praxis-sec 1.2.0 → 1.2.2

package/cli/data/threatpacks/latest.json

@@ -1,41 +1,41 @@
-{
-  "version": "1.1",
-  "_refresh_policy": {
-    "cadence": "Incident-driven + weekly review",
-    "process": "1. Track OWASP LLM/Agentic releases and reported AI attack incidents. 2. Add signatures in own phrasing (never copy AGPL/copyrighted text verbatim). 3. Bump version. 4. Run npm test (prober tests enforce compilation + ReDoS guard).",
-    "owner": "Praxis contributors",
-    "lastReviewed": "2026-10-02"
-  },
-  "probes": [
-    {
-      "id": "TP-001",
-      "category": "obfuscated-injection",
-      "title": "Encoded-payload decode instruction (base64/hex/ROT)",
-      "regex": "(?i)(?:decode|base64|rot1[0-9]|deobfuscate)[\\s\\S]{0,80}(?:then\\s+(?:respond|answer|execute|run)|before\\s+you\\s+(?:respond|answer))",
-      "severity": "high",
-      "description": "Source contains a decode-then-execute instruction that tells a model to decode an encoded payload before acting — the obfuscated-injection family used to smuggle instructions past content filters.",
-      "fix": "Reject decode-first instructions from untrusted content. Never execute content decoded from user-controlled strings."
-    },
-    {
-      "id": "TP-002",
-      "category": "jailbreak-frame",
-      "title": "System-prompt redefinition instruction",
-      "regex": "(?i)(?:redefine|replace|rewrite)\\s+(?:your|the)\\s+(?:system|base)\\s+(?:prompt|instructions|rules)[\\s\\S]{0,120}(?:with|to)\\s+",
-      "severity": "high",
-      "description": "Source contains an instruction that asks the model to replace its own system prompt — a jailbreak frame that erases the developer's guardrails.",
-      "fix": "Strip prompt-redefinition frames. Treat any instruction that modifies the system prompt as untrusted input."
-    },
-    {
-      "id": "TP-003",
-      "category": "indirect-injection",
-      "title": "Document-payload split injection (multi-file chaining)",
-      "regex": "(?i)(?:part\\s*\\d+\\s*of\\s*\\d+|continue\\s+(?:reading|with|in)\\s+(?:the\\s+)?(?:next|following|part|message)|when\\s+combined\\s+with\\s+(?:the\\s+)?(?:above|previous|preceding|earlier|these|prior|other)\\s+(?:instruction|instructions|rule|rules|prompt|prompts|text|content|contents|message|messages|directive|directives|command|commands|guideline|guidelines)\\b)",
-      "severity": "medium",
-      "description": "Source contains split-payload markers that chain instructions across documents/messages — the payload-splitting technique that defeats per-input content filters.",
-      "fix": "Evaluate documents independently; do not concatenate instruction-like text across untrusted sources.",
-      "_tightened": "P-IMP-057: the bare phrase \"when combined with\" matched ordinary English (e.g. the comment \"when combined with machine output\") and produced a medium-severity finding. It now requires a chaining referent (above/previous/preceding/earlier/these/prior/other) AND an instruction-like noun, so benign prose like \"merged when combined with the previous version\" no longer matches."
