@kevinrabun/judges 3.115.0 → 3.115.2

package/dist/commands/setup-wizard.js

@@ -0,0 +1,174 @@
+/**
+ * Setup-wizard — Interactive guided setup for new users and teams.
+ */
+import { writeFileSync, existsSync, mkdirSync } from "fs";
+import { join, dirname } from "path";
+// ─── Presets ────────────────────────────────────────────────────────────────
+const SETUP_PRESETS = {
+    "quick-start": {
+        description: "Minimal setup — evaluate files with sensible defaults",
+        config: { preset: "lenient", format: "text" },
+    },
+    "security-first": {
+        description: "Focus on security findings — strict severity thresholds",
+        config: { preset: "security-only", minSeverity: "medium", failOnFindings: true },
+    },
+    "ci-integration": {
+        description: "Optimized for CI/CD pipelines — JSON output, quality gates",
+        config: { preset: "strict", format: "sarif", failOnFindings: true, minScore: 70 },
+    },
+    "team-review": {
+        description: "Team-oriented — shared config, audit logging, PR summaries",
+        config: { preset: "strict", format: "markdown" },
+    },
+    compliance: {
+        description: "Compliance-focused — full audit trail, evidence collection",
+        config: { preset: "compliance", format: "sarif" },
+    },
+};
+// ─── CI Templates ───────────────────────────────────────────────────────────
+function generateGitHubActions(profile) {
+    return `name: Judges Code Review
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - run: npx @kevinrabun/judges-cli eval . --preset ${profile.preset} --format sarif --fail-on-findings
+`;
+}
+function generateGitLabCI(profile) {
+    return `judges-review:
+  image: node:20
+  script:
+    - npx @kevinrabun/judges-cli eval . --preset ${profile.preset} --format sarif --fail-on-findings
+  only:
+    - merge_requests
+    - main
+`;
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runSetupWizard(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges setup-wizard — Guided setup for new users
+
+Usage:
+  judges setup-wizard                            Interactive setup
+  judges setup-wizard --profile quick-start      Use preset profile
+  judges setup-wizard --list-profiles            List available profiles
+  judges setup-wizard --generate-ci github-actions  Generate CI config
+  judges setup-wizard --init                     Create .judgesrc and CI config
+
+Profiles:
+  quick-start       Minimal setup with sensible defaults
+  security-first    Security-focused with strict thresholds
+  ci-integration    Optimized for CI/CD pipelines
+  team-review       Team-oriented with shared config
+  compliance        Full compliance with audit trails
+
+Options:
+  --profile <name>       Select a setup profile
+  --list-profiles        List all available profiles
+  --generate-ci <type>   Generate CI config (github-actions, gitlab-ci)
+  --init                 Write configuration files
+  --output <dir>         Output directory (default: current)
+  --format json          JSON output
+  --help, -h             Show this help
+
+Generates .judgesrc configuration and CI workflow files
+based on your team's needs. All data stays local.
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    if (argv.includes("--list-profiles")) {
+        if (format === "json") {
+            console.log(JSON.stringify(SETUP_PRESETS, null, 2));
+            return;
+        }
+        console.log("\n  Setup Profiles\n  ═════════════════════════════");
+        for (const [name, info] of Object.entries(SETUP_PRESETS)) {
+            console.log(`    ${name.padEnd(20)} ${info.description}`);
+        }
+        console.log();
+        return;
+    }
+    const profileName = argv.find((_a, i) => argv[i - 1] === "--profile") || "quick-start";
+    const ciType = argv.find((_a, i) => argv[i - 1] === "--generate-ci");
+    const outputDir = argv.find((_a, i) => argv[i - 1] === "--output") || ".";
+    const doInit = argv.includes("--init");
+    const preset = SETUP_PRESETS[profileName];
+    if (!preset) {
+        console.error(`Error: Unknown profile '${profileName}'. Use --list-profiles to see options.`);
+        process.exitCode = 1;
+        return;
+    }
+    const profile = {
+        preset: profileName,
+        ciSystem: ciType || "github-actions",
+        languages: [],
+        strictness: profileName === "security-first" || profileName === "compliance" ? "strict" : "moderate",
+        features: [],
+    };
+    if (ciType) {
+        const ciConfig = ciType === "gitlab-ci" ? generateGitLabCI(profile) : generateGitHubActions(profile);
+        console.log(ciConfig);
+        return;
+    }
+    if (doInit) {
+        // Write .judgesrc
+        const rcPath = join(outputDir, ".judgesrc");
+        if (!existsSync(rcPath)) {
+            writeFileSync(rcPath, JSON.stringify(preset.config, null, 2), "utf-8");
+            console.log(`Created ${rcPath}`);
+        }
+        else {
+            console.log(`${rcPath} already exists, skipping.`);
+        }
+        // Write CI config
+        const ciDir = join(outputDir, ".github", "workflows");
+        const ciPath = join(ciDir, "judges-review.yml");
+        if (!existsSync(ciPath)) {
+            mkdirSync(dirname(ciPath), { recursive: true });
+            writeFileSync(ciPath, generateGitHubActions(profile), "utf-8");
+            console.log(`Created ${ciPath}`);
+        }
+        else {
+            console.log(`${ciPath} already exists, skipping.`);
+        }
+        console.log("\nSetup complete! Next steps:");
+        console.log("  1. Run: npx @kevinrabun/judges-cli eval <file>");
+        console.log("  2. Customize .judgesrc for your needs");
+        console.log("  3. Commit the CI workflow for automated reviews");
+        return;
+    }
+    // Show setup summary
+    if (format === "json") {
+        console.log(JSON.stringify({ profile: profileName, ...preset }, null, 2));
+        return;
+    }
+    console.log(`\n  Setup Wizard — ${profileName}\n  ═════════════════════════════`);
+    console.log(`    Profile: ${profileName}`);
+    console.log(`    Description: ${preset.description}`);
+    console.log(`    Configuration:`);
+    for (const [key, value] of Object.entries(preset.config)) {
+        console.log(`      ${key}: ${value}`);
+    }
+    console.log();
+    console.log("  To apply this configuration:");
+    console.log(`    judges setup-wizard --profile ${profileName} --init`);
+    console.log();
+    console.log("  To generate CI config:");
+    console.log(`    judges setup-wizard --profile ${profileName} --generate-ci github-actions`);
+    console.log();
+}

