praxis-sec 1.0.0

package/cli/commands/env-audit.js

@@ -0,0 +1,349 @@
+/**
+ * Env Audit Command
+ * ==================
+ *
+ * Post-sync credential health check. Designed to run immediately after
+ * `stripe projects env --pull` or any credential provisioning workflow.
+ *
+ * Checks:
+ *   1. Every .env* file is covered by .gitignore
+ *   2. No .env values appear hardcoded in source files
+ *   3. Git history has no previously committed .env files
+ *   4. Agent configs can't read credential files without restriction
+ *
+ * USAGE:
+ *   praxis env-audit [path]
+ *   praxis env-audit . --json
+ *
+ * EXIT CODES:
+ *   0 — clean
+ *   1 — issues found
+ */
+
+import fs from 'fs';
+import path from 'path';
+import fg from 'fast-glob';
+import chalk from 'chalk';
+import ora from 'ora';
+import { execFileSync } from 'child_process';
+import { SECRET_PATTERNS, SKIP_DIRS } from '../utils/patterns.js';
+
+// Minimum value length to cross-reference (skip short values like "true", "3000")
+const MIN_VALUE_LENGTH = 8;
+
+// Keys that are safe to appear in source (not secrets)
+const SAFE_KEY_PATTERNS = /^(?:NEXT_PUBLIC_|REACT_APP_|VITE_|NUXT_PUBLIC_|NODE_ENV|PORT|HOST|HOSTNAME|LOG_LEVEL|DEBUG|TZ|LANG|APP_NAME|APP_URL|BASE_URL)/i;
+
+// =============================================================================
+// ENV AUDIT COMMAND
+// =============================================================================
+
+export async function envAuditCommand(targetPath = '.', options) {
+  const absolutePath = path.resolve(targetPath);
+  const spinner = ora('Auditing credential environment...').start();
+
+  const findings = [];
+
+  try {
+    // ── Step 1: Find all .env files ──────────────────────────────────────────
+    const envFiles = await findEnvFiles(absolutePath);
+    spinner.text = `Found ${envFiles.length} .env file(s)`;
+
+    if (envFiles.length === 0) {
+      spinner.succeed('No .env files found — nothing to audit.');
+      return;
+    }
+
+    // ── Step 2: Check .gitignore coverage ────────────────────────────────────
+    spinner.text = 'Checking .gitignore coverage...';
+    for (const envFile of envFiles) {
+      const relPath = path.relative(absolutePath, envFile).replace(/\\/g, '/');
+      const basename = path.basename(envFile);
+
+      // Skip .env.example and .env.sample — these are meant to be committed
+      if (/\.env\.(?:example|sample|template)$/i.test(basename)) continue;
+
+      const isIgnored = checkGitignored(absolutePath, relPath);
+      if (!isIgnored) {
+        findings.push({
+          type: 'gitignore',
+          severity: 'critical',
+          file: relPath,
+          message: `${relPath} is NOT covered by .gitignore — credentials will be committed`,
+          fix: `Add "${basename}" to your .gitignore file`,
+        });
+      }
+    }
+
+    // ── Step 3: Parse .env values and cross-reference against source ─────────
+    spinner.text = 'Cross-referencing credentials against source files...';
+    // Only cross-reference real .env files, not .env.example/.env.sample
+    const realEnvFiles = envFiles.filter(f => !/\.env\.(?:example|sample|template)$/i.test(path.basename(f)));
+    const envValues = parseEnvFiles(realEnvFiles);
+    const sensitiveValues = envValues.filter(v =>
+      v.value.length >= MIN_VALUE_LENGTH && !SAFE_KEY_PATTERNS.test(v.key)
+    );
+
+    if (sensitiveValues.length > 0) {
+      const sourceFiles = await findSourceFiles(absolutePath);
+      for (const { key, value, file: envFile } of sensitiveValues) {
+        for (const srcFile of sourceFiles) {
+          const relSrc = path.relative(absolutePath, srcFile).replace(/\\/g, '/');
+          // Don't flag the .env file itself
+          if (srcFile === envFile) continue;
+
+          try {
+            const content = fs.readFileSync(srcFile, 'utf-8');
+            if (content.includes(value)) {
+              findings.push({
+                type: 'hardcoded',
+                severity: 'critical',
+                file: relSrc,
+                message: `${key} value from ${path.basename(envFile)} is hardcoded in ${relSrc}`,
+                fix: `Replace the hardcoded value with process.env.${key} or equivalent`, // praxis-ignore SQL_INJECTION_TEMPLATE_LITERAL — env-var name interpolation, not SQL
+              });
