@kevinrabun/judges 3.46.0 → 3.47.0

package/dist/commands/ai-prompt-audit.js

@@ -0,0 +1,255 @@
+/**
+ * AI prompt audit — scans AI-generated code for prompt injection
+ * risks: user input echoed into SQL, shell, config, etc.
+ *
+ * Pattern-based analysis only — no data stored externally.
+ */
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
+import { join } from "path";
+const AUDIT_DIR = ".judges-prompt-audit";
+const AUDIT_FILE = join(AUDIT_DIR, "audit-history.json");
+const RISK_PATTERNS = [
+    {
+        id: "sql-template-literal",
+        regex: /`[^`]*\$\{[^}]*(?:user|input|param|query|req\.|request|body|args)[^}]*\}[^`]*(?:SELECT|INSERT|UPDATE|DELETE|FROM|WHERE)/i,
+        severity: "critical",
+        description: "Template literal with user input in SQL context",
+        recommendation: "Use parameterized queries ($1, $2) instead of string interpolation",
+    },
+    {
+        id: "sql-concat",
+        regex: /(?:query|sql|execute|prepare)\s*\([^)]*(?:\+|\bconcat)\s*[^)]*(?:user|input|param|req\.|request|body)/i,
+        severity: "critical",
+        description: "String concatenation with user input in SQL query",
+        recommendation: "Use parameterized queries with placeholder values",
+    },
+    {
+        id: "shell-injection",
+        regex: /(?:exec|spawn|execSync|execFile|system|popen)\s*\([^)]*(?:\$\{|[\s+].*(?:user|input|param|req\.|args))/i,
+        severity: "critical",
+        description: "User input in shell command execution",
+        recommendation: "Use execFile with argument array, or validate against an allowlist",
+    },
+    {
+        id: "eval-user-input",
+        regex: /(?:eval|Function|setTimeout|setInterval)\s*\([^)]*(?:user|input|param|req\.|request|body|query)/i,
+        severity: "critical",
+        description: "User input passed to eval or dynamic code execution",
+        recommendation: "Never use eval with user input; use safe parsers instead",
+    },
+    {
+        id: "innerHTML-assignment",
+        regex: /\.innerHTML\s*=\s*(?!['"`](?:''|""|``)).*(?:user|input|param|data|response|result)/i,
+        severity: "high",
+        description: "Dynamic content assigned to innerHTML without sanitization",
+        recommendation: "Use textContent for text or a sanitization library (DOMPurify) for HTML",
+    },
+    {
+        id: "hardcoded-secret",
+        regex: /(?:password|secret|api_key|apiKey|token|auth)\s*[:=]\s*['"][^'"]{8,}['"]/i,
+        severity: "high",
+        description: "Hardcoded credential or secret in source code",
+        recommendation: "Use environment variables or a secrets manager",
+    },
+    {
+        id: "url-user-input",
+        regex: /(?:fetch|axios|http\.get|request|got)\s*\([^)]*(?:\$\{|[\s+].*(?:user|input|param|req\.|url|host))/i,
+        severity: "high",
+        description: "User-controlled URL in HTTP request (SSRF risk)",
+        recommendation: "Validate URLs against an allowlist and block private IP ranges",
+    },
+    {
+        id: "path-traversal",
+        regex: /(?:readFile|readFileSync|createReadStream|writeFile|writeFileSync|unlink|rmdir)\s*\([^)]*(?:\$\{|[\s+].*(?:user|input|param|req\.|path|file|name))/i,
+        severity: "high",
+        description: "User input in file system operation (path traversal risk)",
+        recommendation: "Sanitize paths with path.resolve and validate within allowed directory",
+    },
+    {
+        id: "prompt-echo",
+        regex: /(?:\/\/|#)\s*(?:TODO|FIXME|HACK|generated|copilot|cursor|claude|gpt|ai)[:\s].*(?:user|implement|replace|change)/i,
+        severity: "medium",
+        description: "AI prompt remnant in code comment — may expose intent or instructions",
+        recommendation: "Remove AI generation comments and prompt artifacts before committing",
+    },
+    {
+        id: "cors-wildcard",
+        regex: /(?:Access-Control-Allow-Origin|cors|origin)\s*[:=]\s*['"`]\*['"`]/i,
+        severity: "medium",
+        description: "Wildcard CORS allows any origin to access the API",
+        recommendation: "Restrict CORS to specific trusted origins",
+    },
+];
+// ─── Core ───────────────────────────────────────────────────────────────────
+function ensureDir() {
