@kevinrabun/judges 3.115.1 → 3.115.3

package/dist/commands/doc-gen.js

@@ -0,0 +1,208 @@
+/**
+ * Documentation generation — generates security documentation
+ * from Judges findings history and configuration.
+ *
+ * All output is local markdown files.
+ */
+import { existsSync, readFileSync, mkdirSync, writeFileSync } from "fs";
+import { join } from "path";
+// ─── Helpers ────────────────────────────────────────────────────────────────
+function loadJsonSafe(path, fallback) {
+    if (!existsSync(path))
+        return fallback;
+    try {
+        return JSON.parse(readFileSync(path, "utf-8"));
+    }
+    catch {
+        return fallback;
+    }
+}
+function generatePolicyDoc() {
+    const sections = [];
+    // Header
+    sections.push({
+        title: "Security Review Policy",
+        content: `# Security Review Policy\n\n_Generated by Judges on ${new Date().toISOString().split("T")[0]}_\n\n## Overview\n\nThis document outlines the security review policy enforced by the Judges automated code review system.\n`,
+    });
+    // Configuration
+    const configPath = ".judgesrc";
+    if (existsSync(configPath)) {
+        try {
+            const config = JSON.parse(readFileSync(configPath, "utf-8"));
+            let content = `## Configuration\n\n`;
+            if (config.preset)
+                content += `- **Preset:** ${config.preset}\n`;
+            if (config.minSeverity)
+                content += `- **Minimum Severity:** ${config.minSeverity}\n`;
+            if (config.disabledJudges?.length)
+                content += `- **Disabled Judges:** ${config.disabledJudges.join(", ")}\n`;
+            if (config.disabledRules?.length)
+                content += `- **Disabled Rules:** ${config.disabledRules.join(", ")}\n`;
+            content += `\n`;
+            sections.push({ title: "Configuration", content });
+        }
+        catch {
+            // skip
+        }
+    }
+    // Suppressions
+    const supps = loadJsonSafe(".judges-suppressions.json", { suppressions: [] });
+    if (supps.suppressions && supps.suppressions.length > 0) {
+        let content = `## Approved Suppressions\n\n| Rule | Reason | Approved By |\n|------|--------|-------------|\n`;
+        for (const s of supps.suppressions) {
+            content += `| ${s.ruleId || "—"} | ${s.reason || "—"} | ${s.approvedBy || "—"} |\n`;
+        }
+        content += `\n`;
+        sections.push({ title: "Suppressions", content });
+    }
+    // Quality gates
+    const gate = loadJsonSafe(join(".judges-quality-gate", "policy.json"), {});
+    if (Object.keys(gate).length > 0) {
+        let content = `## Quality Gate Policy\n\n`;
+        for (const [key, val] of Object.entries(gate)) {
+            content += `- **${key}:** ${JSON.stringify(val)}\n`;
+        }
+        content += `\n`;
+        sections.push({ title: "Quality Gate", content });
+    }
+    return sections;
+}
+function generateRemediationGuide() {
+    const sections = [];
+    sections.push({
+        title: "Remediation Guide",
+        content: `# Security Remediation Guide\n\n_Generated by Judges on ${new Date().toISOString().split("T")[0]}_\n\nThis guide covers common security findings and how to fix them.\n\n`,
+    });
+    const guides = [
+        {
+            rule: "SQL Injection",
+            fix: "Use parameterized queries or prepared statements. Never concatenate user input into SQL strings.",
+            example: "db.query('SELECT * FROM users WHERE id = ?', [userId])",
+        },
+        {
+            rule: "Cross-Site Scripting (XSS)",
+            fix: "Sanitize and encode all user-provided output. Use framework-provided escaping (e.g., React auto-escapes).",
+            example: "const safe = DOMPurify.sanitize(userInput)",
+        },
+        {
+            rule: "Command Injection",
+            fix: "Use parameterized APIs or allowlists instead of shell execution with user input.",
+            example: "execFile('git', ['log', '--oneline'], callback)",
+        },
+        {
+            rule: "Hardcoded Secrets",
+            fix: "Move secrets to environment variables or a secrets manager. Never commit credentials.",
+            example: "const apiKey = process.env.API_KEY",
+        },
+        {
+            rule: "Insecure Cryptography",
+            fix: "Use strong algorithms (AES-256-GCM, SHA-256+). Avoid MD5, SHA-1, DES, RC4.",
+            example: "crypto.createCipheriv('aes-256-gcm', key, iv)",
+        },
+        {
+            rule: "Path Traversal",
+            fix: "Validate and normalize file paths. Use allowlists for permitted directories.",
+            example: "const safePath = path.resolve(baseDir, path.basename(userInput))",
+        },
+        {
+            rule: "SSRF",
+            fix: "Validate and allowlist URLs. Block internal IP ranges. Use URL parsing.",
+            example: "const url = new URL(userInput); if (!ALLOWED_HOSTS.has(url.hostname)) throw new Error()",
