@kevinrabun/judges-cli 3.124.0

package/dist/commands/example-leak.js

@@ -0,0 +1,232 @@
+/**
+ * Example leak — detect AI-copied example/placeholder code left in production.
+ */
+import { readFileSync, readdirSync, statSync } from "fs";
+import { join, extname } from "path";
+// ─── File Collection ────────────────────────────────────────────────────────
+const CODE_EXTS = new Set([".ts", ".tsx", ".js", ".jsx", ".py", ".java", ".go", ".rs", ".cs", ".rb"]);
+function collectFiles(dir, max = 300) {
+    const files = [];
+    function walk(d) {
+        if (files.length >= max)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(d);
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (files.length >= max)
+                return;
+            if (e.startsWith(".") || e === "node_modules" || e === "dist" || e === "build")
+                continue;
+            const full = join(d, e);
+            try {
+                if (statSync(full).isDirectory())
+                    walk(full);
+                else if (CODE_EXTS.has(extname(full)))
+                    files.push(full);
+            }
+            catch {
+                /* skip */
+            }
+        }
+    }
+    walk(dir);
+    return files;
+}
+// ─── Analysis ───────────────────────────────────────────────────────────────
+const PLACEHOLDER_URLS = [
+    /https?:\/\/(?:example\.com|localhost:\d+|127\.0\.0\.1:\d+|httpbin\.org|jsonplaceholder\.typicode\.com|reqres\.in|api\.example)/i,
+];
+const PLACEHOLDER_SECRETS = [
+    /['"](?:sk-[a-zA-Z0-9]{20,}|your[-_]?api[-_]?key|REPLACE[-_]?ME|changeme|password123|secret123|test[-_]?secret|my[-_]?secret|dummy[-_]?key|placeholder)['"]/,
+];
+const EXAMPLE_NAMES = [
+    /(?:class|function|const|let|var)\s+(?:MyApp|MyComponent|Example\w*|Demo\w*|HelloWorld|SampleApp|TestApp|FooBar|Foo|Bar|Baz|Qux)\b/,
+];
+const EXAMPLE_DATA = [
+    /['"](?:John Doe|Jane Doe|john@example\.com|jane@example\.com|foo@bar\.com|test@test\.com|user@example\.com|123 Main St|Acme Corp|Lorem ipsum|Alice|Bob)['"]/i,
+];
+const TUTORIAL_MARKERS = [
+    /\/\/\s*(?:Step \d|TODO:?\s*replace|FIXME:?\s*placeholder|HACK:?\s*example|NOTE:?\s*this is (?:a |an )?(?:example|demo|sample|placeholder))/i,
+    /#\s*(?:Step \d|TODO:?\s*replace|FIXME:?\s*placeholder)/i,
+];
+const HARDCODED_PORTS = [/(?:PORT|port)\s*[:=]\s*(?:3000|8080|8000|5000|4200|9090)\b/];
+function analyzeFile(filepath) {
+    const issues = [];
+    let content;
+    try {
+        content = readFileSync(filepath, "utf-8");
+    }
+    catch {
+        return issues;
+    }
+    // Skip test/fixture/example files
+    if (/(?:test|spec|fixture|example|demo|sample|mock|stub|__test__|__spec__)/i.test(filepath))
+        return issues;
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Placeholder URLs
+        for (const pattern of PLACEHOLDER_URLS) {
+            if (pattern.test(line)) {
+                const url = line.match(pattern)?.[0];
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "Placeholder URL in non-test code",
+                    severity: "high",
+                    detail: `\`${url}\` is an example/localhost URL — replace with actual endpoint`,
+                });
+                break;
+            }
+        }
+        // Placeholder secrets
+        for (const pattern of PLACEHOLDER_SECRETS) {
+            if (pattern.test(line)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "Placeholder secret/key value",
+                    severity: "high",
+                    detail: "Example API key or placeholder secret found — replace with env variable or secret manager",
+                });
+                break;
+            }
+        }
+        // Example class/function names
+        for (const pattern of EXAMPLE_NAMES) {
+            if (pattern.test(line)) {
+                const name = line.match(/(?:class|function|const|let|var)\s+((?:Example|Demo|HelloWorld|Sample|Test|FooBar|Foo|Bar|Baz|Qux)\w*)/)?.[1];
+                if (name) {
+                    issues.push({
+                        file: filepath,
+                        line: i + 1,
+                        issue: "Example/placeholder name in production",
+                        severity: "medium",
+                        detail: `\`${name}\` looks like tutorial code — rename to something domain-specific`,
+                    });
+                }
+                break;
+            }
+        }
+        // Example data
+        for (const pattern of EXAMPLE_DATA) {
+            if (pattern.test(line)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "Example data in non-test code",
