praxis-sec 1.2.0 → 1.2.2

package/cli/commands/baseline.js

@@ -16,10 +16,11 @@ import fs from 'fs';
 import path from 'path';
 import chalk from 'chalk';
 import ora from 'ora';
+import { displayPath } from '../core/paths.js';
 import { buildOrchestrator } from '../agents/index.js';
 import { SECRET_PATTERNS, SKIP_DIRS, SKIP_EXTENSIONS, SKIP_FILENAMES, MAX_FILE_SIZE } from '../utils/patterns.js';
 import { isHighEntropyMatch } from '../utils/entropy.js';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 
 const BASELINE_FILE = '.praxis/baseline.json';
 
@@ -28,7 +29,7 @@ const BASELINE_FILE = '.praxis/baseline.json';
  * Uses rule + relative file path + first 40 chars of matched text.
  */
 function fingerprint(finding, rootPath) {
-  const relFile = path.relative(rootPath, finding.file || '').replace(/\\/g, '/');
+  const relFile = displayPath(finding.file || '', rootPath);
   const matched = (finding.matched || '').slice(0, 40);
   return `${finding.rule}:${relFile}:${matched}`;
 }

package/cli/commands/benchmark.js

@@ -34,7 +34,7 @@ import {
 } from '../utils/patterns.js';
 import { isHighEntropyMatch, getConfidence } from '../utils/entropy.js';
 import * as output from '../utils/output.js';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 
 // =============================================================================
 // INDUSTRY BENCHMARKS (aggregated from public research)

package/cli/commands/ci.js

@@ -19,6 +19,7 @@
 
 import fs from 'fs';
 import path from 'path';
+import { displayPath } from '../core/paths.js';
 import { renderFindingsSARIF } from '../core/output/sarif.js';
 import { execFileSync } from 'child_process';
 import { buildOrchestrator } from '../agents/index.js';
@@ -37,7 +38,7 @@ import {
 import { isHighEntropyMatch, getConfidence } from '../utils/entropy.js';
 import { ThreatIntel } from '../utils/threat-intel.js';
 import * as intelOrchestrator from '../utils/intel/index.js';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 
 // =============================================================================
 // MAIN COMMAND
@@ -50,6 +51,12 @@ export async function ciCommand(targetPath = '.', options = {}) {
   const alwaysFailOn = options.alwaysFailOn || null;
   const sarifPath = options.sarif || null;
 
+  if (!Number.isFinite(threshold) || threshold < 0 || threshold > 100 ||
+      [failOn, alwaysFailOn].some(value => value && !['critical', 'high', 'medium', 'low'].includes(value))) {
+    console.error('[praxis] Invalid CI gate: threshold must be 0-100 and severity must be critical, high, medium, or low.');
+    process.exit(2);
+  }
+
   if (!fs.existsSync(absolutePath)) {
     console.error(`[praxis] Path does not exist: ${absolutePath}`);
     process.exit(1);
@@ -99,16 +106,26 @@ export async function ciCommand(targetPath = '.', options = {}) {
 
   // ── Agent Scan ───────────────────────────────────────────────────────────
   const orchestrator = buildOrchestrator();
-  const results = await orchestrator.runAll(absolutePath, { quiet: true }); // praxis-ignore — orchestrator result, not LLM output triggering actions
+  const results = await orchestrator.runAll(absolutePath, { quiet: true, deep: options.deep }); // praxis-ignore — orchestrator result, not LLM output triggering actions
   const agentFindings = results.findings;
+  let scanComplete = results.agentResults.every(agent => agent.success);
+  if (!scanComplete) console.error('[praxis] Scan incomplete: one or more agents failed.');
 
