AST flags, LLM judges: two halves of an audit pipeline

clone repo
  │
  ▼
AST stage                          ← cheap, deterministic
  ┌────────────────────────┐
  │ filter (gates)         │   rented linter signal, noise removed
  │ originate (detectors)  │   custom signal, cross-file
  └────────────────────────┘
  → candidates
  │
  ▼
LLM stage                          ← expensive, contextual
  per-file batched review
  per-detector prompt
  → confirm, fix, impact score

// receiver memoization
<Button onClick={() => x()} />        // harmless if Button is plain
<MemoButton onClick={() => x()} />    // same line, real problem
 
// list context
<Modal onClose={() => close()} />     // one closure, fine
arr.map(x => <Row onClick={() => …}/>)// N closures, real
 
// allocation size
<X options={{a: 1}} />                // constant bytes
<X items={[...all, ...more]} />       // could be 10k items
 
// server components
<Provider value={obj}>…</Provider>    // no client re-render → not a perf issue

// worker/src/eslint-bridge/gates.ts (excerpt)
 
const reactPerfGate = (finding, analysis, ctx) => {
  if (isUnambiguousServerComponent(finding.filePath, ctx.project, analysis)) {
    return false;
  }
 
  // Inline objects/arrays carry unbounded data. Keep; let LLM read.
  if (!FUNCTION_OR_JSX_RULES.has(finding.detectorName)) return true;
 
  // Inline functions/JSX are structurally small. They matter only when:
  //   (a) receiver is a Context.Provider
  //   (b) flag is inside .map/.flatMap/etc.
  const located = findInnermostAt(analysis.ast, finding.lineStart, col);
  if (!located) return true; // fail open
  const ancestors = [...located.ancestors, located.node];
  return isContextProviderReceiver(ancestors) || isInsideListRender(ancestors);
};

function isUnambiguousServerComponent(relPath, project, f) {
  if (!project.isNextProject || !project.hasAppRouter) return false;
  if (!relPath.startsWith("app/") && !relPath.startsWith("src/app/"))
    return false;
  if (f.hasUseServer) return true;
 
  const isDefinitelyClient =
    f.hasUseClient ||
    f.hasReactHookCall || // /^use[A-Z]/, excluding useId
    f.hasJsxEventHandler || // /^on[A-Z]/
    f.hasBrowserGlobal || // window/document/navigator/storage
    f.hasClassComponent ||
    f.hasClientOnlyImport;
  if (isDefinitelyClient) return false;
 
  return (
    f.hasServerOnlyImport ||
    f.hasNextServerImport || // next/headers, next/cookies, next/cache
    f.defaultExportIsAsync
  );
}

contexts.ts                       BookingForm.tsx
  const BookingCtx =                const { customer } = useContext(BookingCtx)
    createContext({                             ↑
      customer,    ─────────────────────────────┘
      session,
      cart,                       OrderSummary.tsx
      pricing,                      const { cart, pricing } = useContext(BookingCtx)
      shipping,
      taxes,                      ShippingStep.tsx
      promo,                        const { shipping } = useContext(BookingCtx)
      payment,
    })
 
  → 8 keys exposed, 3 consumers, avg usage ratio 0.17
  → split into BookingCustomerCtx, BookingCartCtx, BookingShippingCtx

// worker/src/technologies/react/detectors/context-overconsumption/detector.ts
 
if (totalKeys < 5) continue; // (a) too small to split
if (consumers.length < 3) continue; // (b) too few consumers
if (avgRatio >= 0.5) continue; // (c) consumers use most keys
 
// avgRatio = mean over consumers of (usedKeys ∩ exposedKeys) / totalKeys

// worker/src/shared/project-index.ts (excerpt)
 
const project = new Project({
  skipAddingFilesFromTsConfig: true,
  // Critical: without this, ts-morph follows imports into node_modules and
  // OOMs on @types/react alone. Symbol resolution still works for files we
  // explicitly add.
  skipFileDependencyResolution: true,
  skipLoadingLibFiles: true,
  compilerOptions: { allowJs: true, jsx: 1, moduleResolution: 100 },
});
 
// Walk the repo ourselves; never let ts-morph see node_modules/dist/.next.
for (const f of collectSourceFiles(workingDir)) {
  try {
    project.addSourceFileAtPath(f);
  } catch {
    /* skip unparseable */
  }
}
 
// Pass 1: every createContext call, indexed by its symbol id.
// Pass 2: every useContext call, resolve arg's symbol back to a Context.
//         Walk the bound result for destructure + member access to get usedKeys.

{
  "detectorName": "lumorem/react-context-overconsumption",
  "filePath": "src/contexts/booking.tsx",
  "lineStart": 14,
  "confidence": "high",
  "detectorMetadata": {
    "totalKeys": 8,
    "consumerCount": 3,
    "avgUsageRatio": 0.167,
    "exposedKeys": ["customer", "session", "cart", "pricing", …],
    "consumers": [
      { "file": "BookingForm.tsx",   "line": 22, "usedKeys": ["customer"] },
      { "file": "OrderSummary.tsx",  "line": 40, "usedKeys": ["cart","pricing"] },
      { "file": "ShippingStep.tsx",  "line": 18, "usedKeys": ["shipping"] }
    ]
  }
}

file content ────┐
                 │   ONE prompt cache hit per file
candidate 1 ─────┤   (anthropic prompt cache TTL = 5min, well above audit duration)
candidate 2 ─────┼──►  Claude returns verdicts: [{idx, confirmed, fix?}, …]
candidate N ─────┘

// worker/src/shared/llm-review.ts (excerpt)
 
const CHUNK_SIZE = 10;
// For a file with N candidates: ceil(N/10) calls, file content cached.

const PROMPT_REGISTRY: Record<string, string> = {
  [CONTEXT_OVERCONSUMPTION_DETECTOR]: CONTEXT_OVERCONSUMPTION_PROMPT,
};
 
function selectSystemPrompt(candidates) {
  const first = candidates[0].detectorName;
  const allSame = candidates.every((c) => c.detectorName === first);
  if (!allSame) return SYSTEM_PROMPT; // mixed chunk → generic
  return PROMPT_REGISTRY[first] ?? SYSTEM_PROMPT; // single detector → tailored
}

// worker/src/technologies/react/manifest.ts
 
export const reactManifest: TechnologyManifest = {
  name: "react",
  extends: [], // (inheritance e.g. nextjs → react is deferred)
  appliesTo, // package.json has "react" dep
  detectors: [{ name: DETECTOR_NAME, detect }],
};