@kevinrabun/judges-cli 3.124.0

package/dist/commands/finding-noise-score.js

@@ -0,0 +1,93 @@
+import { readFileSync, existsSync } from "fs";
+import { join } from "path";
+function computeNoiseScore(finding) {
+    let score = 0;
+    const factors = [];
+    if (finding.confidence !== undefined && finding.confidence !== null && finding.confidence < 0.5) {
+        score += 30;
+        factors.push("low confidence");
+    }
+    if (finding.severity === "info") {
+        score += 20;
+        factors.push("info-level severity");
+    }
+    else if (finding.severity === "low") {
+        score += 10;
+        factors.push("low severity");
+    }
+    if (finding.patch === undefined || finding.patch === null) {
+        score += 15;
+        factors.push("no patch available");
+    }
+    if (finding.recommendation.length < 30) {
+        score += 15;
+        factors.push("vague recommendation");
+    }
+    if (factors.length === 0) {
+        factors.push("actionable finding");
+    }
+    return { score: Math.min(100, score), factors };
+}
+export function runFindingNoiseScore(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`Usage: judges finding-noise-score [options]
+
+Score finding noise levels to identify low-signal findings.
+
+Options:
+  --report <path>      Path to verdict JSON
+  --threshold <n>      Noise score threshold to flag (default: 40)
+  --format <fmt>       Output format: table (default) or json
+  -h, --help           Show this help message`);
+        return;
+    }
+    const formatIdx = argv.indexOf("--format");
+    const format = formatIdx !== -1 && argv[formatIdx + 1] ? argv[formatIdx + 1] : "table";
+    const threshIdx = argv.indexOf("--threshold");
+    const threshold = threshIdx !== -1 && argv[threshIdx + 1] ? parseInt(argv[threshIdx + 1], 10) : 40;
+    const reportIdx = argv.indexOf("--report");
+    const reportPath = reportIdx !== -1 && argv[reportIdx + 1]
+        ? join(process.cwd(), argv[reportIdx + 1])
+        : join(process.cwd(), ".judges", "last-verdict.json");
+    if (!existsSync(reportPath)) {
+        console.log(`No report found at: ${reportPath}`);
+        return;
+    }
+    const data = JSON.parse(readFileSync(reportPath, "utf-8"));
+    const findings = data.findings ?? [];
+    const entries = [];
+    for (const f of findings) {
+        const result = computeNoiseScore(f);
+        let noiseLevel;
+        if (result.score >= 60)
+            noiseLevel = "high noise";
+        else if (result.score >= 30)
+            noiseLevel = "moderate noise";
+        else
+            noiseLevel = "low noise";
+        entries.push({
+            ruleId: f.ruleId,
+            title: f.title,
+            severity: f.severity,
+            noiseScore: result.score,
+            noiseLevel,
+            factors: result.factors,
+        });
+    }
+    entries.sort((a, b) => b.noiseScore - a.noiseScore);
+    if (format === "json") {
+        console.log(JSON.stringify(entries, null, 2));
+        return;
+    }
+    const noisy = entries.filter((e) => e.noiseScore >= threshold);
+    console.log(`\n=== Noise Score (${noisy.length}/${entries.length} above threshold ${threshold}) ===\n`);
+    if (entries.length === 0) {
+        console.log("No findings to score.");
+        return;
+    }
+    for (const e of entries) {
+        const flag = e.noiseScore >= threshold ? " ⚠" : "";
+        console.log(`  ${String(e.noiseScore).padStart(3)}  ${e.noiseLevel.padEnd(16)} ${e.ruleId}${flag}`);
+        console.log(`       ${e.factors.join(", ")}`);
+    }
+}

package/dist/commands/finding-owner-assign.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Finding-owner-assign — Assign ownership of findings based on configurable rules.
+ */
+export declare function runFindingOwnerAssign(argv: string[]): void;

