praxis-sec 1.0.0

package/cli/agents/stateful-watcher.js

@@ -0,0 +1,238 @@
+/**
+ * StatefulWatcher — Persistent K2.6 Security Session
+ * ====================================================
+ *
+ * Keeps a Kimi K2.6 conversation thread open across file-change events.
+ * Each scan sends only the diff — not the full codebase — so the model
+ * builds understanding incrementally rather than restarting from scratch.
+ *
+ * Advantages over stateless watch:
+ *  - No duplicate findings on repeated scans of unchanged files
+ *  - Model understands which files are already clean vs. risky
+ *  - Diffs are small → faster, cheaper per event
+ *  - K2.6's 12h+ session length handles full work sessions without reset
+ *
+ * USAGE (via watch command):
+ *   npx praxis-sec watch . --deep --stateful
+ *   npx praxis-sec watch . --deep --stateful --provider kimi
+ */
+
+import fs from 'fs';
+import path from 'path';
+import { autoDetectProvider } from '../providers/llm-provider.js';
+import { createFinding } from './base-agent.js';
+
+// Max chars of diff content per event
+const MAX_DIFF_CHARS = 20_000;
+
+// =============================================================================
+// STATEFUL WATCHER
+// =============================================================================
+
+export class StatefulWatcher {
+  /**
+   * @param {object} options
+   * @param {object}  options.provider    — LLM provider (Kimi preferred)
+   * @param {string}  options.rootPath
+   * @param {boolean} options.verbose
+   */
+  constructor(options = {}) {
+    this.provider = options.provider;
+    this.rootPath = options.rootPath;
+    this.verbose = options.verbose || false;
+
+    // Persistent conversation thread
+    this._messages = [];
+    this._scanCount = 0;
+    this._baselineSet = false;
+  }
+
+  static create(rootPath, options = {}) {
+    const providerName = typeof options.provider === 'string' ? options.provider : 'kimi';
+    const provider = autoDetectProvider(rootPath, { provider: providerName, model: options.model || 'kimi-k2.6' });
+    if (!provider) return null;
+    return new StatefulWatcher({ provider, rootPath, verbose: options.verbose });
+  }
+
+  /**
+   * Set the initial baseline — called once on watcher start.
+   * The model receives a codebase summary and primes its security context.
+   *
+   * @param {object} recon — Output from ReconAgent
+   * @param {string[]} files — All scannable files
+   */
+  async setBaseline(recon, files) {
+    const summary = this._buildReconSummary(recon);
+    const fileList = files
+      .slice(0, 200)
+      .map(f => path.relative(this.rootPath, f))
+      .join('\n');
+
+    const baselineMsg = `You are a persistent security monitor for this codebase. I will send you file changes as they happen. For each change, identify new security issues introduced by that specific change.
+
+Project context:
+${summary}
+
+File inventory (${files.length} total):
+${fileList}
+
+Respond to each update with a JSON array of findings. Use this format:
+[{"file":"<relative path>","line":<number>,"severity":"critical|high|medium|low","rule":"<rule-id>","title":"<title>","description":"<description>","remediation":"<fix>"}]
+
+If no new issues are introduced by the change, respond with an empty array: []
+Never include issues you already reported in previous messages.`;
+
+    this._messages.push({ role: 'user', content: baselineMsg });
+
+    try {
+      const ack = await this._callProvider('You are a security expert. Acknowledge you understand the codebase context.', this._messages);
+      this._messages.push({ role: 'assistant', content: ack });
+      this._baselineSet = true;
+      if (this.verbose) console.log(`  [Stateful] Baseline set. Provider: ${this.provider.name}`);
+    } catch (err) {
+      if (this.verbose) console.log(`  [Stateful] Baseline failed: ${err.message}`);
+    }
+  }
+
+  /**
+   * Analyze a set of changed files. Sends only diffs to the persistent session.
