praxis-sec 1.0.0

package/cli/agents/swarm-orchestrator.js

@@ -0,0 +1,200 @@
+/**
+ * SwarmOrchestrator — K2.6-Powered Parallel Security Swarm
+ * ==========================================================
+ *
+ * Instead of running 28 agents locally in Node.js (chunks of 6),
+ * --swarm sends the entire task to Kimi K2.6 and lets its native
+ * 300-agent swarm handle parallel analysis.
+ *
+ * Each of Praxis's 23 attack classes is assigned as an explicit
+ * sub-agent role. K2.6 fans out, each sub-agent scans for its class,
+ * and results are returned as a consolidated findings array.
+ *
+ * Output is mapped back to Praxis's Finding format so SARIF,
+ * HTML reports, and CI exit codes work unchanged.
+ *
+ * USAGE:
+ *   npx praxis-sec red-team . --swarm
+ *   npx praxis-sec red-team . --swarm --provider kimi
+ */
+
+import fs from 'fs';
+import path from 'path';
+import { createProvider, autoDetectProvider } from '../providers/llm-provider.js';
+import { ReconAgent } from './recon-agent.js';
+import { createFinding } from './base-agent.js';
+
+// =============================================================================
+// AGENT ROLE DEFINITIONS — maps Praxis's 23 attack classes to swarm roles
+// =============================================================================
+
+const SWARM_ROLES = [
+  { id: 'injection',           name: 'Injection Tester',            desc: 'SQL injection, command injection, LDAP injection, XPath injection, template injection' },
+  { id: 'auth-bypass',         name: 'Auth Bypass Agent',           desc: 'Authentication bypass, authorization flaws, privilege escalation, JWT weaknesses' },
+  { id: 'ssrf',                name: 'SSRF Prober',                 desc: 'Server-side request forgery, SSRF via redirects, internal service exposure' },
+  { id: 'supply-chain',        name: 'Supply Chain Auditor',        desc: 'Dependency confusion, typosquatting, malicious packages, outdated deps with CVEs' },
+  { id: 'config',              name: 'Config Auditor',              desc: 'Hardcoded secrets, insecure defaults, exposed debug endpoints, misconfigured CORS' },
+  { id: 'llm-redteam',         name: 'LLM Red Team',               desc: 'Prompt injection, jailbreaks, unsafe LLM output rendering, model inversion' },
+  { id: 'mobile',              name: 'Mobile Scanner',             desc: 'Insecure data storage, weak crypto, insecure communication, exported components' },
+  { id: 'git-history',         name: 'Git History Scanner',        desc: 'Secrets committed in git history, deleted files with sensitive data' },
+  { id: 'cicd',                name: 'CI/CD Scanner',              desc: 'Insecure GitHub Actions, exposed secrets in workflows, artifact poisoning' },
+  { id: 'api-fuzzer',          name: 'API Fuzzer',                 desc: 'Missing input validation, mass assignment, insecure direct object references (IDOR)' },
+  { id: 'supabase-rls',        name: 'Supabase RLS Agent',         desc: 'Missing row-level security, exposed Supabase service keys, insecure RLS policies' },
+  { id: 'mcp-security',        name: 'MCP Security Agent',         desc: 'Tool poisoning, MCP server misconfiguration, unsafe tool definitions' },
+  { id: 'agentic-security',    name: 'Agentic Security Agent',     desc: 'Agentic loop vulnerabilities, unsafe tool use, context window attacks' },
+  { id: 'rag-security',        name: 'RAG Security Agent',         desc: 'Prompt injection via retrieved documents, data poisoning, retrieval manipulation' },
+  { id: 'pii-compliance',      name: 'PII Compliance Agent',       desc: 'PII exposure, GDPR/CCPA violations, unencrypted personal data' },
+  { id: 'vibe-coding',         name: 'Vibe Coding Agent',          desc: 'AI-generated code security issues, hardcoded values from iterative prompting' },
