@kevinrabun/judges 3.61.0 → 3.63.0

package/dist/commands/review-explain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-explain.d.ts","sourceRoot":"","sources":["../../src/commands/review-explain.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA6JH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CA8ErD"}

package/dist/commands/review-explain.js

@@ -0,0 +1,195 @@
+/**
+ * Review-explain — Generate plain-language explanation of review findings
+ * for non-technical stakeholders.
+ */
+import { readFileSync, existsSync } from "fs";
+// ─── Plain-language explanations ───────────────────────────────────────────
+const EXPLANATIONS = {
+    "hardcoded-secret": {
+        plain: "A password or secret key is written directly in the code, visible to anyone who can see the source.",
+        impact: "If code is shared or leaked, attackers can immediately access protected systems. This is a leading cause of data breaches.",
+        recommendation: "Move secrets to environment variables or a secrets manager. Never commit credentials to version control.",
+    },
+    "eval-usage": {
+        plain: "The code can execute arbitrary commands, potentially from untrusted input.",
+        impact: "An attacker could inject malicious code that runs with full application permissions, leading to data theft or system compromise.",
+        recommendation: "Replace with safer alternatives that don't allow arbitrary code execution.",
+    },
+    "sql-injection": {
+        plain: "User input is being inserted directly into database queries without protection.",
+        impact: "Attackers can manipulate queries to steal, modify, or delete data. SQL injection is consistently in the OWASP Top 10.",
+        recommendation: "Use parameterized queries or an ORM that handles input sanitization automatically.",
+    },
+    "sql-concat": {
+        plain: "Database queries are built by concatenating strings, which can allow injection attacks.",
+        impact: "Similar to SQL injection — attackers can manipulate queries through crafted input.",
+        recommendation: "Use parameterized queries instead of string concatenation.",
+    },
+    "xss-risk": {
+        plain: "The code inserts content directly into web pages without sanitization.",
+        impact: "Attackers can inject scripts that steal user credentials, redirect users, or deface the application.",
+        recommendation: "Always sanitize user content before displaying it. Use framework-provided escaping functions.",
+    },
+    "command-injection": {
+        plain: "The code runs system commands that include user-controllable data.",
+        impact: "An attacker could execute arbitrary commands on the server, potentially taking full control.",
+        recommendation: "Avoid passing user input to system commands. Use libraries with safe APIs instead.",
+    },
+    "empty-catch": {
+        plain: "Errors are being silently ignored — the code catches errors but does nothing with them.",
+        impact: "Issues go undetected in production, making debugging extremely difficult and potentially hiding security problems.",
+        recommendation: "Log errors appropriately and handle them based on their severity.",
+    },
+    "any-type": {
+        plain: "Code uses unsafe typing that bypasses compile-time safety checks.",
+        impact: "Bugs that would normally be caught before deployment can slip through to production.",
+        recommendation: "Use proper type definitions to catch errors during development rather than in production.",
+    },
+    "console-log": {
+        plain: "Debug logging statements are present in production code.",
+        impact: "Can leak sensitive information and create unnecessary noise in production logs.",
+        recommendation: "Use a proper logging framework with configurable levels.",
+    },
+    "deprecated-api": {
+        plain: "The code uses outdated functions that may be removed in future releases.",
+        impact: "Future updates could break the application. Deprecated APIs may also have known security vulnerabilities.",
+        recommendation: "Migrate to the recommended replacement APIs.",
+    },
+    "unsafe-regex": {
+        plain: "A pattern matching expression is built from user input, which could be exploited.",
+        impact: "Attackers can craft input that causes the application to hang or consume excessive resources.",
+        recommendation: "Validate and escape user input before using it in pattern matching.",
+    },
+    "todo-fixme": {
+        plain: "The code contains unfinished work markers that haven't been addressed.",
+        impact: "Incomplete implementations may have missing validation, error handling, or security checks.",