+            }
+          } catch {
+            // skip unreadable files
+          }
+        }
+      }
+    }
+
+    // ── Step 4: Check git history for committed .env files ───────────────────
+    spinner.text = 'Checking git history for committed credentials...';
+    const historyLeaks = checkGitHistory(absolutePath);
+    for (const leak of historyLeaks) {
+      findings.push({
+        type: 'history',
+        severity: 'high',
+        file: leak,
+        message: `${leak} was previously committed to git history — credentials may be in old commits`,
+        fix: 'Rotate all credentials that were in this file. Use git filter-repo to remove from history if needed.',
+      });
+    }
+
+    // ── Step 5: Check .projects manifest for credential leaks ────────────────
+    spinner.text = 'Checking .projects manifest...';
+    const projectsDir = path.join(absolutePath, '.projects');
+    if (fs.existsSync(projectsDir)) {
+      const projectsFiles = await fg(['**/*'], {
+        cwd: projectsDir,
+        absolute: true,
+        onlyFiles: true,
+      });
+
+      for (const pFile of projectsFiles) {
+        try {
+          const content = fs.readFileSync(pFile, 'utf-8');
+          for (const pattern of SECRET_PATTERNS) {
+            pattern.pattern.lastIndex = 0;
+            const match = pattern.pattern.exec(content);
+            if (match) {
+              const relPath = path.relative(absolutePath, pFile).replace(/\\/g, '/');
+              findings.push({
+                type: 'projects-manifest',
+                severity: 'critical',
+                file: relPath,
+                message: `${pattern.name} found in .projects manifest — credentials should not be in the manifest`,
+                fix: 'Remove credential values from .projects/ config. Stripe Projects stores credentials server-side.',
+              });
+            }
+          }
+        } catch {
+          // skip unreadable
+        }
+      }
+    }
+
+    // ── Step 6: Check agent config access to .env files ──────────────────────
+    spinner.text = 'Checking agent config access to credential files...';
+    const agentConfigs = await fg([
+      '.claude/settings.json',
+      '.cursorrules',
+      '.cursor/rules/*.mdc',
+      '.windsurfrules',
+      'CLAUDE.md',
+      '.claw.json',
+      '.claw/settings.json',
+      'openclaw.json',
+    ], {
+      cwd: absolutePath,
+      absolute: true,
+      onlyFiles: true,
+      dot: true,
+    });
+
+    for (const configFile of agentConfigs) {
+      try {
+        const content = fs.readFileSync(configFile, 'utf-8');
+        const relPath = path.relative(absolutePath, configFile).replace(/\\/g, '/');
+
+        // Check for danger modes that give agents full access
+        if (/dangerouslySkipPermissions\s*["']?\s*[:=]\s*["']?true/i.test(content) ||
+            /permissionMode\s*["']?\s*[:=]\s*["']?danger-full-access/i.test(content)) {
+          findings.push({
+            type: 'agent-access',
+            severity: 'critical',
+            file: relPath,
+            message: `${relPath} grants unrestricted file access — agent can read all .env credentials`,
+            fix: 'Remove dangerouslySkipPermissions / danger-full-access. Scope agent file access explicitly.',
+          });
+        }
+      } catch {
+        // skip
+      }
+    }
+
+    // ── Output ───────────────────────────────────────────────────────────────
+    spinner.stop();
+
+    if (options.json) {
+      console.log(JSON.stringify({ findings, envFiles: envFiles.length, clean: findings.length === 0 }, null, 2));
+      process.exit(findings.length > 0 ? 1 : 0);
+      return;
+    }
+
+    console.log();
+    console.log(chalk.cyan.bold('  Praxis — Env Audit'));
+    console.log(chalk.gray(`  Scanned ${envFiles.length} .env file(s), ${sensitiveValues.length} credential(s)`));
+    console.log();
+
+    if (findings.length === 0) {
+      console.log(chalk.green('  ✔ Environment is clean. No credential leaks detected.\n'));
+      console.log(chalk.gray('  Tip: run this after every `stripe projects env --pull` or credential sync.\n'));
+      process.exit(0);
+      return;
+    }
+
+    // Group by type
+    const groups = {
+      gitignore: { label: 'Missing .gitignore Coverage', icon: '🔓' },
