@kevinrabun/judges 3.115.0 → 3.115.2

package/dist/commands/security-maturity.js

@@ -0,0 +1,312 @@
+/**
+ * Security maturity — assesses organization's security posture
+ * maturity level based on Judges usage and finding data.
+ *
+ * All analysis from local files — no external data.
+ */
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+const MATURITY_LABELS = ["Initial", "Developing", "Defined", "Managed", "Optimizing"];
+// ─── Core ───────────────────────────────────────────────────────────────────
+function fileExists(path) {
+    return existsSync(path);
+}
+function loadJsonSafe(path, fallback) {
+    if (!existsSync(path))
+        return fallback;
+    try {
+        return JSON.parse(readFileSync(path, "utf-8"));
+    }
+    catch {
+        return fallback;
+    }
+}
+function assessMaturity() {
+    const dimensions = [];
+    // 1. Scanning adoption
+    {
+        let level = 1;
+        const evidence = [];
+        const nextSteps = [];
+        if (fileExists(".judgesrc")) {
+            level = 2;
+            evidence.push(".judgesrc configured");
+        }
+        if (fileExists(".judges-scores")) {
+            level = 3;
+            evidence.push("Developer scoring active");
+        }
+        if (fileExists(join(".judges-leaderboard", "leaderboard.json"))) {
+            level = 4;
+            evidence.push("Team leaderboard active");
+        }
+        if (fileExists(join(".judges-quality-gate", "policy.json"))) {
+            level = 5;
+            evidence.push("Quality gate policy set");
+        }
+        if (level < 2)
+            nextSteps.push("Configure .judgesrc with team presets");
+        if (level < 3)
+            nextSteps.push("Enable developer scoring with `judges dev-score`");
+        if (level < 4)
+            nextSteps.push("Set up team leaderboard with `judges team-leaderboard`");
+        if (level < 5)
+            nextSteps.push("Configure quality gate policy with `judges pr-quality-gate --set-policy`");
+        dimensions.push({
+            name: "Scanning Adoption",
+            level,
+            maxLevel: 5,
+            description: "How widely Judges is used across the team",
+            evidence,
+            nextSteps,
+        });
+    }
+    // 2. Finding management
+    {
+        let level = 1;
+        const evidence = [];
+        const nextSteps = [];
+        if (fileExists(".judges-suppressions.json")) {
+            level = 2;
+            evidence.push("Suppressions configured");
+        }
+        if (fileExists(join(".judges-audit-trail", "trail.json"))) {
+            level = 3;
+            evidence.push("Audit trail active");
+        }
+        if (fileExists(".judges-votes.json")) {
+            level = 4;
+            evidence.push("Consensus voting enabled");
+        }
+        if (fileExists(join(".judges-auto-fix", "fix-history.json"))) {
+            level = 5;
+            evidence.push("Auto-fix suggestions used");
+        }
+        if (level < 2)
+            nextSteps.push("Configure finding suppressions with `judges suppress`");
+        if (level < 3)
+            nextSteps.push("Enable audit trail with `judges audit-trail`");
+        if (level < 4)
+            nextSteps.push("Set up consensus voting with `judges vote`");
+        if (level < 5)
+            nextSteps.push("Use auto-fix suggestions with `judges auto-fix`");
+        dimensions.push({
+            name: "Finding Management",
+            level,
+            maxLevel: 5,
+            description: "How findings are triaged, tracked, and resolved",
+            evidence,
+            nextSteps,
+        });
+    }
+    // 3. Compliance & governance
+    {
+        let level = 1;
+        const evidence = [];
+        const nextSteps = [];
+        if (fileExists(join(".judges-reg-watch", "watch.json")) || fileExists(".judges-reg-watch.json")) {
+            level = 2;
+            evidence.push("Regulatory watch configured");
+        }
+        if (fileExists(".judges-policy-audit.json")) {
+            level = 3;
+            evidence.push("Policy audit active");
+        }
+        if (fileExists(join(".judges-audit-bundle", "manifest.json"))) {
+            level = 4;
+            evidence.push("Audit bundles generated");
+        }
+        const costData = loadJsonSafe(join(".judges-cost-forecast", "history.json"), {
+            snapshots: [],
+        });
+        if (costData.snapshots.length > 0) {
+            level = 5;
+            evidence.push("Cost forecasting active");
+        }
+        if (level < 2)
+            nextSteps.push("Set up regulatory watch with `judges reg-watch`");
+        if (level < 3)
+            nextSteps.push("Run policy audit with `judges policy-audit`");
+        if (level < 4)
+            nextSteps.push("Generate audit bundles with `judges audit-bundle`");
