@kevinrabun/judges 3.115.1 → 3.115.2

package/dist/commands/generate.js

@@ -0,0 +1,403 @@
+/**
+ * Secure code template generator — pre-hardened templates
+ * for common patterns with Judges findings pre-mitigated.
+ *
+ * All output is generated locally — no data transmitted.
+ */
+// ─── Template library ───────────────────────────────────────────────────────
+const TEMPLATE_LIBRARY = [
+    {
+        id: "express-api-route",
+        title: "Express API Route (Secure)",
+        framework: "express",
+        language: "typescript",
+        description: "Express REST endpoint with input validation, error handling, and rate limiting",
+        mitigations: [
+            "Input validation with schema check",
+            "Error handler hides internal details",
+            "Parameterized DB queries",
+            "Rate limiting per IP",
+        ],
+        code: `import { Router, Request, Response, NextFunction } from "express";
+
+const router = Router();
+
+// Simple in-memory rate limiter
+const hits = new Map<string, { count: number; reset: number }>();
+function rateLimit(limit: number, windowMs: number) {
+  return (req: Request, res: Response, next: NextFunction): void => {
+    const key = req.ip ?? "unknown";
+    const now = Date.now();
+    const entry = hits.get(key);
+    if (!entry || now > entry.reset) {
+      hits.set(key, { count: 1, reset: now + windowMs });
+      return next();
+    }
+    if (entry.count >= limit) {
+      res.status(429).json({ error: "Too many requests" });
+      return;
+    }
+    entry.count++;
+    next();
+  };
+}
+
+// Input validation
+function validateBody(body: unknown): body is { name: string; email: string } {
+  if (typeof body !== "object" || body === null) return false;
+  const b = body as Record<string, unknown>;
+  return typeof b.name === "string" && b.name.length <= 200
+      && typeof b.email === "string" && /^[^@]+@[^@]+$/.test(b.email);
+}
+
+router.post("/api/users", rateLimit(100, 60_000), (req: Request, res: Response) => {
+  if (!validateBody(req.body)) {
+    res.status(400).json({ error: "Invalid input" });
+    return;
+  }
+  // Use parameterized queries — never interpolate user input
+  // db.query("INSERT INTO users (name, email) VALUES ($1, $2)", [req.body.name, req.body.email]);
+  res.status(201).json({ ok: true });
+});
+
+// Centralized error handler — hides internals
+router.use((err: Error, _req: Request, res: Response, _next: NextFunction) => {
+  console.error(err); // log server-side only
+  res.status(500).json({ error: "Internal server error" });
+});
+
+export default router;`,
+    },
+    {
+        id: "react-auth-component",
+        title: "React Auth Component (Secure)",
+        framework: "react",
+        language: "typescript",
+        description: "React authentication form with CSRF protection and secure state management",
+        mitigations: [
+            "CSRF token included in form submission",
+            "Password field never logged or serialized",
+            "AuthN errors are generic — no user enumeration",
+            "State cleared on unmount",
+        ],
+        code: `import React, { useState, useCallback, useEffect } from "react";
+
+interface LoginFormProps {
+  csrfToken: string;
+  onLogin: (token: string) => void;
+}
+
+export function LoginForm({ csrfToken, onLogin }: LoginFormProps) {
+  const [email, setEmail] = useState("");
+  const [password, setPassword] = useState("");
+  const [error, setError] = useState<string | null>(null);
+  const [loading, setLoading] = useState(false);
+
+  // Clear sensitive state on unmount
+  useEffect(() => {
+    return () => {
+      setPassword("");
+    };
+  }, []);
+
+  const handleSubmit = useCallback(
+    async (e: React.FormEvent) => {
+      e.preventDefault();
+      setError(null);
+      setLoading(true);
+      try {
+        const resp = await fetch("/api/login", {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "X-CSRF-Token": csrfToken,
+          },
+          body: JSON.stringify({ email, password }),
+          credentials: "same-origin",
+        });
