@kevinrabun/judges-cli 3.124.0

package/dist/commands/auto-triage.js

@@ -0,0 +1,125 @@
+/**
+ * Confidence auto-triage — automatically suppress findings below
+ * a configurable confidence threshold, reducing noise for teams
+ * that want higher-signal reviews.
+ *
+ * Findings below the threshold are marked as "auto-suppressed"
+ * rather than removed, preserving auditability.
+ */
+// ─── Triage Logic ───────────────────────────────────────────────────────────
+const DEFAULT_THRESHOLD = 0.7;
+export function autoTriage(findings, config = {}) {
+    const minConfidence = config.minConfidence ?? DEFAULT_THRESHOLD;
+    const severityThresholds = config.severityThresholds || {};
+    const alwaysKeep = new Set(config.alwaysKeep || []);
+    const alwaysSuppress = new Set(config.alwaysSuppress || []);
+    const kept = [];
+    const suppressed = [];
+    const byReason = {};
+    for (const f of findings) {
+        // Always-keep rules bypass all thresholds
+        if (alwaysKeep.has(f.ruleId)) {
+            kept.push(f);
+            continue;
+        }
+        // Always-suppress rules
+        if (alwaysSuppress.has(f.ruleId)) {
+            suppressed.push(f);
+            byReason["always-suppress"] = (byReason["always-suppress"] || 0) + 1;
+            continue;
+        }
+        // Determine threshold for this finding
+        const threshold = severityThresholds[f.severity] ?? minConfidence;
+        const confidence = f.confidence ?? 1.0;
+        if (confidence < threshold) {
+            suppressed.push(f);
+            byReason["below-threshold"] = (byReason["below-threshold"] || 0) + 1;
+        }
+        else {
+            kept.push(f);
+        }
+    }
+    return {
+        kept,
+        suppressed,
+        stats: {
+            total: findings.length,
+            kept: kept.length,
+            suppressed: suppressed.length,
+            byReason,
+        },
+    };
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runAutoTriage(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges auto-triage — Automatically suppress low-confidence findings
+
+Usage:
+  judges auto-triage --input results.json                  Triage with default threshold (0.7)
+  judges auto-triage --input results.json --threshold 0.5  Custom threshold
+  judges auto-triage --input results.json --keep SEC-001   Always keep specific rules
+
+Options:
+  --input <path>          JSON results file (required)
+  --threshold <0-1>       Minimum confidence to keep (default: 0.7)
+  --keep <rules>          Comma-separated rules to always keep
+  --suppress <rules>      Comma-separated rules to always suppress
+  --format json           JSON output
+  --help, -h              Show this help
+
+Findings below the confidence threshold are marked as suppressed
+rather than removed, preserving audit trail.
+`);
+        return;
+    }
+    const { readFileSync, existsSync } = require("fs");
+    const inputPath = argv.find((_a, i) => argv[i - 1] === "--input");
+    if (!inputPath || !existsSync(inputPath)) {
+        console.error("Error: --input <path> required");
+        process.exit(1);
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const thresholdStr = argv.find((_a, i) => argv[i - 1] === "--threshold");
+    const keepStr = argv.find((_a, i) => argv[i - 1] === "--keep");
+    const suppressStr = argv.find((_a, i) => argv[i - 1] === "--suppress");
+    const data = JSON.parse(readFileSync(inputPath, "utf-8"));
+    const findings = data.evaluations
+        ? data.evaluations.flatMap((e) => e.findings || [])
+        : data.findings || data;
+    const config = {};
+    if (thresholdStr)
+        config.minConfidence = parseFloat(thresholdStr);
+    if (keepStr)
+        config.alwaysKeep = keepStr.split(",").map((s) => s.trim());
+    if (suppressStr)
+        config.alwaysSuppress = suppressStr.split(",").map((s) => s.trim());
+    const result = autoTriage(findings, config);
+    if (format === "json") {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    console.log(`\n  Auto-Triage Results\n`);
+    console.log(`  Total:      ${result.stats.total}`);
+    console.log(`  Kept:       ${result.stats.kept}`);
+    console.log(`  Suppressed: ${result.stats.suppressed}\n`);
+    if (Object.keys(result.stats.byReason).length > 0) {
+        console.log(`  By reason:`);
+        for (const [reason, count] of Object.entries(result.stats.byReason)) {
+            console.log(`    ${reason}: ${count}`);
