@rahul05ranjan/dhruv-cli 1.4.6 → 1.5.0

package/docs/publishing-fix.md

@@ -0,0 +1,34 @@
+# npm publishing issue resolution
+
+## Issue
+
+GitHub Actions was failing with:
+
+```text
+npm ERR! 403 403 Forbidden - PUT https://registry.npmjs.org/@rahul05ranjan%2fdhruv-cli - You cannot publish over the previously published versions: 0.0.0-development.
+```
+
+## Resolution
+
+- Updated the package version from `0.0.0-development` to `1.4.0`.
+- Added semantic-release configuration and plugins.
+- Removed direct npm publishing from the CI workflow.
+- Added a dedicated publishing workflow with version-conflict checks.
+- Enabled trusted publishing with npm provenance.
+
+## Release conventions
+
+Use conventional commit messages so semantic-release can determine the next version:
+
+```bash
+# Patch
+git commit -m "fix: resolve a connection issue"
+
+# Minor
+git commit -m "feat: add a new command"
+
+# Major
+git commit -m "feat!: change the command output contract"
+```
+
+The authoritative release configuration lives in [`.releaserc.json`](../.releaserc.json) and the workflows live in [`.github/workflows/`](../.github/workflows/).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rahul05ranjan/dhruv-cli",
-  "version": "1.4.6",
+  "version": "1.5.0",
   "description": "AI-powered CLI assistant for developers using Ollama",
   "keywords": [
     "ai",

package/src/commands/generate.ts

@@ -1,7 +1,9 @@
 import fs from 'fs';
+import path from 'path';
 import { runCommand } from '../core/command-runner.js';
 import { getSystemMessage } from '../core/prompts.js';
-import { printError, printSuccess } from '../utils/ux.js';
+import { printError, printSuccess, printInfo } from '../utils/ux.js';
+import { loadConfig } from '../config/config.js';
 
 function buildPrompt(type: string, content: string): string {
   if (type === 'tests' || type === 'test') {
@@ -23,7 +25,13 @@ function extractTestCode(response: string): string {
     .trim();
 }
 
-export async function generate(type: string, target: string) {
+export interface GenerateOptions {
+  apply?: boolean;
+  output?: string;
+  overwrite?: boolean;
+}
+
+export async function generate(type: string, target: string, options: GenerateOptions = {}) {
   if (!fs.existsSync(target)) {
     printError(`Target file "${target}" does not exist.`);
     return;
@@ -47,9 +55,20 @@ export async function generate(type: string, target: string) {
         printError('No valid test code generated.');
         return;
       }
-      const testFile = target.replace(/\.[^.]+$/, '.test.js');
+      const extension = path.extname(target) || '.js';
+      const testFile = options.output ?? target.replace(/\.[^.]+$/, `.test${extension}`);
+      if (!options.apply && !options.output) {
+        if (loadConfig().responseFormat !== 'json') {
+          printInfo(`Preview only. Use --apply to write ${testFile}, or --output <path> to choose a destination.`);
+        }
+        return;
+      }
+      if (fs.existsSync(testFile) && !options.overwrite) {
+        printError(`Test file "${testFile}" already exists. Use --overwrite to replace it.`);
+        return;
+      }
       fs.writeFileSync(testFile, codeToSave);
-      printSuccess(`Test file saved: ${testFile}`);
+      if (loadConfig().responseFormat !== 'json') printSuccess(`Test file saved: ${testFile}`);
     },
     footer: `🔍 Want a review? Try: dhruv review ${target}`,
   });

package/src/commands/health.ts

@@ -28,20 +28,26 @@ interface SystemInfo {
   cpuCount: number;
 }
 
-export async function health(): Promise<void> {
-  console.log(chalk.blue.bold('🔍 Dhruv CLI Health Check\n'));
+export interface HealthOptions {
+  details?: boolean;
+}
 
+export async function health(options: HealthOptions = {}): Promise<void> {
+  const jsonOutput = loadConfig().responseFormat === 'json';
   const results: HealthCheckResult[] = [];
   const startTime = Date.now();
 
   try {
     // System Information
     const systemInfo = getSystemInfo();
-    console.log(chalk.cyan('📊 System Information:'));
-    Object.entries(systemInfo).forEach(([key, value]) => {
-      console.log(`  ${key}: ${chalk.yellow(value)}`);
-    });
-    console.log();
+    if (!jsonOutput) {
+      console.log(chalk.blue.bold('🔍 Dhruv CLI Health Check\n'));
+      console.log(chalk.cyan('📊 System Information:'));
+      Object.entries(systemInfo).forEach(([key, value]) => {
+        console.log(`  ${key}: ${chalk.yellow(value)}`);
+      });
+      console.log();
+    }
 
