minovative-mind-cli 2.5.1 → 2.6.0

package/dist/utils/performanceAuditor.js

@@ -1,20 +1,31 @@
 import path from 'node:path';
 import pc from 'picocolors';
 const EXTENSION_MAP = {
-    '.ts': 'js', '.tsx': 'js', '.js': 'js', '.jsx': 'js', '.mjs': 'js', '.cjs': 'js',
-    '.py': 'python', '.pyw': 'python',
+    '.ts': 'js',
+    '.tsx': 'js',
+    '.js': 'js',
+    '.jsx': 'js',
+    '.mjs': 'js',
+    '.cjs': 'js',
+    '.py': 'python',
+    '.pyw': 'python',
     '.go': 'go',
     '.rs': 'rust',
     '.php': 'php',
+    '.cs': 'csharp',
+    '.java': 'java',
+    '.cpp': 'cpp',
+    '.hpp': 'cpp',
+    '.cc': 'cpp',
+    '.cxx': 'cpp',
+    '.c': 'cpp',
+    '.h': 'cpp',
+    '.rb': 'ruby',
 };
 function detectLanguage(filePath) {
     return EXTENSION_MAP[path.extname(filePath).toLowerCase()] ?? 'unknown';
 }
 // ─── Comment & String Stripping ──────────────────────────────────────
-//
-// Before running regex-based detection, we strip string literals and
-// comments from the source to prevent false positives on patterns
-// appearing inside strings or documentation.
 /**
  * Replaces the content of string literals and comments with whitespace,
  * preserving line count so that line-number tracking remains accurate.
@@ -27,32 +38,77 @@ function stripStringsAndComments(source, lang) {
     while (i < source.length) {
         const ch = source[i];
         const next = source[i + 1];
-        // ── JS/TS/Go/Rust/PHP: line comments (//) ─────────────────────
-        if ((lang === 'js' || lang === 'go' || lang === 'rust' || lang === 'php') && ch === '/' && next === '/') {
+        // ── C-family: line comments (//) ──────────────────────────────
+        if (['js', 'go', 'rust', 'php', 'csharp', 'java', 'cpp'].includes(lang) && ch === '/' && next === '/') {
             const eol = source.indexOf('\n', i);
             const end = eol === -1 ? source.length : eol;
             result += ' '.repeat(end - i);
             i = end;
             continue;
         }
-        // ── JS/TS/Go/Rust/PHP: block comments (/* ... */) ─────────────
-        if ((lang === 'js' || lang === 'go' || lang === 'rust' || lang === 'php') && ch === '/' && next === '*') {
+        // ── C-family: block comments (/* ... */) ─────────────────────
+        if (['js', 'go', 'rust', 'php', 'csharp', 'java', 'cpp'].includes(lang) && ch === '/' && next === '*') {
             const end = source.indexOf('*/', i + 2);
             const closePos = end === -1 ? source.length : end + 2;
-            // Preserve newlines for line counting
             const segment = source.substring(i, closePos);
             result += segment.replace(/[^\n]/g, ' ');
             i = closePos;
             continue;
         }
-        // ── Python/PHP: line comments (#) ─────────────────────────────
-        if ((lang === 'python' || lang === 'php') && ch === '#') {
+        // ── Hash comment languages: (#) ──────────────────────────────
+        if (['python', 'php', 'ruby'].includes(lang) && ch === '#') {
             const eol = source.indexOf('\n', i);
             const end = eol === -1 ? source.length : eol;
             result += ' '.repeat(end - i);
             i = end;
             continue;
         }
+        // ── Ruby: block comments (=begin ... =end) ────────────────────
+        if (lang === 'ruby' && (i === 0 || source[i - 1] === '\n') && source.substring(i, i + 6) === '=begin') {
+            const end = source.indexOf('\n=end', i + 6);
+            const closePos = end === -1 ? source.length : end + 5;
+            const segment = source.substring(i, closePos);
+            result += segment.replace(/[^\n]/g, ' ');
+            i = closePos;
+            continue;
+        }
+        // ── C#: Raw string literals ("""...""") ────────────────────────
+        if (lang === 'csharp' && source.substring(i, i + 3) === '"""') {
+            const end = source.indexOf('"""', i + 3);
+            const closePos = end === -1 ? source.length : end + 3;
+            const segment = source.substring(i, closePos);
+            result += segment.replace(/[^\n]/g, ' ');
+            i = closePos;
+            continue;
+        }
+        // ── C#: Verbatim string literals (@"...") ─────────────────────
+        if (lang === 'csharp' && ch === '@' && next === '"') {
+            let j = i + 2;
+            while (j < source.length) {
+                if (source[j] === '"' && source[j + 1] === '"') {
+                    j += 2;
+                    continue;
+                }
+                if (source[j] === '"') {
+                    j++;
+                    break;
+                }
+                j++;
+            }
+            const segment = source.substring(i, j);
+            result += segment.replace(/[^\n]/g, ' ');
+            i = j;
+            continue;
+        }
+        // ── C++: Raw string literals R"(...)" ─────────────────────────
+        if (lang === 'cpp' && ch === 'R' && next === '"') {
+            const end = source.indexOf(')"', i + 2);
+            const closePos = end === -1 ? source.length : end + 2;
+            const segment = source.substring(i, closePos);
+            result += segment.replace(/[^\n]/g, ' ');
+            i = closePos;
+            continue;
+        }
         // ── Python: triple-quoted strings ─────────────────────────
         if (lang === 'python' && (source.substring(i, i + 3) === '"""' || source.substring(i, i + 3) === "'''")) {
             const quote = source.substring(i, i + 3);
@@ -67,7 +123,6 @@ function stripStringsAndComments(source, lang) {
         if (lang === 'php' && ch === '<' && next === '<' && source[i + 2] === '<') {
             const eol = source.indexOf('\n', i);
             if (eol !== -1) {
-                // e.g. <<<EOF or <<<'EOF'
                 const idMatch = source.substring(i + 3, eol).match(/[A-Za-z0-9_]+/);
                 if (idMatch) {
                     const identifier = idMatch[0];
@@ -83,26 +138,24 @@ function stripStringsAndComments(source, lang) {
                 }
             }
         }
-        // ── All languages: string literals ────────────────────────
+        // ── All languages: generic string literals ────────────────────
         if (ch === '"' || ch === "'" || (lang === 'js' && ch === '`')) {
             const quote = ch;
             let j = i + 1;
             while (j < source.length) {
                 if (source[j] === '\\') {
-                    j += 2; // skip escaped character
+                    j += 2;
                     continue;
                 }
                 if (source[j] === quote) {
                     j++;
                     break;
                 }
-                // Template literals can span multiple lines
                 if (quote === '`' && source[j] === '\n') {
                     result += ' '.repeat(j - i);
                     result += '\n';
                     i = j + 1;
                     j = i;
-                    // Reset — we'll pick up again from the new line
                     continue;
                 }
                 j++;
@@ -117,10 +170,83 @@ function stripStringsAndComments(source, lang) {
     }
     return result;
 }
-// ─── Utility: Line Number Lookup ─────────────────────────────────────
+// ─── Directives Handling (perf-ignore) ────────────────────────────────
 /**
- * Given a character offset in the source, returns the 1-indexed line number.
