@kevinrabun/judges-cli 3.124.0

package/dist/commands/auto-detect.js

@@ -0,0 +1,328 @@
+// ─── Project Auto-Detection for Init Wizard ──────────────────────────────────
+// Detects project type, languages, and frameworks from file system signals,
+// then recommends appropriate presets and configuration for `judges init`.
+//
+// All detection functions are pure and testable — they operate on arrays of
+// file paths and/or package.json content, not direct filesystem access.
+// ──────────────────────────────────────────────────────────────────────────────
+import { PRESETS } from "../presets.js";
+// ─── Language & Framework Detection ─────────────────────────────────────────
+const LANG_INDICATORS = {
+    typescript: [".ts", ".tsx"],
+    javascript: [".js", ".jsx", ".mjs", ".cjs"],
+    python: [".py"],
+    rust: [".rs"],
+    go: [".go"],
+    java: [".java"],
+    csharp: [".cs"],
+    cpp: [".cpp", ".cc", ".cxx", ".h", ".hpp"],
+    ruby: [".rb"],
+    php: [".php"],
+    kotlin: [".kt", ".kts"],
+    swift: [".swift"],
+};
+const FRAMEWORK_FILES = {
+    react: ["src/App.tsx", "src/App.jsx", "src/app.tsx", "src/app.jsx"],
+    nextjs: ["next.config.js", "next.config.ts", "next.config.mjs"],
+    express: [], // detected from package.json
+    fastapi: [], // detected from requirements
+    django: ["manage.py"],
+    flask: [], // detected from requirements
+    angular: ["angular.json"],
+    vue: ["vue.config.js", "vue.config.ts"],
+    svelte: ["svelte.config.js", "svelte.config.ts"],
+    terraform: ["main.tf", "variables.tf"],
+    docker: ["Dockerfile", "docker-compose.yml", "docker-compose.yaml"],
+};
+const PKG_FRAMEWORK_MAP = {
+    express: "express",
+    fastify: "fastify",
+    koa: "koa",
+    hapi: "hapi",
+    nestjs: "@nestjs/core",
+    react: "react",
+    "react-native": "react-native",
+    vue: "vue",
+    angular: "@angular/core",
+    svelte: "svelte",
+    nextjs: "next",
+    nuxt: "nuxt",
+    gatsby: "gatsby",
+    electron: "electron",
+};
+const PY_FRAMEWORK_MAP = {
+    django: "django",
+    flask: "flask",
+    fastapi: "fastapi",
+    tornado: "tornado",
+    starlette: "starlette",
+    pyramid: "pyramid",
+};
+/**
+ * Detect primary languages from a list of file paths.
+ */
+export function detectLanguages(files) {
+    const counts = new Map();
+    for (const file of files) {
+        const lower = file.toLowerCase();
+        for (const [lang, exts] of Object.entries(LANG_INDICATORS)) {
+            if (exts.some((ext) => lower.endsWith(ext))) {
+                counts.set(lang, (counts.get(lang) ?? 0) + 1);
+            }
+        }
+    }
+    return [...counts.entries()].sort((a, b) => b[1] - a[1]).map(([lang]) => lang);
+}
+/**
+ * Detect frameworks from file paths and optional package.json dependencies.
+ */
+export function detectFrameworksFromFiles(files, packageJsonDeps, requirementsTxt) {
+    const found = new Set();
+    // Check file-based indicators
+    const fileSet = new Set(files.map((f) => f.replace(/\\/g, "/")));
+    for (const [framework, indicators] of Object.entries(FRAMEWORK_FILES)) {
+        if (indicators.length > 0 && indicators.some((ind) => fileSet.has(ind))) {
+            found.add(framework);
+        }
+    }
+    // Check package.json dependencies
+    if (packageJsonDeps) {
+        for (const [framework, pkg] of Object.entries(PKG_FRAMEWORK_MAP)) {
+            if (packageJsonDeps[pkg]) {
+                found.add(framework);
+            }
+        }
+    }
+    // Check Python requirements
+    if (requirementsTxt) {
+        const lower = requirementsTxt.toLowerCase();
+        for (const [framework, pkg] of Object.entries(PY_FRAMEWORK_MAP)) {
+            if (lower.includes(pkg)) {
+                found.add(framework);
+            }
+        }
+    }
+    // Docker detection from file names
+    if (files.some((f) => {
+        const base = f.replace(/\\/g, "/").split("/").pop() ?? "";
+        return base === "Dockerfile" || base.startsWith("docker-compose");
+    })) {
+        found.add("docker");
+    }
+    return [...found].sort();
+}
+/**
+ * Classify the project type from detected signals.
