praxis-sec 1.0.0

package/cli/agents/prompt-injection-prober.js

@@ -0,0 +1,224 @@
+/**
+ * Prompt Injection Prober
+ * ========================
+ *
+ * Loads a probe corpus from cli/data/probes/prompt-injection-corpus.json and
+ * scans source code for static-detectable signals that match each probe.
+ *
+ * The corpus replaces hardcoded patterns: new probes are added by editing
+ * the JSON file. Each probe carries `tags` (e.g. ['LLM01', 'AML.T0051'])
+ * which feed into the standards registry automatically — once the agent
+ * tags a finding with the probe IDs, the per-finding `standards` field is
+ * populated by the ScoringEngine.
+ *
+ * Maps to: OWASP LLM01/05/06/07/08, MITRE ATLAS T0043/T0051/T0053/T0054/T0057/T0070.
+ */
+
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import { fileURLToPath } from 'url';
+import { BaseAgent, createFinding } from './base-agent.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const CORPUS_PATH = path.resolve(__dirname, '..', 'data', 'probes', 'prompt-injection-corpus.json');
+
+const SCAN_EXTS = new Set(['.js', '.jsx', '.mjs', '.cjs', '.ts', '.tsx', '.py', '.rb', '.go', '.java', '.rs', '.php']);
+
+let _cachedCorpus = null;
+
+/** Reads a JSON file, returning null rather than throwing. */
+function readJson(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, 'utf-8'));
+  } catch {
+    return null;
+  }
+}
+
+const THREATPACK_SEED = path.join(path.dirname(CORPUS_PATH), '..', 'threatpacks', 'latest.json');
+
+function loadCorpus() {
+  if (_cachedCorpus) return _cachedCorpus;
+  try {
+    const data = readJson(CORPUS_PATH) || {};
+    const categoryById = {};
+    for (const c of data.categories || []) categoryById[c.id] = c;
+
+    const decorate = (p) => {
+      const cat = categoryById[p.category] || {};
+      let regex;
+      try {
+        regex = compileProbeRegex(p.regex);
+      } catch {
+        regex = null;
+      }
+      return {
+        ...p,
+        patternSource: p.regex,
+        regex,
+        categoryTitle: cat.title || p.category,
+        tags: cat.tags || [],
+      };
+    };
+
+    // 1. Bundled prompt-injection corpus.
+    const probes = (data.probes || []).map(decorate);
+
+    // 2. Bundled threat-pack seed — the detection floor for this release.
+    //
+    // The seed used to be consulted only via `praxis intel update`. Loading it here
+    // means the shipped attack-vector families work on a first run with no network,
+    // and it makes the release's own signatures authoritative (P-IMP-064).
+    const seed = readJson(THREATPACK_SEED);
+    const seedVersion = seed?.version || null;
+    for (const p of seed?.probes || []) probes.push(decorate(p));
+
+    // 3. Overlay the fetched intel feed, which may bring newer signatures.
+    //
+    //    Version-gated per probe: a feed older than the bundled seed must not replace
+    //    a probe the release already ships. A stale `threat-intel.json` holding
+    //    threatpack 1.0.0 was reinstating the pre-fix TP-003 pattern
+    //    (`when\s+combined\s+with`, no referent, no instruction noun) and reporting
+    //    ordinary English as prompt injection. A feed newer than, or equal to, the
+    //    seed still wins, so updates keep working.
