@kevinrabun/judges-cli 3.124.0

package/dist/commands/plugin-search.js

@@ -0,0 +1,327 @@
+/**
+ * `judges plugin search` — Plugin discovery from a curated registry.
+ *
+ * Uses a local JSON registry file (bundled with judges) to list available
+ * community and official plugins. No network calls — the registry is
+ * versioned alongside the codebase and updated when judges is updated.
+ *
+ * Usage:
+ *   judges plugin search                    List all plugins
+ *   judges plugin search security           Search by keyword
+ *   judges plugin search --category custom  Filter by category
+ */
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+import { defaultRegistry } from "../judge-registry.js";
+// ─── Registry Loading ───────────────────────────────────────────────────────
+/**
+ * Load the bundled plugin registry.
+ * Falls back to an empty registry if the file doesn't exist.
+ */
+function loadRegistry() {
+    // The registry lives alongside the distributed package
+    try {
+        const __filename = fileURLToPath(import.meta.url);
+        const __dirname = dirname(__filename);
+        const registryPath = join(__dirname, "..", "plugin-registry.json");
+        const raw = readFileSync(registryPath, "utf-8");
+        return JSON.parse(raw);
+    }
+    catch {
+        // Return the built-in seed registry
+        return SEED_REGISTRY;
+    }
+}
+// ─── Seed Registry ──────────────────────────────────────────────────────────
+// Bundled starter entries — extended by the plugin-registry.json file.
+const SEED_REGISTRY = {
+    version: "1.0",
+    updatedAt: new Date().toISOString(),
+    plugins: [
+        {
+            name: "@kevinrabun/judges-plugin-react",
+            description: "React-specific security and quality rules: XSS via dangerouslySetInnerHTML, hooks misuse, key prop validation",
+            version: "0.1.0",
+            author: "judges",
+            categories: ["react", "frontend", "security"],
+            install: "npm install @kevinrabun/judges-plugin-react",
+            official: true,
+        },
+        {
+            name: "@kevinrabun/judges-plugin-aws",
+            description: "AWS infrastructure rules: IAM over-permissioning, S3 public access, Lambda cold start patterns",
+            version: "0.1.0",
+            author: "judges",
+            categories: ["aws", "cloud", "infrastructure", "security"],
+            install: "npm install @kevinrabun/judges-plugin-aws",
+            official: true,
+        },
+        {
+            name: "@kevinrabun/judges-plugin-kubernetes",
+            description: "Kubernetes manifest validation: pod security, resource limits, network policies",
+            version: "0.1.0",
+            author: "judges",
+            categories: ["kubernetes", "infrastructure", "security"],
+            install: "npm install @kevinrabun/judges-plugin-kubernetes",
+            official: true,
+        },
+        {
+            name: "@kevinrabun/judges-plugin-database",
+            description: "Database query and schema rules: N+1 detection, missing indexes, migration safety",
+            version: "0.1.0",
+            author: "judges",
+            categories: ["database", "performance", "quality"],
+            install: "npm install @kevinrabun/judges-plugin-database",
+            official: true,
+        },
+        {
+            name: "@kevinrabun/judges-plugin-graphql",
+            description: "GraphQL schema and resolver rules: depth limiting, query complexity, authorization",
+            version: "0.1.0",
+            author: "judges",
+            categories: ["graphql", "api", "security"],
+            install: "npm install @kevinrabun/judges-plugin-graphql",
+            official: true,
+        },
+    ],
+};
+// ─── Search & Filter ────────────────────────────────────────────────────────
+function searchPlugins(registry, query, category) {
+    let results = registry.plugins;
+    if (category) {
+        const cat = category.toLowerCase();
+        results = results.filter((p) => p.categories.some((c) => c.toLowerCase() === cat));
+    }
+    if (query) {
+        const q = query.toLowerCase();
+        results = results.filter((p) => p.name.toLowerCase().includes(q) ||
+            p.description.toLowerCase().includes(q) ||
+            p.categories.some((c) => c.toLowerCase().includes(q)) ||
+            p.author.toLowerCase().includes(q));
+    }
+    return results;
+}
+// ─── Formatters ─────────────────────────────────────────────────────────────
