praxis-sec 1.0.0

package/cli/commands/init.js

@@ -0,0 +1,514 @@
+/**
+ * Init Command
+ * ============
+ *
+ * Initialize security configurations in the current project.
+ * Copies pre-configured security files from praxis.
+ *
+ * USAGE:
+ *   praxis init              Copy all security configs
+ *   praxis init --gitignore  Only copy .gitignore
+ *   praxis init --headers    Only copy security headers
+ *   praxis init -f           Force overwrite existing files
+ *
+ * FILES COPIED:
+ *   - .gitignore (merged with existing if present)
+ *   - nextjs-security-headers.js (for Next.js projects)
+ */
+
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import chalk from 'chalk';
+import * as output from '../utils/output.js';
+
+// Get the directory of this module (for finding config files)
+const __filename = fileURLToPath(import.meta.url); // praxis-ignore — module's own path via import.meta.url, not user input
+const __dirname = path.dirname(__filename);
+const PACKAGE_ROOT = path.resolve(__dirname, '..', '..');
+
+// =============================================================================
+// MAIN INIT FUNCTION
+// =============================================================================
+
+export async function initCommand(options = {}) {
+  const targetDir = process.cwd();
+
+  console.log();
+  output.header('Initializing Security Configs');
+  console.log();
+  console.log(chalk.gray(`Target directory: ${targetDir}`));
+  console.log();
+
+  const results = {
+    copied: [],
+    skipped: [],
+    merged: [],
+    errors: []
+  };
+
+  // Determine which files to copy.
+  // If a specific flag is set, only run that category.
+  // With no flags, run everything.
+  // Handle --openclaw flag separately
+  if (options.openclaw) {
+    return handleOpenClawInit(targetDir, options.force, results);
+  }
+
+  // Handle --hermes --from <url>
+  if (options.hermes) {
+    return handleHermesInit(targetDir, options);
+  }
+
+  const hasSpecificFlag = options.gitignore || options.headers || options.agents;
+  const copyGitignore = hasSpecificFlag ? !!options.gitignore : true;
+  const copyHeaders   = hasSpecificFlag ? !!options.headers   : true;
+  const copyAgents    = hasSpecificFlag ? !!options.agents    : true;
+
+  // Copy .gitignore
+  if (copyGitignore) {
+    await handleGitignore(targetDir, options.force, results);
+  }
+
+  // Copy security headers
+  if (copyHeaders) {
+    await handleSecurityHeaders(targetDir, options.force, results);
+  }
+
+  // Append security rules to AI agent instruction files
+  if (copyAgents) {
+    await handleAgentFiles(targetDir, options.force, results);
+  }
+
+  // Print summary
+  printSummary(results);
+}
+
+// =============================================================================
+// GITIGNORE HANDLING
+// =============================================================================
+
+async function handleGitignore(targetDir, force, results) {
+  // Note: We use 'gitignore-template' because npm excludes dotfiles from packages
+  const sourcePath = path.join(PACKAGE_ROOT, 'configs', 'gitignore-template');
+  const targetPath = path.join(targetDir, '.gitignore');
+
+  // Check if source exists
+  if (!fs.existsSync(sourcePath)) {
+    results.errors.push({
+      file: '.gitignore',
+      error: 'Source file not found in praxis package'
+    });
+    return;
+  }
+
+  const sourceContent = fs.readFileSync(sourcePath, 'utf-8');
+
+  // Check if target exists
+  if (fs.existsSync(targetPath)) {
+    if (force) {
+      // Overwrite
+      fs.writeFileSync(targetPath, sourceContent);
+      results.copied.push('.gitignore (overwritten)');
+    } else {
+      // Merge: append praxis patterns to existing
+      const existingContent = fs.readFileSync(targetPath, 'utf-8');
+
+      // Check if already has praxis content
+      if (existingContent.includes('# PRAXIS')) {