+        }
+        console.log("");
+    }
+    if (result.kept.length > 0) {
+        console.log(`  Kept findings:`);
+        for (const f of result.kept.slice(0, 20)) {
+            const conf = f.confidence;
+            const confStr = conf !== undefined ? ` (${(conf * 100).toFixed(0)}%)` : "";
+            console.log(`    ${f.severity.padEnd(8)} ${f.ruleId}: ${f.title.slice(0, 70)}${confStr}`);
+        }
+        if (result.kept.length > 20)
+            console.log(`    ... and ${result.kept.length - 20} more`);
+        console.log("");
+    }
+}

package/dist/commands/baseline.d.ts

@@ -0,0 +1,47 @@
+export declare function computeFindingFingerprint(ruleId: string, title: string, sourceCode: string, lineNumber: number, contextRadius?: number): string;
+/** V2 baseline finding stored per-file */
+export interface BaselineFinding {
+    ruleId: string;
+    title: string;
+    fingerprint: string;
+    severity: string;
+    lineNumbers: number[];
+    status: "active" | "resolved";
+}
+/** V2 baseline format — project-wide, fingerprint-based matching */
+export interface BaselineV2 {
+    version: 2;
+    createdAt: string;
+    updatedAt: string;
+    files: Record<string, BaselineFinding[]>;
+    totalFindings: number;
+    resolvedFindings: number;
+}
+/** Loaded baseline ready for matching */
+export interface LoadedBaseline {
+    version: number;
+    /** v1 legacy keys: ruleId::line::title */
+    keys: Set<string>;
+    /** v2 fingerprints */
+    fingerprints: Set<string>;
+    /** v2 per-file fingerprint map for faster lookups */
+    fileFingerprints: Map<string, Set<string>>;
+}
+/**
+ * Load a baseline file (v1 or v2) into a unified lookup structure.
+ */
+export declare function loadBaselineData(baselinePath: string): LoadedBaseline;
+/**
+ * Check whether a finding is suppressed by the loaded baseline.
+ *
+ * For v1 baselines, uses exact ruleId::line::title matching.
+ * For v2 baselines, uses fingerprint matching against source code context.
+ *
+ * @param filePath - Relative path of the file being evaluated (for v2 per-file lookup)
+ */
+export declare function isBaselined(finding: {
+    ruleId: string;
+    title: string;
+    lineNumbers?: number[];
+}, baseline: LoadedBaseline, sourceCode: string, filePath?: string): boolean;
+export declare function runBaseline(argv: string[]): void;

package/dist/commands/baseline.js

@@ -0,0 +1,353 @@
+// ─── Baseline Command ────────────────────────────────────────────────────────
+// Create and update baseline files for suppressing known findings.
+//
+// Usage:
+//   judges baseline create --file src/app.ts          # baseline one file
+//   judges baseline create --dir .                    # baseline entire project
+//   judges baseline update --dir .                    # re-scan & merge
+//   judges baseline create --file src/app.ts -o .judges-baseline.json
+// ──────────────────────────────────────────────────────────────────────────────
+import { createHash } from "crypto";
+import { readFileSync, writeFileSync, existsSync } from "fs";
+import { resolve, relative } from "path";
+import { evaluateWithTribunal } from "../evaluators/index.js";
+import { collectFiles } from "../cli.js";
+import { detectLanguageFromPath as detectLanguage } from "../ext-to-lang.js";
+// ─── Fingerprinting ────────────────────────────────────────────────────────
+// Hash ruleId + title + normalized surrounding source context so that findings
+// survive line-number shifts caused by unrelated edits.
+const DEFAULT_CONTEXT_RADIUS = 3;
+export function computeFindingFingerprint(ruleId, title, sourceCode, lineNumber, contextRadius = DEFAULT_CONTEXT_RADIUS) {
+    const lines = sourceCode.split("\n");
+    const startIdx = Math.max(0, lineNumber - 1 - contextRadius);
+    const endIdx = Math.min(lines.length, lineNumber + contextRadius);
+    const contextSlice = lines
+        .slice(startIdx, endIdx)
+        .map((l) => l.trim())
+        .filter((l) => l.length > 0)
+        .join("\n");
+    const raw = `${ruleId}::${title}::${contextSlice}`;
+    return createHash("sha256").update(raw).digest("hex").slice(0, 16);
+}
+// ─── Load / Match Baseline ──────────────────────────────────────────────────
+/** Build a legacy v1 key (ruleId::firstLine::title) */
+function v1Key(f) {
+    const line = f.lineNumbers?.[0] ?? 0;
+    return `${f.ruleId}::${line}::${f.title}`;
+}
+/**
+ * Load a baseline file (v1 or v2) into a unified lookup structure.