+ */
+export function classifyProjectType(languages, frameworks, files) {
+    const frameworkSet = new Set(frameworks);
+    const fileSet = new Set(files.map((f) => f.replace(/\\/g, "/").split("/").pop() ?? ""));
+    // Infrastructure
+    if (frameworkSet.has("terraform") || files.some((f) => f.endsWith(".tf") || f.endsWith(".bicep"))) {
+        return "infrastructure";
+    }
+    // Mobile
+    if (frameworkSet.has("react-native") ||
+        frameworkSet.has("flutter") ||
+        languages.includes("swift") ||
+        languages.includes("kotlin")) {
+        // Only mobile if no strong web signals
+        if (!frameworkSet.has("express") && !frameworkSet.has("fastapi") && !frameworkSet.has("django")) {
+            return "mobile";
+        }
+    }
+    // Data science
+    if (files.some((f) => f.endsWith(".ipynb")) ||
+        files.some((f) => f.endsWith(".py") && (f.includes("notebook") || f.includes("analysis")))) {
+        return "data-science";
+    }
+    const hasWebFrontend = frameworkSet.has("react") || frameworkSet.has("vue") || frameworkSet.has("angular") || frameworkSet.has("svelte");
+    const hasWebBackend = frameworkSet.has("express") ||
+        frameworkSet.has("fastify") ||
+        frameworkSet.has("koa") ||
+        frameworkSet.has("django") ||
+        frameworkSet.has("flask") ||
+        frameworkSet.has("fastapi") ||
+        frameworkSet.has("nestjs");
+    if (hasWebFrontend && hasWebBackend)
+        return "full-stack";
+    if (hasWebBackend)
+        return "web-api";
+    if (hasWebFrontend)
+        return "web-frontend";
+    // CLI tool
+    if (fileSet.has("cli.ts") ||
+        fileSet.has("cli.js") ||
+        fileSet.has("cli.py") ||
+        files.some((f) => f.includes("bin/") || f.includes("commands/"))) {
+        return "cli-tool";
+    }
+    // Library — has index/lib but no web framework
+    if (files.some((f) => f.includes("lib/") || f.includes("src/index."))) {
+        return "library";
+    }
+    return "unknown";
+}
+/**
+ * Detect CI configuration from file list.
+ */
+export function detectCI(files) {
+    return files.some((f) => {
+        const norm = f.replace(/\\/g, "/");
+        return (norm.includes(".github/workflows/") ||
+            norm.includes(".gitlab-ci") ||
+            norm.includes("azure-pipelines") ||
+            norm.includes("Jenkinsfile") ||
+            norm.includes(".circleci/"));
+    });
+}
+/**
+ * Detect monorepo structure from file list.
+ */
+export function detectMonorepo(files) {
+    return files.some((f) => {
+        const norm = f.replace(/\\/g, "/");
+        return (norm.includes("packages/") ||
+            norm.includes("apps/") ||
+            norm.includes("lerna.json") ||
+            norm.includes("pnpm-workspace.yaml") ||
+            norm.includes("turbo.json"));
+    });
+}
+/**
+ * Gather all project signals from detected data.
