minovative-mind-cli 1.2.3 → 1.3.1

package/dist/utils/performanceAuditor.js

@@ -0,0 +1,615 @@
+import path from 'node:path';
+import pc from 'picocolors';
+const EXTENSION_MAP = {
+    '.ts': 'js', '.tsx': 'js', '.js': 'js', '.jsx': 'js', '.mjs': 'js', '.cjs': 'js',
+    '.py': 'python', '.pyw': 'python',
+    '.go': 'go',
+    '.rs': 'rust',
+};
+function detectLanguage(filePath) {
+    return EXTENSION_MAP[path.extname(filePath).toLowerCase()] ?? 'unknown';
+}
+// ─── Comment & String Stripping ──────────────────────────────────────
+//
+// Before running regex-based detection, we strip string literals and
+// comments from the source to prevent false positives on patterns
+// appearing inside strings or documentation.
+/**
+ * Replaces the content of string literals and comments with whitespace,
+ * preserving line count so that line-number tracking remains accurate.
+ */
+function stripStringsAndComments(source, lang) {
+    if (lang === 'unknown')
+        return source;
+    let result = '';
+    let i = 0;
+    while (i < source.length) {
+        const ch = source[i];
+        const next = source[i + 1];
+        // ── JS/TS/Go/Rust: line comments (//) ─────────────────────
+        if ((lang === 'js' || lang === 'go' || lang === 'rust') && ch === '/' && next === '/') {
+            const eol = source.indexOf('\n', i);
+            const end = eol === -1 ? source.length : eol;
+            result += ' '.repeat(end - i);
+            i = end;
+            continue;
+        }
+        // ── JS/TS/Go/Rust: block comments (/* ... */) ─────────────
+        if ((lang === 'js' || lang === 'go' || lang === 'rust') && ch === '/' && next === '*') {
+            const end = source.indexOf('*/', i + 2);
+            const closePos = end === -1 ? source.length : end + 2;
+            // Preserve newlines for line counting
+            const segment = source.substring(i, closePos);
+            result += segment.replace(/[^\n]/g, ' ');
+            i = closePos;
+            continue;
+        }
+        // ── Python: line comments (#) ─────────────────────────────
+        if (lang === 'python' && ch === '#') {
+            const eol = source.indexOf('\n', i);
+            const end = eol === -1 ? source.length : eol;
+            result += ' '.repeat(end - i);
+            i = end;
+            continue;
+        }
+        // ── Python: triple-quoted strings ─────────────────────────
+        if (lang === 'python' && (source.substring(i, i + 3) === '"""' || source.substring(i, i + 3) === "'''")) {
+            const quote = source.substring(i, i + 3);
+            const end = source.indexOf(quote, i + 3);
+            const closePos = end === -1 ? source.length : end + 3;
+            const segment = source.substring(i, closePos);
+            result += segment.replace(/[^\n]/g, ' ');
+            i = closePos;
+            continue;
+        }
+        // ── All languages: string literals ────────────────────────
+        if (ch === '"' || ch === "'" || (lang === 'js' && ch === '`')) {
+            const quote = ch;
+            let j = i + 1;
+            while (j < source.length) {
+                if (source[j] === '\\') {
+                    j += 2; // skip escaped character
+                    continue;
+                }
+                if (source[j] === quote) {
+                    j++;
+                    break;
+                }
+                // Template literals can span multiple lines
+                if (quote === '`' && source[j] === '\n') {
+                    result += ' '.repeat(j - i);
+                    result += '\n';
+                    i = j + 1;
+                    j = i;
+                    // Reset — we'll pick up again from the new line
+                    continue;
+                }
+                j++;
+            }
+            const segment = source.substring(i, j);
+            result += segment.replace(/[^\n]/g, ' ');
+            i = j;
+            continue;
+        }
+        result += ch;
+        i++;
+    }
+    return result;
+}
+// ─── Utility: Line Number Lookup ─────────────────────────────────────
+/**
+ * Given a character offset in the source, returns the 1-indexed line number.
+ */
+function getLineNumber(source, offset) {
+    let line = 1;
+    for (let i = 0; i < offset && i < source.length; i++) {
+        if (source[i] === '\n')
+            line++;
+    }
+    return line;
+}
+// ── PERF-001: Nested Loop Detection (O(n²) risk) ────────────────────
+//
+// Strategy: Track brace-depth to identify loop constructs that contain
+// other loop constructs. Works across all C-family languages + Python.