+ */
+export function loadBaselineData(baselinePath) {
+    const abs = resolve(baselinePath);
+    if (!existsSync(abs)) {
+        return { version: 0, keys: new Set(), fingerprints: new Set(), fileFingerprints: new Map() };
+    }
+    try {
+        const raw = readFileSync(abs, "utf-8");
+        const data = JSON.parse(raw);
+        if (data.version === 2) {
+            const fingerprints = new Set();
+            const fileFingerprints = new Map();
+            for (const [filePath, findings] of Object.entries(data.files || {})) {
+                const set = new Set();
+                for (const f of findings) {
+                    if (f.status === "active") {
+                        fingerprints.add(f.fingerprint);
+                        set.add(f.fingerprint);
+                    }
+                }
+                fileFingerprints.set(filePath, set);
+            }
+            return { version: 2, keys: new Set(), fingerprints, fileFingerprints };
+        }
+        // V1 fallback
+        const keys = new Set();
+        if (Array.isArray(data.findings)) {
+            for (const f of data.findings) {
+                keys.add(v1Key(f));
+            }
+        }
+        return { version: 1, keys, fingerprints: new Set(), fileFingerprints: new Map() };
+    }
+    catch {
+        console.error(`Warning: Could not parse baseline file: ${baselinePath}`);
+        return { version: 0, keys: new Set(), fingerprints: new Set(), fileFingerprints: new Map() };
+    }
+}
+/**
+ * Check whether a finding is suppressed by the loaded baseline.
+ *
+ * For v1 baselines, uses exact ruleId::line::title matching.
+ * For v2 baselines, uses fingerprint matching against source code context.
+ *
+ * @param filePath - Relative path of the file being evaluated (for v2 per-file lookup)
+ */
+export function isBaselined(finding, baseline, sourceCode, filePath) {
+    // V1 matching — exact key lookup
+    if (baseline.keys.size > 0) {
+        if (baseline.keys.has(v1Key(finding)))
+            return true;
+    }
+    // V2 matching — fingerprint-based
+    if (baseline.fingerprints.size > 0) {
+        const targetSet = filePath && baseline.fileFingerprints.has(filePath)
+            ? baseline.fileFingerprints.get(filePath)
+            : baseline.fingerprints;
+        for (const line of finding.lineNumbers ?? [0]) {
+            const fp = computeFindingFingerprint(finding.ruleId, finding.title, sourceCode, line);
+            if (targetSet.has(fp))
+                return true;
+        }
+    }
+    return false;
+}
+// ─── Baseline Creation Helpers ──────────────────────────────────────────────
+function buildV2Findings(findings, sourceCode) {
+    return findings.map((f) => ({
+        ruleId: f.ruleId,
+        title: f.title,
+        fingerprint: computeFindingFingerprint(f.ruleId, f.title, sourceCode, f.lineNumbers?.[0] ?? 1),
+        severity: f.severity,
+        lineNumbers: f.lineNumbers ?? [],
+        status: "active",
+    }));
+}
+function createSingleFileBaseline(filePath, code, language) {
+    const verdict = evaluateWithTribunal(code, language);
+    const relPath = relative(resolve("."), resolve(filePath));
+    const now = new Date().toISOString();
+    return {
+        version: 2,
+        createdAt: now,
+        updatedAt: now,
+        files: {
+            [relPath]: buildV2Findings(verdict.findings, code),
+        },
+        totalFindings: verdict.findings.length,
+        resolvedFindings: 0,
+    };
+}
+function createProjectBaseline(dir, excludePatterns, includePatterns, maxFiles, language) {
+    const files = collectFiles(dir, {
+        exclude: excludePatterns,
+        include: includePatterns,
+        maxFiles,
+    });
+    if (files.length === 0) {
+        console.error(`No supported source files found in: ${dir}`);
+        process.exit(1);
+    }
+    const now = new Date().toISOString();
+    const baseline = {
+        version: 2,
+        createdAt: now,
+        updatedAt: now,
+        files: {},
+        totalFindings: 0,
+        resolvedFindings: 0,
+    };
+    console.log(`Scanning ${files.length} file(s) for baseline…`);
+    for (let i = 0; i < files.length; i++) {
+        const filePath = files[i];
+        const relPath = relative(resolve("."), filePath);
+        process.stderr.write(`  [${i + 1}/${files.length}] ${relPath}…`);
+        try {