+   *
+   * @param {string[]} changedFiles — Absolute paths of changed files
+   * @returns {Promise<object[]>} — New findings introduced by this change
+   */
+  async analyzeChanges(changedFiles) {
+    if (!this._baselineSet) return [];
+    this._scanCount++;
+
+    const diffs = this._readChanges(changedFiles);
+    if (!diffs) return [];
+
+    const updateMsg = `Files changed (scan #${this._scanCount}):\n\n${diffs}\n\nWhat NEW security issues does this change introduce? Reply with the JSON findings array only.`;
+
+    this._messages.push({ role: 'user', content: updateMsg });
+
+    try {
+      const response = await this._callProvider(
+        'You are a persistent security monitor. Report only NEW issues from the latest change.',
+        this._messages
+      );
+
+      this._messages.push({ role: 'assistant', content: response });
+
+      const findings = this._parseFindings(response, changedFiles[0]);
+      if (this.verbose && findings.length > 0) {
+        console.log(`  [Stateful] Scan #${this._scanCount}: ${findings.length} new finding(s)`);
+      }
+      return findings;
+    } catch (err) {
+      if (this.verbose) console.log(`  [Stateful] Scan failed: ${err.message}`);
+      return [];
+    }
+  }
+
+  _readChanges(changedFiles) {
+    const parts = [];
+    let totalChars = 0;
+
+    for (const filePath of changedFiles) {
+      if (totalChars >= MAX_DIFF_CHARS) break;
+      try {
+        const relPath = path.relative(this.rootPath, filePath);
+        const content = fs.readFileSync(filePath, 'utf-8');
+        const snippet = content.slice(0, Math.min(5000, MAX_DIFF_CHARS - totalChars));
+        parts.push(`### ${relPath}\n\`\`\`\n${snippet}\n\`\`\``);
+        totalChars += snippet.length;
+      } catch { /* skip */ }
+    }
+
+    return parts.length ? parts.join('\n\n') : null;
+  }
+
+  _buildReconSummary(recon) {
+    if (!recon) return 'No recon data.';
+    const parts = [];
+    if (recon.frameworks?.length) parts.push(`Frameworks: ${recon.frameworks.join(', ')}`);
+    if (recon.databases?.length)  parts.push(`Databases: ${recon.databases.join(', ')}`);
+    if (recon.authPatterns?.length) parts.push(`Auth: ${recon.authPatterns.join(', ')}`);
+    if (recon.languages?.length)  parts.push(`Languages: ${recon.languages.join(', ')}`);
+    return parts.join('\n') || 'General codebase.';
+  }
+
+  async _callProvider(systemPrompt, messages) {
+    // Use multi-turn messages if provider supports it (OpenAI format)
+    if (this.provider.baseUrl && typeof this.provider.complete === 'function') {
+      const response = await fetch(this.provider.baseUrl, {
+        method: 'POST',
+        headers: {
+          'Authorization': `Bearer ${this.provider.apiKey}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          model: this.provider.model,
+          max_tokens: 2048,
+          messages: [
+            { role: 'system', content: systemPrompt },
+            ...messages,
+          ],
+        }),
+      });
+
+      if (!response.ok) {
+        throw new Error(`${this.provider.name} API error: HTTP ${response.status}`);
+      }
+
+      const data = await response.json();
+      return data.choices?.[0]?.message?.content || '';
+    }
+
+    // Fallback: single-turn (for providers without persistent context)
+    const lastMsg = messages[messages.length - 1];
+    return this.provider.complete(systemPrompt, lastMsg?.content || '', { maxTokens: 2048 });
+  }
+
+  _parseFindings(text, refFile) {
+    const cleaned = text
+      .replace(/^```(?:json)?\s*/i, '')
+      .replace(/\s*```\s*$/i, '')
+      .trim();
+
+    try {
+      const raw = JSON.parse(cleaned);
+      if (!Array.isArray(raw)) return [];
+
+      return raw
+        .filter(r => r.title && r.severity)
+        .map(r => {
+          const filePath = r.file
+            ? path.resolve(this.rootPath, r.file)
+            : refFile || null;
+
+          return createFinding({
+            file: filePath,
+            line: r.line || 0,
+            severity: ['critical', 'high', 'medium', 'low', 'info'].includes(r.severity) ? r.severity : 'medium',
+            confidence: 'medium',
+            rule: r.rule || 'stateful:monitor',
+            title: r.title,
+            description: r.description || r.title,
+            matched: '',
+            remediation: r.remediation || '',
+            category: 'Stateful Monitor',
+          });
+        });
+    } catch {
+      return [];
+    }
+  }
+
+  getStats() {
+    return {
+      scanCount: this._scanCount,
+      provider: this.provider?.name || 'none',
+      model: this.provider?.model || 'unknown',
+      messageCount: this._messages.length,
+    };
+  }
+}
+
+export default StatefulWatcher;

package/cli/agents/supabase-rls-agent.js

@@ -0,0 +1,154 @@
+/**
+ * SupabaseRLSAgent
+ * =================
+ *
+ * Detects missing or weak Row Level Security (RLS) in Supabase projects.
