praxis-sec 1.1.0 → 1.2.1

package/cli/agents/base-agent.js

@@ -17,9 +17,63 @@
 
 import fs from 'fs';
 import path from 'path';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 import { SKIP_DIRS, SKIP_EXTENSIONS, SKIP_FILENAMES, MAX_FILE_SIZE, MAX_SCAN_FILES, loadGitignorePatterns } from '../utils/patterns.js';
 
+// =============================================================================
+// RULE-TABLE SUPPRESSION
+// =============================================================================
+//
+// A detection rule table is data, not code, and it necessarily contains the
+// signatures it hunts for: a rule's `description:` spells out the insecure call
+// it is looking for, so that prose matches the rule itself. Scanning our own
+// tables therefore reported every rule describing itself — 138 of 271 findings
+// in a self-scan, over half the report.
+//
+// Keep this comment free of concrete API names: quoting one makes this file a
+// match for the very rule being discussed.
+//
+// Suppression is deliberately two-stage so it cannot mask a real finding:
+//   1. the FILE must be a rule table (two or more matcher entries against rule
+//      ids — something application code never declares), and
+//   2. the LINE must be a rule field holding prose or a pattern.
+// A file that merely uses the words "description" or "fix" fails stage 1 and is
+// scanned normally.
+
+const RULE_MATCHER_FIELD = /^\s*(?:regex|pattern|detectionRegex)\s*:/;
+const RULE_ID_FIELD = /^\s*(?:rule|id|name)\s*:\s*['"`]/;
+const RULE_PROSE_FIELD =
+  /^\s*(?:title|description|fix|note|recommendation|regex|pattern|detectionRegex|severity|cwe|owasp|confidence|id|rule)\s*:/;
+
+const MIN_RULE_TABLE_ENTRIES = 2;
+
+/**
+ * Build the set of line indexes that hold rule-table prose rather than code.
+ *
+ * Returns `null` when the file is not a rule table, so callers get "scan this
+ * file normally" for free. Reuse the returned Set for the whole file: building
+ * it is one cheap pass, and callers that scan line by line would otherwise
+ * repeat it per line.
+ *
+ * @param {string[]} lines
+ * @returns {Set<number>|null} zero-based indexes of rule-definition lines
+ */
+export function ruleTableLineMask(lines) {
+  let matchers = 0;
+  let ids = 0;
+  for (const line of lines) {
+    if (RULE_MATCHER_FIELD.test(line)) matchers++;
+    else if (RULE_ID_FIELD.test(line)) ids++;
+  }
+  if (matchers < MIN_RULE_TABLE_ENTRIES || ids < MIN_RULE_TABLE_ENTRIES) return null;
+
+  const mask = new Set();
+  for (let i = 0; i < lines.length; i++) {
+    if (RULE_PROSE_FIELD.test(lines[i])) mask.add(i);
+  }
+  return mask;
+}
+
 // =============================================================================
 // FINDING FACTORY
 // =============================================================================
@@ -225,9 +279,15 @@ export class BaseAgent {
     const lines = content.split('\n');
     const findings = [];
 
+    // Rule tables state what a vulnerability looks like, so their prose and
+    // patterns match the rules looking for them. Skipping those lines is what
+    // stops a self-scan from reporting every rule describing itself.
+    const ruleTable = ruleTableLineMask(lines);
+
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
       if (this.isSuppressed(line)) continue;
+      if (ruleTable && ruleTable.has(i)) continue;
 
       for (const p of patterns) {
         p.regex.lastIndex = 0;

package/cli/agents/endpoint-agent-abuse-agent.js

@@ -27,7 +27,7 @@
 
 import fs from 'fs';
 import path from 'path';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 import { BaseAgent, createFinding } from './base-agent.js';
 
 // =============================================================================
@@ -247,7 +247,7 @@ export class EndpointAgentAbuseAgent extends BaseAgent {
         category: this.category,
         rule: 'EAA_AGENT_CLI_IN_LIFECYCLE',
         title: `Lifecycle Script "${name}" Invokes an AI Agent CLI`,
-        description: `An npm lifecycle hook launches a coding-agent CLI. Package installs run without user review, making this a vector for driving a trusted agent from an untrusted parent (EAA-001, observed in the Nx s1ngularity and Trivy OpenVSX incidents).`,
+        description: `An npm lifecycle hook launches a coding-agent CLI. Package installs run without user review, making this a vector for driving a trusted agent from an untrusted parent (EAA-001, observed in the Nx s1ngularity and Trivy OpenVSX incidents).`, // praxis-ignore AGENT_RECURSIVE_INVOCATION — description of a finding this scanner emits, not an agent definition
         matched: cmd.slice(0, 200),
         confidence: 'medium',
         cwe: 'CWE-506',

package/cli/agents/git-history-scanner.js

@@ -99,7 +99,7 @@ export class GitHistoryScanner extends BaseAgent {
               severity: stillExists ? p.severity : this.elevateSeverity(p.severity),
               category: 'history',
               rule: 'GIT_HISTORY_SECRET',
-              title: `Historical Secret: ${p.name}`,
+              title: `Historical Secret: ${p.name}`, // praxis-ignore AGENT_LOG_SECRET_KV — title template of a finding this scanner emits, not an agent definition
               description: stillExists
                 ? `Secret found in current code AND in git history (commit ${currentCommit}).`
                 : `Secret was removed from code but still exists in git history (commit ${currentCommit}, ${currentDate}). Anyone with repo access can retrieve it.`,

package/cli/agents/html-reporter.js

@@ -55,7 +55,7 @@ export class HTMLReporter {
 
   /**
    * The provenance line printed in report footers: exactly which tool, runtime and
-   * vendored data assets produced this document (P-IMP-053). A surprising result should
+   * vendored data assets produced this document. A surprising result should
    * be attributable, not mysterious.
    */
   getFingerprintLine(filesScanned = null) {
@@ -880,7 +880,7 @@ function toggleDetail(id) {
   /**
    * Score trend over time, from `.praxis/history.json`.
    *
-   * This is the part that must not overstate (P-IMP-055). An empty graph reads as
+   * This is the part that must not overstate. An empty graph reads as
    * "flat, no change", which is a different claim from "we have no data", so:
    *   - no prior scans  → say the project is at its baseline
    *   - fewer than 3 measurements → say a trend needs more, and show what exists
@@ -985,7 +985,7 @@ function toggleDetail(id) {
   }
 