+        },
+        {
+            rule: "Missing Authentication",
+            fix: "Require authentication on all sensitive endpoints. Use middleware for consistent enforcement.",
+            example: "app.use('/api', authMiddleware)",
+        },
+    ];
+    let content = "";
+    for (const g of guides) {
+        content += `## ${g.rule}\n\n**Fix:** ${g.fix}\n\n\`\`\`\n${g.example}\n\`\`\`\n\n---\n\n`;
+    }
+    sections.push({ title: "Remediation Details", content });
+    return sections;
+}
+function generateTeamPlaybook() {
+    const sections = [];
+    sections.push({
+        title: "Team Security Playbook",
+        content: `# Team Security Playbook\n\n_Generated by Judges on ${new Date().toISOString().split("T")[0]}_\n\n## Workflow\n\n1. **Pre-commit**: Run \`judges review\` locally before pushing code\n2. **CI Pipeline**: Configure \`judges ci-template\` for automated PR checks\n3. **Triage**: Use \`judges auto-triage\` to prioritize critical findings\n4. **Review**: Assign findings using \`judges assign-findings\`\n5. **Track**: Monitor progress with \`judges burndown\`\n6. **Report**: Generate digests with \`judges digest\`\n\n`,
+    });
+    sections.push({
+        title: "Escalation Procedures",
+        content: `## Escalation Procedures\n\n| Severity | SLA | Action |\n|----------|-----|--------|\n| Critical | 4 hours | Notify security lead, create incident ticket |\n| High | 24 hours | Assign to code owner, block PR merge |\n| Medium | 1 week | Assign to team backlog |\n| Low | 1 sprint | Track in burndown |\n\n`,
+    });
+    sections.push({
+        title: "Metrics",
+        content: `## Key Metrics\n\n- **Mean Time to Remediate (MTTR)**: Track via \`judges sla-track\`\n- **False Positive Rate**: Tune via \`judges noise-advisor\`\n- **Coverage**: Monitor via \`judges coverage-map\`\n- **Team Score**: View via \`judges team-leaderboard\`\n- **Security Maturity**: Assess via \`judges security-maturity\`\n\n`,
+    });
+    return sections;
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+const STORE = ".judges-docs";
+export function runDocGen(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges doc-gen — Generate security documentation
+
+Usage:
+  judges doc-gen --policy
+  judges doc-gen --remediation
+  judges doc-gen --playbook
+  judges doc-gen --all
+
+Options:
+  --policy              Generate security review policy document
+  --remediation         Generate remediation guide
+  --playbook            Generate team security playbook
+  --all                 Generate all documents
+  --output <dir>        Output directory (default: .judges-docs)
+  --format json         JSON output
+  --help, -h            Show this help
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const outputDir = argv.find((_a, i) => argv[i - 1] === "--output") || STORE;
+    const genPolicy = argv.includes("--policy") || argv.includes("--all");
+    const genRemediation = argv.includes("--remediation") || argv.includes("--all");
+    const genPlaybook = argv.includes("--playbook") || argv.includes("--all");
+    if (!genPolicy && !genRemediation && !genPlaybook) {
+        console.log("  Specify --policy, --remediation, --playbook, or --all. Use --help for details.");
+        return;
+    }
+    if (!existsSync(outputDir))
+        mkdirSync(outputDir, { recursive: true });
+    const generated = [];
+    if (genPolicy) {
+        const sections = generatePolicyDoc();
+        const content = sections.map((s) => s.content).join("\n");
+        const outPath = join(outputDir, "security-policy.md");
+        writeFileSync(outPath, content);
+        generated.push(outPath);
+    }
+    if (genRemediation) {
+        const sections = generateRemediationGuide();
+        const content = sections.map((s) => s.content).join("\n");
+        const outPath = join(outputDir, "remediation-guide.md");
+        writeFileSync(outPath, content);
+        generated.push(outPath);
+    }
+    if (genPlaybook) {
+        const sections = generateTeamPlaybook();
+        const content = sections.map((s) => s.content).join("\n");
+        const outPath = join(outputDir, "team-playbook.md");
+        writeFileSync(outPath, content);
+        generated.push(outPath);
+    }
+    if (format === "json") {
+        console.log(JSON.stringify({ generated, outputDir, timestamp: new Date().toISOString() }, null, 2));
+    }
+    else {
+        console.log(`\n  Documentation Generated\n  ──────────────────────────`);
+        for (const g of generated) {
+            console.log(`    ✅ ${g}`);
+        }
+        console.log(`\n  Output directory: ${outputDir}\n`);
+    }
+}

package/dist/commands/docs.d.ts

@@ -0,0 +1 @@
+export declare function runDocs(argv: string[]): void;

package/dist/commands/docs.js

@@ -0,0 +1,156 @@
+// ─── Rule Documentation Generator ────────────────────────────────────────────
+// Generate per-judge/per-rule documentation in Markdown format.
