praxis-sec 1.2.2 → 1.2.4

package/cli/commands/vibe-check.js

@@ -30,7 +30,7 @@ import {
   MAX_FILE_SIZE,
   loadGitignorePatterns
 } from '../utils/patterns.js';
-import { isHighEntropyMatch, getConfidence } from '../utils/entropy.js';
+import { isHighEntropyMatch, getConfidence, isDocumentedSecretExample } from '../utils/entropy.js';
 import fg from '../core/glob.js';
 
 // =============================================================================
@@ -135,6 +135,7 @@ export async function vibeCheckCommand(targetPath = '.', options = {}) {
           pattern.pattern.lastIndex = 0;
           let match;
           while ((match = pattern.pattern.exec(line)) !== null) {
+            if (isDocumentedSecretExample(pattern.name, match[0])) continue;
             if (pattern.requiresEntropyCheck && !isHighEntropyMatch(match[0])) continue;
             secretFindings.push({
               file, line: lineNum + 1, column: match.index + 1,

package/cli/commands/watch.js

@@ -16,7 +16,7 @@ import chalk from 'chalk';
 import { displayPath } from '../core/paths.js';
 import { execFileSync } from 'child_process';
 import { SKIP_DIRS, SKIP_EXTENSIONS, SKIP_FILENAMES, SECRET_PATTERNS, SECURITY_PATTERNS } from '../utils/patterns.js';
-import { isHighEntropyMatch, getConfidence } from '../utils/entropy.js';
+import { isHighEntropyMatch, getConfidence, isDocumentedSecretExample } from '../utils/entropy.js';
 import * as output from '../utils/output.js';
 import { ScoringEngine } from '../agents/scoring-engine.js';
 
@@ -175,6 +175,7 @@ function scanFile(filePath, patterns) {
         pattern.pattern.lastIndex = 0;
         let match;
         while ((match = pattern.pattern.exec(line)) !== null) {
+          if (isDocumentedSecretExample(pattern.name, match[0])) continue;
           if (pattern.requiresEntropyCheck && !isHighEntropyMatch(match[0])) continue;
           findings.push({
             line: i + 1,

package/cli/core/glob.js

@@ -1,9 +1,10 @@
 /**
  * Scanner file discovery boundary. Target-controlled patterns are bounded before
- * fast-glob/braces parse them (GHSA-vfj7-8cjw-p6xm has no upstream patch yet).
+ * the glob parser sees them, including pathological ignore patterns.
  * Directory symlinks must not turn a project scan into a scan of the host.
  */
-import fastGlob from 'fast-glob';
+import { glob as discover, globSync } from 'tinyglobby';
+import { validateDir } from './fs.js';
 
 const MAX_PATTERNS = 4096;
 const MAX_LENGTH = 8192;
@@ -42,15 +43,16 @@ export function validateGlobPatterns(patterns) {
 }
 
 function safeOptions(patterns, options) {
+  if (options.cwd && !validateDir(options.cwd, { exitOnMissing: false })) throw new Error('Scan root must be an existing directory');
   validateGlobPatterns(patterns);
   if (options.ignore) validateGlobPatterns(options.ignore);
-  return { ...options, followSymbolicLinks: false };
+  return { ...options, expandDirectories: false, followSymbolicLinks: false };
 }
 
 function glob(patterns, options = {}) {
-  return fastGlob(patterns, safeOptions(patterns, options));
+  return discover(patterns, safeOptions(patterns, options));
 }
 
