@kevinrabun/judges-cli 3.124.0

package/dist/commands/reg-watch.js

@@ -0,0 +1,219 @@
+/**
+ * Regulatory change monitor — track security standards versions
+ * and map coverage changes to the current rule set.
+ *
+ * Uses local versioned data files in .judges-reg-watch.json.
+ */
+import { readFileSync, writeFileSync, existsSync } from "fs";
+const REG_FILE = ".judges-reg-watch.json";
+// ─── Built-in standards ─────────────────────────────────────────────────────
+const STANDARDS = {
+    "owasp-top10": {
+        version: "2021",
+        items: [
+            { id: "A01", title: "Broken Access Control", rulePrefix: "AUTH" },
+            { id: "A02", title: "Cryptographic Failures", rulePrefix: "CRYPTO" },
+            { id: "A03", title: "Injection", rulePrefix: "INJECT" },
+            { id: "A04", title: "Insecure Design", rulePrefix: "SEC" },
+            { id: "A05", title: "Security Misconfiguration", rulePrefix: "SEC" },
+            { id: "A06", title: "Vulnerable Components", rulePrefix: "DEP" },
+            { id: "A07", title: "Authentication Failures", rulePrefix: "AUTH" },
+            { id: "A08", title: "Software Integrity Failures", rulePrefix: "SEC" },
+            { id: "A09", title: "Logging & Monitoring Failures", rulePrefix: "ERR" },
+            { id: "A10", title: "Server-Side Request Forgery", rulePrefix: "SSRF" },
+        ],
+    },
+    "cwe-top25": {
+        version: "2024",
+        items: [
+            { id: "CWE-787", title: "Out-of-bounds Write", rulePrefix: "MEM" },
+            { id: "CWE-79", title: "Cross-site Scripting (XSS)", rulePrefix: "INJECT" },
+            { id: "CWE-89", title: "SQL Injection", rulePrefix: "INJECT" },
+            { id: "CWE-416", title: "Use After Free", rulePrefix: "MEM" },
+            { id: "CWE-78", title: "OS Command Injection", rulePrefix: "INJECT" },
+            { id: "CWE-20", title: "Improper Input Validation", rulePrefix: "SEC" },
+            { id: "CWE-125", title: "Out-of-bounds Read", rulePrefix: "MEM" },
+            { id: "CWE-22", title: "Path Traversal", rulePrefix: "SEC" },
+            { id: "CWE-352", title: "Cross-Site Request Forgery", rulePrefix: "SEC" },
+            { id: "CWE-434", title: "Unrestricted Upload", rulePrefix: "SEC" },
+            { id: "CWE-862", title: "Missing Authorization", rulePrefix: "AUTH" },
+            { id: "CWE-476", title: "NULL Pointer Dereference", rulePrefix: "ERR" },
+            { id: "CWE-287", title: "Improper Authentication", rulePrefix: "AUTH" },
+            { id: "CWE-190", title: "Integer Overflow", rulePrefix: "SEC" },
+            { id: "CWE-502", title: "Deserialization of Untrusted Data", rulePrefix: "SEC" },
+            { id: "CWE-77", title: "Command Injection", rulePrefix: "INJECT" },
+            { id: "CWE-119", title: "Buffer Overflow", rulePrefix: "MEM" },
+            { id: "CWE-798", title: "Hardcoded Credentials", rulePrefix: "AUTH" },
+            { id: "CWE-918", title: "Server-Side Request Forgery", rulePrefix: "SSRF" },
+            { id: "CWE-306", title: "Missing Authentication", rulePrefix: "AUTH" },
+            { id: "CWE-362", title: "Race Condition", rulePrefix: "CONCUR" },
+            { id: "CWE-269", title: "Improper Privilege Management", rulePrefix: "AUTH" },
+            { id: "CWE-94", title: "Code Injection", rulePrefix: "INJECT" },
+            { id: "CWE-863", title: "Incorrect Authorization", rulePrefix: "AUTH" },
+            { id: "CWE-276", title: "Incorrect Default Permissions", rulePrefix: "SEC" },
+        ],
+    },
+    "nist-ssdf": {
+        version: "1.1",
+        items: [
+            { id: "PO.1", title: "Define Security Requirements", rulePrefix: "SEC" },
+            { id: "PS.1", title: "Protect Software", rulePrefix: "SEC" },
+            { id: "PS.2", title: "Protect Development Environment", rulePrefix: "SEC" },