+ */
+export function detectProjectSignals(files, packageJsonDeps, requirementsTxt) {
+    const languages = detectLanguages(files);
+    const frameworks = detectFrameworksFromFiles(files, packageJsonDeps, requirementsTxt);
+    const projectType = classifyProjectType(languages, frameworks, files);
+    const hasCI = detectCI(files);
+    const hasDocker = frameworks.includes("docker");
+    const isMonorepo = detectMonorepo(files);
+    return { languages, frameworks, projectType, hasCI, hasDocker, isMonorepo };
+}
+// ─── Preset Recommendation ─────────────────────────────────────────────────
+/**
+ * Recommend a preset based on detected project signals.
+ */
+export function recommendPreset(signals) {
+    const suggestions = [];
+    // Infrastructure projects → strict + compliance
+    if (signals.projectType === "infrastructure") {
+        suggestions.push("Consider enabling the IaC security judge");
+        return {
+            preset: "strict",
+            reason: "Infrastructure-as-code projects benefit from thorough security and compliance review",
+            confidence: "high",
+            suggestions,
+        };
+    }
+    // Data science → lenient (exploratory code)
+    if (signals.projectType === "data-science") {
+        return {
+            preset: "lenient",
+            reason: "Data science projects typically prioritize exploratory flexibility over strict compliance",
+            confidence: "medium",
+            suggestions: ["Focus on security for any data pipeline code shipping to production"],
+        };
+    }
+    // Web API → security focus + strict
+    if (signals.projectType === "web-api") {
+        if (!signals.hasCI)
+            suggestions.push("Add CI integration to catch issues in PRs");
+        return {
+            preset: "security-only",
+            reason: "API services are externally accessible — security review is the highest priority",
+            confidence: "high",
+            suggestions,
+        };
+    }
+    // Full-stack → default (needs both security and quality)
+    if (signals.projectType === "full-stack") {
+        if (!signals.hasCI)
+            suggestions.push("Add CI integration for automated code review");
+        if (signals.isMonorepo)
+            suggestions.push("Consider per-package .judgesrc configs for large monorepos");
+        return {
+            preset: "strict",
+            reason: "Full-stack applications need comprehensive review across frontend and backend",
+            confidence: "high",
+            suggestions,
+        };
+    }
+    // Web frontend → lenient (less security surface)
+    if (signals.projectType === "web-frontend") {
+        return {
+            preset: "lenient",
+            reason: "Frontend projects have less direct security surface; focus on critical issues",
+            confidence: "medium",
+            suggestions: ["Enable the accessibility judge for public-facing applications"],
+        };
+    }
+    // CLI tool → default
+    if (signals.projectType === "cli-tool") {
+        return {
+            preset: "strict",
+            reason: "CLI tools benefit from comprehensive quality and security review",
+            confidence: "medium",
+            suggestions: [],
+        };
+    }
+    // Library → strict (shared code must be solid)
+    if (signals.projectType === "library") {
+        return {
+            preset: "strict",
+            reason: "Libraries are consumed by many projects — high quality standards are important",
+            confidence: "high",
+            suggestions: ["Enable backwards-compatibility judge to catch API breakage"],
+        };
+    }
+    // Default fallback
+    return {
+        preset: "strict",
+        reason: "General-purpose review covers all quality dimensions",
+        confidence: "low",
+        suggestions: ["Once your project is established, consider narrowing to a focused preset"],
+    };
+}
+/**
+ * Format project signals as a readable summary for the init wizard.
+ */
+export function formatProjectSummary(signals) {
+    const lines = [];
+    lines.push("  📦 Detected Project Signals:");
+    lines.push("  " + "─".repeat(50));
+    if (signals.languages.length > 0) {
+        lines.push(`    Languages   : ${signals.languages.join(", ")}`);
+    }
+    if (signals.frameworks.length > 0) {
+        lines.push(`    Frameworks  : ${signals.frameworks.join(", ")}`);
+    }
+    lines.push(`    Project type: ${signals.projectType}`);
+    lines.push(`    CI detected : ${signals.hasCI ? "yes" : "no"}`);
+    lines.push(`    Docker      : ${signals.hasDocker ? "yes" : "no"}`);
+    lines.push(`    Monorepo    : ${signals.isMonorepo ? "yes" : "no"}`);
+    lines.push("");
+    return lines.join("\n");
+}
+/**
+ * Format a preset recommendation for display.
