@kevinrabun/judges-cli 3.124.0

package/dist/commands/coach-mode.js

@@ -0,0 +1,229 @@
+/**
+ * Coach mode — interactive teaching mode that explains why each
+ * finding matters with real-world examples and secure alternatives.
+ *
+ * Wraps evaluations with educational context for each finding category.
+ */
+import { readFileSync, existsSync } from "fs";
+// ─── Knowledge Base ─────────────────────────────────────────────────────────
+const LESSONS = [
+    {
+        category: "sql-injection",
+        explanation: "SQL injection occurs when user input is concatenated directly into SQL queries, allowing attackers to manipulate the query logic, extract data, or modify the database.",
+        realWorldExample: "Heartland Payment Systems (2008): SQL injection led to theft of 130 million credit card numbers. Equifax breach (2017): An unpatched vulnerability allowed SQL injection affecting 147 million people.",
+        secureAlternative: "BEFORE: `db.query('SELECT * FROM users WHERE id=' + userId)`\nAFTER:  `db.query('SELECT * FROM users WHERE id=$1', [userId])`\n\nAlways use parameterized queries or prepared statements.",
+        resources: ["OWASP SQL Injection Prevention", "CWE-89: SQL Injection"],
+    },
+    {
+        category: "xss",
+        explanation: "Cross-Site Scripting (XSS) lets attackers inject malicious scripts into web pages viewed by other users, stealing session cookies, redirecting users, or defacing content.",
+        realWorldExample: "British Airways (2018): XSS-style attack on payment page stole 380,000 credit card details. TweetDeck XSS worm (2014) auto-retweeted itself across thousands of accounts.",
+        secureAlternative: "BEFORE: `element.innerHTML = userInput`\nAFTER:  `element.textContent = userInput`\n  OR:   `element.innerHTML = DOMPurify.sanitize(userInput)`\n\nAlways sanitize before DOM insertion.",
+        resources: ["OWASP XSS Prevention Cheat Sheet", "CWE-79: Cross-site Scripting"],
+    },
+    {
+        category: "hardcoded-secret",
+        explanation: "Hardcoded secrets (API keys, passwords, tokens) in source code are exposed to anyone with repo access and persist in git history even if 'deleted'. Automated scrapers on GitHub find them within seconds.",
+        realWorldExample: "Uber (2016): AWS keys hardcoded in a GitHub repo led to breach of 57 million records. Multiple cryptocurrency thefts traced to API keys pushed to public repos.",
+        secureAlternative: "BEFORE: `const apiKey = 'sk-1234567890abcdef'`\nAFTER:  `const apiKey = process.env.API_KEY`\n\nUse environment variables, .env files (gitignored), or a secrets manager (AWS SSM, HashiCorp Vault).",
+        resources: ["OWASP Secrets Management", "CWE-798: Hard-coded Credentials"],
+    },
+    {
+        category: "eval",
+        explanation: "eval() and new Function() execute arbitrary code strings, enabling code injection attacks where attacker-controlled input becomes executable code.",
+        realWorldExample: "Multiple Node.js package supply chain attacks used eval() to execute obfuscated malicious payloads. The event-stream incident (2018) used eval-like patterns to steal cryptocurrency.",
+        secureAlternative: "BEFORE: `eval('obj.' + propName)`\nAFTER:  `obj[propName]`  (property access)\n  OR:   Use a safe parser like expr-eval for math expressions.\n\nNever pass user input to eval().",
+        resources: ["CWE-95: Eval Injection", "MDN: Never use eval()"],
+    },
+    {
+        category: "empty-catch",
+        explanation: "Empty catch blocks silently swallow exceptions, hiding bugs, security issues, and data corruption. The application continues in an undefined state without any indication of failure.",
+        realWorldExample: "Knight Capital (2012): Silent error handling in trading software caused $440 million loss in 45 minutes. Empty catches masked the deployment error that triggered the catastrophe.",
+        secureAlternative: "BEFORE: `try { op() } catch (e) {}`\nAFTER:  `try { op() } catch (e) { logger.error('Operation failed', { error: e }); throw e; }`\n\nAlways log, report, or re-throw caught exceptions.",
+        resources: ["CWE-390: Detection of Error Without Action", "Error Handling Best Practices"],
+    },
+    {
+        category: "insecure-http",
+        explanation: "Plain HTTP transmits data unencrypted, allowing man-in-the-middle attacks to intercept passwords, API keys, and sensitive data in transit.",
+        realWorldExample: "FireSheep (2010): Tool demonstrated mass session hijacking on HTTP networks at coffee shops. Multiple ISPs caught injecting ads and tracking scripts into HTTP traffic.",