+            const code = readFileSync(filePath, "utf-8");
+            const lang = language || detectLanguage(filePath) || "typescript";
+            const verdict = evaluateWithTribunal(code, lang);
+            if (verdict.findings.length > 0) {
+                baseline.files[relPath] = buildV2Findings(verdict.findings, code);
+                baseline.totalFindings += verdict.findings.length;
+            }
+            process.stderr.write(` ${verdict.findings.length} finding(s)\n`);
+        }
+        catch (err) {
+            process.stderr.write(` error: ${err.message}\n`);
+        }
+    }
+    return baseline;
+}
+// ─── Baseline Update (Merge) ────────────────────────────────────────────────
+function updateBaseline(existingPath, dir, excludePatterns, includePatterns, maxFiles, language) {
+    // Load existing baseline
+    const abs = resolve(existingPath);
+    let existing;
+    if (existsSync(abs)) {
+        try {
+            const data = JSON.parse(readFileSync(abs, "utf-8"));
+            if (data.version === 2)
+                existing = data;
+        }
+        catch {
+            console.error(`Warning: Could not parse existing baseline, creating fresh.`);
+        }
+    }
+    // Scan project
+    const fresh = createProjectBaseline(dir, excludePatterns, includePatterns, maxFiles, language);
+    if (!existing)
+        return fresh;
+    // Merge: keep resolved status for fingerprints that no longer appear
+    let resolvedCount = 0;
+    const merged = {
+        version: 2,
+        createdAt: existing.createdAt,
+        updatedAt: new Date().toISOString(),
+        files: {},
+        totalFindings: 0,
+        resolvedFindings: 0,
+    };
+    // Build set of all fresh fingerprints
+    const freshFingerprints = new Set();
+    for (const findings of Object.values(fresh.files)) {
+        for (const f of findings)
+            freshFingerprints.add(f.fingerprint);
+    }
+    // Process existing files — mark resolved findings
+    for (const [_filePath, existingFindings] of Object.entries(existing.files)) {
+        for (const ef of existingFindings) {
+            if (ef.status === "active" && !freshFingerprints.has(ef.fingerprint)) {
+                ef.status = "resolved";
+                resolvedCount++;
+            }
+        }
+    }
+    // Merge: start with fresh findings, inherit resolved from existing
+    const existingFingerprints = new Set();
+    for (const findings of Object.values(existing.files)) {
+        for (const f of findings)
+            existingFingerprints.add(f.fingerprint);
+    }
+    // Add all fresh file findings
+    for (const [filePath, freshFindings] of Object.entries(fresh.files)) {
+        merged.files[filePath] = freshFindings;
+        merged.totalFindings += freshFindings.length;
+    }
+    // Carry over resolved findings from files that still exist
+    for (const [filePath, existingFindings] of Object.entries(existing.files)) {
+        const resolved = existingFindings.filter((f) => f.status === "resolved");
+        if (resolved.length > 0) {
+            if (!merged.files[filePath])
+                merged.files[filePath] = [];
+            merged.files[filePath].push(...resolved);
+        }
+    }
+    merged.resolvedFindings =
+        resolvedCount +
+            Object.values(merged.files).reduce((sum, findings) => sum + findings.filter((f) => f.status === "resolved").length, 0);
+    // Deduplicate resolved count (we added resolvedCount + counted resolved again)
+    merged.resolvedFindings = Object.values(merged.files).reduce((sum, findings) => sum + findings.filter((f) => f.status === "resolved").length, 0);
+    const newFindings = merged.totalFindings - [...freshFingerprints].filter((fp) => existingFingerprints.has(fp)).length;
+    console.log(`\n  Merge summary: ${merged.totalFindings} active, ${merged.resolvedFindings} resolved` +
+        (newFindings > 0 ? `, ${newFindings} new` : ""));
+    return merged;
+}
+// ─── CLI Entry Point ────────────────────────────────────────────────────────
+export function runBaseline(argv) {
+    const subcommand = argv[3]; // "create" | "update"
+    if (!subcommand || subcommand === "--help" || subcommand === "-h") {
+        console.log(`
+Judges Panel — Baseline Management
+
+USAGE:
+  judges baseline create --file <path>                     Baseline one file (v2)