-    }
-  ],
-  "eaa": [],
-  "gateways": []
-}
+{
+  "version": "1.1",
+  "_refresh_policy": {
+    "cadence": "Incident-driven + weekly review",
+    "process": "1. Track OWASP LLM/Agentic releases and reported AI attack incidents. 2. Add signatures in own phrasing (never copy AGPL/copyrighted text verbatim). 3. Bump version. 4. Run npm test (prober tests enforce compilation + ReDoS guard).",
+    "owner": "Praxis contributors",
+    "lastReviewed": "2026-10-02"
+  },
+  "probes": [
+    {
+      "id": "TP-001",
+      "category": "obfuscated-injection",
+      "title": "Encoded-payload decode instruction (base64/hex/ROT)",
+      "regex": "(?i)(?:decode|base64|rot1[0-9]|deobfuscate)[\\s\\S]{0,80}(?:then\\s+(?:respond|answer|execute|run)|before\\s+you\\s+(?:respond|answer))",
+      "severity": "high",
+      "description": "Source contains a decode-then-execute instruction that tells a model to decode an encoded payload before acting — the obfuscated-injection family used to smuggle instructions past content filters.",
+      "fix": "Reject decode-first instructions from untrusted content. Never execute content decoded from user-controlled strings."
+    },
+    {
+      "id": "TP-002",
+      "category": "jailbreak-frame",
+      "title": "System-prompt redefinition instruction",
+      "regex": "(?i)(?:redefine|replace|rewrite)\\s+(?:your|the)\\s+(?:system|base)\\s+(?:prompt|instructions|rules)[\\s\\S]{0,120}(?:with|to)\\s+",
+      "severity": "high",
+      "description": "Source contains an instruction that asks the model to replace its own system prompt — a jailbreak frame that erases the developer's guardrails.",
+      "fix": "Strip prompt-redefinition frames. Treat any instruction that modifies the system prompt as untrusted input."
+    },
+    {
+      "id": "TP-003",
+      "category": "indirect-injection",
+      "title": "Document-payload split injection (multi-file chaining)",
+      "regex": "(?i)(?:part\\s*\\d+\\s*of\\s*\\d+|continue\\s+(?:reading|with|in)\\s+(?:the\\s+)?(?:next|following|part|message)|when\\s+combined\\s+with\\s+(?:the\\s+)?(?:above|previous|preceding|earlier|these|prior|other)\\s+(?:instruction|instructions|rule|rules|prompt|prompts|text|content|contents|message|messages|directive|directives|command|commands|guideline|guidelines)\\b)",
+      "severity": "medium",
+      "description": "Source contains split-payload markers that chain instructions across documents/messages — the payload-splitting technique that defeats per-input content filters.",
+      "fix": "Evaluate documents independently; do not concatenate instruction-like text across untrusted sources.",
+      "_tightened": "The bare phrase \"when combined with\" matched ordinary English (e.g. the comment \"when combined with machine output\") and produced a medium-severity finding. It now requires a chaining referent (above/previous/preceding/earlier/these/prior/other) AND an instruction-like noun, so benign prose like \"merged when combined with the previous version\" no longer matches."
+    }
+  ],
+  "eaa": [],
+  "gateways": []
+}