+//
+// Usage:
+//   judges docs                          # output all judge docs to stdout
+//   judges docs --output docs/rules/     # write individual files
+//   judges docs --judge cybersecurity    # single judge
+// ──────────────────────────────────────────────────────────────────────────────
+import { writeFileSync, mkdirSync, existsSync } from "fs";
+import { join, resolve } from "path";
+import { JUDGES, getJudge } from "../judges/index.js";
+function extractRulesFromPrompt(judge) {
+    const rules = [];
+    const prompt = judge.systemPrompt;
+    // Typically rules are documented in the system prompt with patterns like:
+    // SEC-001: Title — Description
+    // or SEC-001 | Title | Description
+    const rulePattern = new RegExp(`(${judge.rulePrefix}-\\d{3})[:\\s|]+([^\\n|]+?)(?:\\s*[—|]\\s*([^\\n]+))?$`, "gm");
+    let match;
+    while ((match = rulePattern.exec(prompt)) !== null) {
+        rules.push({
+            ruleId: match[1],
+            title: match[2].trim(),
+            description: match[3]?.trim() || match[2].trim(),
+        });
+    }
+    return rules;
+}
+// ─── Generate Documentation ─────────────────────────────────────────────────
+function generateJudgeDoc(judge) {
+    const rules = extractRulesFromPrompt(judge);
+    const lines = [];
+    lines.push(`# ${judge.name}`);
+    lines.push("");
+    lines.push(`**Domain:** ${judge.domain}`);
+    lines.push(`**Rule Prefix:** \`${judge.rulePrefix}\``);
+    lines.push(`**Judge ID:** \`${judge.id}\``);
+    lines.push("");
+    lines.push("## Description");
+    lines.push("");
+    lines.push(judge.description);
+    lines.push("");
+    if (rules.length > 0) {
+        lines.push("## Rules");
+        lines.push("");
+        lines.push("| Rule ID | Title | Description |");
+        lines.push("|---------|-------|-------------|");
+        for (const rule of rules) {
+            lines.push(`| \`${rule.ruleId}\` | ${rule.title} | ${rule.description} |`);
+        }
+        lines.push("");
+    }
+    lines.push("## Usage");
+    lines.push("");
+    lines.push("```bash");
+    lines.push(`# Evaluate with this judge only`);
+    lines.push(`judges eval --judge ${judge.id} --file <path>`);
+    lines.push("");
+    lines.push("# As part of the full tribunal");
+    lines.push("judges eval --file <path>");
+    lines.push("```");
+    lines.push("");
+    return lines.join("\n");
+}
+function generateIndexDoc() {
+    const lines = [];
+    lines.push("# Judges Panel — Rule Reference");
+    lines.push("");
+    lines.push(`The Judges Panel includes **${JUDGES.length}** specialized judges that evaluate AI-generated code.`);
+    lines.push("");
+    lines.push("## Judges");
+    lines.push("");
+    lines.push("| Judge | Domain | Rule Prefix | Description |");
+    lines.push("|-------|--------|-------------|-------------|");
+    for (const judge of JUDGES) {
+        lines.push(`| [${judge.name}](${judge.id}.md) | ${judge.domain} | \`${judge.rulePrefix}\` | ${judge.description} |`);