+        if (!resp.ok) {
+          // Generic error — prevents user enumeration
+          setError("Invalid email or password");
+          return;
+        }
+        const data = await resp.json();
+        onLogin(data.token);
+      } catch {
+        setError("Login failed. Please try again.");
+      } finally {
+        setLoading(false);
+        setPassword(""); // clear password from memory
+      }
+    },
+    [email, password, csrfToken, onLogin],
+  );
+
+  return (
+    <form onSubmit={handleSubmit}>
+      <label>Email
+        <input type="email" value={email} onChange={(e) => setEmail(e.target.value)} required />
+      </label>
+      <label>Password
+        <input type="password" value={password} onChange={(e) => setPassword(e.target.value)} required autoComplete="current-password" />
+      </label>
+      {error && <p role="alert">{error}</p>}
+      <button type="submit" disabled={loading}>{loading ? "Logging in…" : "Log In"}</button>
+    </form>
+  );
+}`,
+    },
+    {
+        id: "node-file-upload",
+        title: "Node.js File Upload (Secure)",
+        framework: "node",
+        language: "typescript",
+        description: "File upload handler with type checking, size limits, and path traversal prevention",
+        mitigations: [
+            "File type allowlist — rejects unexpected MIME types",
+            "Size limit enforced before writing",
+            "Sanitized filename prevents path traversal",
+            "Upload directory is outside web root",
+        ],
+        code: `import { randomUUID } from "crypto";
+import { join, extname } from "path";
+import { writeFileSync, mkdirSync, existsSync } from "fs";
+
+const UPLOAD_DIR = "/var/uploads"; // outside web root
+const MAX_SIZE = 5 * 1024 * 1024; // 5 MB
+const ALLOWED_TYPES = new Set(["image/png", "image/jpeg", "image/gif", "application/pdf"]);
+const ALLOWED_EXTS = new Set([".png", ".jpg", ".jpeg", ".gif", ".pdf"]);
+
+interface UploadResult {
+  ok: boolean;
+  id?: string;
+  error?: string;
+}
+
+export function handleUpload(
+  filename: string,
+  contentType: string,
+  data: Buffer,
+): UploadResult {
+  // 1. Size check
+  if (data.length > MAX_SIZE) return { ok: false, error: "File too large" };
+
+  // 2. MIME type check
+  if (!ALLOWED_TYPES.has(contentType)) return { ok: false, error: "File type not allowed" };
+
+  // 3. Extension check (defense in depth)
+  const ext = extname(filename).toLowerCase();
+  if (!ALLOWED_EXTS.has(ext)) return { ok: false, error: "File extension not allowed" };
+
+  // 4. Generate safe filename — never use user-supplied name directly
+  const id = randomUUID();
+  const safeName = id + ext;
+  const dest = join(UPLOAD_DIR, safeName);
+
+  // 5. Ensure directory exists
+  if (!existsSync(UPLOAD_DIR)) mkdirSync(UPLOAD_DIR, { recursive: true });
+
+  // 6. Write file
+  writeFileSync(dest, data);
+  return { ok: true, id };
+}`,
+    },
+    {
+        id: "python-flask-api",
+        title: "Flask API Endpoint (Secure)",
+        framework: "flask",
+        language: "python",
+        description: "Flask REST endpoint with CORS, input validation, and secure error responses",
+        mitigations: [
+            "CORS restricted to allowed origins",
+            "Input validated before processing",
+            "Errors return generic messages",
+            "SQL parameterized via SQLAlchemy",
+        ],
+        code: `from flask import Flask, request, jsonify
+from flask_cors import CORS
+
+app = Flask(__name__)
+CORS(app, origins=["https://app.example.com"])  # restrict origins
+
+@app.route("/api/items", methods=["POST"])
+def create_item():
+    data = request.get_json(silent=True)
+    if not data:
+        return jsonify({"error": "Invalid JSON"}), 400
+
+    name = data.get("name", "")
+    if not isinstance(name, str) or len(name) > 200:
+        return jsonify({"error": "Invalid input"}), 400
+
+    # Use parameterized queries — never f-strings with user input
+    # db.session.execute(text("INSERT INTO items (name) VALUES (:name)"), {"name": name})
+    return jsonify({"ok": True}), 201
+
+@app.errorhandler(Exception)