+function formatPluginList(plugins) {
+    if (plugins.length === 0) {
+        return "No plugins found matching your search.\n";
+    }
+    const lines = [
+        "╔══════════════════════════════════════════════════════════════╗",
+        "║              Judges — Plugin Registry                       ║",
+        "╚══════════════════════════════════════════════════════════════╝",
+        "",
+        `Found ${plugins.length} plugin(s):`,
+        "",
+    ];
+    for (const p of plugins) {
+        const badge = p.official ? " ✓ official" : "";
+        lines.push(`  ${p.name}${badge}`);
+        lines.push(`    ${p.description}`);
+        lines.push(`    Categories: ${p.categories.join(", ")}   Version: ${p.version}`);
+        lines.push(`    Install: ${p.install}`);
+        if (p.url)
+            lines.push(`    Docs: ${p.url}`);
+        lines.push("");
+    }
+    lines.push("To add a plugin to your project:");
+    lines.push("  1. Install: npm install <plugin-name>");
+    lines.push('  2. Add to .judgesrc: { "plugins": ["<plugin-name>"] }');
+    lines.push("");
+    return lines.join("\n");
+}
+function formatPluginJson(plugins) {
+    return JSON.stringify(plugins, null, 2);
+}
+// ─── CLI Entry ──────────────────────────────────────────────────────────────
+export function runPluginSearch(argv) {
+    // Detect subcommand: judges plugin <sub> [args]
+    const sub = argv[3];
+    if (sub === "list") {
+        listInstalledPlugins();
+        return;
+    }
+    if (sub === "init") {
+        const name = argv[4];
+        if (!name) {
+            console.error("  Usage: judges plugin init <name>");
+            process.exit(1);
+        }
+        scaffoldPlugin(name);
+        return;
+    }
+    if (sub === "info") {
+        const name = argv[4];
+        if (!name) {
+            console.error("  Usage: judges plugin info <name>");
+            process.exit(1);
+        }
+        showPluginInfo(name);
+        return;
+    }
+    // Default: search
+    let query;
+    let category;
+    let format = "text";
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === "--category" && argv[i + 1])
+            category = argv[++i];
+        else if (arg === "--format" && argv[i + 1])
+            format = argv[++i];
+        else if (arg === "--help" || arg === "-h") {
+            printHelp();
+            process.exit(0);
+        }
+        else if (!arg.startsWith("-") && arg !== "plugin" && arg !== "search") {
+            query = arg;
+        }
+    }
+    const registry = loadRegistry();
+    const results = searchPlugins(registry, query, category);
+    if (format === "json") {
+        console.log(formatPluginJson(results));
+    }
+    else {
+        console.log(formatPluginList(results));
+    }
+}
+// ─── List Installed Plugins ─────────────────────────────────────────────────
+function listInstalledPlugins() {
+    const installed = defaultRegistry.getRegisteredPlugins();
+    if (installed.length === 0) {
+        console.log("\n  No plugins installed.\n");
+        console.log("  To create a plugin: judges plugin init <name>");
+        console.log("  To browse plugins:  judges plugin search\n");
+        return;
+    }
+    console.log("\n  Installed Plugins:");
+    console.log("  " + "─".repeat(55));
+    console.log(`  ${"Name".padEnd(30)} ${"Version".padEnd(10)} Rules  Judges`);
+    console.log("  " + "─".repeat(55));
+    for (const p of installed) {
+        console.log(`  ${p.name.padEnd(30)} v${p.version.padEnd(9)} ${String(p.rulesRegistered).padStart(5)}  ${String(p.judgesRegistered).padStart(6)}`);
+    }
+    console.log("");
+}
+// ─── Plugin Info ────────────────────────────────────────────────────────────
+function showPluginInfo(name) {
+    // Check installed first
+    const installed = defaultRegistry.getRegisteredPlugins();
+    const found = installed.find((p) => p.name === name);
+    if (found) {
+        console.log(`\n  Plugin  : ${found.name}`);
+        console.log(`  Version : ${found.version}`);
+        console.log(`  Rules   : ${found.rulesRegistered}`);
+        console.log(`  Judges  : ${found.judgesRegistered}`);
+        console.log(`  Status  : installed ✅\n`);
+        return;
+    }
+    // Check registry
+    const registry = loadRegistry();
+    const entry = registry.plugins.find((p) => p.name === name || p.name.endsWith(`/${name}`));
+    if (entry) {
+        console.log(`\n  Plugin      : ${entry.name}`);