+ * Filters out findings that are suppressed via comment directives in raw source.
+ * Supported directives:
+ *   // perf-ignore
+ *   // perf-ignore: PERF-001, PERF-009
+ *   // perf-ignore-file
+ *   // perf-ignore-file: PERF-003
+ * Works with //, #, /* ... * /, -- comment styles across languages.
  */
+function applyDirectiveSuppression(findings, rawSource) {
+    if (findings.length === 0)
+        return findings;
+    const lines = rawSource.split('\n');
+    const fileIgnoredCodes = new Set();
+    let ignoreAllFile = false;
+    const lineIgnoredCodesMap = new Map();
+    const directiveRegex = /(?:\/\/|#|\/\*|--)\s*perf-ignore(-file)?(?:[:\s]+([A-Za-z0-9_,\s-]+))?/i;
+    for (let idx = 0; idx < lines.length; idx++) {
+        const lineNum = idx + 1;
+        const lineStr = lines[idx];
+        const match = lineStr.match(directiveRegex);
+        if (!match)
+            continue;
+        const isFileLevel = Boolean(match[1]);
+        const codesRaw = match[2]?.trim();
+        const parsedCodes = codesRaw
+            ? codesRaw
+                .split(/[\s,]+/)
+                .map((c) => c.trim().toUpperCase())
+                .filter(Boolean)
+            : [];
+        if (isFileLevel) {
+            if (parsedCodes.length === 0) {
+                ignoreAllFile = true;
+            }
+            else {
+                for (const code of parsedCodes) {
+                    fileIgnoredCodes.add(code);
+                }
+            }
+        }
+        else {
+            // Line-level directive suppresses findings on the directive line AND the following line
+            const targetLines = [lineNum, lineNum + 1];
+            for (const targetLine of targetLines) {
+                let lineCodes = lineIgnoredCodesMap.get(targetLine);
+                if (!lineCodes) {
+                    lineCodes = new Set();
+                    lineIgnoredCodesMap.set(targetLine, lineCodes);
+                }
+                if (parsedCodes.length === 0) {
+                    lineCodes.add('*');
+                }
+                else {
+                    for (const code of parsedCodes) {
+                        lineCodes.add(code);
+                    }
+                }
+            }
+        }
+    }
+    if (ignoreAllFile)
+        return [];
+    return findings.filter((finding) => {
+        const code = finding.code.toUpperCase();
+        if (fileIgnoredCodes.has(code))
+            return false;
+        const lineCodes = lineIgnoredCodesMap.get(finding.line);
+        if (lineCodes) {
+            if (lineCodes.has('*') || lineCodes.has(code))
+                return false;
+        }
+        return true;
+    });
+}
+// ─── Utility: Line Number Lookup ─────────────────────────────────────
 function getLineNumber(source, offset) {
     let line = 1;
     for (let i = 0; i < offset && i < source.length; i++) {
@@ -130,16 +256,15 @@ function getLineNumber(source, offset) {
     return line;
 }
 // ── PERF-001: Nested Loop Detection (O(n²) risk) ────────────────────
-//
-// Strategy: Track brace-depth to identify loop constructs that contain
-// other loop constructs. Works across all C-family languages + Python.