+        results.skipped.push('.gitignore (already contains praxis patterns)');
+        return;
+      }
+
+      // Append praxis section
+      const mergedContent = existingContent.trim() + '\n\n' +
+        '# =============================================================================\n' +
+        '# PRAXIS ADDITIONS\n' +
+        '# Added by: npx praxis-sec init\n' +
+        '# =============================================================================\n\n' +
+        extractSecurityPatterns(sourceContent);
+
+      fs.writeFileSync(targetPath, mergedContent);
+      results.merged.push('.gitignore');
+    }
+  } else {
+    // Create new
+    fs.writeFileSync(targetPath, sourceContent);
+    results.copied.push('.gitignore');
+  }
+}
+
+/**
+ * Extract the most important security patterns from our .gitignore
+ */
+function extractSecurityPatterns(fullGitignore) {
+  // Extract key sections
+  const patterns = `
+# Environment files
+.env
+.env.local
+.env*.local
+*.env
+
+# Private keys & certificates
+*.pem
+*.key
+*.p12
+*.pfx
+
+# Credentials
+*credentials*
+*.secrets.json
+secrets.yml
+secrets.yaml
+
+# Service accounts
+**/service-account*.json
+*-firebase-adminsdk-*.json
+
+# AWS
+.aws/credentials
+
+# Database files
+*.sqlite
+*.sqlite3
+*.db
+
+# Logs (may contain sensitive data)
+*.log
+logs/
+`;
+
+  return patterns.trim();
+}
+
+// =============================================================================
+// SECURITY HEADERS HANDLING
+// =============================================================================
+
+async function handleSecurityHeaders(targetDir, force, results) {
+  const sourcePath = path.join(PACKAGE_ROOT, 'configs', 'nextjs-security-headers.js');
+  const targetPath = path.join(targetDir, 'security-headers.config.js');
+
+  // Check if source exists
+  if (!fs.existsSync(sourcePath)) {
+    results.errors.push({
+      file: 'security-headers.config.js',
+      error: 'Source file not found in praxis package'
+    });
+    return;
+  }
+
+  // Detect if this is a Next.js project
+  const packageJsonPath = path.join(targetDir, 'package.json');
+  let isNextProject = false;
+
+  if (fs.existsSync(packageJsonPath)) {
+    try {
+      const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
+      isNextProject = !!(packageJson.dependencies?.next || packageJson.devDependencies?.next);
+    } catch {
+      // Ignore parse errors
+    }
+  }
+
+  // Check if target exists
+  if (fs.existsSync(targetPath) && !force) {
+    results.skipped.push('security-headers.config.js (already exists, use -f to overwrite)');
+    return;
+  }
+
+  // Copy the file
+  const content = fs.readFileSync(sourcePath, 'utf-8');
+  fs.writeFileSync(targetPath, content);
+  results.copied.push('security-headers.config.js');
+
+  // Show integration instructions
+  if (isNextProject) {
+    console.log(chalk.cyan('\nNext.js detected! Add to your next.config.js:\n'));
+    console.log(chalk.gray('  const { securityHeadersConfig } = require(\'./security-headers.config.js\');'));
+    console.log(chalk.gray('  module.exports = { ...securityHeadersConfig, /* your config */ };'));
+    console.log();
+  }
+}
+
+// =============================================================================
+// AGENT FILE HANDLING
+// =============================================================================
+
+// Marker used for idempotency — if this string is present we already added our section.
+const AGENT_MARKER = '<!-- praxis -->';
+
+// The security rules block appended to existing agent instruction files.
+const AGENT_SECTION = `
+## Security (praxis)
+${AGENT_MARKER}
+- Always run \`npx praxis-sec scan .\` before committing code
+- Never hardcode API keys, tokens, or credentials in source files — use environment variables
+- If hardcoded secrets are found or generated, run \`npx praxis-sec remediate\` to auto-fix them
+`;
+
+// Standalone content for a new Cursor rules file.