package/cli/integrations/github-action.js

@@ -0,0 +1,136 @@
+/** Marketplace runner: argv-only execution, release-pinned CLI, and one gate decision. */
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { spawnSync, execFileSync } from 'child_process';
+import { fileURLToPath } from 'url';
+
+const cli = fileURLToPath(new URL('../bin/praxis.js', import.meta.url));
+const severities = ['critical', 'high', 'medium', 'low'];
+
+export function buildScanArgs(inputs, { base = false, sarif = null } = {}) {
+  const args = ['scan', 'ci', inputs.path || '.', '--json', '--threshold', base ? '0' : (inputs.threshold || '75')];
+  if (inputs.deps === 'false') args.push('--no-deps');
+  if (inputs.deep === 'true') args.push('--deep');
+  if (!base && inputs.baseline === 'true') args.push('--baseline');
+  if (!base && inputs.failOn) args.push('--fail-on', inputs.failOn);
+  if (!base && inputs.alwaysFailOn) args.push('--always-fail-on', inputs.alwaysFailOn);
+  if (inputs.netNew === 'true') args.push('--include-findings');
+  if (sarif) args.push('--sarif', sarif);
+  return args;
+}
+
+export function parseScanResult(result) {
+  if (result.error) throw result.error;
+  if (![0, 1].includes(result.status)) throw new Error(`Praxis scan failed (exit ${result.status})`);
+  let report;
+  try { report = JSON.parse(result.stdout); } catch { throw new Error('Praxis scan did not produce valid JSON'); } // praxis-ignore AGENT_NO_OUTPUT_SCHEMA — subprocess stdout, not LLM output; fields are checked on the next line
+  if (!report || typeof report.pass !== 'boolean' || !Number.isFinite(report.score)) {
+    throw new Error('Praxis scan produced an invalid report');
+  }
+  if (result.status === 1 && report.pass) throw new Error('Praxis scan exit status disagrees with report');
+  return report;
+}
+
+export function introducedFindings(base, head, floor = 'high') {
+  const limit = severities.indexOf(floor);
+  if (limit < 0) throw new Error(`Invalid fail-on-new severity: ${floor}`);
+  if (!Array.isArray(base.findings) || !Array.isArray(head.findings)) throw new Error('Net-new gate requires finding lists from both scans');
+  const identity = finding => `${finding.file}:${finding.rule}`;
+  const existing = new Set(base.findings.map(identity));
+  const introduced = head.findings.filter(finding => !existing.has(identity(finding)));
+  return {
+    total: introduced.length,
+    blocking: introduced.filter(finding => {
+      const severity = severities.indexOf(finding.severity);
+      return severity >= 0 && severity <= limit;
+    }).length,
+  };
+}
+
+export function evaluateGate(head, base, inputs) {
+  if (!base) return { pass: head.pass, introduced: null };
+  if (base.scanComplete === false) throw new Error('Base scan is incomplete; refusing to pass the net-new gate');
+  const introduced = introducedFindings(base, head, inputs.failOnNew || 'high');
+  return { pass: head.scanComplete !== false && head.floorPass !== false && introduced.blocking === 0, introduced };
+}
+
+function scan(inputs, cwd, options = {}) {
+  const result = spawnSync(process.execPath, [cli, ...buildScanArgs(inputs, options)], {
+    cwd, env: process.env, encoding: 'utf8', timeout: 20 * 60 * 1000, maxBuffer: 32 * 1024 * 1024,
+  });
+  // GitHub annotations go to stderr, keeping the JSON channel valid.
+  if (result.stderr) process.stderr.write(result.stderr);
+  return parseScanResult(result);
+}
+
+export async function runAction(env = process.env) {
+  const inputs = {
+    path: env.PRAXIS_INPUT_PATH, threshold: env.PRAXIS_INPUT_THRESHOLD,
+    failOn: env.PRAXIS_INPUT_FAIL_ON, alwaysFailOn: env.PRAXIS_INPUT_ALWAYS_FAIL_ON,
+    deps: env.PRAXIS_INPUT_DEPS, deep: env.PRAXIS_INPUT_DEEP, baseline: env.PRAXIS_INPUT_BASELINE,
+    netNew: env.PRAXIS_INPUT_NET_NEW, failOnNew: env.PRAXIS_INPUT_FAIL_ON_NEW,
+  };
+  const temp = fs.mkdtempSync(path.join(env.RUNNER_TEMP || os.tmpdir(), 'praxis-action-'));
