praxis-sec 1.0.0

package/cli/commands/diff.js

@@ -0,0 +1,200 @@
+/**
+ * Diff Command
+ * =============
+ *
+ * Scan only changed files (git diff) for security issues.
+ * Much faster than a full audit — perfect for pre-commit hooks and PR reviews.
+ *
+ * USAGE:
+ *   praxis diff              Scan uncommitted changes (staged + unstaged)
+ *   praxis diff --staged     Scan only staged changes
+ *   praxis diff HEAD~3       Scan changes in last 3 commits
+ *   praxis diff main         Scan changes since branching from main
+ */
+
+import { execFileSync } from 'child_process';
+import path from 'path';
+import chalk from 'chalk';
+import ora from 'ora';
+import { SECRET_PATTERNS, SECURITY_PATTERNS, SKIP_EXTENSIONS, SKIP_FILENAMES } from '../utils/patterns.js';
+import { buildOrchestrator } from '../agents/index.js';
+import { ScoringEngine } from '../agents/scoring-engine.js';
+
+// =============================================================================
+// DIFF COMMAND
+// =============================================================================
+
+export async function diffCommand(ref, options) {
+  const targetPath = options.path || process.cwd();
+  const absolutePath = path.resolve(targetPath);
+
+  // ── Get changed files from git ────────────────────────────────────────────
+  const spinner = ora(chalk.white('Getting changed files from git...')).start();
+
+  let gitArgs;
+  if (options.staged) {
+    gitArgs = ['diff', '--cached', '--name-only', '--diff-filter=ACMR'];
+  } else if (ref) {
+    gitArgs = ['diff', '--name-only', '--diff-filter=ACMR', ref];
+  } else {
+    // Uncommitted changes: both staged and unstaged
+    gitArgs = ['diff', '--name-only', '--diff-filter=ACMR', 'HEAD'];
+  }
+
+  let changedFiles;
+  try {
+    const output = execFileSync('git', gitArgs, {
+      cwd: absolutePath,
+      encoding: 'utf-8',
+      timeout: 10_000,
+    }).trim();
+
+    if (!output) {
+      spinner.succeed(chalk.green('No changed files detected'));
+      console.log(chalk.gray('\n  Nothing to scan. Your working tree is clean.\n'));
+      return;
+    }
+
+    changedFiles = output
+      .split('\n')
+      .map(f => f.trim())
+      .filter(f => f.length > 0)
+      .map(f => path.resolve(absolutePath, f))
+      .filter(f => {
+        const ext = path.extname(f).toLowerCase();
+        if (SKIP_EXTENSIONS.has(ext)) return false;
+        const basename = path.basename(f);
+        if (SKIP_FILENAMES.has(basename)) return false;
+        return true;
+      });
+
+    spinner.succeed(chalk.white(`${changedFiles.length} changed file(s) to scan`));
+  } catch (err) {
+    // Fallback for repos with no commits yet
+    if (err.message?.includes('unknown revision')) {
+      try {
+        const output = execFileSync('git', ['diff', '--cached', '--name-only', '--diff-filter=ACMR'], {
+          cwd: absolutePath,
+          encoding: 'utf-8',
+          timeout: 10_000,
+        }).trim();
+
+        changedFiles = output
+          .split('\n')
+          .map(f => f.trim())
+          .filter(f => f.length > 0)
+          .map(f => path.resolve(absolutePath, f))
+          .filter(f => {
+            const ext = path.extname(f).toLowerCase();
+            if (SKIP_EXTENSIONS.has(ext)) return false;
+            const basename = path.basename(f);
+            if (SKIP_FILENAMES.has(basename)) return false;
+            return true;
+          });
+
+        if (!changedFiles.length) {
+          spinner.succeed(chalk.green('No changed files detected'));
+          return;
+        }
+        spinner.succeed(chalk.white(`${changedFiles.length} changed file(s) to scan`));
+      } catch {
+        spinner.fail(chalk.red('Not a git repository or git not available'));
+        process.exit(1);
+      }
+    } else {
+      spinner.fail(chalk.red('Failed to get changed files from git'));
+      console.error(chalk.gray(`  ${err.message}`));
+      process.exit(1);
+    }
+  }
+
+  if (changedFiles.length === 0) {
+    console.log(chalk.gray('\n  No scannable files in the diff.\n'));
+    return;
+  }
+
+  // ── Print header ──────────────────────────────────────────────────────────
+  console.log();
+  console.log(chalk.cyan('═'.repeat(60)));
+  console.log(chalk.cyan.bold('  Praxis — Diff Scan'));
+  console.log(chalk.cyan('═'.repeat(60)));
+  console.log();
+  console.log(chalk.gray(`  Scanning ${changedFiles.length} changed file(s):`));