+const CURSOR_RULE_CONTENT = `---
+description: Prevent API key leaks and credential exposure in generated code
+alwaysApply: true
+---
+
+- Always run \`npx praxis-sec scan .\` before committing code
+- Never hardcode API keys, tokens, or credentials in source files — use environment variables
+- If hardcoded secrets are found or generated, run \`npx praxis-sec remediate\` to auto-fix them
+`;
+
+async function handleAgentFiles(targetDir, force, results) {
+  // Files where we append a section if they already exist, or create if they don't.
+  const appendTargets = [
+    { file: 'CLAUDE.md',                          label: 'CLAUDE.md' },
+    { file: '.windsurfrules',                      label: '.windsurfrules' },
+    { file: path.join('.github', 'copilot-instructions.md'), label: '.github/copilot-instructions.md' },
+  ];
+
+  for (const { file, label } of appendTargets) {
+    const targetPath = path.join(targetDir, file);
+
+    if (fs.existsSync(targetPath)) {
+      const existing = fs.readFileSync(targetPath, 'utf-8');
+      if (existing.includes(AGENT_MARKER)) {
+        results.skipped.push(`${label} (already contains praxis rules)`);
+        continue;
+      }
+      if (force || true) { // always append unless already present
+        fs.writeFileSync(targetPath, existing.trimEnd() + '\n' + AGENT_SECTION);
+        results.merged.push(label);
+      }
+    } else {
+      // Ensure parent directory exists (e.g. .github/)
+      const parentDir = path.dirname(targetPath);
+      if (!fs.existsSync(parentDir)) {
+        fs.mkdirSync(parentDir, { recursive: true });
+      }
+      fs.writeFileSync(targetPath, AGENT_SECTION.trim() + '\n');
+      results.copied.push(label);
+    }
+  }
+
+  // Cursor rules — dedicated file, no merging needed.
+  const cursorRulesDir  = path.join(targetDir, '.cursor', 'rules');
+  const cursorRulesFile = path.join(cursorRulesDir, 'praxis.mdc');
+
+  if (fs.existsSync(cursorRulesFile) && !force) {
+    results.skipped.push('.cursor/rules/praxis.mdc (already exists, use -f to overwrite)');
+  } else {
+    if (!fs.existsSync(cursorRulesDir)) {
+      fs.mkdirSync(cursorRulesDir, { recursive: true });
+    }
+    fs.writeFileSync(cursorRulesFile, CURSOR_RULE_CONTENT.trim() + '\n');
+    results.copied.push('.cursor/rules/praxis.mdc');
+  }
+}
+
+// =============================================================================
+// HERMES AGENT INIT
+// =============================================================================
+
+async function handleHermesInit(targetDir, options) {
+  const fromUrl = options.from;
+
+  if (!fromUrl) {
+    console.error(chalk.red('\nError: --hermes requires --from <setup-url>'));
+    console.error(chalk.gray('  Generate a setup URL at: '));
+    console.error(chalk.gray('  Then run: npx praxis-sec init --hermes --from <url>\n'));
+    process.exit(1);
+  }
+
+  // Validate the URL is well-formed and from a trusted origin.
+  // Allow HTTPS (any host — the security is HTTPS + explicit user opt-in via
+  // `praxis init --from <url>`) and localhost for local development.