+    let feedApplied = 0;
+    let feedRejected = 0;
+    const feed = readJson(path.join(os.homedir(), '.praxis', 'threat-intel.json'));
+    const pack = feed?.threatPack;
+    const feedVersion = pack?.version || null;
+    const feedIsOlder = seedVersion && feedVersion
+      && compareVersions(feedVersion, seedVersion) < 0;
+
+    for (const p of pack?.probes || []) {
+      if (feedIsOlder) { feedRejected++; continue; }
+      const decorated = decorate(p);
+      const existing = probes.findIndex(x => x.id === p.id);
+      if (existing >= 0) probes[existing] = decorated;
+      else probes.push(decorated);
+      feedApplied++;
+    }
+
+    _cachedCorpus = {
+      version: data.version,
+      probes,
+      seedThreatPackVersion: seedVersion,
+      feedThreatPackVersion: feedVersion,
+      feedApplied,
+      feedRejected,
+    };
+    return _cachedCorpus;
+  } catch {
+    _cachedCorpus = { version: '0', probes: [], feedApplied: 0, feedRejected: 0 };
+    return _cachedCorpus;
+  }
+}
+
+/**
+ * Compares dotted version strings numerically. Returns <0, 0 or >0.
+ * Missing/invalid segments compare as 0, so `1.0` and `1.0.0` are equal.
+ */
+function compareVersions(a, b) {
+  const pa = String(a).split('.').map(n => parseInt(n, 10) || 0);
+  const pb = String(b).split('.').map(n => parseInt(n, 10) || 0);
+  const len = Math.max(pa.length, pb.length);
+  for (let i = 0; i < len; i++) {
+    const d = (pa[i] || 0) - (pb[i] || 0);
+    if (d !== 0) return d;
+  }
+  return 0;
+}
+
+function compileProbeRegex(pattern) {
+  let flags = 'g';
+  let body = pattern;
+  const m = body.match(/^\(\?([imsux]+)\)/);
+  if (m) {
+    for (const f of m[1]) if ('imsu'.includes(f) && !flags.includes(f)) flags += f;
+    body = body.slice(m[0].length);
+  }
+  // Scanner hardening: reject nested-quantifier constructs that risk
+  // catastrophic backtracking on adversarial input.
+  if (NESTED_QUANTIFIER.test(body)) {
+    throw new Error('ReDoS-unsafe probe regex (nested quantifiers)');
+  }
+  return new RegExp(body, flags);
+}
+
+const NESTED_QUANTIFIER = /\((?:[^()\\]|\\.)*[+*]\)[+*{]/;
+
+export class PromptInjectionProber extends BaseAgent {
+  constructor() {
+    super(
+      'PromptInjectionProber',
+      'Probe-corpus-driven scan for prompt-injection patterns (OWASP LLM01, ATLAS T0043/T0051)',
+      'llm'
+    );
+    this._corpus = loadCorpus();
+    this.probeCount = this._corpus.probes.length;
+  }
+
+  shouldRun(recon) {
+    if (!recon) return true;
+    const langs = recon.languages instanceof Set ? [...recon.languages] : (recon.languages || []);
+    if (langs.some(l => ['javascript', 'typescript', 'python', 'ruby', 'go', 'java', 'rust', 'php'].includes(l))) {
+      return true;
+    }
+    return Boolean(recon.frameworks?.length || recon.apiRoutes?.length);
+  }
+
+  async analyze(context) {
+    const findings = [];
+    const probes = this._corpus.probes.filter(p => p.regex);
+    if (probes.length === 0) return findings;
+
+    const files = this.getFilesToScan(context).filter(f => SCAN_EXTS.has(path.extname(f).toLowerCase()));
+
+    for (const file of files) {
+      const content = this.readFile(file);
+      if (!content) continue;
+      const lines = content.split('\n');
+
+      for (const probe of probes) {
+        probe.regex.lastIndex = 0;
+        let match;
+        while ((match = probe.regex.exec(content)) !== null) {
+          const idx = match.index;
+          const before = content.slice(0, idx);
+          const lineNum = before.split('\n').length;
+          const lastNl = before.lastIndexOf('\n');
+          const column = lastNl === -1 ? idx + 1 : idx - lastNl;
+          const lineText = lines[lineNum - 1] || '';
+          if (this.isSuppressed(lineText)) continue;
+