 const detectNestedLoops = (source, stripped, lang, findings) => {
-    // Python uses indentation, not braces — use a different strategy
     if (lang === 'python') {
         detectNestedLoopsPython(source, stripped, findings);
         return;
     }
-    // C-family: scan for loop keywords and track brace depth
+    if (lang === 'ruby') {
+        detectNestedLoopsRuby(source, stripped, findings);
+        return;
+    }
     const loopPattern = /\b(for|foreach|while|do)\s*[\s(]|\.(forEach|map|filter|reduce|flatMap)\s*\(/g;
     const lines = stripped.split('\n');
     for (let i = 0; i < lines.length; i++) {
@@ -149,7 +274,6 @@ const detectNestedLoops = (source, stripped, lang, findings) => {
             continue;
         }
         loopPattern.lastIndex = 0;
-        // Found a loop — scan forward tracking brace depth to find nested loops
         let depth = 0;
         let foundOpening = false;
         for (let j = i; j < lines.length; j++) {
@@ -163,20 +287,24 @@ const detectNestedLoops = (source, stripped, lang, findings) => {
                     depth--;
                 }
             }
-            // Check lines inside the outer loop body for nested loops
             if (j > i && foundOpening && depth > 0) {
+                // Context-aware heuristic: Ignore nested loops over small constant literals/bounds (e.g. i < 2, ['a', 'b'])
                 if (/\b(for|foreach|while|do)\s*[\s(]|\.(forEach|map|filter|reduce|flatMap)\s*\(/.test(innerLine)) {
+                    if (/for\s*\([^;]*;\s*[\w$]+\s*<=\s*([0-9]|10)\b/.test(innerLine) ||
+                        /for\s*\([^;]*;\s*[\w$]+\s*<\s*([0-9]|10)\b/.test(innerLine) ||
+                        /\[\s*(?:\d+|'[^']+'|"[^"]+")\s*,\s*(?:\d+|'[^']+'|"[^"]+")\s*\]/.test(innerLine)) {
+                        continue;
+                    }
                     findings.push({
                         severity: 'WARNING',
                         code: 'PERF-001',
                         line: j + 1,
                         message: `Nested loop detected (outer loop at line ${i + 1}) — O(n²) or worse complexity.`,
-                        suggestion: 'Consider using a Map/Set for O(1) lookups, or restructure to avoid nested iteration.',
+                        suggestion: 'Consider using a Map/Set/Hash for O(1) lookups, or restructure to avoid nested iteration.',
                     });
-                    break; // One warning per outer loop is enough
+                    break;
                 }
             }
-            // Outer loop body has closed
             if (foundOpening && depth <= 0)
                 break;
         }
@@ -192,22 +320,52 @@ function detectNestedLoopsPython(_source, stripped, findings) {
         const outerIndent = lines[i].search(/\S/);
         if (outerIndent < 0)
             continue;
-        // Scan forward for a nested loop with deeper indentation
         for (let j = i + 1; j < lines.length; j++) {
             const innerLine = lines[j];
             if (innerLine.trim() === '')
                 continue;
             const innerIndent = innerLine.search(/\S/);
-            // If we've returned to same or lesser indent, the outer loop body is over
             if (innerIndent <= outerIndent)
                 break;
             if (loopPattern.test(innerLine)) {
+                if (/\brange\s*\(\s*([0-9]|10)\s*\)/.test(innerLine))
+                    continue;
+                findings.push({
+                    severity: 'WARNING',
+                    code: 'PERF-001',
+                    line: j + 1,
+                    message: `Nested loop detected (outer loop at line ${i + 1}) — O(n²) or worse complexity.`,
+                    suggestion: 'Consider using a dictionary/set for O(1) lookups, or restructure to avoid nested iteration.',
+                });
+                break;
+            }
+        }
+    }
+}
+function detectNestedLoopsRuby(_source, stripped, findings) {
+    const lines = stripped.split('\n');
+    const loopPattern = /\b(while|until|for)\b|\.(each|times|map|select|loop)\b/;
+    for (let i = 0; i < lines.length; i++) {
+        const outerLine = lines[i];
+        if (!loopPattern.test(outerLine))
+            continue;
+        const outerIndent = outerLine.search(/\S/);
+        if (outerIndent < 0)
+            continue;
+        for (let j = i + 1; j < lines.length; j++) {
+            const innerLine = lines[j];
+            if (innerLine.trim() === '')
+                continue;
+            const innerIndent = innerLine.search(/\S/);
+            if (innerIndent <= outerIndent && !/^\s*(end|\}|\))\b/.test(innerLine))
+                break;
+            if (loopPattern.test(innerLine) && innerIndent > outerIndent) {
                 findings.push({
                     severity: 'WARNING',
                     code: 'PERF-001',
                     line: j + 1,
                     message: `Nested loop detected (outer loop at line ${i + 1}) — O(n²) or worse complexity.`,
-                    suggestion: 'Consider using a dictionary for O(1) lookups, or restructure to avoid nested iteration.',
+                    suggestion: 'Consider using a Hash for O(1) lookups or flat map operations.',
                 });
                 break;
             }
@@ -218,10 +376,7 @@ function detectNestedLoopsPython(_source, stripped, findings) {
 const detectChainedArrayMethods = (_source, stripped, lang, findings) => {
     if (lang !== 'js')
         return;
-    // Match chains like .map(...).filter(...).reduce(...) with 3+ methods
-    const chainPattern = /\.(map|filter|reduce|flatMap|flat|sort|slice|concat)\s*\([^)]*\)\s*\.(map|filter|reduce|flatMap|flat|sort|slice|concat)\s*\([^)]*\)\s*\.(map|filter|reduce|flatMap|flat|sort|slice|concat)/g;
