@kevinrabun/judges-cli 3.124.0

package/dist/commands/idempotency-audit.js

@@ -0,0 +1,222 @@
+/**
+ * Idempotency audit — verify retried/webhook operations are safely idempotent.
+ */
+import { readFileSync, readdirSync, statSync } from "fs";
+import { join, extname } from "path";
+// ─── File Collection ────────────────────────────────────────────────────────
+const CODE_EXTS = new Set([".ts", ".tsx", ".js", ".jsx", ".py", ".java", ".go", ".rs"]);
+function collectFiles(dir, max = 300) {
+    const files = [];
+    function walk(d) {
+        if (files.length >= max)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(d);
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (files.length >= max)
+                return;
+            if (e.startsWith(".") || e === "node_modules" || e === "dist" || e === "build")
+                continue;
+            const full = join(d, e);
+            try {
+                if (statSync(full).isDirectory())
+                    walk(full);
+                else if (CODE_EXTS.has(extname(full)))
+                    files.push(full);
+            }
+            catch {
+                /* skip */
+            }
+        }
+    }
+    walk(dir);
+    return files;
+}
+// ─── Analysis ───────────────────────────────────────────────────────────────
+function analyzeFile(filepath) {
+    const issues = [];
+    let content;
+    try {
+        content = readFileSync(filepath, "utf-8");
+    }
+    catch {
+        return issues;
+    }
+    const lines = content.split("\n");
+    const fullText = content;
+    const isRetryContext = /retry|webhook|queue|worker|consumer|handler|idempoten/i.test(fullText);
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // INSERT without ON CONFLICT / upsert in retry context
+        if (/INSERT\s+INTO/i.test(line) && isRetryContext) {
+            const block = lines.slice(i, Math.min(i + 3, lines.length)).join("\n");
+            if (!/ON\s+CONFLICT|ON\s+DUPLICATE|UPSERT|IF\s+NOT\s+EXISTS|MERGE/i.test(block)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "INSERT without conflict handling in retry path",
+                    severity: "high",
+                    detail: "Retry can cause duplicate rows — use INSERT ... ON CONFLICT or UPSERT",
+                });
+            }
+        }
+        // Auto-increment counter mutation in handler
+        if (/\+\+|\+=\s*1|\.increment|\.incr\b/i.test(line)) {
+            if (/handler|webhook|consumer|worker|queue|retry/i.test(fullText)) {
+                const block = lines.slice(Math.max(0, i - 5), Math.min(i + 5, lines.length)).join("\n");
+                if (!/idempotency|dedup|idempotent|already.*processed/i.test(block)) {
+                    issues.push({
+                        file: filepath,
+                        line: i + 1,
+                        issue: "Counter increment in retry-able path",
+                        severity: "high",
+                        detail: "Counter mutation is not idempotent — repeated execution will over-count",
+                    });
+                }
+            }
+        }
+        // Email/SMS/notification send without dedup
+        if (/sendEmail|sendSMS|sendNotification|notify|\.send\s*\(/i.test(line)) {
+            if (isRetryContext) {
+                const block = lines.slice(Math.max(0, i - 8), Math.min(i + 5, lines.length)).join("\n");
+                if (!/idempotency|dedup|already.*sent|sentIds|processed/i.test(block)) {
+                    issues.push({
+                        file: filepath,
+                        line: i + 1,
+                        issue: "Notification send without dedup in retry path",
+                        severity: "high",
+                        detail: "Retry will send duplicate notifications — track sent IDs or use idempotency key",
+                    });
+                }
+            }
+        }
+        // Payment/charge without idempotency key
+        if (/charge|payment|transfer|payout|refund/i.test(line) && /\.(?:create|post|execute)\s*\(/i.test(line)) {
+            const block = lines.slice(i, Math.min(i + 5, lines.length)).join("\n");
+            if (!/idempotency|idempotent|dedup|Idempotency-Key/i.test(block)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "Financial operation without idempotency key",
+                    severity: "high",
+                    detail: "Payment operation lacks idempotency key — retry can cause double-charge",
+                });
+            }
+        }
+        // Webhook handler without idempotency check
+        if (/webhook|eventHandler|onEvent|handleEvent/i.test(line) && /function|=>|async/.test(line)) {
+            const funcBlock = lines.slice(i, Math.min(i + 20, lines.length)).join("\n");