+            { id: "PW.1", title: "Design for Security", rulePrefix: "SEC" },
+            { id: "PW.5", title: "Create Source Code with Security Practices", rulePrefix: "SEC" },
+            { id: "PW.6", title: "Configure the Build to Find Issues", rulePrefix: "SEC" },
+            { id: "PW.7", title: "Review and Audit Software", rulePrefix: "SEC" },
+            { id: "PW.8", title: "Test Executable Code", rulePrefix: "SEC" },
+            { id: "RV.1", title: "Identify and Confirm Vulnerabilities", rulePrefix: "SEC" },
+            { id: "RV.2", title: "Assess, Prioritize, and Remediate", rulePrefix: "SEC" },
+        ],
+    },
+};
+// ─── Core ───────────────────────────────────────────────────────────────────
+function loadDb() {
+    if (!existsSync(REG_FILE))
+        return { standards: [], lastUpdated: "" };
+    return JSON.parse(readFileSync(REG_FILE, "utf-8"));
+}
+function saveDb(db) {
+    writeFileSync(REG_FILE, JSON.stringify(db, null, 2));
+}
+function checkCoverage(standard) {
+    const std = STANDARDS[standard];
+    if (!std)
+        return null;
+    // Check which rules are covered via config
+    let config = {};
+    if (existsSync(".judgesrc")) {
+        try {
+            config = JSON.parse(readFileSync(".judgesrc", "utf-8"));
+        }
+        catch {
+            /* empty */
+        }
+    }
+    const disabledRules = new Set(config.disabledRules || []);
+    const _disabledJudges = new Set(config.disabledJudges || []);
+    const items = std.items.map((item) => {
+        // Check if the rule prefix is disabled
+        const isDisabled = [...disabledRules].some((r) => r.startsWith(item.rulePrefix));
+        const judgeMapped = !["MEM", "CONCUR", "SSRF", "DEP"].includes(item.rulePrefix);
+        const covered = judgeMapped && !isDisabled;
+        return {
+            id: item.id,
+            title: item.title,
+            covered,
+            coveredBy: covered ? `${item.rulePrefix}*` : undefined,
+        };
+    });
+    return {
+        standard,
+        version: std.version,
+        lastChecked: new Date().toISOString(),
+        items,
+    };
+}
+export function updateWatch(standards) {
+    const db = loadDb();
+    const results = [];
+    for (const std of standards) {
+        const result = checkCoverage(std);
+        if (result) {
+            db.standards = db.standards.filter((s) => s.standard !== std);
+            db.standards.push(result);
+            results.push(result);
+        }
+    }
+    db.lastUpdated = new Date().toISOString();
+    saveDb(db);
+    return results;
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runRegWatch(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges reg-watch — Regulatory change monitoring
+
+Usage:
+  judges reg-watch --standards owasp-top10,cwe-top25
+  judges reg-watch --check owasp-top10
+  judges reg-watch --list
+  judges reg-watch --status
+
+Options:
+  --standards <csv>    Check coverage for standards (comma-separated)
+  --check <name>       Check single standard coverage
+  --list               List available standards
+  --status             Show last check status
+  --format json        JSON output
+  --help, -h           Show this help
+
+Available standards:
+  owasp-top10   OWASP Top 10 (2021)
+  cwe-top25     CWE Top 25 (2024)
+  nist-ssdf     NIST SSDF v1.1
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    // List standards
+    if (argv.includes("--list")) {
+        if (format === "json") {
+            console.log(JSON.stringify(Object.entries(STANDARDS).map(([k, v]) => ({ name: k, version: v.version, items: v.items.length })), null, 2));
+        }
+        else {
+            console.log("\n  Available Standards\n  ───────────────────");
+            for (const [name, std] of Object.entries(STANDARDS)) {
