@kevinrabun/judges-cli 3.124.0

package/dist/commands/snippet-eval.js

@@ -0,0 +1,223 @@
+/**
+ * Snippet eval — evaluate a code snippet from stdin or a string
+ * argument without needing a file, with instant formatted output.
+ *
+ * Zero-friction entry point for evaluating AI-generated code snippets.
+ */
+import { readFileSync } from "fs";
+const SNIPPET_RULES = [
+    {
+        id: "SNIP-001",
+        title: "SQL injection risk",
+        pattern: /(?:SELECT|INSERT|UPDATE|DELETE).*\+\s*\w|`\$\{.*(?:SELECT|INSERT|UPDATE|DELETE)/i,
+        severity: "high",
+        recommendation: "Use parameterized queries",
+    },
+    {
+        id: "SNIP-002",
+        title: "XSS vulnerability",
+        pattern: /innerHTML|dangerouslySetInnerHTML|document\.write/i,
+        severity: "high",
+        recommendation: "Sanitize user input before DOM insertion",
+    },
+    {
+        id: "SNIP-003",
+        title: "Hardcoded secret",
+        pattern: /(?:password|secret|api.?key|token)\s*[:=]\s*['"][^'"]{8,}/i,
+        severity: "critical",
+        recommendation: "Use environment variables or secrets manager",
+    },
+    {
+        id: "SNIP-004",
+        title: "eval() usage",
+        pattern: /\beval\s*\(|new\s+Function\s*\(/i,
+        severity: "high",
+        recommendation: "Use safe expression parsers instead of eval",
+    },
+    {
+        id: "SNIP-005",
+        title: "Empty catch block",
+        pattern: /catch\s*\([^)]*\)\s*\{\s*\}/,
+        severity: "medium",
+        recommendation: "Log the error or re-throw it",
+    },
+    {
+        id: "SNIP-006",
+        title: "Console.log in production code",
+        pattern: /console\.(log|debug)\s*\(/,
+        severity: "low",
+        recommendation: "Use a proper logging framework",
+    },
+    {
+        id: "SNIP-007",
+        title: "Insecure HTTP",
+        pattern: /['"]http:\/\/(?!localhost|127\.0\.0\.1)/i,
+        severity: "medium",
+        recommendation: "Use HTTPS for all external connections",
+    },
+    {
+        id: "SNIP-008",
+        title: "Weak crypto",
+        pattern: /Math\.random\s*\(\)|createHash\s*\(\s*['"]md5['"]\)/i,
+        severity: "high",
+        recommendation: "Use crypto.randomUUID() or SHA-256+",
+    },
+    {
+        id: "SNIP-009",
+        title: "Command injection risk",
+        pattern: /execSync\s*\(.*\+|spawn\s*\(.*\$\{/i,
+        severity: "critical",
+        recommendation: "Validate/sanitize inputs, use array args with spawn",
+    },
+    {
+        id: "SNIP-010",
+        title: "Permissive CORS",
+        pattern: /cors\(\s*\)|Allow-Origin.*\*/i,
+        severity: "medium",
+        recommendation: "Specify allowed origins explicitly",
+    },
+    {
+        id: "SNIP-011",
+        title: "Missing error handling",
+        pattern: /\.then\s*\([^)]*\)\s*(?!\.catch)/i,
+        severity: "medium",
+        recommendation: "Add .catch() or use async/await with try/catch",
+    },
+    {
+        id: "SNIP-012",
+        title: "SELECT * usage",
+        pattern: /SELECT\s+\*\s+FROM/i,
+        severity: "low",
+        recommendation: "Select only needed columns",
+    },
+];
+function scanSnippet(code, _lang) {
+    const findings = [];
+    const lines = code.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        for (const rule of SNIPPET_RULES) {
+            if (rule.pattern.test(lines[i])) {
+                if (!findings.some((f) => f.ruleId === rule.id && Math.abs(f.line - (i + 1)) < 3)) {
+                    findings.push({
+                        ruleId: rule.id,
+                        title: rule.title,
+                        severity: rule.severity,
+                        line: i + 1,
+                        recommendation: rule.recommendation,
+                    });
+                }
+            }
+        }
+    }
+    return findings;
+}
+// ─── Language Detection ────────────────────────────────────────────────────
+function detectLanguage(code) {
+    if (/\bimport\s+\{.*\}\s+from\s+['"]|:\s*(string|number|boolean|void)\b|interface\s+\w+/.test(code))
+        return "typescript";
