praxis-sec 1.0.0

package/cli/commands/web.js

@@ -0,0 +1,63 @@
+/**
+ * `praxis web` — local web UI for driving scans and managing scan projects.
+ *
+ * Read-only by design: it orchestrates scans and shows results, and deliberately does
+ * NOT expose fix application. See docs/design/WEB-UI.md for the threat model.
+ */
+
+import { createServer, resolveBind, isLoopback } from '../core/web/server.js';
+import { runScanWithOrchestrator, JobQueue } from '../core/web/jobs.js';
+import { listProjects } from '../core/web/projects.js';
+import * as output from '../utils/output.js';
+
+export async function webCommand(options = {}) {
+  const host = options.host || '127.0.0.1'; // praxis-ignore SSRF_INTERNAL_IP — loopback default; resolveBind() enforces the remote-bind policy
+  const port = parseInt(options.port || '7317', 10);
+  const allowRemote = Boolean(options.allowRemote);
+  const token = options.token || process.env.PRAXIS_WEB_TOKEN || null;
+
+  const bind = resolveBind(host, { allowRemote, token });
+  if (!bind.ok) {
+    output.error(bind.error);
+    process.exitCode = 1;
+    return;
+  }
+
+  const { server, jobs } = createServer({
+    host: bind.host,
+    port,
+    token: bind.remote ? token : null,
+    queue: new JobQueue({ runScan: runScanWithOrchestrator }),
+  });
+
+  await new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(port, bind.host, resolve);
+  });
+
+  const actual = server.address();
+  output.success(`Praxis Web listening on http://${bind.host}:${actual.port}`);
+  if (bind.remote) {
+    output.warn('REMOTE BIND — this server exposes source code and scan results. Anyone who can reach it, and knows the token, can read them.');
+  } else {
+    output.info('Loopback only. Use --allow-remote --token <16+ chars> to expose it deliberately.');
+  }
+
+  const registered = listProjects();
+  output.info(registered.length
+    ? `${registered.length} project(s) already registered.`
+    : 'No projects registered yet — add one from the UI, or POST /api/projects.');
+
+  output.info('This UI is read-only: it cannot apply fixes. Use `praxis fix` for remediation.');
+
+  const shutdown = () => {
+    output.info('\nShutting down…');
+    server.close(() => process.exit(0));
+    // Do not let a hung SSE connection block exit forever.
+    setTimeout(() => process.exit(0), 2000).unref();
+  };
+  process.on('SIGINT', shutdown);
+  process.on('SIGTERM', shutdown);
+
+  return { server, jobs, isLoopback: isLoopback(bind.host) };
+}