+    if (!existsSync(AUDIT_DIR))
+        mkdirSync(AUDIT_DIR, { recursive: true });
+}
+function loadStore() {
+    if (!existsSync(AUDIT_FILE))
+        return { results: [], updatedAt: new Date().toISOString() };
+    try {
+        return JSON.parse(readFileSync(AUDIT_FILE, "utf-8"));
+    }
+    catch {
+        return { results: [], updatedAt: new Date().toISOString() };
+    }
+}
+function saveStore(store) {
+    ensureDir();
+    store.updatedAt = new Date().toISOString();
+    writeFileSync(AUDIT_FILE, JSON.stringify(store, null, 2));
+}
+export function auditFile(filePath) {
+    const content = readFileSync(filePath, "utf-8");
+    const lines = content.split("\n");
+    const risks = [];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        for (const pattern of RISK_PATTERNS) {
+            if (pattern.regex.test(line)) {
+                risks.push({
+                    line: i + 1,
+                    pattern: pattern.id,
+                    severity: pattern.severity,
+                    description: pattern.description,
+                    recommendation: pattern.recommendation,
+                });
+            }
+        }
+    }
+    // Risk score: critical=30, high=15, medium=5
+    const riskScore = risks.reduce((sum, r) => {
+        if (r.severity === "critical")
+            return sum + 30;
+        if (r.severity === "high")
+            return sum + 15;
+        return sum + 5;
+    }, 0);
+    const result = {
+        file: filePath,
+        risks,
+        riskScore: Math.min(100, riskScore),
+        timestamp: new Date().toISOString(),
+    };
+    // Persist
+    const store = loadStore();
+    store.results.push(result);
+    if (store.results.length > 200)
+        store.results = store.results.slice(-200);
+    saveStore(store);
+    return result;
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runAiPromptAudit(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges ai-prompt-audit — Scan for prompt injection risks in AI-generated code
+
+Usage:
+  judges ai-prompt-audit --file src/app.ts
+  judges ai-prompt-audit --patterns
+  judges ai-prompt-audit --history
+  judges ai-prompt-audit --summary
+
+Options:
+  --file <path>           Scan a file for prompt injection risks
+  --patterns              Show all detection patterns
+  --history               Show audit history
+  --summary               Show risk summary across all audits
+  --format json           JSON output
+  --help, -h              Show this help
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    // Patterns
+    if (argv.includes("--patterns")) {
+        const patterns = RISK_PATTERNS.map(({ id, severity, description, recommendation }) => ({
+            id,
+            severity,
+            description,
+            recommendation,
+        }));
+        if (format === "json") {
+            console.log(JSON.stringify(patterns, null, 2));
+        }
+        else {
+            console.log(`\n  Prompt Audit Patterns (${patterns.length})\n  ──────────────────────────`);
+            for (const p of patterns) {
+                console.log(`    [${p.severity.padEnd(8)}] ${p.id.padEnd(25)} ${p.description}`);
+            }
+            console.log("");
+        }
+        return;
+    }
+    // History
+    if (argv.includes("--history")) {
+        const store = loadStore();
+        if (format === "json") {
+            console.log(JSON.stringify(store, null, 2));
+        }
+        else {
+            console.log(`\n  Audit History (${store.results.length} scans)\n  ──────────────────────────`);
+            for (const r of store.results.slice(-15)) {
+                const icon = r.riskScore === 0 ? "✅" : r.riskScore >= 50 ? "🔴" : "⚠️";
+                console.log(`    ${icon} ${r.timestamp.slice(0, 16)}  risk:${r.riskScore.toString().padEnd(4)} ${r.risks.length} issues  ${r.file}`);
+            }
+            console.log("");
+        }
+        return;
+    }
+    // Summary
+    if (argv.includes("--summary")) {
+        const store = loadStore();
+        const totalRisks = store.results.reduce((s, r) => s + r.risks.length, 0);
+        const critCount = store.results.reduce((s, r) => s + r.risks.filter((x) => x.severity === "critical").length, 0);