-glob.sync = (patterns, options = {}) => fastGlob.sync(patterns, safeOptions(patterns, options));
+glob.sync = (patterns, options = {}) => globSync(patterns, safeOptions(patterns, options));
 
 export default glob;

package/cli/core/paths.js

@@ -35,7 +35,7 @@ const toSlash = (p) => String(p).split(path.sep).join('/').replace(/\\/g, '/');
 // normally come from the host's own glob, but a path read back from a report or
 // a cache can carry the other platform's shape, and treating it as relative would
 // print a drive letter straight into the output. Same guard sarif.js uses.
-const isAbsoluteLike = (s) => path.isAbsolute(s) || /^[a-zA-Z]:[\\/]/.test(s);
+const isAbsoluteLike = (s) => path.isAbsolute(s) || /^[a-zA-Z]:[\\/]/.test(s) || /^\\\\/.test(s);
 
 /**
  * Render a finding's file for display.
@@ -58,7 +58,7 @@ export function displayPath(file, root) {
   if (root) {
     const rel = path.relative(root, s);
     // `rel` starting with '..' means the file is outside the scan root.
-    if (rel && !rel.startsWith('..') && !path.isAbsolute(rel)) return toSlash(rel);
+    if (rel && rel !== '..' && !rel.startsWith(`..${path.sep}`) && !path.isAbsolute(rel)) return toSlash(rel);
   }
 
   const home = os.homedir();
@@ -68,7 +68,7 @@ export function displayPath(file, root) {
 
   // Outside the root and outside home: identify the file without publishing the
   // local directory layout.
-  return path.basename(s);
+  return path.posix.basename(toSlash(s));
 }
 
 /**
@@ -88,4 +88,4 @@ export function normalizeFindingPaths(findings, root) {
   return findings;
 }
 
-export default displayPath;
+export default displayPath;

package/cli/core/web/jobs.js

@@ -172,6 +172,8 @@ export async function runScanWithOrchestrator(rootPath, onProgress) {
     },
   });
 
+  if (agentResults.some(agent => !agent.success)) throw new Error('Scan incomplete: one or more agents failed');
+
   let score = 100;
   let grade = 'A';
   let categories = {};

package/cli/data/documented-secret-examples.json

@@ -0,0 +1,14 @@
+{
+  "version": 1,
+  "lastReviewed": "2026-10-07",
+  "description": "Exact provider-documented non-working credential identifiers. No substring, test-directory, or history-wide exemptions.",
+  "examples": [
+    {
+      "pattern": "AWS Access Key ID",
+      "aliases": ["AGENT_LOG_EXPOSED_AWS_KEY"],
+      "value": "AKIAIOSFODNN7EXAMPLE",
+      "source": "https://docs.aws.amazon.com/AmazonS3/latest/developerguide/RESTAuthentication.html",
+      "reason": "AWS explicitly labels this identifier a non-working example credential."
+    }
+  ]
+}

package/cli/utils/entropy.js

@@ -19,6 +19,25 @@
  * Patterns with known prefixes (sk-ant-, ghp_, AKIA...) are already precise enough.
  */
 
+import fs from 'fs';
+
+const documentedExamples = new Map();
+try {
+  const catalog = JSON.parse(fs.readFileSync(new URL('../data/documented-secret-examples.json', import.meta.url), 'utf8'));
+  for (const entry of catalog.examples || []) {
+    if (typeof entry.pattern !== 'string' || typeof entry.value !== 'string') continue;
+    for (const name of [entry.pattern, ...(Array.isArray(entry.aliases) ? entry.aliases : [])]) {
+      if (typeof name !== 'string') continue;
+      if (!documentedExamples.has(name)) documentedExamples.set(name, new Set());
+      documentedExamples.get(name).add(entry.value);
+    }
+  }
+} catch { /* Missing example data must never suppress unknown credentials. */ }
+
+export function isDocumentedSecretExample(patternName, matched) {
+  return documentedExamples.get(patternName)?.has(extractSecretValue(matched)) === true;
+}
+
 // =============================================================================
 // ENTROPY CALCULATION
 // =============================================================================

package/cli/utils/hermes-tool-registry.js

@@ -62,7 +62,9 @@ export const HERMES_TOOLS = [
     },
     handler: async ({ path: scanPath, severity = 'medium', deep = false }) => {
       const { auditCommand } = await import('../commands/audit.js');
-      return auditCommand(scanPath, { severity, deep, json: true, quiet: true });
+      const report = await auditCommand(scanPath, { deep, _agenticInner: true, deps: false, noAi: true });
+      const ranks = { critical: 4, high: 3, medium: 2, low: 1 };
+      return { ...report, findings: report.findings.filter(f => (ranks[f.severity] ?? 0) >= (ranks[severity] ?? 0)) };
     },
   },
 