+        secureAlternative: "BEFORE: `fetch('http://api.example.com/data')`\nAFTER:  `fetch('https://api.example.com/data')`\n\nAlways use HTTPS. Enable HSTS headers. Reject HTTP in production.",
+        resources: ["OWASP Transport Layer Protection", "CWE-319: Cleartext Transmission"],
+    },
+    {
+        category: "weak-crypto",
+        explanation: "Math.random() is predictable and not cryptographically secure. MD5 and SHA1 are broken for security purposes — collisions can be generated practically.",
+        realWorldExample: "Flame malware (2012): Exploited MD5 collision to forge Microsoft certificates. Multiple password breaches accelerated by MD5 hash cracking (orders of magnitude faster than bcrypt).",
+        secureAlternative: "BEFORE: `const token = Math.random().toString(36)`\nAFTER:  `const token = crypto.randomUUID()`\n\nBEFORE: `crypto.createHash('md5')`\nAFTER:  `crypto.createHash('sha256')`  or bcrypt for passwords.",
+        resources: ["OWASP Cryptographic Failures", "CWE-338: Weak PRNG"],
+    },
+    {
+        category: "command-injection",
+        explanation: "Passing user input to shell commands (exec, spawn with string) allows attackers to inject additional commands using ; && || etc.",
+        realWorldExample: "ImageTragick (2016): Image processing library passed filenames to shell commands, enabling remote code execution on thousands of servers. Multiple CI/CD pipeline compromises via command injection in build scripts.",
+        secureAlternative: "BEFORE: `execSync('convert ' + filename)`\nAFTER:  `spawn('convert', [filename])`\n\nUse array-based APIs. Validate inputs against allowlists. Never pass user input to exec().",
+        resources: ["OWASP OS Command Injection", "CWE-78: OS Command Injection"],
+    },
+    {
+        category: "cors",
+        explanation: "Permissive CORS (Access-Control-Allow-Origin: *) allows any website to make authenticated requests to your API, enabling cross-origin data theft.",
+        realWorldExample: "Multiple cryptocurrency exchanges had funds stolen via CORS misconfiguration, where malicious sites could read authenticated API responses including account balances and trade capabilities.",
+        secureAlternative: "BEFORE: `app.use(cors())`  // allows all origins\nAFTER:  `app.use(cors({ origin: ['https://myapp.com'], credentials: true }))`\n\nSpecify allowed origins. Never use * with credentials.",
+        resources: ["OWASP CORS Misconfiguration", "MDN: CORS"],
+    },
+    {
+        category: "missing-auth",
+        explanation: "API endpoints without authentication middleware are accessible to anyone, including automated scanners. Every endpoint processing or returning data must verify the caller's identity.",
+        realWorldExample: "Parler data scrape (2021): Unauthenticated API endpoints allowed bulk download of millions of posts including deleted content. T-Mobile (2021): Unauthenticated API exposed 40 million records.",
+        secureAlternative: "BEFORE: `app.get('/users', handler)`\nAFTER:  `app.get('/users', authMiddleware, roleCheck('admin'), handler)`\n\nApply authentication to all non-public routes. Add authorization for sensitive operations.",
+        resources: ["OWASP Broken Access Control", "CWE-306: Missing Authentication"],
+    },
+];
+function findLesson(text) {
+    const lower = text.toLowerCase();
+    for (const lesson of LESSONS) {
+        if (lower.includes(lesson.category) || lower.includes(lesson.category.replace(/-/g, " "))) {
+            return lesson;
+        }
+    }
+    // Fuzzy match
+    const keywords = {
+        sql: "sql-injection",
+        inject: "sql-injection",
+        xss: "xss",
+        "cross-site": "xss",
+        innerhtml: "xss",
+        secret: "hardcoded-secret",
+        password: "hardcoded-secret",
+        hardcode: "hardcoded-secret",
+        eval: "eval",
+        "new function": "eval",
+        "empty catch": "empty-catch",
+        "catch {}": "empty-catch",
+        http: "insecure-http",
+        "math.random": "weak-crypto",
+        md5: "weak-crypto",
+        crypto: "weak-crypto",
+        exec: "command-injection",
+        spawn: "command-injection",
+        command: "command-injection",
+        cors: "cors",
+        auth: "missing-auth",
+        middleware: "missing-auth",
+    };
+    for (const [kw, cat] of Object.entries(keywords)) {
+        if (lower.includes(kw)) {
+            return LESSONS.find((l) => l.category === cat) || null;
+        }
+    }