+        const highCount = store.results.reduce((s, r) => s + r.risks.filter((x) => x.severity === "high").length, 0);
+        const avgScore = store.results.length > 0
+            ? Math.round(store.results.reduce((s, r) => s + r.riskScore, 0) / store.results.length)
+            : 0;
+        if (format === "json") {
+            console.log(JSON.stringify({ totalScans: store.results.length, totalRisks, critCount, highCount, avgScore }, null, 2));
+        }
+        else {
+            console.log(`\n  Prompt Audit Summary\n  ──────────────────────────`);
+            console.log(`  Scans:    ${store.results.length}`);
+            console.log(`  Risks:    ${totalRisks} (${critCount} critical, ${highCount} high)`);
+            console.log(`  Avg risk: ${avgScore}/100`);
+            console.log("");
+        }
+        return;
+    }
+    // Scan file
+    const filePath = argv.find((_a, i) => argv[i - 1] === "--file");
+    if (!filePath) {
+        console.error("  Use --file <path>, --patterns, --history, or --summary. --help for usage.");
+        return;
+    }
+    if (!existsSync(filePath)) {
+        console.error(`  File not found: ${filePath}`);
+        return;
+    }
+    const result = auditFile(filePath);
+    if (format === "json") {
+        console.log(JSON.stringify(result, null, 2));
+    }
+    else {
+        const icon = result.riskScore === 0 ? "✅" : result.riskScore >= 50 ? "🔴" : "⚠️";
+        console.log(`\n  ${icon} Prompt Audit — ${filePath}`);
+        console.log(`  Risk score: ${result.riskScore}/100 | Issues: ${result.risks.length}`);
+        console.log(`  ──────────────────────────`);
+        if (result.risks.length === 0) {
+            console.log("    No prompt injection risks detected.");
+        }
+        else {
+            for (const r of result.risks) {
+                console.log(`    L${r.line.toString().padEnd(5)} [${r.severity.padEnd(8)}] ${r.pattern}`);
+                console.log(`           ${r.description}`);
+                console.log(`           Fix: ${r.recommendation}`);
+            }
+        }
+        console.log("");
+    }
+}
+//# sourceMappingURL=ai-prompt-audit.js.map

package/dist/commands/ai-prompt-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-prompt-audit.js","sourceRoot":"","sources":["../../src/commands/ai-prompt-audit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAwB5B,MAAM,SAAS,GAAG,sBAAsB,CAAC;AACzC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;AAYzD,MAAM,aAAa,GAAkB;IACnC;QACE,EAAE,EAAE,sBAAsB;QAC1B,KAAK,EACH,0HAA0H;QAC5H,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,iDAAiD;QAC9D,cAAc,EAAE,oEAAoE;KACrF;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,wGAAwG;QAC/G,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,mDAAmD;QAChE,cAAc,EAAE,mDAAmD;KACpE;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,yGAAyG;QAChH,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,uCAAuC;QACpD,cAAc,EAAE,oEAAoE;KACrF;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,kGAAkG;QACzG,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,qDAAqD;QAClE,cAAc,EAAE,0DAA0D;KAC3E;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,KAAK,EAAE,qFAAqF;QAC5F,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,4DAA4D;QACzE,cAAc,EAAE,yEAAyE;KAC1F;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,KAAK,EAAE,2EAA2E;QAClF,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,+CAA+C;QAC5D,cAAc,EAAE,gDAAgD;KACjE;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,qGAAqG;QAC5G,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,iDAAiD;QAC9D,cAAc,EAAE,gEAAgE;KACjF;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EACH,qJAAqJ;QACvJ,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,2DAA2D;QACxE,cAAc,EAAE,wEAAwE;KACzF;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EACH,kHAAkH;QACpH,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,uEAAuE;QACpF,cAAc,EAAE,sEAAsE;KACvF;IACD;QACE,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,oEAAoE;QAC3E,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,mDAAmD;QAChE,cAAc,EAAE,2CAA2C;KAC5D;CACF,CAAC;AAEF,+EAA+E;AAE/E,SAAS,SAAS;IAChB