+        recommendation: "Track these in your project management tool and resolve before release.",
+    },
+};
+// ─── Analysis ──────────────────────────────────────────────────────────────
+function explainFindings(findings) {
+    // Deduplicate by pattern
+    const patternSet = new Map();
+    for (const f of findings) {
+        const existing = patternSet.get(f.pattern);
+        if (existing) {
+            existing.count++;
+        }
+        else {
+            patternSet.set(f.pattern, { severity: f.severity, count: 1 });
+        }
+    }
+    const explanations = [];
+    for (const [pattern, data] of patternSet) {
+        const expl = EXPLANATIONS[pattern] || {
+            plain: `Found ${data.count} instance(s) of '${pattern}' pattern.`,
+            impact: "This finding may affect code quality or security depending on context.",
+            recommendation: "Review each instance and address based on your team's standards.",
+        };
+        explanations.push({
+            pattern,
+            severity: data.severity,
+            plainExplanation: expl.plain,
+            businessImpact: expl.impact,
+            recommendation: expl.recommendation,
+        });
+    }
+    // Sort by severity
+    const sevRank = { critical: 4, high: 3, medium: 2, low: 1 };
+    explanations.sort((a, b) => (sevRank[b.severity] || 0) - (sevRank[a.severity] || 0));
+    const criticalCount = findings.filter((f) => f.severity === "critical").length;
+    const highCount = findings.filter((f) => f.severity === "high").length;
+    let riskLevel = "Low";
+    if (criticalCount > 0)
+        riskLevel = "Critical";
+    else if (highCount > 0)
+        riskLevel = "High";
+    else if (findings.length > 10)
+        riskLevel = "Medium";
+    let executiveSummary;
+    if (findings.length === 0) {
+        executiveSummary = "No issues were found in this review. The code appears to meet quality and security standards.";
+    }
+    else if (criticalCount > 0) {
+        executiveSummary = `This review found ${criticalCount} critical security issue(s) that must be resolved before deployment. These issues could lead to data breaches or system compromise if exploited.`;
+    }
+    else if (highCount > 0) {
+        executiveSummary = `This review found ${highCount} high-severity issue(s) that should be addressed promptly. While not immediately exploitable, they represent significant risk.`;
+    }
+    else {
+        executiveSummary = `This review found ${findings.length} issue(s), none critical. These represent code quality improvements that will reduce technical debt.`;
+    }
+    return { totalFindings: findings.length, explanations, executiveSummary, riskLevel };
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runReviewExplain(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges review-explain — Plain-language explanation of review findings
+
+Usage:
+  judges review-explain --file findings.json    Explain findings from JSON
+  judges review-explain --format json           JSON output
+
+Options:
+  --file <path>        Path to findings JSON (array or {findings: [...]})
+  --format json        JSON output
+  --help, -h           Show this help
+
+Translates technical security and quality findings into plain language
+that non-technical stakeholders can understand. Includes business impact
+and actionable recommendations.
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const findingsFile = argv.find((_a, i) => argv[i - 1] === "--file");
+    if (!findingsFile) {
+        console.error("Error: --file <path> is required. Provide a JSON file with findings.");
+        process.exitCode = 1;
+        return;
+    }
+    if (!existsSync(findingsFile)) {
+        console.error(`Error: File '${findingsFile}' not found.`);
+        process.exitCode = 1;
+        return;
+    }
+    let findings;
+    try {
+        const raw = JSON.parse(readFileSync(findingsFile, "utf-8"));
+        findings = Array.isArray(raw) ? raw : Array.isArray(raw.findings) ? raw.findings : [];
+    }
+    catch {
+        console.error("Error: Cannot parse findings file.");
+        process.exitCode = 1;
+        return;
+    }
+    const result = explainFindings(findings);
+    if (format === "json") {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    console.log(`\n  Review Explanation\n  ─────────────────────────────`);
+    console.log(`    Risk Level: ${result.riskLevel}`);
+    console.log(`    Total Findings: ${result.totalFindings}\n`);
+    console.log(`    Executive Summary:`);
+    console.log(`    ${result.executiveSummary}`);
+    if (result.explanations.length > 0) {
+        console.log("\n    Detailed Findings:");
+        for (const expl of result.explanations) {
