@goodandready/dsh-moa 0.2.76 → 0.2.78

package/lib/pipeline/privacy-sanitizer.js

@@ -0,0 +1,213 @@
+/**
+ * DeepSeek Harness Mixture of Agents (MoA) — Hybrid Private Edge & Privacy Sanitizer (#306)
+ *
+ * Protects project confidentiality in hybrid deployments by scrubbing local absolute paths,
+ * internal private IPs, API tokens, JWTs, and proprietary secrets before forwarding prompts
+ * or candidate proposals to external Cloud Judges. Preserves unsanitized originals locally
+ * for workspace promotion.
+ */
+
+import { MOA_EVENTS, emitEvent } from '../events.js'
+
+/**
+ * Common regex definitions for sensitive data redaction.
+ */
+export const SANITIZATION_PATTERNS = {
+  OPENAI_OR_GENERIC_KEY: /sk-[a-zA-Z0-9_\-]{20,}/g,
+  BEARER_TOKEN: /Bearer\s+[a-zA-Z0-9_\-\.]{20,}/gi,
+  JWT: /ey[A-Za-z0-9_\-]{15,}\.ey[A-Za-z0-9_\-]{15,}\.[A-Za-z0-9_\-]{10,}/g,
+  AWS_KEY: /AKIA[0-9A-Z]{16}/g,
+  PRIVATE_KEY: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g,
+  SECRET_ASSIGNMENT: /(?<=(?:api[_-]?key|secret|password|token|auth)\s*[:=]\s*["'])[a-zA-Z0-9_\-\.\/+=]{8,}(?=["'])/gi,
+  UNIX_HOME_PATH: /(?:\/(?:home|Users)\/[a-zA-Z0-9_\-]+(?:\/[a-zA-Z0-9_\-\.]+)*)/g,
+  WIN_USER_PATH: /(?:[A-Za-z]:\\(?:Users|Documents and Settings)\\[a-zA-Z0-9_\-]+(?:\\[a-zA-Z0-9_\-\.]+)*)/g,
+  PRIVATE_IP: /\b(?:192\.168\.\d{1,3}\.\d{1,3}|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[0-1])\.\d{1,3}\.\d{1,3})\b/g,
+  EMAIL: /\b[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}\b/g,
+}
+
+/**
+ * Sanitizes a text string by redacting sensitive secrets, internal paths, and PII.
+ *
+ * @param {string} text
+ * @param {object} [options]
+ * @returns {{ sanitizedText: string, redactionCount: number, redactingEntries: Array<object> }}
+ */
+export function sanitizeSensitiveText(text, options = {}) {
+  if (!text || typeof text !== 'string') {
+    return { sanitizedText: text || '', redactionCount: 0, redactingEntries: [] }
+  }
+
+  const {
+    redactSecrets = true,
+    redactPaths = true,
+    redactIps = true,
+    redactEmails = true,
+  } = options
+
+  let result = text
+  let redactionCount = 0
+  const redactingEntries = []
+
+  // 1. Secrets & API Keys
+  if (redactSecrets) {
+    result = result.replace(SANITIZATION_PATTERNS.PRIVATE_KEY, () => {
+      redactionCount++
+      redactingEntries.push({ type: 'PRIVATE_KEY' })
+      return '[REDACTED_PRIVATE_KEY]'
+    })
+
+    result = result.replace(SANITIZATION_PATTERNS.OPENAI_OR_GENERIC_KEY, () => {
+      redactionCount++
+      redactingEntries.push({ type: 'API_KEY' })
+      return '[REDACTED_API_KEY]'
+    })
+
+    result = result.replace(SANITIZATION_PATTERNS.JWT, () => {
+      redactionCount++
+      redactingEntries.push({ type: 'JWT' })
+      return '[REDACTED_JWT]'
+    })
+
+    result = result.replace(SANITIZATION_PATTERNS.AWS_KEY, () => {
+      redactionCount++
+      redactingEntries.push({ type: 'AWS_KEY' })
+      return '[REDACTED_AWS_KEY]'
+    })
+
+    result = result.replace(SANITIZATION_PATTERNS.SECRET_ASSIGNMENT, () => {
+      redactionCount++
+      redactingEntries.push({ type: 'SECRET_VALUE' })
+      return '[REDACTED_SECRET]'
+    })
+  }
+
+  // 2. Private Paths
+  if (redactPaths) {
+    result = result.replace(SANITIZATION_PATTERNS.UNIX_HOME_PATH, (match) => {
+      redactionCount++
+      const parts = match.split('/')
+      const subpath = parts.slice(3).join('/')
+      return subpath ? `/workspace/${subpath}` : '/workspace'
+    })
+
+    result = result.replace(SANITIZATION_PATTERNS.WIN_USER_PATH, (match) => {