package/cli/core/ast/guardrail-detector.js

@@ -0,0 +1,141 @@
+/**
+ * Praxis AI Guardrail & Defense Framework Detector
+ * ==================================================
+ *
+ * Detects active runtime guardrails, structured generation wrappers, and
+ * content moderation defenses in AI/LLM and RAG pipelines.
+ *
+ * When an active guardrail protects an LLM prompt or RAG vector sink,
+ * findings are downgraded or marked as mitigated to prevent false positives.
+ */
+
+// =============================================================================
+// GUARDRAIL SIGNATURES
+// =============================================================================
+
+export const GUARDRAIL_FRAMEWORKS = [
+  {
+    name: 'NeMo Guardrails',
+    category: 'input_output_rails',
+    importPatterns: [/from\s+nemoguardrails\s+import/i, /import\s+nemoguardrails/i],
+    usagePatterns: [/\bLLMRails\s*\(/i, /\bRailsConfig\s*\(/i, /\brails\.generate\s*\(/i],
+  },
+  {
+    name: 'Llama Guard',
+    category: 'moderation_classifier',
+    importPatterns: [/llama_guard/i, /LlamaGuard/i],
+    usagePatterns: [/\bLlamaGuard\s*\(/i, /\brun_llama_guard\s*\(/i, /\bcheck_moderation\s*\(/i],
+  },
+  {
+    name: 'Outlines (Structured Generation)',
+    category: 'structured_generation',
+    importPatterns: [/import\s+outlines/i, /from\s+outlines\s+import/i],
+    usagePatterns: [/\boutlines\.generate\.(?:choice|json|regex|format)\s*\(/i],
+  },
+  {
+    name: 'Instructor / Structured Outputs',
+    category: 'structured_output',
+    importPatterns: [/import\s+instructor/i, /from\s+instructor\s+import/i],
+    usagePatterns: [/\binstructor\.from_openai\s*\(/i, /\bresponse_model\s*=/i, /\bclient\.beta\.chat\.completions\.parse\s*\(/i],
+  },
+  {
+    name: 'LangChain Moderation / Constitutional',
+    category: 'pipeline_rails',
+    importPatterns: [/OpenAIModerationChain/i, /ConstitutionalChain/i],
+    usagePatterns: [/\bOpenAIModerationChain\s*\(/i, /\bConstitutionalChain\s*\(/i],
+  },
+  {
+    name: 'Zod / Pydantic Schema Validation',
+    category: 'schema_validation',
+    importPatterns: [/from\s+pydantic\s+import/i, /import\s+\{\s*z\s*\}\s+from\s+['"]zod['"]/i, /require\s*\(\s*['"]zod['"]\s*\)/i],
+    usagePatterns: [/\bclass\s+\w+\s*\(\s*BaseModel\s*\)/i, /\bz\.object\s*\(/i, /\bsafeParse\s*\(/i, /\bschema\.parse\s*\(/i],
+  },
+  {
+    name: 'DOMPurify / HTML Sanitizer',
+    category: 'content_sanitization',
+    importPatterns: [/DOMPurify/i, /sanitize-html/i, /import\s+bleach/i],
+    usagePatterns: [/\bDOMPurify\.sanitize\s*\(/i, /\bsanitizeHtml\s*\(/i, /\bbleach\.clean\s*\(/i],
+  },
+];
+
+export class GuardrailDetector {
+  /**
+   * Scan code content for active guardrail frameworks.
+   *
+   * @param {string} code — Source code
+   * @returns {object}    — { hasGuardrails: boolean, frameworks: string[], defenses: string[] }
+   */
+  static detect(code = '') {
+    if (!code || typeof code !== 'string') {
+      return { hasGuardrails: false, frameworks: [], defenses: [] };
+    }
+
+    const detectedFrameworks = [];
+    const detectedDefenses = [];
+
+    for (const fw of GUARDRAIL_FRAMEWORKS) {
+      const hasImport = fw.importPatterns.some(p => p.test(code));
+      const hasUsage = fw.usagePatterns.some(p => p.test(code));
+
+      if (hasImport || hasUsage) {
+        detectedFrameworks.push(fw.name);
+        detectedDefenses.push(fw.category);
+      }
+    }
+
+    return {
+      hasGuardrails: detectedFrameworks.length > 0,
+      frameworks: detectedFrameworks,
+      defenses: Array.from(new Set(detectedDefenses)),
+    };
+  }
+
+  /**
+   * Check if a specific finding sink is protected by a guardrail.
+   *
+   * @param {object} finding — Finding object
+   * @param {string} code    — File code content
+   * @returns {object}       — { isProtected: boolean, guardrail: string|null, reason: string|null }
+   */
+  static checkProtection(finding, code = '') {
+    const analysis = GuardrailDetector.detect(code);
+    if (!analysis.hasGuardrails) {
+      return { isProtected: false, guardrail: null, reason: null };
+    }
+
+    const findingRule = finding.rule || '';
+    const findingCat = finding.category || '';
+
+    // LLM / Prompt injection findings
+    if (findingCat === 'llm' || findingRule.includes('PROMPT') || findingRule.includes('AGENT')) {
+      const aiGuard = analysis.frameworks.find(f =>
+        f.includes('NeMo') || f.includes('Llama Guard') || f.includes('Outlines') || f.includes('Instructor') || f.includes('LangChain')
+      );
+      if (aiGuard) {
+        return {
+          isProtected: true,
+          guardrail: aiGuard,
+          reason: `Code uses active AI defense framework: ${aiGuard}`,
+        };
+      }
+    }
+
+    // RAG findings
+    if (findingRule.includes('RAG') || findingCat === 'rag') {
+      const schemaGuard = analysis.frameworks.find(f =>
+        f.includes('Zod') || f.includes('Pydantic') || f.includes('DOMPurify') || f.includes('NeMo')
+      );
+      if (schemaGuard) {
+        return {
+          isProtected: true,
+          guardrail: schemaGuard,
+          reason: `RAG ingestion pipeline is guarded by ${schemaGuard}`,
+        };
+      }
+    }
+
+    return { isProtected: false, guardrail: null, reason: null };
+  }
+}
+
+export default GuardrailDetector;

package/cli/core/ast/index.js

@@ -0,0 +1,22 @@
+/**
+ * Praxis AST & Dataflow Engine
+ * =============================
+ *
+ * Unified export surface for:
+ * - ASTParser (fast JavaScript/TypeScript & Python tokenizer and parser)
+ * - ScopeTree (lexical scope tree & symbol resolution)
+ * - TaintTracker (source-to-sink dataflow analysis)
+ * - GuardrailDetector (AI runtime defense & guardrail detection)
+ */
+
+export { ASTParser, Tokenizer, TokenType, NodeType } from './parser.js';
+export { ScopeTree, Scope, ScopeType } from './scope-tree.js';
+export { TaintTracker, UNTRUSTED_SOURCES, SANITIZERS } from './taint-tracker.js';
+export { GuardrailDetector, GUARDRAIL_FRAMEWORKS } from './guardrail-detector.js';
+
+export default {
+  ASTParser: import('./parser.js').then(m => m.ASTParser),
+  ScopeTree: import('./scope-tree.js').then(m => m.ScopeTree),
+  TaintTracker: import('./taint-tracker.js').then(m => m.TaintTracker),
+  GuardrailDetector: import('./guardrail-detector.js').then(m => m.GuardrailDetector),
+};