+    if (/\bdef\s+\w+\s*\(|import\s+\w+\s*$|from\s+\w+\s+import/m.test(code))
+        return "python";
+    if (/\bfunc\s+\w+\s*\(|package\s+\w+|:=\s*/.test(code))
+        return "go";
+    if (/\bfn\s+\w+\s*\(|let\s+mut\s|impl\s+\w+/.test(code))
+        return "rust";
+    if (/\bpublic\s+class\s|System\.out\.|@Override/.test(code))
+        return "java";
+    if (/\bnamespace\s+\w+|using\s+System|public\s+async\s+Task/.test(code))
+        return "csharp";
+    if (/\bfunction\s+\w+|const\s+\w+\s*=|require\s*\(/.test(code))
+        return "javascript";
+    return "unknown";
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runSnippetEval(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges snippet-eval — Evaluate code snippets instantly
+
+Usage:
+  echo "const key = '12345'" | judges snippet-eval
+  judges snippet-eval --code "eval(userInput)"
+  judges snippet-eval --code "SELECT * FROM users WHERE id=" --lang sql
+  judges snippet-eval --demo
+
+Options:
+  --code <snippet>      Code snippet to evaluate (or pipe via stdin)
+  --lang <language>     Language hint (auto-detected if omitted)
+  --demo                Run with demo vulnerable code
+  --format json         JSON output
+  --help, -h            Show this help
+
+Zero-friction evaluation — no project setup needed.
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const codeArg = argv.find((_a, i) => argv[i - 1] === "--code") || "";
+    const langArg = argv.find((_a, i) => argv[i - 1] === "--lang") || "";
+    const isDemo = argv.includes("--demo");
+    let code;
+    if (isDemo) {
+        code = `// AI-generated API handler
+const query = "SELECT * FROM users WHERE id=" + req.params.id;
+const apiKey = "sk-proj-1234567890abcdef1234567890";
+document.innerHTML = userInput;
+try { await riskyOperation(); } catch (e) {}
+console.log("Debug: user token = " + token);
+fetch("http://api.example.com/data");
+const sessionId = Math.random().toString(36);`;
+    }
+    else if (codeArg) {
+        code = codeArg;
+    }
+    else {
+        // Try reading from stdin
+        try {
+            code = readFileSync(0, "utf-8");
+        }
+        catch {
+            console.error("  Provide code via --code, --demo, or pipe to stdin");
+            return;
+        }
+    }
+    if (!code.trim()) {
+        console.error("  No code provided");
+        return;
+    }
+    const lang = langArg || detectLanguage(code);
+    const findings = scanSnippet(code, lang);
+    // Determine verdict
+    const hasCritical = findings.some((f) => f.severity === "critical");
+    const hasHigh = findings.some((f) => f.severity === "high");
+    const verdict = hasCritical || findings.length > 5
+        ? "FAIL"
+        : hasHigh || findings.length > 2
+            ? "WARN"
+            : findings.length === 0
+                ? "SAFE"
+                : "WARN";
+    if (format === "json") {
+        console.log(JSON.stringify({
+            verdict,
+            language: lang,
+            findings,
+            lines: code.split("\n").length,
+            timestamp: new Date().toISOString(),
+        }, null, 2));
+    }
+    else {
+        const badge = verdict === "SAFE" ? "✅ SAFE" : verdict === "WARN" ? "⚠️  WARN" : "❌ FAIL";
+        console.log(`\n  Snippet Eval: ${badge}  (${lang}, ${code.split("\n").length} lines)\n  ──────────────────────────`);
+        if (findings.length === 0) {
+            console.log("  No issues detected in snippet.");
+        }
+        else {
+            for (const f of findings) {
+                const icon = f.severity === "critical" ? "🔴" : f.severity === "high" ? "🟠" : f.severity === "medium" ? "🟡" : "⚪";
+                console.log(`    ${icon} L${f.line} [${f.severity}] ${f.ruleId}: ${f.title}`);
+                console.log(`        💡 ${f.recommendation}`);
+            }
+        }
+        console.log(`\n    ${findings.length} finding(s) | Verdict: ${verdict}\n`);
+    }
+}

package/dist/commands/spec-conform.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Spec conform — check code conformance to project conventions and style patterns.