+                    severity: "medium",
+                    detail: "Placeholder data (John Doe, example.com, etc.) left in production code",
+                });
+                break;
+            }
+        }
+        // Tutorial markers
+        for (const pattern of TUTORIAL_MARKERS) {
+            if (pattern.test(line)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "Tutorial comment marker",
+                    severity: "low",
+                    detail: "Comment from tutorial/example code — indicates AI-copied scaffold",
+                });
+                break;
+            }
+        }
+        // Hardcoded ports
+        for (const pattern of HARDCODED_PORTS) {
+            if (pattern.test(line) && !/process\.env|ENV|config/i.test(line)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "Hardcoded default port",
+                    severity: "low",
+                    detail: "Port hardcoded to common default — should come from config or env",
+                });
+                break;
+            }
+        }
+        // console.log with example text
+        if (/console\.log\s*\(\s*['"](?:Hello|Hi|Welcome|It works|Success|TODO|Test)\b/.test(line)) {
+            issues.push({
+                file: filepath,
+                line: i + 1,
+                issue: "Example console.log",
+                severity: "low",
+                detail: "Generic log message from tutorial — remove or replace with structured logging",
+            });
+        }
+        // Empty function bodies that look like stubs
+        if (/(?:function|=>)\s*\{[\s]*\}/.test(line) && !/test|spec|mock|stub|noop|placeholder/i.test(line)) {
+            issues.push({
+                file: filepath,
+                line: i + 1,
+                issue: "Empty function stub",
+                severity: "medium",
+                detail: "Function with empty body — may be unfinished AI-generated scaffold",
+            });
+        }
+    }
+    return issues;
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runExampleLeak(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges example-leak — Detect AI-copied example/placeholder code left in production
+
+Usage:
+  judges example-leak [dir]
+  judges example-leak src/ --format json
+
+Options:
+  [dir]                 Directory to scan (default: .)
+  --format json         JSON output
+  --help, -h            Show this help
+
+Checks: placeholder URLs, example API keys, tutorial names, example data (John Doe, Lorem ipsum),
+tutorial comments, hardcoded ports, example console.log messages, empty function stubs.
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const dir = argv.find((a) => !a.startsWith("-") && argv.indexOf(a) > 0) || ".";
+    const files = collectFiles(dir);
+    const allIssues = [];
+    for (const f of files)
+        allIssues.push(...analyzeFile(f));
+    const highCount = allIssues.filter((i) => i.severity === "high").length;
+    const medCount = allIssues.filter((i) => i.severity === "medium").length;
+    const score = Math.max(0, 100 - highCount * 12 - medCount * 4);
+    if (format === "json") {
+        console.log(JSON.stringify({
+            issues: allIssues,
+            score,
+            summary: { high: highCount, medium: medCount, total: allIssues.length },
+            timestamp: new Date().toISOString(),
+        }, null, 2));
+    }
+    else {
+        const badge = score >= 80 ? "✅ CLEAN" : score >= 50 ? "⚠️  LEAKING" : "❌ EXAMPLE CODE";
+        console.log(`\n  Example Leak: ${badge} (${score}/100)\n  ─────────────────────────────`);
+        if (allIssues.length === 0) {
+            console.log("    No example/placeholder code detected.\n");
+            return;
+        }
+        for (const issue of allIssues.slice(0, 25)) {
+            const icon = issue.severity === "high" ? "🔴" : issue.severity === "medium" ? "🟡" : "🔵";
+            console.log(`    ${icon} ${issue.issue}`);
+            console.log(`        ${issue.file}:${issue.line}`);
+            console.log(`        ${issue.detail}`);
+        }
+        if (allIssues.length > 25)
+            console.log(`    ... and ${allIssues.length - 25} more`);
+        console.log(`\n    Total: ${allIssues.length} | High: ${highCount} | Medium: ${medCount} | Score: ${score}/100\n`);
+    }
+}

package/dist/commands/exception-consistency.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Exception consistency — detect inconsistent exception handling
+ * patterns within a codebase: thrown-but-uncaught, asymmetric
+ * try/catch/finally, unhandled promise rejections, mixed strategies.