+  const sarif = env.PRAXIS_INPUT_SARIF === 'true' ? path.join(temp, 'results.sarif') : null;
+  const root = env.GITHUB_WORKSPACE || process.cwd();
+  const head = scan(inputs, root, { sarif });
+  let base = null;
+  if (inputs.netNew === 'true') {
+    if (env.GITHUB_EVENT_NAME !== 'pull_request') throw new Error('net-new requires a pull_request event');
+    const sha = env.PRAXIS_BASE_SHA || '';
+    if (!/^[a-f0-9]{40,64}$/i.test(sha)) throw new Error('Invalid or missing pull request base SHA');
+    const worktree = path.join(temp, 'base');
+    let added = false;
+    try {
+      execFileSync('git', ['fetch', '--depth', '1', 'origin', sha], { cwd: root, stdio: ['ignore', 'pipe', 'pipe'] });
+      execFileSync('git', ['worktree', 'add', '--detach', worktree, sha], { cwd: root, stdio: ['ignore', 'pipe', 'pipe'] });
+      added = true;
+      base = scan(inputs, worktree, { base: true });
+    } finally {
+      if (added) execFileSync('git', ['worktree', 'remove', '--force', worktree], { cwd: root, stdio: ['ignore', 'pipe', 'pipe'] });
+    }
+  }
+  const gate = evaluateGate(head, base, inputs);
+  const count = category => head.categories?.[category]?.findingCount || 0;
+  const outputs = {
+    score: head.score, grade: head.grade, findings: head.totalFindings, secrets: count('secrets'),
+    vulns: count('injection') + count('auth'), cves: head.totalDepVulns,
+    'sarif-file': sarif && fs.existsSync(sarif) ? sarif : '',
+    'report-url': `${env.GITHUB_SERVER_URL || 'https://github.com'}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}`,
+    fail: gate.pass ? '0' : '1',
+  };
+  if (env.GITHUB_OUTPUT) {
+    fs.appendFileSync(env.GITHUB_OUTPUT, Object.entries(outputs).map(([key, value]) => `${key}=${value ?? ''}`).join('\n') + '\n');
+  }
+  let summary = `## Praxis Security Report\n\nScore: **${head.score}/100 (${head.grade})** · Findings: **${head.totalFindings}** · CVEs: **${head.totalDepVulns}**\n\n`;
+  if (gate.introduced) summary += `Net-new gate: **${gate.introduced.total}** introduced finding(s), **${gate.introduced.blocking}** at or above ${inputs.failOnNew || 'high'}.\n\n`;
+  summary += gate.pass ? '**Passed** the configured security gate.\n' : '**Failed** the configured security gate.\n';
+  if (env.GITHUB_STEP_SUMMARY) fs.appendFileSync(env.GITHUB_STEP_SUMMARY, summary);
+  console.log(summary);
+  if (env.PRAXIS_INPUT_COMMENT === 'true' && env.GITHUB_EVENT_NAME === 'pull_request') {
+    const pr = env.PRAXIS_PR_NUMBER;
+    const repository = env.GITHUB_REPOSITORY;
+    if (!/^\d+$/.test(pr || '') || !/^[\w.-]+\/[\w.-]+$/.test(repository || '')) throw new Error('Invalid PR context');
+    const marker = '<!-- praxis-security-report -->';
+    const body = `${marker}\n${summary}\n[Scanned by Praxis](https://github.com/Ganron007/Praxis)`;
+    const bodyPath = path.join(temp, 'comment.json');
+    fs.writeFileSync(bodyPath, JSON.stringify({ body }));
+    try {
+      const comments = JSON.parse(execFileSync('gh', ['api', '--paginate', '--slurp', `repos/${repository}/issues/${pr}/comments`], { env, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] })).flat();
+      const existing = comments.find(comment => comment.user?.type === 'Bot' && comment.body?.includes(marker));
+      const endpoint = existing ? `repos/${repository}/issues/comments/${existing.id}` : `repos/${repository}/issues/${pr}/comments`;
+      execFileSync('gh', ['api', endpoint, '-X', existing ? 'PATCH' : 'POST', '--input', bodyPath], { env, stdio: ['ignore', 'pipe', 'pipe'] });
+    } catch {
+      console.error('::warning::Could not post Praxis PR comment. Check pull-requests: write permissions.');
+    }
+  }
+  return gate;
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  runAction().catch(error => {
+    console.error(`::error::${String(error.message).replace(/%/g, '%25').replace(/\r/g, '%0D').replace(/\n/g, '%0A')}`);
+    process.exitCode = 1;
+  });
+}