   // ── Dependency Audit ─────────────────────────────────────────────────────
   let depVulns = [];
+  let dependencyAudit = options.deps === false ? 'skipped' : 'not-applicable';
   if (options.deps !== false) {
     try {
       const depResult = await runDepsAudit(absolutePath);
       depVulns = depResult.vulns || [];
-    } catch { /* skip */ }
+      dependencyAudit = depResult.error ? 'failed' : (depResult.pm ? 'complete' : 'not-applicable');
+    } catch {
+      dependencyAudit = 'failed';
+    }
+    if (dependencyAudit === 'failed') {
+      scanComplete = false;
+      console.error('[praxis] Dependency audit incomplete. Install the package manager audit tool and check registry access, or explicitly use --no-deps.');
+    }
   }
 
   // ── Merge & Deduplicate ──────────────────────────────────────────────────
@@ -140,6 +157,8 @@ export async function ciCommand(targetPath = '.', options = {}) {
   scoringEngine.saveToHistory(absolutePath, scoreResult);
 
   const duration = ((Date.now() - startTime) / 1000).toFixed(1);
+  const gateFindings = [...allFindings, ...depVulns];
+  const floorFindings = [...preBaselineFindings, ...depVulns];
 
   // ── SARIF Output ─────────────────────────────────────────────────────────
   if (sarifPath) {
@@ -163,12 +182,15 @@ export async function ciCommand(targetPath = '.', options = {}) {
       }])),
       ...(options.includeFindings ? {
         findings: allFindings.map(f => ({
-          file: path.relative(absolutePath, f.file).replace(/\\/g, '/'),
+          file: displayPath(f.file, absolutePath),
           line: f.line, rule: f.rule, severity: f.severity,
         })),
       } : {}),
       threshold,
-      pass: determinePass(scoreResult, allFindings, threshold, failOn, alwaysFailOn, preBaselineFindings),
+      scanComplete,
+      dependencyAudit,
+      floorPass: determinePass(scoreResult, [], 0, null, alwaysFailOn, floorFindings),
+      pass: scanComplete && determinePass(scoreResult, gateFindings, threshold, failOn, alwaysFailOn, floorFindings),
       duration: `${duration}s`,
     }, null, 2));
   } else {
@@ -182,7 +204,7 @@ export async function ciCommand(targetPath = '.', options = {}) {
     if (critical > 0) {
       console.log(`[praxis] Critical findings:`);
       for (const f of allFindings.filter(f => f.severity === 'critical').slice(0, 5)) {
-        const rel = path.relative(absolutePath, f.file).replace(/\\/g, '/');
+        const rel = displayPath(f.file, absolutePath);
         console.log(`  - ${f.rule} at ${rel}:${f.line}`);
       }
     }
@@ -192,7 +214,7 @@ export async function ciCommand(targetPath = '.', options = {}) {
     }
   }
 
-  // ── GitHub PR Inline Annotations (P-IMP-044) ───────────────────────────
+  // ── GitHub PR Inline Annotations ───────────────────────────
   emitGitHubAnnotations(allFindings, absolutePath);
 
   // ── GitHub PR Comment ──────────────────────────────────────────────────
@@ -200,12 +222,12 @@ export async function ciCommand(targetPath = '.', options = {}) {
     try {
       postPRComment(scoreResult, allFindings, depVulns, absolutePath, duration);
     } catch (err) {
-      console.log(`[praxis] Warning: Could not post PR comment: ${err.message}`);
+      console.error(`[praxis] Warning: Could not post PR comment: ${err.message}`);
     }
   }
 
   // ── Exit Code ────────────────────────────────────────────────────────────
-  const pass = determinePass(scoreResult, allFindings, threshold, failOn, alwaysFailOn, preBaselineFindings);
+  const pass = scanComplete && determinePass(scoreResult, gateFindings, threshold, failOn, alwaysFailOn, floorFindings);
   if (!pass) {
     if (!options.json) {
       if (failOn) {
@@ -229,14 +251,7 @@ export async function ciCommand(targetPath = '.', options = {}) {
 // HELPERS
 // =============================================================================
 