-    const lines = stripped.split('\n');
-    // Search across joined lines since chains can span multiple lines
+    const chainPattern = /\.(map|filter|reduce|flatMap|flat|sort|slice|concat)\s*\([\s\S]*?\)\s*\.(map|filter|reduce|flatMap|flat|sort|slice|concat)\s*\([\s\S]*?\)\s*\.(map|filter|reduce|flatMap|flat|sort|slice|concat)/g;
     const joined = stripped;
     let match;
     while ((match = chainPattern.exec(joined)) !== null) {
@@ -240,10 +395,21 @@ const detectSyncIOInAsync = (_source, stripped, lang, findings) => {
     if (lang !== 'js')
         return;
     const syncAPIs = [
-        'readFileSync', 'writeFileSync', 'appendFileSync', 'mkdirSync',
-        'readdirSync', 'statSync', 'existsSync', 'copyFileSync',
-        'renameSync', 'unlinkSync', 'rmdirSync', 'accessSync',
-        'execSync', 'spawnSync', 'execFileSync'
+        'readFileSync',
+        'writeFileSync',
+        'appendFileSync',
+        'mkdirSync',
+        'readdirSync',
+        'statSync',
+        'existsSync',
+        'copyFileSync',
+        'renameSync',
+        'unlinkSync',
+        'rmdirSync',
+        'accessSync',
+        'execSync',
+        'spawnSync',
+        'execFileSync',
     ];
     const lines = stripped.split('\n');
     let insideAsync = false;
@@ -251,7 +417,6 @@ const detectSyncIOInAsync = (_source, stripped, lang, findings) => {
     let braceDepth = 0;
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
-        // Detect async function/method/arrow entry
         if (/\basync\s+(function\b|\w+\s*\(|(\w+)\s*=>|\(.*\)\s*=>)/.test(line) || /\basync\s+\w+\s*\(/.test(line)) {
             insideAsync = true;
             asyncBraceDepth = braceDepth;
@@ -309,7 +474,6 @@ const detectSpreadInLoops = (_source, stripped, lang, findings) => {
             }
         }
         if (loopDepth > 0 && /\.\.\.[\w$]/.test(line)) {
-            // Ignore rest parameters in function definitions: function(...args) or (...args) =>
             if (!/function\s*\([^)]*\.\.\.[\w$]/.test(line) && !/\([^)]*\.\.\.[\w$][^)]*\)\s*=>/.test(line)) {
                 findings.push({
                     severity: 'WARNING',
@@ -327,21 +491,17 @@ const detectMissingCleanup = (source, stripped, lang, findings) => {
     if (lang !== 'js' && lang !== 'python')
         return;
     if (lang === 'js') {
-        // Look for createReadStream/createWriteStream/createServer assigned to a variable
         const pattern = /\b(const|let|var)\s+(\w+)\s*=\s*.*\b(createReadStream|createWriteStream|createServer|createConnection|net\.connect|tls\.connect)\b/g;
         let match;
         while ((match = pattern.exec(stripped)) !== null) {
             const varName = match[2];
             const creator = match[3];
             const line = getLineNumber(stripped, match.index);
-            // Check if .close(), .destroy(), .end(), or .disconnect() is called on this variable
-            // within a reasonable scope (the rest of the file)
             const rest = stripped.substring(match.index);
             const hasCleanup = rest.includes(`${varName}.close()`) ||
                 rest.includes(`${varName}.destroy()`) ||
                 rest.includes(`${varName}.end()`) ||
                 rest.includes(`${varName}.disconnect()`) ||
-                // Also accept piping (which handles cleanup) or 'using' declarations
                 rest.includes(`${varName}.pipe(`) ||
                 stripped.includes(`using ${varName}`);
             if (!hasCleanup) {
@@ -356,11 +516,9 @@ const detectMissingCleanup = (source, stripped, lang, findings) => {
         }
     }
     if (lang === 'python') {
-        // Detect open() not inside a 'with' statement
         const lines = stripped.split('\n');
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i];
-            // Match: var = open(...) but NOT: with open(...) as var
             if (/=\s*open\s*\(/.test(line) && !/\bwith\b/.test(line)) {
                 findings.push({
                     severity: 'WARNING',
@@ -379,7 +537,6 @@ const detectDangerousEval = (_source, stripped, lang, findings) => {
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
         if (lang === 'js') {
-            // Match eval(...) but not .addEventListener('...', eval)
             if (/\beval\s*\(/.test(line)) {
                 findings.push({
                     severity: 'ERROR',
@@ -444,14 +601,10 @@ const detectUnsafeJsonParse = (_source, stripped, lang, findings) => {
                     insideAsync = false;
             }
         }
-        // Detect JSON.parse(req.body) / JSON.parse(body) / JSON.parse(data) etc.
-        // in what appears to be a request handler context
         if (/JSON\.parse\s*\(/.test(line)) {
-            // Check if this is inside a try block — if so, it's handled
             const prevLines = lines.slice(Math.max(0, i - 5), i).join('\n');
             if (/\btry\s*\{/.test(prevLines))
                 continue;
-            // Check if the argument looks like an external input
             const argMatch = line.match(/JSON\.parse\s*\(\s*(\w+)/);
             if (argMatch) {
                 const argName = argMatch[1].toLowerCase();
@@ -475,13 +628,9 @@ const detectUnboundedFetch = (_source, stripped, lang, findings) => {
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
         if (lang === 'js') {
-            // Detect .find() / .findMany() / .select() / .query() without .limit() / .take() / .paginate()
-            // Common in Prisma, Mongoose, Knex, Sequelize. Uses negative lookahead to ignore array methods like .find(x => ...) or .find(function(...) ...)
