praxis-sec 1.2.0 → 1.2.2

package/cli/agents/base-agent.js

@@ -17,7 +17,7 @@
 
 import fs from 'fs';
 import path from 'path';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 import { SKIP_DIRS, SKIP_EXTENSIONS, SKIP_FILENAMES, MAX_FILE_SIZE, MAX_SCAN_FILES, loadGitignorePatterns } from '../utils/patterns.js';
 
 // =============================================================================

package/cli/agents/endpoint-agent-abuse-agent.js

@@ -27,7 +27,7 @@
 
 import fs from 'fs';
 import path from 'path';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 import { BaseAgent, createFinding } from './base-agent.js';
 
 // =============================================================================

package/cli/agents/html-reporter.js

@@ -33,6 +33,7 @@ import { buildScanFingerprint, fingerprintLine } from '../utils/scan-fingerprint
 import { readFixLedger, summarizeFixLedger, isReversible } from '../utils/fix-ledger.js';
 import { readScoreHistory, summarizeHistory } from '../utils/score-history.js';
 import { toolVersion } from '../core/version.js';
+import { displayPath } from '../core/paths.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const PKG_VERSION = toolVersion();
@@ -44,18 +45,17 @@ export class HTMLReporter {
   }
 
   normalizePath(filePath, rootPath) {
-    if (!filePath) return '';
-    const norm = String(filePath).replace(/\\/g, '/');
-    const normRoot = rootPath ? String(rootPath).replace(/\\/g, '/') : '';
-    if (normRoot && norm.startsWith(normRoot)) {
-      return norm.slice(normRoot.length).replace(/^\/+/, '');
-    }
-    return norm.replace(/^[a-zA-Z]:\/+/, '').replace(/^.*\/Praxis\/showcase-target\//, '').replace(/^.*\/showcase-target\//, '');
+    // Paths reach the reporter already normalised by the orchestrator, so this only
+    // has to fall back for callers that build findings themselves. The strippers
+    // that used to live here leaked the username into every HTML report and
+    // truncated any real path containing a directory called `Praxis` — see
+    // cli/core/paths.js.
+    return displayPath(filePath, rootPath);
   }
 
   /**
    * The provenance line printed in report footers: exactly which tool, runtime and
-   * vendored data assets produced this document (P-IMP-053). A surprising result should
+   * vendored data assets produced this document. A surprising result should
    * be attributable, not mysterious.
    */
   getFingerprintLine(filesScanned = null) {
@@ -880,7 +880,7 @@ function toggleDetail(id) {
   /**
    * Score trend over time, from `.praxis/history.json`.
    *
-   * This is the part that must not overstate (P-IMP-055). An empty graph reads as
+   * This is the part that must not overstate. An empty graph reads as
    * "flat, no change", which is a different claim from "we have no data", so:
    *   - no prior scans  → say the project is at its baseline
    *   - fewer than 3 measurements → say a trend needs more, and show what exists
@@ -985,7 +985,7 @@ function toggleDetail(id) {
   }
 
   /**
-   * Remediation Ledger — the applied half of the find→fix→verify loop (P-IMP-054).
+   * Remediation Ledger — the applied half of the find→fix→verify loop.
    *
    * Reads `.praxis/fixes.jsonl` (currently applied changes) and `.praxis/failures.jsonl`
    * (plans proposed and rejected). Rejections are the more telling half: a rejected fix

package/cli/agents/index.js

@@ -123,11 +123,11 @@ export function buildOrchestrator() {
 }
 
 /**
- * Async build — loads built-in agents + any plugins from .praxis/agents/.
+ * Async build — loads built-ins and, with explicit trust, .praxis/agents/ plugins.
  * Preferred over buildOrchestrator() when rootPath is available.
  *
  * @param {string} rootPath — project root (for plugin discovery)
- * @param {object} options  — { verbose, quiet }
+ * @param {object} options  — { verbose, quiet, trustPlugins }
  */
 export async function buildOrchestratorAsync(rootPath, options = {}) {
   const orchestrator = new OrchestratorClass();

package/cli/agents/injection-tester.js

@@ -23,7 +23,14 @@ export const PATTERNS = [
   {
     rule: 'SQL_INJECTION_TEMPLATE_LITERAL',
     title: 'SQL Injection via Template Literal',
-    regex: /`(?:SELECT|INSERT|UPDATE|DELETE|DROP\s+TABLE|ALTER\s+TABLE|TRUNCATE|CREATE|REPLACE|MERGE)[^`]*\$\{/gi,
+    // Each keyword is anchored to the token SQL requires after it. The previous
+// `(?:SELECT|INSERT|...|CREATE|REPLACE|MERGE)[^`]*\$\{` matched the bare
+// keywords, so English words that merely start with one — created, updated,
+// deleted, inserted, replaced — fired a critical on any template literal like
+// `` `created file changed since fix: ${file.path}` ``. Anchoring also lets a
+// word that IS a keyword stand in for SQL only with its real continuation
+// (`MERGE INTO`, `SELECT ... FROM`), not `merge conflict`.
+regex: /`(?:SELECT\s+[\w*`,\s]{1,80}?\b(?:FROM|INTO|SET|VALUES|WHERE)\b|INSERT\s+INTO|UPDATE\s+[\w*`,\s]{1,80}?\bSET\b|DELETE\s+FROM|(?:DROP|ALTER)\s+TABLE|TRUNCATE\s+(?:TABLE\b|(?=[A-Za-z_]*\$\{))|CREATE\s+(?:TABLE|INDEX|UNIQUE|OR\s+REPLACE)|REPLACE\s+INTO|MERGE\s+INTO)[^`]*\$\{/gi,
     severity: 'critical',
     cwe: 'CWE-89',
     owasp: 'A03:2021',