+  let parsed;
+  try {
+    parsed = new URL(fromUrl);
+  } catch {
+    console.error(chalk.red('\nError: Invalid URL: ' + fromUrl + '\n'));
+    process.exit(1);
+  }
+
+  const isLocal = parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';
+  const isHttps = parsed.protocol === 'https:';
+  if (!isLocal && !isHttps) {
+    console.error(chalk.red('\nError: Setup URL must use HTTPS (got: ' + parsed.protocol + '//)'));
+    console.error(chalk.gray('  Or use http://localhost for local development.\n'));
+    process.exit(1);
+  }
+
+  console.log();
+  output.header('Hermes Agent Security Setup');
+  console.log();
+  console.log(chalk.gray('Fetching config from:'), chalk.cyan(fromUrl));
+  console.log();
+
+  // Fetch the config bundle
+  let data;
+  try {
+    const { default: fetch } = await import('node-fetch').catch(() => ({ default: globalThis.fetch }));
+    const res = await fetch(fromUrl, { headers: { 'Accept': 'application/json' } });
+    if (!res.ok) {
+      const body = await res.json().catch(() => ({}));
+      throw new Error(body.error ?? `HTTP ${res.status}`);
+    }
+    data = await res.json();
+  } catch (err) {
+    console.error(chalk.red('\nFailed to fetch setup config: ' + err.message + '\n'));
+    process.exit(1);
+  }
+
+  if (!data.files || !Array.isArray(data.files) || data.files.length === 0) {
+    console.error(chalk.red('\nInvalid config bundle — no files returned.\n'));
+    process.exit(1);
+  }
+
+  // Write each file
+  const written = [];
+  const skipped = [];
+
+  for (const { path: filePath, content } of data.files) {
+    // Sanitize path — no traversal
+    const normalized = path.normalize(filePath).replace(/^(\.\.(\/|\\|$))+/, '');
+    const absPath = path.join(targetDir, normalized);
+
+    if (fs.existsSync(absPath) && !options.force) {
+      skipped.push(normalized);
+      continue;
+    }
+
+    const dir = path.dirname(absPath);
+    if (!fs.existsSync(dir)) {
+      fs.mkdirSync(dir, { recursive: true });
+    }
+    fs.writeFileSync(absPath, content, 'utf-8');
+    written.push(normalized);
+  }
+
+  // Print results
+  console.log(chalk.green.bold('Files written:'));
+  for (const f of written) {
+    console.log(chalk.green(`  ✔ ${f}`));
+  }
+  if (skipped.length > 0) {
+    console.log();
+    console.log(chalk.yellow.bold('Skipped (already exist — use -f to overwrite):'));
+    for (const f of skipped) {
+      console.log(chalk.yellow(`  → ${f}`));
+    }
+  }
+
+  console.log();
+  console.log(chalk.cyan.bold('Next steps:'));
+  console.log(chalk.white('  1.') + ' Populate your baseline:    ' + chalk.cyan('npx praxis-sec audit .'));
+  console.log(chalk.white('  2.') + ' Auto-fix findings:         ' + chalk.cyan('npx praxis-sec audit . --agentic 3 --agentic-target 80'));
+  console.log(chalk.white('  3.') + ' Commit everything and push — CI runs on every PR.');
+  console.log();
+}
+
+// =============================================================================
+// OPENCLAW HARDENED CONFIG
+// =============================================================================
+
+const HARDENED_OPENCLAW = `{
+  "// SECURITY": "Generated by praxis init --openclaw — hardened defaults",
+
+  "// host": "Bind to localhost only — never 0.0.0.0 (CVE-2026-25253 ClawJacked)",
+  "host": "127.0.0.1",
+  "port": 3100,
+
+  "// auth": "Always require authentication — prevents unauthorized agent takeover",
+  "auth": {
+    "type": "apiKey",
+    "key": "\${OPENCLAW_API_KEY}"
+  },
+
+  "// url": "Use wss:// for all non-localhost connections (encrypted WebSocket)",
+  "url": "wss://localhost:3100",
+
+  "// safeBins": "Allowlist of binaries the agent can execute — block everything else",
+  "safeBins": ["node", "git", "npx", "npm"],
+
+  "// skills": "Only add verified skills from trusted sources — ClawHavoc had 1,184 malicious skills",
+  "skills": [],
+
+  "// logging": "Enable audit logging for security monitoring",