+            const icon = expl.severity === "critical"
+                ? "🔴"
+                : expl.severity === "high"
+                    ? "🟠"
+                    : expl.severity === "medium"
+                        ? "🟡"
+                        : "🔵";
+            console.log(`\n      ${icon} ${expl.pattern} (${expl.severity})`);
+            console.log(`         What: ${expl.plainExplanation}`);
+            console.log(`         Impact: ${expl.businessImpact}`);
+            console.log(`         Action: ${expl.recommendation}`);
+        }
+    }
+    console.log();
+}
+//# sourceMappingURL=review-explain.js.map

package/dist/commands/review-explain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-explain.js","sourceRoot":"","sources":["../../src/commands/review-explain.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AA0B9C,8EAA8E;AAE9E,MAAM,YAAY,GAA8E;IAC9F,kBAAkB,EAAE;QAClB,KAAK,EAAE,qGAAqG;QAC5G,MAAM,EACJ,4HAA4H;QAC9H,cAAc,EACZ,0GAA0G;KAC7G;IACD,YAAY,EAAE;QACZ,KAAK,EAAE,4EAA4E;QACnF,MAAM,EACJ,kIAAkI;QACpI,cAAc,EAAE,4EAA4E;KAC7F;IACD,eAAe,EAAE;QACf,KAAK,EAAE,iFAAiF;QACxF,MAAM,EACJ,uHAAuH;QACzH,cAAc,EAAE,oFAAoF;KACrG;IACD,YAAY,EAAE;QACZ,KAAK,EAAE,yFAAyF;QAChG,MAAM,EAAE,oFAAoF;QAC5F,cAAc,EAAE,4DAA4D;KAC7E;IACD,UAAU,EAAE;QACV,KAAK,EAAE,wEAAwE;QAC/E,MAAM,EAAE,sGAAsG;QAC9G,cAAc,EAAE,+FAA+F;KAChH;IACD,mBAAmB,EAAE;QACnB,KAAK,EAAE,oEAAoE;QAC3E,MAAM,EAAE,8FAA8F;QACtG,cAAc,EAAE,oFAAoF;KACrG;IACD,aAAa,EAAE;QACb,KAAK,EAAE,yFAAyF;QAChG,MAAM,EACJ,oHAAoH;QACtH,cAAc,EAAE,mEAAmE;KACpF;IACD,UAAU,EAAE;QACV,KAAK,EAAE,mEAAmE;QAC1E,MAAM,EAAE,sFAAsF;QAC9F,cAAc,EAAE,2FAA2F;KAC5G;IACD,aAAa,EAAE;QACb,KAAK,EAAE,0DAA0D;QACjE,MAAM,EAAE,iFAAiF;QACzF,cAAc,EAAE,0DAA0D;KAC3E;IACD,gBAAgB,EAAE;QAChB,KAAK,EAAE,0EAA0E;QACjF,MAAM,EAAE,2GAA2G;QACnH,cAAc,EAAE,8CAA8C;KAC/D;IACD,cAAc,EAAE;QACd,KAAK,EAAE,mFAAmF;QAC1F,MAAM,EAAE,+FAA+F;QACvG,cAAc,EAAE,qEAAqE;KACtF;IACD,YAAY,EAAE;QACZ,KAAK,EAAE,wEAAwE;QAC/E,MAAM,EAAE,6FAA6F;QACrG,cAAc,EAAE,yEAAyE;KAC1F;CACF,CAAC;AAEF,8EAA8E;AAE9E,SAAS,eAAe,CAAC,QAAyB;IAChD,yBAAyB;IACzB,MAAM,UAAU,GAAG,IAAI,GAAG,EAA+C,CAAC;IAC1E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAuB,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI;YACpC,KAAK,EAAE,SAAS,IAAI,CAAC,KAAK,oBAAoB,OAAO,YAAY;YACjE,MAAM,EAAE,wEAAwE;YAChF,cAAc,EAAE,kEAAkE;SACnF,CAAC;QAEF,YAAY,CAAC,IAAI,CAAC;YAChB,OAAO;YACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,KAAK;YAC5B,cAAc,EAAE,IAAI,CAAC,MAAM;YAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC,CAAC;IACL,CAAC;IAED,mBAAmB;IACnB,MAAM,OAAO,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACpF,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAErF,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;IAC/E,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAEvE,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,aAAa,GAAG,CAAC;QAAE,SAAS,GAAG,UAAU,CAAC;SACzC,IAAI,SAAS,GAAG,CAAC;QAAE,SAAS,GAAG,MAAM,CAAC;SACtC,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;QAAE,SAAS,GAAG,QAAQ,CAAC;IAEpD,IAAI,gBAAwB,CAAC;IAC7B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,gBAAgB,GAAG,+FAA+F,CAAC;IACrH,CAAC;SAAM,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QAC7B,gBAAgB,GAAG,qBAAqB,aAAa,kJAAkJ,CAAC;IAC1M,CAAC;SAAM,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACzB,gBAAgB,GAAG,qBAAqB,SAAS,gIAAgI,CAAC;IACpL,CAAC;SAAM,CAAC;QACN,gBAAgB,GAAG,qBAAqB,QAAQ,CAAC,MAAM,sGAAsG,CAAC;IAChK,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC;AACvF,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,gBAAgB,CAAC,IAAc;IAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;CAef,CAAC,CAAC;QACC,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,UAAU,CAAC,IAAI,MAAM,CAAC;IAC1F,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;IAEpF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;QACtF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,gBAAgB,YAAY,cAAc,CAAC,CAAC;QAC1D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,QAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5D,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACpD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAEzC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE9C,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACxC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACvC,MAAM,IAAI,GACR,IAAI,CAAC,QAAQ,KAAK,UAAU;gBAC1B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM;oBACxB,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ;wBAC1B,CAAC,CAAC,IAAI;wBACN,CAAC,CAAC,IAAI,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;YAClE,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;AAChB,CAAC"}

package/dist/commands/review-gate.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Review-gate — CI/CD quality gate with configurable pass/fail thresholds.
