praxis-sec 1.2.0 → 1.2.1

package/cli/commands/baseline.js

@@ -19,7 +19,7 @@ import ora from 'ora';
 import { buildOrchestrator } from '../agents/index.js';
 import { SECRET_PATTERNS, SKIP_DIRS, SKIP_EXTENSIONS, SKIP_FILENAMES, MAX_FILE_SIZE } from '../utils/patterns.js';
 import { isHighEntropyMatch } from '../utils/entropy.js';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 
 const BASELINE_FILE = '.praxis/baseline.json';
 

package/cli/commands/benchmark.js

@@ -34,7 +34,7 @@ import {
 } from '../utils/patterns.js';
 import { isHighEntropyMatch, getConfidence } from '../utils/entropy.js';
 import * as output from '../utils/output.js';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 
 // =============================================================================
 // INDUSTRY BENCHMARKS (aggregated from public research)

package/cli/commands/ci.js

@@ -37,7 +37,7 @@ import {
 import { isHighEntropyMatch, getConfidence } from '../utils/entropy.js';
 import { ThreatIntel } from '../utils/threat-intel.js';
 import * as intelOrchestrator from '../utils/intel/index.js';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 
 // =============================================================================
 // MAIN COMMAND
@@ -50,6 +50,12 @@ export async function ciCommand(targetPath = '.', options = {}) {
   const alwaysFailOn = options.alwaysFailOn || null;
   const sarifPath = options.sarif || null;
 
+  if (!Number.isFinite(threshold) || threshold < 0 || threshold > 100 ||
+      [failOn, alwaysFailOn].some(value => value && !['critical', 'high', 'medium', 'low'].includes(value))) {
+    console.error('[praxis] Invalid CI gate: threshold must be 0-100 and severity must be critical, high, medium, or low.');
+    process.exit(2);
+  }
+
   if (!fs.existsSync(absolutePath)) {
     console.error(`[praxis] Path does not exist: ${absolutePath}`);
     process.exit(1);
@@ -99,16 +105,26 @@ export async function ciCommand(targetPath = '.', options = {}) {
 
   // ── Agent Scan ───────────────────────────────────────────────────────────
   const orchestrator = buildOrchestrator();
-  const results = await orchestrator.runAll(absolutePath, { quiet: true }); // praxis-ignore — orchestrator result, not LLM output triggering actions
+  const results = await orchestrator.runAll(absolutePath, { quiet: true, deep: options.deep }); // praxis-ignore — orchestrator result, not LLM output triggering actions
   const agentFindings = results.findings;
+  let scanComplete = results.agentResults.every(agent => agent.success);
+  if (!scanComplete) console.error('[praxis] Scan incomplete: one or more agents failed.');
 
   // ── Dependency Audit ─────────────────────────────────────────────────────
   let depVulns = [];
+  let dependencyAudit = options.deps === false ? 'skipped' : 'not-applicable';
   if (options.deps !== false) {
     try {
       const depResult = await runDepsAudit(absolutePath);
       depVulns = depResult.vulns || [];
-    } catch { /* skip */ }
+      dependencyAudit = depResult.error ? 'failed' : (depResult.pm ? 'complete' : 'not-applicable');
+    } catch {
+      dependencyAudit = 'failed';
+    }
+    if (dependencyAudit === 'failed') {
+      scanComplete = false;
+      console.error('[praxis] Dependency audit incomplete. Install the package manager audit tool and check registry access, or explicitly use --no-deps.');
+    }
   }
 
   // ── Merge & Deduplicate ──────────────────────────────────────────────────
@@ -140,6 +156,8 @@ export async function ciCommand(targetPath = '.', options = {}) {
   scoringEngine.saveToHistory(absolutePath, scoreResult);
 
   const duration = ((Date.now() - startTime) / 1000).toFixed(1);
+  const gateFindings = [...allFindings, ...depVulns];
+  const floorFindings = [...preBaselineFindings, ...depVulns];
 