-function determinePass(scoreResult, findings, threshold, failOn, alwaysFailOn, preBaselineFindings = null) {
-  if (failOn) {
-    const sevOrder = ['critical', 'high', 'medium', 'low'];
-    const failIndex = sevOrder.indexOf(failOn);
-    if (failIndex === -1) return scoreResult.score >= threshold;
-    const blockingSevs = sevOrder.slice(0, failIndex + 1);
-    return !findings.some(f => blockingSevs.includes(f.severity));
-  }
+export function determinePass(scoreResult, findings, threshold, failOn, alwaysFailOn, preBaselineFindings = null) {
   if (alwaysFailOn) {
     const sevOrder = ['critical', 'high', 'medium', 'low'];
     const floorIndex = sevOrder.indexOf(alwaysFailOn);
@@ -246,6 +261,13 @@ function determinePass(scoreResult, findings, threshold, failOn, alwaysFailOn, p
     const floorSet = preBaselineFindings || findings;
     if (floorSet.some(f => floorSevs.includes(f.severity))) return false;
   }
+  if (failOn) {
+    const sevOrder = ['critical', 'high', 'medium', 'low'];
+    const failIndex = sevOrder.indexOf(failOn);
+    if (failIndex === -1) return scoreResult.score >= threshold;
+    const blockingSevs = sevOrder.slice(0, failIndex + 1);
+    return !findings.some(f => blockingSevs.includes(f.severity));
+  }
   return scoreResult.score >= threshold;
 }
 
@@ -253,19 +275,22 @@ function emitGitHubAnnotations(findings, rootPath) {
   if (process.env.GITHUB_ACTIONS !== 'true') return;
   for (const f of findings) {
     if (!f.file || !f.line) continue;
-    const rel = path.relative(rootPath, f.file).replace(/\\/g, '/');
+    const rel = displayPath(f.file, rootPath);
     const level = ['critical', 'high'].includes(f.severity) ? 'error' : 'warning';
     const col = f.column || 1;
-    const title = (f.title || f.rule || 'Security Finding').replace(/\r?\n/g, ' ');
-    const msg = (f.description || f.matched || '').replace(/\r?\n/g, ' ').slice(0, 300);
-    console.log(`::${level} file=${rel},line=${f.line},col=${col},title=${title}::${msg}`);
+    const escapeData = value => String(value).replace(/%/g, '%25').replace(/\r/g, '%0D').replace(/\n/g, '%0A');
+    const escapeProperty = value => escapeData(value).replace(/:/g, '%3A').replace(/,/g, '%2C');
+    const title = escapeProperty(f.title || f.rule || 'Security Finding');
+    // Matched text may be a live credential. Annotations only need the description.
+    const msg = escapeData(String(f.description || 'Security finding detected').slice(0, 300));
+    console.error(`::${level} file=${escapeProperty(rel)},line=${f.line},col=${col},title=${title}::${msg}`);
   }
 }
 
 /**
  * SARIF for GitHub Code Scanning.
  *
- * Delegates to the shared serializer in `cli/core/output/sarif.js` (P-IMP-062). This
+ * Delegates to the shared serializer in `cli/core/output/sarif.js`. This
  * used to be a private copy, which is why the GitHub Action's SARIF carried no
  * `security-severity` at all — the fix landed in the registry and never reached here.
  *
@@ -301,7 +326,7 @@ function postPRComment(scoreResult, findings, depVulns, rootPath, duration) {
       const parsed = JSON.parse(prJson);
       prNumber = String(parsed.number);
     } catch {
-      console.log('[praxis] No PR detected — skipping PR comment');
+      console.error('[praxis] No PR detected — skipping PR comment');
       return;
     }
   }
@@ -326,7 +351,7 @@ function postPRComment(scoreResult, findings, depVulns, rootPath, duration) {
     body += `### Critical & High Findings\n\n`;
     body += `| Severity | File | Issue |\n|----------|------|-------|\n`;
     for (const f of findings.filter(f => f.severity === 'critical' || f.severity === 'high').slice(0, 20)) {
-      const rel = path.relative(rootPath, f.file).replace(/\\/g, '/');
+      const rel = displayPath(f.file, rootPath);
       body += `| ${f.severity.toUpperCase()} | \`${rel}:${f.line}\` | ${(f.title || f.rule).slice(0, 60)} |\n`;
     }
     body += '\n';
@@ -344,7 +369,7 @@ function postPRComment(scoreResult, findings, depVulns, rootPath, duration) {
     stdio: ['pipe', 'pipe', 'pipe'], // praxis-ignore
   });
 
