praxis-sec 1.2.0 → 1.2.1

package/cli/agents/base-agent.js

@@ -17,7 +17,7 @@
 
 import fs from 'fs';
 import path from 'path';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 import { SKIP_DIRS, SKIP_EXTENSIONS, SKIP_FILENAMES, MAX_FILE_SIZE, MAX_SCAN_FILES, loadGitignorePatterns } from '../utils/patterns.js';
 
 // =============================================================================

package/cli/agents/endpoint-agent-abuse-agent.js

@@ -27,7 +27,7 @@
 
 import fs from 'fs';
 import path from 'path';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 import { BaseAgent, createFinding } from './base-agent.js';
 
 // =============================================================================

package/cli/agents/html-reporter.js

@@ -55,7 +55,7 @@ export class HTMLReporter {
 
   /**
    * The provenance line printed in report footers: exactly which tool, runtime and
-   * vendored data assets produced this document (P-IMP-053). A surprising result should
+   * vendored data assets produced this document. A surprising result should
    * be attributable, not mysterious.
    */
   getFingerprintLine(filesScanned = null) {
@@ -880,7 +880,7 @@ function toggleDetail(id) {
   /**
    * Score trend over time, from `.praxis/history.json`.
    *
-   * This is the part that must not overstate (P-IMP-055). An empty graph reads as
+   * This is the part that must not overstate. An empty graph reads as
    * "flat, no change", which is a different claim from "we have no data", so:
    *   - no prior scans  → say the project is at its baseline
    *   - fewer than 3 measurements → say a trend needs more, and show what exists
@@ -985,7 +985,7 @@ function toggleDetail(id) {
   }
 
   /**
-   * Remediation Ledger — the applied half of the find→fix→verify loop (P-IMP-054).
+   * Remediation Ledger — the applied half of the find→fix→verify loop.
    *
    * Reads `.praxis/fixes.jsonl` (currently applied changes) and `.praxis/failures.jsonl`
    * (plans proposed and rejected). Rejections are the more telling half: a rejected fix

package/cli/agents/index.js

@@ -123,11 +123,11 @@ export function buildOrchestrator() {
 }
 
 /**
- * Async build — loads built-in agents + any plugins from .praxis/agents/.
+ * Async build — loads built-ins and, with explicit trust, .praxis/agents/ plugins.
  * Preferred over buildOrchestrator() when rootPath is available.
  *
  * @param {string} rootPath — project root (for plugin discovery)
- * @param {object} options  — { verbose, quiet }
+ * @param {object} options  — { verbose, quiet, trustPlugins }
  */
 export async function buildOrchestratorAsync(rootPath, options = {}) {
   const orchestrator = new OrchestratorClass();

package/cli/agents/injection-tester.js

@@ -23,7 +23,14 @@ export const PATTERNS = [
   {
     rule: 'SQL_INJECTION_TEMPLATE_LITERAL',
     title: 'SQL Injection via Template Literal',
-    regex: /`(?:SELECT|INSERT|UPDATE|DELETE|DROP\s+TABLE|ALTER\s+TABLE|TRUNCATE|CREATE|REPLACE|MERGE)[^`]*\$\{/gi,
+    // Each keyword is anchored to the token SQL requires after it. The previous
+// `(?:SELECT|INSERT|...|CREATE|REPLACE|MERGE)[^`]*\$\{` matched the bare
+// keywords, so English words that merely start with one — created, updated,
+// deleted, inserted, replaced — fired a critical on any template literal like
+// `` `created file changed since fix: ${file.path}` ``. Anchoring also lets a
+// word that IS a keyword stand in for SQL only with its real continuation
+// (`MERGE INTO`, `SELECT ... FROM`), not `merge conflict`.
+regex: /`(?:SELECT\s+[\w*`,\s]{1,80}?\b(?:FROM|INTO|SET|VALUES|WHERE)\b|INSERT\s+INTO|UPDATE\s+[\w*`,\s]{1,80}?\bSET\b|DELETE\s+FROM|(?:DROP|ALTER)\s+TABLE|TRUNCATE\s+(?:TABLE\b|(?=[A-Za-z_]*\$\{))|CREATE\s+(?:TABLE|INDEX|UNIQUE|OR\s+REPLACE)|REPLACE\s+INTO|MERGE\s+INTO)[^`]*\$\{/gi,
     severity: 'critical',
     cwe: 'CWE-89',
     owasp: 'A03:2021',

package/cli/agents/memory-poisoning-agent.js

@@ -30,7 +30,7 @@
  */
 
 import path from 'path';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 import { BaseAgent, createFinding } from './base-agent.js';
 