+const detectNestedLoops = (source, stripped, lang, findings) => {
+    // Python uses indentation, not braces — use a different strategy
+    if (lang === 'python') {
+        detectNestedLoopsPython(source, stripped, findings);
+        return;
+    }
+    // C-family: scan for loop keywords and track brace depth
+    const loopPattern = /\b(for|while|do)\s*[\s(]/g;
+    const lines = stripped.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (!loopPattern.test(line)) {
+            loopPattern.lastIndex = 0;
+            continue;
+        }
+        loopPattern.lastIndex = 0;
+        // Found a loop — scan forward tracking brace depth to find nested loops
+        let depth = 0;
+        let foundOpening = false;
+        for (let j = i; j < lines.length; j++) {
+            const innerLine = lines[j];
+            for (const ch of innerLine) {
+                if (ch === '{') {
+                    depth++;
+                    foundOpening = true;
+                }
+                else if (ch === '}') {
+                    depth--;
+                }
+            }
+            // Check lines inside the outer loop body for nested loops
+            if (j > i && foundOpening && depth > 0) {
+                if (/\b(for|while|do)\s*[\s(]/.test(innerLine)) {
+                    findings.push({
+                        severity: 'WARNING',
+                        code: 'PERF-001',
+                        line: j + 1,
+                        message: `Nested loop detected (outer loop at line ${i + 1}) — O(n²) or worse complexity.`,
+                        suggestion: 'Consider using a Map/Set for O(1) lookups, or restructure to avoid nested iteration.',
+                    });
+                    break; // One warning per outer loop is enough
+                }
+            }
+            // Outer loop body has closed
+            if (foundOpening && depth <= 0)
+                break;
+        }
+    }
+};
+function detectNestedLoopsPython(_source, stripped, findings) {
+    const lines = stripped.split('\n');
+    const loopPattern = /^\s*(for\s+.+\s+in\s+|while\s+)/;
+    for (let i = 0; i < lines.length; i++) {
+        const outerMatch = lines[i].match(loopPattern);
+        if (!outerMatch)
+            continue;
+        const outerIndent = lines[i].search(/\S/);
+        if (outerIndent < 0)
+            continue;
+        // Scan forward for a nested loop with deeper indentation
+        for (let j = i + 1; j < lines.length; j++) {
+            const innerLine = lines[j];
+            if (innerLine.trim() === '')
+                continue;
+            const innerIndent = innerLine.search(/\S/);
+            // If we've returned to same or lesser indent, the outer loop body is over
+            if (innerIndent <= outerIndent)
+                break;
+            if (loopPattern.test(innerLine)) {
+                findings.push({
+                    severity: 'WARNING',
+                    code: 'PERF-001',
+                    line: j + 1,
+                    message: `Nested loop detected (outer loop at line ${i + 1}) — O(n²) or worse complexity.`,
+                    suggestion: 'Consider using a dictionary for O(1) lookups, or restructure to avoid nested iteration.',
+                });
+                break;
+            }
+        }
+    }
+}
+// ── PERF-002: Chained Array Methods (multiple intermediate allocations) ──
+const detectChainedArrayMethods = (_source, stripped, lang, findings) => {
+    if (lang !== 'js')
+        return;
+    // Match chains like .map(...).filter(...).reduce(...) with 3+ methods
+    const chainPattern = /\.(map|filter|reduce|flatMap|flat|sort|slice|concat)\s*\([^)]*\)\s*\.(map|filter|reduce|flatMap|flat|sort|slice|concat)\s*\([^)]*\)\s*\.(map|filter|reduce|flatMap|flat|sort|slice|concat)/g;
+    const lines = stripped.split('\n');
+    // Search across joined lines since chains can span multiple lines
+    const joined = stripped;
+    let match;
+    while ((match = chainPattern.exec(joined)) !== null) {
+        const line = getLineNumber(stripped, match.index);
+        findings.push({
+            severity: 'WARNING',
+            code: 'PERF-002',
+            line,
+            message: `Chained array methods (.${match[1]}().${match[2]}().${match[3]}()) — creates 3+ intermediate arrays.`,