+        console.log(`  Version     : ${entry.version}`);
+        console.log(`  Description : ${entry.description}`);
+        console.log(`  Author      : ${entry.author}`);
+        console.log(`  Categories  : ${entry.categories.join(", ")}`);
+        console.log(`  Install     : ${entry.install}`);
+        if (entry.url)
+            console.log(`  Docs        : ${entry.url}`);
+        console.log(`  Status      : not installed\n`);
+        return;
+    }
+    console.log(`\n  Plugin "${name}" not found.\n`);
+    console.log("  Search available plugins: judges plugin search\n");
+}
+// ─── Scaffold New Plugin ────────────────────────────────────────────────────
+function scaffoldPlugin(name) {
+    const dir = join(process.cwd(), name);
+    if (existsSync(dir)) {
+        console.error(`  Error: Directory '${name}' already exists.`);
+        process.exit(1);
+    }
+    mkdirSync(dir, { recursive: true });
+    mkdirSync(join(dir, "src"), { recursive: true });
+    writeFileSync(join(dir, "package.json"), JSON.stringify({
+        name: `judges-plugin-${name}`,
+        version: "0.1.0",
+        type: "module",
+        main: "dist/index.js",
+        types: "dist/index.d.ts",
+        keywords: ["judges-plugin", "code-review", "security"],
+        peerDependencies: { "@kevinrabun/judges": "*" },
+        scripts: { build: "tsc" },
+    }, null, 2), "utf-8");
+    writeFileSync(join(dir, "tsconfig.json"), JSON.stringify({
+        compilerOptions: {
+            target: "ES2022",
+            module: "Node16",
+            moduleResolution: "Node16",
+            outDir: "./dist",
+            rootDir: "./src",
+            strict: true,
+            declaration: true,
+        },
+        include: ["src/**/*"],
+    }, null, 2), "utf-8");
+    writeFileSync(join(dir, "src", "index.ts"), `/**
+ * ${name} — Judges Panel Plugin
+ *
+ * import { registerPlugin } from "@kevinrabun/judges/api";
+ * import plugin from "judges-plugin-${name}";
+ * registerPlugin(plugin);
+ */
+
+import type { JudgesPlugin } from "@kevinrabun/judges/api";
+
+const plugin: JudgesPlugin = {
+  name: "${name}",
+  version: "0.1.0",
+  description: "Custom judges plugin",
+  rules: [
+    // {
+    //   id: "CUSTOM-001",
+    //   title: "Example Rule",
+    //   severity: "medium",
+    //   judgeId: "custom",
+    //   description: "Describe what this rule checks",
+    //   pattern: /your-regex-pattern/,
+    //   suggestedFix: "Fix suggestion",
+    //   tags: ["custom"],
+    // },
+  ],
+};
+
+export default plugin;
+`, "utf-8");
+    console.log(`\n  ✅ Plugin scaffolded at: ./${name}/`);
+    console.log(`\n  Next steps:`);
+    console.log(`    1. cd ${name}`);
+    console.log(`    2. Add custom rules to src/index.ts`);
+    console.log(`    3. npm run build`);
+    console.log(`    4. Register in your project: import & registerPlugin()\n`);
+}
+// ─── Help ───────────────────────────────────────────────────────────────────
+function printHelp() {
+    console.log(`
+judges plugin — Plugin discovery and management
+
+Usage:
+  judges plugin search                      List all plugins
+  judges plugin search security             Search by keyword
+  judges plugin search --category aws       Filter by category
+  judges plugin list                        List installed plugins
+  judges plugin info <name>                 Show plugin details
+  judges plugin init <name>                 Scaffold a new plugin project
+
+Options:
+  --category <name>   Filter by category (e.g. security, aws, react)
+  --format <fmt>      Output format: text (default), json
+  -h, --help          Show this help
+
+The plugin registry is bundled locally — no network calls are made.
+`);
+}

package/dist/commands/plugins.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `judges plugins` — Plugin management and discovery.
+ *
+ * Lists installed plugins, shows their rules and judges, and provides
+ * guidance on creating and discovering new plugins.
+ *
+ * Usage:
+ *   judges plugins                    List installed plugins
+ *   judges plugins --format json      Machine-readable output
+ *   judges plugins info <name>        Show details for a plugin
+ */
+export declare function runPlugins(argv: string[]): void;

package/dist/commands/plugins.js

@@ -0,0 +1,104 @@
+/**
+ * `judges plugins` — Plugin management and discovery.
+ *
+ * Lists installed plugins, shows their rules and judges, and provides
+ * guidance on creating and discovering new plugins.