+ */
+export declare function runSpecConform(argv: string[]): void;

package/dist/commands/spec-conform.js

@@ -0,0 +1,304 @@
+/**
+ * Spec conform — check code conformance to project conventions and style patterns.
+ */
+import { readFileSync, readdirSync, statSync } from "fs";
+import { join, extname, basename } from "path";
+// ─── File Collection ────────────────────────────────────────────────────────
+const CODE_EXTS = new Set([".ts", ".tsx", ".js", ".jsx"]);
+function collectFiles(dir, max = 300) {
+    const files = [];
+    function walk(d) {
+        if (files.length >= max)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(d);
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (files.length >= max)
+                return;
+            if (e.startsWith(".") || e === "node_modules" || e === "dist" || e === "build")
+                continue;
+            const full = join(d, e);
+            try {
+                if (statSync(full).isDirectory())
+                    walk(full);
+                else if (CODE_EXTS.has(extname(full)))
+                    files.push(full);
+            }
+            catch {
+                /* skip */
+            }
+        }
+    }
+    walk(dir);
+    return files;
+}
+function detectConventions(dir, files) {
+    const conv = {
+        useSemicolons: null,
+        quoteStyle: null,
+        indentStyle: null,
+        indentSize: null,
+        namingStyle: null,
+        hasEslint: false,
+        hasPrettier: false,
+        hasEditorConfig: false,
+        fileNamingPattern: null,
+    };
+    // Check for config files
+    try {
+        const entries = readdirSync(dir);
+        conv.hasEslint = entries.some((e) => /^\.?eslint/.test(e));
+        conv.hasPrettier = entries.some((e) => /^\.?prettier/.test(e));
+        conv.hasEditorConfig = entries.includes(".editorconfig");
+    }
+    catch {
+        /* skip */
+    }
+    // Analyze existing file conventions from first 20 files
+    let semiCount = 0;
+    let noSemiCount = 0;
+    let singleQuote = 0;
+    let doubleQuote = 0;
+    let tabIndent = 0;
+    let spaceIndent = 0;
+    const indentSizes = [];
+    let camelCount = 0;
+    let snakeCount = 0;
+    const sampleFiles = files.slice(0, 20);
+    for (const filepath of sampleFiles) {
+        let content;
+        try {
+            content = readFileSync(filepath, "utf-8");
+        }
+        catch {
+            continue;
+        }
+        const fileLines = content.split("\n");
+        for (const line of fileLines.slice(0, 50)) {
+            // Semicolons
+            if (/;\s*$/.test(line.trim()) && !/\/\/|\/\*|\*/.test(line.trim().slice(0, 2)))
+                semiCount++;
+            if (/[^;{}\s]\s*$/.test(line.trim()) && line.trim().length > 5 && !/\/\/|\/\*|\*|=>/.test(line.trim()))
+                noSemiCount++;
+            // Quotes
+            const singles = (line.match(/'/g) || []).length;
+            const doubles = (line.match(/"/g) || []).length;
+            singleQuote += singles;
+            doubleQuote += doubles;
+            // Indentation
+            const indent = line.match(/^(\s+)/);
+            if (indent) {
+                if (indent[1].includes("\t"))
+                    tabIndent++;
+                else {
+                    spaceIndent++;
+                    indentSizes.push(indent[1].length);
+                }
+            }
+        }
+        // Variable naming
+        const varDecls = content.match(/(?:const|let|var)\s+([a-z]\w+)/g) || [];
+        for (const decl of varDecls) {
+            const name = decl.split(/\s+/)[1];
+            if (name.includes("_"))
+                snakeCount++;
+            else
+                camelCount++;
+        }
+    }
+    conv.useSemicolons = semiCount > noSemiCount * 2 ? true : noSemiCount > semiCount * 2 ? false : null;
+    conv.quoteStyle = singleQuote > doubleQuote * 1.5 ? "single" : doubleQuote > singleQuote * 1.5 ? "double" : null;
+    conv.indentStyle = tabIndent > spaceIndent ? "tabs" : spaceIndent > tabIndent ? "spaces" : null;
+    if (indentSizes.length > 0) {
+        const mode = indentSizes.sort((a, b) => a - b)[Math.floor(indentSizes.length / 2)];