+    }
+    lines.push("");
+    lines.push("## Quick Start");
+    lines.push("");
+    lines.push("```bash");
+    lines.push("# Evaluate a file with all judges");
+    lines.push("judges eval --file src/app.ts");
+    lines.push("");
+    lines.push("# Evaluate with a specific judge");
+    lines.push("judges eval --judge cybersecurity --file src/app.ts");
+    lines.push("");
+    lines.push("# List all available judges");
+    lines.push("judges list");
+    lines.push("```");
+    lines.push("");
+    return lines.join("\n");
+}
+// ─── CLI Entry Point ────────────────────────────────────────────────────────
+export function runDocs(argv) {
+    let output;
+    let judgeId;
+    for (let i = 3; i < argv.length; i++) {
+        const arg = argv[i];
+        switch (arg) {
+            case "--output":
+            case "-o":
+                output = argv[++i];
+                break;
+            case "--judge":
+            case "-j":
+                judgeId = argv[++i];
+                break;
+            case "--help":
+            case "-h":
+                console.log(`
+Judges Panel — Rule Documentation Generator
+
+USAGE:
+  judges docs                          Print all docs to stdout
+  judges docs --output docs/rules/     Write per-judge .md files
+  judges docs --judge cybersecurity    Show single judge documentation
+
+OPTIONS:
+  --output, -o <dir>   Output directory for .md files
+  --judge, -j <id>     Generate docs for a single judge
+`);
+                process.exit(0);
+        }
+    }
+    if (judgeId) {
+        const judge = getJudge(judgeId);
+        if (!judge) {
+            console.error(`Unknown judge: ${judgeId}`);
+            console.error('Run "judges list" to see available judges.');
+            process.exit(1);
+        }
+        console.log(generateJudgeDoc(judge));
+        process.exit(0);
+    }
+    if (output) {
+        const dir = resolve(output);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        // Write index
+        writeFileSync(join(dir, "README.md"), generateIndexDoc(), "utf-8");
+        // Write per-judge docs
+        for (const judge of JUDGES) {
+            writeFileSync(join(dir, `${judge.id}.md`), generateJudgeDoc(judge), "utf-8");
+        }
+        console.log(`✅ Generated documentation for ${JUDGES.length} judges in ${dir}`);
+    }
+    else {
+        // Print everything to stdout
+        console.log(generateIndexDoc());
+        for (const judge of JUDGES) {
+            console.log(generateJudgeDoc(judge));
+        }
+    }
+    process.exit(0);
+}

package/dist/commands/encoding-safety.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Encoding safety — detect encoding mismatches, unsafe deserialization, and injection risks.
+ */
+export declare function runEncodingSafety(argv: string[]): void;

package/dist/commands/encoding-safety.js

@@ -0,0 +1,275 @@
+/**
+ * Encoding safety — detect encoding mismatches, unsafe deserialization, and injection risks.