package/cli/utils/cache-manager.js

@@ -17,6 +17,7 @@
 
 import fs from 'fs';
 import path from 'path';
+import { displayPath } from '../core/paths.js';
 import crypto from 'crypto';
 import { toolVersion } from '../core/version.js';
 
@@ -200,7 +201,7 @@ export class CacheManager {
       // Group findings by file (relative paths)
       const lastFindings = {};
       for (const f of allFindings) {
-        const relPath = path.relative(this.rootPath, f.file).replace(/\\/g, '/');
+        const relPath = displayPath(f.file, this.rootPath);
         if (!lastFindings[relPath]) lastFindings[relPath] = [];
         // Store a lightweight copy (no absolute paths)
         lastFindings[relPath].push({

package/cli/utils/plugin-loader.js

@@ -3,10 +3,10 @@
  * ============================================
  *
  * Allows users to drop custom security agents into `.praxis/agents/` and
- * have them automatically loaded and run alongside the built-in agents.
+ * run them alongside the built-in agents after explicit local trust.
  *
  * HOW IT WORKS:
- *   1. On startup, loadPlugins(rootPath) scans `.praxis/agents/*.js`
+ *   1. With explicit trust, loadPlugins(rootPath) scans `.praxis/agents/*.js`
  *   2. Each file must export a default class that extends BaseAgent
  *   3. Validated plugins are instantiated and returned for registration
  *   4. buildOrchestrator() calls loadPlugins() and registers the results
@@ -21,7 +21,7 @@
  * EXAMPLE PLUGIN:
  *
  *   // .praxis/agents/my-rule.js
- *   import { BaseAgent, createFinding } from 'praxis';
+ *   import { BaseAgent, createFinding } from 'praxis-sec';
  *
  *   export default class MyCustomRule extends BaseAgent {
  *     constructor() {
@@ -50,12 +50,12 @@
  *   }
  *
  * PLUGIN ISOLATION:
- *   Plugins run in the same process but each agent gets its own timeout (30s).
- *   A crashing or hanging plugin does not affect other agents.
+ *   Trusted plugins run in the same process with full operator permissions.
+ *   Agent promise timeouts are not a sandbox and cannot stop synchronous loops.
  *
  * SECURITY NOTE:
- *   Plugins are arbitrary code executed from the local filesystem. Never install
- *   plugins from untrusted sources. praxis will warn if plugins are detected.
+ *   Plugins are arbitrary code with full operator permissions. A normal scan
+ *   never imports them; trusted local scans opt in with --trust-plugins.
  */
 
 import fs from 'fs';
@@ -69,10 +69,13 @@ const PLUGIN_DIR = '.praxis/agents';
  * Load custom agent plugins from .praxis/agents/*.js
  *
  * @param {string} rootPath — project root directory
- * @param {object} options  — { verbose, quiet }
+ * @param {object} options  — { verbose, quiet, trustPlugins }
  * @returns {Promise<object[]>} — array of instantiated agent objects
  */
 export async function loadPlugins(rootPath, options = {}) {
+  // Importing a module executes its top-level code before class validation.
+  // Scanned repositories are data, never implicit authorization to run plugins.
+  if (options.trustPlugins !== true) return [];
   const pluginDir = path.join(rootPath, PLUGIN_DIR);
 
   if (!fs.existsSync(pluginDir)) return [];
@@ -126,89 +129,6 @@ export async function loadPlugins(rootPath, options = {}) {
         instance.category = 'custom';
       }
 