+            suggestion: 'Combine into a single .reduce() or use a for-loop to avoid intermediate allocations.',
+        });
+    }
+};
+// ── PERF-003: Synchronous I/O in Async Functions ─────────────────────
+const detectSyncIOInAsync = (_source, stripped, lang, findings) => {
+    if (lang !== 'js')
+        return;
+    const syncAPIs = [
+        'readFileSync', 'writeFileSync', 'appendFileSync', 'mkdirSync',
+        'readdirSync', 'statSync', 'existsSync', 'copyFileSync',
+        'renameSync', 'unlinkSync', 'rmdirSync', 'accessSync',
+    ];
+    const lines = stripped.split('\n');
+    let insideAsync = false;
+    let asyncBraceDepth = 0;
+    let braceDepth = 0;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Detect async function/method/arrow entry
+        if (/\basync\s+(function\b|\w+\s*\(|(\w+)\s*=>|\(.*\)\s*=>)/.test(line) || /\basync\s+\w+\s*\(/.test(line)) {
+            insideAsync = true;
+            asyncBraceDepth = braceDepth;
+        }
+        for (const ch of line) {
+            if (ch === '{')
+                braceDepth++;
+            else if (ch === '}') {
+                braceDepth--;
+                if (insideAsync && braceDepth <= asyncBraceDepth) {
+                    insideAsync = false;
+                }
+            }
+        }
+        if (insideAsync) {
+            for (const api of syncAPIs) {
+                if (line.includes(api)) {
+                    findings.push({
+                        severity: 'ERROR',
+                        code: 'PERF-003',
+                        line: i + 1,
+                        message: `Synchronous I/O (${api}) inside async function — blocks the event loop.`,
+                        suggestion: 'Use the async equivalent (e.g., fs.promises.readFile or fs/promises) instead.',
+                    });
+                }
+            }
+        }
+    }
+};
+// ── PERF-004: Object/Array Spread Inside Loops ───────────────────────
+const detectSpreadInLoops = (_source, stripped, lang, findings) => {
+    if (lang !== 'js')
+        return;
+    const lines = stripped.split('\n');
+    let loopDepth = 0;
+    let braceDepth = 0;
+    let inLoop = false;
+    let loopBraceStart = 0;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (/\b(for|while|do)\s*[\s(]/.test(line) && !inLoop) {
+            inLoop = true;
+            loopBraceStart = braceDepth;
+            loopDepth++;
+        }
+        for (const ch of line) {
+            if (ch === '{')
+                braceDepth++;
+            else if (ch === '}') {
+                braceDepth--;
+                if (inLoop && braceDepth <= loopBraceStart) {
+                    inLoop = false;
+                    loopDepth--;
+                }
+            }
+        }
+        if (loopDepth > 0 && /\.\.\.[\w$]/.test(line)) {
+            findings.push({
+                severity: 'WARNING',
+                code: 'PERF-004',
+                line: i + 1,
+                message: 'Object/Array spread inside a loop — creates a full shallow copy on every iteration.',
+                suggestion: 'Mutate the object directly or accumulate into a pre-allocated structure.',
+            });
+        }
+    }
+};
+// ── PERF-005: Missing Resource Cleanup ───────────────────────────────
+const detectMissingCleanup = (source, stripped, lang, findings) => {
+    if (lang !== 'js' && lang !== 'python')
+        return;
+    if (lang === 'js') {
+        // Look for createReadStream/createWriteStream/createServer assigned to a variable
+        const pattern = /\b(const|let|var)\s+(\w+)\s*=\s*.*\b(createReadStream|createWriteStream|createServer|createConnection|net\.connect|tls\.connect)\b/g;
+        let match;
+        while ((match = pattern.exec(stripped)) !== null) {
+            const varName = match[2];
+            const creator = match[3];
+            const line = getLineNumber(stripped, match.index);
+            // Check if .close(), .destroy(), .end(), or .disconnect() is called on this variable
+            // within a reasonable scope (the rest of the file)
+            const rest = stripped.substring(match.index);
+            const hasCleanup = rest.includes(`${varName}.close()`) ||
+                rest.includes(`${varName}.destroy()`) ||
+                rest.includes(`${varName}.end()`) ||
+                rest.includes(`${varName}.disconnect()`) ||
