@docker-doctor/cli 0.4.1 → 0.4.3

package/dist/{src-DHveWSuN.mjs → src-TK9DRoRo.mjs}

@@ -4,7 +4,7 @@ import path from "node:path";
 import { parse } from "yaml";
 
 //#region package.json
-var version = "0.4.1";
+var version = "0.4.3";
 
 //#endregion
 //#region ../core/src/project-info/discover.ts
@@ -31,9 +31,9 @@ const discoverProject = async (rootDir) => {
 		if (base === "docker-compose.yml" || base === "docker-compose.yaml" || base === "compose.yml" || base === "compose.yaml" || (base.startsWith("docker-compose.") || base.startsWith("compose.")) && (base.endsWith(".yml") || base.endsWith(".yaml"))) composeFiles.push(path.relative(rootDir, file));
 	}
 	return {
-		composeFiles,
-		dockerfiles,
-		dockerignores
+		composeFiles: composeFiles.toSorted(),
+		dockerfiles: dockerfiles.toSorted(),
+		dockerignores: dockerignores.toSorted()
 	};
 };
 
@@ -59,8 +59,13 @@ const DOCKERFILE_KEYWORDS = /* @__PURE__ */ new Set([
 	"VOLUME",
 	"WORKDIR"
 ]);
+const HEREDOC_INSTRUCTIONS = /* @__PURE__ */ new Set([
+	"ADD",
+	"COPY",
+	"RUN"
+]);
 const INSTRUCTION_LINE_RE = /^(?<inst>[A-Za-z]+)\s+(?<args>.*)$/u;
-const HEREDOC_OPENER_RE = /<<-?\s*(?<quote>['"]?)(?<delim>\w+)\k<quote>/gu;
+const HEREDOC_OPENER_RE = /(?<=^|\s)<<-?(?<quote>['"]?)(?<delim>\w+)\k<quote>/gu;
 const createParserState = () => ({
 	currentArgs: "",
 	currentInstruction: "",
@@ -114,7 +119,7 @@ const processInstructionLine = (state, trimmed, lineNum) => {
 			state.currentArgs = matched.args;
 		}
 	}
-	if (state.currentInstruction) state.heredocQueue.push(...findHeredocDelimiters(lineContent));
+	if (HEREDOC_INSTRUCTIONS.has(state.currentInstruction)) state.heredocQueue.push(...findHeredocDelimiters(lineContent));
 	if (state.heredocQueue.length > 0) return;
 	if (!hasContinuation) closeInstruction(state);
 };
@@ -160,7 +165,7 @@ var ParseError = class extends Error {
 //#region ../core/src/parsers/compose-parser.ts
 const parseCompose = (content, filepath) => {
 	try {
-		return parse(content);
+		return parse(content, { merge: true });
 	} catch (error) {
 		throw new ParseError({
 			file: filepath,
@@ -169,6 +174,79 @@ const parseCompose = (content, filepath) => {
 	}
 };
 