+                console.log(`    ${name.padEnd(15)} v${std.version} (${std.items.length} items)`);
+            }
+            console.log("");
+        }
+        return;
+    }
+    // Check standards
+    const standardsStr = argv.find((_a, i) => argv[i - 1] === "--standards");
+    const singleCheck = argv.find((_a, i) => argv[i - 1] === "--check");
+    const toCheck = standardsStr ? standardsStr.split(",") : singleCheck ? [singleCheck] : [];
+    if (toCheck.length > 0) {
+        const results = updateWatch(toCheck);
+        for (const result of results) {
+            const covered = result.items.filter((i) => i.covered).length;
+            const total = result.items.length;
+            const pct = Math.round((covered / total) * 100);
+            if (format === "json") {
+                console.log(JSON.stringify(result, null, 2));
+            }
+            else {
+                console.log(`\n  ${result.standard} v${result.version} — Coverage: ${pct}% (${covered}/${total})\n  ──────────────────────────────────────`);
+                for (const item of result.items) {
+                    const icon = item.covered ? "✅" : "❌";
+                    console.log(`    ${icon} ${item.id.padEnd(10)} ${item.title.padEnd(40)} ${item.coveredBy || "NOT COVERED"}`);
+                }
+                console.log("");
+            }
+        }
+        return;
+    }
+    // Status
+    if (argv.includes("--status")) {
+        const db = loadDb();
+        if (db.standards.length === 0) {
+            console.log("\n  No standards monitored. Use --standards to start.\n");
+            return;
+        }
+        if (format === "json") {
+            console.log(JSON.stringify(db, null, 2));
+        }
+        else {
+            console.log(`\n  Regulatory Watch Status\n  ───────────────────────`);
+            console.log(`  Last updated: ${db.lastUpdated}`);
+            for (const s of db.standards) {
+                const covered = s.items.filter((i) => i.covered).length;
+                console.log(`    ${s.standard.padEnd(15)} v${s.version} — ${covered}/${s.items.length} covered (${s.lastChecked.split("T")[0]})`);
+            }
+            console.log("");
+        }
+        return;
+    }
+    console.log("  Use --standards or --check to monitor. --help for usage.");
+}

package/dist/commands/regression-alert.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Regression alerting — compare current scan results against a saved
+ * baseline snapshot to detect quality regressions.
+ *
+ * Snapshots are stored locally in .judges-baseline.json.
+ */
+import type { Finding } from "../types.js";
+export interface BaselineSnapshot {
+    timestamp: string;
+    gitCommit?: string;
+    gitBranch?: string;
+    totalFindings: number;
+    bySeverity: Record<string, number>;
+    byRule: Record<string, number>;
+    findingIds: string[];
+}
+export interface RegressionReport {
+    status: "improved" | "stable" | "regressed";
+    newFindings: string[];
+    fixedFindings: string[];
+    delta: number;
+    severityDelta: Record<string, number>;
+    ruleDelta: Record<string, number>;
+    baseline: BaselineSnapshot;
+    current: BaselineSnapshot;
+}
+export declare function buildSnapshot(findings: Finding[]): BaselineSnapshot;
+export declare function saveBaseline(snapshot: BaselineSnapshot, file?: string): void;
+export declare function loadBaseline(file?: string): BaselineSnapshot | null;
+export declare function compareSnapshots(baseline: BaselineSnapshot, current: BaselineSnapshot): RegressionReport;
+export declare function runRegressionAlert(argv: string[]): Promise<void>;

package/dist/commands/regression-alert.js

@@ -0,0 +1,215 @@
+/**
+ * Regression alerting — compare current scan results against a saved
+ * baseline snapshot to detect quality regressions.
+ *
+ * Snapshots are stored locally in .judges-baseline.json.