+def handle_error(e):
+    app.logger.exception("Request error")  # log server-side
+    return jsonify({"error": "Internal server error"}), 500
+`,
+    },
+    {
+        id: "go-http-handler",
+        title: "Go HTTP Handler (Secure)",
+        framework: "net/http",
+        language: "go",
+        description: "Go HTTP handler with timeout, input validation, and secure headers",
+        mitigations: [
+            "Read/write timeouts prevent slowloris",
+            "Request body size limited",
+            "Security headers set on every response",
+            "Input validation before processing",
+        ],
+        code: `package main
+
+import (
+\t"encoding/json"
+\t"log"
+\t"net/http"
+\t"time"
+)
+
+type CreateRequest struct {
+\tName  string \`json:"name"\`
+\tEmail string \`json:"email"\`
+}
+
+func securityHeaders(next http.Handler) http.Handler {
+\treturn http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+\t\tw.Header().Set("X-Content-Type-Options", "nosniff")
+\t\tw.Header().Set("X-Frame-Options", "DENY")
+\t\tw.Header().Set("Content-Security-Policy", "default-src 'self'")
+\t\tnext.ServeHTTP(w, r)
+\t})
+}
+
+func createHandler(w http.ResponseWriter, r *http.Request) {
+\tif r.Method != http.MethodPost {
+\t\thttp.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+\t\treturn
+\t}
+
+\t// Limit request body size
+\tr.Body = http.MaxBytesReader(w, r.Body, 1<<20) // 1 MB
+
+\tvar req CreateRequest
+\tif err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+\t\thttp.Error(w, "Invalid input", http.StatusBadRequest)
+\t\treturn
+\t}
+
+\tif len(req.Name) == 0 || len(req.Name) > 200 {
+\t\thttp.Error(w, "Invalid name", http.StatusBadRequest)
+\t\treturn
+\t}
+
+\tw.Header().Set("Content-Type", "application/json")
+\tjson.NewEncoder(w).Encode(map[string]bool{"ok": true})
+}
+
+func main() {
+\tmux := http.NewServeMux()
+\tmux.HandleFunc("/api/create", createHandler)
+
+\tsrv := &http.Server{
+\t\tAddr:         ":8080",
+\t\tHandler:      securityHeaders(mux),
+\t\tReadTimeout:  5 * time.Second,
+\t\tWriteTimeout: 10 * time.Second,
+\t\tIdleTimeout:  120 * time.Second,
+\t}
+\tlog.Fatal(srv.ListenAndServe())
+}
+`,
+    },
+];
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runGenerate(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges generate — Secure code template generator
+
+Usage:
+  judges generate --list
+  judges generate --template express-api-route
+  judges generate --template express-api-route --out ./src/routes/users.ts
+  judges generate --lang typescript
+  judges generate --framework flask
+
+Options:
+  --list                  List all available templates
+  --template <id>         Generate a specific template
+  --lang <language>       Filter templates by language
+  --framework <name>      Filter templates by framework
+  --out <path>            Write template to file (stdout if omitted)
+  --format json           JSON output
+  --help, -h              Show this help
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const lang = argv.find((_a, i) => argv[i - 1] === "--lang");
+    const framework = argv.find((_a, i) => argv[i - 1] === "--framework");
+    // Filter
+    let templates = TEMPLATE_LIBRARY;
+    if (lang)
+        templates = templates.filter((t) => t.language === lang.toLowerCase());
+    if (framework)
+        templates = templates.filter((t) => t.framework === framework.toLowerCase());
+    // List
+    if (argv.includes("--list") || !argv.find((_a, i) => argv[i - 1] === "--template")) {
+        if (format === "json") {
+            console.log(JSON.stringify(templates.map(({ code: _c, ...rest }) => rest), null, 2));
+        }
+        else {
+            console.log(`\n  Secure Code Templates (${templates.length})\n  ──────────────────────────`);
+            for (const t of templates) {
+                console.log(`    ${t.id.padEnd(25)} ${t.language.padEnd(12)} ${t.framework.padEnd(10)} ${t.title}`);
+            }
+            console.log(`\n  Use: judges generate --template <id>\n`);
+        }
+        return;
+    }
+    // Specific template