+    return null;
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runCoachMode(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges coach-mode — Educational security coaching
+
+Usage:
+  judges coach-mode --topic sql-injection
+  judges coach-mode --topic xss
+  judges coach-mode --all
+  judges coach-mode --scan <file>
+
+Options:
+  --topic <name>        Learn about a specific finding category
+  --all                 Show all available lessons
+  --scan <file>         Scan a file and show coaching for each finding
+  --format json         JSON output
+  --help, -h            Show this help
+
+Topics: sql-injection, xss, hardcoded-secret, eval, empty-catch,
+        insecure-http, weak-crypto, command-injection, cors, missing-auth
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const topic = argv.find((_a, i) => argv[i - 1] === "--topic") || "";
+    const isAll = argv.includes("--all");
+    const scanFile = argv.find((_a, i) => argv[i - 1] === "--scan") || "";
+    if (isAll) {
+        if (format === "json") {
+            console.log(JSON.stringify({ lessons: LESSONS, total: LESSONS.length }, null, 2));
+        }
+        else {
+            console.log(`\n  Coach Mode — ${LESSONS.length} lessons available\n  ──────────────────────────`);
+            for (const lesson of LESSONS) {
+                console.log(`\n    📚 ${lesson.category}`);
+                console.log(`        ${lesson.explanation.substring(0, 80)}...`);
+            }
+            console.log("\n    Use --topic <name> for full lesson details.\n");
+        }
+        return;
+    }
+    if (topic) {
+        const lesson = findLesson(topic);
+        if (!lesson) {
+            console.error(`  Unknown topic: ${topic}. Use --all to see available topics.`);
+            return;
+        }
+        if (format === "json") {
+            console.log(JSON.stringify(lesson, null, 2));
+        }
+        else {
+            console.log(`\n  📚 ${lesson.category.toUpperCase()}`);
+            console.log(`  ──────────────────────────\n`);
+            console.log(`  WHY IT MATTERS:`);
+            console.log(`    ${lesson.explanation}\n`);
+            console.log(`  REAL-WORLD EXAMPLES:`);
+            console.log(`    ${lesson.realWorldExample}\n`);
+            console.log(`  SECURE ALTERNATIVE:`);
+            for (const line of lesson.secureAlternative.split("\n")) {
+                console.log(`    ${line}`);
+            }
+            console.log(`\n  RESOURCES:`);
+            for (const r of lesson.resources) {
+                console.log(`    📖 ${r}`);
+            }
+            console.log("");
+        }
+        return;
+    }
+    if (scanFile) {
+        if (!existsSync(scanFile)) {
+            console.error(`  File not found: ${scanFile}`);
+            return;
+        }
+        const content = readFileSync(scanFile, "utf-8");
+        const lines = content.split("\n");
+        const found = [];
+        for (let i = 0; i < lines.length; i++) {
+            const lesson = findLesson(lines[i]);
+            if (lesson && !found.some((f) => f.lesson.category === lesson.category)) {
+                found.push({ line: i + 1, lesson });
+            }
+        }
+        if (format === "json") {
+            console.log(JSON.stringify({
+                file: scanFile,
+                findings: found.map((f) => ({ line: f.line, ...f.lesson })),
+                timestamp: new Date().toISOString(),
+            }, null, 2));
+        }
+        else {
+            console.log(`\n  Coach Mode — ${scanFile} (${found.length} teaching moment(s))\n  ──────────────────────────`);
+            if (found.length === 0) {
+                console.log("  ✅ No common anti-patterns detected to coach on.");
+            }
+            else {
+                for (const f of found) {
+                    console.log(`\n    📚 Line ${f.line}: ${f.lesson.category}`);
+                    console.log(`        ${f.lesson.explanation}`);
+                    console.log(`        🔴 Example breach: ${f.lesson.realWorldExample.split(".")[0]}`);
+                    console.log(`        💡 ${f.lesson.secureAlternative.split("\n")[f.lesson.secureAlternative.includes("AFTER") ? 1 : 0]}`);
+                }
+            }
+            console.log("");
+        }
+        return;
+    }
+    console.log("  Use --topic <name>, --all, or --scan <file>. See --help for details.");
+}

package/dist/commands/code-health.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Code-health — Overall codebase health score across multiple dimensions.
