@rahul05ranjan/dhruv-cli 1.3.0 → 1.5.0

package/src/commands/menu.ts

@@ -1,35 +1,143 @@
 import inquirer from 'inquirer';
 import { themed } from '../utils/ux.js';
+import { explain } from './explain.js';
+import { suggest } from './suggest.js';
+import { fix } from './fix.js';
+import { review } from './review.js';
+import { optimize } from './optimize.js';
+import { securityCheck } from './security-check.js';
+import { generate } from './generate.js';
+import { init } from './init.js';
+import { status } from './status.js';
+import { health } from './health.js';
+import { metrics } from './metrics.js';
+import { detectProjectType } from '../utils/projectType.js';
+import chalk from 'chalk';
+import { commandCatalog } from '../core/command-catalog.js';
 
 const commands = [
-  { name: 'Explain', value: 'explain' },
-  { name: 'Suggest', value: 'suggest' },
-  { name: 'Fix', value: 'fix' },
-  { name: 'Review', value: 'review' },
-  { name: 'Optimize', value: 'optimize' },
-  { name: 'Security Check', value: 'security-check' },
-  { name: 'Generate', value: 'generate' },
-  { name: 'Init (Setup)', value: 'init' },
-  { name: 'Project Type', value: 'project-type' },
-  { name: 'Exit', value: 'exit' }
+  ...commandCatalog.map(({ menuLabel, name }) => ({ name: menuLabel, value: name })),
+  { name: 'Exit', value: 'exit' },
 ];
 
 export async function menu() {
-  let running = true;
-  while (running) {
-    const { cmd } = await inquirer.prompt([
-      {
-        type: 'list',
-        name: 'cmd',
-        message: themed('What do you want to do?', 'primary'),
-        choices: commands
+  try {
+    while (true) {
+      const { filter = '' } = await inquirer.prompt([
+        {
+          type: 'input',
+          name: 'filter',
+          message: 'Filter commands (press enter to show all):',
+        },
+      ]);
+      const normalizedFilter = String(filter).trim().toLowerCase();
+      const filteredCommands = normalizedFilter
+        ? commands.filter((command) => command.name.toLowerCase().includes(normalizedFilter) || command.value.includes(normalizedFilter))
+        : commands;
+      const { cmd } = await inquirer.prompt([
+        {
+          type: 'list',
+          name: 'cmd',
+          message: themed('What do you want to do?', 'primary'),
+          choices: filteredCommands.length > 0 ? filteredCommands : [{ name: 'No matching commands — Exit', value: 'exit' }],
+        }
+      ]);
+    
+      if (cmd === 'exit') {
+        break;
       }
-    ]);
-    if (cmd === 'exit') {
-      running = false;
-      break;
+
+      try {
+        switch (cmd) {
+        case 'explain': {
+          const { query } = await inquirer.prompt([
+            { type: 'input', name: 'query', message: 'What would you like me to explain?' }
+          ]);
+          if (query) await explain(query);
+          break;
+        }
+        case 'suggest': {
+          const { query } = await inquirer.prompt([
+            { type: 'input', name: 'query', message: 'What would you like suggestions for?' }
+          ]);
+          if (query) await suggest(query);
+          break;
+        }
+        case 'fix': {
+          const { query } = await inquirer.prompt([
+            { type: 'input', name: 'query', message: 'Describe the issue you need help fixing:' }
+          ]);
+          if (query) await fix(query);
+          break;
+        }
+        case 'review': {
+          const { fileOrDir } = await inquirer.prompt([
+            { type: 'input', name: 'fileOrDir', message: 'Enter file or directory path to review:' }
+          ]);
+          if (fileOrDir) await review(fileOrDir);
+          break;
+        }
+        case 'optimize': {
+          const { file } = await inquirer.prompt([
+            { type: 'input', name: 'file', message: 'Enter file path to optimize:' }
+          ]);
+          if (file) await optimize(file);
+          break;
+        }
+        case 'security-check': {
+          const { fileOrDir } = await inquirer.prompt([
+            { type: 'input', name: 'fileOrDir', message: 'Enter file or directory path to check (or press enter for current directory):', default: '.' }
+          ]);
+          await securityCheck(fileOrDir);
+          break;
+        }
+        case 'generate': {
+          const answers = await inquirer.prompt([
+            { 
+              type: 'list', 
+              name: 'type', 
+              message: 'What would you like to generate?',
+              choices: ['tests', 'documentation', 'docs', 'component']
+            },
+            { type: 'input', name: 'target', message: 'Enter target file path:' }
+          ]);
+          if (answers.target) await generate(answers.type, answers.target);
+          break;
+        }
+        case 'init': {
+          await init();
+          break;
+        }
+        case 'project-type': {
+          const type = detectProjectType();
+          console.log(chalk.blue(`Detected project type: ${type}`));
+          break;
+        }
+        case 'status':
+          await status();
+          break;
+        case 'health':
+          await health();
+          break;
+        case 'metrics':
+          await metrics();
+          break;
+        case 'completion':
+          console.log(themed('Run `dhruv completion <bash|zsh|fish>` to install shell completion.', 'accent'));
+          break;
+        default:
+          console.log(themed(`You selected: ${cmd}`, 'accent'));
+        }
+      } catch (error) {
+        console.error(chalk.red(`Error executing ${cmd}: ${(error as Error).message}`));
+      }
+
+      console.log(''); // Add spacing between commands
     }
-    // For demo, just print the command. In real use, you would call the command handler.
-    console.log(themed(`You selected: ${cmd}`, 'accent'));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const cancelled = /cancel|force closed|exitprompt/i.test(message);
+    process.exitCode = cancelled ? 130 : 1;
+    console.error(chalk.red(cancelled ? 'Interactive menu cancelled.' : `Interactive menu failed: ${message}`));
   }
 }