+  judges baseline create --dir .                           Baseline entire project (v2)
+  judges baseline update --dir .                           Re-scan & merge (mark resolved)
+  judges baseline create --file <path> -o baseline.json    Custom output path
+
+OPTIONS:
+  --file, -f <path>       File to evaluate for baseline
+  --dir, -d <path>        Directory to scan for project-wide baseline
+  --output, -o <path>     Output baseline file (default: .judges-baseline.json)
+  --language, -l <lang>   Language override (auto-detected if omitted)
+  --exclude <pattern>     Glob patterns to exclude (repeatable)
+  --include <pattern>     Glob patterns to include (repeatable)
+  --max-files <n>         Maximum files to scan
+`);
+        process.exit(0);
+    }
+    if (subcommand !== "create" && subcommand !== "update") {
+        console.error(`Unknown baseline subcommand: ${subcommand}`);
+        console.error('Use "judges baseline create" or "judges baseline update"');
+        process.exit(1);
+    }
+    let file;
+    let dir;
+    let output = ".judges-baseline.json";
+    let language;
+    const exclude = [];
+    const include = [];
+    let maxFiles;
+    for (let i = 4; i < argv.length; i++) {
+        const arg = argv[i];
+        switch (arg) {
+            case "--file":
+            case "-f":
+                file = argv[++i];
+                break;
+            case "--dir":
+            case "-d":
+                dir = argv[++i];
+                break;
+            case "--output":
+            case "-o":
+                output = argv[++i];
+                break;
+            case "--language":
+            case "-l":
+                language = argv[++i];
+                break;
+            case "--exclude":
+                exclude.push(argv[++i]);
+                break;
+            case "--include":
+                include.push(argv[++i]);
+                break;
+            case "--max-files":
+                maxFiles = parseInt(argv[++i], 10);
+                break;
+            default:
+                if (!arg.startsWith("-") && !file && !dir)
+                    file = arg;
+                break;
+        }
+    }
+    // ── Update subcommand ──────────────────────────────────────────────────
+    if (subcommand === "update") {
+        const targetDir = dir || ".";
+        console.log(`Updating baseline from ${targetDir}…`);
+        const baseline = updateBaseline(output, targetDir, exclude, include, maxFiles, language);
+        const outPath = resolve(output);
+        writeFileSync(outPath, JSON.stringify(baseline, null, 2), "utf-8");
+        console.log(`✅ Baseline updated: ${outPath} (${baseline.totalFindings} active, ${baseline.resolvedFindings} resolved)`);
+        process.exit(0);
+    }
+    // ── Create subcommand ──────────────────────────────────────────────────
+    // Project-wide mode
+    if (dir) {
+        console.log(`Creating project-wide baseline from ${dir}…`);
+        const baseline = createProjectBaseline(dir, exclude, include, maxFiles, language);
+        const outPath = resolve(output);
+        writeFileSync(outPath, JSON.stringify(baseline, null, 2), "utf-8");
+        console.log(`✅ Baseline created: ${outPath} (${baseline.totalFindings} findings across ${Object.keys(baseline.files).length} file(s))`);
+        process.exit(0);
+    }
+    // Single-file mode
+    if (!file) {
+        console.error("Error: --file or --dir is required for baseline create");
+        process.exit(1);
+    }
+    const abs = resolve(file);
+    if (!existsSync(abs)) {
+        console.error(`Error: File not found: ${abs}`);
+        process.exit(1);
+    }
+    const code = readFileSync(abs, "utf-8");
+    const lang = language || detectLanguage(file) || "typescript";
+    console.log(`Evaluating ${file} to create baseline...`);
+    const baseline = createSingleFileBaseline(file, code, lang);
+    const outPath = resolve(output);
+    writeFileSync(outPath, JSON.stringify(baseline, null, 2), "utf-8");
+    console.log(`✅ Baseline created: ${outPath} (${baseline.totalFindings} finding(s) captured)`);
+    process.exit(0);
+}

package/dist/commands/batch-review.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Batch-review — Parallel review of multiple files with aggregated results.
+ */
+export declare function runBatchReview(argv: string[]): void;