+ */
+import { readFileSync, readdirSync, statSync } from "fs";
+import { join, extname } from "path";
+// ─── File Collection ────────────────────────────────────────────────────────
+const CODE_EXTS = new Set([".ts", ".tsx", ".js", ".jsx", ".py", ".java", ".go", ".rs"]);
+function collectFiles(dir, max = 300) {
+    const files = [];
+    function walk(d) {
+        if (files.length >= max)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(d);
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (files.length >= max)
+                return;
+            if (e.startsWith(".") || e === "node_modules" || e === "dist" || e === "build")
+                continue;
+            const full = join(d, e);
+            try {
+                if (statSync(full).isDirectory())
+                    walk(full);
+                else if (CODE_EXTS.has(extname(full)))
+                    files.push(full);
+            }
+            catch {
+                /* skip */
+            }
+        }
+    }
+    walk(dir);
+    return files;
+}
+// ─── Analysis ───────────────────────────────────────────────────────────────
+function analyzeFile(filepath) {
+    const issues = [];
+    let content;
+    try {
+        content = readFileSync(filepath, "utf-8");
+    }
+    catch {
+        return issues;
+    }
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // eval() on dynamic input
+        if (/\beval\s*\(/.test(line)) {
+            if (!/eslint-disable|\/\/\s*safe|test|spec|fixture/i.test(line) && !/test|spec|fixture/i.test(filepath)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "eval() usage",
+                    severity: "high",
+                    detail: "eval() executes arbitrary code — use JSON.parse, Function(), or AST-based alternatives",
+                });
+            }
+        }
+        // Python pickle.loads / marshal.loads
+        if (/pickle\.loads?\s*\(|marshal\.loads?\s*\(|yaml\.load\s*\(/i.test(line)) {
+            const block = lines.slice(i, Math.min(i + 3, lines.length)).join("\n");
+            if (!/safe_load|SafeLoader/i.test(block)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "Unsafe deserialization",
+                    severity: "high",
+                    detail: "pickle/marshal/yaml.load can execute arbitrary code — use safe alternatives",
+                });
+            }
+        }
+        // Template literal interpolation into structured formats
+        if (/`[^`]*\$\{/.test(line)) {
+            if (/SELECT|INSERT|UPDATE|DELETE|FROM|WHERE/i.test(line)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "SQL interpolation via template literal",
+                    severity: "high",
+                    detail: "Variable interpolated into SQL string — use parameterized queries",
+                });
+            }
+            if (/<\w+[^>]*>/.test(line) && /\$\{/.test(line)) {
+                if (!/sanitize|escape|encode|DOMPurify|xss/i.test(line)) {
+                    issues.push({
+                        file: filepath,
+                        line: i + 1,
+                        issue: "HTML interpolation without escaping",
+                        severity: "high",
+                        detail: "Variable interpolated into HTML — sanitize to prevent XSS",
+                    });
+                }
+            }
+        }
+        // String concatenation into XML/JSON
+        if (/['"]<\?xml|['"]<\w+/.test(line) && /\+\s*\w+/.test(line)) {
+            issues.push({
+                file: filepath,
+                line: i + 1,
+                issue: "String concatenation into XML",
+                severity: "medium",
+                detail: "Building XML via string concatenation — use a builder/serializer to prevent injection",
+            });
+        }
+        // Base64 decode without validation
+        if (/atob\s*\(|Buffer\.from\s*\([^,]+,\s*['"]base64['"]|base64\.b64decode/i.test(line)) {
+            const block = lines.slice(i, Math.min(i + 5, lines.length)).join("\n");
+            if (!/try|catch|validate|verify|check|schema/i.test(block)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "Base64 decode without validation",
+                    severity: "medium",
+                    detail: "Decoding Base64 without try/catch — malformed input causes runtime errors",
+                });
+            }
+        }
+        // Mixed encoding (readFile without specifying encoding)
+        if (/readFile(?:Sync)?\s*\(\s*\w+\s*\)/.test(line)) {
+            if (!/utf-8|utf8|encoding|binary|buffer/i.test(line)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "File read without encoding specification",
+                    severity: "low",
+                    detail: "readFile without encoding returns Buffer — specify 'utf-8' for text processing",
+                });
+            }
+        }
+        // URL encoding/decoding asymmetry
+        if (/encodeURI\s*\(/.test(line) && !line.includes("encodeURIComponent")) {
+            issues.push({
+                file: filepath,
+                line: i + 1,
+                issue: "encodeURI vs encodeURIComponent",
+                severity: "medium",
+                detail: "encodeURI doesn't encode /:@!$&'()*+,;= — use encodeURIComponent for query values",
+            });
+        }
+        // JSON.stringify in URL without encoding
+        if (/JSON\.stringify/.test(line) && /url|href|src|query|param/i.test(line)) {