package/src/commands/metrics.ts

@@ -0,0 +1,100 @@
+import { Command } from 'commander';
+import chalk from 'chalk';
+import { printSuccess, printError, printInfo } from '../utils/ux.js';
+import { metricsCollector } from '../core/metrics.js';
+import { logger } from '../core/logger.js';
+import { loadConfig } from '../config/config.js';
+
+export interface MetricsOptions {
+  raw?: boolean;
+  reset?: boolean;
+}
+
+export async function metrics(options: MetricsOptions = {}): Promise<void> {
+  try {
+    if (options.reset) {
+      metricsCollector.resetPersistent();
+      if (loadConfig().responseFormat === 'json') {
+        process.stdout.write(`${JSON.stringify({ ok: true, command: 'metrics', reset: true, summary: metricsCollector.getSummary() })}\n`);
+      } else {
+        printSuccess('Local metrics reset.');
+      }
+      return;
+    }
+
+    // Get metrics data
+    const metricsData = await metricsCollector.getMetricsJSON();
+    const summary = metricsCollector.getSummary();
+
+    if (loadConfig().responseFormat === 'json') {
+      process.stdout.write(`${JSON.stringify({
+        ok: true,
+        command: 'metrics',
+        summary,
+        metrics: metricsData,
+      })}\n`);
+      return;
+    }
+
+    console.log(chalk.blue.bold('📊 Dhruv CLI Metrics\n'));
+    console.log(chalk.cyan('📌 Local summary:'));
+    console.log(`  Sessions: ${chalk.green(summary.sessions)}`);
+    Object.entries(summary.commands).forEach(([command, data]) => {
+      console.log(`  ${chalk.yellow(command)}: ${data.runs} runs, ${data.successes} succeeded, ${data.failures} failed, ${data.durationMs}ms`);
+    });
+    Object.entries(summary.models).forEach(([model, data]) => {
+      console.log(`  ${chalk.yellow(model)}: ${data.requests} requests, ${data.successes} succeeded, ${data.failures} failed, ${data.durationMs}ms`);
+    });
+    console.log(`  Cache: ${chalk.green(summary.cache.hits)} hits, ${chalk.yellow(summary.cache.misses)} misses`);
+
+    if (metricsData.length === 0) {
+      printInfo('No metrics data available yet. Metrics are collected during CLI usage.');
+      return;
+    }
+
+    // Display metrics by category
+    const categories = {
+      'Command Metrics': ['dhruv_command', 'dhruv_session'],
+      'AI Service Metrics': ['dhruv_ai_request', 'dhruv_ai_tokens', 'dhruv_cache'],
+      'Performance Metrics': ['dhruv_memory', 'dhruv_performance'],
+      'Error Metrics': ['dhruv_error'],
+      'Plugin Metrics': ['dhruv_plugin']
+    };
+
+    Object.entries(categories).forEach(([category, prefixes]) => {
+      const categoryMetrics = metricsData.filter(metric =>
+        prefixes.some(prefix => metric.name.startsWith(prefix))
+      );
+
+      if (categoryMetrics.length > 0) {
+        console.log(chalk.cyan(`\n📈 ${category}:`));
+
+        categoryMetrics.forEach(metric => {
+          const name = metric.name.replace('dhruv_', '').replace(/_/g, ' ');
+          const value = metric.values?.[0]?.value || 0;
+          const labels = metric.values?.[0]?.labels || {};
+
+          console.log(`  ${chalk.yellow(name)}: ${chalk.green(value)}`);
+
+          // Display labels if available
+          const labelEntries = Object.entries(labels);
+          if (labelEntries.length > 0) {
+            console.log(`    ${chalk.gray('Labels:')} ${labelEntries.map(([k, v]) => `${k}=${v}`).join(', ')}`);
+          }
+        });
+      }
+    });
+
+    if (options.raw) {
+      const rawMetrics = await metricsCollector.getMetrics();
+      process.stdout.write(rawMetrics);
+    }
+
+    logger.info('Metrics displayed successfully', { metricsCount: metricsData.length });
+
+  } catch (error) {
+    printError('Failed to retrieve metrics');
+    console.error(chalk.red((error as Error).message));
+    logger.error('Metrics command failed', error as Error);
+  }
+}