+                // Also accept piping (which handles cleanup) or 'using' declarations
+                rest.includes(`${varName}.pipe(`) ||
+                stripped.includes(`using ${varName}`);
+            if (!hasCleanup) {
+                findings.push({
+                    severity: 'WARNING',
+                    code: 'PERF-005',
+                    line,
+                    message: `Resource created via ${creator}() assigned to '${varName}' but no .close()/.destroy()/.end() found.`,
+                    suggestion: "Use a try/finally block or 'using' declaration to ensure cleanup.",
+                });
+            }
+        }
+    }
+    if (lang === 'python') {
+        // Detect open() not inside a 'with' statement
+        const lines = stripped.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            // Match: var = open(...) but NOT: with open(...) as var
+            if (/=\s*open\s*\(/.test(line) && !/\bwith\b/.test(line)) {
+                findings.push({
+                    severity: 'WARNING',
+                    code: 'PERF-005',
+                    line: i + 1,
+                    message: "File opened with open() without a 'with' statement — resource may not be properly closed.",
+                    suggestion: "Use 'with open(...) as f:' to ensure the file handle is automatically closed.",
+                });
+            }
+        }
+    }
+};
+// ── PERF-006: eval() / new Function() / exec() ──────────────────────
+const detectDangerousEval = (_source, stripped, lang, findings) => {
+    const lines = stripped.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (lang === 'js') {
+            // Match eval(...) but not .addEventListener('...', eval)
+            if (/\beval\s*\(/.test(line)) {
+                findings.push({
+                    severity: 'ERROR',
+                    code: 'PERF-006',
+                    line: i + 1,
+                    message: 'eval() usage — prevents V8 optimizations and poses security risks.',
+                    suggestion: 'Use JSON.parse(), a lookup table, or refactor the logic to avoid dynamic code evaluation.',
+                });
+            }
+            if (/\bnew\s+Function\s*\(/.test(line)) {
+                findings.push({
+                    severity: 'ERROR',
+                    code: 'PERF-006',
+                    line: i + 1,
+                    message: 'new Function() — dynamically compiled code bypasses V8 optimization pipeline.',
+                    suggestion: 'Pre-compile or use a safer alternative (e.g., a lookup table or map).',
+                });
+            }
+        }
+        if (lang === 'python') {
+            if (/\beval\s*\(/.test(line)) {
+                findings.push({
+                    severity: 'ERROR',
+                    code: 'PERF-006',
+                    line: i + 1,
+                    message: 'eval() usage — arbitrary code execution risk and performance penalty.',
+                    suggestion: 'Use ast.literal_eval() for safe evaluation, or refactor to avoid dynamic code.',
+                });
+            }
+            if (/\bexec\s*\(/.test(line)) {
+                findings.push({
+                    severity: 'ERROR',
+                    code: 'PERF-006',
+                    line: i + 1,
+                    message: 'exec() usage — arbitrary code execution risk.',
+                    suggestion: 'Refactor to avoid dynamic code execution. Use importlib or a dispatch table.',
+                });
+            }
+        }
+    }
+};
+// ── PERF-007: JSON.parse on Unvalidated Input ────────────────────────
+const detectUnsafeJsonParse = (_source, stripped, lang, findings) => {
+    if (lang !== 'js')
+        return;
+    const lines = stripped.split('\n');
+    let insideAsync = false;
+    let asyncBraceDepth = 0;
+    let braceDepth = 0;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (/\basync\s+/.test(line)) {
+            insideAsync = true;
+            asyncBraceDepth = braceDepth;
+        }
+        for (const ch of line) {
+            if (ch === '{')
+                braceDepth++;
+            else if (ch === '}') {
+                braceDepth--;
+                if (insideAsync && braceDepth <= asyncBraceDepth)
+                    insideAsync = false;
+            }
+        }
+        // Detect JSON.parse(req.body) / JSON.parse(body) / JSON.parse(data) etc.