+    const templateId = argv.find((_a, i) => argv[i - 1] === "--template");
+    if (!templateId)
+        return;
+    const tmpl = TEMPLATE_LIBRARY.find((t) => t.id === templateId);
+    if (!tmpl) {
+        console.error(`  Template not found: ${templateId}`);
+        console.error(`  Use --list to see available templates.`);
+        return;
+    }
+    // Output path
+    const outPath = argv.find((_a, i) => argv[i - 1] === "--out");
+    if (format === "json") {
+        console.log(JSON.stringify(tmpl, null, 2));
+        return;
+    }
+    const header = [
+        `// ═══════════════════════════════════════════════════`,
+        `// ${tmpl.title}`,
+        `// Framework: ${tmpl.framework} | Language: ${tmpl.language}`,
+        `// ${tmpl.description}`,
+        `//`,
+        `// Security mitigations applied:`,
+        ...tmpl.mitigations.map((m) => `//   ✓ ${m}`),
+        `//`,
+        `// Generated by: judges generate --template ${tmpl.id}`,
+        `// ═══════════════════════════════════════════════════`,
+        ``,
+    ].join("\n");
+    const output = header + tmpl.code;
+    if (outPath) {
+        const { writeFileSync: wfs } = require("fs");
+        wfs(outPath, output);
+        console.log(`  ✅ Written to ${outPath}`);
+        console.log(`     Template: ${tmpl.title}`);
+    }
+    else {
+        console.log(output);
+    }
+}

package/dist/commands/governance.d.ts

@@ -0,0 +1,31 @@
+/**
+ * `judges governance` — Multi-repo governance dashboard.
+ *
+ * Aggregates snapshot data from multiple repos into a unified governance view.
+ * Teams self-host their own snapshot files; this command reads them from a
+ * directory of exported snapshots (each repo pushes to a shared location).
+ *
+ * Usage:
+ *   judges governance --dir ./governance-data         # read snapshots from dir
+ *   judges governance --dir ./governance-data --html  # HTML dashboard output
+ *   judges governance --dir ./governance-data --json  # JSON output
+ */
+import type { TrendReport } from "./snapshot.js";
+import { type RegressionAlert } from "./snapshot.js";
+export interface RepoSummary {
+    repo: string;
+    trend: TrendReport;
+    regressions: RegressionAlert[];
+    lastRun: string;
+    grade: "A" | "B" | "C" | "D" | "F";
+}
+export interface GovernanceReport {
+    repos: RepoSummary[];
+    overallHealth: "healthy" | "at-risk" | "critical";
+    totalFindings: number;
+    repoCount: number;
+    criticalRepos: string[];
+    generatedAt: string;
+}
+export declare function buildGovernanceReport(dir: string): GovernanceReport;
+export declare function runGovernance(argv: string[]): void;

package/dist/commands/governance.js

@@ -0,0 +1,202 @@
+/**
+ * `judges governance` — Multi-repo governance dashboard.
+ *
+ * Aggregates snapshot data from multiple repos into a unified governance view.
+ * Teams self-host their own snapshot files; this command reads them from a
+ * directory of exported snapshots (each repo pushes to a shared location).
+ *
+ * Usage:
+ *   judges governance --dir ./governance-data         # read snapshots from dir
+ *   judges governance --dir ./governance-data --html  # HTML dashboard output
+ *   judges governance --dir ./governance-data --json  # JSON output
+ */
+import { existsSync, readFileSync, readdirSync } from "fs";
+import { resolve, basename } from "path";
+import { computeTrend, detectRegressions } from "./snapshot.js";
+// ─── Grade Calculation ──────────────────────────────────────────────────────
+function gradeFromTrend(trend) {
+    const t = trend.stats;
+    if (t.currentTotal === 0 && t.trend === "improving")
+        return "A";
+    if (t.currentTotal <= 3 && t.trend !== "regressing")
+        return "A";
+    if (t.currentTotal <= 10 && t.trend !== "regressing")
+        return "B";
+    if (t.currentTotal <= 20)
+        return "C";
+    if (t.currentTotal <= 50)
+        return "D";
+    return "F";
+}
+// ─── Snapshot Directory Loading ─────────────────────────────────────────────
+function loadSnapshotFiles(dir) {
+    const repos = new Map();
+    if (!existsSync(dir))
+        return repos;