+ */
+export function formatRecommendation(rec) {
+    const lines = [];
+    const preset = PRESETS[rec.preset];
+    const presetDesc = preset ? preset.description : "";
+    lines.push(`  💡 Recommended preset: "${rec.preset}" (confidence: ${rec.confidence})`);
+    if (presetDesc)
+        lines.push(`     ${presetDesc}`);
+    lines.push(`     Reason: ${rec.reason}`);
+    if (rec.suggestions.length > 0) {
+        lines.push("");
+        lines.push("  📌 Suggestions:");
+        for (const s of rec.suggestions) {
+            lines.push(`     • ${s}`);
+        }
+    }
+    lines.push("");
+    return lines.join("\n");
+}

package/dist/commands/auto-fix.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Auto-fix — generates safe, automated fix suggestions for
+ * common finding patterns. All processing is local.
+ */
+interface FixSuggestion {
+    ruleId: string;
+    title: string;
+    file: string;
+    line: number;
+    before: string;
+    after: string;
+    confidence: number;
+    timestamp: string;
+}
+export declare function suggestFix(ruleId: string, file: string, line: number): FixSuggestion | null;
+export declare function runAutoFix(argv: string[]): void;
+export {};

package/dist/commands/auto-fix.js

@@ -0,0 +1,240 @@
+/**
+ * Auto-fix — generates safe, automated fix suggestions for
+ * common finding patterns. All processing is local.
+ */
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
+import { join } from "path";
+const FIX_DIR = ".judges-auto-fix";
+const FIX_FILE = join(FIX_DIR, "fix-history.json");
+// ─── Fix template library ───────────────────────────────────────────────────
+const FIX_TEMPLATES = [
+    {
+        rulePattern: "SQL-",
+        title: "Use parameterized queries",
+        description: "Replace string concatenation in SQL with parameterized queries",
+        before: 'db.query("SELECT * FROM users WHERE id = " + userId)',
+        after: 'db.query("SELECT * FROM users WHERE id = $1", [userId])',
+        language: "typescript",
+    },
+    {
+        rulePattern: "XSS-",
+        title: "Use textContent instead of innerHTML",
+        description: "Replace innerHTML with textContent to prevent XSS",
+        before: "element.innerHTML = userInput",
+        after: "element.textContent = userInput",
+        language: "typescript",
+    },
+    {
+        rulePattern: "CMD-",
+        title: "Use execFile with argument array",
+        description: "Replace exec with execFile and separate arguments",
+        before: 'exec("git " + command)',
+        after: 'execFile("git", [command])',
+        language: "typescript",
+    },
+    {
+        rulePattern: "CRYPTO-",
+        title: "Replace MD5 with SHA-256",
+        description: "Use cryptographically secure hash function",
+        before: "crypto.createHash('md5').update(data).digest('hex')",
+        after: "crypto.createHash('sha256').update(data).digest('hex')",
+        language: "typescript",
+    },
+    {
+        rulePattern: "AUTH-",
+        title: "Add bcrypt password hashing",
+        description: "Hash passwords with bcrypt instead of plaintext storage",
+        before: "user.password = password",
+        after: "user.password = await bcrypt.hash(password, 12)",
+        language: "typescript",
+    },
+    {
+        rulePattern: "SEC-",
+        title: "Validate input before use",
+        description: "Add input validation before processing user data",
+        before: "const data = req.body",
+        after: "const data = validateInput(req.body, schema)",
+        language: "typescript",
+    },
+    {
+        rulePattern: "SSRF-",
+        title: "Validate URL against allowlist",
+        description: "Check URL against trusted domains before requesting",
+        before: "await fetch(userUrl)",
+        after: "if (isAllowedUrl(userUrl)) await fetch(userUrl)",
+        language: "typescript",
+    },