+ */
+export declare function runReviewGate(argv: string[]): void;
+//# sourceMappingURL=review-gate.d.ts.map

package/dist/commands/review-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-gate.d.ts","sourceRoot":"","sources":["../../src/commands/review-gate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAoKH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAoFlD"}

package/dist/commands/review-gate.js

@@ -0,0 +1,213 @@
+/**
+ * Review-gate — CI/CD quality gate with configurable pass/fail thresholds.
+ */
+import { readFileSync, readdirSync, statSync } from "fs";
+import { join, extname } from "path";
+// ─── Default thresholds ────────────────────────────────────────────────────
+function defaultConfig() {
+    return {
+        maxCritical: 0,
+        maxHigh: 5,
+        maxTotal: 25,
+        blockOnSecurityFindings: true,
+    };
+}
+// ─── Patterns ──────────────────────────────────────────────────────────────
+const GATE_PATTERNS = [
+    {
+        name: "hardcoded-secret",
+        severity: "critical",
+        regex: /(?:password|secret|api_key|token)\s*[:=]\s*["'][^"']{8,}/i,
+        security: true,
+    },
+    { name: "eval-usage", severity: "critical", regex: /\beval\s*\(/, security: true },
+    { name: "sql-injection", severity: "critical", regex: /(?:query|execute)\s*\(\s*["'`].*\+/, security: true },
+    { name: "xss-risk", severity: "high", regex: /innerHTML\s*=|\.html\s*\(|document\.write\s*\(/, security: true },
+    {
+        name: "unsafe-deserialization",
+        severity: "critical",
+        regex: /JSON\.parse\s*\(\s*(?:req|request|body|params|query)\b/,
+        security: true,
+    },
+    {
+        name: "command-injection",
+        severity: "critical",
+        regex: /exec(?:Sync)?\s*\(\s*(?:`[^`]*\$\{|["'][^"']*\+)/,
+        security: true,
+    },
+    {
+        name: "path-traversal",
+        severity: "high",
+        regex: /(?:readFile|writeFile|createReadStream)\s*\([^)]*(?:req|params|query)/,
+        security: true,
+    },
+    { name: "empty-catch", severity: "medium", regex: /catch\s*\([^)]*\)\s*\{\s*\}/, security: false },
+    { name: "any-type", severity: "low", regex: /:\s*any\b/, security: false },
+    { name: "console-log", severity: "low", regex: /console\.log\s*\(/, security: false },
+    { name: "deprecated-api", severity: "medium", regex: /new\s+Buffer\s*\(|\.substr\s*\(/, security: false },
+    { name: "todo-in-code", severity: "low", regex: /\/\/\s*(?:TODO|FIXME|HACK)\b/i, security: false },
+];
+// ─── Helpers ────────────────────────────────────────────────────────────────
+function collectSourceFiles(dir) {
+    const exts = new Set([".ts", ".js", ".tsx", ".jsx", ".py", ".java", ".go", ".rs", ".cs"]);
+    const files = [];
+    const skipDirs = new Set(["node_modules", ".git", "dist", "build", "coverage"]);
+    function walk(d) {
+        let entries;
+        try {
+            entries = readdirSync(d);
+        }
+        catch {
+            return;
+        }
+        for (const name of entries) {
+            if (skipDirs.has(name))
+                continue;
+            const full = join(d, name);
+            try {
+                const st = statSync(full);
+                if (st.isDirectory())
+                    walk(full);
+                else if (exts.has(extname(name)))
+                    files.push(full);
+            }
+            catch {
+                // skip
+            }
+        }
+    }
+    walk(dir);
+    return files;
+}
+function runGate(files, config) {
+    const findings = [];
+    for (const filePath of files) {
+        let content;
+        try {
+            content = readFileSync(filePath, "utf-8");
+        }
+        catch {
+            continue;
+        }
+        const lines = content.split("\n");
+        for (let i = 0; i < lines.length; i++) {
+            for (const pat of GATE_PATTERNS) {
+                if (pat.regex.test(lines[i])) {
+                    findings.push({ pattern: pat.name, severity: pat.severity, file: filePath, line: i + 1 });
+                }
+            }
+        }
+    }
+    const counts = { critical: 0, high: 0, medium: 0, low: 0, total: findings.length };
+    for (const f of findings) {
+        if (f.severity === "critical")
+            counts.critical++;
+        else if (f.severity === "high")
+            counts.high++;
+        else if (f.severity === "medium")
+            counts.medium++;
+        else
+            counts.low++;
+    }
+    const failReasons = [];
+    if (counts.critical > config.maxCritical) {