+      hardcoded: { label: 'Hardcoded Credentials in Source', icon: '🔑' },
+      history: { label: 'Credentials in Git History', icon: '📜' },
+      'projects-manifest': { label: 'Credentials in .projects Manifest', icon: '📁' },
+      'agent-access': { label: 'Agent Config: Unrestricted Credential Access', icon: '🤖' },
+    };
+
+    for (const [type, meta] of Object.entries(groups)) {
+      const typeFindings = findings.filter(f => f.type === type);
+      if (typeFindings.length === 0) continue;
+
+      console.log(chalk.yellow(`  ${meta.icon} ${meta.label} (${typeFindings.length})`));
+      for (const f of typeFindings) {
+        const sevColor = f.severity === 'critical' ? chalk.red : chalk.yellow;
+        console.log(`    ${sevColor(f.severity.toUpperCase())} ${f.file}`);
+        console.log(chalk.gray(`      ${f.message}`));
+        console.log(chalk.gray(`      Fix: ${f.fix}`));
+      }
+      console.log();
+    }
+
+    const criticals = findings.filter(f => f.severity === 'critical').length;
+    if (criticals > 0) {
+      console.log(chalk.red.bold(`  ✘ ${criticals} critical issue(s). Fix before committing.\n`));
+    } else {
+      console.log(chalk.yellow(`  ⚠ ${findings.length} issue(s) found. Review before committing.\n`));
+    }
+
+    process.exit(1);
+
+  } catch (err) {
+    spinner.fail(`Env audit error: ${err.message}`);
+    process.exit(1);
+  }
+}
+
+// =============================================================================
+// HELPERS
+// =============================================================================
+
+async function findEnvFiles(rootPath) {
+  return fg(['.env', '.env.*', '**/.env', '**/.env.*'], {
+    cwd: rootPath,
+    absolute: true,
+    onlyFiles: true,
+    dot: true,
+    ignore: Array.from(SKIP_DIRS).map(d => `**/${d}/**`),
+  });
+}
+
+function parseEnvFiles(envFiles) {
+  const values = [];
+  for (const file of envFiles) {
+    try {
+      const content = fs.readFileSync(file, 'utf-8');
+      for (const line of content.split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#')) continue;
+        const eqIdx = trimmed.indexOf('=');
+        if (eqIdx === -1) continue;
+        const key = trimmed.slice(0, eqIdx).trim();
+        let value = trimmed.slice(eqIdx + 1).trim();
+        // Strip surrounding quotes
+        if ((value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'"))) {
+          value = value.slice(1, -1);
+        }
+        if (value && value !== '' && !value.startsWith('${')) {
+          values.push({ key, value, file });
+        }
+      }
+    } catch {
+      // skip unreadable
+    }
+  }
+  return values;
+}
+
+async function findSourceFiles(rootPath) {
+  return fg(['**/*.{js,jsx,ts,tsx,mjs,cjs,py,rb,go,rs,php,java,kt,swift,yaml,yml,json,toml,tf}'], {
+    cwd: rootPath,
+    absolute: true,
+    onlyFiles: true,
+    ignore: [
+      ...Array.from(SKIP_DIRS).map(d => `**/${d}/**`),
+      '**/.env*',
+      '**/*.min.js',
+      '**/__tests__/**',
+      '**/*.test.*',
+      '**/*.spec.*',
+      '**/test/**',
+      '**/tests/**',
+      '**/fixtures/**',
+      '**/snippets/**',
+    ],
+  });
+}
+
+function checkGitignored(rootPath, relPath) {
+  try {
+    execFileSync('git', ['check-ignore', '-q', relPath], { cwd: rootPath, stdio: 'pipe' });
+    return true; // exit 0 means it IS ignored
+  } catch {
+    return false; // exit 1 means it is NOT ignored
+  }
+}
+
+function checkGitHistory(rootPath) {
+  try {
+    const result = execFileSync('git', ['log', '--all', '--diff-filter=A', '--name-only', '--pretty=format:'], {
+      cwd: rootPath,
+      stdio: ['pipe', 'pipe', 'pipe'],
+      maxBuffer: 5 * 1024 * 1024,
+    }).toString();
+
+    const envFilePattern = /^\.env(?:\.\w+)?$/;
+    const safeEnvPattern = /\.env\.(?:example|sample|template)$/;
+    const committed = new Set();
+    for (const line of result.split('\n')) {
+      const trimmed = line.trim();
+      if (trimmed && envFilePattern.test(path.basename(trimmed)) && !safeEnvPattern.test(trimmed)) {
+        committed.add(trimmed);
+      }
+    }
+    return Array.from(committed);
+  } catch {
+    return [];
+  }
+}

package/cli/commands/fix.js

@@ -0,0 +1,218 @@
+/**
+ * Fix Command
+ * ===========
+ *
+ * Scans for secrets and generates a .env.example file with placeholder values.