+  { id: 'exception-handler',   name: 'Exception Handler Agent',    desc: 'Stack traces in responses, error information disclosure, unhandled exceptions' },
+  { id: 'agent-config',        name: 'Agent Config Scanner',       desc: 'Insecure agent config files (.cursorrules, CLAUDE.md, MCP configs)' },
+  { id: 'memory-poisoning',    name: 'Memory Poisoning Agent',     desc: 'Malicious content in AI memory stores, embedding poisoning' },
+  { id: 'managed-agent',       name: 'Managed Agent Scanner',      desc: 'Insecure managed agent platforms, overprivileged agents' },
+  { id: 'hermes-security',     name: 'Hermes Security Agent',      desc: 'Hermes CLI security, agent tool permissions, orchestrator misconfiguration' },
+  { id: 'agent-attestation',   name: 'Agent Attestation Agent',    desc: 'Missing agent identity verification, unauthenticated agent-to-agent calls' },
+  { id: 'agentic-supply-chain', name: 'Agentic Supply Chain Agent', desc: 'Compromised AI integrations, OAuth scope creep, MCP server supply chain' },
+];
+
+// Max file content to include in the swarm prompt (cost control)
+const MAX_FILE_CHARS = 200_000;
+const MAX_FILES = 100;
+
+// =============================================================================
+// SWARM ORCHESTRATOR
+// =============================================================================
+
+export class SwarmOrchestrator {
+  /**
+   * @param {object} options
+   * @param {object}  options.provider    — LLM provider (must be Kimi or OpenAI-compatible with tool use)
+   * @param {boolean} options.verbose
+   * @param {number}  options.budgetCents
+   */
+  constructor(options = {}) {
+    this.provider = options.provider;
+    this.verbose = options.verbose || false;
+    this.budgetCents = options.budgetCents ?? 200;
+  }
+
+  static create(rootPath, options = {}) {
+    if (typeof options.provider === 'string') {
+      // Explicit provider requested
+      const provider = autoDetectProvider(rootPath, { provider: options.provider, model: options.model });
+      if (!provider) return null;
+      return new SwarmOrchestrator({ provider, verbose: options.verbose, budgetCents: options.budgetCents });
+    }
+
+    // Auto-select: prefer deepseek-flash (1M ctx, cheap) then kimi as fallback
+    for (const [providerName, swarmModel] of [
+      ['deepseek-flash', 'deepseek-v4-flash'],
+      ['kimi',           'moonshot-v1-128k'],
+    ]) {
+      const provider = autoDetectProvider(rootPath, { provider: providerName, model: swarmModel });
+      if (provider) return new SwarmOrchestrator({ provider, verbose: options.verbose, budgetCents: options.budgetCents });
+    }
+
+    return null;
+  }
+
+  /**
+   * Run the swarm scan against a codebase.
+   *
+   * @param {string} rootPath
+   * @param {object} reconData — Output from ReconAgent
+   * @param {string[]} files   — All scannable files
+   * @returns {Promise<object[]>} — findings[]
+   */
+  async run(rootPath, reconData, files) {
+    const codeBundle = this._bundleCode(rootPath, files);
+    const prompt = this._buildSwarmPrompt(reconData, codeBundle, rootPath);
+
+    const systemPrompt = `You are a security swarm coordinator. You MUST respond with ONLY a valid JSON object — no prose, no markdown, no explanation, no code fences. Your response must start with { and end with }. Deploy all ${SWARM_ROLES.length} sub-agents, each scanning for their attack class, then output the consolidated JSON findings.`;
+
+    const jsonInstruction = '\n\nOutput a JSON object with exactly these keys: {"findings":[{"agentId":"<agent-id>","file":"<relative-path>","line":<number>,"severity":"critical|high|medium|low","rule":"<rule-id>","title":"<title>","description":"<description>","remediation":"<fix>"}],"agentSummary":[{"agentId":"<agent-id>","findingCount":<number>,"status":"clean|findings"}]}';
+
+    const text = await this.provider.complete(systemPrompt, prompt + jsonInstruction, { maxTokens: 8192, jsonMode: true });