+          const finding = createFinding({
+            file,
+            line: lineNum,
+            column,
+            severity: probe.severity || 'medium',
+            category: 'llm',
+            rule: `PROBE_${probe.id}`,
+            title: probe.title,
+            description: probe.description,
+            matched: match[0].slice(0, 160),
+            confidence: 'medium',
+            cwe: 'CWE-77',
+            owasp: 'ASI01',
+            fix: probe.fix || 'Sanitize untrusted input before LLM prompt construction.',
+          });
+          finding.probe = { id: probe.id, category: probe.category, tags: probe.tags };
+          findings.push(finding);
+
+          if (!probe.regex.global) break;
+          if (match.index === probe.regex.lastIndex) probe.regex.lastIndex++;
+        }
+      }
+    }
+
+    return findings;
+  }
+}
+
+export const _internals = { loadCorpus, compileProbeRegex, CORPUS_PATH };
+export default PromptInjectionProber;

package/cli/agents/rag-security-agent.js

@@ -0,0 +1,204 @@
+/**
+ * RAG Security Agent
+ * ====================
+ *
+ * Detects security vulnerabilities in Retrieval-Augmented Generation
+ * (RAG) implementations. RAG poisoning attacks are a proven threat
+ * vector — attackers corrupt knowledge bases to manipulate LLM outputs.
+ *
+ * Checks: unvalidated document ingestion, missing chunk isolation,
+ * embedding exposure, metadata leakage, no retrieval filtering,
+ * excessive context stuffing.
+ *
+ * Maps to: OWASP LLM08 (Vector & Embedding Weaknesses),
+ *          OWASP Agentic AI ASI04 (Memory Poisoning)
+ */
+
+import path from 'path';
+import { BaseAgent } from './base-agent.js';
+
+// =============================================================================
+// RAG SECURITY PATTERNS
+// =============================================================================
+
+export const PATTERNS = [
+  // ── Document Ingestion ───────────────────────────────────────────────────
+  {
+    rule: 'RAG_UNSANITIZED_INGESTION',
+    title: 'RAG: Documents Ingested Without Sanitization',
+    regex: /(?:addDocuments|add_documents|upsert|insert|index\.add|from_documents)\s*\(\s*(?:documents|docs|chunks|texts|pages|uploads|files|userDocs|userFiles)/g,
+    severity: 'high',
+    cwe: 'CWE-20',
+    owasp: 'A03:2021',
+    description: 'Documents added to vector store without sanitization. Attackers can embed malicious instructions in documents that get retrieved and injected into LLM context.',
+    fix: 'Sanitize document content before ingestion: strip HTML/script tags, detect prompt injection patterns, validate content type.',
+  },
+  {
+    rule: 'RAG_USER_UPLOAD_TO_VECTORDB',
+    title: 'RAG: User Upload Directly to Vector Store',
+    regex: /(?:upload|multer|formidable|busboy|req\.file|req\.files)[\s\S]{0,500}(?:addDocuments|add_documents|upsert|vectorStore|index\.add|embed|from_documents)/g, // praxis-ignore RAG_USER_UPLOAD_TO_VECTORDB — detector definition
+    severity: 'critical',
+    cwe: 'CWE-434',
+    owasp: 'A03:2021',
+    description: 'User file uploads are fed directly into a vector database without review. This enables RAG poisoning — attackers upload documents containing hidden instructions.',
+    fix: 'Add a review/approval pipeline between user uploads and vector store ingestion. Scan uploads for prompt injection patterns.',
+  },
+  {
+    rule: 'RAG_NO_CONTENT_FILTER',
+    title: 'RAG: No Content Filtering on Ingestion',
+    regex: /(?:TextLoader|PDFLoader|CSVLoader|DirectoryLoader|WebBaseLoader|UnstructuredLoader|load_and_split|loadDocuments)\s*\((?![\s\S]{0,300}(?:filter|sanitize|clean|validate|strip|remove|moderate))/g,
+    severity: 'medium',
+    cwe: 'CWE-20',
+    owasp: 'A03:2021',
+    confidence: 'medium',