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACzF,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,SAAS,EAAE,CAAC;IACZ,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAgB;IACxC,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAiB,EAAE,CAAC;IAE/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;YACpC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,OAAO,EAAE,OAAO,CAAC,EAAE;oBACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,cAAc,EAAE,OAAO,CAAC,cAAc;iBACvC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACxC,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU;YAAE,OAAO,GAAG,GAAG,EAAE,CAAC;QAC/C,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,GAAG,GAAG,EAAE,CAAC;QAC3C,OAAO,GAAG,GAAG,CAAC,CAAC;IACjB,CAAC,EAAE,CAAC,CAAC,CAAC;IAEN,MAAM,MAAM,GAAgB;QAC1B,IAAI,EAAE,QAAQ;QACd,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC;QACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,UAAU;IACV,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG;QAAE,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1E,SAAS,CAAC,KAAK,CAAC,CAAC;IAEjB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,gBAAgB,CAAC,IAAc;IAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;CAgBf,CAAC,CAAC;QACC,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,UAAU,CAAC,IAAI,MAAM,CAAC;IAE1F,WAAW;IACX,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC;YACrF,EAAE;YACF,QAAQ;YACR,WAAW;YACX,cAAc;SACf,CAAC,CAAC,CAAC;QACJ,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,8BAA8B,QAAQ,CAAC,MAAM,iCAAiC,CAAC,CAAC;YAC5F,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IAED,UAAU;IACV,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,CAAC,OAAO,CAAC,MAAM,uCAAuC,CAAC,CAAC;YAC/F,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBACvE,OAAO,CAAC,GAAG,CACT,OAAO,IAAI,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY,CAAC,CAAC,IAAI,EAAE,CACxH,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IAED,UAAU;IACV,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACjH,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7G,MAAM,QAAQ,GACZ,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACtB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACvF,CAAC,CAAC,CAAC,CAAC;QACR,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAC1G,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;YACtE,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,eAAe,UAAU,KAAK,SAAS,cAAc,SAAS,QAAQ,CAAC,CAAC;YACpF,OAAO,CAAC,GAAG,CAAC,eAAe,QAAQ,MAAM,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IAED,YAAY;IACZ,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;IAChF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;QAC7F,OAAO;IACT,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,mBAAmB,QAAQ,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,SAAS,kBAAkB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC1F,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC3C,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/commands/code-owner-suggest.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Code owner suggest — auto-recommend CODEOWNERS entries
+ * based on finding patterns and resolution history.
+ *
+ * All analysis uses local data only.
+ */
+interface OwnerSuggestion {
+    path: string;
+    suggestedOwner: string;
+    reason: string;
+    confidence: number;
+    ruleCategories: string[];
+}
+export declare function suggestOwner(path: string, author: string, ruleCategories: string[]): OwnerSuggestion;
+export declare function runCodeOwnerSuggest(argv: string[]): void;
+export {};
+//# sourceMappingURL=code-owner-suggest.d.ts.map

package/dist/commands/code-owner-suggest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-owner-suggest.d.ts","sourceRoot":"","sources":["../../src/commands/code-owner-suggest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,UAAU,eAAe;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAuDD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,eAAe,CAkBpG;AAwBD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CA2HxD"}

package/dist/commands/code-owner-suggest.js

@@ -0,0 +1,215 @@
+/**
+ * Code owner suggest — auto-recommend CODEOWNERS entries
+ * based on finding patterns and resolution history.