-      // Sandbox the analyze method to restrict file system access and block shell executions
-      const originalAnalyze = instance.analyze;
-      instance.analyze = async function(context) {
-        const child_process = await import('child_process');
-        
-        const originalReadFileSync = fs.readFileSync;
-        const originalWriteFileSync = fs.writeFileSync;
-        const originalReadFile = fs.readFile;
-        const originalWriteFile = fs.writeFile;
-        const originalPromisesReadFile = fs.promises?.readFile;
-        const originalPromisesWriteFile = fs.promises?.writeFile;
-        const originalExec = child_process.exec;
-        const originalExecSync = child_process.execSync;
-        const originalSpawn = child_process.spawn;
-        const originalSpawnSync = child_process.spawnSync;
-        
-        const isSafePath = (p) => {
-          if (!p) return false;
-          try {
-            const resolved = path.resolve(context.rootPath, String(p));
-            return resolved.startsWith(path.resolve(context.rootPath));
-          } catch {
-            return false;
-          }
-        };
-        
-        fs.readFileSync = (p, ...args) => {
-          if (!isSafePath(p)) throw new Error(`Access denied (sandbox): read outside workspace path ${p}`);
-          return originalReadFileSync(p, ...args);
-        };
-        fs.writeFileSync = (p, ...args) => {
-          if (!isSafePath(p)) throw new Error(`Access denied (sandbox): write outside workspace path ${p}`);
-          return originalWriteFileSync(p, ...args);
-        };
-        fs.readFile = (p, ...args) => {
-          if (!isSafePath(p)) throw new Error(`Access denied (sandbox): read outside workspace path ${p}`);
-          return originalReadFile(p, ...args);
-        };
-        fs.writeFile = (p, ...args) => {
-          if (!isSafePath(p)) throw new Error(`Access denied (sandbox): write outside workspace path ${p}`);
-          return originalWriteFile(p, ...args);
-        };
-        if (fs.promises) {
-          fs.promises.readFile = async (p, ...args) => {
-            if (!isSafePath(p)) throw new Error(`Access denied (sandbox): read outside workspace path ${p}`);
-            return originalPromisesReadFile(p, ...args);
-          };
-          fs.promises.writeFile = async (p, ...args) => {
-            if (!isSafePath(p)) throw new Error(`Access denied (sandbox): write outside workspace path ${p}`);
-            return originalPromisesWriteFile(p, ...args);
-          };
-        }
-        
-        // Best-effort lockdown: ESM module namespaces are immutable, so this
-        // only takes effect where child_process exposes mutable bindings.
-        // The fs path guard above still applies in all cases.
-        try {
-          child_process.exec = () => { throw new Error('Access denied (sandbox): exec not allowed in plugins'); };
-          child_process.execSync = () => { throw new Error('Access denied (sandbox): execSync not allowed in plugins'); };
-          child_process.spawn = () => { throw new Error('Access denied (sandbox): spawn not allowed in plugins'); };
-          child_process.spawnSync = () => { throw new Error('Access denied (sandbox): spawnSync not allowed in plugins'); };
-        } catch { /* immutable ESM namespace */ }
-        
-        try {
-          return await originalAnalyze.call(this, context);
-        } finally {
-          fs.readFileSync = originalReadFileSync;
-          fs.writeFileSync = originalWriteFileSync;
-          fs.readFile = originalReadFile;
-          fs.writeFile = originalWriteFile;
-          if (fs.promises) {
-            fs.promises.readFile = originalPromisesReadFile;
-            fs.promises.writeFile = originalPromisesWriteFile;
-          }
-          try {
-            child_process.exec = originalExec;
-            child_process.execSync = originalExecSync;
-            child_process.spawn = originalSpawn;
-            child_process.spawnSync = originalSpawnSync;
-          } catch { /* immutable ESM namespace */ }
-        }
-      };
-
       plugins.push(instance);
 
       if (!options.quiet) {
@@ -283,8 +203,8 @@ export function scaffoldPlugin(rootPath, pluginName) {
   const template = `/**
  * Custom Praxis Agent: ${className}
  *
- * Drop this file in .praxis/agents/ to have it run automatically
- * as part of every \`praxis audit\` or \`praxis watch --deep\`.
+ * Drop this file in .praxis/agents/ and explicitly opt in with
+ * \`praxis scan full . --trust-plugins\` after reviewing its code.
  *
  * The \`analyze(context)\` method receives:
  *   context.rootPath   — absolute path to the project root
@@ -304,9 +224,9 @@ if (globalThis.__praxisAgentFramework) {
   ({ BaseAgent, createFinding } = globalThis.__praxisAgentFramework);
 } else {
   try {
-    ({ BaseAgent, createFinding } = await import('praxis'));
+    ({ BaseAgent, createFinding } = await import('praxis-sec'));
   } catch {
-    ({ BaseAgent, createFinding } = await import('praxis/cli/index.js'));
+    ({ BaseAgent, createFinding } = await import('praxis-sec/cli/index.js'));
   }
 }