@kevinrabun/judges 3.53.0 → 3.54.0

package/dist/commands/snippet-eval.js

@@ -0,0 +1,224 @@
+/**
+ * Snippet eval — evaluate a code snippet from stdin or a string
+ * argument without needing a file, with instant formatted output.
+ *
+ * Zero-friction entry point for evaluating AI-generated code snippets.
+ */
+import { readFileSync } from "fs";
+const SNIPPET_RULES = [
+    {
+        id: "SNIP-001",
+        title: "SQL injection risk",
+        pattern: /(?:SELECT|INSERT|UPDATE|DELETE).*\+\s*\w|`\$\{.*(?:SELECT|INSERT|UPDATE|DELETE)/i,
+        severity: "high",
+        recommendation: "Use parameterized queries",
+    },
+    {
+        id: "SNIP-002",
+        title: "XSS vulnerability",
+        pattern: /innerHTML|dangerouslySetInnerHTML|document\.write/i,
+        severity: "high",
+        recommendation: "Sanitize user input before DOM insertion",
+    },
+    {
+        id: "SNIP-003",
+        title: "Hardcoded secret",
+        pattern: /(?:password|secret|api.?key|token)\s*[:=]\s*['"][^'"]{8,}/i,
+        severity: "critical",
+        recommendation: "Use environment variables or secrets manager",
+    },
+    {
+        id: "SNIP-004",
+        title: "eval() usage",
+        pattern: /\beval\s*\(|new\s+Function\s*\(/i,
+        severity: "high",
+        recommendation: "Use safe expression parsers instead of eval",
+    },
+    {
+        id: "SNIP-005",
+        title: "Empty catch block",
+        pattern: /catch\s*\([^)]*\)\s*\{\s*\}/,
+        severity: "medium",
+        recommendation: "Log the error or re-throw it",
+    },
+    {
+        id: "SNIP-006",
+        title: "Console.log in production code",
+        pattern: /console\.(log|debug)\s*\(/,
+        severity: "low",
+        recommendation: "Use a proper logging framework",
+    },
+    {
+        id: "SNIP-007",
+        title: "Insecure HTTP",
+        pattern: /['"]http:\/\/(?!localhost|127\.0\.0\.1)/i,
+        severity: "medium",
+        recommendation: "Use HTTPS for all external connections",
+    },
+    {
+        id: "SNIP-008",
+        title: "Weak crypto",
+        pattern: /Math\.random\s*\(\)|createHash\s*\(\s*['"]md5['"]\)/i,
+        severity: "high",
+        recommendation: "Use crypto.randomUUID() or SHA-256+",
+    },
+    {
+        id: "SNIP-009",
+        title: "Command injection risk",
+        pattern: /execSync\s*\(.*\+|spawn\s*\(.*\$\{/i,
+        severity: "critical",
+        recommendation: "Validate/sanitize inputs, use array args with spawn",
+    },
+    {
+        id: "SNIP-010",
+        title: "Permissive CORS",
+        pattern: /cors\(\s*\)|Allow-Origin.*\*/i,
+        severity: "medium",
+        recommendation: "Specify allowed origins explicitly",
+    },
+    {
+        id: "SNIP-011",
+        title: "Missing error handling",
+        pattern: /\.then\s*\([^)]*\)\s*(?!\.catch)/i,
+        severity: "medium",
+        recommendation: "Add .catch() or use async/await with try/catch",
+    },
+    {
+        id: "SNIP-012",
+        title: "SELECT * usage",
+        pattern: /SELECT\s+\*\s+FROM/i,
+        severity: "low",
+        recommendation: "Select only needed columns",
+    },
+];
+function scanSnippet(code, _lang) {
+    const findings = [];
+    const lines = code.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        for (const rule of SNIPPET_RULES) {
+            if (rule.pattern.test(lines[i])) {
+                if (!findings.some((f) => f.ruleId === rule.id && Math.abs(f.line - (i + 1)) < 3)) {
+                    findings.push({
+                        ruleId: rule.id,
+                        title: rule.title,
+                        severity: rule.severity,
+                        line: i + 1,
+                        recommendation: rule.recommendation,
+                    });
+                }
+            }
+        }
+    }
+    return findings;
+}
+// ─── Language Detection ────────────────────────────────────────────────────
+function detectLanguage(code) {
+    if (/\bimport\s+\{.*\}\s+from\s+['"]|:\s*(string|number|boolean|void)\b|interface\s+\w+/.test(code))
+        return "typescript";
+    if (/\bdef\s+\w+\s*\(|import\s+\w+\s*$|from\s+\w+\s+import/m.test(code))
+        return "python";
+    if (/\bfunc\s+\w+\s*\(|package\s+\w+|:=\s*/.test(code))