     // Configuration Check
     results.push(...await checkConfiguration());
@@ -64,15 +70,37 @@ export async function health(): Promise<void> {
     // Plugin System Check
     results.push(...await checkPlugins());
 
-    // Display Results
-    displayResults(results);
-
     const duration = Date.now() - startTime;
+    const summary = summarizeResults(results);
+    if (jsonOutput) {
+      process.exitCode = summary.fail > 0 ? 1 : 0;
+      process.stdout.write(`${JSON.stringify({
+        ok: summary.fail === 0,
+        command: 'health',
+        system: systemInfo,
+        results,
+        summary,
+        durationMs: duration,
+      })}\n`);
+    } else {
+      if (options.details) displayResults(results);
+      else displayConciseResults(results);
+    }
+
     logger.info('Health check completed', { duration, results: results.length });
 
   } catch (error) {
-    printError('Health check failed');
-    console.error(chalk.red((error as Error).message));
+    process.exitCode = 1;
+    if (jsonOutput) {
+      process.stdout.write(`${JSON.stringify({
+        ok: false,
+        command: 'health',
+        error: (error as Error).message,
+      })}\n`);
+    } else {
+      printError('Health check failed');
+      console.error(chalk.red((error as Error).message));
+    }
     logger.error('Health check failed', error as Error);
   }
 }
@@ -421,11 +449,7 @@ function displayResults(results: HealthCheckResult[]): void {
   });
 
   // Summary
-  const summary = {
-    pass: results.filter(r => r.status === 'pass').length,
-    warn: results.filter(r => r.status === 'warn').length,
-    fail: results.filter(r => r.status === 'fail').length
-  };
+  const summary = summarizeResults(results);
 
   console.log(chalk.blue.bold('\n📊 Summary:'));
   console.log(`  ✅ Passed: ${chalk.green(summary.pass)}`);
@@ -438,3 +462,24 @@ function displayResults(results: HealthCheckResult[]): void {
 
   console.log(`\n${statusIcon} ${statusColor('Overall Status: ' + overallStatus.toUpperCase())}`);
 }
+
+function displayConciseResults(results: HealthCheckResult[]): void {
+  const summary = summarizeResults(results);
+  const overallStatus = summary.fail > 0 ? 'fail' : summary.warn > 0 ? 'warn' : 'pass';
+  const icon = overallStatus === 'pass' ? '✅' : overallStatus === 'warn' ? '⚠️' : '❌';
+
+  console.log(chalk.blue.bold(`\n${icon} Health: ${overallStatus.toUpperCase()}`));
+  console.log(`  ${chalk.green(`${summary.pass} passed`)}, ${chalk.yellow(`${summary.warn} warnings`)}, ${chalk.red(`${summary.fail} failed`)}`);
+  results
+    .filter((result) => result.status !== 'pass')
+    .forEach((result) => console.log(`  ${result.category}: ${result.message}${result.recommendation ? ` — ${result.recommendation}` : ''}`));
+  console.log(chalk.dim('Run `dhruv health --details` for full diagnostics.'));
+}
+
+function summarizeResults(results: HealthCheckResult[]) {
+  return {
+    pass: results.filter(r => r.status === 'pass').length,
+    warn: results.filter(r => r.status === 'warn').length,
+    fail: results.filter(r => r.status === 'fail').length,
+  };
+}

package/src/commands/init.ts

@@ -26,6 +26,13 @@ export async function init() {
         choices: modelChoices,
         default: current.model,
       },
+      {
+        type: 'list',
+        name: 'scope',
+        message: 'Where should Dhruv save these settings?',
+        choices: ['local', 'global'],
+        default: 'local',
+      },
       {
         type: 'list',
         name: 'responseFormat',
@@ -48,9 +55,11 @@ export async function init() {
       },
     ]);
 