@@ -86,7 +88,7 @@ export const HERMES_TOOLS = [
     },
     handler: async ({ target }) => {
       const { scanMcpCommand } = await import('../commands/scan-mcp.js');
-      return scanMcpCommand(target, { json: true });
+      return scanMcpCommand(target, { json: true, quiet: true });
     },
   },
 
@@ -115,7 +117,7 @@ export const HERMES_TOOLS = [
     },
     handler: async ({ path: projectPath, severity = 'medium' }) => {
       const { mcpGetFindings } = await import('../commands/mcp.js');
-      return mcpGetFindings({ projectPath, severity });
+      return mcpGetFindings({ reportPath: path.join(projectPath, '.praxis', 'last-report.json'), severity });
     },
   },
 
@@ -123,7 +125,7 @@ export const HERMES_TOOLS = [
     name: 'praxis_suppress_finding',
     description:
       'Suppress a known-safe finding by inserting an inline praxis-ignore comment ' +
-      'in the source file before the flagged line. Use only when the finding is a ' +
+      'on the flagged source line. Use only when the finding is a ' +
       'confirmed false positive and you can document why it is safe.',
     parameters: {
       type: 'object',
@@ -184,11 +186,11 @@ export const HERMES_TOOLS = [
 // =============================================================================
 
 const KNOWN_HASHES = {
-  praxis_audit:             '4d282d29e44fcc01',
-  praxis_scan_mcp:          'f967aea9626ca840',
-  praxis_get_findings:      'c09c9447efd574b3',
-  praxis_suppress_finding:  '3b7339419fe52ac7',
-  praxis_memory_list:       'c71c996716d1805b',
+  praxis_audit:             '4bdb0dafe1efea27',
+  praxis_scan_mcp:          '99c278579ccc7e38',
+  praxis_get_findings:      '8c3b10c970f047ab',
+  praxis_suppress_finding:  '3cedaa6e7ae974ae',
+  praxis_memory_list:       '9d405b87e81c7263',
 };
 
 function toolHash(tool) {

package/configs/firebase/security-checklist.md

@@ -24,11 +24,11 @@ allow read, write: if request.time < timestamp.date(2024, 12, 31);
 ### 2. [ ] Firestore rules require authentication
 
 ```javascript
-// GOOD: Requires authentication
+// Authentication check alone: insufficient for private per-user data
 allow read, write: if request.auth != null;
 
 // BETTER: Requires authentication AND ownership
-allow read, write: if request.auth.uid == userId;
+allow read, write: if request.auth != null && request.auth.uid == userId;
 ```
 
 ### 3. [ ] Storage rules have file type validation
@@ -49,7 +49,7 @@ allow write: if request.resource.size < 5 * 1024 * 1024;
 ### 5. [ ] Default deny rule at the end
 
 ```javascript
-// Catch-all: deny everything not explicitly allowed
+// Explicit default deny. Matching allow rules are additive; this does not override another allow.
 match /{document=**} {
   allow read, write: if false;
 }

package/configs/supabase/security-checklist.md

@@ -2,42 +2,40 @@
 
 **Complete this checklist before launching your Supabase-powered app.**
 
-Based on [CVE-2025-48757](https://byteiota.com/supabase-security-flaw-170-apps-exposed-by-missing-rls/) and common pentesting findings.
+Follow [Supabase RLS guidance](https://supabase.com/docs/guides/database/postgres/row-level-security). Test allow and deny behavior for each operation and role; these examples are not proof of access isolation.
 
 ---
 
 ## Critical: Row Level Security (RLS)
 
-### 1. [ ] RLS is ENABLED on ALL tables
+### 1. [ ] RLS is enabled on tables exposed to application users
 