+ *
+ * All analysis uses local data only.
+ */
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
+import { join } from "path";
+const OWNER_DIR = ".judges-code-owners";
+const OWNER_FILE = join(OWNER_DIR, "suggestions.json");
+// ─── Core ───────────────────────────────────────────────────────────────────
+function ensureDir() {
+    if (!existsSync(OWNER_DIR))
+        mkdirSync(OWNER_DIR, { recursive: true });
+}
+function loadStore() {
+    if (!existsSync(OWNER_FILE))
+        return { suggestions: [], updatedAt: new Date().toISOString() };
+    try {
+        return JSON.parse(readFileSync(OWNER_FILE, "utf-8"));
+    }
+    catch {
+        return { suggestions: [], updatedAt: new Date().toISOString() };
+    }
+}
+function saveStore(store) {
+    ensureDir();
+    store.updatedAt = new Date().toISOString();
+    writeFileSync(OWNER_FILE, JSON.stringify(store, null, 2));
+}
+function loadScoreData() {
+    // Try to load from dev-score data
+    const scoreDir = ".judges-scores";
+    if (!existsSync(scoreDir))
+        return [];
+    try {
+        const { readdirSync: rds } = require("fs");
+        const files = rds(scoreDir).filter((f) => f.endsWith(".json"));
+        return files.map((f) => {
+            try {
+                const data = JSON.parse(readFileSync(join(scoreDir, f), "utf-8"));
+                return {
+                    author: data.author || f.replace(".json", ""),
+                    findingsFixed: data.findingsFixed || data.score || 0,
+                    categories: data.topCategories || [],
+                };
+            }
+            catch {
+                return { author: f.replace(".json", ""), findingsFixed: 0, categories: [] };
+            }
+        });
+    }
+    catch {
+        return [];
+    }
+}
+export function suggestOwner(path, author, ruleCategories) {
+    const suggestion = {
+        path,
+        suggestedOwner: author,
+        reason: `Most active reviewer for ${ruleCategories.join(", ")} findings`,
+        confidence: Math.min(100, 50 + ruleCategories.length * 10),
+        ruleCategories,
+    };
+    const store = loadStore();
+    // Replace existing suggestion for same path
+    const idx = store.suggestions.findIndex((s) => s.path === path);
+    if (idx >= 0)
+        store.suggestions[idx] = suggestion;
+    else
+        store.suggestions.push(suggestion);
+    if (store.suggestions.length > 200)
+        store.suggestions = store.suggestions.slice(-200);
+    saveStore(store);
+    return suggestion;
+}
+function generateCodeowners(suggestions) {
+    const lines = [
+        "# CODEOWNERS — Generated by judges code-owner-suggest",
+        "# Review and customize before committing",
+        "",
+    ];
+    const grouped = new Map();
+    for (const s of suggestions) {
+        const existing = grouped.get(s.suggestedOwner) || [];
+        existing.push(s.path);
+        grouped.set(s.suggestedOwner, existing);
+    }
+    for (const [owner, paths] of grouped) {
+        for (const p of paths) {
+            lines.push(`${p} @${owner}`);
+        }
+    }
+    return lines.join("\n") + "\n";
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runCodeOwnerSuggest(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges code-owner-suggest — Auto-recommend CODEOWNERS entries
+
+Usage:
+  judges code-owner-suggest --analyze
+  judges code-owner-suggest --suggest --path "src/auth/" --owner "alice@co.com" --rules SEC,AUTH
+  judges code-owner-suggest --export
+  judges code-owner-suggest --export --out CODEOWNERS
+
+Options:
+  --analyze               Auto-suggest from dev-score and finding data
+  --suggest               Manually add a suggestion
+  --path <path>           File/directory path for suggestion
+  --owner <name>          Owner email/username
+  --rules <csv>           Rule categories (comma-separated)
+  --export                Export as CODEOWNERS format
+  --out <file>            Write CODEOWNERS to file
+  --format json           JSON output
+  --help, -h              Show this help
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    // Manual suggestion
+    if (argv.includes("--suggest")) {