+        conv.indentSize = mode <= 4 ? mode : null;
+    }
+    conv.namingStyle = camelCount > snakeCount * 2 ? "camelCase" : snakeCount > camelCount * 2 ? "snake_case" : null;
+    // File naming pattern
+    const fileNames = files.map((f) => basename(f, extname(f)));
+    const kebab = fileNames.filter((n) => /^[a-z][a-z0-9-]*$/.test(n)).length;
+    const camel = fileNames.filter((n) => /^[a-z][a-zA-Z0-9]*$/.test(n) && /[A-Z]/.test(n)).length;
+    const pascal = fileNames.filter((n) => /^[A-Z][a-zA-Z0-9]*$/.test(n)).length;
+    const snake = fileNames.filter((n) => /^[a-z][a-z0-9_]*$/.test(n) && n.includes("_")).length;
+    const counts = [
+        { style: "kebab-case", count: kebab },
+        { style: "camelCase", count: camel },
+        { style: "PascalCase", count: pascal },
+        { style: "snake_case", count: snake },
+    ].sort((a, b) => b.count - a.count);
+    if (counts[0].count > files.length * 0.5)
+        conv.fileNamingPattern = counts[0].style;
+    return conv;
+}
+// ─── Analysis ───────────────────────────────────────────────────────────────
+function analyzeFile(filepath, conv) {
+    const issues = [];
+    let content;
+    try {
+        content = readFileSync(filepath, "utf-8");
+    }
+    catch {
+        return issues;
+    }
+    const lines = content.split("\n");
+    const fname = basename(filepath, extname(filepath));
+    // File naming convention
+    if (conv.fileNamingPattern === "kebab-case" && !/^[a-z][a-z0-9.-]*$/.test(fname) && !fname.startsWith("_")) {
+        issues.push({
+            file: filepath,
+            line: 1,
+            issue: "File name breaks project convention",
+            severity: "low",
+            detail: `Project uses kebab-case filenames but this file is named \`${fname}\``,
+        });
+    }
+    if (conv.fileNamingPattern === "PascalCase" && !/^[A-Z]/.test(fname)) {
+        issues.push({
+            file: filepath,
+            line: 1,
+            issue: "File name breaks project convention",
+            severity: "low",
+            detail: `Project uses PascalCase filenames but this file is named \`${fname}\``,
+        });
+    }
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const trimmed = line.trim();
+        // Semicolon consistency
+        if (conv.useSemicolons === true && /[a-zA-Z0-9)\]'"]\s*$/.test(trimmed) && trimmed.length > 10) {
+            if (!/^\s*(?:\/\/|\/\*|\*|import|export|if|else|for|while|do|switch|try|catch|finally|class|interface|type|enum|function|=>|\{|\}|\(|\)|,)/.test(trimmed)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "Missing semicolon (project uses semicolons)",
+                    severity: "low",
+                    detail: "Line ends without semicolon — inconsistent with project style",
+                });
+            }
+        }
+        // Quote style consistency
+        if (conv.quoteStyle === "single" && /"[^"]*"/.test(trimmed) && !/import\s/.test(trimmed)) {
+            if (!trimmed.includes("'") && !trimmed.includes("`") && !/console\.|require|JSON/.test(trimmed)) {
+                // Only flag if it's clearly a string, not a JSON key or HTML attribute
+                const dqCount = (trimmed.match(/"/g) || []).length;
+                if (dqCount === 2) {
+                    issues.push({
+                        file: filepath,
+                        line: i + 1,
+                        issue: "Double quotes (project uses single)",
+                        severity: "low",
+                        detail: "Project convention is single quotes — AI generated double-quoted string",
+                    });
+                }
+            }
+        }
+        // Variable naming convention
+        if (conv.namingStyle === "camelCase") {
+            const snakeMatch = trimmed.match(/(?:const|let|var)\s+([a-z]+_[a-z_]+)/);
+            if (snakeMatch) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "snake_case variable in camelCase project",
+                    severity: "medium",
+                    detail: `\`${snakeMatch[1]}\` uses snake_case — project convention is camelCase`,
+                });
+            }
+        }