+            if (!/idempotency|dedup|already.*processed|processedIds|eventId/i.test(funcBlock)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "Webhook handler without idempotency guard",
+                    severity: "medium",
+                    detail: "Webhook providers may deliver events multiple times — check for prior processing",
+                });
+            }
+        }
+        // Queue consumer ACK before processing completes
+        if (/\.ack\s*\(|\.acknowledge/i.test(line)) {
+            const beforeBlock = lines.slice(Math.max(0, i - 3), i + 1).join("\n");
+            if (!/await|then|\.catch|try/i.test(beforeBlock)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "Queue ACK before processing completion",
+                    severity: "high",
+                    detail: "Acknowledging message before processing finishes — crash loses the message",
+                });
+            }
+        }
+        // File write without atomic rename pattern
+        if (/writeFileSync|writeFile\s*\(|fs\.write/i.test(line)) {
+            if (isRetryContext) {
+                const block = lines.slice(i, Math.min(i + 5, lines.length)).join("\n");
+                if (!/rename|\.tmp|\.temp|atomic|swap/i.test(block)) {
+                    issues.push({
+                        file: filepath,
+                        line: i + 1,
+                        issue: "File write without atomic rename",
+                        severity: "low",
+                        detail: "Non-atomic write in retry path — crash during write corrupts the file",
+                    });
+                }
+            }
+        }
+        // DELETE without WHERE in retry context
+        if (/DELETE\s+FROM/i.test(line) && isRetryContext) {
+            const block = lines.slice(i, Math.min(i + 3, lines.length)).join("\n");
+            if (!/WHERE/i.test(block)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "DELETE without WHERE in retry path",
+                    severity: "high",
+                    detail: "Unbounded DELETE is dangerous in retry context — could wipe entire table",
+                });
+            }
+        }
+    }
+    return issues;
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runIdempotencyAudit(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges idempotency-audit — Verify retry/webhook operations are safely idempotent
+
+Usage:
+  judges idempotency-audit [dir]
+  judges idempotency-audit src/ --format json
+
+Options:
+  [dir]                 Directory to scan (default: .)
+  --format json         JSON output
+  --help, -h            Show this help
+
+Checks: INSERT without conflict handling, counter mutation in retries, notification dedup,
+payment idempotency keys, webhook handler guards, queue ACK ordering, atomic file writes.
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const dir = argv.find((a) => !a.startsWith("-") && argv.indexOf(a) > 0) || ".";
+    const files = collectFiles(dir);
+    const allIssues = [];
+    for (const f of files)
+        allIssues.push(...analyzeFile(f));
+    const highCount = allIssues.filter((i) => i.severity === "high").length;
+    const medCount = allIssues.filter((i) => i.severity === "medium").length;
+    const score = Math.max(0, 100 - highCount * 10 - medCount * 4);
+    if (format === "json") {
+        console.log(JSON.stringify({
+            issues: allIssues,
+            score,
+            summary: { high: highCount, medium: medCount, total: allIssues.length },
+            timestamp: new Date().toISOString(),
+        }, null, 2));
+    }
+    else {
+        const badge = score >= 80 ? "✅ SAFE" : score >= 50 ? "⚠️  RISKY" : "❌ UNSAFE";
+        console.log(`\n  Idempotency: ${badge} (${score}/100)\n  ─────────────────────────────`);
+        if (allIssues.length === 0) {
+            console.log("    No idempotency issues detected.\n");
+            return;
+        }
+        for (const issue of allIssues.slice(0, 25)) {
+            const icon = issue.severity === "high" ? "🔴" : issue.severity === "medium" ? "🟡" : "🔵";
+            console.log(`    ${icon} ${issue.issue}`);
+            console.log(`        ${issue.file}:${issue.line}`);
+            console.log(`        ${issue.detail}`);
+        }
+        if (allIssues.length > 25)
+            console.log(`    ... and ${allIssues.length - 25} more`);
+        console.log(`\n    Total: ${allIssues.length} | High: ${highCount} | Medium: ${medCount} | Score: ${score}/100\n`);
+    }
+}

package/dist/commands/ignore-list.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Ignore-list — Configurable ignore patterns for files, directories, and rules.