+      redactionCount++
+      const parts = match.split('\\')
+      const subpath = parts.slice(3).join('\\')
+      return subpath ? `C:\\workspace\\${subpath}` : 'C:\\workspace'
+    })
+  }
+
+  // 3. Private IP addresses
+  if (redactIps) {
+    result = result.replace(SANITIZATION_PATTERNS.PRIVATE_IP, () => {
+      redactionCount++
+      redactingEntries.push({ type: 'INTERNAL_IP' })
+      return '[REDACTED_INTERNAL_IP]'
+    })
+  }
+
+  // 4. Email addresses
+  if (redactEmails) {
+    result = result.replace(SANITIZATION_PATTERNS.EMAIL, () => {
+      redactionCount++
+      redactingEntries.push({ type: 'EMAIL' })
+      return '[REDACTED_EMAIL]'
+    })
+  }
+
+  return {
+    sanitizedText: result,
+    redactionCount,
+    redactingEntries,
+  }
+}
+
+/**
+ * Sanitizes candidate solutions before forwarding them to an external Cloud Judge.
+ * Preserves the original unmodified code in candidate.originalOutput for safe local promotion.
+ *
+ * @param {Array<object>} candidates
+ * @param {object} [options]
+ * @returns {object} Sanitization result
+ */
+export function sanitizeCandidatesForCloudJudge(candidates, options = {}) {
+  const {
+    ctx,
+    runId,
+    onProgress,
+    redactSecrets = true,
+    redactPaths = true,
+    redactIps = true,
+    redactEmails = true,
+  } = options
+
+  if (!Array.isArray(candidates) || candidates.length === 0) {
+    return {
+      sanitizedCandidates: [],
+      totalRedactions: 0,
+      privacyDirective: null,
+    }
+  }
+
+  let totalRedactions = 0
+  const sanitizedCandidates = candidates.map((cand, idx) => {
+    const rawText = typeof cand === 'string' ? cand : cand.output || cand.text || cand.code || ''
+    const { sanitizedText, redactionCount, redactingEntries } = sanitizeSensitiveText(rawText, {
+      redactSecrets,
+      redactPaths,
+      redactIps,
+      redactEmails,
+    })
+
+    totalRedactions += redactionCount
+
+    if (typeof cand === 'object' && cand !== null) {
+      if (!cand.originalOutput) {
+        cand.originalOutput = rawText
+      }
+      cand.sanitizedOutput = sanitizedText
+      cand.redactionCount = redactionCount
+    }
+
+    if (ctx && redactionCount > 0) {
+      emitEvent(ctx, MOA_EVENTS.PRIVACY_SANITIZED, {
+        runId,
+        candidateIndex: idx,
+        model: cand?.model || `Candidate ${idx + 1}`,
+        redactionCount,
+        types: [...new Set(redactingEntries.map((e) => e.type))],
+      })
+    }
+
+    return typeof cand === 'object' && cand !== null
+      ? { ...cand, output: sanitizedText, text: sanitizedText }
+      : sanitizedText
+  })
+
+  if (typeof onProgress === 'function' && totalRedactions > 0) {
+    onProgress(`🛡️ *Hybrid Edge Privacy*: Sanitized ${totalRedactions} sensitive token(s) (secrets, paths, IPs) before cloud judge.\n`)
+  }
+
+  const privacyDirective = totalRedactions > 0 ? formatPrivacyDirective(totalRedactions) : null
+
+  return {
+    sanitizedCandidates,
+    totalRedactions,
+    privacyDirective,
+  }
+}
+
+/**
+ * Formats a privacy directive header for the Cloud Judge prompt.
+ *
+ * @param {number} totalRedactions
+ * @returns {string}
+ */
+export function formatPrivacyDirective(totalRedactions) {
+  return [
+    '### 🛡️ PRIVACY & PII SANITIZATION ACTIVE',
+    `Notice: ${totalRedactions} internal system path(s), private network IP(s), or secret token(s) have been sanitized with [REDACTED_*] or relative paths to preserve user confidentiality.`,
+    'Evaluate the candidate solutions based on their architecture, correctness, and logic.',
+  ].join('\n')
+}