package/dist/commands/finding-owner-assign.js

@@ -0,0 +1,133 @@
+/**
+ * Finding-owner-assign — Assign ownership of findings based on configurable rules.
+ */
+import { readFileSync, existsSync, writeFileSync } from "fs";
+// ─── Helpers ────────────────────────────────────────────────────────────────
+function loadOwnerRules(configPath) {
+    if (!existsSync(configPath))
+        return [];
+    try {
+        const data = JSON.parse(readFileSync(configPath, "utf-8"));
+        if (Array.isArray(data.rules)) {
+            return data.rules;
+        }
+        return [];
+    }
+    catch {
+        return [];
+    }
+}
+function assignOwners(verdict, rules) {
+    const assignments = [];
+    for (const f of verdict.findings) {
+        let owner = "unassigned";
+        let matchedPattern = "";
+        for (const rule of rules) {
+            const ruleIdLower = f.ruleId.toLowerCase();
+            const titleLower = f.title.toLowerCase();
+            const patLower = rule.pattern.toLowerCase();
+            if (ruleIdLower.includes(patLower) || titleLower.includes(patLower)) {
+                owner = rule.owner;
+                matchedPattern = rule.pattern;
+                break;
+            }
+        }
+        // fallback: assign by severity
+        if (owner === "unassigned") {
+            const sev = (f.severity || "medium").toLowerCase();
+            if (sev === "critical" || sev === "high") {
+                owner = "security-team";
+                matchedPattern = `severity:${sev}`;
+            }
+        }
+        assignments.push({
+            ruleId: f.ruleId,
+            title: f.title,
+            severity: (f.severity || "medium").toLowerCase(),
+            owner,
+            matchedPattern,
+        });
+    }
+    return assignments;
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runFindingOwnerAssign(argv) {
+    const fileIdx = argv.indexOf("--file");
+    const configIdx = argv.indexOf("--config");
+    const formatIdx = argv.indexOf("--format");
+    const outIdx = argv.indexOf("--output");
+    const filePath = fileIdx >= 0 ? argv[fileIdx + 1] : undefined;
+    const configPath = configIdx >= 0 ? argv[configIdx + 1] : ".judges-owners.json";
+    const format = formatIdx >= 0 ? argv[formatIdx + 1] : "table";
+    const outputPath = outIdx >= 0 ? argv[outIdx + 1] : undefined;
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges finding-owner-assign — Assign finding owners
+
+Usage:
+  judges finding-owner-assign --file <verdict.json> [--config <owners.json>]
+                              [--format table|json] [--output <file>]
+
+Options:
+  --file <path>      Path to verdict JSON file (required)
+  --config <path>    Owner rules config (default: .judges-owners.json)
+  --format <fmt>     Output format: table (default), json
+  --output <path>    Write assignments to file
+  --help, -h         Show this help
+
+Config format:
+  { "rules": [{ "pattern": "AUTH", "owner": "security-team" }] }
+`);
+        return;
+    }
+    if (!filePath) {
+        console.error("Error: --file required");
+        process.exitCode = 1;
+        return;
+    }
+    if (!existsSync(filePath)) {
+        console.error(`Error: not found: ${filePath}`);
+        process.exitCode = 1;
+        return;
+    }
+    let verdict;
+    try {
+        verdict = JSON.parse(readFileSync(filePath, "utf-8"));
+    }
+    catch {
+        console.error("Error: invalid JSON");
+        process.exitCode = 1;
+        return;
+    }
+    const rules = loadOwnerRules(configPath);
+    const assignments = assignOwners(verdict, rules);
+    if (outputPath) {
+        writeFileSync(outputPath, JSON.stringify(assignments, null, 2));
+        console.log(`Wrote ${assignments.length} assignments to ${outputPath}`);
+        return;
+    }
+    if (format === "json") {
+        console.log(JSON.stringify(assignments, null, 2));
+        return;
+    }
+    // group by owner
+    const byOwner = new Map();
+    for (const a of assignments) {
+        const arr = byOwner.get(a.owner) || [];
+        arr.push(a);
+        byOwner.set(a.owner, arr);
+    }
+    console.log(`\nFinding Owner Assignments (${assignments.length} findings)`);
+    console.log("═".repeat(75));
+    for (const [owner, items] of byOwner) {
+        console.log(`\n  Owner: ${owner} (${items.length} findings)`);
+        console.log("  " + "─".repeat(70));
+        console.log(`  ${"Rule".padEnd(20)} ${"Severity".padEnd(10)} Title`);
+        for (const a of items) {
+            const rule = a.ruleId.length > 18 ? a.ruleId.slice(0, 18) + "…" : a.ruleId;
+            const title = a.title.length > 35 ? a.title.slice(0, 35) + "…" : a.title;
+            console.log(`  ${rule.padEnd(20)} ${a.severity.padEnd(10)} ${title}`);
+        }
+    }
+    console.log("\n" + "═".repeat(75));
+}