+ * Checks SQL migrations, client-side service_role key usage,
+ * unprotected storage operations, and anon-key data mutations.
+ */
+
+import fs from 'fs';
+import path from 'path';
+import { BaseAgent, createFinding } from './base-agent.js';
+
+// Patterns for client-side code
+export const CLIENT_PATTERNS = [
+  {
+    rule: 'SUPABASE_SERVICE_KEY_CLIENT',
+    title: 'Supabase: Service Role Key in Client Code',
+    regex: /SUPABASE_SERVICE_ROLE_KEY|service_role_key|serviceRoleKey|supabaseAdmin/g,
+    severity: 'critical',
+    cwe: 'CWE-798',
+    owasp: 'A07:2021',
+    description: 'Service role key bypasses RLS entirely. Never expose it in client-side code.',
+    fix: 'Use the anon key on the client. Move service_role operations to a backend/edge function.',
+  },
+  {
+    rule: 'SUPABASE_RLS_DISABLED',
+    title: 'Supabase: RLS Bypass via .rpc() or Admin Client',
+    regex: /\.rpc\s*\(\s*['"][^'"]+['"]/g,
+    severity: 'high',
+    cwe: 'CWE-284',
+    owasp: 'A01:2021',
+    confidence: 'medium',
+    description: 'Supabase .rpc() calls execute database functions that may bypass RLS policies.',
+    fix: 'Ensure the underlying SQL function uses SECURITY DEFINER carefully, or set search_path.',
+  },
+  {
+    rule: 'SUPABASE_PUBLIC_ANON_INSERT',
+    title: 'Supabase: Unguarded Insert/Update/Delete',
+    regex: /supabase\s*\.from\s*\(\s*['"][^'"]+['"]\s*\)\s*\.(?:insert|update|delete|upsert)\s*\(/g,
+    severity: 'high',
+    cwe: 'CWE-284',
+    owasp: 'A01:2021',
+    confidence: 'medium',
+    description: 'Supabase data mutation without visible auth check. Ensure RLS policies protect this table.',
+    fix: 'Verify RLS is enabled on the table and policies restrict mutations to authenticated users.',
+  },
+  {
+    rule: 'SUPABASE_UNPROTECTED_STORAGE',
+    title: 'Supabase: Storage Operation Without Auth',
+    regex: /supabase\s*\.storage\s*\.from\s*\(\s*['"][^'"]+['"]\s*\)\s*\.(?:upload|remove|move|createSignedUrl|list)\s*\(/g,
+    severity: 'medium',
+    cwe: 'CWE-284',
+    owasp: 'A01:2021',
+    confidence: 'medium',
+    description: 'Supabase storage operation detected. Ensure storage policies restrict access.',
+    fix: 'Configure storage bucket policies to require authentication.',
+  },
+];
+
+// Client-side directories (findings here are more severe)
+const CLIENT_DIRS = /(?:^|[/\\])(?:src|pages|app|components|hooks|lib|utils)[/\\]/i;
+
+export class SupabaseRLSAgent extends BaseAgent {
+  constructor() {
+    super('SupabaseRLSAgent', 'Supabase Row Level Security audit', 'auth');
+  }
+
+  shouldRun(recon) {
+    return recon?.databases?.includes('supabase') ||
+           recon?.authPatterns?.includes('supabase-auth') ||
+           false;
+  }
+
+  async analyze(context) {
+    const { rootPath, files } = context;
+    let findings = [];
+
+    // ── 1. Scan client-side code for Supabase security issues ─────────────────
+    const codeFiles = files.filter(f => {
+      const ext = path.extname(f).toLowerCase();