   // ── SARIF Output ─────────────────────────────────────────────────────────
   if (sarifPath) {
@@ -168,7 +186,10 @@ export async function ciCommand(targetPath = '.', options = {}) {
         })),
       } : {}),
       threshold,
-      pass: determinePass(scoreResult, allFindings, threshold, failOn, alwaysFailOn, preBaselineFindings),
+      scanComplete,
+      dependencyAudit,
+      floorPass: determinePass(scoreResult, [], 0, null, alwaysFailOn, floorFindings),
+      pass: scanComplete && determinePass(scoreResult, gateFindings, threshold, failOn, alwaysFailOn, floorFindings),
       duration: `${duration}s`,
     }, null, 2));
   } else {
@@ -192,7 +213,7 @@ export async function ciCommand(targetPath = '.', options = {}) {
     }
   }
 
-  // ── GitHub PR Inline Annotations (P-IMP-044) ───────────────────────────
+  // ── GitHub PR Inline Annotations ───────────────────────────
   emitGitHubAnnotations(allFindings, absolutePath);
 
   // ── GitHub PR Comment ──────────────────────────────────────────────────
@@ -200,12 +221,12 @@ export async function ciCommand(targetPath = '.', options = {}) {
     try {
       postPRComment(scoreResult, allFindings, depVulns, absolutePath, duration);
     } catch (err) {
-      console.log(`[praxis] Warning: Could not post PR comment: ${err.message}`);
+      console.error(`[praxis] Warning: Could not post PR comment: ${err.message}`);
     }
   }
 
   // ── Exit Code ────────────────────────────────────────────────────────────
-  const pass = determinePass(scoreResult, allFindings, threshold, failOn, alwaysFailOn, preBaselineFindings);
+  const pass = scanComplete && determinePass(scoreResult, gateFindings, threshold, failOn, alwaysFailOn, floorFindings);
   if (!pass) {
     if (!options.json) {
       if (failOn) {
@@ -229,14 +250,7 @@ export async function ciCommand(targetPath = '.', options = {}) {
 // HELPERS
 // =============================================================================
 
-function determinePass(scoreResult, findings, threshold, failOn, alwaysFailOn, preBaselineFindings = null) {
-  if (failOn) {
-    const sevOrder = ['critical', 'high', 'medium', 'low'];
-    const failIndex = sevOrder.indexOf(failOn);
-    if (failIndex === -1) return scoreResult.score >= threshold;
-    const blockingSevs = sevOrder.slice(0, failIndex + 1);
-    return !findings.some(f => blockingSevs.includes(f.severity));
-  }
+export function determinePass(scoreResult, findings, threshold, failOn, alwaysFailOn, preBaselineFindings = null) {
   if (alwaysFailOn) {
     const sevOrder = ['critical', 'high', 'medium', 'low'];
     const floorIndex = sevOrder.indexOf(alwaysFailOn);
@@ -246,6 +260,13 @@ function determinePass(scoreResult, findings, threshold, failOn, alwaysFailOn, p
     const floorSet = preBaselineFindings || findings;
     if (floorSet.some(f => floorSevs.includes(f.severity))) return false;
   }
+  if (failOn) {
+    const sevOrder = ['critical', 'high', 'medium', 'low'];
+    const failIndex = sevOrder.indexOf(failOn);
+    if (failIndex === -1) return scoreResult.score >= threshold;
+    const blockingSevs = sevOrder.slice(0, failIndex + 1);
+    return !findings.some(f => blockingSevs.includes(f.severity));
+  }
   return scoreResult.score >= threshold;
 }
 
@@ -256,16 +277,19 @@ function emitGitHubAnnotations(findings, rootPath) {
     const rel = path.relative(rootPath, f.file).replace(/\\/g, '/');
     const level = ['critical', 'high'].includes(f.severity) ? 'error' : 'warning';
     const col = f.column || 1;
-    const title = (f.title || f.rule || 'Security Finding').replace(/\r?\n/g, ' ');
-    const msg = (f.description || f.matched || '').replace(/\r?\n/g, ' ').slice(0, 300);
-    console.log(`::${level} file=${rel},line=${f.line},col=${col},title=${title}::${msg}`);
+    const escapeData = value => String(value).replace(/%/g, '%25').replace(/\r/g, '%0D').replace(/\n/g, '%0A');
+    const escapeProperty = value => escapeData(value).replace(/:/g, '%3A').replace(/,/g, '%2C');
+    const title = escapeProperty(f.title || f.rule || 'Security Finding');
+    // Matched text may be a live credential. Annotations only need the description.
+    const msg = escapeData(String(f.description || 'Security finding detected').slice(0, 300));
+    console.error(`::${level} file=${escapeProperty(rel)},line=${f.line},col=${col},title=${title}::${msg}`);
   }
 }
 