             if (/\.(find|findMany|findAll|select|query)\s*\(\s*(?!(\w+|\([^)]*\))\s*=>|function\b)/.test(line)) {
-                // Look ahead a few lines for a .limit() / .take() / .skip() / .paginate() / .first()
                 const window = lines.slice(i, Math.min(i + 5, lines.length)).join('\n');
-                if (!/\.(limit|take|first|paginate|skip|offset|top)\s*\(/.test(window) &&
-                    !/\bLIMIT\b/i.test(window)) {
+                if (!/\.(limit|take|first|paginate|skip|offset|top)\s*\(/.test(window) && !/\bLIMIT\b/i.test(window)) {
                     findings.push({
                         severity: 'WARNING',
                         code: 'PERF-008',
@@ -493,7 +642,6 @@ const detectUnboundedFetch = (_source, stripped, lang, findings) => {
             }
         }
         if (lang === 'python') {
-            // Detect .all() / .filter() on Django/SQLAlchemy querysets without [:N] or .limit()
             if (/\.(all|filter|objects\.filter|objects\.all)\s*\(/.test(line)) {
                 const window = lines.slice(i, Math.min(i + 5, lines.length)).join('\n');
                 if (!/\.(limit|first|paginate|count)\s*\(/.test(window) &&
@@ -512,8 +660,7 @@ const detectUnboundedFetch = (_source, stripped, lang, findings) => {
         if (lang === 'php') {
             if (/\.(all|get|findAll|query)\s*\(|::all\s*\(/.test(line)) {
                 const window = lines.slice(i, Math.min(i + 5, lines.length)).join('\n');
-                if (!/\.(limit|take|paginate|offset)\s*\(/.test(window) &&
-                    !/\bLIMIT\b/i.test(window)) {
+                if (!/\.(limit|take|paginate|offset)\s*\(/.test(window) && !/\bLIMIT\b/i.test(window)) {
                     findings.push({
                         severity: 'WARNING',
                         code: 'PERF-008',
@@ -524,10 +671,36 @@ const detectUnboundedFetch = (_source, stripped, lang, findings) => {
                 }
             }
         }
-        // Go / Rust: detect SQL queries without LIMIT
-        if (lang === 'go' || lang === 'rust') {
+        if (lang === 'ruby') {
+            if (/\.(all|where)\b/.test(line) && !/\.(limit|find_each|first|take|paginate)\b/.test(line)) {
+                const window = lines.slice(i, Math.min(i + 5, lines.length)).join('\n');
+                if (!/\.(limit|find_each|first|take|paginate)\b/.test(window) && !/\bLIMIT\b/i.test(window)) {
+                    findings.push({
+                        severity: 'WARNING',
+                        code: 'PERF-008',
+                        line: i + 1,
+                        message: 'ActiveRecord query without .limit() or .find_each — may fetch unbounded rows into memory.',
+                        suggestion: 'Add .limit(N) or use .find_each for batch processing.',
+                    });
+                }
+            }
+        }
+        if (lang === 'csharp' || lang === 'java') {
+            if (/\.(ToList|ToArray|findAll|Query)\s*\(/.test(line)) {
+                const window = lines.slice(i, Math.min(i + 5, lines.length)).join('\n');
+                if (!/\.(Take|Limit|Page|FirstOrDefault)\s*\(/.test(window) && !/\bLIMIT\b/i.test(window)) {
+                    findings.push({
+                        severity: 'WARNING',
+                        code: 'PERF-008',
+                        line: i + 1,
+                        message: 'ORM/Collection query materialization without Take/Limit — may load entire dataset into memory.',
+                        suggestion: 'Apply .Take(N) or pagination before calling materialization methods.',
+                    });
+                }
+            }
+        }
+        if (lang === 'go' || lang === 'rust' || lang === 'cpp') {
             if (/SELECT\s+/i.test(line) && !/\bLIMIT\b/i.test(line)) {
-                // Look ahead for LIMIT on subsequent lines
                 const window = lines.slice(i, Math.min(i + 5, lines.length)).join('\n');
                 if (!/\bLIMIT\b/i.test(window)) {
                     findings.push({
@@ -570,7 +743,6 @@ const detectPhpInLoopOperations = (_source, stripped, lang, findings) => {
             }
         }
         if (loopDepth > 0) {
-            // PERF-PHP1: array_merge
             if (/\barray_merge\s*\(/.test(line)) {
                 findings.push({
                     severity: 'WARNING',
@@ -580,7 +752,6 @@ const detectPhpInLoopOperations = (_source, stripped, lang, findings) => {
                     suggestion: 'Append to array with $arr[] = $val and merge once outside the loop, or use the splat operator.',
                 });
             }
-            // PERF-PHP2: N+1 queries
             if (/(->get\(|->find\(|->query\(|->findAll\(|::find\(|DB::|->execute\()/.test(line)) {
                 findings.push({
                     severity: 'WARNING',
@@ -590,7 +761,6 @@ const detectPhpInLoopOperations = (_source, stripped, lang, findings) => {
                     suggestion: 'Pre-fetch data outside the loop using eager loading (e.g., with()) or a single IN() query.',
                 });
             }
-            // PERF-PHP3: Blocking I/O
             if (/\b(file_get_contents|curl_exec|fopen)\s*\(/.test(line)) {
                 findings.push({
                     severity: 'WARNING',
@@ -612,12 +782,20 @@ const detectSequentialAwait = (_source, stripped, lang, findings) => {
     let braceDepth = 0;
     let inLoop = false;
     let loopBraceStart = 0;
+    let isPaginationOrRetryLoop = false;
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
-        if ((/\b(for|while|do)\s*[\s(]/.test(line) || /\.(forEach|map|filter|reduce)\s*\(/.test(line)) && !inLoop) {
+        const isLoopHeader = /\b(for|while|do)\s*[\s(]/.test(line) || /\.(forEach|map|filter|reduce)\s*\(/.test(line);
+        if (isLoopHeader && !inLoop) {
             inLoop = true;
             loopBraceStart = braceDepth;
             loopDepth++;
+            if (/\b(cursor|hasMore|nextPage|hasNext|page|retry|attempt|backoff)\b/i.test(line)) {