+    let raw = null;
+    try {
+      raw = JSON.parse(text || '{}');
+    } catch {
+      if (this.verbose) console.log('  [Swarm] JSON parse failed. Preview:', text?.slice(0, 200));
+      raw = null;
+    }
+
+    return this._mapFindings(raw?.findings ?? [], rootPath);
+  }
+
+  _bundleCode(rootPath, files) {
+    let bundle = '';
+    let totalChars = 0;
+    const selected = files.slice(0, MAX_FILES);
+
+    for (const filePath of selected) {
+      if (totalChars >= MAX_FILE_CHARS) break;
+      try {
+        const relPath = path.relative(rootPath, filePath);
+        const content = fs.readFileSync(filePath, 'utf-8');
+        const snippet = content.slice(0, Math.min(8000, MAX_FILE_CHARS - totalChars));
+        bundle += `\n\n### ${relPath}\n\`\`\`\n${snippet}\n\`\`\``;
+        totalChars += snippet.length;
+      } catch { /* skip unreadable */ }
+    }
+
+    return bundle;
+  }
+
+  _buildSwarmPrompt(recon, codeBundle, rootPath) {
+    const projectName = path.basename(rootPath);
+    const reconSummary = recon
+      ? [
+          recon.frameworks?.length ? `Frameworks: ${recon.frameworks.join(', ')}` : '',
+          recon.databases?.length  ? `Databases: ${recon.databases.join(', ')}`   : '',
+          recon.authPatterns?.length ? `Auth patterns: ${recon.authPatterns.join(', ')}` : '',
+          recon.languages?.length  ? `Languages: ${recon.languages.join(', ')}`   : '',
+        ].filter(Boolean).join('\n')
+      : '';
+
+    const agentList = SWARM_ROLES.map((r, i) =>
+      `  Sub-agent ${String(i + 1).padStart(2, '0')} [${r.id}] — ${r.name}: ${r.desc}`
+    ).join('\n');
+
+    return `# Security Swarm Task: ${projectName}
+
+## Project Context
+${reconSummary || 'No recon data available.'}
+
+## Sub-Agent Assignments
+Deploy all ${SWARM_ROLES.length} sub-agents in parallel. Each scans for exactly their assigned attack class:
+
+${agentList}
+
+## Instructions
+1. Each sub-agent independently analyzes the full codebase for its attack class.
+2. For each finding, record: agentId (the sub-agent's id), file path, line number, severity, a rule identifier, title, description, the matched snippet, and remediation advice.
+3. Severity scale: critical (exploitable now), high (likely exploitable), medium (potential issue), low (best practice), info (note).
+4. Report all findings from all sub-agents in the tool call, even if the list is long.
+5. If a sub-agent finds nothing, include it in agentSummary with status "clean" and findingCount 0.
+
+## Codebase
+${codeBundle}`;
+  }
+
+  _mapFindings(rawFindings, rootPath) {
+    return rawFindings.map(r => {
+      const role = SWARM_ROLES.find(a => a.id === r.agentId) || { name: 'SwarmAgent', id: r.agentId };
+      return createFinding({
+        file: r.file ? path.resolve(rootPath, r.file) : null,
+        line: r.line || 0,
+        severity: r.severity || 'medium',
+        confidence: 'medium',
+        rule: r.rule || `swarm:${role.id}`,
+        title: r.title,
+        description: r.description,
+        matched: r.matched || '',
+        remediation: r.remediation || '',
+        category: role.name,
+      });
+    });
+  }
+}
+
+export default SwarmOrchestrator;

package/cli/agents/verifier-agent.js

@@ -0,0 +1,303 @@
+/**
+ * VerifierAgent — Second-Pass Finding Confirmation
+ * ==================================================
+ *
+ * Runs after all agents complete. Takes high-confidence findings
+ * and attempts to confirm or downgrade them by analyzing surrounding
+ * code context.
+ *
+ * Checks:
+ *   - Is the flagged value static/hardcoded or dynamic (from user input)?
+ *   - Is there upstream sanitization or validation?
+ *   - Is the code inside error handling that neutralizes it?
+ *   - Is the finding in dead/unreachable code?
+ *
+ * Impact: Unverified findings get downgraded one confidence level.