+//#endregion
+//#region ../core/src/parsers/exec-form.ts
+const parseExecForm = (args) => {
+	const trimmed = args.trim();
+	if (!trimmed.startsWith("[")) return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(trimmed);
+	} catch {
+		return null;
+	}
+	if (!Array.isArray(parsed)) return null;
+	if (!parsed.every((el) => typeof el === "string")) return null;
+	return parsed;
+};
+
+//#endregion
+//#region ../core/src/parsers/image-ref.ts
+const parseImageRef = (ref) => {
+	if (ref.includes("${") || ref.startsWith("$")) return {
+		isVariable: true,
+		name: ref
+	};
+	let remainder = ref;
+	let digest;
+	const atIndex = remainder.indexOf("@");
+	if (atIndex !== -1) {
+		digest = remainder.slice(atIndex + 1);
+		remainder = remainder.slice(0, atIndex);
+	}
+	let tag;
+	const lastColonIndex = remainder.lastIndexOf(":");
+	const lastSlashIndex = remainder.lastIndexOf("/");
+	if (lastColonIndex !== -1 && lastColonIndex > lastSlashIndex) {
+		tag = remainder.slice(lastColonIndex + 1);
+		remainder = remainder.slice(0, lastColonIndex);
+	}
+	let registry;
+	const firstSlashIndex = remainder.indexOf("/");
+	if (firstSlashIndex !== -1) {
+		const firstSegment = remainder.slice(0, firstSlashIndex);
+		if (firstSegment.includes(".") || firstSegment.includes(":") || firstSegment === "localhost") {
+			registry = firstSegment;
+			remainder = remainder.slice(firstSlashIndex + 1);
+		}
+	}
+	return {
+		digest,
+		isVariable: false,
+		name: remainder,
+		registry,
+		tag
+	};
+};
+const parseFromArgs = (args) => {
+	const parts = args.split(/\s+/u).filter(Boolean);
+	const asIndex = parts.findIndex((p) => p.toLowerCase() === "as");
+	return {
+		base: (asIndex === -1 ? parts : parts.slice(0, asIndex)).find((p) => !p.startsWith("--")) ?? null,
+		stage: asIndex === -1 ? null : parts[asIndex + 1] ?? null
+	};
+};
+const isScratch = (base) => base?.toLowerCase() === "scratch";
+const collectStageAliases = (instructions) => {
+	const aliases = /* @__PURE__ */ new Set();
+	for (const inst of instructions) {
+		if (inst.instruction !== "FROM") continue;
+		const { stage } = parseFromArgs(inst.args);
+		if (stage) aliases.add(stage.toLowerCase());
+	}
+	return aliases;
+};
+
 //#endregion
 //#region ../core/src/rules/best-practices.ts
 const createDiagnostic$4 = (file, ruleKey, severity, message, help, line) => ({
@@ -188,7 +266,7 @@ const requireHealthcheck = {
 		return [];
 	},
 	defaultSeverity: "info",
-	help: "Use HEALTHCHECK (e.g., 'HEALTHCHECK --interval=30s --timeout=3s CMD curl -f http://localhost/ || exit 1') so Docker can monitor the container's live status.",
+	help: "Use HEALTHCHECK (e.g., `HEALTHCHECK --interval=30s --timeout=3s CMD curl -f http://localhost/ || exit 1`) so Docker can monitor the container's live status.",
 	key: "docker-doctor/require-healthcheck",
 	message: "Add a HEALTHCHECK instruction"
 };
@@ -214,14 +292,11 @@ const useExecForm = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT") {
-			const args = inst.args.trim();
-			if (!args.startsWith("[") || !args.endsWith("]")) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `${inst.instruction} instruction uses shell form instead of exec form. In shell form, the command runs under '/bin/sh -c', which does not pass signals to child processes.`, this.help, inst.line));
-		}
+		for (const inst of instructions) if ((inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT") && parseExecForm(inst.args) === null) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `${inst.instruction} instruction uses shell form instead of exec form. In shell form, the command runs under '/bin/sh -c', which does not pass signals to child processes.`, this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Write CMD/ENTRYPOINT instructions as JSON arrays (e.g. ENTRYPOINT [\"node\", \"index.js\"]) so OS signals (like SIGTERM) are forwarded correctly.",
+	help: "Write CMD/ENTRYPOINT instructions as JSON arrays (e.g. `ENTRYPOINT [\"node\", \"index.js\"]`) so OS signals (like SIGTERM) are forwarded correctly.",
 	key: "docker-doctor/use-exec-form",
 	message: "Use exec form for CMD and ENTRYPOINT"
 };
@@ -232,7 +307,7 @@ const requireLabels = {
 		return [];
 	},
 	defaultSeverity: "info",
-	help: "Use LABEL instructions (e.g. LABEL org.opencontainers.image.authors=\"...\") to document ownership, license, version, and build info.",
+	help: "Use LABEL instructions (e.g. `LABEL org.opencontainers.image.authors=\"...\"`) to document ownership, license, version, and build info.",
 	key: "docker-doctor/require-labels",
 	message: "Add LABEL metadata to images"
 };
@@ -249,22 +324,47 @@ const combineAptUpdateInstall = {
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Combine 'apt-get update' and 'apt-get install' in the same RUN instruction (e.g. 'RUN apt-get update && apt-get install -y --no-install-recommends <package> && rm -rf /var/lib/apt/lists/*').",