package/dist/commands/finding-owner-notify.d.ts

@@ -0,0 +1 @@
+export declare function runFindingOwnerNotify(argv: string[]): void;

package/dist/commands/finding-owner-notify.js

@@ -0,0 +1,121 @@
+import { readFileSync, existsSync } from "fs";
+import { join } from "path";
+function loadOwnerMappings(mappingPath) {
+    if (!existsSync(mappingPath))
+        return [];
+    try {
+        const content = readFileSync(mappingPath, "utf-8");
+        // Support simple JSON format: [{ "pattern": "auth", "owners": ["@alice"] }]
+        return JSON.parse(content);
+    }
+    catch {
+        // Try CODEOWNERS-like format: pattern @owner1 @owner2
+        const lines = readFileSync(mappingPath, "utf-8").split("\n");
+        const mappings = [];
+        for (const line of lines) {
+            const trimmed = line.trim();
+            if (!trimmed || trimmed.startsWith("#"))
+                continue;
+            const parts = trimmed.split(/\s+/);
+            if (parts.length >= 2) {
+                mappings.push({ pattern: parts[0], owners: parts.slice(1) });
+            }
+        }
+        return mappings;
+    }
+}
+const SEVERITY_RANK = { critical: 5, high: 4, medium: 3, low: 2, info: 1 };
+function rankToSev(rank) {
+    if (rank >= 5)
+        return "critical";
+    if (rank >= 4)
+        return "high";
+    if (rank >= 3)
+        return "medium";
+    if (rank >= 2)
+        return "low";
+    return "info";
+}
+function buildNotifications(verdict, mappings) {
+    const ownerMap = new Map();
+    for (const f of verdict.findings ?? []) {
+        const ruleIdLower = f.ruleId.toLowerCase();
+        const titleLower = f.title.toLowerCase();
+        let matched = false;
+        for (const mapping of mappings) {
+            if (ruleIdLower.includes(mapping.pattern.toLowerCase()) || titleLower.includes(mapping.pattern.toLowerCase())) {
+                for (const owner of mapping.owners) {
+                    const entry = ownerMap.get(owner) ?? { findings: [], maxRank: 0 };
+                    entry.findings.push({ ruleId: f.ruleId, title: f.title, severity: f.severity });
+                    entry.maxRank = Math.max(entry.maxRank, SEVERITY_RANK[f.severity] ?? 0);
+                    ownerMap.set(owner, entry);
+                }
+                matched = true;
+                break;
+            }
+        }
+        if (!matched) {
+            const entry = ownerMap.get("unassigned") ?? { findings: [], maxRank: 0 };
+            entry.findings.push({ ruleId: f.ruleId, title: f.title, severity: f.severity });