 ```sql
 -- Check which tables DON'T have RLS
-SELECT schemaname, tablename
-FROM pg_tables
-WHERE schemaname = 'public'
-AND tablename NOT IN (
-  SELECT tablename::text FROM pg_class
-  WHERE relrowsecurity = true
-);
+SELECT n.nspname AS schemaname, c.relname AS tablename
+FROM pg_class AS c
+JOIN pg_namespace AS n ON n.oid = c.relnamespace
+WHERE n.nspname = 'public'
+  AND c.relkind IN ('r', 'p')
+  AND NOT c.relrowsecurity;
 ```
 
-**If any tables appear, enable RLS immediately:**
+**Review exposed tables and enable RLS with tested policies and grants:**
 ```sql
 ALTER TABLE table_name ENABLE ROW LEVEL SECURITY;
 ```
 
-### 2. [ ] Every table has at least one policy
+### 2. [ ] Exposed tables have the policies needed for intended operations
 
 ```sql
--- Tables with RLS enabled but NO policies (locked to everyone!)
-SELECT tablename FROM pg_tables
-WHERE schemaname = 'public'
-AND tablename IN (
-  SELECT tablename::text FROM pg_class WHERE relrowsecurity = true
-)
-AND tablename NOT IN (
-  SELECT tablename FROM pg_policies
-);
+-- RLS tables with no policies: ordinary roles are denied, but bypass roles differ.
+SELECT n.nspname AS schemaname, c.relname AS tablename
+FROM pg_class AS c
+JOIN pg_namespace AS n ON n.oid = c.relnamespace
+WHERE n.nspname = 'public'
+  AND c.relkind IN ('r', 'p')
+  AND c.relrowsecurity
+  AND NOT EXISTS (SELECT 1 FROM pg_policy AS p WHERE p.polrelid = c.oid);
 ```
 
 ### 3. [ ] Policies use `auth.uid()` not hardcoded values
@@ -97,7 +95,7 @@ grep -r "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9" ./src
 The `anon` key is designed to be public, but only if RLS is properly configured.
 
 ```typescript
-// Frontend: Use anon key (safe if RLS is set up)
+// Frontend: use the appropriate public key with tested RLS policies and grants
 const supabase = createClient(url, anonKey);
 
 // Server: Use service_role key (for admin operations)