-    saveConfig(answers);
-    console.log(chalk.green('Configuration saved!'));
+    const { scope, ...settings } = answers;
+    saveConfig(settings, { scope });
+    console.log(chalk.green(`Configuration saved ${scope === 'global' ? 'for your user account' : 'in this project'}!`));
   } catch (error) {
+    process.exitCode = 130;
     if ((error as { isTtyError?: boolean })?.isTtyError) {
       console.log(chalk.red('This command requires an interactive terminal.'));
     } else {

package/src/commands/menu.ts

@@ -8,41 +8,47 @@ import { optimize } from './optimize.js';
 import { securityCheck } from './security-check.js';
 import { generate } from './generate.js';
 import { init } from './init.js';
+import { status } from './status.js';
+import { health } from './health.js';
+import { metrics } from './metrics.js';
 import { detectProjectType } from '../utils/projectType.js';
 import chalk from 'chalk';
+import { commandCatalog } from '../core/command-catalog.js';
 
 const commands = [
-  { name: 'Explain', value: 'explain' },
-  { name: 'Suggest', value: 'suggest' },
-  { name: 'Fix', value: 'fix' },
-  { name: 'Review', value: 'review' },
-  { name: 'Optimize', value: 'optimize' },
-  { name: 'Security Check', value: 'security-check' },
-  { name: 'Generate', value: 'generate' },
-  { name: 'Init (Setup)', value: 'init' },
-  { name: 'Project Type', value: 'project-type' },
-  { name: 'Exit', value: 'exit' }
+  ...commandCatalog.map(({ menuLabel, name }) => ({ name: menuLabel, value: name })),
+  { name: 'Exit', value: 'exit' },
 ];
 
 export async function menu() {
-  let running = true;
-  while (running) {
-    const { cmd } = await inquirer.prompt([
-      {
-        type: 'list',
-        name: 'cmd',
-        message: themed('What do you want to do?', 'primary'),
-        choices: commands
-      }
-    ]);
+  try {
+    while (true) {
+      const { filter = '' } = await inquirer.prompt([
+        {
+          type: 'input',
+          name: 'filter',
+          message: 'Filter commands (press enter to show all):',
+        },
+      ]);
+      const normalizedFilter = String(filter).trim().toLowerCase();
+      const filteredCommands = normalizedFilter
+        ? commands.filter((command) => command.name.toLowerCase().includes(normalizedFilter) || command.value.includes(normalizedFilter))
+        : commands;
+      const { cmd } = await inquirer.prompt([
+        {
+          type: 'list',
+          name: 'cmd',
+          message: themed('What do you want to do?', 'primary'),
+          choices: filteredCommands.length > 0 ? filteredCommands : [{ name: 'No matching commands — Exit', value: 'exit' }],
+        }
+      ]);
     
-    if (cmd === 'exit') {
-      running = false;
-      break;
-    }
+      if (cmd === 'exit') {
+        break;
+      }
 
-    try {
-      switch (cmd) {
+      try {
+        switch (cmd) {
         case 'explain': {
           const { query } = await inquirer.prompt([
             { type: 'input', name: 'query', message: 'What would you like me to explain?' }
@@ -107,13 +113,31 @@ export async function menu() {
           console.log(chalk.blue(`Detected project type: ${type}`));
           break;
         }
+        case 'status':
+          await status();
+          break;
+        case 'health':
+          await health();
+          break;
+        case 'metrics':
+          await metrics();
+          break;
+        case 'completion':
+          console.log(themed('Run `dhruv completion <bash|zsh|fish>` to install shell completion.', 'accent'));
+          break;
         default:
           console.log(themed(`You selected: ${cmd}`, 'accent'));
+        }
+      } catch (error) {
+        console.error(chalk.red(`Error executing ${cmd}: ${(error as Error).message}`));
       }
-    } catch (error) {
-      console.error(chalk.red(`Error executing ${cmd}: ${(error as Error).message}`));
-    }
 
-    console.log(''); // Add spacing between commands
+      console.log(''); // Add spacing between commands
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const cancelled = /cancel|force closed|exitprompt/i.test(message);
+    process.exitCode = cancelled ? 130 : 1;
+    console.error(chalk.red(cancelled ? 'Interactive menu cancelled.' : `Interactive menu failed: ${message}`));
   }
 }

package/src/commands/metrics.ts

@@ -3,13 +3,49 @@ import chalk from 'chalk';
 import { printSuccess, printError, printInfo } from '../utils/ux.js';
 import { metricsCollector } from '../core/metrics.js';
 import { logger } from '../core/logger.js';
+import { loadConfig } from '../config/config.js';
 