+ */
+export declare function runExceptionConsistency(argv: string[]): void;

package/dist/commands/exception-consistency.js

@@ -0,0 +1,192 @@
+/**
+ * Exception consistency — detect inconsistent exception handling
+ * patterns within a codebase: thrown-but-uncaught, asymmetric
+ * try/catch/finally, unhandled promise rejections, mixed strategies.
+ */
+import { readFileSync, readdirSync, statSync } from "fs";
+import { join, extname } from "path";
+// ─── File Collection ────────────────────────────────────────────────────────
+const CODE_EXTS = new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".py", ".java", ".cs", ".go", ".rs"]);
+function collectFiles(dir, max = 500) {
+    const files = [];
+    function walk(d) {
+        if (files.length >= max)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(d);
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (files.length >= max)
+                return;
+            if (e.startsWith(".") || e === "node_modules" || e === "dist" || e === "build")
+                continue;
+            const full = join(d, e);
+            try {
+                if (statSync(full).isDirectory())
+                    walk(full);
+                else if (CODE_EXTS.has(extname(full)))
+                    files.push(full);
+            }
+            catch {
+                /* skip */
+            }
+        }
+    }
+    walk(dir);
+    return files;
+}
+// ─── Patterns ───────────────────────────────────────────────────────────────
+const PATTERNS = [
+    {
+        name: "empty-catch",
+        regex: /catch\s*\([^)]*\)\s*\{\s*\}/,
+        severity: "high",
+        message: "Empty catch block silently swallows exception",
+    },
+    {
+        name: "catch-ignore-error",
+        regex: /catch\s*\(\s*_?\s*\)\s*\{/,
+        severity: "medium",
+        message: "Catch block ignores error variable",
+    },
+    {
+        name: "throw-string",
+        regex: /throw\s+['"`]/,
+        severity: "medium",
+        message: "Throwing a string literal instead of an Error object",
+    },
+    {
+        name: "catch-console-only",
+        regex: /catch\s*\([^)]*\)\s*\{\s*console\.(log|error|warn)\([^)]*\);\s*\}/,
+        severity: "medium",
+        message: "Catch block only logs — error is not re-thrown or handled",
+    },
+    {
+        name: "unhandled-promise",
+        regex: /\.then\([^)]*\)\s*(?!\.catch)/,
+        severity: "medium",
+        message: "Promise chain without .catch() — potential unhandled rejection",
+    },
+    {
+        name: "async-no-try",
+        regex: /async\s+function\s+\w+[^{]*\{(?:(?!try\s*\{)[\s\S])*await\s/,
+        severity: "low",
+        message: "Async function uses await without try/catch",
+    },
+    {
+        name: "catch-rethrow-same",
+        regex: /catch\s*\(\s*(\w+)\s*\)\s*\{\s*throw\s+\1\s*;?\s*\}/,
+        severity: "low",
+        message: "Catch block only re-throws the same error — unnecessary try/catch",
+    },
+    {
+        name: "generic-catch",
+        regex: /catch\s*\(\s*(\w+)\s*:\s*any\s*\)/,
+        severity: "low",
+        message: "Catching 'any' type — use typed error handling",
+    },
+];
+// ─── Analysis ───────────────────────────────────────────────────────────────
+function analyzeFile(filePath) {
+    let content;
+    try {
+        content = readFileSync(filePath, "utf-8");
+    }
+    catch {
+        return [];
+    }
+    const lines = content.split("\n");
+    const issues = [];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Check multi-line context (current + next 2 lines)
+        const context = lines.slice(i, Math.min(i + 3, lines.length)).join("\n");
+        for (const pat of PATTERNS) {
+            if ((pat.regex.test(context) && pat.regex.test(line)) ||
+                ((i === 0 || !pat.regex.test(lines.slice(i - 1, i + 2).join("\n"))) && pat.regex.test(context))) {