+        if (conv.namingStyle === "snake_case") {
+            const camelMatch = trimmed.match(/(?:const|let|var)\s+([a-z]+[A-Z]\w+)/);
+            if (camelMatch) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "camelCase variable in snake_case project",
+                    severity: "medium",
+                    detail: `\`${camelMatch[1]}\` uses camelCase — project convention is snake_case`,
+                });
+            }
+        }
+        // Mixed indentation
+        if (conv.indentStyle === "spaces" && /^\t/.test(line)) {
+            issues.push({
+                file: filepath,
+                line: i + 1,
+                issue: "Tab indentation in spaces-only project",
+                severity: "low",
+                detail: "Project uses spaces for indentation — AI generated tab-indented code",
+            });
+        }
+        if (conv.indentStyle === "tabs" && /^ {2,}/.test(line) && !/^\s*\*/.test(line)) {
+            issues.push({
+                file: filepath,
+                line: i + 1,
+                issue: "Space indentation in tabs-only project",
+                severity: "low",
+                detail: "Project uses tabs for indentation — AI generated space-indented code",
+            });
+        }
+    }
+    return issues;
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runSpecConform(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges spec-conform — Check code conformance to project conventions
+
+Usage:
+  judges spec-conform [dir]
+  judges spec-conform src/ --format json
+
+Options:
+  [dir]                 Directory to scan (default: .)
+  --format json         JSON output
+  --help, -h            Show this help
+
+Auto-detects: semicolon usage, quote style, indentation, variable naming, file naming.
+Flags AI-generated code that breaks detected project conventions.
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const dir = argv.find((a) => !a.startsWith("-") && argv.indexOf(a) > 0) || ".";
+    const files = collectFiles(dir);
+    const conv = detectConventions(dir, files);
+    const allIssues = [];
+    for (const f of files)
+        allIssues.push(...analyzeFile(f, conv));
+    const highCount = allIssues.filter((i) => i.severity === "high").length;
+    const medCount = allIssues.filter((i) => i.severity === "medium").length;
+    const score = Math.max(0, 100 - highCount * 10 - medCount * 4 - allIssues.filter((i) => i.severity === "low").length);
+    if (format === "json") {
+        console.log(JSON.stringify({
+            conventions: conv,
+            issues: allIssues,
+            score,
+            summary: { high: highCount, medium: medCount, total: allIssues.length },
+            timestamp: new Date().toISOString(),
+        }, null, 2));
+    }
+    else {
+        const badge = score >= 80 ? "✅ CONFORMING" : score >= 50 ? "⚠️  DRIFTING" : "❌ NONCONFORMING";
+        console.log(`\n  Spec Conform: ${badge} (${score}/100)\n  ─────────────────────────────`);
+        console.log(`    Detected: semis=${conv.useSemicolons ?? "?"} quotes=${conv.quoteStyle ?? "?"} indent=${conv.indentStyle ?? "?"}(${conv.indentSize ?? "?"}) naming=${conv.namingStyle ?? "?"} files=${conv.fileNamingPattern ?? "?"}`);
+        if (allIssues.length === 0) {
+            console.log("    No convention violations detected.\n");
+            return;
+        }
+        for (const issue of allIssues.slice(0, 25)) {
+            const icon = issue.severity === "high" ? "🔴" : issue.severity === "medium" ? "🟡" : "🔵";
+            console.log(`    ${icon} ${issue.issue}`);
+            console.log(`        ${issue.file}:${issue.line}`);
+            console.log(`        ${issue.detail}`);
+        }
+        if (allIssues.length > 25)
+            console.log(`    ... and ${allIssues.length - 25} more`);
+        console.log(`\n    Total: ${allIssues.length} | High: ${highCount} | Medium: ${medCount} | Score: ${score}/100\n`);
+    }
+}

package/dist/commands/stale-pattern.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Stale-pattern — identify outdated idioms when modern alternatives exist.
+ */
+export declare function runStalePattern(argv: string[]): void;