+            if (!/encodeURI|encodeURIComponent|URLSearchParams/i.test(line)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "JSON in URL without encoding",
+                    severity: "medium",
+                    detail: "JSON placed in URL without encoding — special characters will break the URL",
+                });
+            }
+        }
+        // innerHTML / dangerouslySetInnerHTML
+        if (/\.innerHTML\s*=|dangerouslySetInnerHTML/i.test(line)) {
+            const block = lines.slice(Math.max(0, i - 2), Math.min(i + 2, lines.length)).join("\n");
+            if (!/sanitize|DOMPurify|escape|encode|trusted|xss/i.test(block)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "innerHTML without sanitization",
+                    severity: "high",
+                    detail: "Setting innerHTML without sanitization — XSS vulnerability",
+                });
+            }
+        }
+        // document.write
+        if (/document\.write\s*\(/.test(line)) {
+            issues.push({
+                file: filepath,
+                line: i + 1,
+                issue: "document.write usage",
+                severity: "medium",
+                detail: "document.write can be exploited for DOM-based XSS — use DOM APIs instead",
+            });
+        }
+        // RegExp constructor with unsanitized input
+        if (/new\s+RegExp\s*\(\s*\w+/.test(line)) {
+            if (!/escape|sanitize|quote|literal/i.test(line)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "RegExp from variable without escaping",
+                    severity: "medium",
+                    detail: "Dynamic RegExp without escaping special characters — ReDoS or unexpected matching risk",
+                });
+            }
+        }
+        // Deserialization: BinaryFormatter, ObjectInputStream
+        if (/BinaryFormatter|ObjectInputStream|Serializable.*readObject|unserialize\s*\(/i.test(line)) {
+            issues.push({
+                file: filepath,
+                line: i + 1,
+                issue: "Unsafe binary deserialization",
+                severity: "high",
+                detail: "Binary deserialization of untrusted data can execute arbitrary code",
+            });
+        }
+        // Content-Type mismatch
+        if (/setHeader\s*\(\s*['"]Content-Type['"]\s*,/.test(line)) {
+            if (/text\/plain/i.test(line)) {
+                const block = lines.slice(i, Math.min(i + 5, lines.length)).join("\n");
+                if (/JSON\.stringify|\.json\s*\(/.test(block)) {
+                    issues.push({
+                        file: filepath,
+                        line: i + 1,
+                        issue: "Content-Type mismatch",
+                        severity: "medium",
+                        detail: "Content-Type set to text/plain but sending JSON — clients may misinterpret the response",
+                    });
+                }
+            }
+        }
+    }
+    return issues;
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runEncodingSafety(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges encoding-safety — Detect encoding mismatches, injection, and unsafe deserialization
+
+Usage:
+  judges encoding-safety [dir]
+  judges encoding-safety src/ --format json
+
+Options:
+  [dir]                 Directory to scan (default: .)
+  --format json         JSON output
+  --help, -h            Show this help
+
+Checks: eval(), unsafe deserialization (pickle, marshal, yaml.load), SQL/HTML/XML interpolation,
+Base64 validation, encoding asymmetry, innerHTML XSS, RegExp injection, Content-Type mismatch.
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const dir = argv.find((a) => !a.startsWith("-") && argv.indexOf(a) > 0) || ".";
+    const files = collectFiles(dir);
+    const allIssues = [];
+    for (const f of files)
+        allIssues.push(...analyzeFile(f));
+    const highCount = allIssues.filter((i) => i.severity === "high").length;
+    const medCount = allIssues.filter((i) => i.severity === "medium").length;
+    const score = Math.max(0, 100 - highCount * 10 - medCount * 4);
+    if (format === "json") {
+        console.log(JSON.stringify({
+            issues: allIssues,
+            score,
+            summary: { high: highCount, medium: medCount, total: allIssues.length },
+            timestamp: new Date().toISOString(),
+        }, null, 2));
+    }
+    else {
+        const badge = score >= 80 ? "✅ SAFE" : score >= 50 ? "⚠️  RISKY" : "❌ DANGEROUS";
+        console.log(`\n  Encoding Safety: ${badge} (${score}/100)\n  ─────────────────────────────`);
+        if (allIssues.length === 0) {
+            console.log("    No encoding safety issues detected.\n");
+            return;
+        }
+        for (const issue of allIssues.slice(0, 25)) {
+            const icon = issue.severity === "high" ? "🔴" : issue.severity === "medium" ? "🟡" : "🔵";
+            console.log(`    ${icon} ${issue.issue}`);
+            console.log(`        ${issue.file}:${issue.line}`);
+            console.log(`        ${issue.detail}`);
+        }
+        if (allIssues.length > 25)
+            console.log(`    ... and ${allIssues.length - 25} more`);
+        console.log(`\n    Total: ${allIssues.length} | High: ${highCount} | Medium: ${medCount} | Score: ${score}/100\n`);
+    }
+}

package/dist/commands/error-taxonomy.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Error taxonomy — classify and standardize error codes, messages, and
+ * hierarchies across a codebase.
+ */
+export declare function runErrorTaxonomy(argv: string[]): void;