+ */
+export declare function runCodeHealth(argv: string[]): void;

package/dist/commands/code-health.js

@@ -0,0 +1,195 @@
+/**
+ * Code-health — Overall codebase health score across multiple dimensions.
+ */
+import { readFileSync, existsSync } from "fs";
+// ─── Severity weights ───────────────────────────────────────────────────────
+const SEVERITY_PENALTY = {
+    critical: 25,
+    high: 15,
+    medium: 8,
+    low: 3,
+    info: 1,
+};
+function computeGrade(score) {
+    if (score >= 90)
+        return "A";
+    if (score >= 80)
+        return "B";
+    if (score >= 70)
+        return "C";
+    if (score >= 60)
+        return "D";
+    return "F";
+}
+// ─── Dimension Analysis ────────────────────────────────────────────────────
+function categorizeFinding(f) {
+    const rule = (f.ruleId || "").toLowerCase();
+    const title = (f.title || "").toLowerCase();
+    if (rule.includes("sql") ||
+        rule.includes("xss") ||
+        rule.includes("inject") ||
+        rule.includes("auth") ||
+        rule.includes("crypto") ||
+        rule.includes("secret") ||
+        title.includes("vulnerab") ||
+        title.includes("security") ||
+        title.includes("injection")) {
+        return "security";
+    }
+    if (rule.includes("error") ||
+        rule.includes("null") ||
+        rule.includes("type") ||
+        rule.includes("bound") ||
+        rule.includes("overflow") ||
+        title.includes("bug") ||
+        title.includes("error") ||
+        title.includes("crash")) {
+        return "reliability";
+    }
+    if (rule.includes("complex") ||
+        rule.includes("dupl") ||
+        rule.includes("smell") ||
+        rule.includes("long") ||
+        rule.includes("dead") ||
+        title.includes("maintain") ||
+        title.includes("complex") ||
+        title.includes("duplicate")) {
+        return "maintainability";
+    }
+    if (rule.includes("perf") ||
+        rule.includes("optim") ||
+        rule.includes("leak") ||
+        title.includes("perform") ||
+        title.includes("slow") ||
+        title.includes("memory")) {
+        return "performance";
+    }
+    return "quality";
+}
+function computeDimension(name, findings, weight) {
+    let penalty = 0;
+    for (const f of findings) {
+        const sev = (f.severity || "low").toLowerCase();
+        penalty += SEVERITY_PENALTY[sev] || 3;
+    }
+    const score = Math.max(0, Math.min(100, 100 - penalty));
+    const details = findings.length === 0 ? `No ${name} issues found` : `${findings.length} ${name} finding(s) detected`;
+    return { name, score, weight, findingsCount: findings.length, details };
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runCodeHealth(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges code-health — Overall codebase health score
+
+Usage:
+  judges code-health --file verdict.json       Compute health from verdict
+  judges code-health --format json             JSON output
+  judges code-health --weights "security=40,reliability=25,maintainability=20,performance=10,quality=5"
+
+Options:
+  --file <path>         Verdict JSON file
+  --weights <spec>      Custom dimension weights (must total 100)
+  --format json         JSON output
+  --help, -h            Show this help
+
+Dimensions:
+  security              Injection, auth, crypto, secrets
+  reliability           Null checks, type errors, bounds
+  maintainability       Complexity, duplication, code smells
+  performance           Memory leaks, optimization issues
+  quality               General code quality findings
+
+Computes a weighted health score (0-100) with a letter grade (A-F).