+            entry.maxRank = Math.max(entry.maxRank, SEVERITY_RANK[f.severity] ?? 0);
+            ownerMap.set("unassigned", entry);
+        }
+    }
+    const results = [];
+    for (const [owner, data] of ownerMap) {
+        results.push({
+            owner,
+            findings: data.findings,
+            highestSeverity: rankToSev(data.maxRank),
+        });
+    }
+    results.sort((a, b) => (SEVERITY_RANK[b.highestSeverity] ?? 0) - (SEVERITY_RANK[a.highestSeverity] ?? 0));
+    return results;
+}
+export function runFindingOwnerNotify(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`Usage: judges finding-owner-notify [options]
+
+Generate ownership-based notification lists for findings.
+
+Options:
+  --report <path>      Path to verdict JSON
+  --owners <path>      Path to owner mapping file (JSON or CODEOWNERS format)
+  --format <fmt>       Output format: table (default) or json
+  -h, --help           Show this help message`);
+        return;
+    }
+    const formatIdx = argv.indexOf("--format");
+    const format = formatIdx !== -1 && argv[formatIdx + 1] ? argv[formatIdx + 1] : "table";
+    const reportIdx = argv.indexOf("--report");
+    const reportPath = reportIdx !== -1 && argv[reportIdx + 1]
+        ? join(process.cwd(), argv[reportIdx + 1])
+        : join(process.cwd(), ".judges", "last-verdict.json");
+    const ownersIdx = argv.indexOf("--owners");
+    const ownersPath = ownersIdx !== -1 && argv[ownersIdx + 1]
+        ? join(process.cwd(), argv[ownersIdx + 1])
+        : join(process.cwd(), ".judges", "owners.json");
+    if (!existsSync(reportPath)) {
+        console.log(`No report found at: ${reportPath}`);
+        return;
+    }
+    const data = JSON.parse(readFileSync(reportPath, "utf-8"));
+    const mappings = loadOwnerMappings(ownersPath);
+    const notifications = buildNotifications(data, mappings);
+    if (format === "json") {
+        console.log(JSON.stringify(notifications, null, 2));
+        return;
+    }
+    console.log(`\n=== Owner Notifications (${notifications.length} owners) ===\n`);
+    if (notifications.length === 0) {
+        console.log("No findings to notify about.");
+        return;
+    }
+    for (const n of notifications) {
+        console.log(`  ${n.owner} (${n.findings.length} findings, highest: ${n.highestSeverity})`);
+        for (const f of n.findings) {
+            console.log(`    [${f.severity.toUpperCase()}] ${f.ruleId}: ${f.title}`);
+        }
+        console.log();
+    }
+}