package/dist/commands/severity-tune.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Severity-tune — Auto-calibrate severity levels based on project patterns.
+ */
+export declare function runSeverityTune(argv: string[]): void;

package/dist/commands/severity-tune.js

@@ -0,0 +1,208 @@
+/**
+ * Severity-tune — Auto-calibrate severity levels based on project patterns.
+ */
+import { readFileSync, readdirSync, statSync } from "fs";
+import { join, extname } from "path";
+// ─── Patterns with default severity ────────────────────────────────────────
+const TUNE_PATTERNS = [
+    {
+        name: "hardcoded-secret",
+        severity: "critical",
+        regex: /(?:password|secret|api_key|token)\s*[:=]\s*["'][^"']{8,}/i,
+    },
+    { name: "eval-usage", severity: "critical", regex: /\beval\s*\(/ },
+    { name: "sql-concat", severity: "critical", regex: /(?:query|execute)\s*\(\s*["'`].*\+/ },
+    { name: "xss-risk", severity: "high", regex: /innerHTML\s*=|document\.write\s*\(/ },
+    { name: "command-injection", severity: "critical", regex: /exec(?:Sync)?\s*\(\s*`[^`]*\$\{/ },
+    { name: "empty-catch", severity: "medium", regex: /catch\s*\([^)]*\)\s*\{\s*\}/ },
+    { name: "any-type", severity: "medium", regex: /:\s*any\b/ },
+    { name: "unsafe-regex", severity: "high", regex: /new\s+RegExp\s*\([^)]*\+/ },
+    { name: "deprecated-api", severity: "medium", regex: /new\s+Buffer\s*\(|\.substr\s*\(/ },
+    { name: "console-log", severity: "low", regex: /console\.log\s*\(/ },
+    { name: "todo-fixme", severity: "low", regex: /\/\/\s*(?:TODO|FIXME|HACK)\b/i },
+    { name: "magic-number", severity: "low", regex: /(?:if|return|===?)\s*(?<!\w)\d{3,}(?!\w)/ },
+    { name: "long-line", severity: "low", regex: /^.{200,}$/ },
+    { name: "nested-ternary", severity: "medium", regex: /[?][^:]*[?]/ },
+    { name: "god-function", severity: "medium", regex: /^(?:export\s+)?(?:async\s+)?function\s+\w+/ },
+];
+// ─── Helpers ────────────────────────────────────────────────────────────────
+function collectSourceFiles(dir) {
+    const exts = new Set([".ts", ".js", ".tsx", ".jsx", ".py", ".java", ".go", ".rs", ".cs"]);
+    const files = [];
+    const skipDirs = new Set(["node_modules", ".git", "dist", "build", "coverage"]);
+    function walk(d) {
+        let entries;
+        try {
+            entries = readdirSync(d);
+        }
+        catch {
+            return;
+        }
+        for (const name of entries) {
+            if (skipDirs.has(name))
+                continue;
+            const full = join(d, name);
+            try {
+                const st = statSync(full);
+                if (st.isDirectory())
+                    walk(full);
+                else if (exts.has(extname(name)))
+                    files.push(full);
+            }
+            catch {
+                // skip
+            }
+        }
+    }
+    walk(dir);
+    return files;
+}
+function analyzeSeverity(files) {
+    const patternData = new Map();
+    for (const pat of TUNE_PATTERNS) {
+        patternData.set(pat.name, { occurrences: 0, files: new Set(), severity: pat.severity });
+    }
+    for (const filePath of files) {
+        let content;
+        try {
+            content = readFileSync(filePath, "utf-8");
+        }
+        catch {
+            continue;
+        }
+        const lines = content.split("\n");
+        for (const pat of TUNE_PATTERNS) {
+            // Special handling for god-function: count functions > 80 lines
+            if (pat.name === "god-function") {
+                let funcCount = 0;
+                let inFunc = false;
+                let braceDepth = 0;
+                let funcLines = 0;
+                for (const line of lines) {
+                    if (pat.regex.test(line) && !inFunc) {
+                        inFunc = true;
+                        braceDepth = 0;
+                        funcLines = 0;
+                    }
+                    if (inFunc) {
+                        funcLines++;
+                        braceDepth += (line.match(/\{/g) || []).length;
+                        braceDepth -= (line.match(/\}/g) || []).length;
+                        if (braceDepth <= 0 && funcLines > 1) {
+                            if (funcLines > 80)
+                                funcCount++;
+                            inFunc = false;
+                        }
+                    }
+                }
+                if (funcCount > 0) {
+                    const data = patternData.get(pat.name);
+                    data.occurrences += funcCount;