+        if (level < 5)
+            nextSteps.push("Track costs with `judges cost-forecast`");
+        dimensions.push({
+            name: "Compliance & Governance",
+            level,
+            maxLevel: 5,
+            description: "Regulatory compliance and audit readiness",
+            evidence,
+            nextSteps,
+        });
+    }
+    // 4. Team collaboration
+    {
+        let level = 1;
+        const evidence = [];
+        const nextSteps = [];
+        if (fileExists(".judges-correlations.json")) {
+            level = 2;
+            evidence.push("Finding correlation active");
+        }
+        if (fileExists(".judges-digest.json")) {
+            level = 3;
+            evidence.push("Digest reports active");
+        }
+        if (fileExists(join(".judges-shared-rules"))) {
+            level = 4;
+            evidence.push("Rule sharing enabled");
+        }
+        if (fileExists(join(".judges-patterns"))) {
+            level = 5;
+            evidence.push("Pattern registry active");
+        }
+        if (level < 2)
+            nextSteps.push("Enable correlation with `judges correlate`");
+        if (level < 3)
+            nextSteps.push("Set up digests with `judges digest`");
+        if (level < 4)
+            nextSteps.push("Share rules with `judges rule-share`");
+        if (level < 5)
+            nextSteps.push("Build pattern registry with `judges pattern-registry`");
+        dimensions.push({
+            name: "Team Collaboration",
+            level,
+            maxLevel: 5,
+            description: "Knowledge sharing and team review processes",
+            evidence,
+            nextSteps,
+        });
+    }
+    // 5. AI-specific readiness
+    {
+        let level = 1;
+        const evidence = [];
+        const nextSteps = [];
+        if (fileExists(".judges-model-risk.json")) {
+            level = 2;
+            evidence.push("Model risk profiling active");
+        }
+        if (fileExists(join(".judges-model-trust", "trust-history.json"))) {
+            level = 3;
+            evidence.push("AI model trust scoring active");
+        }
+        if (fileExists(join(".judges-prompt-audit", "audit-history.json"))) {
+            level = 4;
+            evidence.push("Prompt injection auditing active");
+        }
+        if (fileExists(join(".judges-learn"))) {
+            level = 5;
+            evidence.push("Developer learning paths active");
+        }
+        if (level < 2)
+            nextSteps.push("Profile AI model risks with `judges model-risk`");
+        if (level < 3)
+            nextSteps.push("Score AI model trust with `judges ai-model-trust`");
+        if (level < 4)
+            nextSteps.push("Audit for prompt injection with `judges ai-prompt-audit`");
+        if (level < 5)
+            nextSteps.push("Set up learning paths with `judges learn`");
+        dimensions.push({
+            name: "AI Readiness",
+            level,
+            maxLevel: 5,
+            description: "AI-specific code review maturity",
+            evidence,
+            nextSteps,
+        });
+    }
+    // Overall
+    const avgLevel = Math.round(dimensions.reduce((s, d) => s + d.level, 0) / dimensions.length);
+    const score = Math.round((dimensions.reduce((s, d) => s + d.level, 0) / (dimensions.length * 5)) * 100);
+    return {
+        overallLevel: avgLevel,
+        overallLabel: MATURITY_LABELS[avgLevel - 1] || "Unknown",
+        dimensions,
+        score,
+        timestamp: new Date().toISOString(),
+    };
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runSecurityMaturity(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges security-maturity — Security posture maturity assessment
+
+Usage:
+  judges security-maturity
+  judges security-maturity --dimension "Scanning Adoption"
+  judges security-maturity --roadmap
+
+Options:
+  --dimension <name>    Show details for a specific dimension
+  --roadmap             Show prioritized improvement roadmap
+  --format json         JSON output
+  --help, -h            Show this help
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const assessment = assessMaturity();
+    // Single dimension
+    const dimName = argv.find((_a, i) => argv[i - 1] === "--dimension");
+    if (dimName) {
+        const dim = assessment.dimensions.find((d) => d.name.toLowerCase().includes(dimName.toLowerCase()));
+        if (!dim) {
+            console.error(`  Dimension not found. Available: ${assessment.dimensions.map((d) => d.name).join(", ")}`);
+            return;
+        }
+        if (format === "json") {
+            console.log(JSON.stringify(dim, null, 2));
+        }
+        else {
+            console.log(`\n  ${dim.name} — Level ${dim.level}/${dim.maxLevel} (${MATURITY_LABELS[dim.level - 1]})`);