+        // in what appears to be a request handler context
+        if (/JSON\.parse\s*\(/.test(line)) {
+            // Check if this is inside a try block — if so, it's handled
+            const prevLines = lines.slice(Math.max(0, i - 5), i).join('\n');
+            if (/\btry\s*\{/.test(prevLines))
+                continue;
+            // Check if the argument looks like an external input
+            const argMatch = line.match(/JSON\.parse\s*\(\s*(\w+)/);
+            if (argMatch) {
+                const argName = argMatch[1].toLowerCase();
+                const externalHints = ['body', 'data', 'payload', 'input', 'raw', 'text', 'chunk', 'buffer', 'message'];
+                if (externalHints.some((hint) => argName.includes(hint))) {
+                    findings.push({
+                        severity: 'INFO',
+                        code: 'PERF-007',
+                        line: i + 1,
+                        message: `JSON.parse() on '${argMatch[1]}' without try/catch — may throw on malformed input or cause OOM on large payloads.`,
+                        suggestion: 'Wrap in try/catch and consider validating payload size before parsing.',
+                    });
+                }
+            }
+        }
+    }
+};
+// ── PERF-008: Unbounded Database/API Fetch ───────────────────────────
+const detectUnboundedFetch = (_source, stripped, lang, findings) => {
+    const lines = stripped.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (lang === 'js') {
+            // Detect .find() / .findMany() / .select() / .query() without .limit() / .take() / .paginate()
+            // Common in Prisma, Mongoose, Knex, Sequelize
+            if (/\.(find|findMany|findAll|select|query)\s*\(/.test(line)) {
+                // Look ahead a few lines for a .limit() / .take() / .skip() / .paginate() / .first()
+                const window = lines.slice(i, Math.min(i + 5, lines.length)).join('\n');
+                if (!/\.(limit|take|first|paginate|skip|offset|top)\s*\(/.test(window) &&
+                    !/\bLIMIT\b/i.test(window)) {
+                    findings.push({
+                        severity: 'WARNING',
+                        code: 'PERF-008',
+                        line: i + 1,
+                        message: 'Database/API query without .limit() or pagination — may fetch unbounded rows into memory.',
+                        suggestion: 'Add .limit(), .take(), or cursor-based pagination to bound the result set.',
+                    });
+                }
+            }
+        }
+        if (lang === 'python') {
+            // Detect .all() / .filter() on Django/SQLAlchemy querysets without [:N] or .limit()
+            if (/\.(all|filter|objects\.filter|objects\.all)\s*\(/.test(line)) {
+                const window = lines.slice(i, Math.min(i + 5, lines.length)).join('\n');
+                if (!/\.(limit|first|paginate|count)\s*\(/.test(window) &&
+                    !/\[:?\d+\]/.test(window) &&
+                    !/\bLIMIT\b/i.test(window)) {
+                    findings.push({
+                        severity: 'WARNING',
+                        code: 'PERF-008',
+                        line: i + 1,
+                        message: 'Query without .limit() or slicing — may fetch unbounded rows into memory.',
+                        suggestion: 'Add .limit(), slicing [:N], or cursor-based pagination to bound the result set.',
+                    });
+                }
+            }
+        }
+        // Go / Rust: detect SQL queries without LIMIT
+        if (lang === 'go' || lang === 'rust') {
+            if (/SELECT\s+/i.test(line) && !/\bLIMIT\b/i.test(line)) {
+                // Look ahead for LIMIT on subsequent lines
+                const window = lines.slice(i, Math.min(i + 5, lines.length)).join('\n');
+                if (!/\bLIMIT\b/i.test(window)) {
+                    findings.push({
+                        severity: 'WARNING',
+                        code: 'PERF-008',
+                        line: i + 1,
+                        message: 'SQL SELECT without LIMIT clause — may fetch unbounded rows into memory.',
+                        suggestion: 'Add a LIMIT clause or use cursor-based pagination.',
+                    });
+                }
+            }
+        }
+    }
+};
+// ─── Rule Registry ───────────────────────────────────────────────────
+const ALL_RULES = [
+    detectNestedLoops,
+    detectChainedArrayMethods,
+    detectSyncIOInAsync,
+    detectSpreadInLoops,
+    detectMissingCleanup,
+    detectDangerousEval,
+    detectUnsafeJsonParse,
+    detectUnboundedFetch,
+];
+// ─── Supported Extensions for Auditing ───────────────────────────────
+const AUDITABLE_EXTENSIONS = new Set(Object.keys(EXTENSION_MAP));
+/**
+ * Returns true if the file extension is supported by the performance auditor.
+ */
+export function isAuditableFile(filePath) {
+    return AUDITABLE_EXTENSIONS.has(path.extname(filePath).toLowerCase());
+}
+// ─── Main Entry Point ────────────────────────────────────────────────
+/**
+ * Scans source code for performance anti-patterns using language-aware
+ * regex-based heuristics. Returns structured findings grouped by severity.