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const file = argv.find((_a, i) => argv[i - 1] === "--file");
+    // Parse custom weights
+    const defaultWeights = {
+        security: 35,
+        reliability: 25,
+        maintainability: 20,
+        performance: 10,
+        quality: 10,
+    };
+    const weightsArg = argv.find((_a, i) => argv[i - 1] === "--weights");
+    if (weightsArg) {
+        for (const part of weightsArg.split(",")) {
+            const [key, val] = part.split("=");
+            if (key && val)
+                defaultWeights[key.trim()] = parseInt(val, 10);
+        }
+    }
+    let findings = [];
+    let baseScore = 0;
+    if (file) {
+        if (!existsSync(file)) {
+            console.error(`Error: File not found: ${file}`);
+            process.exitCode = 1;
+            return;
+        }
+        try {
+            const verdict = JSON.parse(readFileSync(file, "utf-8"));
+            findings = verdict.findings || [];
+            baseScore = verdict.overallScore || 0;
+        }
+        catch {
+            console.error(`Error: Could not parse ${file}`);
+            process.exitCode = 1;
+            return;
+        }
+    }
+    // Group findings by dimension
+    const groups = new Map();
+    for (const key of Object.keys(defaultWeights)) {
+        groups.set(key, []);
+    }
+    for (const f of findings) {
+        const cat = categorizeFinding(f);
+        const arr = groups.get(cat);
+        if (arr)
+            arr.push(f);
+        else {
+            const qArr = groups.get("quality");
+            if (qArr)
+                qArr.push(f);
+        }
+    }
+    // Compute dimensions
+    const dimensions = [];
+    for (const [name, weight] of Object.entries(defaultWeights)) {
+        const dimFindings = groups.get(name) || [];
+        dimensions.push(computeDimension(name, dimFindings, weight));
+    }
+    // Weighted average
+    const totalWeight = dimensions.reduce((sum, d) => sum + d.weight, 0);
+    const weightedScore = totalWeight > 0 ? Math.round(dimensions.reduce((sum, d) => sum + d.score * d.weight, 0) / totalWeight) : baseScore;
+    const report = {
+        timestamp: new Date().toISOString(),
+        overallScore: weightedScore,
+        grade: computeGrade(weightedScore),
+        dimensions,
+        totalFindings: findings.length,
+        summary: `Health score: ${weightedScore}/100 (Grade ${computeGrade(weightedScore)}). ${findings.length} total findings across ${dimensions.filter((d) => d.findingsCount > 0).length} dimensions.`,
+    };
+    if (format === "json") {
+        console.log(JSON.stringify(report, null, 2));
+        return;
+    }
+    console.log(`\n  Codebase Health Report\n  ═════════════════════════════`);
+    console.log(`    Overall Score: ${report.overallScore}/100`);
+    console.log(`    Grade: ${report.grade}`);
+    console.log(`    Total Findings: ${report.totalFindings}`);
+    console.log();
+    console.log("  Dimensions");
+    console.log("  ─────────────────────────────");
+    for (const d of dimensions) {
+        const bar = "█".repeat(Math.floor(d.score / 5)) + "░".repeat(20 - Math.floor(d.score / 5));
+        const grade = computeGrade(d.score);
+        console.log(`    ${d.name.padEnd(18)} ${bar} ${d.score}/100 (${grade}) — ${d.findingsCount} findings [weight: ${d.weight}%]`);
+    }
+    console.log(`\n  Summary: ${report.summary}`);
+    console.log();
+}

package/dist/commands/code-owner-suggest.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Code owner suggest — auto-recommend CODEOWNERS entries
+ * based on finding patterns and resolution history.
+ *
+ * All analysis uses local data only.