+ *
+ * Usage:
+ *   judges plugins                    List installed plugins
+ *   judges plugins --format json      Machine-readable output
+ *   judges plugins info <name>        Show details for a plugin
+ */
+import { getRegisteredPlugins, getCustomRules, getPluginJudges } from "../plugins.js";
+// ─── Runner ─────────────────────────────────────────────────────────────────
+export function runPlugins(argv) {
+    const format = argv.includes("--format") ? argv[argv.indexOf("--format") + 1] : "text";
+    const subcommand = argv.find((a, i) => i > 2 && !a.startsWith("-") && a !== "json" && a !== "text");
+    const plugins = getRegisteredPlugins();
+    const customRules = getCustomRules();
+    const customJudges = getPluginJudges();
+    if (subcommand === "info") {
+        const name = argv.find((a, i) => i > argv.indexOf("info") && !a.startsWith("-"));
+        if (!name) {
+            console.error("  Usage: judges plugins info <plugin-name>");
+            process.exit(1);
+        }
+        const reg = plugins.find((p) => p.name === name);
+        if (!reg) {
+            console.error(`  Plugin not found: "${name}"`);
+            console.error(`  Installed plugins: ${plugins.map((p) => p.name).join(", ") || "(none)"}`);
+            process.exit(1);
+        }
+        console.log("");
+        console.log(`  Plugin: ${reg.name} v${reg.version}`);
+        console.log("  " + "─".repeat(40));
+        console.log(`  Rules registered:  ${reg.rulesRegistered}`);
+        console.log(`  Judges registered: ${reg.judgesRegistered}`);
+        console.log("");
+        return;
+    }
+    if (format === "json") {
+        console.log(JSON.stringify({
+            installed: plugins.map((p) => ({
+                name: p.name,
+                version: p.version,
+                rulesRegistered: p.rulesRegistered,
+                judgesRegistered: p.judgesRegistered,
+            })),
+            totalCustomRules: customRules.length,
+            totalCustomJudges: customJudges.length,
+            customRuleIds: customRules.map((r) => r.id),
+            customJudgeIds: customJudges.map((j) => j.id),
+        }, null, 2));
+        return;
+    }
+    // Text output
+    console.log("");
+    console.log("╔══════════════════════════════════════════════════════════════╗");
+    console.log("║           Judges Panel — Plugin Manager                     ║");
+    console.log("╚══════════════════════════════════════════════════════════════╝");
+    console.log("");
+    if (plugins.length === 0) {
+        console.log("  No plugins installed.");
+        console.log("");
+        console.log("  Get started:");
+        console.log("    judges scaffold-plugin my-rules      Create a new plugin");
+        console.log("    judges community-patterns             Browse community patterns");
+        console.log("    judges help plugins                   Plugin authoring guide");
+        console.log("");
+        return;
+    }
+    console.log(`  Installed Plugins: ${plugins.length}`);
+    console.log(`  Custom Rules: ${customRules.length}`);
+    console.log(`  Custom Judges: ${customJudges.length}`);
+    console.log("");
+    console.log("  " + "─".repeat(60));
+    console.log("");
+    for (const reg of plugins) {
+        const version = reg.version ? ` v${reg.version}` : "";
+        console.log(`  📦 ${reg.name}${version}`);
+        console.log(`     Rules:  ${reg.rulesRegistered}`);
+        console.log(`     Judges: ${reg.judgesRegistered}`);
+        console.log("");
+    }
+    if (customRules.length > 0) {
+        console.log("  Custom Rules:");
+        for (const r of customRules) {
+            const sev = r.severity ? ` [${r.severity}]` : "";
+            console.log(`    ${r.id}${sev} — ${r.description ?? "(no description)"}`);
+        }
+        console.log("");
+    }
+    if (customJudges.length > 0) {
+        console.log("  Custom Judges:");
+        for (const j of customJudges) {
+            console.log(`    ${j.id} — ${j.name}: ${j.domain}`);
+        }
+        console.log("");
+    }
+    console.log("  Commands:");
+    console.log("    judges plugins info <name>          Show plugin details");
+    console.log("    judges scaffold-plugin <name>       Create a new plugin");
+    console.log("    judges community-patterns           Browse community patterns");
+    console.log("");
+}

package/dist/commands/policy-audit.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Policy audit trail — record which rules/judges were active at evaluation
+ * time, creating an immutable local audit log for compliance proof.
+ *
+ * Enables SOC2/ISO27001 auditors to verify that security policies were
+ * enforced at the time of each evaluation. All data stays local.