+ */
+
+import fs from 'fs';
+import path from 'path';
+import { ASTParser, ScopeTree, TaintTracker, GuardrailDetector } from '../core/ast/index.js';
+
+// =============================================================================
+// HEURISTIC PATTERNS
+// =============================================================================
+
+/** Sources of user input — if a finding's matched code references these, it's more likely real */
+const USER_INPUT_SOURCES = [
+  /req\.body/,
+  /req\.query/,
+  /req\.params/,
+  /req\.headers/,
+  /request\.body/,
+  /request\.query/,
+  /request\.params/,
+  /request\.form/,
+  /request\.args/,
+  /request\.json/,
+  /ctx\.request/,
+  /ctx\.query/,
+  /ctx\.params/,
+  /event\.body/,
+  /event\.queryStringParameters/,
+  /searchParams/,
+  /formData/,
+  /userinput/i,
+  /user_input/i,
+  /input\s*\(/,
+  /argv/,
+  /process\.env/,
+  /getenv/,
+];
+
+/** Sanitization/validation indicators — presence near a finding suggests it's protected */
+export const SANITIZATION_PATTERNS = [
+  /sanitize/i,
+  /validate/i,
+  /escape/i,
+  /purify/i,
+  /DOMPurify/,
+  /xss\s*\(/i,
+  /htmlencode/i,
+  /encodeURI/,
+  /encodeURIComponent/,
+  /parameterized/i,
+  /prepared\s*statement/i,
+  /placeholder/i,
+  /\?\s*,/,
+  /\$\d+/,
+  /bindParam/i,
+  /bindValue/i,
+  /zod/i,
+  /yup/i,
+  /joi\./i,
+  /ajv/i,
+  /schema\.parse/i,
+  /safeParse/i,
+  /validator\./i,
+  /parseInt\s*\(/,
+  /parseFloat\s*\(/,
+  /Number\s*\(/,
+  /\.trim\s*\(/,
+  /\.replace\s*\(/,
+  /allowlist/i,
+  /whitelist/i,
+  /blocklist/i,
+  /blacklist/i,
+];
+
+/** Error handling wrappers — findings inside these are less exploitable */
+const ERROR_HANDLING_PATTERNS = [
+  /}\s*catch\s*\(/,
+  /\.catch\s*\(/,
+  /try\s*\{/,
+  /if\s*\(\s*err/,
+  /on\s*\(\s*['"]error['"]/,
+  /\.on\s*\(\s*['"]error['"]/,
+];
+
+/** Static/hardcoded value indicators — finding uses a constant, not user input */
+const STATIC_VALUE_PATTERNS = [
+  /['"][^'"]{0,200}['"]/,
+  /const\s+\w+\s*=\s*['"][^'"]*['"]/,
+  /^\s*\/\//,
+  /^\s*\*/,
+  /^\s*#/,
+  /TODO|FIXME|HACK|NOTE/,
+];
+
+/** Dead code indicators */
+const DEAD_CODE_PATTERNS = [
+  /return\s+/,
+  /throw\s+/,
+  /process\.exit/,
+  /^\s*\/\//,
+];
+
+// =============================================================================
+// VERIFIER AGENT
+// =============================================================================
+
+export class VerifierAgent {
+  constructor() {
+    this.name = 'VerifierAgent';
+    this.description = 'Second-pass verification of findings';
+  }
+
+  /**
+   * Verify an array of findings by analyzing surrounding code context.
+   * Returns findings with added `verified` and `verifierNote` fields.
+   *
+   * @param {object[]} findings — Findings from all agents (post-dedup)
+   * @param {object}   options  — { verbose }
+   * @returns {object[]} — Findings with verification metadata
+   */
+  verify(findings, options = {}) {
+    const fileCache = new Map();
+    const astCache = new Map();
+
+    for (const finding of findings) {
+      // Only verify critical and high severity findings
+      if (finding.severity !== 'critical' && finding.severity !== 'high') {
+        finding.verified = null; // not checked
+        continue;
+      }
+
+      const result = this._verifyFinding(finding, fileCache, astCache);
+      finding.verified = result.verified;
+      finding.verifierNote = result.note;
+
+      // Downgrade unverified findings one confidence level
+      if (!result.verified) {
+        if (finding.confidence === 'high') finding.confidence = 'medium';
+        else if (finding.confidence === 'medium') finding.confidence = 'low';
+      }
+    }
+
+    return findings;
+  }
+
+  /**
+   * Verify a single finding by reading surrounding code and running AST taint analysis.
