praxis-sec 1.0.0

package/cli/agents/git-history-scanner.js

@@ -0,0 +1,169 @@
+/**
+ * GitHistoryScanner Agent
+ * ========================
+ *
+ * Scans git commit history for secrets that were committed
+ * and later removed but remain in repository history.
+ * These are the most dangerous secrets — developers think
+ * they're deleted but they're still accessible.
+ */
+
+import { execSync, execFileSync } from 'child_process';
+import path from 'path';
+import { BaseAgent, createFinding } from './base-agent.js';
+import { SECRET_PATTERNS } from '../utils/patterns.js';
+
+// Compile a fast combined regex from all secret patterns
+const FAST_SECRET_PATTERNS = SECRET_PATTERNS.map(p => ({
+  name: p.name,
+  pattern: p.pattern,
+  severity: p.severity,
+}));
+
+export class GitHistoryScanner extends BaseAgent {
+  constructor() {
+    super('GitHistoryScanner', 'Scan git history for leaked secrets', 'history');
+  }
+
+  async analyze(context) {
+    const { rootPath, options } = context;
+    const findings = [];
+
+    // Check if this is a git repository
+    if (!this.isGitRepo(rootPath)) return [];
+
+    try {
+      // Get recent commits (default: last 50, configurable)
+      const maxCommits = options?.maxCommits || 50;
+      const since = options?.since || null;
+
+      const gitArgs = ['-C', rootPath, 'log', '--all', '--diff-filter=A', '--diff-filter=M', '-p', '--no-color', `--max-count=${parseInt(maxCommits, 10)}`];
+      if (since) {
+        gitArgs.push(`--since=${since}`);
+      }
+
+      let diffOutput;
+      try {
+        diffOutput = execFileSync('git', gitArgs, {
+          cwd: rootPath,
+          encoding: 'utf-8',
+          maxBuffer: 50 * 1024 * 1024, // 50MB buffer
+          timeout: 60000, // 60s timeout
+        });
+      } catch {
+        // git log failed — might be a shallow clone or no history
+        return [];
+      }
+
+      if (!diffOutput) return [];
+
+      // Parse the diff output
+      let currentFile = '';
+      let currentCommit = '';
+      let currentDate = '';
+      const lines = diffOutput.split('\n');
+
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+
+        // Track current commit
+        if (line.startsWith('commit ')) {
+          currentCommit = line.slice(7, 17); // First 10 chars of hash
+        }
+        if (line.startsWith('Date:')) {
+          currentDate = line.slice(5).trim();
+        }
+
+        // Track current file
+        if (line.startsWith('diff --git ')) {
+          const match = line.match(/diff --git a\/(.+) b\//);
+          if (match) currentFile = match[1];
+        }
+
+        // Only check added lines (lines starting with +)
+        if (!line.startsWith('+') || line.startsWith('+++')) continue;
+
+        const addedLine = line.slice(1); // Remove the leading +
+
+        // Check against all secret patterns
+        for (const p of FAST_SECRET_PATTERNS) {
+          p.pattern.lastIndex = 0;
+          const match = p.pattern.exec(addedLine);
+          if (match) {
+            // Check if this secret still exists in current working tree
+            const stillExists = this.existsInWorkingTree(rootPath, match[0]);
+
+            findings.push(createFinding({
+              file: path.join(rootPath, currentFile),
+              line: 0, // Line number not meaningful in history
+              severity: stillExists ? p.severity : this.elevateSeverity(p.severity),
+              category: 'history',
+              rule: 'GIT_HISTORY_SECRET',
+              title: `Historical Secret: ${p.name}`,
+              description: stillExists
+                ? `Secret found in current code AND in git history (commit ${currentCommit}).`
+                : `Secret was removed from code but still exists in git history (commit ${currentCommit}, ${currentDate}). Anyone with repo access can retrieve it.`,
+              matched: this.maskSecret(match[0]),
+              confidence: 'high',
+              fix: stillExists
+                ? 'Remove from code, rotate the credential, then clean git history with BFG or git filter-repo'
+                : 'Rotate this credential immediately, then clean history: npx bfg --replace-text passwords.txt',