+ */
+import { readFileSync, writeFileSync, existsSync } from "fs";
+const BASELINE_FILE = ".judges-baseline.json";
+// ─── Helpers ────────────────────────────────────────────────────────────────
+function makeFindingId(f) {
+    return `${f.ruleId}::${f.title}`;
+}
+function getGitInfo() {
+    try {
+        const { execSync } = require("child_process");
+        const commit = execSync("git rev-parse --short HEAD", { encoding: "utf-8" }).trim();
+        const branch = execSync("git rev-parse --abbrev-ref HEAD", { encoding: "utf-8" }).trim();
+        return { commit, branch };
+    }
+    catch {
+        return {};
+    }
+}
+export function buildSnapshot(findings) {
+    const git = getGitInfo();
+    const bySeverity = {};
+    const byRule = {};
+    const findingIds = [];
+    for (const f of findings) {
+        bySeverity[f.severity] = (bySeverity[f.severity] || 0) + 1;
+        byRule[f.ruleId] = (byRule[f.ruleId] || 0) + 1;
+        findingIds.push(makeFindingId(f));
+    }
+    return {
+        timestamp: new Date().toISOString(),
+        gitCommit: git.commit,
+        gitBranch: git.branch,
+        totalFindings: findings.length,
+        bySeverity,
+        byRule,
+        findingIds,
+    };
+}
+export function saveBaseline(snapshot, file = BASELINE_FILE) {
+    writeFileSync(file, JSON.stringify(snapshot, null, 2));
+}
+export function loadBaseline(file = BASELINE_FILE) {
+    if (!existsSync(file))
+        return null;
+    return JSON.parse(readFileSync(file, "utf-8"));
+}
+export function compareSnapshots(baseline, current) {
+    const baseSet = new Set(baseline.findingIds);
+    const currSet = new Set(current.findingIds);
+    const newFindings = current.findingIds.filter((id) => !baseSet.has(id));
+    const fixedFindings = baseline.findingIds.filter((id) => !currSet.has(id));
+    const delta = current.totalFindings - baseline.totalFindings;
+    const severityDelta = {};
+    const allSeverities = new Set([...Object.keys(baseline.bySeverity), ...Object.keys(current.bySeverity)]);
+    for (const sev of allSeverities) {
+        severityDelta[sev] = (current.bySeverity[sev] || 0) - (baseline.bySeverity[sev] || 0);
+    }
+    const ruleDelta = {};
+    const allRules = new Set([...Object.keys(baseline.byRule), ...Object.keys(current.byRule)]);
+    for (const rule of allRules) {
+        const d = (current.byRule[rule] || 0) - (baseline.byRule[rule] || 0);
+        if (d !== 0)
+            ruleDelta[rule] = d;
+    }
+    let status = "stable";
+    if (delta > 0 || newFindings.length > 0)
+        status = "regressed";
+    else if (delta < 0 || fixedFindings.length > 0)
+        status = "improved";
+    return {
+        status,
+        newFindings,
+        fixedFindings,
+        delta,
+        severityDelta,
+        ruleDelta,
+        baseline,
+        current,
+    };
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export async function runRegressionAlert(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges regression-alert — Detect quality regressions between scans
+
+Usage:
+  judges regression-alert --save --input results.json     Save current results as baseline
+  judges regression-alert --check --input results.json    Compare current results against baseline
+  judges regression-alert --show                          Show current baseline
+
+Options:
+  --save                Save current results as the baseline
+  --check               Compare against saved baseline
+  --show                Display stored baseline info
+  --input <path>        Results JSON file
+  --fail-on-regression  Exit with code 1 if regressions detected (CI mode)
+  --threshold <n>       Only alert if >= n new findings (default: 1)
+  --format json         JSON output
+  --help, -h            Show this help
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const inputPath = argv.find((_a, i) => argv[i - 1] === "--input");
+    const failOnRegression = argv.includes("--fail-on-regression");
+    const thresholdStr = argv.find((_a, i) => argv[i - 1] === "--threshold");
+    const threshold = thresholdStr ? parseInt(thresholdStr, 10) : 1;
+    // Show baseline
+    if (argv.includes("--show")) {
+        const baseline = loadBaseline();
+        if (!baseline) {
+            console.log("\n  No baseline saved. Run with --save first.\n");
+            return;
+        }
+        if (format === "json") {