+                isPaginationOrRetryLoop = true;
+            }
+            else {
+                isPaginationOrRetryLoop = false;
+            }
         }
         for (const ch of line) {
             if (ch === '{')
@@ -627,10 +805,27 @@ const detectSequentialAwait = (_source, stripped, lang, findings) => {
                 if (inLoop && braceDepth <= loopBraceStart) {
                     inLoop = false;
                     loopDepth--;
+                    isPaginationOrRetryLoop = false;
                 }
             }
         }
         if (loopDepth > 0 && /\bawait\s+/.test(line)) {
+            // Context-aware heuristic 1: Concurrent execution patterns
+            if (/\bawait\s+Promise\.(all|allSettled|race|any)\b/.test(line))
+                continue;
+            // Context-aware heuristic 2: Delays / sleep / retries
+            if (/\bawait\s+(delay|sleep|wait|pause|setTimeout)\b/i.test(line) ||
+                /\bawait\s+new\s+Promise\s*\(\s*\(?resolve\)?\s*=>\s*setTimeout/.test(line)) {
+                continue;
+            }
+            // Context-aware heuristic 3: Cursor/pagination or retry loop body
+            if (isPaginationOrRetryLoop || /\b(cursor|hasMore|nextPage|hasNext|page|token)\b/i.test(line)) {
+                continue;
+            }
+            // Context-aware heuristic 4: Stream/reader consumption
+            if (/\b(reader\.read|stream|readline|rl|iterator\.next|gen\.next)\b/i.test(line)) {
+                continue;
+            }
             findings.push({
                 severity: 'WARNING',
                 code: 'PERF-009',
@@ -757,12 +952,12 @@ const detectPythonInLoopOperations = (_source, stripped, lang, findings) => {
             continue;
         }
         if (inLoop && indent > outerIndent) {
-            if (/^\s*[a-zA-Z_]\w*\s*\+=\s*['"]/.test(line)) {
+            if (/\b[a-zA-Z_]\w*\s*\+=/.test(line)) {
                 findings.push({
                     severity: 'WARNING',
                     code: 'PERF-PY1',
                     line: i + 1,
-                    message: 'String concatenation (+=) inside a loop — Python strings are immutable, causing O(n²) memory allocations.',
+                    message: 'String/collection concatenation (+=) inside a loop — Python strings are immutable, causing O(n²) memory allocations.',
                     suggestion: 'Append to a list and use "".join() outside the loop instead.',
                 });
             }
@@ -815,7 +1010,7 @@ const detectGoInLoopOperations = (_source, stripped, lang, findings) => {
                     suggestion: 'Wrap the loop body in an anonymous function (func() { ... }()) or close resources manually.',
                 });
             }
-            if (/\b[a-zA-Z_]\w*\s*\+=\s*["`]/.test(line)) {
+            if (/\b[a-zA-Z_]\w*\s*\+=/.test(line)) {
                 findings.push({
                     severity: 'WARNING',
                     code: 'PERF-GO2',
@@ -876,6 +1071,268 @@ const detectRustInLoopOperations = (_source, stripped, lang, findings) => {
         }
     }
 };
+// ── PERF-CS1/2/3: C# Specific Loop Operations ──────────────────────────
+const detectCsharpInLoopOperations = (source, stripped, lang, findings) => {
+    if (lang !== 'csharp')
+        return;
+    const lines = stripped.split('\n');
+    const rawLines = source.split('\n');
+    let loopDepth = 0;
+    let braceDepth = 0;
+    let inLoop = false;
+    let loopBraceStart = 0;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const rawLine = rawLines[i];
+        if (/\b(for|foreach|while|do)\s*[\s(]/.test(line) && !inLoop) {
+            inLoop = true;
+            loopBraceStart = braceDepth;
+            loopDepth++;
+        }
+        for (const ch of line) {
+            if (ch === '{')
+                braceDepth++;
+            else if (ch === '}') {
+                braceDepth--;
+                if (inLoop && braceDepth <= loopBraceStart) {
+                    inLoop = false;
+                    loopDepth--;
+                }
+            }
+        }
+        if (loopDepth > 0) {
+            // PERF-CS1: LINQ in loop
+            if (/\.(Where|Select|ToList|ToArray|FirstOrDefault|Count)\s*\(/.test(line)) {
+                findings.push({
+                    severity: 'WARNING',
+                    code: 'PERF-CS1',
+                    line: i + 1,
+                    message: 'LINQ query method inside loop — allocates delegates and iterators on every iteration.',
+                    suggestion: 'Pre-compute or pull LINQ queries outside the loop.',
+                });
+            }
+            // PERF-CS2: String concatenation in loop
+            if (/\b[a-zA-Z_]\w*\s*\+=/.test(line)) {
+                findings.push({
+                    severity: 'WARNING',
+                    code: 'PERF-CS2',
+                    line: i + 1,
+                    message: 'String concatenation (+=) inside loop — allocates new string objects repeatedly.',
+                    suggestion: 'Use System.Text.StringBuilder for efficient string construction.',
+                });
+            }
+        }
+        // PERF-CS3: Sync-over-async blocking
+        if (/\.(Result|Wait\(\)|GetAwaiter\(\)\.GetResult\(\))/.test(rawLine)) {
+            findings.push({
+                severity: 'ERROR',
+                code: 'PERF-CS3',
+                line: i + 1,
+                message: 'Sync-over-async blocking (.Result / .Wait()) — causes threadpool starvation and potential deadlocks.',
+                suggestion: 'Use await instead of synchronous blocking on Task objects.',
+            });
+        }
+    }
+};
+// ── PERF-JV1/2/3: Java Specific Loop Operations ────────────────────────
+const detectJavaInLoopOperations = (source, stripped, lang, findings) => {
+    if (lang !== 'java')
+        return;
+    const lines = stripped.split('\n');
+    const rawLines = source.split('\n');