-export async function metrics(): Promise<void> {
-  console.log(chalk.blue.bold('📊 Dhruv CLI Metrics\n'));
+export interface MetricsOptions {
+  raw?: boolean;
+  reset?: boolean;
+}
 
+export async function metrics(options: MetricsOptions = {}): Promise<void> {
   try {
+    if (options.reset) {
+      metricsCollector.resetPersistent();
+      if (loadConfig().responseFormat === 'json') {
+        process.stdout.write(`${JSON.stringify({ ok: true, command: 'metrics', reset: true, summary: metricsCollector.getSummary() })}\n`);
+      } else {
+        printSuccess('Local metrics reset.');
+      }
+      return;
+    }
+
     // Get metrics data
     const metricsData = await metricsCollector.getMetricsJSON();
+    const summary = metricsCollector.getSummary();
+
+    if (loadConfig().responseFormat === 'json') {
+      process.stdout.write(`${JSON.stringify({
+        ok: true,
+        command: 'metrics',
+        summary,
+        metrics: metricsData,
+      })}\n`);
+      return;
+    }
+
+    console.log(chalk.blue.bold('📊 Dhruv CLI Metrics\n'));
+    console.log(chalk.cyan('📌 Local summary:'));
+    console.log(`  Sessions: ${chalk.green(summary.sessions)}`);
+    Object.entries(summary.commands).forEach(([command, data]) => {
+      console.log(`  ${chalk.yellow(command)}: ${data.runs} runs, ${data.successes} succeeded, ${data.failures} failed, ${data.durationMs}ms`);
+    });
+    Object.entries(summary.models).forEach(([model, data]) => {
+      console.log(`  ${chalk.yellow(model)}: ${data.requests} requests, ${data.successes} succeeded, ${data.failures} failed, ${data.durationMs}ms`);
+    });
+    console.log(`  Cache: ${chalk.green(summary.cache.hits)} hits, ${chalk.yellow(summary.cache.misses)} misses`);
 
     if (metricsData.length === 0) {
       printInfo('No metrics data available yet. Metrics are collected during CLI usage.');
@@ -49,11 +85,10 @@ export async function metrics(): Promise<void> {
       }
     });
 
-    // Display raw Prometheus metrics
-    console.log(chalk.cyan('\n📋 Raw Prometheus Metrics:'));
-    console.log(chalk.gray('─'.repeat(50)));
-    const rawMetrics = await metricsCollector.getMetrics();
-    console.log(rawMetrics);
+    if (options.raw) {
+      const rawMetrics = await metricsCollector.getMetrics();
+      process.stdout.write(rawMetrics);
+    }
 
     logger.info('Metrics displayed successfully', { metricsCount: metricsData.length });
 

package/src/commands/optimize.ts

@@ -39,7 +39,7 @@ export async function optimize(file: string) {
     input: { file },
     header: `⚡ Optimization suggestions for ${type}: `,
     buildRequest: (input, model) => ({
-      prompt: `Please analyze and provide optimization suggestions for this ${type}:\n\n${content}\n\nPlease provide:\n1. Specific optimization recommendations\n2. Performance improvements\n3. Best practices to implement\n4. Code examples of improvements\n5. Potential issues to fix\n\nFocus on actionable, practical improvements.`,
+      prompt: `Please analyze and provide optimization suggestions for this ${type}. For every recommendation, explain the expected impact, how to measure it, and the trade-offs or risks before applying it.\n\n${content}\n\nPlease provide:\n1. Specific optimization recommendations\n2. Performance improvements\n3. Best practices to implement\n4. Code examples of improvements\n5. Potential issues to fix\n\nFocus on actionable, practical improvements.`,
       systemMessage: getSystemMessage('optimize'),
       model,
     }),

package/src/commands/review.ts

@@ -1,10 +1,15 @@
 import fs from 'fs';
 import path from 'path';
+import { execFileSync } from 'child_process';
 import { runCommand } from '../core/command-runner.js';
 import { getSystemMessage } from '../core/prompts.js';
 import { printError } from '../utils/ux.js';
+import { detectProjectType } from '../utils/projectType.js';
 