package/src/commands/optimize.ts

@@ -1,36 +1,48 @@
-import { askOllama } from '../core/ai.js';
-import chalk from 'chalk';
-import { loadConfig } from '../config/config.js';
 import fs from 'fs';
-import { highlightCode, printError } from '../utils/ux.js';
+import path from 'path';
+import { runCommand } from '../core/command-runner.js';
+import { getSystemMessage } from '../core/prompts.js';
+import { printError } from '../utils/ux.js';
+
+function optimizationType(file: string): string {
+  const ext = path.extname(file).toLowerCase();
+  const fileName = path.basename(file);
+  if (fileName === 'package.json') return 'package.json configuration';
+  if (ext === '.js' || ext === '.ts') return 'JavaScript/TypeScript code';
+  if (ext === '.json') return 'JSON configuration';
+  if (ext === '.css') return 'CSS styles';
+  if (ext === '.html') return 'HTML markup';
+  return 'general code';
+}
 
 export async function optimize(file: string) {
-  const config = loadConfig();
-  let content = '';
-  if (fs.existsSync(file)) {
-    content = fs.readFileSync(file, 'utf-8');
+  if (!file || file.trim().length === 0) {
+    printError('Please provide a file path to optimize.');
+    return;
+  }
+  if (!fs.existsSync(file)) {
+    printError(`File "${file}" does not exist.`);
+    return;
   }
-  let streamed = '';
+
+  let content: string;
   try {
-    process.stdout.write(chalk.green('Optimization suggestion: '));
-    await askOllama({
-      prompt: `Optimize this file:\n${content}`,
-      model: config.model,
-      onToken: (token: string) => {
-        streamed += token;
-        process.stdout.write(chalk.cyan(token));
-      }
-    });
-    process.stdout.write('\n');
-    if (typeof highlightCode === 'function' && streamed.match(/```[a-z]*[\s\S]*?```/)) {
-      const codeBlocks = streamed.match(/```([a-z]*)\n([\s\S]*?)```/g) || [];
-      for (const block of codeBlocks) {
-        const [, lang, code] = block.match(/```([a-z]*)\n([\s\S]*?)```/) || [];
-        if (code) try { console.log(highlightCode(code, lang || 'js')); } catch (err) { console.error('Highlight error:', err); }
-      }
-    }
+    content = fs.readFileSync(file, 'utf-8');
   } catch (err) {
-    printError('Failed to optimize.');
-    console.error(chalk.red((err as Error).message));
+    printError(`Error reading file "${file}": ${(err as Error).message}`);
+    return;
   }
+
+  const type = optimizationType(file);
+  await runCommand({
+    name: 'optimize',
+    input: { file },
+    header: `⚡ Optimization suggestions for ${type}: `,
+    buildRequest: (input, model) => ({
+      prompt: `Please analyze and provide optimization suggestions for this ${type}. For every recommendation, explain the expected impact, how to measure it, and the trade-offs or risks before applying it.\n\n${content}\n\nPlease provide:\n1. Specific optimization recommendations\n2. Performance improvements\n3. Best practices to implement\n4. Code examples of improvements\n5. Potential issues to fix\n\nFocus on actionable, practical improvements.`,
+      systemMessage: getSystemMessage('optimize'),
+      model,
+    }),
+    footer: `🔍 Want a code review? Try: dhruv review ${file}`,
+  });
 }