+    {
+        rulePattern: "PATH-",
+        title: "Sanitize file path",
+        description: "Resolve and validate file path within allowed directory",
+        before: 'readFileSync(userPath, "utf-8")',
+        after: 'readFileSync(path.resolve(SAFE_DIR, path.basename(userPath)), "utf-8")',
+        language: "typescript",
+    },
+    {
+        rulePattern: "ERR-",
+        title: "Use safe error response",
+        description: "Return generic error message instead of stack trace",
+        before: "res.status(500).json({ error: err.stack })",
+        after: 'res.status(500).json({ error: "Internal server error" })',
+        language: "typescript",
+    },
+    {
+        rulePattern: "CORS-",
+        title: "Restrict CORS origins",
+        description: "Replace wildcard CORS with specific trusted origins",
+        before: 'cors({ origin: "*" })',
+        after: 'cors({ origin: ["https://app.example.com"] })',
+        language: "typescript",
+    },
+];
+// ─── Core ───────────────────────────────────────────────────────────────────
+function ensureDir() {
+    if (!existsSync(FIX_DIR))
+        mkdirSync(FIX_DIR, { recursive: true });
+}
+function loadStore() {
+    if (!existsSync(FIX_FILE))
+        return { suggestions: [], applied: 0, updatedAt: new Date().toISOString() };
+    try {
+        return JSON.parse(readFileSync(FIX_FILE, "utf-8"));
+    }
+    catch {
+        return { suggestions: [], applied: 0, updatedAt: new Date().toISOString() };
+    }
+}
+function saveStore(store) {
+    ensureDir();
+    store.updatedAt = new Date().toISOString();
+    writeFileSync(FIX_FILE, JSON.stringify(store, null, 2));
+}
+export function suggestFix(ruleId, file, line) {
+    const template = FIX_TEMPLATES.find((t) => ruleId.startsWith(t.rulePattern));
+    if (!template)
+        return null;
+    const suggestion = {
+        ruleId,
+        title: template.title,
+        file,
+        line,
+        before: template.before,
+        after: template.after,
+        confidence: 75,
+        timestamp: new Date().toISOString(),
+    };
+    const store = loadStore();
+    store.suggestions.push(suggestion);
+    if (store.suggestions.length > 500)
+        store.suggestions = store.suggestions.slice(-500);
+    saveStore(store);
+    return suggestion;
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runAutoFix(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges auto-fix — Automated fix suggestions for findings
+
+Usage:
+  judges auto-fix --rule SQL-001 --file src/db.ts --line 42
+  judges auto-fix --catalog
+  judges auto-fix --history
+  judges auto-fix --stats
+
+Options:
+  --rule <id>             Rule ID to generate fix for
+  --file <path>           File containing the finding
+  --line <n>              Line number of the finding
+  --catalog               Show all available fix templates
+  --history               Show past fix suggestions
+  --stats                 Show fix statistics
+  --format json           JSON output
+  --help, -h              Show this help
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    // Catalog
+    if (argv.includes("--catalog")) {
+        if (format === "json") {
+            console.log(JSON.stringify(FIX_TEMPLATES, null, 2));
+        }
+        else {
+            console.log(`\n  Fix Template Catalog (${FIX_TEMPLATES.length})\n  ──────────────────────────`);
+            for (const t of FIX_TEMPLATES) {
+                console.log(`    [${t.rulePattern.padEnd(8)}] ${t.title}`);
+                console.log(`            Before: ${t.before}`);
+                console.log(`            After:  ${t.after}`);
+                console.log("");
+            }
+        }
+        return;
+    }
+    // History
+    if (argv.includes("--history")) {
+        const store = loadStore();
+        if (format === "json") {
+            console.log(JSON.stringify(store.suggestions.slice(-20), null, 2));