+ *
+ * This function is designed to be called inline during the verification
+ * phase — it's synchronous, zero-dependency, and executes in <50ms on
+ * files up to 10,000 lines.
+ *
+ * @param content - The raw source code string to audit.
+ * @param filePath - The file path (used for language detection via extension).
+ * @returns A structured audit result with findings separated by severity.
+ */
+export function auditFilePerformance(content, filePath) {
+    const lang = detectLanguage(filePath);
+    const findings = [];
+    if (lang === 'unknown') {
+        return { filePath, findings: [], errors: [], warnings: [], infos: [] };
+    }
+    // Strip strings and comments to avoid false positives
+    const stripped = stripStringsAndComments(content, lang);
+    for (const rule of ALL_RULES) {
+        rule(content, stripped, lang, findings);
+    }
+    // Sort by severity (ERROR first), then by line number
+    const severityOrder = { ERROR: 0, WARNING: 1, INFO: 2 };
+    findings.sort((a, b) => {
+        const sevDiff = severityOrder[a.severity] - severityOrder[b.severity];
+        return sevDiff !== 0 ? sevDiff : a.line - b.line;
+    });
+    return {
+        filePath,
+        findings,
+        errors: findings.filter((f) => f.severity === 'ERROR'),
+        warnings: findings.filter((f) => f.severity === 'WARNING'),
+        infos: findings.filter((f) => f.severity === 'INFO'),
+    };
+}
+// ─── Output Formatters ───────────────────────────────────────────────
+const SEVERITY_ICONS = {
+    ERROR: '🔴',
+    WARNING: '🟡',
+    INFO: '🔵',
+};
+/**
+ * Formats audit findings for beautiful terminal display using picocolors.
+ * Used for non-blocking warnings shown to the user after verification.
+ */
+export function formatAuditForTerminal(results) {
+    const allFindings = results.flatMap((r) => r.findings.map((f) => ({ ...f, file: r.filePath })));
+    if (allFindings.length === 0)
+        return '';
+    const lines = [
+        pc.bold('Performance Audit Results'),
+        pc.dim('─'.repeat(50)),
+    ];
+    for (const f of allFindings) {
+        const icon = SEVERITY_ICONS[f.severity];
+        const sevColor = f.severity === 'ERROR' ? pc.red : f.severity === 'WARNING' ? pc.yellow : pc.blue;
+        lines.push(`${icon} ${sevColor(f.severity)} ${pc.dim(`[${f.code}]`)} ${pc.cyan(f.file)}${pc.dim(`:${f.line}`)}`);
+        lines.push(`  ${f.message}`);
+        lines.push(`  ${pc.dim('→')} ${pc.dim(f.suggestion)}`);
+    }
+    const errorCount = allFindings.filter((f) => f.severity === 'ERROR').length;
+    const warnCount = allFindings.filter((f) => f.severity === 'WARNING').length;
+    const infoCount = allFindings.filter((f) => f.severity === 'INFO').length;
+    lines.push(pc.dim('─'.repeat(50)));
+    lines.push(`${errorCount > 0 ? pc.red(`${errorCount} error(s)`) : '0 errors'}, ` +
+        `${warnCount > 0 ? pc.yellow(`${warnCount} warning(s)`) : '0 warnings'}, ` +
+        `${infoCount > 0 ? pc.blue(`${infoCount} info`) : '0 info'}`);
+    return lines.join('\n');
+}
+/**
+ * Formats audit findings into a structured prompt for the AI auto-correction loop.
+ * Only includes ERROR-severity findings (warnings and info are non-blocking).
+ */
+export function formatAuditForModel(results) {
+    const errors = results.flatMap((r) => r.errors.map((f) => ({ ...f, file: r.filePath })));
+    if (errors.length === 0)
+        return '';
+    const lines = [
+        'The following performance anti-patterns were detected in your generated code:',
+        '',
+    ];
+    for (const e of errors) {
+        lines.push(`[${e.code}] ${e.file}:${e.line} — ${e.message}`);
+        lines.push(`  Fix: ${e.suggestion}`);
+        lines.push('');
+    }
+    lines.push('Please fix these performance issues using the modify_file tool.');
+    return lines.join('\n');
+}