+    description: 'Document loaders used without content filtering. Loaded content goes directly to embedding/vector store.',
+    fix: 'Add content filtering after loading documents: remove scripts, detect injection patterns, validate format.',
+  },
+
+  // ── Chunk Isolation ──────────────────────────────────────────────────────
+  {
+    rule: 'RAG_NO_TENANT_ISOLATION',
+    title: 'RAG: Vector Store Without Tenant Isolation',
+    regex: /(?:vectorStore|pinecone|chroma|weaviate|qdrant|milvus|pgvector)[\s\S]{0,300}(?:add|upsert|insert|index)(?![\s\S]{0,200}(?:namespace|tenant|partition|collection|filter|user_id|org_id|metadata.*(?:user|tenant|org)))/g,
+    severity: 'high',
+    cwe: 'CWE-284',
+    owasp: 'A01:2021',
+    confidence: 'medium',
+    description: 'Documents stored in vector database without tenant/user isolation. Users can retrieve other users\' private documents.',
+    fix: 'Use namespaces, collections, or metadata filters to isolate documents by tenant/user.',
+  },
+  {
+    rule: 'RAG_SYSTEM_DOCS_WITH_USER_DOCS',
+    title: 'RAG: System Documents Mixed With User Documents',
+    regex: /(?:addDocuments|add_documents|upsert)[\s\S]{0,200}(?:system|internal|private|admin)[\s\S]{0,200}(?:user|public|external|upload)/g,
+    severity: 'medium',
+    cwe: 'CWE-668',
+    owasp: 'A01:2021',
+    confidence: 'low',
+    description: 'System/internal documents mixed with user documents in the same collection. User queries could retrieve sensitive internal docs.',
+    fix: 'Separate system documents from user documents in different collections or namespaces.',
+  },
+
+  // ── Retrieval & Query Safety ─────────────────────────────────────────────
+  {
+    rule: 'RAG_NO_RETRIEVAL_FILTER',
+    title: 'RAG: Retrieved Chunks Used Without Filtering',
+    regex: /(?:similarity_search|similaritySearch|query|retrieve|get_relevant|asRetriever)[\s\S]{0,300}(?:page_content|pageContent|text|content|document)[\s\S]{0,200}(?:prompt|messages|content|system|user)/g,
+    severity: 'high',
+    cwe: 'CWE-74',
+    owasp: 'A03:2021',
+    confidence: 'medium',
+    description: 'Retrieved document chunks injected into LLM prompt without filtering. Poisoned documents can override system instructions.',
+    fix: 'Filter retrieved chunks: remove instruction-like content, apply relevance score thresholds, limit number of chunks.',
+  },
+  {
+    rule: 'RAG_NO_RELEVANCE_THRESHOLD',
+    title: 'RAG: No Relevance Score Threshold on Retrieval',
+    regex: /(?:similarity_search|similaritySearch|asRetriever)\s*\(\s*(?:query|question|input)(?![\s\S]{0,200}(?:score_threshold|scoreThreshold|threshold|minScore|min_score|filter))/g,
+    severity: 'medium',
+    cwe: 'CWE-20',
+    owasp: 'A03:2021',
+    confidence: 'low',
+    description: 'Vector similarity search without relevance threshold. Low-relevance chunks may contain poisoned content designed to be retrieved for many queries.',
+    fix: 'Set a minimum relevance score threshold to filter out low-quality matches.',
+  },
+  {
+    rule: 'RAG_EXCESSIVE_CONTEXT',
+    title: 'RAG: Excessive Retrieved Context',
+    regex: /(?:k\s*[:=]\s*(?:[5-9]\d|\d{3,})|top_k\s*[:=]\s*(?:[5-9]\d|\d{3,})|search_kwargs.*k.*(?:[5-9]\d|\d{3,}))/g,
+    severity: 'medium',
+    cwe: 'CWE-400',
+    owasp: 'A04:2021',
+    confidence: 'low',
+    description: 'Retrieving a very large number of chunks (50+). Increases the attack surface for prompt injection via poisoned documents.',
+    fix: 'Limit retrieved chunks to the minimum needed (typically 3-10). More chunks = more injection surface.',
+  },
+
+  // ── Embedding & Data Exposure ────────────────────────────────────────────
+  {
+    rule: 'RAG_EMBEDDING_API_EXPOSED',
+    title: 'RAG: Embedding Endpoint Exposed Without Auth',