+        failReasons.push(`Critical findings (${counts.critical}) exceed threshold (${config.maxCritical})`);
+    }
+    if (counts.high > config.maxHigh) {
+        failReasons.push(`High findings (${counts.high}) exceed threshold (${config.maxHigh})`);
+    }
+    if (counts.total > config.maxTotal) {
+        failReasons.push(`Total findings (${counts.total}) exceed threshold (${config.maxTotal})`);
+    }
+    if (config.blockOnSecurityFindings) {
+        const securityFindings = findings.filter((f) => GATE_PATTERNS.find((p) => p.name === f.pattern && p.security));
+        if (securityFindings.length > 0) {
+            failReasons.push(`${securityFindings.length} security-related findings detected`);
+        }
+    }
+    return {
+        passed: failReasons.length === 0,
+        findings,
+        counts,
+        thresholds: config,
+        failReasons,
+    };
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runReviewGate(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges review-gate — CI/CD quality gate with configurable thresholds
+
+Usage:
+  judges review-gate [dir]                  Run quality gate check
+  judges review-gate --max-critical 0       Set critical threshold
+  judges review-gate --max-high 3           Set high threshold
+  judges review-gate --max-total 20         Set total threshold
+  judges review-gate --format json          JSON output
+
+Options:
+  [dir]                      Target directory (default: .)
+  --max-critical <n>         Max critical findings (default: 0)
+  --max-high <n>             Max high findings (default: 5)
+  --max-total <n>            Max total findings (default: 25)
+  --no-block-security        Don't fail on security findings
+  --format json              JSON output
+  --help, -h                 Show this help
+
+Exit code 1 if gate fails. Designed for CI/CD pipeline integration.
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const dir = argv.find((a) => !a.startsWith("-") &&
+        a !== "review-gate" &&
+        argv[argv.indexOf(a) - 1] !== "--format" &&
+        argv[argv.indexOf(a) - 1] !== "--max-critical" &&
+        argv[argv.indexOf(a) - 1] !== "--max-high" &&
+        argv[argv.indexOf(a) - 1] !== "--max-total") || ".";
+    const config = defaultConfig();
+    const getNum = (flag, fallback) => {
+        const val = argv.find((_a, i) => argv[i - 1] === flag);
+        return val ? parseInt(val, 10) : fallback;
+    };
+    config.maxCritical = getNum("--max-critical", config.maxCritical);
+    config.maxHigh = getNum("--max-high", config.maxHigh);
+    config.maxTotal = getNum("--max-total", config.maxTotal);
+    if (argv.includes("--no-block-security"))
+        config.blockOnSecurityFindings = false;
+    const files = collectSourceFiles(dir);
+    const result = runGate(files, config);
+    if (format === "json") {
+        console.log(JSON.stringify(result, null, 2));
+        if (!result.passed)
+            process.exitCode = 1;
+        return;
+    }
+    const icon = result.passed ? "✅" : "❌";
+    console.log(`\n  Quality Gate: ${icon} ${result.passed ? "PASSED" : "FAILED"}\n  ─────────────────────────────`);
+    console.log(`    Files scanned: ${files.length}`);
+    console.log(`    Total findings: ${result.counts.total}`);
+    console.log(`    Critical: ${result.counts.critical}/${config.maxCritical}  High: ${result.counts.high}/${config.maxHigh}  Total: ${result.counts.total}/${config.maxTotal}`);
+    if (result.failReasons.length > 0) {
+        console.log("\n    Fail reasons:");
+        for (const reason of result.failReasons)
+            console.log(`      ❌ ${reason}`);
+    }
+    if (result.findings.length > 0 && result.findings.length <= 20) {
+        console.log("\n    Findings:");
+        for (const f of result.findings) {
+            console.log(`      [${f.severity}] ${f.pattern} — ${f.file}:${f.line}`);
+        }
+    }
+    else if (result.findings.length > 20) {
+        console.log(`\n    Showing first 20 of ${result.findings.length} findings:`);
+        for (const f of result.findings.slice(0, 20)) {
+            console.log(`      [${f.severity}] ${f.pattern} — ${f.file}:${f.line}`);
+        }
+    }
+    console.log();
+    if (!result.passed)
+        process.exitCode = 1;
+}
+//# sourceMappingURL=review-gate.js.map

