@kevinrabun/judges 3.115.1 → 3.115.3

package/dist/commands/iac-lint.js

@@ -0,0 +1,312 @@
+/**
+ * IaC lint — dedicated linting for Dockerfiles, Kubernetes
+ * manifests, and Helm charts for security misconfigurations.
+ *
+ * All analysis local.
+ */
+import { existsSync, readFileSync, readdirSync } from "fs";
+import { join, basename } from "path";
+// ─── Rules ──────────────────────────────────────────────────────────────────
+const IAC_RULES = [
+    // Dockerfile rules
+    {
+        id: "dockerfile-run-as-root",
+        type: "dockerfile",
+        severity: "high",
+        check: (_content, lines) => {
+            const hasUser = lines.some((l) => /^USER\s+(?!root)/i.test(l.trim()));
+            if (!hasUser)
+                return [{ line: 1, message: "No USER directive — container runs as root" }];
+            return [];
+        },
+        recommendation: "Add USER directive with a non-root user",
+    },
+    {
+        id: "dockerfile-latest-tag",
+        type: "dockerfile",
+        severity: "medium",
+        check: (_content, lines) => {
+            const results = [];
+            for (let i = 0; i < lines.length; i++) {
+                if (/^FROM\s+\S+:latest/i.test(lines[i].trim()) ||
+                    (/^FROM\s+\S+$/i.test(lines[i].trim()) && !lines[i].includes(":"))) {
+                    results.push({ line: i + 1, message: "Using 'latest' or untagged base image" });
+                }
+            }
+            return results;
+        },
+        recommendation: "Pin base image to a specific version tag",
+    },
+    {
+        id: "dockerfile-copy-chown",
+        type: "dockerfile",
+        severity: "low",
+        check: (_content, lines) => {
+            const results = [];
+            for (let i = 0; i < lines.length; i++) {
+                if (/^COPY\s/i.test(lines[i].trim()) && !lines[i].includes("--chown")) {
+                    results.push({ line: i + 1, message: "COPY without --chown — files owned by root" });
+                }
+            }
+            return results;
+        },
+        recommendation: "Use COPY --chown=user:group to set proper ownership",
+    },
+    {
+        id: "dockerfile-add-url",
+        type: "dockerfile",
+        severity: "high",
+        check: (_content, lines) => {
+            const results = [];
+            for (let i = 0; i < lines.length; i++) {
+                if (/^ADD\s+https?:\/\//i.test(lines[i].trim())) {
+                    results.push({ line: i + 1, message: "ADD with URL — use COPY + RUN curl instead" });
+                }
+            }
+            return results;
+        },
+        recommendation: "Replace ADD with RUN curl/wget + COPY for better security",
+    },
+    {
+        id: "dockerfile-env-secret",
+        type: "dockerfile",
+        severity: "critical",
+        check: (_content, lines) => {
+            const results = [];
+            for (let i = 0; i < lines.length; i++) {
+                if (/^ENV\s+.*(?:PASSWORD|SECRET|API_KEY|TOKEN)\s*=/i.test(lines[i].trim())) {
+                    results.push({ line: i + 1, message: "Secret exposed in ENV directive" });
+                }
+            }
+            return results;
+        },
+        recommendation: "Use Docker secrets or runtime environment variables instead",
+    },
+    // Kubernetes rules
+    {
+        id: "k8s-privileged",
+        type: "kubernetes",
+        severity: "critical",
+        check: (content) => {
+            const results = [];
+            const lines = content.split("\n");
+            for (let i = 0; i < lines.length; i++) {
+                if (/privileged:\s*true/i.test(lines[i])) {
+                    results.push({ line: i + 1, message: "Container running in privileged mode" });
+                }
+            }
+            return results;
+        },
+        recommendation: "Set privileged: false and use specific capabilities instead",