+            console.log(`  ──────────────────────────`);
+            console.log(`  ${dim.description}`);
+            if (dim.evidence.length) {
+                console.log(`\n  Evidence:`);
+                for (const e of dim.evidence)
+                    console.log(`    ✅ ${e}`);
+            }
+            if (dim.nextSteps.length) {
+                console.log(`\n  Next steps:`);
+                for (const s of dim.nextSteps)
+                    console.log(`    → ${s}`);
+            }
+            console.log("");
+        }
+        return;
+    }
+    // Roadmap
+    if (argv.includes("--roadmap")) {
+        const allSteps = assessment.dimensions
+            .sort((a, b) => a.level - b.level)
+            .flatMap((d) => d.nextSteps.map((s) => ({ dimension: d.name, level: d.level, step: s })));
+        if (format === "json") {
+            console.log(JSON.stringify(allSteps, null, 2));
+        }
+        else {
+            console.log(`\n  Security Maturity Roadmap\n  ──────────────────────────`);
+            console.log(`  Current: Level ${assessment.overallLevel} (${assessment.overallLabel}) — ${assessment.score}/100\n`);
+            for (const s of allSteps) {
+                console.log(`    [L${s.level}] ${s.dimension.padEnd(25)} → ${s.step}`);
+            }
+            console.log("");
+        }
+        return;
+    }
+    // Full assessment
+    if (format === "json") {
+        console.log(JSON.stringify(assessment, null, 2));
+    }
+    else {
+        console.log(`\n  Security Maturity Assessment`);
+        console.log(`  Overall: Level ${assessment.overallLevel}/5 (${assessment.overallLabel}) — Score: ${assessment.score}/100`);
+        console.log(`  ──────────────────────────`);
+        for (const d of assessment.dimensions) {
+            const bar = "█".repeat(d.level) + "░".repeat(d.maxLevel - d.level);
+            console.log(`    ${d.name.padEnd(25)} ${bar} ${d.level}/${d.maxLevel} (${MATURITY_LABELS[d.level - 1]})`);
+        }
+        console.log(`\n  Run --roadmap to see improvement steps\n`);
+    }
+}

package/dist/commands/security-theater.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Security-theater — detect security-looking code that provides no actual protection.
+ */
+export declare function runSecurityTheater(argv: string[]): void;

package/dist/commands/security-theater.js

@@ -0,0 +1,278 @@
+/**
+ * Security-theater — detect security-looking code that provides no actual protection.
+ */
+import { readFileSync, readdirSync, statSync } from "fs";
+import { join, extname } from "path";
+// ─── File Collection ────────────────────────────────────────────────────────
+const CODE_EXTS = new Set([".ts", ".tsx", ".js", ".jsx", ".py", ".java", ".go", ".cs"]);
+function collectFiles(dir, max = 300) {
+    const files = [];
+    function walk(d) {
+        if (files.length >= max)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(d);
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (files.length >= max)
+                return;
+            if (e.startsWith(".") || e === "node_modules" || e === "dist" || e === "build")
+                continue;
+            const full = join(d, e);
+            try {
+                if (statSync(full).isDirectory())
+                    walk(full);
+                else if (CODE_EXTS.has(extname(full)))
+                    files.push(full);
+            }
+            catch {
+                /* skip */
+            }
+        }
+    }
+    walk(dir);
+    return files;
+}
+// ─── Analysis ───────────────────────────────────────────────────────────────
+function analyzeFile(filepath) {
+    const issues = [];
+    let content;
+    try {
+        content = readFileSync(filepath, "utf-8");
+    }
+    catch {
+        return issues;
+    }
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const trimmed = line.trim();
+        if (trimmed.startsWith("//") || trimmed.startsWith("*") || trimmed.startsWith("/*"))
+            continue;
+        // Weak password hashing
+        if (/(?:createHash|hashlib\.)\s*\(\s*['"](?:md5|sha1)['"]\s*\)/.test(line) &&
+            /password|passwd|pwd/i.test(lines.slice(Math.max(0, i - 3), i + 3).join(" "))) {
+            issues.push({
+                file: filepath,
+                line: i + 1,
+                issue: "Weak password hashing (MD5/SHA1)",
+                severity: "high",
+                detail: "MD5/SHA1 are not appropriate for password hashing — use bcrypt, scrypt, or argon2",
+            });
+        }
+        // Hardcoded encryption keys/IVs
+        if (/(?:key|iv|secret|password)\s*[:=]\s*['"][A-Za-z0-9+/=]{8,}['"]/.test(line) &&
+            /(?:cipher|encrypt|decrypt|crypto|aes|des)/i.test(lines.slice(Math.max(0, i - 5), i + 5).join(" "))) {
+            issues.push({
+                file: filepath,