+  for (const f of changedFiles.slice(0, 10)) {
+    console.log(chalk.gray(`    ${path.relative(absolutePath, f)}`));
+  }
+  if (changedFiles.length > 10) {
+    console.log(chalk.gray(`    ... and ${changedFiles.length - 10} more`));
+  }
+  console.log();
+
+  // ── Run agents on changed files only ──────────────────────────────────────
+  const agentSpinner = ora(chalk.white('Running security agents on diff...')).start();
+
+  const orchestrator = buildOrchestrator();
+  const results = await orchestrator.runAll(absolutePath, {
+    timeout: options.timeout ?? 30_000,
+    changedFiles,
+  });
+
+  const findings = results.findings || [];
+  agentSpinner.succeed(
+    findings.length === 0
+      ? chalk.green('No security issues in changed files')
+      : chalk.yellow(`${findings.length} finding(s) in changed files`)
+  );
+
+  // ── Score ─────────────────────────────────────────────────────────────────
+  if (findings.length > 0) {
+    const scoringEngine = new ScoringEngine();
+    const scoreResult = scoringEngine.compute(findings, []);
+    scoreResult.score = Math.round(scoreResult.score * 10) / 10;
+
+    const scoreColor = scoreResult.score >= 75 ? chalk.green.bold : scoreResult.score >= 60 ? chalk.yellow.bold : chalk.red.bold;
+
+    console.log();
+    console.log(chalk.cyan('  ' + '─'.repeat(56)));
+
+    // Print findings
+    let shown = 0;
+    for (const f of findings) {
+      if (shown >= 20) {
+        console.log(chalk.gray(`\n  ... and ${findings.length - 20} more findings`));
+        break;
+      }
+      const sevColor = f.severity === 'critical' ? chalk.red :
+                        f.severity === 'high' ? chalk.yellow :
+                        f.severity === 'medium' ? chalk.cyan : chalk.gray;
+      const relPath = path.relative(absolutePath, f.file);
+      console.log(`  ${sevColor(`[${f.severity.toUpperCase()}]`)} ${chalk.white(f.title)}`);
+      console.log(chalk.gray(`    ${relPath}:${f.line} → ${f.fix || f.description}`));
+      shown++;
+    }
+
+    console.log();
+    console.log(chalk.cyan('  ' + '─'.repeat(56)));
+    console.log(
+      chalk.white.bold('  Diff Score: ') +
+      scoreColor(`${scoreResult.score}/100 ${scoreResult.grade.letter}`)
+    );
+    console.log(chalk.cyan('  ' + '─'.repeat(56)));
+  }
+
+  // ── JSON output ───────────────────────────────────────────────────────────
+  if (options.json) {
+    const output = {
+      command: 'diff',
+      ref: ref || (options.staged ? '--staged' : 'HEAD'),
+      changedFiles: changedFiles.map(f => path.relative(absolutePath, f)),
+      findings,
+      totalFindings: findings.length,
+    };
+    console.log(JSON.stringify(output, null, 2));
+  }
+
+  console.log();
+  console.log(chalk.cyan('═'.repeat(60)));
+  console.log();
+
+  process.exit(findings.length > 0 ? 1 : 0);
+}

package/cli/commands/doctor.js

@@ -0,0 +1,195 @@
+/**
+ * Doctor Command — Environment Diagnostics
+ * ==========================================
+ *
+ * Checks Node.js version, git, npm, API keys, ignore files,
+ * cache directory, and package version.
+ *
+ * USAGE:
+ *   npx praxis-sec doctor
+ */
+
+import { execFileSync } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+import chalk from 'chalk';
+import { buildOrchestratorAsync } from '../agents/index.js';
+import { autoDetectProvider } from '../providers/llm-provider.js';
+import { toolVersion, isNewerVersion } from '../core/version.js';
+
+const PACKAGE_VERSION = toolVersion();
+
+export async function doctorCommand() {
+  console.log();
+  console.log(chalk.cyan.bold('  Praxis Doctor'));
+  console.log(chalk.gray('  ' + '─'.repeat(50)));
+  console.log();
+
+  let allGood = true;
+
+  // 1. Node.js version
+  const nodeVersion = process.version;
+  const nodeMajor = parseInt(nodeVersion.slice(1), 10);
+  if (nodeMajor >= 18) {
+    pass(`Node.js ${nodeVersion} (requires ≥18)`);
+  } else {
+    fail(`Node.js ${nodeVersion} — requires ≥18`);
+    allGood = false;
+  }
+
+  // 2. Git
+  try {
+    const gitVersion = execFileSync('git', ['--version'], { encoding: 'utf-8' }).trim();
+    pass(gitVersion.replace('git version ', 'git v'));
+  } catch {
+    fail('git not found (needed for guard, git-history-scanner)');
+    allGood = false;
+  }
+
+  // 3. Package manager
+  const managers = ['npm', 'yarn', 'pnpm'];
+  let foundPm = false;
+  for (const pm of managers) {
+    try {