+ */
+import type { TribunalVerdict, JudgesConfig } from "../types.js";
+export interface PolicySnapshot {
+    /** SHA-256 hash of the combined policy state */
+    policyHash: string;
+    /** ISO timestamp */
+    timestamp: string;
+    /** Config file path */
+    configPath: string;
+    /** Active preset(s) */
+    presets: string[];
+    /** Judges that were enabled */
+    enabledJudges: string[];
+    /** Judges that were disabled */
+    disabledJudges: string[];
+    /** Disabled rules */
+    disabledRules: string[];
+    /** Rule overrides */
+    ruleOverrides: Record<string, unknown>;
+    /** Min severity threshold */
+    minSeverity: string;
+    /** Git commit at evaluation time */
+    gitCommit?: string;
+    /** Evaluator version */
+    version: string;
+}
+export interface AuditEntry {
+    id: string;
+    timestamp: string;
+    policySnapshot: PolicySnapshot;
+    verdictSummary: {
+        verdict: string;
+        score: number;
+        criticalCount: number;
+        highCount: number;
+        totalFindings: number;
+    };
+    filesEvaluated: number;
+}
+export interface AuditLog {
+    entries: AuditEntry[];
+    version: string;
+}
+export declare function capturePolicySnapshot(config: JudgesConfig, configPath: string, enabledJudges: string[], version: string): PolicySnapshot;
+export declare function recordAuditEntry(policySnapshot: PolicySnapshot, verdict: TribunalVerdict, filesEvaluated: number): AuditEntry;
+export declare function runPolicyAudit(argv: string[]): void;

package/dist/commands/policy-audit.js

@@ -0,0 +1,160 @@
+/**
+ * Policy audit trail — record which rules/judges were active at evaluation
+ * time, creating an immutable local audit log for compliance proof.
+ *
+ * Enables SOC2/ISO27001 auditors to verify that security policies were
+ * enforced at the time of each evaluation. All data stays local.
+ */
+import { createHash } from "crypto";
+// ─── Policy Snapshot ────────────────────────────────────────────────────────
+export function capturePolicySnapshot(config, configPath, enabledJudges, version) {
+    const { execSync } = require("child_process");
+    let gitCommit;
+    try {
+        gitCommit = execSync("git rev-parse HEAD", { encoding: "utf-8" }).trim();
+    }
+    catch {
+        /* not in git */
+    }
+    const snapshot = {
+        policyHash: "",
+        timestamp: new Date().toISOString(),
+        configPath,
+        presets: config.preset ? [config.preset] : [],
+        enabledJudges,
+        disabledJudges: config.disabledJudges || [],
+        disabledRules: config.disabledRules || [],
+        ruleOverrides: config.ruleOverrides || {},
+        minSeverity: config.minSeverity || "info",
+        gitCommit,
+        version,
+    };
+    // Compute deterministic hash of policy state
+    const hashInput = JSON.stringify({
+        presets: snapshot.presets,
+        enabledJudges: snapshot.enabledJudges.sort(),
+        disabledJudges: snapshot.disabledJudges.sort(),
+        disabledRules: snapshot.disabledRules.sort(),
+        ruleOverrides: snapshot.ruleOverrides,
+        minSeverity: snapshot.minSeverity,
+    });
+    snapshot.policyHash = createHash("sha256").update(hashInput).digest("hex").slice(0, 16);
+    return snapshot;
+}
+// ─── Audit Log Management ──────────────────────────────────────────────────
+const AUDIT_FILE = ".judges-audit.json";
+function loadAuditLog() {
+    const { readFileSync, existsSync } = require("fs");
+    if (existsSync(AUDIT_FILE)) {
+        try {
+            return JSON.parse(readFileSync(AUDIT_FILE, "utf-8"));
+        }
+        catch {
+            /* corrupt file */
+        }
+    }
+    return { entries: [], version: "1.0" };
+}
+function saveAuditLog(log) {
+    const { writeFileSync } = require("fs");
+    writeFileSync(AUDIT_FILE, JSON.stringify(log, null, 2), "utf-8");
+}
+export function recordAuditEntry(policySnapshot, verdict, filesEvaluated) {
+    const entry = {
+        id: createHash("sha256")
+            .update(policySnapshot.timestamp + policySnapshot.policyHash)
+            .digest("hex")
+            .slice(0, 12),
+        timestamp: policySnapshot.timestamp,
+        policySnapshot,
+        verdictSummary: {
+            verdict: verdict.overallVerdict,
+            score: verdict.overallScore,
+            criticalCount: verdict.criticalCount,
+            highCount: verdict.highCount,
+            totalFindings: verdict.findings.length,
+        },
+        filesEvaluated,
+    };
+    const log = loadAuditLog();
+    log.entries.push(entry);
+    // Keep last 1000 entries
+    if (log.entries.length > 1000) {
+        log.entries = log.entries.slice(-1000);
+    }
+    saveAuditLog(log);
+    return entry;
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runPolicyAudit(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges policy-audit — View and manage the policy audit trail
+
+Usage:
+  judges policy-audit                       Show recent audit entries
+  judges policy-audit --last 10             Show last 10 entries
+  judges policy-audit --diff                Compare current policy to last evaluation
+  judges policy-audit --export audit.json   Export full audit log
+
+Options:
+  --last <n>           Show last N entries (default: 5)
+  --diff               Show policy changes since last evaluation
+  --export <path>      Export audit log to file
+  --format json        JSON output
+  --help, -h           Show this help
+
+The audit trail records which rules, judges, and configs were active at
+each evaluation time. Useful for SOC2/ISO27001 compliance proof.