+  "logging": {
+    "level": "info",
+    "auditLog": true
+  }
+}
+`;
+
+async function handleOpenClawInit(targetDir, force, results) {
+  const targetPath = path.join(targetDir, 'openclaw.json');
+
+  if (fs.existsSync(targetPath) && !force) {
+    results.skipped.push('openclaw.json (already exists, use -f to overwrite)');
+  } else {
+    fs.writeFileSync(targetPath, HARDENED_OPENCLAW.trim() + '\n');
+    results.copied.push('openclaw.json (hardened template)');
+  }
+
+  printSummary(results);
+
+  console.log(chalk.cyan('Important:'));
+  console.log(chalk.white('  1.') + ' Set the OPENCLAW_API_KEY environment variable');
+  console.log(chalk.white('  2.') + ' Only add verified skills from trusted sources');
+  console.log(chalk.white('  3.') + ' Run ' + chalk.cyan('npx praxis-sec openclaw .') + ' to verify security');
+  console.log();
+}
+
+// =============================================================================
+// SUMMARY
+// =============================================================================
+
+function printSummary(results) {
+  console.log();
+  console.log(chalk.cyan('='.repeat(60)));
+  console.log(chalk.cyan.bold('  Summary'));
+  console.log(chalk.cyan('='.repeat(60)));
+  console.log();
+
+  if (results.copied.length > 0) {
+    console.log(chalk.green.bold('Created:'));
+    for (const file of results.copied) {
+      console.log(chalk.green(`  \u2714 ${file}`));
+    }
+    console.log();
+  }
+
+  if (results.merged.length > 0) {
+    console.log(chalk.blue.bold('Merged:'));
+    for (const file of results.merged) {
+      console.log(chalk.blue(`  \u2194 ${file} (appended praxis patterns)`));
+    }
+    console.log();
+  }
+
+  if (results.skipped.length > 0) {
+    console.log(chalk.yellow.bold('Skipped:'));
+    for (const file of results.skipped) {
+      console.log(chalk.yellow(`  \u2192 ${file}`));
+    }
+    console.log();
+  }
+
+  if (results.errors.length > 0) {
+    console.log(chalk.red.bold('Errors:'));
+    for (const { file, error } of results.errors) {
+      console.log(chalk.red(`  \u2718 ${file}: ${error}`));
+    }
+    console.log();
+  }
+
+  // Next steps
+  console.log(chalk.cyan('Next steps:'));
+  console.log(chalk.white('  1.') + ' Review the copied files and customize for your project');
+  console.log(chalk.white('  2.') + ' Run ' + chalk.cyan('npx praxis-sec scan .') + ' to check for secrets');
+  console.log(chalk.white('  3.') + ' Run ' + chalk.cyan('npx praxis-sec checklist') + ' before launching');
+  console.log();
+  console.log(chalk.cyan('='.repeat(60)));
+}

package/cli/commands/legal.js

@@ -0,0 +1,158 @@
+/**
+ * Legal Command
+ * =============
+ *
+ * Scans dependency manifests for packages that carry legal risk:
+ * active DMCA takedowns, leaked-source derivatives, IP disputes,
+ * and license violations.
+ *
+ * USAGE:
+ *   praxis legal [path]        Scan for legally risky dependencies
+ *   praxis legal . --json      JSON output
+ *
+ * EXIT CODES:
+ *   0  Clean — no legally risky packages found
+ *   1  Findings — one or more legally risky packages detected
+ */
+
+import fs from 'fs';
+import path from 'path';
+import chalk from 'chalk';
+import ora from 'ora';
+import { LegalRiskAgent } from '../agents/legal-risk-agent.js';
+import * as output from '../utils/output.js';
+
+// =============================================================================
+// RISK LABELS & COLORS
+// =============================================================================
+
+const RISK_COLORS = {
+  dmca:              chalk.red.bold,
+  'ip-dispute':      chalk.red,
+  'leaked-source':   chalk.yellow.bold,
+  'license-violation': chalk.yellow,
+};
+
+const RISK_LABELS = {
+  dmca:              'DMCA Takedown',
+  'ip-dispute':      'IP Dispute',
+  'leaked-source':   'Leaked Source',
+  'license-violation': 'License Violation',
+};
+
+const SEVERITY_COLORS = {
+  critical: chalk.bgRed.white.bold,