 // =============================================================================

package/cli/agents/model-file-scanner.js

@@ -22,7 +22,7 @@
 
 import fs from 'fs';
 import path from 'path';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 import { BaseAgent, createFinding } from './base-agent.js';
 
 const MODEL_GLOBS = [

package/cli/agents/orchestrator.js

@@ -63,12 +63,17 @@ export class Orchestrator {
    * Run a single agent with a timeout.
    */
   async runAgent(agent, context, timeout) {
-    return Promise.race([
-      agent.analyze(context),
-      new Promise((_, reject) => {
-        setTimeout(() => reject(new Error(`timed out after ${timeout / 1000}s`)), timeout);
-      }),
-    ]);
+    let timer;
+    try {
+      return await Promise.race([
+        Promise.resolve().then(() => agent.analyze(context)),
+        new Promise((_, reject) => {
+          timer = setTimeout(() => reject(new Error(`timed out after ${timeout / 1000}s`)), timeout);
+        }),
+      ]);
+    } finally {
+      clearTimeout(timer);
+    }
   }
 
   /**

package/cli/agents/prompt-injection-prober.js

@@ -1,228 +1,228 @@
-/**
- * Prompt Injection Prober
- * ========================
- *
- * Loads a probe corpus from cli/data/probes/prompt-injection-corpus.json and
- * scans source code for static-detectable signals that match each probe.
- *
- * The corpus replaces hardcoded patterns: new probes are added by editing
- * the JSON file. Each probe carries `tags` (e.g. ['LLM01', 'AML.T0051'])
- * which feed into the standards registry automatically — once the agent
- * tags a finding with the probe IDs, the per-finding `standards` field is
- * populated by the ScoringEngine.
- *
- * Maps to: OWASP LLM01/05/06/07/08, MITRE ATLAS T0043/T0051/T0053/T0054/T0057/T0070.
- */
-
-import fs from 'fs';
-import path from 'path';
-import os from 'os';
-import { fileURLToPath } from 'url';
-import { BaseAgent, createFinding, ruleTableLineMask } from './base-agent.js';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-const CORPUS_PATH = path.resolve(__dirname, '..', 'data', 'probes', 'prompt-injection-corpus.json');
-
-const SCAN_EXTS = new Set(['.js', '.jsx', '.mjs', '.cjs', '.ts', '.tsx', '.py', '.rb', '.go', '.java', '.rs', '.php']);
-
-let _cachedCorpus = null;
-
-/** Reads a JSON file, returning null rather than throwing. */
-function readJson(file) {
-  try {
-    return JSON.parse(fs.readFileSync(file, 'utf-8'));
-  } catch {
-    return null;
-  }
-}
-
-const THREATPACK_SEED = path.join(path.dirname(CORPUS_PATH), '..', 'threatpacks', 'latest.json');
-
-function loadCorpus() {
-  if (_cachedCorpus) return _cachedCorpus;
-  try {
-    const data = readJson(CORPUS_PATH) || {};
-    const categoryById = {};
-    for (const c of data.categories || []) categoryById[c.id] = c;
-
-    const decorate = (p) => {
-      const cat = categoryById[p.category] || {};
-      let regex;
-      try {
-        regex = compileProbeRegex(p.regex);
-      } catch {
-        regex = null;
-      }
-      return {
-        ...p,
-        patternSource: p.regex,
-        regex,
-        categoryTitle: cat.title || p.category,
-        tags: cat.tags || [],
-      };
-    };
-
-    // 1. Bundled prompt-injection corpus.
-    const probes = (data.probes || []).map(decorate);
-
-    // 2. Bundled threat-pack seed — the detection floor for this release.
-    //
-    // The seed used to be consulted only via `praxis intel update`. Loading it here
-    // means the shipped attack-vector families work on a first run with no network,
-    // and it makes the release's own signatures authoritative (P-IMP-064).
-    const seed = readJson(THREATPACK_SEED);
-    const seedVersion = seed?.version || null;
-    for (const p of seed?.probes || []) probes.push(decorate(p));
-
-    // 3. Overlay the fetched intel feed, which may bring newer signatures.
-    //
-    //    Version-gated per probe: a feed older than the bundled seed must not replace
-    //    a probe the release already ships. A stale `threat-intel.json` holding
-    //    threatpack 1.0.0 was reinstating the pre-fix TP-003 pattern
-    //    (`when\s+combined\s+with`, no referent, no instruction noun) and reporting
-    //    ordinary English as prompt injection. A feed newer than, or equal to, the
-    //    seed still wins, so updates keep working.
-    let feedApplied = 0;