+        const path = argv.find((_a, i) => argv[i - 1] === "--path");
+        const owner = argv.find((_a, i) => argv[i - 1] === "--owner");
+        const rulesStr = argv.find((_a, i) => argv[i - 1] === "--rules");
+        if (!path || !owner) {
+            console.error("  --path and --owner required for --suggest");
+            return;
+        }
+        const rules = rulesStr ? rulesStr.split(",") : [];
+        const suggestion = suggestOwner(path, owner, rules);
+        if (format === "json") {
+            console.log(JSON.stringify(suggestion, null, 2));
+        }
+        else {
+            console.log(`\n  ✅ Suggestion recorded:`);
+            console.log(`     ${suggestion.path} → @${suggestion.suggestedOwner} (${suggestion.confidence}% confidence)`);
+            console.log(`     Reason: ${suggestion.reason}\n`);
+        }
+        return;
+    }
+    // Auto-analyze
+    if (argv.includes("--analyze")) {
+        const devs = loadScoreData();
+        if (devs.length === 0) {
+            console.log("  No dev-score data found. Record developer activity with `judges dev-score` first.");
+            return;
+        }
+        const suggestions = [];
+        // Map categories to path prefixes
+        const categoryPaths = {
+            SEC: "src/security/",
+            AUTH: "src/auth/",
+            SQL: "src/database/",
+            XSS: "src/frontend/",
+            CRYPTO: "src/crypto/",
+            SSRF: "src/network/",
+            CMD: "src/commands/",
+        };
+        for (const dev of devs) {
+            for (const cat of dev.categories) {
+                const path = categoryPaths[cat] || `src/${cat.toLowerCase()}/`;
+                suggestions.push(suggestOwner(path, dev.author, [cat]));
+            }
+        }
+        if (format === "json") {
+            console.log(JSON.stringify(suggestions, null, 2));
+        }
+        else {
+            console.log(`\n  Auto-Analyzed Code Owners (${suggestions.length} suggestions)\n  ──────────────────────────`);
+            for (const s of suggestions) {
+                console.log(`    ${s.path.padEnd(25)} → @${s.suggestedOwner.padEnd(20)} ${s.ruleCategories.join(",")}`);
+            }
+            console.log(`\n  Export with: judges code-owner-suggest --export\n`);
+        }
+        return;
+    }
+    // Export
+    if (argv.includes("--export")) {
+        const store = loadStore();
+        if (store.suggestions.length === 0) {
+            console.log("  No suggestions yet. Use --analyze or --suggest first.");
+            return;
+        }
+        const content = generateCodeowners(store.suggestions);
+        const outPath = argv.find((_a, i) => argv[i - 1] === "--out");
+        if (outPath) {
+            writeFileSync(outPath, content);
+            console.log(`  ✅ Written to ${outPath} (${store.suggestions.length} entries)`);
+        }
+        else {
+            console.log(content);
+        }
+        return;
+    }
+    // Default: show current suggestions
+    const store = loadStore();
+    if (format === "json") {
+        console.log(JSON.stringify(store, null, 2));
+    }
+    else {
+        console.log(`\n  Code Owner Suggestions (${store.suggestions.length})\n  ──────────────────────────`);
+        if (store.suggestions.length === 0) {
+            console.log("    No suggestions yet. Use --analyze or --suggest to add.");
+        }
+        else {
+            for (const s of store.suggestions) {
+                console.log(`    ${s.path.padEnd(25)} → @${s.suggestedOwner.padEnd(20)} ${s.confidence}% ${s.ruleCategories.join(",")}`);
+            }
+        }
+        console.log("");
+    }
+}
+//# sourceMappingURL=code-owner-suggest.js.map