package/docs/RELEASE-1.2.4.md

@@ -0,0 +1,85 @@
+# Praxis 1.2.4
+
+This patch corrects cases where a scan could report success without examining the
+requested target, and fixes project targeting in the older annotation loop.
+
+- Full, secret, and CI scans require a directory. A file supplied as a scan root
+  now produces an error instead of a false empty result. The VS Code current-file
+  action scans its workspace and selects diagnostics for the requested file.
+- Full-scan JSON includes `scanComplete`, `scanErrors`, and `dependencyAudit`.
+  Failed discovery, failed agents, unavailable dependency audits, or failed
+  requested legal scans mark the result incomplete and exit unsuccessfully.
+  Findings alone still do not fail a normal scan; use `scan ci` for severity gates.
+- Incomplete scans do not update scan cache, score history, or the playbook, and
+  cannot start the annotation loop or satisfy fix verification. HTML reports show
+  an incomplete warning; the web runner refuses failed-agent results.
+  A failed annotation-loop verification also overrides `--fail-below`; JSON
+  reports the failure once without inner-scan progress text. Reports are generated
+  after verification so HTML and machine-readable status agree.
+- `scan full --timeout` now reaches the orchestrator.
+- Annotation targets resolve inside the requested project, including symlink
+  destinations. Protected scanner/Git paths and unsupported comment formats such
+  as JSON are rejected. Writes are atomic, and unchanged annotations are not
+  counted as applied. Multiple annotations in one file are inserted from the
+  bottom to preserve finding line numbers; replaying the same report is safe.
+- In-root directories beginning with two dots retain their full relative path.
+  Foreign Windows backslash and UNC paths fall back to a safe basename.
+- Memory-poisoning document discovery respects ignore rules and dependency
+  directories instead of reading ignored nested artifacts as project context.
+- File discovery uses `tinyglobby` in place of the vulnerable
+  `fast-glob → micromatch → braces` chain. Directory expansion stays disabled,
+  brace limits and symlink boundaries remain enforced, and discovery has tests
+  for hidden files, exclusions, extglobs, literal directories, and async/sync parity.
+- Exact provider-documented non-working credentials are recognized from an
+  attributed data catalog. Unknown credentials on the same line still produce
+  findings. History scans process all matches, distinguish credentials that share
+  the same masked display, and report operational failures as incomplete.
+- Upload rules require request/upload filename evidence instead of treating
+  local package metadata or any variable named `filename` as a vulnerable upload.
+- The independently versioned VS Code extension is prepared as 1.0.1. CLI calls
+  use executable/argument arrays instead of shell text, and default npx execution
+  forbids automatic package installation. Report fields are escaped, severity
+  classes are sanitized, and a Content-Security-Policy blocks remote content.
+  Windows npm launchers resolve to the CLI's JavaScript entry point, preserving
+  literal arguments without invoking a command shell.
+
+- MCP suppression now writes on the matched line, preserves line endings, rejects
+  unsupported formats and non-integer lines, and writes atomically. MCP repository
+  scans use the current scoring API, expose agent failures as incomplete, and
+  reject file roots.
+- Hermes handlers return structured audit/manifest results, read the explicit saved
+  report path, apply severity filtering, and register against corrected integrity
+  hashes. Default Hermes audits disclose skipped dependency checks.
+- Documentation uses canonical commands, preserves errors, corrects CI examples,
+  describes data egress and score limitations, and provides a release procedure.
+  The Claude Code plugin instructions are independently versioned as 3.0.1.
+
+## Validation and limitations
+
+Release validation covers the CLI test suite on Node 18, 20, 22 and 24, lint,
+extension compilation and runtime tests, scan determinism, a complete zero-critical
+self-scan, local PR Action base/head comparison, and installed-package smoke tests.
+The production dependency chain was removed rather than overridden; the reviewed
+full dependency audit, including development dependencies, reports zero advisories.
+Audit results reflect the advisory database at the time of verification.
+
+AWS explicitly identifies the formerly reported fixture credential as
+[non-working example data](https://docs.aws.amazon.com/AmazonS3/latest/developerguide/RESTAuthentication.html).
+Only that exact identifier in AWS credential rules is exempted; tests retain
+unknown credentials on the same line. History and test files are not excluded.
+
+Noncritical heuristic findings and existing lint warnings remain. A self-scan
+score is not a measurement of scanner accuracy. Live LLM provider behavior and
+interactive VS Code UI behavior were not validated by these release checks.
+
+## Distribution
+
+The GitHub release, immutable `v1.2.4` tag, and floating Marketplace Action `v1`
+are prepared from the same commit after its hosted CI succeeds. The release
+includes the npm package tarball and a SHA-256 checksum. **npm publication is a
+separate maintainer step**; a GitHub release does not change npm latest.
+
+Use `Ganron007/Praxis@v1.2.4` to pin the Action. For CLI use before npm publication,
+install the attached tarball or run from a checkout of this tag. After publication,
+install `praxis-sec@1.2.4` from npm. See [the release procedure](RELEASING.md) for
+the checks and publishing handoff.