package/src/commands/review.ts

@@ -1,47 +1,106 @@
-import { askOllama } from '../core/ai.js';
-import chalk from 'chalk';
-import { loadConfig } from '../config/config.js';
 import fs from 'fs';
-import { highlightCode, printError, createProgressBar } from '../utils/ux.js';
+import path from 'path';
+import { execFileSync } from 'child_process';
+import { runCommand } from '../core/command-runner.js';
+import { getSystemMessage } from '../core/prompts.js';
+import { printError } from '../utils/ux.js';
+import { detectProjectType } from '../utils/projectType.js';
 
-export async function review(fileOrDir: string) {
-  const config = loadConfig();
-  let code = '';
-  if (fs.existsSync(fileOrDir)) {
-    const stat = fs.statSync(fileOrDir);
-    if (stat.isDirectory()) {
-      const files = fs.readdirSync(fileOrDir);
-      const bar = createProgressBar(files.length);
-      for (const f of files) {
-        code += fs.readFileSync(`${fileOrDir}/${f}`,'utf-8') + '\n';
-        bar.increment();
+const CODE_FILE = /\.(js|ts|jsx|tsx|py|java|cpp|c|go|rs|rb|php)$/;
+const IGNORED_DIRECTORIES = new Set(['.git', 'node_modules', 'dist', 'build', 'coverage', '.dhruv-cache', 'logs']);
+
+/** Reads a file or up to 10 code files from a directory tree. */
+function readCode(fileOrDir: string): string | undefined {
+  // Read first, branch on the error: no separate existence check to race against.
+  let content: string;
+  try {
+    content = fs.readFileSync(fileOrDir, 'utf-8');
+  } catch (err) {
+    const code = (err as NodeJS.ErrnoException).code;
+    if (code === 'EISDIR') {
+      return readDirectory(fileOrDir);
+    }
+    printError(`Path "${fileOrDir}" does not exist or could not be read.`);
+    return undefined;
+  }
+  return content;
+}
+
+function readDirectory(dir: string): string | undefined {
+  const files: string[] = [];
+
+  function collect(current: string): void {
+    if (files.length >= 10) return;
+
+    for (const entry of fs.readdirSync(current, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (files.length >= 10) return;
+      const absolute = path.join(current, entry.name);
+
+      if (entry.isDirectory()) {
+        if (!IGNORED_DIRECTORIES.has(entry.name)) collect(absolute);
+      } else if (entry.isFile() && CODE_FILE.test(entry.name)) {
+        files.push(path.relative(dir, absolute).split(path.sep).join('/'));
       }
-      bar.stop();
-    } else {
-      code = fs.readFileSync(fileOrDir, 'utf-8');
     }
   }
-  let streamed = '';
+
+  collect(dir);
+
+  if (files.length === 0) {
+    printError(`No code files found in directory "${dir}".`);
+    return undefined;
+  }
+
+  let code = '';
+  for (const f of files) {
+    try {
+      code += `\n// File: ${f}\n${fs.readFileSync(path.join(dir, f), 'utf-8')}\n`;
+    } catch (err) {
+      console.error(`Error reading file ${f}:`, err);
+    }
+  }
+  return code;
+}
+
+function readGitDiff(fileOrDir: string): string | undefined {
+  const root = fs.existsSync(fileOrDir) && fs.statSync(fileOrDir).isDirectory() ? fileOrDir : path.dirname(fileOrDir);
   try {
-    process.stdout.write(chalk.green('Review: '));
-    await askOllama({
-      prompt: `Review this code:\n${code}`,
-      model: config.model,
-      onToken: (token: string) => {
-        streamed += token;
-        process.stdout.write(chalk.cyan(token));
-      }
+    const diff = execFileSync('git', ['diff', '--no-ext-diff', '--unified=80', '--'], {
+      cwd: root,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
     });
-    process.stdout.write('\n');
-    if (typeof highlightCode === 'function' && streamed.match(/```[a-z]*[\s\S]*?```/)) {
-      const codeBlocks = streamed.match(/```([a-z]*)\n([\s\S]*?)```/g) || [];
-      for (const block of codeBlocks) {
-        const [, lang, code] = block.match(/```([a-z]*)\n([\s\S]*?)```/) || [];
-        if (code) try { console.log(highlightCode(code, lang || 'js')); } catch (err) { console.error('Highlight error:', err); }
-      }
+    if (!diff.trim()) {
+      printError(`No uncommitted changes found in "${fileOrDir}".`);
+      return undefined;
     }
-  } catch (err) {
-    printError('Failed to review code.');
-    console.error(chalk.red((err as Error).message));
+    return diff;
+  } catch {
+    printError(`Could not read a git diff for "${fileOrDir}".`);
+    return undefined;
   }
 }
+
+export interface ReviewOptions {
+  diff?: boolean;
+}
+
+export async function review(fileOrDir: string, options: ReviewOptions = {}) {
+  const code = options.diff ? readGitDiff(fileOrDir) : readCode(fileOrDir);
+  if (code === undefined) return;
+  const projectRoot = fs.existsSync(fileOrDir) && fs.statSync(fileOrDir).isDirectory() ? fileOrDir : path.dirname(fileOrDir);
+  const projectType = detectProjectType(projectRoot);
+  const scope = options.diff ? 'the current uncommitted git diff' : 'the supplied source files';
+
+  await runCommand({
+    name: 'review',
+    input: { fileOrDir },
+    header: '🔍 Code Review: ',
+    buildRequest: (input, model) => ({
+      prompt: `Please review ${scope} for a ${projectType} project. Provide feedback on code quality, best practices, potential issues, and suggestions for improvement. For every finding, include the file, line or region, severity, explanation, and an actionable recommendation. Here is the code to review:\n\nCODE_START\n${code}\nCODE_END`,
+      systemMessage: getSystemMessage('review'),
+      model,
+    }),
+    footer: `🛡️  Security check? Try: dhruv security-check ${fileOrDir}`,
+  });
+}