+    const files = readdirSync(dir).filter((f) => f.endsWith(".json"));
+    for (const file of files) {
+        try {
+            const raw = readFileSync(resolve(dir, file), "utf-8");
+            const store = JSON.parse(raw);
+            if (store.version === 1 && Array.isArray(store.snapshots)) {
+                // Use filename (minus extension) as repo name
+                const repoName = basename(file, ".json").replace(/-snapshots$/, "");
+                repos.set(repoName, store);
+            }
+        }
+        catch {
+            // Skip invalid files
+        }
+    }
+    return repos;
+}
+// ─── Report Generation ──────────────────────────────────────────────────────
+export function buildGovernanceReport(dir) {
+    const stores = loadSnapshotFiles(dir);
+    const repos = [];
+    let totalFindings = 0;
+    const criticalRepos = [];
+    for (const [repoName, store] of stores) {
+        const trend = computeTrend(store);
+        const regressions = detectRegressions(store);
+        const grade = gradeFromTrend(trend);
+        repos.push({
+            repo: repoName,
+            trend,
+            regressions,
+            lastRun: trend.stats.lastRun,
+            grade,
+        });
+        totalFindings += trend.stats.currentTotal;
+        if (grade === "D" || grade === "F" || regressions.some((r) => r.severity === "error")) {
+            criticalRepos.push(repoName);
+        }
+    }
+    // Sort by grade (worst first) then by findings count
+    const gradeOrder = { F: 0, D: 1, C: 2, B: 3, A: 4 };
+    repos.sort((a, b) => (gradeOrder[a.grade] ?? 5) - (gradeOrder[b.grade] ?? 5) ||
+        b.trend.stats.currentTotal - a.trend.stats.currentTotal);
+    const overallHealth = criticalRepos.length === 0 ? "healthy" : criticalRepos.length <= repos.length * 0.3 ? "at-risk" : "critical";
+    return {
+        repos,
+        overallHealth,
+        totalFindings,
+        repoCount: repos.length,
+        criticalRepos,
+        generatedAt: new Date().toISOString(),
+    };
+}
+// ─── CLI Formatters ─────────────────────────────────────────────────────────
+function formatGovernanceText(report) {
+    const lines = [];
+    const healthIcon = report.overallHealth === "healthy" ? "✅" : report.overallHealth === "at-risk" ? "⚠️ " : "🔴";
+    lines.push("╔══════════════════════════════════════════════════════════════╗");
+    lines.push("║        Judges Panel — Governance Dashboard                  ║");
+    lines.push("╚══════════════════════════════════════════════════════════════╝");
+    lines.push("");
+    lines.push(`  Health    : ${healthIcon} ${report.overallHealth.toUpperCase()}`);
+    lines.push(`  Repos     : ${report.repoCount}`);
+    lines.push(`  Findings  : ${report.totalFindings} total across all repos`);
+    if (report.criticalRepos.length > 0) {
+        lines.push(`  Critical  : ${report.criticalRepos.join(", ")}`);
+    }
+    lines.push(`  Generated : ${report.generatedAt.slice(0, 10)}`);
+    lines.push("");
+    lines.push("  Repository Summary:");
+    lines.push("  " + "─".repeat(58));
+    lines.push(`  ${"Repository".padEnd(30)} Grade  Findings  Trend`);
+    lines.push("  " + "─".repeat(58));
+    for (const r of report.repos) {
+        const trendIcon = r.trend.stats.trend === "improving" ? "📉" : r.trend.stats.trend === "regressing" ? "📈" : "➡️ ";
+        const findings = String(r.trend.stats.currentTotal).padStart(6);
+        lines.push(`  ${r.repo.padEnd(30)} ${r.grade.padEnd(6)} ${findings}   ${trendIcon} ${r.trend.stats.trend}`);
+        if (r.regressions.length > 0) {
+            for (const alert of r.regressions.slice(0, 2)) {
+                const icon = alert.severity === "error" ? "🔴" : "🟡";
+                lines.push(`    ${icon} ${alert.message}`);
+            }
+        }
+    }
+    lines.push("");
+    return lines.join("\n");
+}
+function formatGovernanceHtml(report) {
+    const healthColor = report.overallHealth === "healthy" ? "#16a34a" : report.overallHealth === "at-risk" ? "#ca8a04" : "#dc2626";
+    const gradeColor = { A: "#16a34a", B: "#65a30d", C: "#ca8a04", D: "#ea580c", F: "#dc2626" };