-    let feedRejected = 0;
-    const feed = readJson(path.join(os.homedir(), '.praxis', 'threat-intel.json'));
-    const pack = feed?.threatPack;
-    const feedVersion = pack?.version || null;
-    const feedIsOlder = seedVersion && feedVersion
-      && compareVersions(feedVersion, seedVersion) < 0;
-
-    for (const p of pack?.probes || []) {
-      if (feedIsOlder) { feedRejected++; continue; }
-      const decorated = decorate(p);
-      const existing = probes.findIndex(x => x.id === p.id);
-      if (existing >= 0) probes[existing] = decorated;
-      else probes.push(decorated);
-      feedApplied++;
-    }
-
-    _cachedCorpus = {
-      version: data.version,
-      probes,
-      seedThreatPackVersion: seedVersion,
-      feedThreatPackVersion: feedVersion,
-      feedApplied,
-      feedRejected,
-    };
-    return _cachedCorpus;
-  } catch {
-    _cachedCorpus = { version: '0', probes: [], feedApplied: 0, feedRejected: 0 };
-    return _cachedCorpus;
-  }
-}
-
-/**
- * Compares dotted version strings numerically. Returns <0, 0 or >0.
- * Missing/invalid segments compare as 0, so `1.0` and `1.0.0` are equal.
- */
-function compareVersions(a, b) {
-  const pa = String(a).split('.').map(n => parseInt(n, 10) || 0);
-  const pb = String(b).split('.').map(n => parseInt(n, 10) || 0);
-  const len = Math.max(pa.length, pb.length);
-  for (let i = 0; i < len; i++) {
-    const d = (pa[i] || 0) - (pb[i] || 0);
-    if (d !== 0) return d;
-  }
-  return 0;
-}
-
-function compileProbeRegex(pattern) {
-  let flags = 'g';
-  let body = pattern;
-  const m = body.match(/^\(\?([imsux]+)\)/);
-  if (m) {
-    for (const f of m[1]) if ('imsu'.includes(f) && !flags.includes(f)) flags += f;
-    body = body.slice(m[0].length);
-  }
-  // Scanner hardening: reject nested-quantifier constructs that risk
-  // catastrophic backtracking on adversarial input.
-  if (NESTED_QUANTIFIER.test(body)) {
-    throw new Error('ReDoS-unsafe probe regex (nested quantifiers)');
-  }
-  return new RegExp(body, flags);
-}
-
-const NESTED_QUANTIFIER = /\((?:[^()\\]|\\.)*[+*]\)[+*{]/;
-
-export class PromptInjectionProber extends BaseAgent {
-  constructor() {
-    super(
-      'PromptInjectionProber',
-      'Probe-corpus-driven scan for prompt-injection patterns (OWASP LLM01, ATLAS T0043/T0051)',
-      'llm'
-    );
-    this._corpus = loadCorpus();
-    this.probeCount = this._corpus.probes.length;
-  }
-
-  shouldRun(recon) {
-    if (!recon) return true;
-    const langs = recon.languages instanceof Set ? [...recon.languages] : (recon.languages || []);
-    if (langs.some(l => ['javascript', 'typescript', 'python', 'ruby', 'go', 'java', 'rust', 'php'].includes(l))) {
-      return true;
-    }
-    return Boolean(recon.frameworks?.length || recon.apiRoutes?.length);
-  }
-
-  async analyze(context) {
-    const findings = [];
-    const probes = this._corpus.probes.filter(p => p.regex);
-    if (probes.length === 0) return findings;
-
-    const files = this.getFilesToScan(context).filter(f => SCAN_EXTS.has(path.extname(f).toLowerCase()));
-
-    for (const file of files) {
-      const content = this.readFile(file);
-      if (!content) continue;
-      const lines = content.split('\n');
-      // A probe payload quoted in a rule table's own prose is the table
-      // documenting the probe, not an injection.
-      const ruleTable = ruleTableLineMask(lines);
-
-      for (const probe of probes) {
-        probe.regex.lastIndex = 0;
-        let match;
-        while ((match = probe.regex.exec(content)) !== null) {
-          const idx = match.index;
-          const before = content.slice(0, idx);
-          const lineNum = before.split('\n').length;
-          const lastNl = before.lastIndexOf('\n');
-          const column = lastNl === -1 ? idx + 1 : idx - lastNl;
-          const lineText = lines[lineNum - 1] || '';
-          if (this.isSuppressed(lineText)) continue;
-          if (ruleTable && ruleTable.has(lineNum - 1)) continue;
-
-          const finding = createFinding({
-            file,
-            line: lineNum,
-            column,
-            severity: probe.severity || 'medium',
-            category: 'llm',
-            rule: `PROBE_${probe.id}`,
-            title: probe.title,
-            description: probe.description,
-            matched: match[0].slice(0, 160),
-            confidence: 'medium',