+        return "go";
+    if (/\bfn\s+\w+\s*\(|let\s+mut\s|impl\s+\w+/.test(code))
+        return "rust";
+    if (/\bpublic\s+class\s|System\.out\.|@Override/.test(code))
+        return "java";
+    if (/\bnamespace\s+\w+|using\s+System|public\s+async\s+Task/.test(code))
+        return "csharp";
+    if (/\bfunction\s+\w+|const\s+\w+\s*=|require\s*\(/.test(code))
+        return "javascript";
+    return "unknown";
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runSnippetEval(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges snippet-eval — Evaluate code snippets instantly
+
+Usage:
+  echo "const key = '12345'" | judges snippet-eval
+  judges snippet-eval --code "eval(userInput)"
+  judges snippet-eval --code "SELECT * FROM users WHERE id=" --lang sql
+  judges snippet-eval --demo
+
+Options:
+  --code <snippet>      Code snippet to evaluate (or pipe via stdin)
+  --lang <language>     Language hint (auto-detected if omitted)
+  --demo                Run with demo vulnerable code
+  --format json         JSON output
+  --help, -h            Show this help
+
+Zero-friction evaluation — no project setup needed.
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const codeArg = argv.find((_a, i) => argv[i - 1] === "--code") || "";
+    const langArg = argv.find((_a, i) => argv[i - 1] === "--lang") || "";
+    const isDemo = argv.includes("--demo");
+    let code;
+    if (isDemo) {
+        code = `// AI-generated API handler
+const query = "SELECT * FROM users WHERE id=" + req.params.id;
+const apiKey = "sk-proj-1234567890abcdef1234567890";
+document.innerHTML = userInput;
+try { await riskyOperation(); } catch (e) {}
+console.log("Debug: user token = " + token);
+fetch("http://api.example.com/data");
+const sessionId = Math.random().toString(36);`;
+    }
+    else if (codeArg) {
+        code = codeArg;
+    }
+    else {
+        // Try reading from stdin
+        try {
+            code = readFileSync(0, "utf-8");
+        }
+        catch {
+            console.error("  Provide code via --code, --demo, or pipe to stdin");
+            return;
+        }
+    }
+    if (!code.trim()) {
+        console.error("  No code provided");
+        return;
+    }
+    const lang = langArg || detectLanguage(code);
+    const findings = scanSnippet(code, lang);
+    // Determine verdict
+    const hasCritical = findings.some((f) => f.severity === "critical");
+    const hasHigh = findings.some((f) => f.severity === "high");
+    const verdict = hasCritical || findings.length > 5
+        ? "FAIL"
+        : hasHigh || findings.length > 2
+            ? "WARN"
+            : findings.length === 0
+                ? "SAFE"
+                : "WARN";
+    if (format === "json") {
+        console.log(JSON.stringify({
+            verdict,
+            language: lang,
+            findings,
+            lines: code.split("\n").length,
+            timestamp: new Date().toISOString(),
+        }, null, 2));
+    }
+    else {
+        const badge = verdict === "SAFE" ? "✅ SAFE" : verdict === "WARN" ? "⚠️  WARN" : "❌ FAIL";
+        console.log(`\n  Snippet Eval: ${badge}  (${lang}, ${code.split("\n").length} lines)\n  ──────────────────────────`);
+        if (findings.length === 0) {
+            console.log("  No issues detected in snippet.");
+        }
+        else {
+            for (const f of findings) {
+                const icon = f.severity === "critical" ? "🔴" : f.severity === "high" ? "🟠" : f.severity === "medium" ? "🟡" : "⚪";
+                console.log(`    ${icon} L${f.line} [${f.severity}] ${f.ruleId}: ${f.title}`);
+                console.log(`        💡 ${f.recommendation}`);
+            }
+        }
+        console.log(`\n    ${findings.length} finding(s) | Verdict: ${verdict}\n`);
+    }
+}
+//# sourceMappingURL=snippet-eval.js.map