+                    data.files.add(filePath);
+                }
+                continue;
+            }
+            let hitCount = 0;
+            for (const line of lines) {
+                if (pat.regex.test(line))
+                    hitCount++;
+            }
+            if (hitCount > 0) {
+                const data = patternData.get(pat.name);
+                data.occurrences += hitCount;
+                data.files.add(filePath);
+            }
+        }
+    }
+    // Generate tuning recommendations
+    const recommendations = [];
+    const fileCount = files.length;
+    for (const [name, data] of patternData) {
+        if (data.occurrences === 0)
+            continue;
+        const filePercent = fileCount > 0 ? (data.files.size / fileCount) * 100 : 0;
+        let suggestedSeverity = data.severity;
+        let reason = "Current severity is appropriate";
+        // If a pattern appears in >50% of files, it may be a team convention — consider lowering severity
+        if (filePercent > 50 && data.severity !== "low") {
+            suggestedSeverity = data.severity === "critical" ? "high" : data.severity === "high" ? "medium" : "low";
+            reason = `Appears in ${Math.round(filePercent)}% of files — may be a project norm. Consider lowering severity.`;
+        }
+        // If a critical/high pattern appears very rarely, keep it — it's genuinely concerning
+        else if (data.occurrences <= 2 && (data.severity === "critical" || data.severity === "high")) {
+            reason = "Rare occurrence — keep current severity to catch regressions";
+        }
+        // If low-severity pattern is pervasive, suggest ignoring
+        else if (data.severity === "low" && data.occurrences > 100) {
+            suggestedSeverity = "info";
+            reason = `${data.occurrences} occurrences — consider ignoring to reduce noise`;
+        }
+        if (suggestedSeverity !== data.severity) {
+            recommendations.push({
+                pattern: name,
+                currentSeverity: data.severity,
+                occurrences: data.occurrences,
+                filesAffected: data.files.size,
+                suggestedSeverity,
+                reason,
+            });
+        }
+    }
+    recommendations.sort((a, b) => b.occurrences - a.occurrences);
+    const summary = recommendations.length === 0
+        ? "All severity levels appear well-calibrated for this project."
+        : `${recommendations.length} severity adjustments recommended to reduce noise and improve signal.`;
+    return {
+        filesScanned: files.length,
+        patternsAnalyzed: TUNE_PATTERNS.length,
+        tuningRecommendations: recommendations,
+        summary,
+    };
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runSeverityTune(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges severity-tune — Auto-calibrate severity levels for your project
+
+Usage:
+  judges severity-tune [dir]                  Analyze and recommend adjustments
+  judges severity-tune --format json          JSON output
+
+Options:
+  [dir]                   Target directory (default: .)
+  --format json           JSON output
+  --help, -h              Show this help
+
+Analyzes your codebase to determine if default severity levels match your
+project's patterns. Recommends adjustments to reduce alert fatigue for
+pervasive patterns while maintaining sensitivity for genuine issues.
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const dir = argv.find((a) => !a.startsWith("-") && a !== "severity-tune" && argv[argv.indexOf(a) - 1] !== "--format") || ".";
+    const files = collectSourceFiles(dir);
+    if (files.length === 0) {
+        console.log("No source files found.");
+        return;
+    }
+    const result = analyzeSeverity(files);
+    if (format === "json") {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    console.log(`\n  Severity Tune\n  ─────────────────────────────`);
+    console.log(`    Files scanned: ${result.filesScanned}`);
+    console.log(`    Patterns analyzed: ${result.patternsAnalyzed}`);
+    console.log(`\n    💡 ${result.summary}`);
+    if (result.tuningRecommendations.length > 0) {
+        console.log("\n    Recommendations:");
+        for (const rec of result.tuningRecommendations) {
+            console.log(`\n      ${rec.pattern}: ${rec.currentSeverity} → ${rec.suggestedSeverity}`);
+            console.log(`        ${rec.occurrences} occurrences in ${rec.filesAffected} files`);
+            console.log(`        ${rec.reason}`);
+        }
+    }
+    console.log();
+}