+                line: i + 1,
+                issue: "Hardcoded encryption key or IV",
+                severity: "high",
+                detail: "Encryption keys/IVs must not be hardcoded — use environment variables or key management services",
+            });
+        }
+        // Wildcard CORS with auth
+        if (/['"]Access-Control-Allow-Origin['"]\s*[:,]\s*['"]\s*[*]\s*['"]/.test(line)) {
+            const nearby = lines.slice(i, Math.min(i + 10, lines.length)).join(" ");
+            if (/(?:authorization|cookie|credentials|auth)/i.test(nearby)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "CORS wildcard (*) with authentication",
+                    severity: "high",
+                    detail: "Access-Control-Allow-Origin: * combined with authentication bypasses same-origin policy protections",
+                });
+            }
+            else {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "CORS wildcard (*)",
+                    severity: "medium",
+                    detail: "CORS wildcard allows any origin — restrict to trusted domains unless truly public",
+                });
+            }
+        }
+        // CSRF token generated but never verified
+        if (/csrf[_-]?token|csrfToken|_csrf/i.test(line) && /generate|create|set|assign/i.test(line)) {
+            const fileContent = content;
+            if (!/csrf.*verif|verify.*csrf|csrf.*valid|csrfProtection|csurf/i.test(fileContent)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "CSRF token generated but never verified",
+                    severity: "high",
+                    detail: "CSRF tokens must be verified on the server side — generation alone provides no protection",
+                });
+            }
+        }
+        // Rate limiting that is too lenient
+        if (/rateLimit|rate[_-]?limit/i.test(line)) {
+            const context = lines.slice(i, Math.min(i + 5, lines.length)).join(" ");
+            const limitMatch = context.match(/(?:max|limit|windowMs|window)\s*[:=]\s*(\d+)/);
+            if (limitMatch) {
+                const val = parseInt(limitMatch[1], 10);
+                if (/max|limit/i.test(limitMatch[0]) && val >= 10000) {
+                    issues.push({
+                        file: filepath,
+                        line: i + 1,
+                        issue: "Ineffective rate limiting (limit too high)",
+                        severity: "medium",
+                        detail: `Rate limit of ${val} requests is too permissive to be protective`,
+                    });
+                }
+            }
+        }
+        // Validation without authorization
+        if (/(?:validate|sanitize|check)\s*\(\s*(?:req|request)/.test(line) || /(?:joi|yup|zod)\s*\./.test(line)) {
+            if (/(?:body|params|query)/.test(line)) {
+                const nearby = lines.slice(Math.max(0, i - 10), Math.min(i + 10, lines.length)).join(" ");
+                if (!/(?:auth|authorize|isAuthenticated|requireAuth|passport|jwt|token|session)/.test(nearby)) {
+                    issues.push({
+                        file: filepath,
+                        line: i + 1,
+                        issue: "Input validation without authorization check",
+                        severity: "medium",
+                        detail: "Validating input without checking authorization — an unauthenticated user could send valid-looking data",
+                    });
+                }
+            }
+        }
+        // Client-side only validation
+        if (/(?:disabled|readonly|hidden)\s*[=:]\s*(?:true|['"]true['"])/.test(line) &&
+            /(?:submit|form|action)/i.test(lines.slice(Math.max(0, i - 5), i + 5).join(" "))) {
+            issues.push({
+                file: filepath,
+                line: i + 1,
+                issue: "Client-side-only form restriction",
+                severity: "medium",
+                detail: "disabled/readonly/hidden form attributes can be bypassed — enforce restrictions server-side",
+            });
+        }
+        // Base64 used as encryption
+        if (/(?:btoa|atob|Buffer\.from\([^)]*,\s*['"]base64['"]|base64[_-]?encode|base64[_-]?decode)/i.test(line)) {
+            const nearby = lines.slice(Math.max(0, i - 3), i + 3).join(" ");
+            if (/(?:encrypt|secret|password|secure|protect|hide)/i.test(nearby)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "Base64 used as encryption",
+                    severity: "high",
+                    detail: "Base64 is encoding, not encryption — it provides zero confidentiality",
+                });
+            }
+        }
+        // SQL partial parameterization
+        if (/(?:query|execute|exec|raw)\s*\(/.test(line)) {
+            const context = lines.slice(i, Math.min(i + 3, lines.length)).join(" ");