+ * Also shows a summary of what to move to environment variables.
+ *
+ * USAGE:
+ *   praxis fix             Scan and generate .env.example
+ *   praxis fix --dry-run   Preview what would be generated (don't write file)
+ */
+
+import fs from 'fs';
+import path from 'path';
+import ora from 'ora';
+import chalk from 'chalk';
+import {
+  SECRET_PATTERNS,
+  SKIP_DIRS,
+  SKIP_EXTENSIONS,
+  SKIP_FILENAMES,
+  TEST_FILE_PATTERNS,
+  MAX_FILE_SIZE
+} from '../utils/patterns.js';
+import { isHighEntropyMatch } from '../utils/entropy.js';
+import fg from 'fast-glob';
+import * as output from '../utils/output.js';
+
+// =============================================================================
+// MAIN COMMAND
+// =============================================================================
+
+export async function fixCommand(options = {}) {
+  const cwd = process.cwd();
+
+  const spinner = ora({ text: 'Scanning for secrets...', color: 'cyan' }).start();
+
+  try {
+    const files = await findFiles(cwd);
+    const results = [];
+
+    for (const file of files) {
+      const findings = await scanFile(file);
+      if (findings.length > 0) {
+        results.push({ file, findings });
+      }
+    }
+
+    spinner.stop();
+
+    if (results.length === 0) {
+      output.success('No secrets found — nothing to fix!');
+      console.log(chalk.gray('\nYour codebase looks clean. Keep it that way with:'));
+      console.log(chalk.gray('  npx praxis-sec guard   # Block pushes if secrets are found'));
+      return;
+    }
+
+    // Build env var suggestions from findings
+    const envVars = buildEnvVarSuggestions(results);
+
+    output.header('Fix Report');
+    printFindings(results, cwd);
+    printEnvExample(envVars, options.dryRun);
+
+  } catch (err) {
+    spinner.fail('Fix scan failed');
+    output.error(err.message);
+    process.exit(1);
+  }
+}
+
+// =============================================================================
+// SCAN (same logic as scan command, reused here)
+// =============================================================================
+
+async function findFiles(rootPath) {
+  const globIgnore = Array.from(SKIP_DIRS).map(dir => `**/${dir}/**`);
+  const files = await fg('**/*', {
+    cwd: rootPath, absolute: true, onlyFiles: true, ignore: globIgnore, dot: true
+  });
+
+  const filtered = [];
+  for (const file of files) {
+    const ext = path.extname(file).toLowerCase();
+    if (SKIP_EXTENSIONS.has(ext)) continue;
+    if (SKIP_FILENAMES.has(path.basename(file))) continue;
+    const basename = path.basename(file);
+    if (basename.endsWith('.min.js') || basename.endsWith('.min.css')) continue;
+    if (TEST_FILE_PATTERNS.some(p => p.test(file))) continue;
+    if (basename === '.env.example') continue; // Don't scan example files
+    try {
+      const stats = fs.statSync(file);
+      if (stats.size > MAX_FILE_SIZE) continue;
+    } catch { continue; }
+    filtered.push(file);
+  }
+  return filtered;
+}
+
+async function scanFile(filePath) {
+  const findings = [];
+  try {
+    const content = fs.readFileSync(filePath, 'utf-8');
+    const lines = content.split('\n');
+
+    for (let lineNum = 0; lineNum < lines.length; lineNum++) {
+      const line = lines[lineNum];
+      if (/praxis-ignore/i.test(line)) continue;
+
+      for (const pattern of SECRET_PATTERNS) {
+        pattern.pattern.lastIndex = 0;
+        let match;
+        while ((match = pattern.pattern.exec(line)) !== null) {