+   */
+  _verifyFinding(finding, fileCache, astCache = new Map()) {
+    const { file, line, matched } = finding;
+    if (!file || !line) {
+      return { verified: null, note: 'Missing file or line info' };
+    }
+
+    // Read the file (cached)
+    let content;
+    let lines;
+    let scopeTree;
+    if (fileCache.has(file)) {
+      content = fileCache.get(file);
+      lines = content.split('\n');
+      scopeTree = astCache.get(file);
+    } else {
+      try {
+        content = fs.readFileSync(file, 'utf-8');
+        lines = content.split('\n');
+        fileCache.set(file, content);
+
+        const parsed = ASTParser.parse(content, file);
+        scopeTree = ScopeTree.build(parsed.ast, content);
+        astCache.set(file, scopeTree);
+      } catch {
+        return { verified: null, note: 'Could not read file' };
+      }
+    }
+
+    // ── AST Step 1: AI Guardrail / Defense framework check ──────────────────
+    const protection = GuardrailDetector.checkProtection(finding, content);
+    if (protection.isProtected) {
+      return {
+        verified: false,
+        note: `Mitigated: ${protection.reason}`,
+      };
+    }
+
+    // ── AST Step 2: Dataflow & Taint Tracker Evaluation ──────────────────────
+    const taintEval = TaintTracker.evaluateFinding({
+      file,
+      line,
+      matched,
+      code: content,
+      scopeTree,
+    });
+
+    if (taintEval.isSanitized) {
+      return {
+        verified: false,
+        note: taintEval.reason || 'Sanitization detected in AST scope',
+      };
+    }
+
+    if (taintEval.isStatic) {
+      return {
+        verified: false,
+        note: taintEval.reason || 'Value appears to be static constant',
+      };
+    }
+
+    // Get scope boundaries
+    const scope = scopeTree ? scopeTree.getScopeAt(line) : null;
+    const startLine = scope ? Math.max(0, scope.range.startLine - 1) : Math.max(0, line - 16);
+    const endLine = scope ? Math.min(lines.length, scope.range.endLine) : Math.min(lines.length, line + 15);
+    const windowText = lines.slice(startLine, endLine).join('\n');
+    const beforeText = lines.slice(startLine, Math.max(startLine, line - 1)).join('\n');
+    const findingLine = lines[line - 1] || '';
+
+    // ── Check 3: Is dead code? ──────────────────────────────────────────────
+    const isDeadCode = this._isDeadCode(lines, line);
+    if (isDeadCode) {
+      return {
+        verified: false,
+        note: 'Finding appears to be in unreachable code (after return/throw)',
+      };
+    }
+
+    // ── Check 4: Error handling wrapper ─────────────────────────────────────
+    const inErrorHandler = ERROR_HANDLING_PATTERNS.some(p => p.test(beforeText));
+    if (inErrorHandler) {
+      return {
+        verified: false,
+        note: 'Finding is inside error handling context, reducing exploitability',
+      };
+    }
+
+    // ── Check 5: Confirmed user input ───────────────────────────────────────
+    if (taintEval.isTainted || USER_INPUT_SOURCES.some(p => p.test(windowText))) {
+      return {
+        verified: true,
+        note: 'User input flows to this sink within enclosing scope',
+      };
+    }
+
+    // Default: cannot determine, keep as-is
+    return {
+      verified: null,
+      note: 'Could not determine verification status from code context',
+    };
+  }
+
+  /**
+   * Check if the matched code is using a static/hardcoded value.
+   */
+  _isStaticValue(line, matched) {
+    // If the finding line is a comment, it's static
+    if (/^\s*(?:\/\/|#|\*|\/\*)/.test(line)) return true;
+
+    // If the matched text is just a string literal with no interpolation
+    if (/^['"][^'"]*['"]$/.test(matched)) return true;
+
+    // If the line is a const assignment to a string literal
+    if (/const\s+\w+\s*=\s*['"][^'"]*['"]/.test(line)) return true;
+
+    // If it looks like a TODO/placeholder comment
+    if (/TODO|FIXME|EXAMPLE|PLACEHOLDER|SAMPLE/i.test(line)) return true;
+
+    return false;
+  }
+
+  /**
+   * Check if a line is after a return/throw (dead code).
+   */
+  _isDeadCode(lines, lineNum) {
+    // Check the 5 lines before the finding for return/throw
+    for (let i = Math.max(0, lineNum - 6); i < lineNum - 1; i++) {
+      const l = lines[i]?.trim() || '';
+      // If a return/throw is found and there's no conditional/block opener after
+      if (/^(?:return\s|throw\s|process\.exit)/.test(l)) {
+        // Check if there's a } or else between the return and our line
+        const between = lines.slice(i + 1, lineNum - 1).join('\n');
+        if (!/[{}]|else|case/.test(between)) {
+          return true;
+        }
+      }
+    }
+    return false;
+  }
+}
+
+export default VerifierAgent;