praxis-sec 1.0.0 → 1.2.0

package/docs/THREAT_INTEL.md

@@ -6,7 +6,7 @@ other command that consumes the merged feed. It explains what each command
 does, how the system is laid out internally, and what knobs you can turn.
 
 For everything else (general CLI usage, scanning, hooks, etc.), see the main
-[`README.md`](./README.md).
+[`README.md`](../README.md) and the full [`USAGE.md`](USAGE.md) reference.
 
 ---
 

package/docs/USAGE.md

@@ -120,8 +120,34 @@ Full audit: secrets + 28 agents + deps + score + remediation plan.
 | `--agentic-target <score>` | Target security score for agentic loop |
 | `--hermes-only` | Run only Hermes-relevant agents |
 | `--fail-below <threshold>` | Exit 1 if score < threshold |
+| `-b, --branch <name>` | Branch or tag to scan (when target is a Git URL) |
+| `--depth <n>` | Git clone depth (default: 1 for shallow clone, 0 for full history) |
+| `--git-token <token>` | Auth token for private Git repositories (or set `PRAXIS_GIT_TOKEN` / `GITHUB_TOKEN`) |
+| `--git-history` | Include Git commit history secret audit |
+| `--keep-clone` | Retain cloned repository on disk after scan instead of deleting |
+| `--submodules` | Recursively clone Git submodules |
 | `-v, --verbose` | Verbose output |
 
+> **Direct Git Repository Scanning:** You can pass any remote Git URL directly to `praxis scan` (e.g., `praxis scan https://github.com/OWASP/wrongsecrets`). Praxis clones the repository into an isolated, secure temporary directory, executes the audit, and automatically purges the workspace upon completion.
+
+### `scan git <url>` / `scan repo <url>`
+
+Direct remote Git repository audit. Clones the remote repository to an isolated temporary workspace, runs the 28-agent audit, generates compliance and remediation reports, and cleans up the temporary files safely.
+
+```bash
+# Scan a public GitHub repository with depth 1 (fast SAST audit)
+praxis scan git https://github.com/OWASP/wrongsecrets
+
+# Scan a specific branch with full commit history secret audit
+praxis scan git https://github.com/org/repo -b staging --git-history
+
+# Scan a private repository using an auth token
+praxis scan git https://github.com/private-org/repo --git-token "$GITHUB_TOKEN" --json > report.json
+
+# Shorthand syntax also supported:
+praxis scan gh:OWASP/wrongsecrets
+```
+
 ### `scan secrets [path]`
 
 Fast pattern-based secret scan only (no agents).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "praxis-sec",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "Praxis — From finding to fix, on autopilot. AI-native security CLI with 28 parallel agents covering AI / MCP / skill threats, OWASP LLM Top 10, multi-source supply-chain intel (OSV / GHSA / KEV / EPSS / NVD / Gitleaks + optional paid feeds), secret scanning, and an LLM-powered agentic remediation loop.",
   "main": "cli/index.js",
   "bin": {
@@ -8,7 +8,7 @@
   },
   "type": "module",
   "scripts": {
-    "test": "node --test cli/__tests__/intel.test.js cli/__tests__/agents.test.js cli/__tests__/core.test.js cli/__tests__/standards.test.js cli/__tests__/model-file-scanner.test.js cli/__tests__/prompt-injection-prober.test.js cli/__tests__/ast-engine.test.js cli/__tests__/benchmark.test.js cli/__tests__/redteam.test.js cli/__tests__/html-reporter.test.js cli/__tests__/scan-fingerprint.test.js cli/__tests__/fix-ledger.test.js cli/__tests__/threatpack-probes.test.js cli/__tests__/score-history.test.js cli/__tests__/web-ui.test.js cli/__tests__/rule-portability.test.js",
+    "test": "node --test cli/__tests__/intel.test.js cli/__tests__/agents.test.js cli/__tests__/core.test.js cli/__tests__/standards.test.js cli/__tests__/model-file-scanner.test.js cli/__tests__/prompt-injection-prober.test.js cli/__tests__/ast-engine.test.js cli/__tests__/benchmark.test.js cli/__tests__/redteam.test.js cli/__tests__/html-reporter.test.js cli/__tests__/scan-fingerprint.test.js cli/__tests__/fix-ledger.test.js cli/__tests__/threatpack-probes.test.js cli/__tests__/score-history.test.js cli/__tests__/web-ui.test.js cli/__tests__/rule-portability.test.js cli/__tests__/git-remote.test.js",
     "test:determinism": "node scripts/check-determinism.mjs .",
     "lint": "eslint cli/",
     "praxis": "node cli/bin/praxis.js"