-/** Reads a file or the code files of a directory (up to 10), concatenated. */
+const CODE_FILE = /\.(js|ts|jsx|tsx|py|java|cpp|c|go|rs|rb|php)$/;
+const IGNORED_DIRECTORIES = new Set(['.git', 'node_modules', 'dist', 'build', 'coverage', '.dhruv-cache', 'logs']);
+
+/** Reads a file or up to 10 code files from a directory tree. */
 function readCode(fileOrDir: string): string | undefined {
   // Read first, branch on the error: no separate existence check to race against.
   let content: string;
@@ -22,10 +27,24 @@ function readCode(fileOrDir: string): string | undefined {
 }
 
 function readDirectory(dir: string): string | undefined {
-  const files = fs
-    .readdirSync(dir)
-    .filter((f) => f.match(/\.(js|ts|jsx|tsx|py|java|cpp|c|go|rs|rb|php)$/))
-    .slice(0, 10);
+  const files: string[] = [];
+
+  function collect(current: string): void {
+    if (files.length >= 10) return;
+
+    for (const entry of fs.readdirSync(current, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (files.length >= 10) return;
+      const absolute = path.join(current, entry.name);
+
+      if (entry.isDirectory()) {
+        if (!IGNORED_DIRECTORIES.has(entry.name)) collect(absolute);
+      } else if (entry.isFile() && CODE_FILE.test(entry.name)) {
+        files.push(path.relative(dir, absolute).split(path.sep).join('/'));
+      }
+    }
+  }
+
+  collect(dir);
 
   if (files.length === 0) {
     printError(`No code files found in directory "${dir}".`);
@@ -43,16 +62,42 @@ function readDirectory(dir: string): string | undefined {
   return code;
 }
 
-export async function review(fileOrDir: string) {
-  const code = readCode(fileOrDir);
+function readGitDiff(fileOrDir: string): string | undefined {
+  const root = fs.existsSync(fileOrDir) && fs.statSync(fileOrDir).isDirectory() ? fileOrDir : path.dirname(fileOrDir);
+  try {
+    const diff = execFileSync('git', ['diff', '--no-ext-diff', '--unified=80', '--'], {
+      cwd: root,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    if (!diff.trim()) {
+      printError(`No uncommitted changes found in "${fileOrDir}".`);
+      return undefined;
+    }
+    return diff;
+  } catch {
+    printError(`Could not read a git diff for "${fileOrDir}".`);
+    return undefined;
+  }
+}
+
+export interface ReviewOptions {
+  diff?: boolean;
+}
+
+export async function review(fileOrDir: string, options: ReviewOptions = {}) {
+  const code = options.diff ? readGitDiff(fileOrDir) : readCode(fileOrDir);
   if (code === undefined) return;
+  const projectRoot = fs.existsSync(fileOrDir) && fs.statSync(fileOrDir).isDirectory() ? fileOrDir : path.dirname(fileOrDir);
+  const projectType = detectProjectType(projectRoot);
+  const scope = options.diff ? 'the current uncommitted git diff' : 'the supplied source files';
 
   await runCommand({
     name: 'review',
     input: { fileOrDir },
     header: '🔍 Code Review: ',
     buildRequest: (input, model) => ({
-      prompt: `Please review this code and provide feedback on code quality, best practices, potential issues, and suggestions for improvement. Here is the code to review:\n\nCODE_START\n${code}\nCODE_END\n\nPlease provide your review in a structured format with clear categories and actionable feedback.`,
+      prompt: `Please review ${scope} for a ${projectType} project. Provide feedback on code quality, best practices, potential issues, and suggestions for improvement. For every finding, include the file, line or region, severity, explanation, and an actionable recommendation. Here is the code to review:\n\nCODE_START\n${code}\nCODE_END`,
       systemMessage: getSystemMessage('review'),
       model,
     }),

package/src/commands/security-check.ts

@@ -4,6 +4,59 @@ import { runCommand } from '../core/command-runner.js';
 import { getSystemMessage } from '../core/prompts.js';
 import { printError } from '../utils/ux.js';
 