+            if (/\$\{|\+\s*['"]/.test(context) && /[?$]/.test(context)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "Partially parameterized SQL query",
+                    severity: "high",
+                    detail: "Query mixes parameterized values with string concatenation — fully parameterize all inputs",
+                });
+            }
+        }
+        // Commented-out security controls
+        if (/^\s*\/\/\s*(?:app\.use\s*\(\s*(?:helmet|csrf|cors|rateLimit)|requireAuth|isAuthenticated|authorize)/.test(line)) {
+            issues.push({
+                file: filepath,
+                line: i + 1,
+                issue: "Commented-out security middleware",
+                severity: "high",
+                detail: "Security middleware is commented out — likely left disabled from debugging",
+            });
+        }
+        // JWT with 'none' algorithm
+        if (/algorithm[s]?\s*[:=]\s*\[?\s*['"]none['"]/i.test(line)) {
+            issues.push({
+                file: filepath,
+                line: i + 1,
+                issue: "JWT 'none' algorithm allowed",
+                severity: "high",
+                detail: "Allowing 'none' algorithm in JWT verification completely disables signature checking",
+            });
+        }
+        // Overly long JWT expiration
+        if (/expiresIn\s*[:=]\s*['"](\d+)([dh])['"]/.test(line)) {
+            const match = line.match(/expiresIn\s*[:=]\s*['"](\d+)([dh])['"]/);
+            if (match) {
+                const val = parseInt(match[1], 10);
+                const unit = match[2];
+                if ((unit === "d" && val > 30) || (unit === "h" && val > 720)) {
+                    issues.push({
+                        file: filepath,
+                        line: i + 1,
+                        issue: "JWT expiration too long",
+                        severity: "medium",
+                        detail: `Token expiration of ${val}${unit} is excessively long — shorter-lived tokens reduce blast radius of theft`,
+                    });
+                }
+            }
+        }
+    }
+    return issues;
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runSecurityTheater(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges security-theater — Detect security-looking code that provides no protection
+
+Usage:
+  judges security-theater [dir]
+  judges security-theater src/ --format json
+
+Options:
+  [dir]                 Directory to scan (default: .)
+  --format json         JSON output
+  --help, -h            Show this help
+
+Checks: weak password hashing, hardcoded keys/IVs, wildcard CORS with auth,
+unverified CSRF tokens, ineffective rate limiting, validation without auth,
+base64-as-encryption, partial SQL parameterization, commented-out security
+middleware, JWT 'none' algorithm, overly long JWT expiration.
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const dir = argv.find((a) => !a.startsWith("-") && argv.indexOf(a) > 0) || ".";
+    const files = collectFiles(dir);
+    const allIssues = [];
+    for (const f of files)
+        allIssues.push(...analyzeFile(f));
+    const highCount = allIssues.filter((i) => i.severity === "high").length;
+    const medCount = allIssues.filter((i) => i.severity === "medium").length;
+    const score = Math.max(0, 100 - highCount * 15 - medCount * 7 - allIssues.filter((i) => i.severity === "low").length * 3);
+    if (format === "json") {
+        console.log(JSON.stringify({
+            issues: allIssues,
+            score,
+            summary: { high: highCount, medium: medCount, total: allIssues.length },
+            timestamp: new Date().toISOString(),
+        }, null, 2));
+    }
+    else {
+        const badge = score >= 80 ? "✅ GENUINE SECURITY" : score >= 50 ? "⚠️  THEATER DETECTED" : "❌ SECURITY THEATER";
+        console.log(`\n  Security-Theater: ${badge} (${score}/100)\n  ─────────────────────────────`);
+        if (allIssues.length === 0) {
+            console.log("    No security theater detected.\n");
+            return;
+        }
+        for (const issue of allIssues.slice(0, 25)) {
+            const icon = issue.severity === "high" ? "🔴" : issue.severity === "medium" ? "🟡" : "🔵";
+            console.log(`    ${icon} ${issue.issue}`);
+            console.log(`        ${issue.file}:${issue.line}`);
+            console.log(`        ${issue.detail}`);
+        }
+        if (allIssues.length > 25)
+            console.log(`    ... and ${allIssues.length - 25} more`);
+        console.log(`\n    Total: ${allIssues.length} | High: ${highCount} | Medium: ${medCount} | Score: ${score}/100\n`);
+    }
+}

package/dist/commands/setup-wizard.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Setup-wizard — Interactive guided setup for new users and teams.
+ */
+export declare function runSetupWizard(argv: string[]): void;