+ */
+interface OwnerSuggestion {
+    path: string;
+    suggestedOwner: string;
+    reason: string;
+    confidence: number;
+    ruleCategories: string[];
+}
+export declare function suggestOwner(path: string, author: string, ruleCategories: string[]): OwnerSuggestion;
+export declare function runCodeOwnerSuggest(argv: string[]): void;
+export {};

package/dist/commands/code-owner-suggest.js

@@ -0,0 +1,214 @@
+/**
+ * Code owner suggest — auto-recommend CODEOWNERS entries
+ * based on finding patterns and resolution history.
+ *
+ * All analysis uses local data only.
+ */
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
+import { join } from "path";
+const OWNER_DIR = ".judges-code-owners";
+const OWNER_FILE = join(OWNER_DIR, "suggestions.json");
+// ─── Core ───────────────────────────────────────────────────────────────────
+function ensureDir() {
+    if (!existsSync(OWNER_DIR))
+        mkdirSync(OWNER_DIR, { recursive: true });
+}
+function loadStore() {
+    if (!existsSync(OWNER_FILE))
+        return { suggestions: [], updatedAt: new Date().toISOString() };
+    try {
+        return JSON.parse(readFileSync(OWNER_FILE, "utf-8"));
+    }
+    catch {
+        return { suggestions: [], updatedAt: new Date().toISOString() };
+    }
+}
+function saveStore(store) {
+    ensureDir();
+    store.updatedAt = new Date().toISOString();
+    writeFileSync(OWNER_FILE, JSON.stringify(store, null, 2));
+}
+function loadScoreData() {
+    // Try to load from dev-score data
+    const scoreDir = ".judges-scores";
+    if (!existsSync(scoreDir))
+        return [];
+    try {
+        const { readdirSync: rds } = require("fs");
+        const files = rds(scoreDir).filter((f) => f.endsWith(".json"));
+        return files.map((f) => {
+            try {
+                const data = JSON.parse(readFileSync(join(scoreDir, f), "utf-8"));
+                return {
+                    author: data.author || f.replace(".json", ""),
+                    findingsFixed: data.findingsFixed || data.score || 0,
+                    categories: data.topCategories || [],
+                };
+            }
+            catch {
+                return { author: f.replace(".json", ""), findingsFixed: 0, categories: [] };
+            }
+        });
+    }
+    catch {
+        return [];
+    }
+}
+export function suggestOwner(path, author, ruleCategories) {
+    const suggestion = {
+        path,
+        suggestedOwner: author,
+        reason: `Most active reviewer for ${ruleCategories.join(", ")} findings`,
+        confidence: Math.min(100, 50 + ruleCategories.length * 10),
+        ruleCategories,
+    };
+    const store = loadStore();
+    // Replace existing suggestion for same path
+    const idx = store.suggestions.findIndex((s) => s.path === path);
+    if (idx >= 0)
+        store.suggestions[idx] = suggestion;
+    else
+        store.suggestions.push(suggestion);
+    if (store.suggestions.length > 200)
+        store.suggestions = store.suggestions.slice(-200);
+    saveStore(store);
+    return suggestion;
+}
+function generateCodeowners(suggestions) {
+    const lines = [
+        "# CODEOWNERS — Generated by judges code-owner-suggest",
+        "# Review and customize before committing",
+        "",
+    ];
+    const grouped = new Map();
+    for (const s of suggestions) {
+        const existing = grouped.get(s.suggestedOwner) || [];
+        existing.push(s.path);
+        grouped.set(s.suggestedOwner, existing);
+    }
+    for (const [owner, paths] of grouped) {
+        for (const p of paths) {
+            lines.push(`${p} @${owner}`);
+        }
+    }
+    return lines.join("\n") + "\n";
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runCodeOwnerSuggest(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges code-owner-suggest — Auto-recommend CODEOWNERS entries
+
+Usage:
+  judges code-owner-suggest --analyze
+  judges code-owner-suggest --suggest --path "src/auth/" --owner "alice@co.com" --rules SEC,AUTH
+  judges code-owner-suggest --export
+  judges code-owner-suggest --export --out CODEOWNERS
+
+Options:
+  --analyze               Auto-suggest from dev-score and finding data
+  --suggest               Manually add a suggestion
+  --path <path>           File/directory path for suggestion
+  --owner <name>          Owner email/username
+  --rules <csv>           Rule categories (comma-separated)