+    },
+    {
+        id: "k8s-host-network",
+        type: "kubernetes",
+        severity: "high",
+        check: (content) => {
+            const results = [];
+            const lines = content.split("\n");
+            for (let i = 0; i < lines.length; i++) {
+                if (/hostNetwork:\s*true/i.test(lines[i])) {
+                    results.push({ line: i + 1, message: "Pod using host network namespace" });
+                }
+            }
+            return results;
+        },
+        recommendation: "Disable hostNetwork unless absolutely required",
+    },
+    {
+        id: "k8s-no-resource-limits",
+        type: "kubernetes",
+        severity: "medium",
+        check: (content) => {
+            if (/kind:\s*(?:Deployment|Pod|StatefulSet|DaemonSet)/i.test(content) &&
+                !/resources:\s*\n\s+limits:/i.test(content)) {
+                return [{ line: 1, message: "No resource limits defined" }];
+            }
+            return [];
+        },
+        recommendation: "Add resources.limits for CPU and memory",
+    },
+    {
+        id: "k8s-run-as-root",
+        type: "kubernetes",
+        severity: "high",
+        check: (content) => {
+            const results = [];
+            const lines = content.split("\n");
+            for (let i = 0; i < lines.length; i++) {
+                if (/runAsUser:\s*0/i.test(lines[i])) {
+                    results.push({ line: i + 1, message: "Container running as root (UID 0)" });
+                }
+            }
+            return results;
+        },
+        recommendation: "Set runAsUser to a non-zero UID and runAsNonRoot: true",
+    },
+    {
+        id: "k8s-no-readiness-probe",
+        type: "kubernetes",
+        severity: "low",
+        check: (content) => {
+            if (/kind:\s*Deployment/i.test(content) && !/readinessProbe:/i.test(content)) {
+                return [{ line: 1, message: "No readiness probe configured" }];
+            }
+            return [];
+        },
+        recommendation: "Add readinessProbe for proper traffic management",
+    },
+];
+// ─── Scanner ────────────────────────────────────────────────────────────────
+function detectFileType(filePath, content) {
+    const name = basename(filePath).toLowerCase();
+    if (name === "dockerfile" || name.startsWith("dockerfile."))
+        return "dockerfile";
+    if (name.endsWith(".dockerfile"))
+        return "dockerfile";
+    if (/kind:\s*(?:Deployment|Service|Pod|StatefulSet|DaemonSet|ConfigMap|Secret|Ingress)/i.test(content))
+        return "kubernetes";
+    if (/apiVersion:\s*v\d|apiVersion:\s*apps\//i.test(content))
+        return "kubernetes";
+    if (name === "chart.yaml" || name === "values.yaml")
+        return "helm";
+    return null;
+}
+function collectIacFiles(dir) {
+    const result = [];
+    const skipDirs = new Set(["node_modules", ".git", "dist", "build"]);
+    function walk(d) {
+        let entries;
+        try {
+            entries = readdirSync(d);
+        }
+        catch {
+            return;
+        }
+        for (const name of entries) {
+            if (skipDirs.has(name))
+                continue;
+            const full = join(d, name);
+            try {
+                const sub = readdirSync(full);
+                void sub;
+                walk(full);
+            }
+            catch {
+                const lower = name.toLowerCase();
+                if (lower.includes("dockerfile") || lower.endsWith(".yaml") || lower.endsWith(".yml")) {
+                    result.push(full);
+                }
+            }
+        }
+    }
+    walk(dir);
+    return result;
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runIacLint(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges iac-lint — Lint Dockerfiles, Kubernetes manifests, and Helm charts
+
+Usage:
+  judges iac-lint [dir]
+  judges iac-lint Dockerfile
+  judges iac-lint k8s/ --severity critical,high
+
+Options:
+  --severity <levels>   Filter by severity (comma-separated)
+  --rules               List all IaC lint rules
+  --format json         JSON output
+  --help, -h            Show this help
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    // List rules
+    if (argv.includes("--rules")) {
+        if (format === "json") {
+            console.log(JSON.stringify(IAC_RULES.map(({ check: _c, ...rest }) => rest), null, 2));
+        }
+        else {
+            console.log(`\n  IaC Lint Rules (${IAC_RULES.length})\n  ──────────────────────────`);
+            for (const r of IAC_RULES) {
+                console.log(`    [${r.severity.toUpperCase().padEnd(8)}] ${r.id.padEnd(30)} (${r.type})`);
+            }
+            console.log("");
+        }
+        return;
+    }
+    const target = argv.find((a) => !a.startsWith("--") && !argv[argv.indexOf(a) - 1]?.startsWith("--")) || ".";
+    const sevFilter = argv.find((_a, i) => argv[i - 1] === "--severity");
+    // Collect files
+    let files;
+    if (existsSync(target)) {
+        try {
+            readdirSync(target);
+            files = collectIacFiles(target);
+        }
+        catch {
+            files = [target];
+        }
+    }
+    else {
+        console.error(`  Path not found: ${target}`);
+        return;
+    }
+    let findings = [];
+    for (const file of files) {
+        let content;
+        try {
+            content = readFileSync(file, "utf-8");
+        }
+        catch {
+            continue;
+        }
+        const fileType = detectFileType(file, content);
+        if (!fileType)
+            continue;
+        const applicableRules = IAC_RULES.filter((r) => r.type === fileType);
+        const lines = content.split("\n");
+        for (const rule of applicableRules) {
+            const matches = rule.check(content, lines);
+            for (const m of matches) {
+                findings.push({
+                    file,
+                    line: m.line,
+                    ruleId: rule.id,
+                    severity: rule.severity,
+                    message: m.message,
+                    recommendation: rule.recommendation,
+                });
+            }
+        }
+    }
+    if (sevFilter) {
+        const allowed = sevFilter.split(",");
+        findings = findings.filter((f) => allowed.includes(f.severity));
+    }
+    if (format === "json") {
+        console.log(JSON.stringify({ findings, scannedFiles: files.length, timestamp: new Date().toISOString() }, null, 2));
+    }
+    else {
+        console.log(`\n  IaC Lint — ${files.length} files scanned`);
+        console.log(`  Found: ${findings.length} issues\n  ──────────────────────────`);
+        if (findings.length === 0) {
+            console.log(`    ✅ No IaC issues detected\n`);
+            return;
+        }
+        for (const sev of ["critical", "high", "medium", "low"]) {
+            const items = findings.filter((f) => f.severity === sev);
+            if (items.length === 0)
+                continue;
+            console.log(`\n    ${sev.toUpperCase()} (${items.length})`);
+            for (const f of items) {
+                console.log(`      ${f.file}:${f.line} — ${f.ruleId}`);
+                console.log(`        ${f.message}`);
+                console.log(`        → ${f.recommendation}`);
+            }
+        }
+        console.log("");
+    }
+}

package/dist/commands/idempotency-audit.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Idempotency audit — verify retried/webhook operations are safely idempotent.
+ */
+export declare function runIdempotencyAudit(argv: string[]): void;

package/dist/commands/idempotency-audit.js

@@ -0,0 +1,222 @@
+/**
+ * Idempotency audit — verify retried/webhook operations are safely idempotent.