-  console.log(`[praxis] PR comment posted on #${prNumber}`);
+  console.error(`[praxis] PR comment posted on #${prNumber}`);
 }
 
 function checkIntelFreshness(maxAge) {

package/cli/commands/deps.js

@@ -229,7 +229,10 @@ function parseNpmAudit(jsonStr) {
   try {
     data = JSON.parse(jsonStr);
   } catch {
-    return [];
+    throw new Error('Dependency audit did not produce valid JSON');
+  }
+  if (!data || data.error || (!data.vulnerabilities && !data.advisories)) {
+    throw new Error('Dependency audit did not produce an audit report');
   }
 
   const vulns = [];
@@ -331,11 +334,14 @@ function parsePipAudit(jsonStr) {
   try {
     data = JSON.parse(jsonStr);
   } catch {
-    return [];
+    throw new Error('Dependency audit did not produce valid JSON');
   }
 
+  const dependencies = Array.isArray(data) ? data : data?.dependencies;
+  if (!Array.isArray(dependencies)) throw new Error('Dependency audit did not produce an audit report');
+
   const vulns = [];
-  for (const pkg of (Array.isArray(data) ? data : [])) {
+  for (const pkg of dependencies) {
     for (const vuln of (pkg.vulns || [])) {
       const fixVersion = vuln.fix_versions?.[0];
       vulns.push({
@@ -500,7 +506,7 @@ function printDepFindings(vulns, pm) {
 
 /**
  * Run the dependency audit for a given path and return normalized vulnerabilities.
- * Returns { pm, vulns } or { pm: null, vulns: [] } if no manifest found.
+ * Returns { pm, vulns, error? }. An unavailable audit is never a clean audit.
  * Does not print anything — used programmatically by other commands.
  */
 export async function runDepsAudit(rootPath) {
@@ -511,6 +517,6 @@ export async function runDepsAudit(rootPath) {
     const vulns = runAudit(pm, rootPath);
     return { pm, vulns };
   } catch {
-    return { pm, vulns: [] };
+    return { pm, vulns: [], error: `${pm.name} dependency audit could not be completed` };
   }
 }

package/cli/commands/diff.js

@@ -16,6 +16,7 @@ import { execFileSync } from 'child_process';
 import path from 'path';
 import chalk from 'chalk';
 import ora from 'ora';
+import { displayPath } from '../core/paths.js';
 import { SECRET_PATTERNS, SECURITY_PATTERNS, SKIP_EXTENSIONS, SKIP_FILENAMES } from '../utils/patterns.js';
 import { buildOrchestrator } from '../agents/index.js';
 import { ScoringEngine } from '../agents/scoring-engine.js';
@@ -165,7 +166,7 @@ export async function diffCommand(ref, options) {
       const sevColor = f.severity === 'critical' ? chalk.red :
                         f.severity === 'high' ? chalk.yellow :
                         f.severity === 'medium' ? chalk.cyan : chalk.gray;
-      const relPath = path.relative(absolutePath, f.file);
+      const relPath = displayPath(f.file, absolutePath);
       console.log(`  ${sevColor(`[${f.severity.toUpperCase()}]`)} ${chalk.white(f.title)}`);
       console.log(chalk.gray(`    ${relPath}:${f.line} → ${f.fix || f.description}`));
       shown++;

package/cli/commands/env-audit.js

@@ -22,7 +22,7 @@
 
 import fs from 'fs';
 import path from 'path';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 import chalk from 'chalk';
 import ora from 'ora';
 import { execFileSync } from 'child_process';

package/cli/commands/fix.js

@@ -23,7 +23,7 @@ import {
   MAX_FILE_SIZE
 } from '../utils/patterns.js';
 import { isHighEntropyMatch } from '../utils/entropy.js';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 import * as output from '../utils/output.js';
 