+ */
+interface IgnoreConfig {
+    version: string;
+    filePatterns: string[];
+    directoryPatterns: string[];
+    ruleIgnores: string[];
+    inlineSuppressions: boolean;
+}
+declare function shouldIgnoreFile(filePath: string, baseDir: string, config: IgnoreConfig): boolean;
+declare function shouldIgnoreRule(ruleId: string, config: IgnoreConfig): boolean;
+declare function filterFiles(files: string[], baseDir: string, config: IgnoreConfig): {
+    effective: string[];
+    ignored: string[];
+};
+export declare function runIgnoreList(argv: string[]): void;
+export { shouldIgnoreFile, shouldIgnoreRule, filterFiles, IgnoreConfig };

package/dist/commands/ignore-list.js

@@ -0,0 +1,152 @@
+/**
+ * Ignore-list — Configurable ignore patterns for files, directories, and rules.
+ */
+import { readFileSync, writeFileSync, existsSync } from "fs";
+import { join, relative } from "path";
+import { matchGlobPath } from "../tools/command-safety.js";
+// ─── Simple glob matcher ────────────────────────────────────────────────────
+function matchGlob(filePath, pattern) {
+    return matchGlobPath(filePath, pattern);
+}
+// ─── Default config ────────────────────────────────────────────────────────
+function defaultIgnoreConfig() {
+    return {
+        version: "1.0.0",
+        filePatterns: [
+            "**/*.test.ts",
+            "**/*.test.js",
+            "**/*.spec.ts",
+            "**/*.spec.js",
+            "**/*.d.ts",
+            "**/fixtures/**",
+            "**/testdata/**",
+        ],
+        directoryPatterns: ["node_modules", "dist", "build", "coverage", ".git", ".next", "__pycache__", "vendor"],
+        ruleIgnores: [],
+        inlineSuppressions: true,
+    };
+}
+// ─── Matching engine ───────────────────────────────────────────────────────
+function shouldIgnoreFile(filePath, baseDir, config) {
+    const rel = relative(baseDir, filePath).replace(/\\/g, "/");
+    for (const pattern of config.filePatterns) {
+        if (matchGlob(rel, pattern))
+            return true;
+    }
+    // Check directory patterns
+    const parts = rel.split("/");
+    for (const dir of config.directoryPatterns) {
+        if (parts.includes(dir))
+            return true;
+    }
+    return false;
+}
+function shouldIgnoreRule(ruleId, config) {
+    return config.ruleIgnores.includes(ruleId);
+}
+function filterFiles(files, baseDir, config) {
+    const effective = [];
+    const ignored = [];
+    for (const f of files) {
+        if (shouldIgnoreFile(f, baseDir, config)) {
+            ignored.push(f);
+        }
+        else {
+            effective.push(f);
+        }
+    }
+    return { effective, ignored };
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runIgnoreList(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges ignore-list — Manage review ignore patterns
+
+Usage:
+  judges ignore-list init                   Create .judgesignore.json template
+  judges ignore-list show                   Show current ignore config
+  judges ignore-list test <path>            Test if a path would be ignored
+  judges ignore-list --format json          JSON output
+
+Subcommands:
+  init                 Create a .judgesignore.json template
+  show                 Display current ignore configuration
+  test <path>          Test whether a specific path is ignored
+
+Options:
+  --format json        JSON output
+  --help, -h           Show this help
+
+Ignore patterns are stored in .judgesignore.json and control which files,
+directories, and rules are excluded from review.