+    const rows = report.repos
+        .map((r) => `<tr>
+      <td>${esc(r.repo)}</td>
+      <td style="color:${gradeColor[r.grade] ?? "#666"};font-weight:700">${r.grade}</td>
+      <td>${r.trend.stats.currentTotal}</td>
+      <td>${r.trend.stats.trend}</td>
+      <td>${r.regressions.length}</td>
+      <td>${r.lastRun.slice(0, 10)}</td>
+    </tr>`)
+        .join("\n");
+    return `<!DOCTYPE html>
+<html lang="en"><head><meta charset="utf-8"><title>Judges Governance Dashboard</title>
+<style>
+  :root{--bg:#fff;--fg:#1a1a1a;--card:#f9fafb;--border:#e5e7eb;--muted:#6b7280}
+  @media(prefers-color-scheme:dark){:root{--bg:#0f172a;--fg:#e2e8f0;--card:#1e293b;--border:#334155;--muted:#94a3b8}}
+  *{margin:0;padding:0;box-sizing:border-box}
+  body{font-family:system-ui,sans-serif;background:var(--bg);color:var(--fg);padding:2rem}
+  h1{margin-bottom:1rem}
+  .badge{display:inline-block;padding:.25rem .75rem;border-radius:4px;font-weight:700}
+  table{width:100%;border-collapse:collapse;margin-top:1rem}
+  th,td{padding:.5rem .75rem;text-align:left;border-bottom:1px solid var(--border)}
+  th{font-size:.75rem;text-transform:uppercase;color:var(--muted)}
+</style></head><body>
+<h1>Judges Panel &mdash; Governance Dashboard</h1>
+<p><span class="badge" style="background:${healthColor};color:#fff">${esc(report.overallHealth.toUpperCase())}</span>
+${report.repoCount} repos, ${report.totalFindings} total findings</p>
+<table><thead><tr><th>Repository</th><th>Grade</th><th>Findings</th><th>Trend</th><th>Alerts</th><th>Last Run</th></tr></thead>
+<tbody>${rows}</tbody></table>
+<p style="margin-top:2rem;font-size:.75rem;color:var(--muted)">Generated ${report.generatedAt.slice(0, 10)} by Judges Panel</p>
+</body></html>`;
+}
+function esc(s) {
+    return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+// ─── CLI Command ────────────────────────────────────────────────────────────
+export function runGovernance(argv) {
+    let dir = ".";
+    let format = "text";
+    for (let i = 3; i < argv.length; i++) {
+        switch (argv[i]) {
+            case "--dir":
+            case "-d":
+                dir = argv[++i] || ".";
+                break;
+            case "--html":
+                format = "html";
+                break;
+            case "--json":
+                format = "json";
+                break;
+            case "--format":
+                format = argv[++i] || "text";
+                break;
+        }
+    }
+    if (!existsSync(dir)) {
+        console.error(`Error: Directory not found: ${dir}`);
+        console.error("Usage: judges governance --dir ./governance-data");
+        process.exit(1);
+    }
+    const report = buildGovernanceReport(dir);
+    if (report.repoCount === 0) {
+        console.log("\n  No snapshot files found. Export repo snapshots as JSON files to the governance directory.");
+        console.log(`  Expected: ${resolve(dir)}/*.json\n`);
+        return;
+    }
+    switch (format) {
+        case "json":
+            console.log(JSON.stringify(report, null, 2));
+            break;
+        case "html":
+            console.log(formatGovernanceHtml(report));
+            break;
+        default:
+            console.log(formatGovernanceText(report));
+    }
+}

package/dist/commands/group-findings.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Finding grouping — group related findings by category, file, or rule
+ * for better review UX and digest-style reporting.
+ */
+import type { Finding } from "../types.js";
+export type GroupByKey = "category" | "severity" | "file" | "rule" | "judge";
+export interface FindingGroup {
+    key: string;
+    label: string;
+    findings: Finding[];
+    count: number;
+    criticalCount: number;
+    highCount: number;
+}
+export interface GroupedReport {
+    groupBy: GroupByKey;
+    groups: FindingGroup[];
+    totalFindings: number;
+    totalGroups: number;
+}
+export declare function groupFindings(findings: Finding[], groupBy: GroupByKey): GroupedReport;
+export declare function runGroupFindings(argv: string[]): void;