   /**
-   * Remediation Ledger — the applied half of the find→fix→verify loop (P-IMP-054).
+   * Remediation Ledger — the applied half of the find→fix→verify loop.
    *
    * Reads `.praxis/fixes.jsonl` (currently applied changes) and `.praxis/failures.jsonl`
    * (plans proposed and rejected). Rejections are the more telling half: a rejected fix

package/cli/agents/index.js

@@ -123,11 +123,11 @@ export function buildOrchestrator() {
 }
 
 /**
- * Async build — loads built-in agents + any plugins from .praxis/agents/.
+ * Async build — loads built-ins and, with explicit trust, .praxis/agents/ plugins.
  * Preferred over buildOrchestrator() when rootPath is available.
  *
  * @param {string} rootPath — project root (for plugin discovery)
- * @param {object} options  — { verbose, quiet }
+ * @param {object} options  — { verbose, quiet, trustPlugins }
  */
 export async function buildOrchestratorAsync(rootPath, options = {}) {
   const orchestrator = new OrchestratorClass();

package/cli/agents/injection-tester.js

@@ -23,7 +23,14 @@ export const PATTERNS = [
   {
     rule: 'SQL_INJECTION_TEMPLATE_LITERAL',
     title: 'SQL Injection via Template Literal',
-    regex: /`(?:SELECT|INSERT|UPDATE|DELETE|DROP\s+TABLE|ALTER\s+TABLE|TRUNCATE|CREATE|REPLACE|MERGE)[^`]*\$\{/gi,
+    // Each keyword is anchored to the token SQL requires after it. The previous
+// `(?:SELECT|INSERT|...|CREATE|REPLACE|MERGE)[^`]*\$\{` matched the bare
+// keywords, so English words that merely start with one — created, updated,
+// deleted, inserted, replaced — fired a critical on any template literal like
+// `` `created file changed since fix: ${file.path}` ``. Anchoring also lets a
+// word that IS a keyword stand in for SQL only with its real continuation
+// (`MERGE INTO`, `SELECT ... FROM`), not `merge conflict`.
+regex: /`(?:SELECT\s+[\w*`,\s]{1,80}?\b(?:FROM|INTO|SET|VALUES|WHERE)\b|INSERT\s+INTO|UPDATE\s+[\w*`,\s]{1,80}?\bSET\b|DELETE\s+FROM|(?:DROP|ALTER)\s+TABLE|TRUNCATE\s+(?:TABLE\b|(?=[A-Za-z_]*\$\{))|CREATE\s+(?:TABLE|INDEX|UNIQUE|OR\s+REPLACE)|REPLACE\s+INTO|MERGE\s+INTO)[^`]*\$\{/gi,
     severity: 'critical',
     cwe: 'CWE-89',
     owasp: 'A03:2021',

package/cli/agents/mcp-security-agent.js

@@ -65,7 +65,13 @@ export const PATTERNS = [
   {
     rule: 'MCP_STDIO_NO_SANDBOX',
     title: 'MCP: stdio Transport Without Sandbox',
-    regex: /(?:StdioServerTransport|stdio|transport.*stdio)/g,
+    // Anchored to actual MCP context: the transport class itself, or a transport/type field
+    // whose value is stdio. An earlier version matched the bare substring instead, so every
+    // `stdio: 'pipe'` in a child_process call and every comment merely mentioning stdio was
+    // reported — 49 of Praxis's own 50 hits for this rule were that mistake, and it was the
+    // single largest source of noise in a self-scan. Keep this comment free of the class name
+    // or it will match itself.
+    regex: /StdioServerTransport|(?:transport|type)["']?\s*[:=]\s*["']?stdio\b/g, // praxis-ignore MCP_STDIO_NO_SANDBOX - this line necessarily names the pattern
     severity: 'medium',
     cwe: 'CWE-269',
     owasp: 'A04:2021',

package/cli/agents/memory-poisoning-agent.js

@@ -30,7 +30,7 @@
  */
 
 import path from 'path';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 import { BaseAgent, createFinding } from './base-agent.js';
 
 // =============================================================================

package/cli/agents/model-file-scanner.js

@@ -22,7 +22,7 @@
 
 import fs from 'fs';
 import path from 'path';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 import { BaseAgent, createFinding } from './base-agent.js';
 
 const MODEL_GLOBS = [

package/cli/agents/orchestrator.js

@@ -63,12 +63,17 @@ export class Orchestrator {
    * Run a single agent with a timeout.
    */
   async runAgent(agent, context, timeout) {
-    return Promise.race([
-      agent.analyze(context),
-      new Promise((_, reject) => {
-        setTimeout(() => reject(new Error(`timed out after ${timeout / 1000}s`)), timeout);
-      }),
-    ]);
+    let timer;
+    try {
+      return await Promise.race([
+        Promise.resolve().then(() => agent.analyze(context)),
+        new Promise((_, reject) => {
+          timer = setTimeout(() => reject(new Error(`timed out after ${timeout / 1000}s`)), timeout);
+        }),
+      ]);
+    } finally {
+      clearTimeout(timer);
+    }
   }
 
   /**