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const configPath = join(".", ".judgesignore.json");
+    const subcommand = argv.find((a) => !a.startsWith("-") && a !== "ignore-list") || "show";
+    if (subcommand === "init") {
+        if (existsSync(configPath)) {
+            console.error("Error: .judgesignore.json already exists.");
+            process.exitCode = 1;
+            return;
+        }
+        writeFileSync(configPath, JSON.stringify(defaultIgnoreConfig(), null, 2), "utf-8");
+        console.log("Created .judgesignore.json with default patterns.");
+        return;
+    }
+    // Load config
+    let config;
+    if (existsSync(configPath)) {
+        try {
+            config = JSON.parse(readFileSync(configPath, "utf-8"));
+        }
+        catch {
+            console.error("Error: .judgesignore.json is not valid JSON.");
+            process.exitCode = 1;
+            return;
+        }
+    }
+    else {
+        config = defaultIgnoreConfig();
+    }
+    if (subcommand === "test") {
+        const testPath = argv.find((a) => !a.startsWith("-") && a !== "ignore-list" && a !== "test");
+        if (!testPath) {
+            console.error("Error: Provide a path to test.");
+            process.exitCode = 1;
+            return;
+        }
+        const ignored = shouldIgnoreFile(testPath, ".", config);
+        if (format === "json") {
+            console.log(JSON.stringify({ path: testPath, ignored }));
+        }
+        else {
+            console.log(`  ${testPath}: ${ignored ? "❌ IGNORED" : "✅ INCLUDED"}`);
+        }
+        return;
+    }
+    // Show
+    if (format === "json") {
+        console.log(JSON.stringify(config, null, 2));
+        return;
+    }
+    console.log(`\n  Ignore Configuration\n  ─────────────────────────────`);
+    console.log(`    Source: ${existsSync(configPath) ? configPath : "defaults (no .judgesignore.json)"}`);
+    console.log(`\n    File Patterns (${config.filePatterns.length}):`);
+    for (const p of config.filePatterns)
+        console.log(`      ⬜ ${p}`);
+    console.log(`\n    Directory Patterns (${config.directoryPatterns.length}):`);
+    for (const p of config.directoryPatterns)
+        console.log(`      ⬜ ${p}`);
+    if (config.ruleIgnores.length > 0) {
+        console.log(`\n    Ignored Rules (${config.ruleIgnores.length}):`);
+        for (const r of config.ruleIgnores)
+            console.log(`      ⬜ ${r}`);
+    }
+    console.log(`\n    Inline suppressions: ${config.inlineSuppressions ? "enabled" : "disabled"}`);
+    console.log();
+}
+// Export helpers for use by other commands
+export { shouldIgnoreFile, shouldIgnoreRule, filterFiles };

package/dist/commands/impact-scan.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Impact scan — detect ripple effects of AI-generated code across
+ * the codebase: broken imports, unused exports, API contract breaks,
+ * dependency chain issues.
+ *
+ * All analysis local.
+ */
+export declare function runImpactScan(argv: string[]): void;

package/dist/commands/impact-scan.js

@@ -0,0 +1,281 @@
+/**
+ * Impact scan — detect ripple effects of AI-generated code across
+ * the codebase: broken imports, unused exports, API contract breaks,
+ * dependency chain issues.
+ *
+ * All analysis local.
+ */
+import { existsSync, readFileSync, readdirSync } from "fs";
+import { join, extname, relative, basename } from "path";
+// ─── Scanner ────────────────────────────────────────────────────────────────
+const SKIP = new Set(["node_modules", ".git", "dist", "build", "coverage"]);
+const EXTS = new Set([".ts", ".js", ".py", ".java", ".cs", ".go", ".rb", ".php", ".rs"]);
+function collectFiles(dir) {
+    const result = [];
+    function walk(d) {
+        let entries;
+        try {
+            entries = readdirSync(d);
+        }
+        catch {
+            return;
+        }
+        for (const name of entries) {
+            if (SKIP.has(name) || name.startsWith("."))