+    let loopDepth = 0;
+    let braceDepth = 0;
+    let inLoop = false;
+    let loopBraceStart = 0;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const rawLine = rawLines[i];
+        if (/\b(for|while|do)\s*[\s(]/.test(line) && !inLoop) {
+            inLoop = true;
+            loopBraceStart = braceDepth;
+            loopDepth++;
+        }
+        for (const ch of line) {
+            if (ch === '{')
+                braceDepth++;
+            else if (ch === '}') {
+                braceDepth--;
+                if (inLoop && braceDepth <= loopBraceStart) {
+                    inLoop = false;
+                    loopDepth--;
+                }
+            }
+        }
+        if (loopDepth > 0) {
+            // PERF-JV1: String concat in loop
+            if (/\b[a-zA-Z_]\w*\s*\+=/.test(line)) {
+                findings.push({
+                    severity: 'WARNING',
+                    code: 'PERF-JV1',
+                    line: i + 1,
+                    message: 'String concatenation (+=) inside loop — allocates intermediate String and StringBuilder instances.',
+                    suggestion: 'Use StringBuilder explicitly outside the loop.',
+                });
+            }
+            // PERF-JV3: Expensive object instantiations in loop
+            if (/\bnew\s+(SimpleDateFormat|DecimalFormat|Pattern|BigInteger|BigDecimal)\b/.test(rawLine) ||
+                /\bPattern\.compile\s*\(/.test(line)) {
+                findings.push({
+                    severity: 'WARNING',
+                    code: 'PERF-JV3',
+                    line: i + 1,
+                    message: 'Heavy object instantiation / Pattern compilation inside loop.',
+                    suggestion: 'Extract formatter / pattern instances outside the loop or reuse thread-safe / static instances.',
+                });
+            }
+        }
+        // PERF-JV2: System.gc() call
+        if (/\bSystem\.gc\s*\(\s*\)/.test(line)) {
+            findings.push({
+                severity: 'WARNING',
+                code: 'PERF-JV2',
+                line: i + 1,
+                message: 'Explicit System.gc() invocation — triggers full stop-the-world Garbage Collection.',
+                suggestion: 'Avoid explicit GC calls and let the JVM manage memory automatically.',
+            });
+        }
+    }
+};
+// ── PERF-CPP1/2/3: C++ Specific Loop Operations ────────────────────────
+const detectCppInLoopOperations = (source, stripped, lang, findings) => {
+    if (lang !== 'cpp')
+        return;
+    const lines = stripped.split('\n');
+    const rawLines = source.split('\n');
+    let loopDepth = 0;
+    let braceDepth = 0;
+    let inLoop = false;
+    let loopBraceStart = 0;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const rawLine = rawLines[i];
+        if (/\bfor\s*\(\s*(auto|[a-zA-Z_]\w*(?:::[a-zA-Z_]\w*)*)\s+([a-zA-Z_]\w*)\s*:\s*/.test(line)) {
+            const match = line.match(/\bfor\s*\(\s*(const\s+)?(auto|[a-zA-Z_]\w*(?:::[a-zA-Z_]\w*)*)\s*(&)?\s*([a-zA-Z_]\w*)\s*:\s*/);
+            if (match && !match[3]) {
+                const typeName = match[2];
+                const primitiveTypes = [
+                    'int',
+                    'char',
+                    'bool',
+                    'float',
+                    'double',
+                    'size_t',
+                    'long',
+                    'short',
+                    'uint32_t',
+                    'int32_t',
+                ];
+                if (!primitiveTypes.includes(typeName)) {
+                    findings.push({
+                        severity: 'WARNING',
+                        code: 'PERF-CPP1',
+                        line: i + 1,
+                        message: 'Range-based for loop element copied by value — triggers copy constructor for non-primitive types.',
+                        suggestion: 'Use const auto& or auto& to pass loop elements by reference.',
+                    });
+                }
+            }
+        }
+        if (/\b(for|while|do)\s*[\s(]/.test(line) && !inLoop) {
+            inLoop = true;
+            loopBraceStart = braceDepth;
+            loopDepth++;
+        }
+        for (const ch of line) {
+            if (ch === '{')
+                braceDepth++;
+            else if (ch === '}') {
+                braceDepth--;
+                if (inLoop && braceDepth <= loopBraceStart) {
+                    inLoop = false;
+                    loopDepth--;
+                }
+            }
+        }
+        if (loopDepth > 0) {
+            // PERF-CPP2: std::endl inside loop
+            if (/\bstd::endl\b/.test(rawLine)) {
+                findings.push({
+                    severity: 'WARNING',
+                    code: 'PERF-CPP2',
+                    line: i + 1,
+                    message: 'std::endl used inside loop — forces stream buffer flushing on every iteration.',
+                    suggestion: "Use '\\n' instead of std::endl to avoid frequent I/O flushing.",
+                });
+            }
+            // PERF-CPP3: std::regex inside loop
+            if (/\bstd::regex\b/.test(line)) {
+                findings.push({
+                    severity: 'WARNING',
+                    code: 'PERF-CPP3',
+                    line: i + 1,
+                    message: 'std::regex compilation inside loop — C++ regex construction is extremely heavy.',
+                    suggestion: 'Construct std::regex objects once outside the loop.',
+                });
+            }
+        }
+    }
+};
+// ── PERF-RB1/2/3: Ruby Specific Loop Operations ────────────────────────
+const detectRubyInLoopOperations = (source, stripped, lang, findings) => {
+    if (lang !== 'ruby')
+        return;
+    const lines = stripped.split('\n');
+    let inLoop = false;
+    let outerIndent = -1;
+    const loopPattern = /\b(while|until|for)\b|\.(each|times|map|select|loop)\b/;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (line.trim() === '')