+      const ver = execFileSync(pm, ['--version'], { encoding: 'utf-8', shell: true }).trim();
+      pass(`${pm} v${ver}`);
+      foundPm = true;
+      break;
+    } catch { /* try next */ }
+  }
+  if (!foundPm) {
+    fail('No package manager found (npm/yarn/pnpm)');
+    allGood = false;
+  }
+
+  // 4. API keys
+  const apiKeys = [
+    { name: 'Anthropic API key', env: 'ANTHROPIC_API_KEY', required: false }, // praxis-ignore — env var names in diagnostic check, no key values
+    { name: 'OpenAI API key', env: 'OPENAI_API_KEY', required: false }, // praxis-ignore — env var name in diagnostic check, no key value
+    { name: 'Google AI API key', env: 'GOOGLE_API_KEY', required: false },
+  ];
+  for (const key of apiKeys) {
+    if (process.env[key.env]) {
+      pass(`${key.name} configured`);
+    } else {
+      info(`${key.name} not set (optional — for AI classification)`);
+    }
+  }
+
+  // 5. .praxisignore
+  const cwd = process.cwd();
+  const ignorePath = path.join(cwd, '.praxisignore');
+  if (fs.existsSync(ignorePath)) {
+    try {
+      const patterns = fs.readFileSync(ignorePath, 'utf-8')
+        .split('\n').filter(l => l.trim() && !l.startsWith('#')).length;
+      pass(`.praxisignore found (${patterns} patterns)`);
+    } catch {
+      pass('.praxisignore found');
+    }
+  } else {
+    info('.praxisignore not found (run: praxis init)');
+  }
+
+  // 6. Cache directory
+  const cacheDir = path.join(cwd, '.praxis');
+  if (fs.existsSync(cacheDir)) {
+    try {
+      const testFile = path.join(cacheDir, '.doctor-test');
+      fs.writeFileSync(testFile, 'test');
+      fs.unlinkSync(testFile);
+      pass('Cache directory writable');
+    } catch {
+      fail('Cache directory not writable');
+      allGood = false;
+    }
+  } else {
+    info('Cache directory does not exist yet (created on first scan)');
+  }
+
+  // 7. Built-in agents & custom plugins
+  try {
+    const orchestrator = await buildOrchestratorAsync(cwd, { quiet: true });
+    const count = orchestrator.agents?.length ?? 0;
+    pass(`All ${count} built-in and plugin agents loaded successfully`);
+  } catch (err) {
+    fail(`Failed to load agents or plugins: ${err.message}`);
+    allGood = false;
+  }
+
+  // 8. Intel sources connectivity
+  try {
+    const res = await fetch('https://api.osv.dev/v1/vulns/test', {
+      signal: AbortSignal.timeout(3000)
+    });
+    if (res.status === 200 || res.status === 404) {
+      pass('Intel source (OSV) is reachable');
+    } else {
+      fail(`Intel source (OSV) returned HTTP ${res.status}`);
+      allGood = false;
+    }
+  } catch (err) {
+    fail(`Intel source (OSV) is unreachable: ${err.message}`);
+    allGood = false;
+  }
+
+  // 9. LLM connection test (if configured)
+  const provider = autoDetectProvider(cwd);
+  if (provider) {
+    try {
+      const response = await provider.complete(
+        "Connection check",
+        "Say: connection ok"
+      );
+      if (response && response.toLowerCase().includes("ok")) {
+        pass(`${provider.name} LLM responding successfully`);
+      } else {
+        fail(`${provider.name} LLM returned unexpected response: ${response}`);
+        allGood = false;
+      }
+    } catch (err) {
+      fail(`${provider.name} LLM connection check failed: ${err.message}`);
+      allGood = false;
+    }
+  } else {
+    info('No LLM provider configured. Skipping LLM connectivity test.');
+  }
+
+  // 10. Version check
+  pass(`praxis v${PACKAGE_VERSION}`);
+  try {
+    const latest = execFileSync('npm', ['view', 'praxis', 'version'], {
+      encoding: 'utf-8', timeout: 5000, shell: true,
+    }).trim();
+    if (latest && latest !== PACKAGE_VERSION && isNewerVersion(latest, PACKAGE_VERSION)) {
+      const msg = ['v', latest, ' available (current: v', PACKAGE_VERSION, ')'].join('');
+      info(msg);
+    } else if (latest) {
+      pass('Up to date');
+    }
+  } catch {
+    // Skip version check if npm view fails
+  }
+
+  console.log();
+  if (allGood) {
+    console.log(chalk.green.bold('  All checks passed!'));
+  } else {
+    console.log(chalk.yellow.bold('  Some checks failed. See above for details.'));
+  }
+  console.log();
+}
+
+function pass(msg) {
+  console.log(chalk.green('  ✔ ') + chalk.white(msg));
+}
+
+function fail(msg) {
+  console.log(chalk.red('  ✗ ') + chalk.red(msg));
+}
+
+function info(msg) {
+  console.log(chalk.gray('  ○ ') + chalk.gray(msg));
+}
+
+export default doctorCommand;