cg-fix

/cg-fix — apply guards (opt-in, dry-run first)

Apply the hardening code to the codebase. Safety-first and non-destructive by default: show a diff, get confirmation, then write. Never touches a live target — only source files.

Argument: $ARGUMENTS — a finding id or all (default: every eligible finding from the latest grader run), plus optional --apply to write after review.

Eligibility — both conditions, no exceptions

A finding may be auto-fixed only if:

finding.confidence === 'confirmed'   AND   finding.autofixable === true

Neither field is yours to set. confirmed comes only from evidence.strength === 'definitive' — the bundler inlines the prefix, the migration never enables RLS, the header was absent on the wire. Everything else caps lower: strong → likely, weak → needs-review, and a reviewer's judgement → likely and can never reach confirmed. So a reviewer finding is never eligible here, however well argued. Editing someone's source on the strength of a guess is how a security tool becomes the thing that broke production.

Skip everything else and say why in one line — "needs a human: the check may live in a helper this pass does not follow" — with the finding's assumption, so the user knows what to check rather than just that it was skipped.

The finding schema you are reading

grader.mjs emits, per finding:

• guard — guard-recipes/<name>.md#<anchor>, resolved against ${CLAUDE_PLUGIN_ROOT}/skills/claudeguard/references/. This is the fix. Open that anchor; do not invent a patch from the title.
• evidence — an object, not an array: { strength, nameOnly, why, at: [...] }.
  • evidence.at[] is the location list: { file, line, snippet } per entry. This is where the patch goes.
  • evidence.why is the mechanism in one sentence — use it in the diff summary so the user reads why before approving a write.
  • Schema change from v1: evidence used to be the bare array that is now evidence.at. Code or habits that reach for finding.evidence[0].file now get undefined and will patch nothing, or the wrong file, without complaining.
• severity, confidence, provenance, tier, assumption, id, subject — for grouping and for the summary. Never recompute any of them.