+            }));
+          }
+        }
+      }
+
+      // Deduplicate by matched value (same secret in multiple commits)
+      const seen = new Set();
+      return findings.filter(f => {
+        const key = `${f.matched}:${f.title}`;
+        if (seen.has(key)) return false;
+        seen.add(key);
+        return true;
+      });
+
+    } catch (err) {
+      // Don't fail the entire scan if git history scan fails
+      return [];
+    }
+  }
+
+  isGitRepo(dir) {
+    try {
+      execSync('git rev-parse --is-inside-work-tree', { cwd: dir, stdio: 'pipe' });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  existsInWorkingTree(rootPath, secret) {
+    try {
+      const result = execFileSync('git', [
+        '-C', rootPath, 'grep', '-F', '-l', secret
+      ], {
+        cwd: rootPath,
+        encoding: 'utf-8',
+        timeout: 5000,
+        stdio: ['pipe', 'pipe', 'pipe'],
+      });
+      return result.trim().length > 0;
+    } catch {
+      return false;
+    }
+  }
+
+  elevateSeverity(sev) {
+    // Secrets in history-only are MORE dangerous (developer thinks they're gone)
+    if (sev === 'medium') return 'high';
+    if (sev === 'high') return 'critical';
+    return sev;
+  }
+
+  maskSecret(secret) {
+    if (secret.length <= 10) return secret.slice(0, 4) + '***';
+    return secret.slice(0, 8) + '***' + secret.slice(-4);
+  }
+}
+
+export default GitHistoryScanner;

package/cli/agents/governance-audits.js

@@ -0,0 +1,138 @@
+/**
+ * Governance Absence-Audits (post-processor)
+ * ==========================================
+ *
+ * Detects MISSING controls rather than present bugs — evidence no generic
+ * regex scanner produces:
+ *
+ *   no-human-oversight — high-blast-radius agent tool authority (financial /
+ *                        destructive actions, excessive agency) with no
+ *                        approval-gate pattern anywhere in the repo.
+ *                        → EU AI Act Art. 14 / ISO 42001 A.12.4 evidence.
+ *
+ *   no-observability   — a repo that uses AI (LLM findings exist) but wires
+ *                        no AI tracing/observability stack at all.
+ *                        → EU AI Act Art. 12 / ISO 42001 A.6.2.6 evidence.
+ *
+ * Runs after the agent pool; findings are merged into the scan results.
+ */
+
+import fs from 'fs';
+import path from 'path';
+
+// Approval-gate patterns — presence of any of these near high-risk agent
+// actions counts as a human-oversight control.
+export const OVERSIGHT_PATTERNS = [
+  /interrupt_before/i, /interrupt_after/i, /human[_-]?in[_-]?the[_-]?loop/i,
+  /requires_approval/i, /confirmation_required/i, /requires_confirmation/i,
+  /approval[_-]?gate/i, /human[_-]?approval/i, /ask[_-]?for[_-]?confirmation/i,
+  /confirm[_-]?before/i, /await[_-]?confirmation/i, /approval[_-]?required/i,
+  /manual[_-]?review/i, /two[_-]?person[_-]?rule/i, /maker[_-]?checker/i,
+  /human[_-]?check/i, /approve[_-]?tool/i, /permission[_-]?request/i,
+  /consent[_-]?check/i, /guardrail/i,
+];
+
+// Financial / destructive / high-blast-radius agent action signals.
+const HIGH_RISK_ACTION = /financial|refund|payment|charge|transfer|withdraw|payout|invoice|delete|drop|truncate|purge|destroy|write_db|update_record|insert|modify|send_email|send_slack|send_sms|post_to|excessive.?agency|blast.?radius/i;
+
+// AI observability/tracing wiring indicators.
+const OBSERVABILITY_INDICATORS = [
+  /langsmith/i, /langfuse/i, /helicone/i, /traceloop/i, /openllmetry/i,
+  /openinference/i, /opentelemetry/i, /otel/i, /wandb\b/i, /weave\b/i,
+  /mlflow/i, /logfire/i, /arize/i, /phoenix\.arize/i, /braintrust/i,
+  /langtrace/i, /agentops/i, /lunary/i, /promptfoo/i, /deepeval/i,
+];
+
+// Files excluded from the observability check: dependency manifests and
+// lockfiles are not proof of wiring (a transitive dep isn't your tracing).
+const OBSERVABILITY_EXCLUDE = /(?:package-lock\.json|yarn\.lock|pnpm-lock\.yaml|poetry\.lock|requirements[^/]*\.txt|Cargo\.lock|go\.sum|composer\.lock|Gemfile\.lock|node_modules[\\/])/i;
+
+// Manifest-style files where tracing-adjacent names commonly appear as
+// dependencies even when nothing is wired.