package/dist/commands/sla-track.d.ts

@@ -0,0 +1,56 @@
+/**
+ * SLA tracking — define response-time SLAs per severity and track
+ * violation rates across runs.
+ *
+ * Data is stored locally in .judges-sla.json — no remote storage.
+ */
+import type { Finding } from "../types.js";
+export interface SlaPolicy {
+    severity: string;
+    /** Max hours to first response/triage */
+    responseHours: number;
+    /** Max hours to remediation */
+    resolutionHours: number;
+}
+export interface SlaEntry {
+    findingId: string;
+    ruleId: string;
+    severity: string;
+    title: string;
+    firstSeenIso: string;
+    triagedIso?: string;
+    resolvedIso?: string;
+    status: "open" | "triaged" | "resolved";
+}
+interface SlaDb {
+    policies: SlaPolicy[];
+    entries: SlaEntry[];
+}
+export declare function trackFindings(findings: Finding[], dbPath?: string): SlaDb;
+export declare function triageEntry(id: string, dbPath?: string): void;
+export declare function resolveEntry(id: string, dbPath?: string): void;
+export interface SlaViolation {
+    findingId: string;
+    ruleId: string;
+    severity: string;
+    type: "response" | "resolution";
+    elapsedHours: number;
+    allowedHours: number;
+}
+export declare function checkViolations(dbPath?: string): SlaViolation[];
+export declare function getSlaStats(dbPath?: string): {
+    total: number;
+    open: number;
+    triaged: number;
+    resolved: number;
+    violations: number;
+    bySeverity: Record<string, {
+        total: number;
+        open: number;
+        violations: number;
+    }>;
+    avgResponseHours: number;
+    avgResolutionHours: number;
+};
+export declare function runSlaTrack(argv: string[]): Promise<void>;
+export {};