+            console.log(JSON.stringify(baseline, null, 2));
+        }
+        else {
+            console.log(`
+  Baseline Snapshot
+  ─────────────────
+  Saved:     ${baseline.timestamp}
+  Commit:    ${baseline.gitCommit || "unknown"}
+  Branch:    ${baseline.gitBranch || "unknown"}
+  Findings:  ${baseline.totalFindings}
+`);
+            for (const [sev, count] of Object.entries(baseline.bySeverity)) {
+                console.log(`    ${sev.padEnd(10)} ${count}`);
+            }
+            console.log("");
+        }
+        return;
+    }
+    // Both --save and --check need input
+    if (!inputPath) {
+        console.error("Error: --input <path> required");
+        process.exit(1);
+    }
+    if (!existsSync(inputPath)) {
+        console.error(`Error: file not found: ${inputPath}`);
+        process.exit(1);
+    }
+    const data = JSON.parse(readFileSync(inputPath, "utf-8"));
+    const findings = data.evaluations
+        ? data.evaluations.flatMap((e) => e.findings || [])
+        : data.findings || data;
+    const snapshot = buildSnapshot(findings);
+    // Save baseline
+    if (argv.includes("--save")) {
+        saveBaseline(snapshot);
+        if (format === "json") {
+            console.log(JSON.stringify(snapshot, null, 2));
+        }
+        else {
+            console.log(`\n  Baseline saved: ${snapshot.totalFindings} findings (${snapshot.gitCommit || "no git"})\n`);
+        }
+        return;
+    }
+    // Check against baseline
+    if (argv.includes("--check")) {
+        const baseline = loadBaseline();
+        if (!baseline) {
+            console.error("Error: No baseline saved. Run with --save first.");
+            process.exit(1);
+        }
+        const report = compareSnapshots(baseline, snapshot);
+        if (format === "json") {
+            console.log(JSON.stringify(report, null, 2));
+        }
+        else {
+            const icon = report.status === "improved" ? "✅" : report.status === "regressed" ? "🚨" : "➖";
+            console.log(`\n  ${icon} Status: ${report.status.toUpperCase()} (delta: ${report.delta >= 0 ? "+" : ""}${report.delta})`);
+            console.log(`  Baseline: ${baseline.totalFindings} findings (${baseline.gitCommit || "?"})`);
+            console.log(`  Current:  ${snapshot.totalFindings} findings (${snapshot.gitCommit || "?"})\n`);
+            if (report.newFindings.length > 0) {
+                console.log(`  New findings (${report.newFindings.length}):`);
+                for (const id of report.newFindings.slice(0, 20)) {
+                    console.log(`    + ${id}`);
+                }
+                if (report.newFindings.length > 20) {
+                    console.log(`    ... and ${report.newFindings.length - 20} more`);
+                }
+            }
+            if (report.fixedFindings.length > 0) {
+                console.log(`\n  Fixed findings (${report.fixedFindings.length}):`);
+                for (const id of report.fixedFindings.slice(0, 20)) {
+                    console.log(`    - ${id}`);
+                }
+                if (report.fixedFindings.length > 20) {
+                    console.log(`    ... and ${report.fixedFindings.length - 20} more`);
+                }
+            }
+            if (Object.keys(report.severityDelta).length > 0) {
+                console.log("\n  By severity:");
+                for (const [sev, d] of Object.entries(report.severityDelta)) {
+                    if (d !== 0)
+                        console.log(`    ${sev.padEnd(10)} ${d >= 0 ? "+" : ""}${d}`);
+                }
+            }
+            console.log("");
+        }
+        if (failOnRegression && report.newFindings.length >= threshold) {
+            console.error(`  ❌ Regression detected: ${report.newFindings.length} new finding(s) (threshold: ${threshold})`);
+            process.exit(1);
+        }
+        return;
+    }
+    console.log("Use --save, --check, or --show. See --help for details.");
+}

package/dist/commands/remediation-lib.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Remediation library — stores proven fixes as parameterized
+ * templates ranked by effectiveness. Auto-applies top-ranked
+ * templates to new instances of the same finding pattern.
+ *
+ * All data stored locally in `.judges-remediation/`.
+ */
+export declare function runRemediationLib(argv: string[]): void;