package/dist/commands/finding-ownership-assign.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Finding-ownership-assign — Assign ownership of findings to team members.
+ */
+export declare function runFindingOwnershipAssign(argv: string[]): void;

package/dist/commands/finding-ownership-assign.js

@@ -0,0 +1,101 @@
+/**
+ * Finding-ownership-assign — Assign ownership of findings to team members.
+ */
+import { readFileSync, writeFileSync, existsSync } from "fs";
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runFindingOwnershipAssign(argv) {
+    const storeIdx = argv.indexOf("--store");
+    const storePath = storeIdx >= 0 ? argv[storeIdx + 1] : ".judges-ownership.json";
+    const formatIdx = argv.indexOf("--format");
+    const format = formatIdx >= 0 ? argv[formatIdx + 1] : "table";
+    const assignIdx = argv.indexOf("--assign");
+    const assignRule = assignIdx >= 0 ? argv[assignIdx + 1] : "";
+    const ownerIdx = argv.indexOf("--owner");
+    const ownerName = ownerIdx >= 0 ? argv[ownerIdx + 1] : "";
+    const findingsIdx = argv.indexOf("--findings");
+    const findingsPath = findingsIdx >= 0 ? argv[findingsIdx + 1] : "";
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges finding-ownership-assign — Assign finding ownership
+
+Usage:
+  judges finding-ownership-assign [--store <path>] [--format table|json]
+  judges finding-ownership-assign --assign <ruleId> --owner <name> [--store <path>]
+  judges finding-ownership-assign --findings <path> --owner <name> [--store <path>]
+
+Options:
+  --store <path>      Ownership store (default: .judges-ownership.json)
+  --assign <ruleId>   Assign a specific rule finding
+  --findings <path>   Bulk assign from findings JSON
+  --owner <name>      Owner name/email
+  --format <fmt>      Output format: table (default), json
+  --help, -h          Show this help
+`);
+        return;
+    }
+    const store = existsSync(storePath)
+        ? JSON.parse(readFileSync(storePath, "utf-8"))
+        : { assignments: [], lastUpdated: new Date().toISOString() };
+    if (assignRule && ownerName) {
+        const existing = store.assignments.find((a) => a.ruleId === assignRule);
+        if (existing) {
+            existing.owner = ownerName;
+            existing.assignedAt = new Date().toISOString();
+            existing.status = "assigned";
+        }
+        else {
+            store.assignments.push({
+                ruleId: assignRule,
+                title: assignRule,
+                severity: "medium",
+                owner: ownerName,
+                assignedAt: new Date().toISOString(),
+                status: "assigned",
+            });
+        }
+        store.lastUpdated = new Date().toISOString();
+        writeFileSync(storePath, JSON.stringify(store, null, 2));
+        console.log(`Assigned ${assignRule} to ${ownerName}.`);
+        return;
+    }
+    if (findingsPath && ownerName && existsSync(findingsPath)) {
+        const findings = JSON.parse(readFileSync(findingsPath, "utf-8"));
+        let count = 0;
+        for (const f of findings) {
+            const existing = store.assignments.find((a) => a.ruleId === f.ruleId);
+            if (!existing) {
+                store.assignments.push({
+                    ruleId: f.ruleId,
+                    title: f.title,
+                    severity: f.severity,
+                    owner: ownerName,
+                    assignedAt: new Date().toISOString(),
+                    status: "assigned",
+                });
+                count++;
+            }
+        }
+        store.lastUpdated = new Date().toISOString();
+        writeFileSync(storePath, JSON.stringify(store, null, 2));
+        console.log(`Bulk assigned ${count} findings to ${ownerName}.`);
+        return;
+    }
+    if (format === "json") {
+        console.log(JSON.stringify(store, null, 2));
+        return;
+    }
+    console.log("\nFinding Ownership");
+    console.log("═".repeat(80));
+    if (store.assignments.length === 0) {
+        console.log("  No assignments yet.");
+    }
+    else {
+        console.log(`  ${"Rule ID".padEnd(25)} ${"Severity".padEnd(10)} ${"Owner".padEnd(18)} ${"Status".padEnd(14)} Assigned`);
+        console.log("  " + "─".repeat(75));
+        for (const a of store.assignments) {
+            console.log(`  ${a.ruleId.padEnd(25)} ${a.severity.padEnd(10)} ${a.owner.padEnd(18)} ${a.status.padEnd(14)} ${a.assignedAt.slice(0, 10)}`);
+        }
+    }
+    console.log(`\n  Total assignments: ${store.assignments.length}`);
+    console.log("═".repeat(80));
+}

package/dist/commands/finding-ownership-map.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Finding-ownership-map — Map findings to code owners.
+ */
+export declare function runFindingOwnershipMap(argv: string[]): void;