+    regex: /(?:app\.|router\.|api\.)(?:get|post)\s*\(\s*['"].*(?:embed|embedding|vectorize|encode)['"](?![\s\S]{0,300}(?:auth|middleware|protect|guard|jwt|bearer|session))/g,
+    severity: 'high',
+    cwe: 'CWE-306',
+    owasp: 'A07:2021',
+    confidence: 'medium',
+    description: 'Embedding API endpoint exposed without authentication. Attackers can enumerate embeddings or generate vectors for injection attacks.',
+    fix: 'Add authentication middleware to embedding endpoints.',
+  },
+  {
+    rule: 'RAG_METADATA_IN_RESPONSE',
+    title: 'RAG: Internal Metadata Exposed in Response',
+    regex: /(?:metadata|source|file_path|filePath|url|author|timestamp)[\s\S]{0,100}(?:res\.json|res\.send|response\.json|return\s*\{|jsonify)/g,
+    severity: 'medium',
+    cwe: 'CWE-200',
+    owasp: 'A01:2021',
+    confidence: 'low',
+    description: 'Internal document metadata (file paths, sources, authors) returned in API responses. Leaks information about the knowledge base structure.',
+    fix: 'Strip internal metadata before returning responses. Only expose necessary fields to the client.',
+  },
+  {
+    rule: 'RAG_EMBEDDING_IN_RESPONSE',
+    title: 'RAG: Raw Embeddings Returned to Client',
+    regex: /(?:embedding|vector|dense_vector)[\s\S]{0,100}(?:res\.json|res\.send|response|return|output)/g,
+    severity: 'medium',
+    cwe: 'CWE-200',
+    owasp: 'A01:2021',
+    confidence: 'low',
+    description: 'Raw embedding vectors returned in API responses. Research shows embeddings can be inverted to recover original text, leaking private data.',
+    fix: 'Never return raw embedding vectors in API responses. Embeddings should remain server-side only.',
+  },
+
+  // ── Model & Pipeline Safety ──────────────────────────────────────────────
+  {
+    rule: 'RAG_PICKLE_EMBEDDING_MODEL',
+    title: 'RAG: Embedding Model Loaded via Pickle',
+    regex: /(?:torch\.load|pickle\.load|joblib\.load)\s*\(\s*(?!.*safetensors)(?!.*weights_only\s*=\s*True)/g,
+    severity: 'critical',
+    cwe: 'CWE-502',
+    owasp: 'A08:2021',
+    description: 'ML model loaded from pickle format. Pickle files can contain arbitrary code that executes on load.',
+    fix: 'Use safetensors format for model loading. If using torch.load(), set weights_only=True.',
+  },
+  {
+    rule: 'RAG_TRUST_REMOTE_CODE',
+    title: 'RAG: Model Loaded With trust_remote_code=True',
+    regex: /trust_remote_code\s*=\s*True/g,
+    severity: 'high',
+    cwe: 'CWE-94',
+    owasp: 'A08:2021',
+    description: 'Embedding or LLM model loaded with trust_remote_code=True. Allows execution of arbitrary code from the model repository.',
+    fix: 'Set trust_remote_code=False. Audit model code before enabling remote code execution.',
+  },
+];
+
+// =============================================================================
+// RAG SECURITY AGENT
+// =============================================================================
+
+export class RAGSecurityAgent extends BaseAgent {
+  constructor() {
+    super(
+      'RAGSecurityAgent',
+      'Detect RAG security vulnerabilities — poisoning, embedding exposure, tenant isolation gaps',
+      'llm'
+    );
+  }
+
+  async analyze(context) {
+    const { files } = context;
+
+    const codeFiles = files.filter(f => {
+      const ext = path.extname(f).toLowerCase();
+      return ['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.py', '.rb', '.go', '.java'].includes(ext);
+    });
+
+    let findings = [];
+    for (const file of codeFiles) {
+      findings = findings.concat(this.scanFileWithPatterns(file, PATTERNS));
+    }
+    return findings;
+  }
+}
+
+export default RAGSecurityAgent;

package/cli/agents/recon-agent.js

@@ -0,0 +1,207 @@
+/**
+ * ReconAgent — Attack Surface Discovery
+ * =======================================
+ *
+ * Maps the full attack surface before other agents run.