+            continue;
+        const indent = line.search(/\S/);
+        if (inLoop && indent <= outerIndent && /^\s*(end|\}|\))\b/.test(line)) {
+            inLoop = false;
+        }
+        // PERF-RB3: Chained Enumerable methods
+        if (/\.(map|select|reject|compact)\b[^.\n]*\.(map|select|reject|compact)\b/.test(line)) {
+            findings.push({
+                severity: 'WARNING',
+                code: 'PERF-RB3',
+                line: i + 1,
+                message: 'Chained Enumerable transformations — creates intermediate array allocations.',
+                suggestion: 'Use .lazy or combine transformations into a single pass.',
+            });
+        }
+        if (!inLoop && loopPattern.test(line)) {
+            inLoop = true;
+            outerIndent = indent;
+            continue;
+        }
+        if (inLoop && indent > outerIndent) {
+            // PERF-RB1: String concat += in loop
+            if (/\b[a-zA-Z_]\w*\s*\+=/.test(line)) {
+                findings.push({
+                    severity: 'WARNING',
+                    code: 'PERF-RB1',
+                    line: i + 1,
+                    message: 'String concatenation (+=) inside loop — creates intermediate string allocations.',
+                    suggestion: 'Use shovel operator << or string interpolation instead.',
+                });
+            }
+            // PERF-RB2: ActiveRecord N+1 query in loop
+            if (/\.(find|where|first|find_by)\b/.test(line)) {
+                findings.push({
+                    severity: 'WARNING',
+                    code: 'PERF-RB2',
+                    line: i + 1,
+                    message: 'Database query execution inside loop (N+1 query risk).',
+                    suggestion: 'Pre-fetch records outside loop using .includes() or bulk query.',
+                });
+            }
+        }
+    }
+};
 // ─── Rule Registry ───────────────────────────────────────────────────
 const ALL_RULES = [
     detectNestedLoops,
@@ -894,6 +1351,10 @@ const ALL_RULES = [
     detectPythonInLoopOperations,
     detectGoInLoopOperations,
     detectRustInLoopOperations,
+    detectCsharpInLoopOperations,
+    detectJavaInLoopOperations,
+    detectCppInLoopOperations,
+    detectRubyInLoopOperations,
 ];
 // ─── Supported Extensions for Auditing ───────────────────────────────
 const AUDITABLE_EXTENSIONS = new Set(Object.keys(EXTENSION_MAP));
@@ -907,10 +1368,7 @@ export function isAuditableFile(filePath) {
 /**
  * Scans source code for performance anti-patterns using language-aware
  * regex-based heuristics. Returns structured findings grouped by severity.
- *
- * This function is designed to be called inline during the verification
- * phase — it's synchronous, zero-dependency, and executes in <50ms on
- * files up to 10,000 lines.
+ * Supports comment suppression directives (perf-ignore).
  *
  * @param content - The raw source code string to audit.
  * @param filePath - The file path (used for language detection via extension).
@@ -918,15 +1376,17 @@ export function isAuditableFile(filePath) {
  */
 export function auditFilePerformance(content, filePath) {
     const lang = detectLanguage(filePath);
-    const findings = [];
     if (lang === 'unknown') {
         return { filePath, findings: [], errors: [], warnings: [], infos: [] };
     }
     // Strip strings and comments to avoid false positives
     const stripped = stripStringsAndComments(content, lang);
+    let findings = [];
     for (const rule of ALL_RULES) {
         rule(content, stripped, lang, findings);
     }
+    // Filter out findings suppressed by perf-ignore comment directives
+    findings = applyDirectiveSuppression(findings, content);
     // Sort by severity (ERROR first), then by line number
     const severityOrder = { ERROR: 0, WARNING: 1, INFO: 2 };
     findings.sort((a, b) => {
@@ -948,21 +1408,17 @@ const SEVERITY_ICONS = {
     INFO: '🔵',
 };
 /**
- * Formats audit findings for beautiful terminal display using picocolors.
- * Used for non-blocking warnings shown to the user after verification.
+ * Formats audit findings for terminal display using picocolors.
  */
 export function formatAuditForTerminal(results) {
     const allFindings = results.flatMap((r) => r.findings.map((f) => ({ ...f, file: r.filePath })));
     if (allFindings.length === 0)
         return '';
-    const lines = [
-        pc.bold('Performance Audit Results'),
-        pc.dim('─'.repeat(50)),
-    ];
+    const lines = [pc.bold('Performance Audit Results'), pc.dim('─'.repeat(50))];
     for (const f of allFindings) {
         const icon = SEVERITY_ICONS[f.severity];
         const sevColor = f.severity === 'ERROR' ? pc.red : f.severity === 'WARNING' ? pc.yellow : pc.blue;
-        lines.push(`${icon} ${sevColor(f.severity)} ${pc.dim(`[${f.code}]`)} ${pc.cyan(f.file)}${pc.dim(`:${f.line}`)}`);
+        lines.push(`${icon} ${sevColor(f.severity)} ${pc.dim(`[${f.code}]`)} ${pc.cyan(`${f.file}:${f.line}`)}`);
         lines.push(`  ${f.message}`);
         lines.push(`  ${pc.dim('→')} ${pc.dim(f.suggestion)}`);
     }
@@ -977,16 +1433,12 @@ export function formatAuditForTerminal(results) {
 }
 /**
  * Formats audit findings into a structured prompt for the AI auto-correction loop.
- * Only includes ERROR-severity findings (warnings and info are non-blocking).
  */
 export function formatAuditForModel(results) {
     const errors = results.flatMap((r) => r.errors.map((f) => ({ ...f, file: r.filePath })));
     if (errors.length === 0)
         return '';
-    const lines = [
-        'The following performance anti-patterns were detected in your generated code:',
-        '',
-    ];
+    const lines = ['The following performance anti-patterns were detected in your generated code:', ''];
     for (const e of errors) {
         lines.push(`[${e.code}] ${e.file}:${e.line} — ${e.message}`);
         lines.push(`  Fix: ${e.suggestion}`);