-            cwe: 'CWE-77',
-            owasp: 'ASI01',
-            fix: probe.fix || 'Sanitize untrusted input before LLM prompt construction.',
-          });
-          finding.probe = { id: probe.id, category: probe.category, tags: probe.tags };
-          findings.push(finding);
-
-          if (!probe.regex.global) break;
-          if (match.index === probe.regex.lastIndex) probe.regex.lastIndex++;
-        }
-      }
-    }
-
-    return findings;
-  }
-}
-
-export const _internals = { loadCorpus, compileProbeRegex, CORPUS_PATH };
-export default PromptInjectionProber;
+/**
+ * Prompt Injection Prober
+ * ========================
+ *
+ * Loads a probe corpus from cli/data/probes/prompt-injection-corpus.json and
+ * scans source code for static-detectable signals that match each probe.
+ *
+ * The corpus replaces hardcoded patterns: new probes are added by editing
+ * the JSON file. Each probe carries `tags` (e.g. ['LLM01', 'AML.T0051'])
+ * which feed into the standards registry automatically — once the agent
+ * tags a finding with the probe IDs, the per-finding `standards` field is
+ * populated by the ScoringEngine.
+ *
+ * Maps to: OWASP LLM01/05/06/07/08, MITRE ATLAS T0043/T0051/T0053/T0054/T0057/T0070.
+ */
+
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import { fileURLToPath } from 'url';
+import { BaseAgent, createFinding, ruleTableLineMask } from './base-agent.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const CORPUS_PATH = path.resolve(__dirname, '..', 'data', 'probes', 'prompt-injection-corpus.json');
+
+const SCAN_EXTS = new Set(['.js', '.jsx', '.mjs', '.cjs', '.ts', '.tsx', '.py', '.rb', '.go', '.java', '.rs', '.php']);
+
+let _cachedCorpus = null;
+
+/** Reads a JSON file, returning null rather than throwing. */
+function readJson(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, 'utf-8'));
+  } catch {
+    return null;
+  }
+}
+
+const THREATPACK_SEED = path.join(path.dirname(CORPUS_PATH), '..', 'threatpacks', 'latest.json');
+
+function loadCorpus() {
+  if (_cachedCorpus) return _cachedCorpus;
+  try {
+    const data = readJson(CORPUS_PATH) || {};
+    const categoryById = {};
+    for (const c of data.categories || []) categoryById[c.id] = c;
+
+    const decorate = (p) => {
+      const cat = categoryById[p.category] || {};
+      let regex;
+      try {
+        regex = compileProbeRegex(p.regex);
+      } catch {
+        regex = null;
+      }
+      return {
+        ...p,
+        patternSource: p.regex,
+        regex,
+        categoryTitle: cat.title || p.category,
+        tags: cat.tags || [],
+      };
+    };
+
+    // 1. Bundled prompt-injection corpus.
+    const probes = (data.probes || []).map(decorate);
+
+    // 2. Bundled threat-pack seed — the detection floor for this release.
+    //
+    // The seed used to be consulted only via `praxis intel update`. Loading it here
+    // means the shipped attack-vector families work on a first run with no network,
+    // and it makes the release's own signatures authoritative.
+    const seed = readJson(THREATPACK_SEED);
+    const seedVersion = seed?.version || null;
+    for (const p of seed?.probes || []) probes.push(decorate(p));
+
+    // 3. Overlay the fetched intel feed, which may bring newer signatures.
+    //
+    //    Version-gated per probe: a feed older than the bundled seed must not replace
+    //    a probe the release already ships. A stale `threat-intel.json` holding
+    //    threatpack 1.0.0 was reinstating the pre-fix TP-003 pattern
+    //    (`when\s+combined\s+with`, no referent, no instruction noun) and reporting
+    //    ordinary English as prompt injection. A feed newer than, or equal to, the
+    //    seed still wins, so updates keep working.
+    let feedApplied = 0;
+    let feedRejected = 0;
+    const feed = readJson(path.join(os.homedir(), '.praxis', 'threat-intel.json'));
+    const pack = feed?.threatPack;
+    const feedVersion = pack?.version || null;
+    const feedIsOlder = seedVersion && feedVersion
+      && compareVersions(feedVersion, seedVersion) < 0;
+
+    for (const p of pack?.probes || []) {
+      if (feedIsOlder) { feedRejected++; continue; }
+      const decorated = decorate(p);
+      const existing = probes.findIndex(x => x.id === p.id);
+      if (existing >= 0) probes[existing] = decorated;
+      else probes.push(decorated);