 /**
  * SARIF for GitHub Code Scanning.
  *
- * Delegates to the shared serializer in `cli/core/output/sarif.js` (P-IMP-062). This
+ * Delegates to the shared serializer in `cli/core/output/sarif.js`. This
  * used to be a private copy, which is why the GitHub Action's SARIF carried no
  * `security-severity` at all — the fix landed in the registry and never reached here.
  *
@@ -301,7 +325,7 @@ function postPRComment(scoreResult, findings, depVulns, rootPath, duration) {
       const parsed = JSON.parse(prJson);
       prNumber = String(parsed.number);
     } catch {
-      console.log('[praxis] No PR detected — skipping PR comment');
+      console.error('[praxis] No PR detected — skipping PR comment');
       return;
     }
   }
@@ -344,7 +368,7 @@ function postPRComment(scoreResult, findings, depVulns, rootPath, duration) {
     stdio: ['pipe', 'pipe', 'pipe'], // praxis-ignore
   });
 
-  console.log(`[praxis] PR comment posted on #${prNumber}`);
+  console.error(`[praxis] PR comment posted on #${prNumber}`);
 }
 
 function checkIntelFreshness(maxAge) {

package/cli/commands/deps.js

@@ -229,7 +229,10 @@ function parseNpmAudit(jsonStr) {
   try {
     data = JSON.parse(jsonStr);
   } catch {
-    return [];
+    throw new Error('Dependency audit did not produce valid JSON');
+  }
+  if (!data || data.error || (!data.vulnerabilities && !data.advisories)) {
+    throw new Error('Dependency audit did not produce an audit report');
   }
 
   const vulns = [];
@@ -331,11 +334,14 @@ function parsePipAudit(jsonStr) {
   try {
     data = JSON.parse(jsonStr);
   } catch {
-    return [];
+    throw new Error('Dependency audit did not produce valid JSON');
   }
 
+  const dependencies = Array.isArray(data) ? data : data?.dependencies;
+  if (!Array.isArray(dependencies)) throw new Error('Dependency audit did not produce an audit report');
+
   const vulns = [];
-  for (const pkg of (Array.isArray(data) ? data : [])) {
+  for (const pkg of dependencies) {
     for (const vuln of (pkg.vulns || [])) {
       const fixVersion = vuln.fix_versions?.[0];
       vulns.push({
@@ -500,7 +506,7 @@ function printDepFindings(vulns, pm) {
 
 /**
  * Run the dependency audit for a given path and return normalized vulnerabilities.
- * Returns { pm, vulns } or { pm: null, vulns: [] } if no manifest found.
+ * Returns { pm, vulns, error? }. An unavailable audit is never a clean audit.
  * Does not print anything — used programmatically by other commands.
  */
 export async function runDepsAudit(rootPath) {
@@ -511,6 +517,6 @@ export async function runDepsAudit(rootPath) {
     const vulns = runAudit(pm, rootPath);
     return { pm, vulns };
   } catch {
-    return { pm, vulns: [] };
+    return { pm, vulns: [], error: `${pm.name} dependency audit could not be completed` };
   }
 }

package/cli/commands/env-audit.js

@@ -22,7 +22,7 @@
 
 import fs from 'fs';
 import path from 'path';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 import chalk from 'chalk';
 import ora from 'ora';
 import { execFileSync } from 'child_process';

package/cli/commands/fix.js

@@ -23,7 +23,7 @@ import {
   MAX_FILE_SIZE
 } from '../utils/patterns.js';
 import { isHighEntropyMatch } from '../utils/entropy.js';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 import * as output from '../utils/output.js';
 
 // =============================================================================

package/cli/commands/mcp.js

@@ -34,7 +34,7 @@
 
 import fs from 'fs';
 import path from 'path';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 import { SECRET_PATTERNS, SKIP_DIRS, SKIP_EXTENSIONS, SKIP_FILENAMES, TEST_FILE_PATTERNS, MAX_FILE_SIZE } from '../utils/patterns.js';
 import { isHighEntropyMatch } from '../utils/entropy.js';
 import { buildOrchestrator } from '../agents/index.js';