package/docs/RELEASING.md

@@ -0,0 +1,51 @@
+# Releasing Praxis
+
+The CLI/npm package, GitHub Action, Claude Code plugin, and VS Code extension
+have separate distribution surfaces. A GitHub release does not publish npm or
+the VS Code extension.
+
+## Prepare
+
+1. Choose the CLI patch version and update `package.json`, both root lockfile
+   version fields, and `docs/RELEASE-<version>.md`.
+2. Update public examples to the intended Action tag. Keep independently
+   versioned integrations consistent with their own manifests and lockfiles.
+3. Run `npm ci` and `npm run release:check`. This checks CLI tests, lint,
+   production dependency advisories, scan determinism, a complete zero-critical
+   self-scan, editor compilation/runtime tests, package exclusions, and an
+   installed-package scan with redaction and cache parity.
+4. Review `git diff --check` and the package contents. Keep `docs/internal/`,
+   runtime state, credentials, test fixtures, and local binaries out of Git and
+   the npm package.
+
+## GitHub and Marketplace
+
+1. Commit the complete release and push it. Wait for CI to pass on that exact
+   commit, including all four Node versions, determinism, package/editor checks,
+   and the local Action smoke test.
+2. Create an annotated immutable version tag, such as `v1.2.4`, on that commit.
+   Never replace a previously published version tag with different source.
+3. Pack the committed source with `npm pack`. Attach the tarball and its SHA-256
+   checksum to the GitHub release, using the reviewed release notes.
+4. Advance the floating `v1` Action tag deliberately to the same commit. Check
+   the prior remote value first and protect the update against concurrent changes.
+5. Verify the release, version tag, floating tag, assets, and successful CI all
+   refer to the reviewed source. Consumers can use the exact version tag or
+   commit instead of the floating tag.
+
+## npm publication
+
+The maintainer publishes npm separately from the same clean, committed checkout:
+
+```bash
+git checkout v1.2.4
+npm ci
+npm publish
+```
+
+`prepublishOnly` reruns the release gates and rejects an uncommitted working
+tree or a version different from the committed package metadata. Authentication
+and npm account requirements must be satisfied by the publishing maintainer.
+After publication, confirm `npm view praxis-sec version dist-tags` and install
+that exact registry version in a clean project. GitHub and npm may legitimately
+show different versions until this step completes.

package/docs/THIRD_PARTY_NOTICES.md

@@ -17,6 +17,14 @@ and attribution as required.
 - **Source:** https://github.com/0x4D31/endpoint-ai-agent-abuse (v0.1.0)
 - **License:** CC0-1.0 (public domain dedication) — https://creativecommons.org/publicdomain/zero/1.0/
 
+## Documented non-working credential examples
+
+- **File:** `cli/data/documented-secret-examples.json`
+- **Source:** [AWS S3 authentication examples](https://docs.aws.amazon.com/AmazonS3/latest/developerguide/RESTAuthentication.html)
+- Contains one exact identifier AWS labels non-working, with our own annotations.
+  No documentation prose is reproduced. This is factual example provenance, not
+  permission to suppress arbitrary credentials, test files, or repository history.
+
 ## Standards referenced (not vendored)
 
 Findings are mapped to the following frameworks; their text is not reproduced:

package/docs/THREAT_INTEL.md

@@ -12,7 +12,9 @@ For everything else (general CLI usage, scanning, hooks, etc.), see the main
 
 ## 1. Commands
 
-Run these from any directory — they only touch `~/.praxis/` (your home dir).
+Feed-update commands store caches under `~/.praxis/`. Scan commands also read
+the selected project and can update its local Praxis state. Updates contact
+configured remote sources; cached data is not a guarantee of current coverage.
 
 | Command | What it does |
 | --- | --- |
@@ -35,7 +37,7 @@ over no data.
 praxis intel update
 ```
 
-Expected output:
+Illustrative output (versions and counts depend on the fetched feeds):
 
 ```
   Fetching sources...