+      feedApplied++;
+    }
+
+    _cachedCorpus = {
+      version: data.version,
+      probes,
+      seedThreatPackVersion: seedVersion,
+      feedThreatPackVersion: feedVersion,
+      feedApplied,
+      feedRejected,
+    };
+    return _cachedCorpus;
+  } catch {
+    _cachedCorpus = { version: '0', probes: [], feedApplied: 0, feedRejected: 0 };
+    return _cachedCorpus;
+  }
+}
+
+/**
+ * Compares dotted version strings numerically. Returns <0, 0 or >0.
+ * Missing/invalid segments compare as 0, so `1.0` and `1.0.0` are equal.
+ */
+function compareVersions(a, b) {
+  const pa = String(a).split('.').map(n => parseInt(n, 10) || 0);
+  const pb = String(b).split('.').map(n => parseInt(n, 10) || 0);
+  const len = Math.max(pa.length, pb.length);
+  for (let i = 0; i < len; i++) {
+    const d = (pa[i] || 0) - (pb[i] || 0);
+    if (d !== 0) return d;
+  }
+  return 0;
+}
+
+function compileProbeRegex(pattern) {
+  let flags = 'g';
+  let body = pattern;
+  const m = body.match(/^\(\?([imsux]+)\)/);
+  if (m) {
+    for (const f of m[1]) if ('imsu'.includes(f) && !flags.includes(f)) flags += f;
+    body = body.slice(m[0].length);
+  }
+  // Scanner hardening: reject nested-quantifier constructs that risk
+  // catastrophic backtracking on adversarial input.
+  if (NESTED_QUANTIFIER.test(body)) {
+    throw new Error('ReDoS-unsafe probe regex (nested quantifiers)');
+  }
+  return new RegExp(body, flags);
+}
+
+const NESTED_QUANTIFIER = /\((?:[^()\\]|\\.)*[+*]\)[+*{]/;
+
+export class PromptInjectionProber extends BaseAgent {
+  constructor() {
+    super(
+      'PromptInjectionProber',
+      'Probe-corpus-driven scan for prompt-injection patterns (OWASP LLM01, ATLAS T0043/T0051)',
+      'llm'
+    );
+    this._corpus = loadCorpus();
+    this.probeCount = this._corpus.probes.length;
+  }
+
+  shouldRun(recon) {
+    if (!recon) return true;
+    const langs = recon.languages instanceof Set ? [...recon.languages] : (recon.languages || []);
+    if (langs.some(l => ['javascript', 'typescript', 'python', 'ruby', 'go', 'java', 'rust', 'php'].includes(l))) {
+      return true;
+    }
+    return Boolean(recon.frameworks?.length || recon.apiRoutes?.length);
+  }
+
+  async analyze(context) {
+    const findings = [];
+    const probes = this._corpus.probes.filter(p => p.regex);
+    if (probes.length === 0) return findings;
+
+    const files = this.getFilesToScan(context).filter(f => SCAN_EXTS.has(path.extname(f).toLowerCase()));
+
+    for (const file of files) {
+      const content = this.readFile(file);
+      if (!content) continue;
+      const lines = content.split('\n');
+      // A probe payload quoted in a rule table's own prose is the table
+      // documenting the probe, not an injection.
+      const ruleTable = ruleTableLineMask(lines);
+
+      for (const probe of probes) {
+        probe.regex.lastIndex = 0;
+        let match;
+        while ((match = probe.regex.exec(content)) !== null) {
+          const idx = match.index;
+          const before = content.slice(0, idx);
+          const lineNum = before.split('\n').length;
+          const lastNl = before.lastIndexOf('\n');
+          const column = lastNl === -1 ? idx + 1 : idx - lastNl;
+          const lineText = lines[lineNum - 1] || '';
+          if (this.isSuppressed(lineText)) continue;
+          if (ruleTable && ruleTable.has(lineNum - 1)) continue;
+
+          const finding = createFinding({
+            file,
+            line: lineNum,
+            column,
+            severity: probe.severity || 'medium',
+            category: 'llm',
+            rule: `PROBE_${probe.id}`,
+            title: probe.title,
+            description: probe.description,
+            matched: match[0].slice(0, 160),
+            confidence: 'medium',
+            cwe: 'CWE-77',
+            owasp: 'ASI01',
+            fix: probe.fix || 'Sanitize untrusted input before LLM prompt construction.',
+          });
+          finding.probe = { id: probe.id, category: probe.category, tags: probe.tags };
+          findings.push(finding);
+
+          if (!probe.regex.global) break;
+          if (match.index === probe.regex.lastIndex) probe.regex.lastIndex++;
+        }
+      }
+    }
+
+    return findings;
+  }
+}
+
+export const _internals = { loadCorpus, compileProbeRegex, CORPUS_PATH };
+export default PromptInjectionProber;