 // =============================================================================

package/cli/commands/legal.js

@@ -19,6 +19,7 @@ import fs from 'fs';
 import path from 'path';
 import chalk from 'chalk';
 import ora from 'ora';
+import { displayPath } from '../core/paths.js';
 import { LegalRiskAgent } from '../agents/legal-risk-agent.js';
 import * as output from '../utils/output.js';
 
@@ -136,7 +137,7 @@ export async function legalCommand(targetPath = '.', options = {}) {
       const riskLabel = RISK_LABELS[riskKey] || riskKey;
 
       console.log(`  ${sevBadge}  ${chalk.white.bold(f.title)}`);
-      console.log(`          ${riskColor(`[${riskLabel}]`)}  ${chalk.gray(path.relative(absolutePath, f.file) || f.file)}`);
+      console.log(`          ${riskColor(`[${riskLabel}]`)}  ${chalk.gray(displayPath(f.file, absolutePath))}`);
       console.log();
       console.log(`          ${chalk.gray(f.description)}`);
       console.log();

package/cli/commands/mcp.js

@@ -34,7 +34,8 @@
 
 import fs from 'fs';
 import path from 'path';
-import fg from 'fast-glob';
+import { displayPath } from '../core/paths.js';
+import fg from '../core/glob.js';
 import { SECRET_PATTERNS, SKIP_DIRS, SKIP_EXTENSIONS, SKIP_FILENAMES, TEST_FILE_PATTERNS, MAX_FILE_SIZE } from '../utils/patterns.js';
 import { isHighEntropyMatch } from '../utils/entropy.js';
 import { buildOrchestrator } from '../agents/index.js';
@@ -313,7 +314,7 @@ async function scanRepo({ path: targetPath, agents: agentFilter, llm = false, ou
         severity:      f.severity,
         category:      f.category,
         rule:          f.rule,
-        file:          f.file ? path.relative(rootPath, f.file) : null,
+        file:          f.file ? displayPath(f.file, rootPath) : null,
         line:          f.line,
         description:   f.description,
         remediation:   f.remediation,

package/cli/commands/openclaw.js

@@ -15,6 +15,7 @@
 import fs from 'fs';
 import path from 'path';
 import chalk from 'chalk';
+import { displayPath } from '../core/paths.js';
 import * as output from '../utils/output.js';
 import { AgentConfigScanner } from '../agents/agent-config-scanner.js';
 import { MCPSecurityAgent } from '../agents/mcp-security-agent.js';
@@ -138,11 +139,7 @@ async function runJsonMode(absolutePath, options) {
   const findings = [...configFindings, ...mcpFindings];
   const normFindings = findings.map(f => ({
     ...f,
-    file: String(f.file || '')
-      .replace(/\\/g, '/')
-      .replace(/^[a-zA-Z]:\/+/, '')
-      .replace(/^.*\/Praxis\/showcase-target\//, 'showcase-target/')
-      .replace(/^.*\/Praxis\//, ''),
+    file: displayPath(f.file, absolutePath),
   }));
   const result = {
     findings: normFindings,
@@ -174,7 +171,7 @@ function printFindings(findings, rootPath) {
   findings.sort((a, b) => (sevOrder[a.severity] ?? 4) - (sevOrder[b.severity] ?? 4));
 
   for (const f of findings) {
-    const relFile = path.relative(rootPath, f.file).replace(/\\/g, '/');
+    const relFile = displayPath(f.file, rootPath);
     const sevLabel = f.severity === 'critical' ? chalk.red.bold('CRITICAL')
       : f.severity === 'high' ? chalk.yellow('HIGH')
       : chalk.blue('MEDIUM');