package/dist/commands/review-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-gate.js","sourceRoot":"","sources":["../../src/commands/review-gate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AA0BrC,8EAA8E;AAE9E,SAAS,aAAa;IACpB,OAAO;QACL,WAAW,EAAE,CAAC;QACd,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,EAAE;QACZ,uBAAuB,EAAE,IAAI;KAC9B,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E,MAAM,aAAa,GAA2E;IAC5F;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,2DAA2D;QAClE,QAAQ,EAAE,IAAI;KACf;IACD,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE;IAClF,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,oCAAoC,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC5G,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,gDAAgD,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC/G;QACE,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,wDAAwD;QAC/D,QAAQ,EAAE,IAAI;KACf;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kDAAkD;QACzD,QAAQ,EAAE,IAAI;KACf;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,uEAAuE;QAC9E,QAAQ,EAAE,IAAI;KACf;IACD,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,6BAA6B,EAAE,QAAQ,EAAE,KAAK,EAAE;IAClG,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE;IAC1E,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,KAAK,EAAE;IACrF,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,iCAAiC,EAAE,QAAQ,EAAE,KAAK,EAAE;IACzG,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,QAAQ,EAAE,KAAK,EAAE;CACnG,CAAC;AAEF,+EAA+E;AAE/E,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IAEhF,SAAS,IAAI,CAAC,CAAS;QACrB,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,CAAC,CAAwB,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC1B,IAAI,EAAE,CAAC,WAAW,EAAE;oBAAE,IAAI,CAAC,IAAI,CAAC,CAAC;qBAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,KAAe,EAAE,MAAkB;IAClD,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;gBAChC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC5F,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACnF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU;YAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;aAC5C,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM;YAAE,MAAM,CAAC,IAAI,EAAE,CAAC;aACzC,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,CAAC,MAAM,EAAE,CAAC;;YAC7C,MAAM,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACzC,WAAW,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,QAAQ,uBAAuB,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,WAAW,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,IAAI,uBAAuB,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnC,WAAW,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,KAAK,uBAAuB,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,MAAM,CAAC,uBAAuB,EAAE,CAAC;QACnC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/G,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,WAAW,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,MAAM,qCAAqC,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,WAAW,CAAC,MAAM,KAAK,CAAC;QAChC,QAAQ;QACR,MAAM;QACN,UAAU,EAAE,MAAM;QAClB,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,aAAa,CAAC,IAAc;IAC1C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;CAoBf,CAAC,CAAC;QACC,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,UAAU,CAAC,IAAI,MAAM,CAAC;IAC1F,MAAM,GAAG,GACP,IAAI,CAAC,IAAI,CACP,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAClB,CAAC,KAAK,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,UAAU;QACxC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,gBAAgB;QAC9C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,YAAY;QAC1C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,aAAa,CAC9C,IAAI,GAAG,CAAC;IAEX,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,QAAgB,EAAU,EAAE;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QACvE,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC5C,CAAC,CAAC;IACF,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAClE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAAE,MAAM,CAAC,uBAAuB,GAAG,KAAK,CAAC;IAEjF,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAEtC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,mCAAmC,CAAC,CAAC;IACjH,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CACT,iBAAiB,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,WAAW,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,YAAY,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CACjK,CAAC;IAEF,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACnC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,6BAA6B,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY,CAAC,CAAC;QAC7E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AAC3C,CAAC"}

package/dist/commands/review-log.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Review-log — Structured audit log of all review actions for compliance.