package/lib/pipeline/runner.js

@@ -1,3 +1,4 @@
+import { sanitizeCandidatesForCloudJudge } from './privacy-sanitizer.js'
 import { evaluateJudgeEscalation } from './escalation.js'
 import { calculateSelfConsistencyAgreement } from './self-consistency.js'
 import { pruneCandidateEnsemble, formatPruningDirective } from './context-pruner.js'
@@ -20,6 +21,8 @@ import { applySyntaxFilter, formatSyntaxDirective } from './syntax-filter.js'
 import { stageEarlyConsensus } from './early-consensus.js'
 import { runSecurityAuditGate } from './security-fuzzer.js'
 import { runCoveVerificationGate } from './cove-verifier.js'
+import { runProfilerGate } from './runtime-profiler.js'
+import { runMutationGate } from './mutation-tester.js'
 import { emitEvent, MOA_EVENTS } from '../events.js'
 
 export async function runMoAPipeline({
@@ -234,6 +237,63 @@ export async function runMoAPipeline({
     securityDirective = securityGateResult.securityDirective
   }
 
+  // Pre-Stage 5.10: Runtime CPU & Memory Profiler Gate (#315)
+  let profilerDirective = null
+  let profilerGateResult = null
+  if (preset?.profiler_gate_enabled) {
+    profilerGateResult = runProfilerGate(
+      syntaxResult.validCandidates.length > 0 ? syntaxResult.validCandidates : successfulRefs,
+      {
+        ctx,
+        runId,
+        onProgress,
+        iterations: preset.profiler_iterations || 100,
+        timeoutMs: preset.profiler_timeout_ms || 2000,
+      }
+    )
+    profilerDirective = profilerGateResult.profilerDirective
+  }
+
+  // Pre-Stage 5.11: Mutation Testing & Fault Injection Gate (#316)
+  let mutationDirective = null
+  let mutationGateResult = null
+  if (preset?.mutation_testing_enabled) {
+    mutationGateResult = runMutationGate(
+      syntaxResult.validCandidates.length > 0 ? syntaxResult.validCandidates : successfulRefs,
+      {
+        ctx,
+        runId,
+        onProgress,
+        minMutationScore: preset.min_mutation_score ?? 0.70,
+      }
+    )
+    mutationDirective = mutationGateResult.mutationDirective
+  }
+
+  // Pre-Stage 5.12: Hybrid Edge Privacy Sanitizer Gate (#306)
+  let privacyDirective = null
+  let candidatesForJudge = syntaxResult.validCandidates.length > 0 ? syntaxResult.validCandidates : successfulRefs
+  let sanitizedReferenceOutputs = referenceOutputs
+  if (preset?.hybrid_edge_privacy_enabled || preset?.cloud_judge_sanitization_enabled) {
+    const sanitizeResult = sanitizeCandidatesForCloudJudge(candidatesForJudge, {
+      ctx,
+      runId,
+      onProgress,
+      redactSecrets: preset.redact_secrets !== false,
+      redactPaths: preset.redact_paths !== false,
+      redactIps: preset.redact_ips !== false,
+    })
+    candidatesForJudge = sanitizeResult.sanitizedCandidates
+    privacyDirective = sanitizeResult.privacyDirective
+    sanitizedReferenceOutputs = referenceOutputs.map((r) => {
+      const matching = candidatesForJudge.find((c) => c.index === r.index || c.model === r.model || c.label === r.label)
+      if (matching && matching.sanitizedOutput) {
+        return { ...r, text: matching.sanitizedOutput, output: matching.sanitizedOutput }
+      }
+      return r
+    })
+  }
+
   // Pre-Stage 6: Dynamic Consensus Threshold & Multi-Judge Escalation (#300)
   const escalationResult = evaluateJudgeEscalation({
     candidateOutputs: syntaxResult.validCandidates.length > 0 ? syntaxResult.validCandidates : successfulRefs,
@@ -282,9 +342,9 @@ export async function runMoAPipeline({
   // Stage 6: Multi-Judge Panel
   const mjRes = await stageMultiJudge({
     preset: effectivePreset,
-    successfulRefs: syntaxResult.validCandidates.length > 0 ? syntaxResult.validCandidates : successfulRefs,
-    referenceOutputs, primaryJudge: effectivePrimaryJudge,
-    userPrompt, judgeCriteria: [ctxStage.judgeCriteria, coveDirective, securityDirective].filter(Boolean).join('\n\n'), prices, maxTokens: ctxStage.maxTokens,
+    successfulRefs: candidatesForJudge,
+    referenceOutputs: sanitizedReferenceOutputs, primaryJudge: effectivePrimaryJudge,
+    userPrompt, judgeCriteria: [ctxStage.judgeCriteria, coveDirective, securityDirective, profilerDirective, mutationDirective, privacyDirective].filter(Boolean).join('\n\n'), prices, maxTokens: ctxStage.maxTokens,
     callLlm, signal, onProgress, cwd, runId, isRefinement: ctxStage.isRefinement,
     isFastMode: ctxStage.isFastMode, collectedCtx: ctxStage.collectedCtx, startTime,
   })
@@ -313,8 +373,8 @@ export async function runMoAPipeline({
     : null
 