package/dist/commands/snippet-eval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snippet-eval.js","sourceRoot":"","sources":["../../src/commands/snippet-eval.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAYlC,MAAM,aAAa,GAMd;IACH;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,oBAAoB;QAC3B,OAAO,EAAE,kFAAkF;QAC3F,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,2BAA2B;KAC5C;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE,oDAAoD;QAC7D,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,0CAA0C;KAC3D;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE,4DAA4D;QACrE,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,8CAA8C;KAC/D;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,6CAA6C;KAC9D;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE,6BAA6B;QACtC,QAAQ,EAAE,QAAQ;QAClB,cAAc,EAAE,8BAA8B;KAC/C;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,gCAAgC;QACvC,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,KAAK;QACf,cAAc,EAAE,gCAAgC;KACjD;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,eAAe;QACtB,OAAO,EAAE,0CAA0C;QACnD,QAAQ,EAAE,QAAQ;QAClB,cAAc,EAAE,wCAAwC;KACzD;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE,sDAAsD;QAC/D,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,qCAAqC;KACtD;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,wBAAwB;QAC/B,OAAO,EAAE,qCAAqC;QAC9C,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,qDAAqD;KACtE;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,iBAAiB;QACxB,OAAO,EAAE,+BAA+B;QACxC,QAAQ,EAAE,QAAQ;QAClB,cAAc,EAAE,oCAAoC;KACrD;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,wBAAwB;QAC/B,OAAO,EAAE,mCAAmC;QAC5C,QAAQ,EAAE,QAAQ;QAClB,cAAc,EAAE,gDAAgD;KACjE;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,gBAAgB;QACvB,OAAO,EAAE,qBAAqB;QAC9B,QAAQ,EAAE,KAAK;QACf,cAAc,EAAE,4BAA4B;KAC7C;CACF,CAAC;AAEF,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAClF,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,cAAc,EAAE,IAAI,CAAC,cAAc;qBACpC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAE9E,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,oFAAoF,CAAC,IAAI,CAAC,IAAI,CAAC;QACjG,OAAO,YAAY,CAAC;IACtB,IAAI,wDAAwD,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzF,IAAI,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACvE,IAAI,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3E,IAAI,wDAAwD,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzF,IAAI,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC;IACpF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,cAAc,CAAC,IAAc;IAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;CAiBf,CAAC,CAAC;QACC,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,UAAU,CAAC,IAAI,MAAM,CAAC;IAC1F,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;IACrF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;IACrF,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEvC,IAAI,IAAY,CAAC;IAEjB,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,GAAG;;;;;;;8CAOmC,CAAC;IAC7C,CAAC;SAAM,IAAI,OAAO,EAAE,CAAC;QACnB,IAAI,GAAG,OAAO,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,yBAAyB;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACpC,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEzC,oBAAoB;IACpB,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IAC5D,MAAM,OAAO,GACX,WAAW,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAChC,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC9B,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBACrB,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,MAAM,CAAC;IAEjB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;YACE,OAAO;YACP,QAAQ,EAAE,IAAI;YACd,QAAQ;YACR,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM;YAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QACzF,OAAO,CAAC,GAAG,CACT,qBAAqB,KAAK,MAAM,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,uCAAuC,CACxG,CAAC;QAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,MAAM,IAAI,GACR,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;gBACzG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC9E,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,MAAM,0BAA0B,OAAO,IAAI,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kevinrabun/judges",
-  "version": "3.53.0",
+  "version": "3.54.0",
   "description": "45 specialized judges that evaluate AI-generated code for security, cost, and quality.",
   "mcpName": "io.github.KevinRabun/judges",
   "type": "module",

package/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/kevinrabun/judges",
     "source": "github"
   },
-  "version": "3.53.0",
+  "version": "3.54.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@kevinrabun/judges",
-      "version": "3.53.0",
+      "version": "3.54.0",
       "transport": {
         "type": "stdio"
       }