table>
-      <thead><tr><th>Name</th><th>Path</th><th>Status</th><th>Actions</th></tr></thead>
-      <tbody id="projects"><tr><td colspan="4" class="empty-state">Loading…</td></tr></tbody>
-    </table></div>
-  </div>
-
-  <div class="card"><div class="card-title">Scans</div>
-    <div class="table-responsive"><table>
-      <thead><tr><th>Job</th><th>Project</th><th>Status</th><th>Progress</th><th>Findings</th></tr></thead>
-      <tbody id="jobs"><tr><td colspan="5" class="empty-state">No scans yet</td></tr></tbody>
-    </table></div>
-  </div>
-</div>
-
-<script>
-const H = { 'X-Praxis-Client': 'praxis-web' };
-const api = (m, p, b) => fetch(p, {
-  method: m,
-  headers: b ? { ...H, 'Content-Type': 'application/json' } : H,
-  body: b ? JSON.stringify(b) : undefined,
-}).then(async r => {
-  const data = await r.json().catch(() => ({}));
-  if (!r.ok) throw new Error(data.error || ('HTTP ' + r.status));
-  return data;
-});
-const esc = s => String(s ?? '').replace(/[&<>"']/g, c =>
-  ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#039;' }[c]));
-
-async function refresh() {
-  const [{ projects }, { jobs }] = await Promise.all([
-    api('GET', '/api/projects'), api('GET', '/api/jobs')]);
-
-  document.getElementById('projects').innerHTML = projects.length ? projects.map(p => \` // praxis-ignore XSS_INNERHTML — intentional sink; all dynamic values escaped via esc() (frontend interpolations audited)
-    <tr>
-      <td><strong>\${esc(p.name)}</strong></td>
-      <td><code>\${esc(p.root)}</code></td>
-      <td>\${p.present ? '<span class="tag tag-clear">available</span>' : '<span class="tag tag-flagged">path missing</span>'}</td>
-      <td><button onclick="scan('\${esc(p.id)}')">Scan</button>
-          <button class="ghost" onclick="remove('\${esc(p.id)}')">Remove</button></td>
-    </tr>\`).join('') : '<tr><td colspan="4" class="empty-state">No projects registered</td></tr>';
-
-  document.getElementById('jobs').innerHTML = jobs.length ? jobs.slice().reverse().map(j => \` // praxis-ignore XSS_INNERHTML — intentional sink; all dynamic values escaped via esc() (audited)
-    <tr>
-      <td><code>\${esc(j.id)}</code></td>
-      <td>\${esc(j.projectName)}</td>
-      <td>\${esc(j.status)}\${j.error ? ' — ' + esc(j.error) : ''}</td>
-      <td>\${j.progress.total ? j.progress.done + '/' + j.progress.total + (j.progress.current ? ' (' + esc(j.progress.current) + ')' : '') : '—'}</td>
-      <td>\${j.hasResult ? '<a href="#" data-job="' + esc(j.id) + '" class="job-link">view</a>' : '—'}</td>
-    </tr>\`).join('') : '<tr><td colspan="5" class="empty-state">No scans yet</td></tr>';
-}
-
-async function addProject() {
-  const path = document.getElementById('path').value.trim();
-  if (!path) return;
-  try { await api('POST', '/api/projects', { path }); document.getElementById('path').value = ''; refresh(); }
-  catch (e) { alert(e.message); }
-}
-
-async function scan(id) {
-  try {
-    const { job } = await api('POST', '/api/projects/' + id + '/scan');
-    watch(job.id);
-    setTimeout(refresh, 400);
-  } catch (e) { alert(e.message); }
-}
-
-async function remove(id) {
-  try { await api('DELETE', '/api/projects/' + id); refresh(); } catch (e) { alert(e.message); }
-}
-
-// Live progress via SSE; the server closes the stream when the job settles.
-function watch(jobId) {
-  const es = new EventSource('/api/jobs/' + jobId + '/events');
-  es.onmessage = ev => {
-    const j = JSON.parse(ev.data);
-    if (['done', 'failed', 'cancelled'].includes(j.status)) { es.close(); refresh(); }
-  };
-  es.onerror = () => { es.close(); refresh(); };
-}
-
-async function showReport(jobId) {
-  const ids = (await api('GET', '/api/jobs')).jobs.map(j => j.id);
-  const jobId2 = jobId || ids[0];
-  const d = await api('GET', '/api/jobs');
-  const job = d.jobs.find(j => j.id === jobId2);
-  if (!job) return;
-  const { result } = await api('GET', '/api/projects/' + job.projectId + '/report?job=' + job.id);
-  const rows = (result.findings || []).slice(0, 100).map(f => \`
-    <tr><td><span class="sev-badge sev-\${esc(f.severity)}">\${esc(f.severity)}</span></td>
-        <td><code>\${esc(f.file)}:\${esc(f.line)}</code></td>
-        <td><strong>\${esc(f.title)}</strong></td>
-        <td>\${esc(f.rule || '')}</td></tr>\`).join('');
-  document.body.insertAdjacentHTML('beforeend', \`
-    <div class="card" id="report">
-      <div class="card-title">Findings — \${esc(result.root || job.projectName)}
-        <span class="muted" style="font-size:0.8rem">\${(result.findings || []).length} finding(s) across \${result.agentCount} agents</span></div>
-      <div class="table-responsive"><table>
-        <thead><tr><th>Severity</th><th>Location</th><th>Issue</th><th>Rule</th></tr></thead>
-        <tbody>\${rows || '<tr><td colspan="4" class="empty-state">No findings</td></tr>'}</tbody>
-      </table></div>
-      <p class="muted" style="font-size:0.78rem;margin-top:0.8rem">Showing up to 100 findings.</p>
-    </div>\`);
-  document.getElementById('report').scrollIntoView({ behavior: 'smooth' });
-}
-
-// Job links are delegated too, so no id is ever interpolated into an inline
-// javascript handler (which would be a nested attribute/JS escaping context).
-document.addEventListener('click', function (e) {
-  const link = e.target.closest('.job-link');
-  if (!link) return;
-  e.preventDefault();
-  showReport(link.getAttribute('data-job'));
-});
-
-refresh();
-</script>
-</body>
-</html>`;
 }