+      return ['.js', '.jsx', '.ts', '.tsx', '.mjs', '.vue', '.svelte'].includes(ext);
+    });
+
+    for (const file of codeFiles) {
+      const fileFindings = this.scanFileWithPatterns(file, CLIENT_PATTERNS);
+      // Elevate severity for findings in client-side directories
+      const relPath = path.relative(rootPath, file).replace(/\\/g, '/');
+      if (CLIENT_DIRS.test(relPath)) {
+        for (const f of fileFindings) {
+          if (f.rule === 'SUPABASE_SERVICE_KEY_CLIENT') {
+            f.severity = 'critical';
+          }
+        }
+      }
+      findings = findings.concat(fileFindings);
+    }
+
+    // ── 2. Scan SQL migrations for missing RLS ────────────────────────────────
+    const sqlFiles = files.filter(f => path.extname(f).toLowerCase() === '.sql');
+    const tablesWithRLS = new Set();
+    const tablesWithoutRLS = [];
+
+    for (const file of sqlFiles) {
+      const content = this.readFile(file);
+      if (!content) continue;
+
+      // Find tables that have RLS enabled
+      const rlsMatches = content.matchAll(/ALTER\s+TABLE\s+(?:(?:public|auth|storage)\.)?["']?(\w+)["']?\s+ENABLE\s+ROW\s+LEVEL\s+SECURITY/gi);
+      for (const m of rlsMatches) {
+        tablesWithRLS.add(m[1].toLowerCase());
+      }
+
+      // Find CREATE TABLE statements
+      const createMatches = content.matchAll(/CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:(?:public|auth|storage)\.)?["']?(\w+)["']?/gi);
+      for (const m of createMatches) {
+        const tableName = m[1].toLowerCase();
+        // Skip Supabase internal tables
+        if (['_prisma_migrations', 'schema_migrations', 'knex_migrations'].includes(tableName)) continue;
+
+        // Check if RLS is enabled in the same file
+        const rlsInFile = new RegExp(
+          `ALTER\\s+TABLE\\s+(?:(?:public|auth|storage)\\.)?["']?${tableName}["']?\\s+ENABLE\\s+ROW\\s+LEVEL\\s+SECURITY`,
+          'gi'
+        ).test(content);
+
+        if (!rlsInFile && !tablesWithRLS.has(tableName)) {
+          tablesWithoutRLS.push({ table: tableName, file });
+        }
+      }
+    }
+
+    // Report tables missing RLS
+    for (const { table, file } of tablesWithoutRLS) {
+      // Double-check across all SQL files
+      if (tablesWithRLS.has(table)) continue;
+      findings.push(createFinding({
+        file,
+        line: 0,
+        severity: 'critical',
+        category: 'auth',
+        rule: 'SUPABASE_NO_RLS_POLICY',
+        title: `Supabase: Table "${table}" Missing RLS`,
+        description: `Table "${table}" is created without enabling Row Level Security. Any user with the anon key can read/write all rows.`,
+        matched: `CREATE TABLE ${table}`, // praxis-ignore SQL_INJECTION_TEMPLATE_LITERAL — detector matched-string construction
+        fix: `Add: ALTER TABLE ${table} ENABLE ROW LEVEL SECURITY;\nThen create appropriate policies with CREATE POLICY.`, // praxis-ignore SQL_INJECTION_TEMPLATE_LITERAL — dynamic detector text, not a real query
+      }));
+    }
+
+    return findings;
+  }
+}
+
+export default SupabaseRLSAgent;