+ */
+import { readFileSync, readdirSync, statSync } from "fs";
+import { join, extname } from "path";
+// ─── File Collection ────────────────────────────────────────────────────────
+const CODE_EXTS = new Set([".ts", ".tsx", ".js", ".jsx", ".py", ".java", ".go", ".rs"]);
+function collectFiles(dir, max = 300) {
+    const files = [];
+    function walk(d) {
+        if (files.length >= max)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(d);
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (files.length >= max)
+                return;
+            if (e.startsWith(".") || e === "node_modules" || e === "dist" || e === "build")
+                continue;
+            const full = join(d, e);
+            try {
+                if (statSync(full).isDirectory())
+                    walk(full);
+                else if (CODE_EXTS.has(extname(full)))
+                    files.push(full);
+            }
+            catch {
+                /* skip */
+            }
+        }
+    }
+    walk(dir);
+    return files;
+}
+// ─── Analysis ───────────────────────────────────────────────────────────────
+function analyzeFile(filepath) {
+    const issues = [];
+    let content;
+    try {
+        content = readFileSync(filepath, "utf-8");
+    }
+    catch {
+        return issues;
+    }
+    const lines = content.split("\n");
+    const fullText = content;
+    const isRetryContext = /retry|webhook|queue|worker|consumer|handler|idempoten/i.test(fullText);
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // INSERT without ON CONFLICT / upsert in retry context
+        if (/INSERT\s+INTO/i.test(line) && isRetryContext) {
+            const block = lines.slice(i, Math.min(i + 3, lines.length)).join("\n");
+            if (!/ON\s+CONFLICT|ON\s+DUPLICATE|UPSERT|IF\s+NOT\s+EXISTS|MERGE/i.test(block)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "INSERT without conflict handling in retry path",
+                    severity: "high",
+                    detail: "Retry can cause duplicate rows — use INSERT ... ON CONFLICT or UPSERT",
+                });
+            }
+        }
+        // Auto-increment counter mutation in handler
+        if (/\+\+|\+=\s*1|\.increment|\.incr\b/i.test(line)) {
+            if (/handler|webhook|consumer|worker|queue|retry/i.test(fullText)) {
+                const block = lines.slice(Math.max(0, i - 5), Math.min(i + 5, lines.length)).join("\n");
+                if (!/idempotency|dedup|idempotent|already.*processed/i.test(block)) {
+                    issues.push({
+                        file: filepath,
+                        line: i + 1,
+                        issue: "Counter increment in retry-able path",
+                        severity: "high",
+                        detail: "Counter mutation is not idempotent — repeated execution will over-count",
+                    });
+                }
+            }
+        }
+        // Email/SMS/notification send without dedup
+        if (/sendEmail|sendSMS|sendNotification|notify|\.send\s*\(/i.test(line)) {
+            if (isRetryContext) {
+                const block = lines.slice(Math.max(0, i - 8), Math.min(i + 5, lines.length)).join("\n");
+                if (!/idempotency|dedup|already.*sent|sentIds|processed/i.test(block)) {
+                    issues.push({
+                        file: filepath,
+                        line: i + 1,
+                        issue: "Notification send without dedup in retry path",
+                        severity: "high",
+                        detail: "Retry will send duplicate notifications — track sent IDs or use idempotency key",
+                    });
+                }
+            }
+        }
+        // Payment/charge without idempotency key
+        if (/charge|payment|transfer|payout|refund/i.test(line) && /\.(?:create|post|execute)\s*\(/i.test(line)) {
+            const block = lines.slice(i, Math.min(i + 5, lines.length)).join("\n");
+            if (!/idempotency|idempotent|dedup|Idempotency-Key/i.test(block)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "Financial operation without idempotency key",
+                    severity: "high",
+                    detail: "Payment operation lacks idempotency key — retry can cause double-charge",
+                });
+            }
+        }
+        // Webhook handler without idempotency check
+        if (/webhook|eventHandler|onEvent|handleEvent/i.test(line) && /function|=>|async/.test(line)) {
+            const funcBlock = lines.slice(i, Math.min(i + 20, lines.length)).join("\n");
+            if (!/idempotency|dedup|already.*processed|processedIds|eventId/i.test(funcBlock)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "Webhook handler without idempotency guard",
+                    severity: "medium",
+                    detail: "Webhook providers may deliver events multiple times — check for prior processing",
+                });
+            }