+const MANIFEST_FILES = /(?:package\.json|requirements[^/]*\.txt|pyproject\.toml|Cargo\.toml|go\.mod|Gemfile)$/i;
+
+function readFileSafe(file) {
+  try {
+    return fs.readFileSync(file, 'utf8');
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * @param {object} args
+ * @param {string} args.rootPath   — project root
+ * @param {string[]} args.files    — files discovered by the orchestrator
+ * @param {object[]} args.findings — agent-pool findings for this run
+ * @returns {object[]} governance findings to merge
+ */
+export function runGovernanceAudits({ rootPath, files = [], findings = [] }) {
+  const audits = [];
+
+  // ── no-human-oversight ─────────────────────────────────────────────────
+  const riskyActions = findings.filter(f =>
+    HIGH_RISK_ACTION.test(`${f.rule || ''} ${f.title || ''}`)
+    && (f.category === 'llm' || f.category === 'agentic' || f.category === 'mcp' || f.rule?.startsWith('MCP_'))
+  );
+
+  if (riskyActions.length > 0) {
+    const repoHasOversight = files.some(f => OVERSIGHT_PATTERNS.some(re => re.test(readFileSafe(f))));
+    if (!repoHasOversight) {
+      const example = riskyActions[0];
+      audits.push({
+        file: example.file || path.join(rootPath, 'agent-config'),
+        line: 1,
+        column: 0,
+        severity: 'high',
+        category: 'llm',
+        rule: 'NO_HUMAN_OVERSIGHT',
+        title: 'High-Risk Agent Actions Without Human Oversight Gate',
+        description: `${riskyActions.length} finding(s) grant the agent high-blast-radius actions (financial, destructive, or broad tool authority), but no approval-gate pattern (interrupt_before, requires_approval, human_in_the_loop, ...) was found anywhere in the repository. EU AI Act Art. 14 requires effective human oversight for high-risk AI systems.`,
+        matched: `oversight patterns absent for ${riskyActions.length} risky action(s)`,
+        confidence: 'medium',
+        cwe: 'CWE-862',
+        owasp: 'ASI08',
+        eaa: 'EAA-002',
+        fix: 'Add human-approval gates before every financial/destructive agent action (framework interrupts, requires_approval flags, or a two-person rule).',
+      });
+    }
+  }
+
+  // ── no-observability ───────────────────────────────────────────────────
+  const usesAi = findings.some(f =>
+    f.category === 'llm' || f.category === 'agentic'
+    || /(?:llm|openai|anthropic|gemini|prompt|mcp|model|rag)/i.test(`${f.rule || ''} ${f.title || ''}`)
+  );
+
+  if (usesAi) {
+    const evidenceFiles = files.filter(f => {
+      const rel = path.relative(rootPath, f).replace(/\\/g, '/');
+      if (OBSERVABILITY_EXCLUDE.test(rel)) return false;
+      if (MANIFEST_FILES.test(path.basename(f))) return false;
+      return true;
+    });
+    const wired = evidenceFiles.some(f =>
+      OBSERVABILITY_INDICATORS.some(re => re.test(readFileSafe(f)))
+    );
+
+    if (!wired) {
+      audits.push({
+        file: path.join(rootPath, 'observability'),
+        line: 1,
+        column: 0,
+        severity: 'medium',
+        category: 'llm',
+        rule: 'NO_OBSERVABILITY',
+        title: 'AI in Use Without Observability/Tracing',
+        description: 'This project calls LLMs, but no AI tracing/observability wiring (LangSmith, Langfuse, Helicone, OpenTelemetry, ...) was found outside dependency manifests. Without traces you cannot detect prompt-injection events, monitor output quality, or respond to AI incidents — EU AI Act Art. 12 / ISO 42001 A.6.2.6.',
+        matched: `no tracing wiring in ${evidenceFiles.length} evidence file(s)`,
+        confidence: 'medium',
+        cwe: 'CWE-778',
+        owasp: 'ASI03',
+        fix: 'Wire an AI tracing/observability stack (e.g., Langfuse, Helicone, or OpenTelemetry) and log prompts, tool calls, and outputs with retention.',
+      });
+    }
+  }
+
+  return audits;
+}