package/src/commands/security-check.ts

@@ -1,41 +1,135 @@
-import { askOllama } from '../core/ai.js';
-import chalk from 'chalk';
-import { loadConfig } from '../config/config.js';
 import fs from 'fs';
-import { highlightCode, printError } from '../utils/ux.js';
+import path from 'path';
+import { runCommand } from '../core/command-runner.js';
+import { getSystemMessage } from '../core/prompts.js';
+import { printError } from '../utils/ux.js';
 
-export async function securityCheck(fileOrDir: string = '.') {
-  const config = loadConfig();
-  let code = '';
-  if (fs.existsSync(fileOrDir)) {
-    const stat = fs.statSync(fileOrDir);
-    if (stat.isDirectory()) {
-      code = fs.readdirSync(fileOrDir).map(f => fs.readFileSync(`${fileOrDir}/${f}`,'utf-8')).join('\n');
-    } else {
-      code = fs.readFileSync(fileOrDir, 'utf-8');
+const CODE_FILE = /\.(js|ts|jsx|tsx|py|java|cpp|c|go|rs|rb|php)$/;
+const IGNORED_DIRECTORIES = new Set(['.git', 'node_modules', 'dist', 'build', 'coverage', '.dhruv-cache', 'logs']);
+
+function redactSensitiveContent(content: string): string {
+  return content
+    .replace(/(\b(?:api[_-]?key|secret|token|password|authorization)\s*[:=]\s*["'`])[^"'`\r\n]+(["'`])/gi, '$1[REDACTED]$2')
+    .replace(/\b(?:sk|pk)-[a-z0-9_-]{8,}\b/gi, '[REDACTED]')
+    .replace(/\bBearer\s+[A-Za-z0-9._~+/=-]+/gi, 'Bearer [REDACTED]');
+}
+
+interface SecurityFinding {
+  line: number;
+  severity: 'high';
+  description: string;
+  remediation: string;
+}
+
+function findHighConfidenceFindings(content: string): SecurityFinding[] {
+  const findings: SecurityFinding[] = [];
+  const lines = content.split(/\r?\n/);
+
+  lines.forEach((line, index) => {
+    if (/\b(?:api[_-]?key|secret|token|password|authorization)\s*[:=]\s*["'`][^"'`\r\n]+["'`]/i.test(line)) {
+      findings.push({
+        line: index + 1,
+        severity: 'high',
+        description: 'credential-like value assigned in source',
+        remediation: 'rotate the credential and load it from a secret manager or environment variable',
+      });
+    } else if (/\b(?:sk|pk)-[a-z0-9_-]{8,}\b/i.test(line)) {
+      findings.push({
+        line: index + 1,
+        severity: 'high',
+        description: 'credential-like API key detected',
+        remediation: 'rotate the credential and remove it from source control',
+      });
+    } else if (/\bBearer\s+[A-Za-z0-9._~+/=-]+/i.test(line)) {
+      findings.push({
+        line: index + 1,
+        severity: 'high',
+        description: 'bearer token detected',
+        remediation: 'revoke the token and use a secure runtime secret store',
+      });
     }
-  }
-  let streamed = '';
+  });
+
+  return findings;
+}
+
+export interface SecurityCheckOptions {
+  strict?: boolean;
+}
+
+/** Reads a file or the code files of a directory (up to 10), concatenated. */
+function readCode(fileOrDir: string): string | undefined {
+  // Read first, branch on the error: no separate existence check to race against.
+  let content: string;
   try {
-    process.stdout.write(chalk.green('Security check result: '));
-    await askOllama({
-      prompt: `Security check for this code:\n${code}`,
-      model: config.model,