+ * Detects frameworks, API routes, auth patterns, databases,
+ * cloud providers, and frontend exposure.
+ */
+
+import fs from 'fs';
+import path from 'path';
+import { BaseAgent } from './base-agent.js';
+
+export class ReconAgent extends BaseAgent {
+  constructor() {
+    super('ReconAgent', 'Attack surface discovery and mapping', 'recon');
+  }
+
+  async analyze(context) {
+    const { rootPath } = context;
+    const files = await this.discoverFiles(rootPath);
+
+    const recon = {
+      frameworks: [],
+      languages: new Set(),
+      apiRoutes: [],
+      authPatterns: [],
+      databases: [],
+      cloudProviders: [],
+      frontendExposure: [],
+      packageManagers: [],
+      cicd: [],
+      hasDockerfile: false,
+      hasTerraform: false,
+      hasKubernetes: false,
+      envFiles: [],
+      configFiles: [],
+      hasModelFiles: false,
+      modelFiles: [],
+    };
+
+    const MODEL_EXT_SET = new Set(['.pkl', '.pickle', '.pt', '.pth', '.ckpt', '.safetensors', '.gguf', '.onnx', '.h5', '.hdf5', '.pb']);
+    const MODEL_BASENAME_RE = /^(?:pytorch_model\.bin|model\.bin|consolidated\..+\.bin)$/;
+
+    // ── Detect by config files ────────────────────────────────────────────────
+    for (const file of files) {
+      const basename = path.basename(file);
+      const relPath = path.relative(rootPath, file).replace(/\\/g, '/');
+      const ext = path.extname(file).toLowerCase();
+
+      // Languages
+      if (['.js', '.jsx', '.mjs', '.cjs'].includes(ext)) recon.languages.add('javascript');
+      if (['.ts', '.tsx'].includes(ext)) recon.languages.add('typescript');
+      if (ext === '.py') recon.languages.add('python');
+      if (ext === '.rb') recon.languages.add('ruby');
+      if (ext === '.go') recon.languages.add('go');
+      if (ext === '.java') recon.languages.add('java');
+      if (ext === '.rs') recon.languages.add('rust');
+      if (ext === '.php') recon.languages.add('php');
+
+      // Frameworks
+      if (basename === 'next.config.js' || basename === 'next.config.mjs' || basename === 'next.config.ts') {
+        recon.frameworks.push('nextjs');
+      }
+      if (basename === 'nuxt.config.ts' || basename === 'nuxt.config.js') recon.frameworks.push('nuxtjs');
+      if (basename === 'svelte.config.js') recon.frameworks.push('sveltekit');
+      if (basename === 'remix.config.js') recon.frameworks.push('remix');
+      if (basename === 'astro.config.mjs' || basename === 'astro.config.ts') recon.frameworks.push('astro');
+      if (basename === 'angular.json') recon.frameworks.push('angular');
+      if (basename === 'vite.config.ts' || basename === 'vite.config.js') recon.frameworks.push('vite');
+      if (basename === 'manage.py') recon.frameworks.push('django');
+      if (basename === 'Gemfile' && this.readFile(file)?.includes('rails')) recon.frameworks.push('rails');
+      if (basename === 'pubspec.yaml') recon.frameworks.push('flutter');
+
+      // API Routes
+      if (relPath.match(/app\/api\/.*\.(js|ts)$/) || relPath.match(/pages\/api\/.*\.(js|ts)$/)) {
+        recon.apiRoutes.push(relPath);
+      }
+      if (relPath.match(/routes?\.(js|ts)$/) || relPath.match(/router\.(js|ts)$/)) {
+        recon.apiRoutes.push(relPath);
+      }