package/dist/commands/finding-ownership-map.js

@@ -0,0 +1,118 @@
+/**
+ * Finding-ownership-map — Map findings to code owners.
+ */
+import { readFileSync, existsSync } from "fs";
+import { stripWildcards } from "../tools/command-safety.js";
+// ─── Analysis ───────────────────────────────────────────────────────────────
+function parseCodeowners(path) {
+    if (!existsSync(path))
+        return [];
+    const content = readFileSync(path, "utf-8");
+    const mappings = [];
+    for (const line of content.split("\n")) {
+        const trimmed = line.trim();
+        if (trimmed.startsWith("#") || trimmed.length === 0)
+            continue;
+        const parts = trimmed.split(/\s+/);
+        if (parts.length >= 2) {
+            mappings.push({ pattern: parts[0], owner: parts[1] });
+        }
+    }
+    return mappings;
+}
+function mapOwnership(verdict, owners) {
+    const ownerMap = new Map();
+    const defaultOwner = "unassigned";
+    for (const f of verdict.findings) {
+        // Use ruleId prefix as a rough domain-to-owner mapping
+        let assignedOwner = defaultOwner;
+        const rulePrefix = f.ruleId.split("-")[0];
+        for (const o of owners) {
+            if (o.pattern.includes(rulePrefix) || f.ruleId.includes(stripWildcards(o.pattern))) {
+                assignedOwner = o.owner;
+                break;
+            }
+        }
+        const existing = ownerMap.get(assignedOwner);
+        const sev = (f.severity || "medium").toLowerCase();
+        if (existing) {
+            existing.findingCount++;
+            if (sev === "critical")
+                existing.criticalCount++;
+            if (sev === "high")
+                existing.highCount++;
+            if (!existing.ruleIds.includes(f.ruleId))
+                existing.ruleIds.push(f.ruleId);
+        }
+        else {
+            ownerMap.set(assignedOwner, {
+                owner: assignedOwner,
+                findingCount: 1,
+                criticalCount: sev === "critical" ? 1 : 0,
+                highCount: sev === "high" ? 1 : 0,
+                ruleIds: [f.ruleId],
+            });
+        }
+    }
+    return [...ownerMap.values()].sort((a, b) => b.findingCount - a.findingCount);
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runFindingOwnershipMap(argv) {
+    const fileIdx = argv.indexOf("--file");
+    const ownersIdx = argv.indexOf("--codeowners");
+    const formatIdx = argv.indexOf("--format");
+    const filePath = fileIdx >= 0 ? argv[fileIdx + 1] : undefined;
+    const ownersPath = ownersIdx >= 0 ? argv[ownersIdx + 1] : "CODEOWNERS";
+    const format = formatIdx >= 0 ? argv[formatIdx + 1] : "table";
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges finding-ownership-map — Map findings to code owners
+
+Usage:
+  judges finding-ownership-map --file <verdict.json> [--codeowners <path>]
+                               [--format table|json]
+
+Options:
+  --file <path>        Path to verdict JSON file (required)
+  --codeowners <path>  Path to CODEOWNERS file (default: CODEOWNERS)
+  --format <fmt>       Output format: table (default), json
+  --help, -h           Show this help
+`);
+        return;
+    }
+    if (!filePath) {
+        console.error("Error: --file required");
+        process.exitCode = 1;
+        return;
+    }
+    if (!existsSync(filePath)) {
+        console.error(`Error: not found: ${filePath}`);
+        process.exitCode = 1;
+        return;
+    }
+    let verdict;
+    try {
+        verdict = JSON.parse(readFileSync(filePath, "utf-8"));
+    }
+    catch {
+        console.error("Error: invalid JSON");
+        process.exitCode = 1;
+        return;
+    }
+    const owners = parseCodeowners(ownersPath);
+    const entries = mapOwnership(verdict, owners);
+    if (format === "json") {
+        console.log(JSON.stringify(entries, null, 2));
+        return;
+    }
+    console.log(`\nOwnership Map (${entries.length} owners)`);
+    console.log("═".repeat(65));
+    console.log(`${"Owner".padEnd(22)} ${"Findings".padEnd(10)} ${"Critical".padEnd(10)} ${"High".padEnd(8)} Rules`);
+    console.log("─".repeat(65));
+    for (const e of entries) {
+        const owner = e.owner.length > 20 ? e.owner.slice(0, 20) + "…" : e.owner;
+        const ruleStr = e.ruleIds.slice(0, 3).join(", ");
+        console.log(`${owner.padEnd(22)} ${String(e.findingCount).padEnd(10)} ${String(e.criticalCount).padEnd(10)} ${String(e.highCount).padEnd(8)} ${ruleStr}`);
+    }
+    console.log("═".repeat(65));
+}

package/dist/commands/finding-patch-chain.d.ts

@@ -0,0 +1 @@
+export declare function runFindingPatchChain(argv: string[]): void;