+const CODE_FILE = /\.(js|ts|jsx|tsx|py|java|cpp|c|go|rs|rb|php)$/;
+const IGNORED_DIRECTORIES = new Set(['.git', 'node_modules', 'dist', 'build', 'coverage', '.dhruv-cache', 'logs']);
+
+function redactSensitiveContent(content: string): string {
+  return content
+    .replace(/(\b(?:api[_-]?key|secret|token|password|authorization)\s*[:=]\s*["'`])[^"'`\r\n]+(["'`])/gi, '$1[REDACTED]$2')
+    .replace(/\b(?:sk|pk)-[a-z0-9_-]{8,}\b/gi, '[REDACTED]')
+    .replace(/\bBearer\s+[A-Za-z0-9._~+/=-]+/gi, 'Bearer [REDACTED]');
+}
+
+interface SecurityFinding {
+  line: number;
+  severity: 'high';
+  description: string;
+  remediation: string;
+}
+
+function findHighConfidenceFindings(content: string): SecurityFinding[] {
+  const findings: SecurityFinding[] = [];
+  const lines = content.split(/\r?\n/);
+
+  lines.forEach((line, index) => {
+    if (/\b(?:api[_-]?key|secret|token|password|authorization)\s*[:=]\s*["'`][^"'`\r\n]+["'`]/i.test(line)) {
+      findings.push({
+        line: index + 1,
+        severity: 'high',
+        description: 'credential-like value assigned in source',
+        remediation: 'rotate the credential and load it from a secret manager or environment variable',
+      });
+    } else if (/\b(?:sk|pk)-[a-z0-9_-]{8,}\b/i.test(line)) {
+      findings.push({
+        line: index + 1,
+        severity: 'high',
+        description: 'credential-like API key detected',
+        remediation: 'rotate the credential and remove it from source control',
+      });
+    } else if (/\bBearer\s+[A-Za-z0-9._~+/=-]+/i.test(line)) {
+      findings.push({
+        line: index + 1,
+        severity: 'high',
+        description: 'bearer token detected',
+        remediation: 'revoke the token and use a secure runtime secret store',
+      });
+    }
+  });
+
+  return findings;
+}
+
+export interface SecurityCheckOptions {
+  strict?: boolean;
+}
+
 /** Reads a file or the code files of a directory (up to 10), concatenated. */
 function readCode(fileOrDir: string): string | undefined {
   // Read first, branch on the error: no separate existence check to race against.
@@ -22,10 +75,22 @@ function readCode(fileOrDir: string): string | undefined {
 }
 
 function readDirectory(dir: string): string | undefined {
-  const files = fs
-    .readdirSync(dir)
-    .filter((f) => f.match(/\.(js|ts|jsx|tsx|py|java|cpp|c|go|rs|rb|php)$/))
-    .slice(0, 10);
+  const files: string[] = [];
+
+  function collect(current: string): void {
+    if (files.length >= 10) return;
+    for (const entry of fs.readdirSync(current, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (files.length >= 10) return;
+      const absolute = path.join(current, entry.name);
+      if (entry.isDirectory()) {
+        if (!IGNORED_DIRECTORIES.has(entry.name)) collect(absolute);
+      } else if (entry.isFile() && CODE_FILE.test(entry.name)) {
+        files.push(path.relative(dir, absolute).split(path.sep).join('/'));
+      }
+    }
+  }
+
+  collect(dir);
 
   if (files.length === 0) {
     printError(`No code files found in directory "${dir}".`);
@@ -43,16 +108,25 @@ function readDirectory(dir: string): string | undefined {
   return code;
 }
 
-export async function securityCheck(fileOrDir: string = '.') {
+export async function securityCheck(fileOrDir: string = '.', options: SecurityCheckOptions = {}) {
   const code = readCode(fileOrDir);
   if (code === undefined) return;
+  const findings = findHighConfidenceFindings(code);
+  const safeCode = redactSensitiveContent(code);
+  const findingSummary = findings.length === 0
+    ? 'none'
+    : findings.map((finding) => `- ${finding.severity} at line ${finding.line}: ${finding.description}; remediation: ${finding.remediation}`).join('\n');
+
+  if (options.strict && findings.length > 0) {
+    process.exitCode = 1;
+  }
 
   await runCommand({
     name: 'security-check',
     input: { fileOrDir },
     header: '🛡️  Security Analysis: ',
     buildRequest: (input, model) => ({
-      prompt: `Perform a security analysis on this code. Look for common security vulnerabilities, unsafe practices, potential injection attacks, and provide recommendations for improvement:\n\n${code}`,
+      prompt: `Perform a security analysis on this code. Look for common security vulnerabilities, unsafe practices, potential injection attacks, and provide recommendations for improvement. High-confidence pre-scan findings:\n${findingSummary}\n\n${safeCode}`,
       systemMessage: getSystemMessage('security'),
       model,
     }),