+        }
+        // Queue consumer ACK before processing completes
+        if (/\.ack\s*\(|\.acknowledge/i.test(line)) {
+            const beforeBlock = lines.slice(Math.max(0, i - 3), i + 1).join("\n");
+            if (!/await|then|\.catch|try/i.test(beforeBlock)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "Queue ACK before processing completion",
+                    severity: "high",
+                    detail: "Acknowledging message before processing finishes — crash loses the message",
+                });
+            }
+        }
+        // File write without atomic rename pattern
+        if (/writeFileSync|writeFile\s*\(|fs\.write/i.test(line)) {
+            if (isRetryContext) {
+                const block = lines.slice(i, Math.min(i + 5, lines.length)).join("\n");
+                if (!/rename|\.tmp|\.temp|atomic|swap/i.test(block)) {
+                    issues.push({
+                        file: filepath,
+                        line: i + 1,
+                        issue: "File write without atomic rename",
+                        severity: "low",
+                        detail: "Non-atomic write in retry path — crash during write corrupts the file",
+                    });
+                }
+            }
+        }
+        // DELETE without WHERE in retry context
+        if (/DELETE\s+FROM/i.test(line) && isRetryContext) {
+            const block = lines.slice(i, Math.min(i + 3, lines.length)).join("\n");
+            if (!/WHERE/i.test(block)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "DELETE without WHERE in retry path",
+                    severity: "high",
+                    detail: "Unbounded DELETE is dangerous in retry context — could wipe entire table",
+                });
+            }
+        }
+    }
+    return issues;
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runIdempotencyAudit(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges idempotency-audit — Verify retry/webhook operations are safely idempotent
+
+Usage:
+  judges idempotency-audit [dir]
+  judges idempotency-audit src/ --format json
+
+Options:
+  [dir]                 Directory to scan (default: .)
+  --format json         JSON output
+  --help, -h            Show this help
+
+Checks: INSERT without conflict handling, counter mutation in retries, notification dedup,
+payment idempotency keys, webhook handler guards, queue ACK ordering, atomic file writes.
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const dir = argv.find((a) => !a.startsWith("-") && argv.indexOf(a) > 0) || ".";
+    const files = collectFiles(dir);
+    const allIssues = [];
+    for (const f of files)
+        allIssues.push(...analyzeFile(f));
+    const highCount = allIssues.filter((i) => i.severity === "high").length;
+    const medCount = allIssues.filter((i) => i.severity === "medium").length;
+    const score = Math.max(0, 100 - highCount * 10 - medCount * 4);
+    if (format === "json") {
+        console.log(JSON.stringify({
+            issues: allIssues,
+            score,
+            summary: { high: highCount, medium: medCount, total: allIssues.length },
+            timestamp: new Date().toISOString(),
+        }, null, 2));
+    }
+    else {
+        const badge = score >= 80 ? "✅ SAFE" : score >= 50 ? "⚠️  RISKY" : "❌ UNSAFE";
+        console.log(`\n  Idempotency: ${badge} (${score}/100)\n  ─────────────────────────────`);
+        if (allIssues.length === 0) {
+            console.log("    No idempotency issues detected.\n");
+            return;
+        }
+        for (const issue of allIssues.slice(0, 25)) {
+            const icon = issue.severity === "high" ? "🔴" : issue.severity === "medium" ? "🟡" : "🔵";
+            console.log(`    ${icon} ${issue.issue}`);
+            console.log(`        ${issue.file}:${issue.line}`);
+            console.log(`        ${issue.detail}`);
+        }
+        if (allIssues.length > 25)
+            console.log(`    ... and ${allIssues.length - 25} more`);
+        console.log(`\n    Total: ${allIssues.length} | High: ${highCount} | Medium: ${medCount} | Score: ${score}/100\n`);
+    }
+}

package/dist/commands/ignore-list.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Ignore-list — Configurable ignore patterns for files, directories, and rules.
+ */
+interface IgnoreConfig {
+    version: string;
+    filePatterns: string[];
+    directoryPatterns: string[];
+    ruleIgnores: string[];
+    inlineSuppressions: boolean;
+}
+declare function shouldIgnoreFile(filePath: string, baseDir: string, config: IgnoreConfig): boolean;
+declare function shouldIgnoreRule(ruleId: string, config: IgnoreConfig): boolean;
+declare function filterFiles(files: string[], baseDir: string, config: IgnoreConfig): {
+    effective: string[];
+    ignored: string[];
+};
+export declare function runIgnoreList(argv: string[]): void;
+export { shouldIgnoreFile, shouldIgnoreRule, filterFiles, IgnoreConfig };