+          if (pattern.requiresEntropyCheck && !isHighEntropyMatch(match[0])) continue;
+          findings.push({
+            line: lineNum + 1,
+            matched: match[0],
+            patternName: pattern.name,
+            severity: pattern.severity,
+          });
+        }
+      }
+    }
+  } catch {}
+  return findings;
+}
+
+// =============================================================================
+// ENV VAR GENERATION
+// =============================================================================
+
+function buildEnvVarSuggestions(results) {
+  const seen = new Set();
+  const vars = [];
+
+  for (const { findings } of results) {
+    for (const f of findings) {
+      const varName = patternToEnvVar(f.patternName);
+      if (!seen.has(varName)) {
+        seen.add(varName);
+        vars.push({ name: varName, comment: f.patternName });
+      }
+    }
+  }
+
+  return vars;
+}
+
+/**
+ * Convert a pattern name to a sensible env var name.
+ * e.g. "OpenAI API Key" → "OPENAI_API_KEY" // praxis-ignore — env var name in doc comment, not a secret value
+ */
+function patternToEnvVar(patternName) {
+  return patternName
+    .toUpperCase()
+    .replace(/[^A-Z0-9\s]/g, '')
+    .trim()
+    .replace(/\s+/g, '_');
+}
+
+// =============================================================================
+// OUTPUT
+// =============================================================================
+
+function printFindings(results, rootPath) {
+  const total = results.reduce((sum, r) => sum + r.findings.length, 0);
+  console.log(chalk.red.bold(`\n  Found ${total} secret(s) across ${results.length} file(s)\n`));
+
+  for (const { file, findings } of results) {
+    const relPath = path.relative(rootPath, file);
+    console.log(chalk.white.bold(`  ${relPath}`));
+    for (const f of findings) {
+      console.log(chalk.gray(`    Line ${f.line}: `) + chalk.yellow(f.patternName));
+    }
+  }
+}
+
+function printEnvExample(envVars, dryRun) {
+  const lines = [
+    '# .env.example',
+    '# Generated by praxis — replace placeholder values with your actual secrets.',
+    '# Copy this file to .env and fill in the values.',
+    '# NEVER commit .env — only commit .env.example',
+    '',
+  ];
+
+  for (const { name, comment } of envVars) {
+    lines.push(`# ${comment}`);
+    lines.push(`${name}=your_${name.toLowerCase()}_here`);
+    lines.push('');
+  }
+
+  const content = lines.join('\n');
+
+  output.header(dryRun ? '.env.example Preview (dry run)' : 'Generated .env.example');
+  console.log();
+  console.log(chalk.gray(content));
+
+  if (!dryRun) {
+    const envExamplePath = path.join(process.cwd(), '.env.example');
+
+    if (fs.existsSync(envExamplePath)) {
+      output.warning('.env.example already exists — skipping. Use --force to overwrite.');
+    } else {
+      fs.writeFileSync(envExamplePath, content);
+      output.success('Created .env.example');
+    }
+
+    console.log();
+    console.log(chalk.cyan.bold('Next steps:'));
+    console.log(chalk.white('1.') + chalk.gray(' Copy .env.example to .env'));
+    console.log(chalk.white('2.') + chalk.gray(' Replace placeholder values with your real secrets'));
+    console.log(chalk.white('3.') + chalk.gray(' Remove the hardcoded values from your source code'));
+    console.log(chalk.white('4.') + chalk.gray(' Verify .env is in your .gitignore'));
+    console.log(chalk.white('5.') + chalk.gray(' Run npx praxis-sec scan . to confirm clean'));
+    console.log();
+  }
+}