+ */
+interface ReviewLogEntry {
+    timestamp: string;
+    action: string;
+    command: string;
+    filesReviewed: number;
+    findingsCount: number;
+    severity: {
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+    };
+    duration: number;
+    user: string;
+    commit: string;
+}
+declare function appendLog(entry: ReviewLogEntry): void;
+export declare function runReviewLog(argv: string[]): void;
+export { appendLog, ReviewLogEntry };
+//# sourceMappingURL=review-log.d.ts.map

package/dist/commands/review-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-log.d.ts","sourceRoot":"","sources":["../../src/commands/review-log.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,UAAU,cAAc;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAwBD,iBAAS,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAK9C;AA2DD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAuGjD;AAGD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC"}

package/dist/commands/review-log.js

@@ -0,0 +1,165 @@
+/**
+ * Review-log — Structured audit log of all review actions for compliance.
+ */
+import { readFileSync, existsSync, mkdirSync, appendFileSync, readdirSync } from "fs";
+import { join } from "path";
+// ─── Helpers ────────────────────────────────────────────────────────────────
+function getLogDir() {
+    return join(".", ".judges", "logs");
+}
+function getLogFile() {
+    const dir = getLogDir();
+    const date = new Date().toISOString().slice(0, 7); // YYYY-MM
+    return join(dir, `review-log-${date}.jsonl`);
+}
+function appendLog(entry) {
+    const dir = getLogDir();
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    const logFile = getLogFile();
+    appendFileSync(logFile, JSON.stringify(entry) + "\n", "utf-8");
+}
+function readAllLogs() {
+    const dir = getLogDir();
+    if (!existsSync(dir))
+        return [];
+    const entries = [];
+    const files = readdirSync(dir).filter((f) => f.endsWith(".jsonl")).sort();
+    for (const f of files) {
+        try {
+            const content = readFileSync(join(dir, f), "utf-8");
+            const lines = content.split("\n").filter((l) => l.trim());
+            for (const line of lines) {
+                try {
+                    entries.push(JSON.parse(line));
+                }
+                catch {
+                    // skip invalid lines
+                }
+            }
+        }
+        catch {
+            // skip unreadable files
+        }
+    }
+    return entries;
+}
+function summarizeLogs(entries) {
+    if (entries.length === 0) {
+        return {
+            totalEntries: 0,
+            recentEntries: [],
+            totalFilesReviewed: 0,
+            totalFindings: 0,
+            averageDuration: 0,
+            firstEntry: "",
+            lastEntry: "",
+        };
+    }
+    const sorted = [...entries].sort((a, b) => new Date(a.timestamp).getTime() - new Date(b.timestamp).getTime());
+    const totalFiles = entries.reduce((s, e) => s + e.filesReviewed, 0);
+    const totalFindings = entries.reduce((s, e) => s + e.findingsCount, 0);
+    const totalDuration = entries.reduce((s, e) => s + e.duration, 0);
+    return {
+        totalEntries: entries.length,
+        recentEntries: sorted.slice(-10),
+        totalFilesReviewed: totalFiles,
+        totalFindings,
+        averageDuration: Math.round(totalDuration / entries.length),
+        firstEntry: sorted[0].timestamp,
+        lastEntry: sorted[sorted.length - 1].timestamp,
+    };
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runReviewLog(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges review-log — Structured audit log of review actions
+
+Usage:
+  judges review-log show                    Show log summary
+  judges review-log record --command eval --files 10 --findings 5
+  judges review-log export                  Export all logs as JSON
+  judges review-log --format json           JSON output
+
+Subcommands:
+  show                 Show log summary and recent entries
+  record               Record a review action to the log
+  export               Export complete log as JSON
+
+Record Options:
+  --command <name>     Command that was run
+  --files <n>          Number of files reviewed
+  --findings <n>       Number of findings
+  --critical <n>       Critical findings count
+  --high <n>           High findings count
+  --medium <n>         Medium findings count
+  --low <n>            Low findings count
+  --duration <ms>      Duration in milliseconds
+  --commit <hash>      Associated commit
+
+Logs are stored locally in .judges/logs/ as monthly JSONL files.