+  high:     chalk.red.bold,
+  medium:   chalk.yellow,
+  low:      chalk.blue,
+};
+
+// =============================================================================
+// MAIN COMMAND
+// =============================================================================
+
+export async function legalCommand(targetPath = '.', options = {}) {
+  const absolutePath = path.resolve(targetPath);
+
+  if (!fs.existsSync(absolutePath)) {
+    output.error(`Path does not exist: ${absolutePath}`);
+    process.exit(1);
+  }
+
+  if (!options.json) {
+    console.log();
+    output.header('Legal Risk Audit');
+    console.log(chalk.gray('  Scanning for DMCA notices, leaked-source derivatives, and IP disputes'));
+    console.log();
+  }
+
+  // ── Run the agent ──────────────────────────────────────────────────────────
+  const spinner = options.json
+    ? null
+    : ora({ text: 'Scanning dependency manifests…', color: 'cyan' }).start();
+
+  const agent = new LegalRiskAgent();
+  let findings = [];
+
+  try {
+    findings = await agent.analyze({ rootPath: absolutePath, files: [] });
+    if (spinner) spinner.stop();
+  } catch (err) {
+    if (spinner) spinner.stop();
+    output.error(`Legal scan failed: ${err.message}`);
+    process.exit(1);
+  }
+
+  // ── JSON output ────────────────────────────────────────────────────────────
+  if (options.json) {
+    console.log(JSON.stringify({ findings, total: findings.length }, null, 2));
+    process.exit(findings.length > 0 ? 1 : 0);
+  }
+
+  // ── Human-readable output ──────────────────────────────────────────────────
+  if (findings.length === 0) {
+    output.success('No legally risky packages found.');
+    console.log();
+    console.log(chalk.gray('  Scanned: package.json, requirements.txt, Cargo.toml, go.mod'));
+    console.log();
+    return;
+  }
+
+  // Group by severity
+  const bySeverity = { critical: [], high: [], medium: [], low: [] };
+  for (const f of findings) {
+    (bySeverity[f.severity] || bySeverity.medium).push(f);
+  }
+
+  const total = findings.length;
+  const critCount = bySeverity.critical.length;
+  const highCount = bySeverity.high.length;
+
+  // Summary line
+  console.log(
+    chalk.red.bold(`  ${total} legal risk finding${total === 1 ? '' : 's'}`),
+    chalk.gray('—'),
+    critCount > 0 ? chalk.red.bold(`${critCount} critical`) + chalk.gray(', ') : '',
+    highCount > 0 ? chalk.red(`${highCount} high`) : '',
+  );
+  console.log();
+
+  // Print findings
+  for (const severity of ['critical', 'high', 'medium', 'low']) {
+    const group = bySeverity[severity];
+    if (group.length === 0) continue;
+
+    for (const f of group) {
+      const sevBadge = SEVERITY_COLORS[severity]
+        ? SEVERITY_COLORS[severity](` ${severity.toUpperCase()} `)
+        : chalk.gray(` ${severity.toUpperCase()} `);
+
+      // Extract risk type from rule: LEGAL_RISK_DMCA → dmca
+      const riskKey = f.rule
+        .replace('LEGAL_RISK_', '')
+        .toLowerCase()
+        .replace(/_/g, '-');
+      const riskColor = RISK_COLORS[riskKey] || chalk.white;
+      const riskLabel = RISK_LABELS[riskKey] || riskKey;
+
+      console.log(`  ${sevBadge}  ${chalk.white.bold(f.title)}`);
+      console.log(`          ${riskColor(`[${riskLabel}]`)}  ${chalk.gray(path.relative(absolutePath, f.file) || f.file)}`);
+      console.log();
+      console.log(`          ${chalk.gray(f.description)}`);
+      console.log();
+      if (f.fix) {
+        console.log(`          ${chalk.cyan('Fix:')} ${chalk.gray(f.fix)}`);
+      }
+      console.log();
+      console.log(chalk.gray('  ' + '─'.repeat(56)));
+      console.log();
+    }
+  }
+
+  // Footer
+  console.log(chalk.yellow.bold('  ⚠  Shipping legally risky packages can expose your project to IP liability.'));
+  console.log(chalk.gray('     Review each finding and remove the affected dependency before releasing.'));
+  console.log();
+
+  process.exit(1);
+}