+                continue;
+            const full = join(d, name);
+            try {
+                const sub = readdirSync(full);
+                void sub;
+                walk(full);
+            }
+            catch {
+                if (EXTS.has(extname(name).toLowerCase()))
+                    result.push(full);
+            }
+        }
+    }
+    walk(dir);
+    return result;
+}
+// ─── Analysis ───────────────────────────────────────────────────────────────
+function extractExports(content) {
+    const exports = [];
+    const patterns = [
+        /export\s+(?:function|class|const|let|var|interface|type|enum)\s+(\w+)/g,
+        /export\s+default\s+(?:function|class)\s+(\w+)/g,
+        /export\s*{\s*([^}]+)\s*}/g,
+    ];
+    for (const pat of patterns) {
+        let m;
+        while ((m = pat.exec(content)) !== null) {
+            if (pat === patterns[2]) {
+                exports.push(...m[1]
+                    .split(",")
+                    .map((s) => s
+                    .trim()
+                    .split(/\s+as\s+/)[0]
+                    .trim())
+                    .filter(Boolean));
+            }
+            else {
+                exports.push(m[1]);
+            }
+        }
+    }
+    return exports;
+}
+function extractImports(content) {
+    const names = [];
+    const sources = [];
+    const importRe = /import\s+(?:{([^}]+)}|(\w+))\s+from\s+["']([^"']+)["']/g;
+    let m;
+    while ((m = importRe.exec(content)) !== null) {
+        sources.push(m[3]);
+        if (m[1]) {
+            names.push(...m[1]
+                .split(",")
+                .map((s) => s
+                .trim()
+                .split(/\s+as\s+/)[0]
+                .trim())
+                .filter(Boolean));
+        }
+        if (m[2])
+            names.push(m[2]);
+    }
+    // require
+    const reqRe = /require\s*\(\s*["']([^"']+)["']\s*\)/g;
+    while ((m = reqRe.exec(content)) !== null)
+        sources.push(m[1]);
+    return { names, sources };
+}
+function analyzeImpact(targetFile, allFiles, baseDir) {
+    const issues = [];
+    const targetContent = readFileSync(targetFile, "utf-8");
+    const targetRel = relative(baseDir, targetFile);
+    const targetBase = basename(targetFile).replace(/\.\w+$/, "");
+    const targetExports = extractExports(targetContent);
+    const targetImports = extractImports(targetContent);
+    // Build import graph from all other files
+    const importers = [];
+    const allExportsMap = new Map();
+    for (const f of allFiles) {
+        if (f === targetFile)
+            continue;
+        let content;
+        try {
+            content = readFileSync(f, "utf-8");
+        }
+        catch {
+            continue;
+        }
+        const rel = relative(baseDir, f);
+        allExportsMap.set(rel, extractExports(content));
+        const { names, sources } = extractImports(content);
+        for (const src of sources) {
+            if (src.includes(targetBase) || src.endsWith("/" + targetBase)) {
+                importers.push({ file: rel, names, source: src });
+            }
+        }
+    }
+    // 1. Check if target's imports reference valid sources
+    for (const src of targetImports.sources) {
+        if (src.startsWith(".")) {
+            const resolved = allFiles.find((f) => {
+                const rel = relative(baseDir, f).replace(/\\/g, "/");
+                const srcNorm = src.replace(/^\.\//, "").replace(/\.\w+$/, "");
+                return rel.replace(/\.\w+$/, "").endsWith(srcNorm);
+            });
+            if (!resolved) {
+                issues.push({
+                    type: "broken-import",
+                    severity: "high",
+                    file: targetRel,
+                    detail: `Import "${src}" could not be resolved`,
+                });
+            }
+        }
+    }
+    // 2. Find exports that nobody imports
+    for (const exp of targetExports) {
+        const usedAnywhere = allFiles.some((f) => {
+            if (f === targetFile)
+                return false;
+            try {
+                return readFileSync(f, "utf-8").includes(exp);
+            }
+            catch {
+                return false;
+            }
+        });
+        if (!usedAnywhere) {
+            issues.push({
+                type: "unused-export",
+                severity: "low",
+                file: targetRel,
+                detail: `Export "${exp}" is not imported by any other file`,
+            });
+        }
+    }
+    // 3. Check naming conflicts
+    for (const exp of targetExports) {
+        const conflicts = [];