   // Pre-Judge Stage 6.8: Cross-Candidate Unchanged Base Context Pruning (#305)
-  let synthCandidateRefs = syntaxResult.validCandidates.length > 0 ? syntaxResult.validCandidates : successfulRefs
-  let synthReferenceOutputs = referenceOutputs
+  let synthCandidateRefs = candidatesForJudge
+  let synthReferenceOutputs = sanitizedReferenceOutputs
   let pruningDirective = null
   if (ctxStage.contextPruningEnabled && ctxStage.collectedCtx?.files?.length > 0) {
     const pruneRes = pruneCandidateEnsemble(synthCandidateRefs, ctxStage.collectedCtx.files, {
@@ -342,7 +402,7 @@ export async function runMoAPipeline({
     }
   }
 
-  const fileScoringDirective = [rawFileDirective, visualResult?.directive, adversarialTddResult?.directive, syntaxDirective, coveDirective, securityDirective, pruningDirective, ctxStage.stackAwareDirective, ctxStage.developerPreferencesDirective].filter(Boolean).join("\n\n") || null
+  const fileScoringDirective = [rawFileDirective, visualResult?.directive, adversarialTddResult?.directive, syntaxDirective, coveDirective, securityDirective, profilerDirective, mutationDirective, privacyDirective, pruningDirective, ctxStage.stackAwareDirective, ctxStage.developerPreferencesDirective].filter(Boolean).join("\n\n") || null
 