+      if (relPath.match(/urls\.py$/)) recon.apiRoutes.push(relPath);
+      if (relPath.match(/controllers?\/.*\.(js|ts|rb)$/)) recon.apiRoutes.push(relPath);
+
+      // Auth
+      if (basename === 'auth.ts' || basename === 'auth.js' || relPath.includes('auth/')) {
+        recon.authPatterns.push(relPath);
+      }
+      if (basename === 'middleware.ts' || basename === 'middleware.js') {
+        recon.authPatterns.push(relPath);
+      }
+
+      // Databases
+      if (basename === 'schema.prisma') recon.databases.push('prisma');
+      if (basename === 'drizzle.config.ts' || basename === 'drizzle.config.js') recon.databases.push('drizzle');
+      if (relPath.includes('models/') && ['.py', '.rb'].includes(ext)) recon.databases.push('orm');
+
+      // Cloud
+      if (basename === 'vercel.json') recon.cloudProviders.push('vercel');
+      if (basename === 'netlify.toml') recon.cloudProviders.push('netlify');
+      if (basename === 'fly.toml') recon.cloudProviders.push('fly');
+      if (basename === 'app.yaml' || basename === 'app.yml') recon.cloudProviders.push('gcp');
+      if (basename === 'serverless.yml' || basename === 'serverless.yaml') recon.cloudProviders.push('aws-serverless');
+      if (basename === 'render.yaml') recon.cloudProviders.push('render');
+      if (basename === 'railway.json') recon.cloudProviders.push('railway');
+
+      // IaC
+      if (ext === '.tf') recon.hasTerraform = true;
+      if (basename === 'Dockerfile' || basename.startsWith('Dockerfile.')) recon.hasDockerfile = true;
+      if (basename.match(/\.ya?ml$/) && relPath.match(/(k8s|kubernetes|deploy|helm)/i)) {
+        recon.hasKubernetes = true;
+      }
+
+      // CI/CD
+      if (relPath.startsWith('.github/workflows/')) recon.cicd.push({ platform: 'github-actions', file: relPath });
+      if (basename === '.gitlab-ci.yml') recon.cicd.push({ platform: 'gitlab', file: relPath });
+      if (basename === 'Jenkinsfile') recon.cicd.push({ platform: 'jenkins', file: relPath });
+      if (basename === '.circleci/config.yml' || relPath.startsWith('.circleci/')) recon.cicd.push({ platform: 'circleci', file: relPath });
+      if (basename === 'bitbucket-pipelines.yml') recon.cicd.push({ platform: 'bitbucket', file: relPath });
+      if (basename === 'azure-pipelines.yml') recon.cicd.push({ platform: 'azure', file: relPath });
+
+      // Package managers
+      if (basename === 'package.json') recon.packageManagers.push('npm');
+      if (basename === 'Pipfile' || basename === 'requirements.txt' || basename === 'pyproject.toml') recon.packageManagers.push('pip');
+      if (basename === 'Gemfile') recon.packageManagers.push('bundler');
+      if (basename === 'go.mod') recon.packageManagers.push('go');
+      if (basename === 'Cargo.toml') recon.packageManagers.push('cargo');
+      if (basename === 'composer.json') recon.packageManagers.push('composer');
+
+      // ML model artifacts
+      if (MODEL_EXT_SET.has(ext) || MODEL_BASENAME_RE.test(basename)) {
+        recon.hasModelFiles = true;
+        if (recon.modelFiles.length < 200) recon.modelFiles.push(relPath);
+      }
+
+      // Env files
+      if (basename.startsWith('.env')) recon.envFiles.push(relPath);
+
+      // Config files