+  --export                Export as CODEOWNERS format
+  --out <file>            Write CODEOWNERS to file
+  --format json           JSON output
+  --help, -h              Show this help
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    // Manual suggestion
+    if (argv.includes("--suggest")) {
+        const path = argv.find((_a, i) => argv[i - 1] === "--path");
+        const owner = argv.find((_a, i) => argv[i - 1] === "--owner");
+        const rulesStr = argv.find((_a, i) => argv[i - 1] === "--rules");
+        if (!path || !owner) {
+            console.error("  --path and --owner required for --suggest");
+            return;
+        }
+        const rules = rulesStr ? rulesStr.split(",") : [];
+        const suggestion = suggestOwner(path, owner, rules);
+        if (format === "json") {
+            console.log(JSON.stringify(suggestion, null, 2));
+        }
+        else {
+            console.log(`\n  ✅ Suggestion recorded:`);
+            console.log(`     ${suggestion.path} → @${suggestion.suggestedOwner} (${suggestion.confidence}% confidence)`);
+            console.log(`     Reason: ${suggestion.reason}\n`);
+        }
+        return;
+    }
+    // Auto-analyze
+    if (argv.includes("--analyze")) {
+        const devs = loadScoreData();
+        if (devs.length === 0) {
+            console.log("  No dev-score data found. Record developer activity with `judges dev-score` first.");
+            return;
+        }
+        const suggestions = [];
+        // Map categories to path prefixes
+        const categoryPaths = {
+            SEC: "src/security/",
+            AUTH: "src/auth/",
+            SQL: "src/database/",
+            XSS: "src/frontend/",
+            CRYPTO: "src/crypto/",
+            SSRF: "src/network/",
+            CMD: "src/commands/",
+        };
+        for (const dev of devs) {
+            for (const cat of dev.categories) {
+                const path = categoryPaths[cat] || `src/${cat.toLowerCase()}/`;
+                suggestions.push(suggestOwner(path, dev.author, [cat]));
+            }
+        }
+        if (format === "json") {
+            console.log(JSON.stringify(suggestions, null, 2));
+        }
+        else {
+            console.log(`\n  Auto-Analyzed Code Owners (${suggestions.length} suggestions)\n  ──────────────────────────`);
+            for (const s of suggestions) {
+                console.log(`    ${s.path.padEnd(25)} → @${s.suggestedOwner.padEnd(20)} ${s.ruleCategories.join(",")}`);
+            }
+            console.log(`\n  Export with: judges code-owner-suggest --export\n`);
+        }
+        return;
+    }
+    // Export
+    if (argv.includes("--export")) {
+        const store = loadStore();
+        if (store.suggestions.length === 0) {
+            console.log("  No suggestions yet. Use --analyze or --suggest first.");
+            return;
+        }
+        const content = generateCodeowners(store.suggestions);
+        const outPath = argv.find((_a, i) => argv[i - 1] === "--out");
+        if (outPath) {
+            writeFileSync(outPath, content);
+            console.log(`  ✅ Written to ${outPath} (${store.suggestions.length} entries)`);
+        }
+        else {
+            console.log(content);
+        }
+        return;
+    }
+    // Default: show current suggestions
+    const store = loadStore();
+    if (format === "json") {
+        console.log(JSON.stringify(store, null, 2));
+    }
+    else {
+        console.log(`\n  Code Owner Suggestions (${store.suggestions.length})\n  ──────────────────────────`);
+        if (store.suggestions.length === 0) {
+            console.log("    No suggestions yet. Use --analyze or --suggest to add.");
+        }
+        else {
+            for (const s of store.suggestions) {
+                console.log(`    ${s.path.padEnd(25)} → @${s.suggestedOwner.padEnd(20)} ${s.confidence}% ${s.ruleCategories.join(",")}`);
+            }
+        }
+        console.log("");
+    }
+}

package/dist/commands/code-similarity.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Code similarity — compare code against internal implementations
+ * to detect when AI generates near-identical copies of known
+ * problematic patterns or unsafe implementations.
+ *
+ * All analysis local.
+ */
+export declare function runCodeSimilarity(argv: string[]): void;