+                // Deduplicate: only flag once per match block
+                if (!issues.some((x) => x.file === filePath && Math.abs(x.line - (i + 1)) < 3 && x.kind === pat.name)) {
+                    issues.push({ file: filePath, line: i + 1, kind: pat.name, message: pat.message, severity: pat.severity });
+                }
+            }
+        }
+    }
+    // Detect mixed strategies: both callbacks and promises in same file
+    const hasCallbacks = /\bcallback\s*\(|function\s*\(\s*err\b/.test(content);
+    const hasPromises = /\.then\s*\(|new\s+Promise\s*\(|async\s/.test(content);
+    if (hasCallbacks && hasPromises) {
+        issues.push({
+            file: filePath,
+            line: 1,
+            kind: "mixed-strategy",
+            message: "File mixes callback-style (err) and promise/async patterns — consider unifying",
+            severity: "low",
+        });
+    }
+    return issues;
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runExceptionConsistency(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges exception-consistency — Detect inconsistent exception handling
+
+Usage:
+  judges exception-consistency [dir]
+  judges exception-consistency src/ --severity high
+  judges exception-consistency --format json
+
+Options:
+  [dir]                 Directory to scan (default: .)
+  --severity <level>    Filter by minimum severity (high|medium|low)
+  --format json         JSON output
+  --help, -h            Show this help
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const severityFilter = argv.find((_a, i) => argv[i - 1] === "--severity") || "low";
+    const dir = argv.find((a) => !a.startsWith("-") && argv.indexOf(a) > 0) || ".";
+    const severityOrder = { high: 3, medium: 2, low: 1 };
+    const minSev = severityOrder[severityFilter] || 1;
+    const files = collectFiles(dir);
+    const allIssues = [];
+    for (const f of files) {
+        const issues = analyzeFile(f);
+        allIssues.push(...issues.filter((x) => severityOrder[x.severity] >= minSev));
+    }
+    allIssues.sort((a, b) => severityOrder[b.severity] - severityOrder[a.severity]);
+    if (format === "json") {
+        console.log(JSON.stringify({ issues: allIssues, filesScanned: files.length, timestamp: new Date().toISOString() }, null, 2));
+    }
+    else {
+        console.log(`\n  Exception Consistency — ${files.length} files scanned, ${allIssues.length} issue(s)\n  ──────────────────────────`);
+        if (allIssues.length === 0) {
+            console.log("  ✅ No inconsistent exception handling detected");
+        }
+        else {
+            const byKind = new Map();
+            for (const issue of allIssues) {
+                byKind.set(issue.kind, (byKind.get(issue.kind) || 0) + 1);
+            }
+            console.log("\n  Summary:");
+            for (const [kind, count] of byKind) {
+                console.log(`    ${kind}: ${count}`);
+            }
+            console.log("\n  Details:");
+            for (const issue of allIssues.slice(0, 50)) {
+                const icon = issue.severity === "high" ? "🔴" : issue.severity === "medium" ? "🟡" : "⚪";
+                console.log(`    ${icon} [${issue.severity}] ${issue.file}:${issue.line}`);
+                console.log(`        ${issue.message}`);
+            }
+            if (allIssues.length > 50) {
+                console.log(`\n    ... and ${allIssues.length - 50} more issue(s)`);
+            }
+        }
+        console.log("");
+    }
+}

package/dist/commands/exec-report.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Exec report — executive security dashboard.
+ * Generates non-technical HTML report with risk posture summary,
+ * recurring issue trends, severity distribution, and remediation guidance.
+ *
+ * All data local.
+ */
+export declare function runExecReport(argv: string[]): void;