+`);
+        return;
+    }
+    const { readFileSync, existsSync, writeFileSync } = require("fs");
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const lastN = parseInt(argv.find((_a, i) => argv[i - 1] === "--last") || "5", 10);
+    const exportPath = argv.find((_a, i) => argv[i - 1] === "--export");
+    if (!existsSync(AUDIT_FILE)) {
+        console.log("\n  No audit trail found. Run an evaluation first.\n");
+        return;
+    }
+    const log = JSON.parse(readFileSync(AUDIT_FILE, "utf-8"));
+    if (exportPath) {
+        writeFileSync(exportPath, JSON.stringify(log, null, 2), "utf-8");
+        console.log(`  Exported ${log.entries.length} audit entries to ${exportPath}`);
+        return;
+    }
+    const entries = log.entries.slice(-lastN);
+    if (format === "json") {
+        console.log(JSON.stringify(entries, null, 2));
+        return;
+    }
+    if (argv.includes("--diff") && log.entries.length >= 2) {
+        const prev = log.entries[log.entries.length - 2].policySnapshot;
+        const curr = log.entries[log.entries.length - 1].policySnapshot;
+        console.log("\n  Policy Diff (last two evaluations)\n");
+        if (prev.policyHash !== curr.policyHash) {
+            console.log("  ⚠️  Policy changed!\n");
+            const addedJudges = curr.enabledJudges.filter((j) => !prev.enabledJudges.includes(j));
+            const removedJudges = prev.enabledJudges.filter((j) => !curr.enabledJudges.includes(j));
+            if (addedJudges.length)
+                console.log(`  + Added judges: ${addedJudges.join(", ")}`);
+            if (removedJudges.length)
+                console.log(`  - Removed judges: ${removedJudges.join(", ")}`);
+            if (prev.minSeverity !== curr.minSeverity)
+                console.log(`  ~ Severity: ${prev.minSeverity} → ${curr.minSeverity}`);
+        }
+        else {
+            console.log("  ✅ No policy changes\n");
+        }
+        console.log("");
+        return;
+    }
+    console.log(`\n  Policy Audit Trail (last ${entries.length} of ${log.entries.length})\n`);
+    for (const e of entries) {
+        const v = e.verdictSummary;
+        console.log(`  ${e.id}  ${e.timestamp}`);
+        console.log(`    Policy: ${e.policySnapshot.policyHash}  Judges: ${e.policySnapshot.enabledJudges.length}  Commit: ${e.policySnapshot.gitCommit?.slice(0, 8) || "N/A"}`);
+        console.log(`    Verdict: ${v.verdict}  Score: ${v.score}  Critical: ${v.criticalCount}  High: ${v.highCount}  Findings: ${v.totalFindings}`);
+        console.log("");
+    }
+}

package/dist/commands/pr-quality-gate.d.ts

@@ -0,0 +1,28 @@
+/**
+ * PR quality gate — automated pass/fail gate for PRs with
+ * configurable thresholds for auto-approval.
+ *
+ * All decisions are local — integrates via output format.
+ */
+interface GatePolicy {
+    maxCritical: number;
+    maxHigh: number;
+    maxTotal: number;
+    requireTestCoverage: boolean;
+    autoApproveBelow: number;
+}
+interface GateResult {
+    passed: boolean;
+    reason: string;
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+    total: number;
+    score: number;
+    policy: GatePolicy;
+    timestamp: string;
+}
+export declare function evaluateGate(critical: number, high: number, medium: number, low: number, score: number): GateResult;
+export declare function runPrQualityGate(argv: string[]): void;
+export {};