package/cli/bin/praxis.js

@@ -123,7 +123,8 @@ const scan = program
 
 scan
   .command('full [path]', { isDefault: true })
-  .description('Full audit: secrets + 28 agents + deps + score + remediation plan')
+  .description('Full audit: secrets + 28 agents + deps + score + remediation plan')
+  .option('--trust-plugins', 'Execute trusted local .praxis/agents plugins with your permissions')
   .option('--json', 'Output results as JSON')
   .option('--sarif', 'Output results in SARIF format')
   .option('--csv', 'Output results as CSV')
@@ -261,7 +262,8 @@ scan
   .option('--threshold <score>', 'Minimum passing score (default: 75)', parseInt)
   .option('--fail-on <severity>', 'Fail on findings at this severity or above')
   .option('--always-fail-on <severity>', 'Severity floor that even an accepted baseline cannot suppress')
-  .option('--include-findings', 'Include the finding list (file/rule/severity) in JSON output for diffing')
+  .option('--include-findings', 'Include the finding list (file/rule/severity) in JSON output for diffing')
+  .option('--deep', 'Enable LLM deep analysis (requires an API key)')
   .option('--sarif <file>', 'Write SARIF output for GitHub Code Scanning')
   .option('--json', 'JSON output')
   .option('--no-deps', 'Skip dependency audit')
@@ -685,7 +687,8 @@ legacy('ci [path]', 'CI/CD mode: scan, score, exit 1 on failure (alias of `scan
   ['--threshold <score>', 'Minimum passing score (default: 75)', parseInt],
   ['--fail-on <severity>', 'Fail on findings at this severity or above'],
   ['--always-fail-on <severity>', 'Severity floor that even an accepted baseline cannot suppress'],
-  ['--include-findings', 'Include the finding list (file/rule/severity) in JSON output for diffing'],
+  ['--include-findings', 'Include the finding list (file/rule/severity) in JSON output for diffing'],
+  ['--deep', 'Enable LLM deep analysis (requires an API key)'],
   ['--sarif <file>', 'Write SARIF output for GitHub Code Scanning'],
   ['--json', 'JSON output'],
   ['--no-deps', 'Skip dependency audit'],
@@ -696,6 +699,7 @@ legacy('ci [path]', 'CI/CD mode: scan, score, exit 1 on failure (alias of `scan
 ]).action(ciCommand);
 
 legacy('audit [path]', 'Audit agent configs (CLAUDE.md, .cursorrules, MCP, skills) — alias of `agents audit`', [
+  ['--trust-plugins', 'Execute trusted local .praxis/agents plugins with your permissions'],
   ['--fix', 'Auto-harden agent configurations'],
   ['--preflight', 'Exit non-zero on critical findings (for CI)'],
   ['--red-team', 'Simulate adversarial attacks against agent configs'],