   // Stage 7: Synthesis Phase
   const synthRes = await stageSynthesis({

package/lib/pipeline/runtime-profiler.js

@@ -0,0 +1,270 @@
+/**
+ * DeepSeek Harness Mixture of Agents (MoA) — Runtime CPU & Memory Profiler Gate (#315)
+ *
+ * Micro-benchmarks candidate code execution duration, ops/sec throughput, and heap memory usage
+ * in an isolated sandbox with hard timeout protection to guide Judge selection towards
+ * algorithmically optimal solutions.
+ */
+
+import vm from 'node:vm'
+import { MOA_EVENTS, emitEvent } from '../events.js'
+
+/**
+ * Extracts executable JavaScript code from markdown fences or raw code.
+ *
+ * @param {string} text
+ * @returns {string}
+ */
+export function extractExecutableCode(text) {
+  if (!text || typeof text !== 'string') return ''
+  const jsFenceMatch = text.match(/```(?:javascript|js|node)\s*\n([\s\S]*?)\n```/i)
+  if (jsFenceMatch && jsFenceMatch[1]) {
+    return jsFenceMatch[1]
+  }
+  const anyFenceMatch = text.match(/```\w*\s*\n([\s\S]*?)\n```/)
+  if (anyFenceMatch && anyFenceMatch[1]) {
+    return anyFenceMatch[1]
+  }
+  return text
+}
+
+/**
+ * Profiles code execution in an isolated VM sandbox.
+ *
+ * @param {string} rawCode - Candidate source code or markdown
+ * @param {object} [options]
+ * @returns {object} Profiler report
+ */
+export function profileCodeExecution(rawCode, options = {}) {
+  const {
+    iterations = 100,
+    timeoutMs = 2000,
+  } = options
+
+  const code = extractExecutableCode(rawCode)
+  if (!code || !code.trim()) {
+    return {
+      passed: false,
+      durationMs: 0,
+      heapBytesUsed: 0,
+      opsPerSec: 0,
+      iterations: 0,
+      error: 'Empty or unexecutable code provided for profiling.',
+      summary: 'Profiler skipped: no executable code.',
+    }
+  }
+
+  // Initial sandbox built-ins to ignore when scanning for user functions
+  const initialKeys = new Set([
+    'console', 'Math', 'Date', 'Array', 'Object', 'String', 'Number',
+    'Boolean', 'Set', 'Map', 'JSON', 'parseInt', 'parseFloat',
+    'globalThis', 'global', '__mainFn', '__benchFn', '__benchArg'
+  ])
+
+  const sandbox = {
+    console: { log: () => {}, warn: () => {}, error: () => {} },
+    Math,
+    Date,
+    Array,
+    Object,
+    String,
+    Number,
+    Boolean,
+    Set,
+    Map,
+    JSON,
+    parseInt,
+    parseFloat,
+  }
+  sandbox.globalThis = sandbox
+  sandbox.global = sandbox
+
+  // Convert export declarations to var / global assignments
+  const cleanCode = code
+    .replace(/^\s*export\s+default\s+/gm, 'globalThis.__mainFn = ')
+    .replace(/^\s*export\s+(?:async\s+)?function\s+([a-zA-Z0-9_]+)/gm, 'function $1')
+    .replace(/^\s*export\s+const\s+([a-zA-Z0-9_]+)/gm, 'var $1')
+    .replace(/^\s*import\s+.*?;?\s*$/gm, '// [import stripped for benchmark]')
+
+  try {
+    const context = vm.createContext(sandbox)
+    // Run candidate code once to evaluate top-level declarations
+    const setupScript = new vm.Script(cleanCode)
+    setupScript.runInContext(context, { timeout: Math.min(1000, timeoutMs) })
+
+    // Find entrypoint function: either __mainFn or any user-defined function on sandbox
+    let targetFn = sandbox.__mainFn
+    if (typeof targetFn !== 'function') {
+      const userKeys = Object.keys(sandbox).filter((k) => !initialKeys.has(k) && typeof sandbox[k] === 'function')
+      if (userKeys.length > 0) {
+        targetFn = sandbox[userKeys[userKeys.length - 1]]
+      }
+    }
+
+    sandbox.__benchFn = targetFn || null
+    sandbox.__benchArg = 10
+
+    let benchScript
+    if (typeof sandbox.__benchFn === 'function') {
+      benchScript = new vm.Script(`
+        try {
+          __benchFn();
+        } catch (_) {
+          try { __benchFn(__benchArg); } catch (__) {}
+        }
+      `)
+    } else {
+      benchScript = new vm.Script(`(() => { ${cleanCode} })()`)
+    }
+
+    // Warm-up run
+    benchScript.runInContext(context, { timeout: Math.min(1000, timeoutMs) })
+
+    // Measure memory and time
+    const startMem = process.memoryUsage().heapUsed
+    const startHr = process.hrtime.bigint()
+
+    for (let i = 0; i < iterations; i++) {
+      benchScript.runInContext(context, { timeout: Math.min(500, timeoutMs) })
+    }
+
+    const endHr = process.hrtime.bigint()
+    const endMem = process.memoryUsage().heapUsed
+
+    const totalNs = Number(endHr - startHr)