+      if (['vercel.json', 'netlify.toml', 'next.config.js', 'next.config.mjs',
+           'next.config.ts', 'docker-compose.yml', 'docker-compose.yaml',
+           'nginx.conf', 'Caddyfile', 'firebase.json', 'supabase/config.toml'
+          ].includes(basename)) {
+        recon.configFiles.push(relPath);
+      }
+    }
+
+    // ── Detect frontend exposure from package.json ────────────────────────────
+    const pkgPath = path.join(rootPath, 'package.json');
+    if (fs.existsSync(pkgPath)) {
+      try {
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+        const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+
+        if (allDeps['express']) recon.frameworks.push('express');
+        if (allDeps['fastify']) recon.frameworks.push('fastify');
+        if (allDeps['hono']) recon.frameworks.push('hono');
+        if (allDeps['@hono/node-server']) recon.frameworks.push('hono');
+        if (allDeps['koa']) recon.frameworks.push('koa');
+        if (allDeps['flask'] || allDeps['Flask']) recon.frameworks.push('flask');
+        if (allDeps['fastapi'] || allDeps['FastAPI']) recon.frameworks.push('fastapi');
+
+        // Auth libraries
+        if (allDeps['next-auth'] || allDeps['@auth/core']) recon.authPatterns.push('next-auth');
+        if (allDeps['@clerk/nextjs'] || allDeps['@clerk/clerk-react']) recon.authPatterns.push('clerk');
+        if (allDeps['@supabase/supabase-js']) { recon.authPatterns.push('supabase-auth'); recon.databases.push('supabase'); }
+        if (allDeps['firebase']) { recon.authPatterns.push('firebase-auth'); recon.databases.push('firebase'); }
+        if (allDeps['jsonwebtoken'] || allDeps['jose']) recon.authPatterns.push('jwt');
+        if (allDeps['passport']) recon.authPatterns.push('passport');
+
+        // Databases
+        if (allDeps['@prisma/client'] || allDeps['prisma']) recon.databases.push('prisma');
+        if (allDeps['drizzle-orm']) recon.databases.push('drizzle');
+        if (allDeps['sequelize']) recon.databases.push('sequelize');
+        if (allDeps['typeorm']) recon.databases.push('typeorm');
+        if (allDeps['mongoose'] || allDeps['mongodb']) recon.databases.push('mongodb');
+        if (allDeps['pg'] || allDeps['postgres']) recon.databases.push('postgres');
+        if (allDeps['mysql2'] || allDeps['mysql']) recon.databases.push('mysql');
+        if (allDeps['@upstash/redis']) recon.databases.push('upstash-redis');
+
+        // AI/LLM
+        if (allDeps['openai'] || allDeps['@anthropic-ai/sdk'] || allDeps['ai']) {
+          recon.frameworks.push('ai-app');
+        }
+
+        // Mobile
+        if (allDeps['react-native'] || allDeps['expo']) recon.frameworks.push('react-native');
+
+      } catch { /* skip parse errors */ }
+    }
+
+    // Deduplicate arrays
+    recon.frameworks = [...new Set(recon.frameworks)];
+    recon.languages = [...recon.languages];
+    recon.authPatterns = [...new Set(recon.authPatterns)];
+    recon.databases = [...new Set(recon.databases)];
+    recon.cloudProviders = [...new Set(recon.cloudProviders)];
+    recon.packageManagers = [...new Set(recon.packageManagers)];
+
+    // Store on context for other agents
+    if (context) context.recon = recon;
+
+    return recon;
+  }
+}
+
+export default ReconAgent;