+        for (const [file, exports] of allExportsMap) {
+            if (exports.includes(exp))
+                conflicts.push(file);
+        }
+        if (conflicts.length > 0) {
+            issues.push({
+                type: "naming-conflict",
+                severity: "medium",
+                file: targetRel,
+                detail: `Export "${exp}" also exported by: ${conflicts.join(", ")}`,
+                affectedFiles: conflicts,
+            });
+        }
+    }
+    // 4. Check files importing target for potential breaks
+    if (importers.length > 0) {
+        const importerFiles = importers.map((i) => i.file);
+        issues.push({
+            type: "dependency-chain",
+            severity: "medium",
+            file: targetRel,
+            detail: `${importers.length} file(s) depend on this module`,
+            affectedFiles: importerFiles,
+        });
+    }
+    // 5. API contract — detect exported function signature changes
+    const fnSigs = targetContent.match(/export\s+(?:async\s+)?function\s+\w+\s*\([^)]*\)/g) || [];
+    const paramCounts = fnSigs.map((sig) => {
+        const params = sig.match(/\(([^)]*)\)/)?.[1] || "";
+        return params.split(",").filter((p) => p.trim().length > 0).length;
+    });
+    const _highArity = paramCounts.filter((c) => c > 5).length;
+    if (_highArity > 0) {
+        issues.push({
+            type: "api-contract",
+            severity: "medium",
+            file: targetRel,
+            detail: `${_highArity} exported function(s) with >5 parameters — fragile API contract`,
+        });
+    }
+    const affected = new Set();
+    for (const iss of issues) {
+        if (iss.affectedFiles)
+            iss.affectedFiles.forEach((f) => affected.add(f));
+    }
+    const impactScore = Math.max(0, 100 -
+        issues.filter((i) => i.severity === "high").length * 25 -
+        issues.filter((i) => i.severity === "medium").length * 10 -
+        issues.filter((i) => i.severity === "low").length * 3);
+    return { targetFile: targetRel, issues, impactScore, affectedFileCount: affected.size };
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runImpactScan(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges impact-scan — Detect cross-file ripple effects
+
+Usage:
+  judges impact-scan <file>
+  judges impact-scan src/api.ts --base-dir src/
+  judges impact-scan <dir>       (scan all files)
+
+Options:
+  --base-dir <dir>    Base directory for resolution (default: .)
+  --format json       JSON output
+  --help, -h          Show this help
+
+Checks:
+  • Broken imports (unresolved local imports)
+  • Unused exports (dead code)
+  • Naming conflicts (duplicate export names)
+  • Dependency chain (files that depend on this module)
+  • API contract (fragile function signatures)
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const baseDir = argv.find((_a, i) => argv[i - 1] === "--base-dir") || ".";
+    const target = argv.find((a) => !a.startsWith("--") && !argv[argv.indexOf(a) - 1]?.startsWith("--")) || ".";
+    if (!existsSync(target)) {
+        console.error(`  Path not found: ${target}`);
+        return;
+    }
+    const allFiles = collectFiles(baseDir);
+    let targetFiles;
+    try {
+        readdirSync(target);
+        targetFiles = collectFiles(target);
+    }
+    catch {
+        targetFiles = [target];
+    }
+    const results = [];
+    for (const f of targetFiles) {
+        results.push(analyzeImpact(f, allFiles, baseDir));
+    }
+    results.sort((a, b) => a.impactScore - b.impactScore);
+    if (format === "json") {
+        console.log(JSON.stringify({ results, timestamp: new Date().toISOString() }, null, 2));
+    }
+    else {
+        console.log(`\n  Impact Scan — ${targetFiles.length} target(s), ${allFiles.length} total files\n  ──────────────────────────`);
+        for (const r of results) {
+            if (r.issues.length === 0)
+                continue;
+            const icon = r.impactScore >= 80 ? "🟢" : r.impactScore >= 50 ? "🟡" : "🔴";
+            console.log(`\n    ${icon} ${r.targetFile} — impact ${r.impactScore}/100 (${r.affectedFileCount} affected files)`);
+            for (const iss of r.issues) {
+                const sev = iss.severity === "high" ? "🔴" : iss.severity === "medium" ? "🟠" : "🟡";
+                console.log(`        ${sev} [${iss.type}] ${iss.detail}`);
+            }
+        }
+        const clean = results.filter((r) => r.issues.length === 0).length;
+        if (clean > 0)
+            console.log(`\n    ✅ ${clean} file(s) have no cross-file impact issues`);
+        console.log("");
+    }
+}