+    const durationMs = Number((totalNs / 1_000_000).toFixed(3))
+    const avgLatencyMs = Number((durationMs / iterations).toFixed(4))
+    const heapBytesUsed = Math.max(0, endMem - startMem)
+    const opsPerSec = durationMs > 0 ? Math.round((iterations / (durationMs / 1000))) : 0
+
+    return {
+      passed: true,
+      durationMs,
+      avgLatencyMs,
+      heapBytesUsed,
+      opsPerSec,
+      iterations,
+      error: null,
+      summary: `⚡ Profiler: ${iterations} iter in ${durationMs}ms (${opsPerSec.toLocaleString()} ops/sec, ~${Math.round(heapBytesUsed / 1024)}KB heap).`,
+    }
+  } catch (err) {
+    const isTimeout = err.code === 'ERR_SCRIPT_EXECUTION_TIMEOUT' || err.message?.includes('timed out')
+    return {
+      passed: false,
+      durationMs: isTimeout ? timeoutMs : 0,
+      avgLatencyMs: 0,
+      heapBytesUsed: 0,
+      opsPerSec: 0,
+      iterations: 0,
+      error: isTimeout ? `Execution timed out after ${timeoutMs}ms (possible infinite loop or catastrophic complexity)` : err.message,
+      summary: isTimeout ? `🚨 Profiler: TIMEOUT (${timeoutMs}ms exceeded)` : `⚠️ Profiler Error: ${err.message}`,
+    }
+  }
+}
+
+/**
+ * Runs runtime performance profiling across all candidate solutions.
+ *
+ * @param {Array<object>} candidates
+ * @param {object} [options]
+ * @returns {object} Profiler gate result
+ */
+export function runProfilerGate(candidates, options = {}) {
+  const {
+    ctx,
+    runId,
+    onProgress,
+    iterations = 100,
+    timeoutMs = 2000,
+  } = options
+
+  const results = []
+  if (!Array.isArray(candidates) || candidates.length === 0) {
+    return {
+      results: [],
+      fastestCandidate: null,
+      profilerDirective: null,
+    }
+  }
+
+  for (let i = 0; i < candidates.length; i++) {
+    const cand = candidates[i]
+    const text = typeof cand === 'string' ? cand : cand.output || cand.text || cand.code || ''
+    const report = profileCodeExecution(text, { iterations, timeoutMs })
+
+    if (typeof cand === 'object' && cand !== null) {
+      cand.profilerReport = report
+    }
+
+    results.push({
+      candidateIndex: i,
+      model: cand?.model || `Candidate ${i + 1}`,
+      report,
+    })
+
+    if (ctx) {
+      emitEvent(ctx, MOA_EVENTS.PROFILER_COMPLETE, {
+        runId,
+        candidateIndex: i,
+        durationMs: report.durationMs,
+        heapBytesUsed: report.heapBytesUsed,
+        opsPerSec: report.opsPerSec,
+        passed: report.passed,
+        error: report.error,
+      })
+    }
+  }
+
+  // Sort passing candidates by throughput (opsPerSec) descending
+  const valid = results.filter((r) => r.report.passed).sort((a, b) => b.report.opsPerSec - a.report.opsPerSec)
+  const fastestCandidate = valid[0] || null
+
+  if (typeof onProgress === 'function' && results.length > 0) {
+    const summaryList = results.map((r) => `Ref ${r.candidateIndex + 1}: ${r.report.passed ? `${r.report.durationMs}ms` : 'TIMEOUT'}`).join(', ')
+    onProgress(`⚡ *Runtime Profiler Gate*: ${summaryList}\n`)
+  }
+
+  const profilerDirective = formatProfilerDirective(results)
+
+  return {
+    results,
+    fastestCandidate,
+    profilerDirective,
+  }
+}
+
+/**
+ * Formats profiler benchmarks into a clear prompt directive for the Judge.
+ *
+ * @param {Array<object>} results
+ * @returns {string|null}
+ */
+export function formatProfilerDirective(results) {
+  if (!Array.isArray(results) || results.length === 0) return null
+
+  const lines = [
+    '### ⚡ RUNTIME PERFORMANCE & CPU/MEMORY PROFILER REPORT',
+    'Objective micro-benchmarks across candidates (100 iterations in isolated sandbox):',
+  ]
+
+  for (const r of results) {
+    const label = `Candidate ${r.candidateIndex + 1}`
+    const rep = r.report
+    if (rep.passed) {
+      const kb = Math.round(rep.heapBytesUsed / 1024)
+      lines.push(
+        `- **${label}**: ⏱️ **${rep.durationMs}ms** total (~${rep.avgLatencyMs}ms/op) | **${rep.opsPerSec.toLocaleString()} ops/sec** | Heap: ~${kb} KB`
+      )
+    } else {
+      lines.push(
+        `- **${label}**: ❌ **PERFORMANCE FAILURE**: ${rep.error}`
+      )
+    }
+  }
+
+  lines.push(
+    '\n**Judge Performance Guideline**: Penalize solutions with excessive latency or timeout failures. Prefer implementations demonstrating clean algorithmic scalability and minimal memory footprint.'
+  )
+
+  return lines.join('\n')
+}