package/dist/commands/code-owner-suggest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-owner-suggest.js","sourceRoot":"","sources":["../../src/commands/code-owner-suggest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAiB5B,MAAM,SAAS,GAAG,qBAAqB,CAAC;AACxC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAEvD,+EAA+E;AAE/E,SAAS,SAAS;IAChB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC7F,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,SAAS,EAAE,CAAC;IACZ,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa;IACpB,kCAAkC;IAClC,MAAM,QAAQ,GAAG,gBAAgB,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAa,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE;YAC7B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;gBAClE,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC7C,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC;oBACpD,UAAU,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE;iBACrC,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YAC9E,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAc,EAAE,cAAwB;IACjF,MAAM,UAAU,GAAoB;QAClC,IAAI;QACJ,cAAc,EAAE,MAAM;QACtB,MAAM,EAAE,4BAA4B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW;QACxE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,cAAc,CAAC,MAAM,GAAG,EAAE,CAAC;QAC1D,cAAc;KACf,CAAC;IAEF,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,4CAA4C;IAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAChE,IAAI,GAAG,IAAI,CAAC;QAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC;;QAC7C,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,GAAG;QAAE,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;IACtF,SAAS,CAAC,KAAK,CAAC,CAAC;IAEjB,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,kBAAkB,CAAC,WAA8B;IACxD,MAAM,KAAK,GAAG;QACZ,uDAAuD;QACvD,0CAA0C;QAC1C,EAAE;KACH,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,mBAAmB,CAAC,IAAc;IAChD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;CAmBf,CAAC,CAAC;QACC,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,UAAU,CAAC,IAAI,MAAM,CAAC;IAE1F,oBAAoB;IACpB,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,QAAQ,UAAU,CAAC,IAAI,OAAO,UAAU,CAAC,cAAc,KAAK,UAAU,CAAC,UAAU,eAAe,CAAC,CAAC;YAC9G,OAAO,CAAC,GAAG,CAAC,gBAAgB,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC;QACrD,CAAC;QACD,OAAO;IACT,CAAC;IAED,eAAe;IACf,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,qFAAqF,CAAC,CAAC;YACnG,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAsB,EAAE,CAAC;QAC1C,kCAAkC;QAClC,MAAM,aAAa,GAA2B;YAC5C,GAAG,EAAE,eAAe;YACpB,IAAI,EAAE,WAAW;YACjB,GAAG,EAAE,eAAe;YACpB,GAAG,EAAE,eAAe;YACpB,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,cAAc;YACpB,GAAG,EAAE,eAAe;SACrB,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC;gBAC/D,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,kCAAkC,WAAW,CAAC,MAAM,6CAA6C,CAAC,CAAC;YAC/G,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1G,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;QACvE,CAAC;QACD,OAAO;IACT,CAAC;IAED,SAAS;IACT,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;QAC9E,IAAI,OAAO,EAAE,CAAC;YACZ,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,kBAAkB,OAAO,KAAK,KAAK,CAAC,WAAW,CAAC,MAAM,WAAW,CAAC,CAAC;QACjF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;QACD,OAAO;IACT,CAAC;IAED,oCAAoC;IACpC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,CAAC,WAAW,CAAC,MAAM,iCAAiC,CAAC,CAAC;QACtG,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO,CAAC,GAAG,CACT,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC5G,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/commands/cost-forecast.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Cost forecast — projects 30/60/90-day security debt and
+ * remediation cost trends from local finding history.
+ *
+ * All data stays local — no upload or external services.
+ */
+interface CostSnapshot {
+    date: string;
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+    totalFindings: number;
+    estimatedCost: number;
+}
+export declare function recordSnapshot(critical: number, high: number, medium: number, low: number): CostSnapshot;
+export declare function runCostForecast(argv: string[]): void;
+export {};
+//# sourceMappingURL=cost-forecast.d.ts.map

package/dist/commands/cost-forecast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost-forecast.d.ts","sourceRoot":"","sources":["../../src/commands/cost-forecast.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,UAAU,YAAY;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB;AAoDD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,CAkDxG;AAID,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CA6GpD"}