-      onToken: (token: string) => {
-        streamed += token;
-        process.stdout.write(chalk.cyan(token));
-      }
-    });
-    process.stdout.write('\n');
-    if (typeof highlightCode === 'function' && streamed.match(/```[a-z]*[\s\S]*?```/)) {
-      const codeBlocks = streamed.match(/```([a-z]*)\n([\s\S]*?)```/g) || [];
-      for (const block of codeBlocks) {
-        const [, lang, code] = block.match(/```([a-z]*)\n([\s\S]*?)```/) || [];
-        if (code) try { console.log(highlightCode(code, lang || 'js')); } catch (err) { console.error('Highlight error:', err); }
+    content = fs.readFileSync(fileOrDir, 'utf-8');
+  } catch (err) {
+    const code = (err as NodeJS.ErrnoException).code;
+    if (code === 'EISDIR') {
+      return readDirectory(fileOrDir);
+    }
+    printError(`Path "${fileOrDir}" does not exist or could not be read.`);
+    return undefined;
+  }
+  return content;
+}
+
+function readDirectory(dir: string): string | undefined {
+  const files: string[] = [];
+
+  function collect(current: string): void {
+    if (files.length >= 10) return;
+    for (const entry of fs.readdirSync(current, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (files.length >= 10) return;
+      const absolute = path.join(current, entry.name);
+      if (entry.isDirectory()) {
+        if (!IGNORED_DIRECTORIES.has(entry.name)) collect(absolute);
+      } else if (entry.isFile() && CODE_FILE.test(entry.name)) {
+        files.push(path.relative(dir, absolute).split(path.sep).join('/'));
       }
     }
-  } catch (err) {
-    printError('Failed to run security check.');
-    console.error(chalk.red((err as Error).message));
   }
+
+  collect(dir);
+
+  if (files.length === 0) {
+    printError(`No code files found in directory "${dir}".`);
+    return undefined;
+  }
+
+  let code = '';
+  for (const f of files) {
+    try {
+      code += `\n// File: ${f}\n${fs.readFileSync(path.join(dir, f), 'utf-8')}\n`;
+    } catch (err) {
+      console.error(`Error reading file ${f}:`, err);
+    }
+  }
+  return code;
+}
+
+export async function securityCheck(fileOrDir: string = '.', options: SecurityCheckOptions = {}) {
+  const code = readCode(fileOrDir);
+  if (code === undefined) return;
+  const findings = findHighConfidenceFindings(code);
+  const safeCode = redactSensitiveContent(code);
+  const findingSummary = findings.length === 0
+    ? 'none'
+    : findings.map((finding) => `- ${finding.severity} at line ${finding.line}: ${finding.description}; remediation: ${finding.remediation}`).join('\n');
+
+  if (options.strict && findings.length > 0) {
+    process.exitCode = 1;
+  }
+
+  await runCommand({
+    name: 'security-check',
+    input: { fileOrDir },
+    header: '🛡️  Security Analysis: ',
+    buildRequest: (input, model) => ({
+      prompt: `Perform a security analysis on this code. Look for common security vulnerabilities, unsafe practices, potential injection attacks, and provide recommendations for improvement. High-confidence pre-scan findings:\n${findingSummary}\n\n${safeCode}`,
+      systemMessage: getSystemMessage('security'),
+      model,
+    }),
+    footer: `🔧 Need fixes? Try: dhruv fix <security issue>`,
+  });
 }