+        }
+        else {
+            console.log(`\n  Fix History (${store.suggestions.length} suggestions)\n  ──────────────────────────`);
+            for (const s of store.suggestions.slice(-15)) {
+                console.log(`    ${s.timestamp.slice(0, 16)}  ${s.ruleId.padEnd(10)} ${s.title}  ${s.file}:${s.line}`);
+            }
+            console.log("");
+        }
+        return;
+    }
+    // Stats
+    if (argv.includes("--stats")) {
+        const store = loadStore();
+        const byRule = new Map();
+        for (const s of store.suggestions) {
+            const prefix = s.ruleId.split("-")[0] + "-";
+            byRule.set(prefix, (byRule.get(prefix) || 0) + 1);
+        }
+        if (format === "json") {
+            console.log(JSON.stringify({ total: store.suggestions.length, applied: store.applied, byRule: Object.fromEntries(byRule) }, null, 2));
+        }
+        else {
+            console.log(`\n  Fix Statistics\n  ──────────────────────────`);
+            console.log(`  Total suggestions: ${store.suggestions.length}`);
+            console.log(`  Applied:           ${store.applied}`);
+            if (byRule.size > 0) {
+                console.log(`\n  By category:`);
+                for (const [rule, count] of byRule) {
+                    console.log(`    ${rule.padEnd(10)} ${count} suggestions`);
+                }
+            }
+            console.log("");
+        }
+        return;
+    }
+    // Suggest fix
+    const ruleId = argv.find((_a, i) => argv[i - 1] === "--rule");
+    const file = argv.find((_a, i) => argv[i - 1] === "--file");
+    const line = parseInt(argv.find((_a, i) => argv[i - 1] === "--line") || "1", 10);
+    if (!ruleId) {
+        console.error("  Use --rule <id>, --catalog, --history, or --stats. --help for usage.");
+        return;
+    }
+    const suggestion = suggestFix(ruleId, file || "unknown", line);
+    if (!suggestion) {
+        console.log(`  No fix template for rule: ${ruleId}`);
+        console.log(`  Available patterns: ${FIX_TEMPLATES.map((t) => t.rulePattern).join(", ")}`);
+        return;
+    }
+    if (format === "json") {
+        console.log(JSON.stringify(suggestion, null, 2));
+    }
+    else {
+        console.log(`\n  Fix Suggestion — ${suggestion.ruleId}`);
+        console.log(`  ──────────────────────────`);
+        console.log(`  Title: ${suggestion.title}`);
+        console.log(`  File:  ${suggestion.file}:${suggestion.line}`);
+        console.log(`\n  Before: ${suggestion.before}`);
+        console.log(`  After:  ${suggestion.after}`);
+        console.log(`\n  Confidence: ${suggestion.confidence}%\n`);
+    }
+}

package/dist/commands/auto-triage.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Confidence auto-triage — automatically suppress findings below
+ * a configurable confidence threshold, reducing noise for teams
+ * that want higher-signal reviews.
+ *
+ * Findings below the threshold are marked as "auto-suppressed"
+ * rather than removed, preserving auditability.
+ */
+import type { Finding } from "../types.js";
+export interface TriageConfig {
+    /** Minimum confidence to keep (0-1). Default: 0.7 */
+    minConfidence: number;
+    /** Per-severity overrides: e.g., { critical: 0.3, high: 0.5 } */
+    severityThresholds?: Record<string, number>;
+    /** Never suppress these rule IDs */
+    alwaysKeep?: string[];
+    /** Always suppress these rule IDs */
+    alwaysSuppress?: string[];
+}
+export interface TriageResult {
+    kept: Finding[];
+    suppressed: Finding[];
+    stats: {
+        total: number;
+        kept: number;
+        suppressed: number;
+        byReason: Record<string, number>;
+    };
+}
+export declare function autoTriage(findings: Finding[], config?: Partial<TriageConfig>): TriageResult;
+export declare function runAutoTriage(argv: string[]): void;