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const subcommand = argv.find((a) => !a.startsWith("-") && a !== "review-log") || "show";
+    if (subcommand === "record") {
+        const getNum = (flag) => {
+            const val = argv.find((_a, i) => argv[i - 1] === flag);
+            return val ? parseInt(val, 10) : 0;
+        };
+        const getStr = (flag) => {
+            return argv.find((_a, i) => argv[i - 1] === flag) || "";
+        };
+        const entry = {
+            timestamp: new Date().toISOString(),
+            action: "review",
+            command: getStr("--command") || "unknown",
+            filesReviewed: getNum("--files"),
+            findingsCount: getNum("--findings"),
+            severity: {
+                critical: getNum("--critical"),
+                high: getNum("--high"),
+                medium: getNum("--medium"),
+                low: getNum("--low"),
+            },
+            duration: getNum("--duration"),
+            user: process.env.USER || process.env.USERNAME || "unknown",
+            commit: getStr("--commit"),
+        };
+        appendLog(entry);
+        console.log(`Logged review action: ${entry.command} (${entry.findingsCount} findings, ${entry.filesReviewed} files).`);
+        return;
+    }
+    if (subcommand === "export") {
+        const entries = readAllLogs();
+        console.log(JSON.stringify(entries, null, 2));
+        return;
+    }
+    // Show
+    const entries = readAllLogs();
+    const summary = summarizeLogs(entries);
+    if (format === "json") {
+        console.log(JSON.stringify(summary, null, 2));
+        return;
+    }
+    console.log(`\n  Review Log\n  ─────────────────────────────`);
+    console.log(`    Total entries: ${summary.totalEntries}`);
+    console.log(`    Total files reviewed: ${summary.totalFilesReviewed}`);
+    console.log(`    Total findings: ${summary.totalFindings}`);
+    console.log(`    Average duration: ${summary.averageDuration}ms`);
+    if (summary.firstEntry) {
+        console.log(`    Period: ${summary.firstEntry.slice(0, 10)} to ${summary.lastEntry.slice(0, 10)}`);
+    }
+    if (summary.recentEntries.length > 0) {
+        console.log("\n    Recent entries:");
+        for (const e of summary.recentEntries) {
+            console.log(`      ${e.timestamp.slice(0, 19)} ${e.command} — ${e.findingsCount} findings, ${e.filesReviewed} files, ${e.duration}ms`);
+        }
+    }
+    console.log();
+}
+// Export for use by other commands
+export { appendLog };
+//# sourceMappingURL=review-log.js.map

package/dist/commands/review-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-log.js","sourceRoot":"","sources":["../../src/commands/review-log.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AACtF,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA0B5B,+EAA+E;AAE/E,SAAS,SAAS;IAChB,OAAO,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU;IAC7D,OAAO,IAAI,CAAC,GAAG,EAAE,cAAc,IAAI,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,SAAS,CAAC,KAAqB;IACtC,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAEhC,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,KAAK,GAAI,WAAW,CAAC,GAAG,CAAyB,CAAC,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE3G,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC,CAAC;gBACnD,CAAC;gBAAC,MAAM,CAAC;oBACP,qBAAqB;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,OAAyB;IAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,YAAY,EAAE,CAAC;YACf,aAAa,EAAE,EAAE;YACjB,kBAAkB,EAAE,CAAC;YACrB,aAAa,EAAE,CAAC;YAChB,eAAe,EAAE,CAAC;YAClB,UAAU,EAAE,EAAE;YACd,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9G,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAElE,OAAO;QACL,YAAY,EAAE,OAAO,CAAC,MAAM;QAC5B,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAChC,kBAAkB,EAAE,UAAU;QAC9B,aAAa;QACb,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC;QAC3D,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,SAAS;KAC/C,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;CA0Bf,CAAC,CAAC;QACC,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,UAAU,CAAC,IAAI,MAAM,CAAC;IAC1F,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,YAAY,CAAC,IAAI,MAAM,CAAC;IAExF,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YACvE,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE;YACtC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1E,CAAC,CAAC;QAEF,MAAM,KAAK,GAAmB;YAC5B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,SAAS;YACzC,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC;YAChC,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC;YACnC,QAAQ,EAAE;gBACR,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC9B,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC;gBACtB,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC;gBAC1B,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC;aACrB;YACD,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC;YAC9B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,SAAS;YAC3D,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC;SAC3B,CAAC;QAEF,SAAS,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,CAAC,GAAG,CACT,yBAAyB,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,aAAa,cAAc,KAAK,CAAC,aAAa,UAAU,CAC1G,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IAED,OAAO;IACP,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAEvC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,sBAAsB,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,6BAA6B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,yBAAyB,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC;IAElE,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC;IAED,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACtC,OAAO,CAAC,GAAG,CACT,SAAS,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,aAAa,cAAc,CAAC,CAAC,aAAa,WAAW,CAAC,CAAC,QAAQ,IAAI,CAC1H,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;AAChB,CAAC;AAED,mCAAmC;AACnC,OAAO,EAAE,SAAS,EAAkB,CAAC"}