package/dist/commands/finding-patch-chain.js

@@ -0,0 +1,90 @@
+import { readFileSync, existsSync } from "fs";
+import { join } from "path";
+function buildPatchChains(verdict) {
+    const findings = verdict.findings ?? [];
+    const withPatches = [];
+    const withoutPatches = [];
+    for (const f of findings) {
+        const entry = {
+            ruleId: f.ruleId,
+            title: f.title,
+            severity: f.severity,
+            hasPatch: f.patch !== undefined && f.patch !== null,
+            patchPreview: f.patch !== undefined && f.patch !== null ? String(f.patch).slice(0, 80) : "",
+            lineNumbers: f.lineNumbers ?? [],
+        };
+        if (entry.hasPatch)
+            withPatches.push(entry);
+        else
+            withoutPatches.push(entry);
+    }
+    // Sort patches by line number (earliest first) for safe application order
+    withPatches.sort((a, b) => {
+        const aFirst = a.lineNumbers.length > 0 ? a.lineNumbers[0] : Infinity;
+        const bFirst = b.lineNumbers.length > 0 ? b.lineNumbers[0] : Infinity;
+        return bFirst - aFirst; // Apply from bottom up to avoid line shifts
+    });
+    const groups = [];
+    if (withPatches.length > 0) {
+        groups.push({
+            groupId: 1,
+            label: "Patchable findings (apply bottom-up)",
+            entries: withPatches,
+            applyOrder: "Apply from highest line number to lowest to avoid line shifts",
+        });
+    }
+    if (withoutPatches.length > 0) {
+        groups.push({
+            groupId: groups.length + 1,
+            label: "Manual fixes required",
+            entries: withoutPatches,
+            applyOrder: "Fix in any order — no auto-patches available",
+        });
+    }
+    return groups;
+}
+export function runFindingPatchChain(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`Usage: judges finding-patch-chain [options]
+
+Link and order patches across findings for safe application.
+
+Options:
+  --report <path>      Path to verdict JSON
+  --format <fmt>       Output format: table (default) or json
+  -h, --help           Show this help message`);
+        return;
+    }
+    const formatIdx = argv.indexOf("--format");
+    const format = formatIdx !== -1 && argv[formatIdx + 1] ? argv[formatIdx + 1] : "table";
+    const reportIdx = argv.indexOf("--report");
+    const reportPath = reportIdx !== -1 && argv[reportIdx + 1]
+        ? join(process.cwd(), argv[reportIdx + 1])
+        : join(process.cwd(), ".judges", "last-verdict.json");
+    if (!existsSync(reportPath)) {
+        console.log(`No report found at: ${reportPath}`);
+        return;
+    }
+    const data = JSON.parse(readFileSync(reportPath, "utf-8"));
+    const groups = buildPatchChains(data);
+    if (format === "json") {
+        console.log(JSON.stringify(groups, null, 2));
+        return;
+    }
+    const totalPatched = groups.filter((g) => g.label.includes("Patchable")).reduce((s, g) => s + g.entries.length, 0);
+    const totalManual = groups.filter((g) => g.label.includes("Manual")).reduce((s, g) => s + g.entries.length, 0);
+    console.log(`\n=== Patch Chain (${totalPatched} patchable, ${totalManual} manual) ===\n`);
+    for (const group of groups) {
+        console.log(`  Group #${group.groupId}: ${group.label}`);
+        console.log(`  Order: ${group.applyOrder}\n`);
+        for (const e of group.entries) {
+            const lines = e.lineNumbers.length > 0 ? ` (L${e.lineNumbers.join(",")})` : "";
+            console.log(`    [${e.severity.toUpperCase()}] ${e.ruleId}${lines}`);
+            console.log(`           ${e.title}`);
+            if (e.patchPreview) {
+                console.log(`           Patch: ${e.patchPreview}...`);
+            }
+        }
+        console.log();
+    }
+}