+	help: "Combine `apt-get update` and `apt-get install` in the same RUN instruction (e.g. `RUN apt-get update && apt-get install -y --no-install-recommends <package> && rm -rf /var/lib/apt/lists/*`).",
 	key: "docker-doctor/combine-apt-update-install",
 	message: "Combine apt-get update and apt-get install"
 };
+const PIPEFAIL_SETTING_RE = /(?:^|\s)-[A-Za-z]*o\s+pipefail\b/u;
+const HAS_PIPE_RE = /(?<!\|)\|(?!\|)/u;
+const shellDirectiveEnablesPipefail = (args) => {
+	const argv = parseExecForm(args);
+	return argv !== null && PIPEFAIL_SETTING_RE.test(argv.join(" "));
+};
 const usePipefail = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN") {
-			const { raw } = inst;
-			if (/(?<!\|)\|(?!\|)/u.test(raw) && !raw.includes("pipefail")) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.", this.help, inst.line));
+		const stagePipefail = /* @__PURE__ */ new Map();
+		let shellHasPipefail = false;
+		let currentStage = null;
+		for (const inst of instructions) {
+			if (inst.instruction === "FROM") {
+				const { base, stage } = parseFromArgs(inst.args);
+				const parentStage = isScratch(base) ? null : base?.toLowerCase() ?? null;
+				shellHasPipefail = parentStage !== null && stagePipefail.get(parentStage) === true;
+				currentStage = stage?.toLowerCase() ?? null;
+				if (currentStage) stagePipefail.set(currentStage, shellHasPipefail);
+				continue;
+			}
+			if (inst.instruction === "SHELL") {
+				shellHasPipefail = shellDirectiveEnablesPipefail(inst.args);
+				if (currentStage) stagePipefail.set(currentStage, shellHasPipefail);
+				continue;
+			}
+			if (inst.instruction !== "RUN") continue;
+			const { args } = inst;
+			if (!HAS_PIPE_RE.test(args)) continue;
+			const execArgv = parseExecForm(args);
+			if (!(execArgv === null ? shellHasPipefail || PIPEFAIL_SETTING_RE.test(args) : PIPEFAIL_SETTING_RE.test(execArgv.join(" ")))) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.", this.help, inst.line));
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Prepend 'set -o pipefail &&' to pipe commands, or use exec form with a shell that supports it (e.g., RUN ['/bin/bash', '-c', 'set -o pipefail && ...']).",
+	help: "Prepend `set -o pipefail &&` to pipe commands, use exec form with a shell that supports it (e.g., `RUN [\"/bin/bash\", \"-c\", \"set -o pipefail && ...\"]`), or set `SHELL [\"/bin/bash\", \"-o\", \"pipefail\", \"-c\"]` at the top of the stage.",
 	key: "docker-doctor/use-pipefail",
 	message: "Use pipefail to catch pipeline command failures"
 };
@@ -279,7 +379,7 @@ const absoluteWorkdir = {
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Always specify absolute paths for WORKDIR instructions (e.g. WORKDIR /app).",
+	help: "Always specify absolute paths for WORKDIR instructions (e.g. `WORKDIR /app`).",
 	key: "docker-doctor/absolute-workdir",
 	message: "Use absolute paths for WORKDIR"
 };
@@ -291,7 +391,7 @@ const avoidRunCd = {
 		return diagnostics;
 	},
 	defaultSeverity: "info",
-	help: "Use the WORKDIR instruction instead of 'cd' inside RUN to establish directory context.",
+	help: "Use the WORKDIR instruction instead of `cd` inside RUN to establish directory context.",
 	key: "docker-doctor/avoid-run-cd",
 	message: "Avoid changing directories with cd in RUN"
 };
@@ -326,7 +426,7 @@ const useraddNoLogInit = {
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Pass '--no-log-init' flag to useradd (e.g., 'RUN useradd --no-log-init -r -g mygroup myuser').",
+	help: "Pass `--no-log-init` flag to useradd (e.g., `RUN useradd --no-log-init -r -g mygroup myuser`).",
 	key: "docker-doctor/useradd-no-log-init",
 	message: "Use --no-log-init with useradd"
 };
@@ -359,9 +459,9 @@ const noVersionKey = {
 		return [];
 	},
 	defaultSeverity: "warning",
-	help: "The 'version' key is deprecated by the Compose specification. Omitting it defaults to the latest specification.",
+	help: "The `version` key is obsolete in the Compose specification. Omitting it defaults to the latest specification.",
 	key: "docker-doctor/no-version-key",
-	message: "Remove the 'version' key from Compose file"
+	message: "Remove the `version` key from the Compose file"
 };
 const requireResourceLimits = {
 	category: "Compose",
@@ -379,7 +479,7 @@ const requireResourceLimits = {
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Add resource limits (e.g. deploy.resources.limits) to prevent a single service from starving host resources in production.",
+	help: "Add resource limits (e.g. `deploy.resources.limits`) to prevent a single service from starving host resources in production.",
 	key: "docker-doctor/require-resource-limits",
 	message: "Define resource limits for services"
 };
@@ -400,7 +500,7 @@ const requireRestartPolicy = {
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Define 'restart: always' or 'restart: unless-stopped' (or deploy.restart_policy) so services restart on crashes or host reboot.",
+	help: "Define `restart: always` or `restart: unless-stopped` (or `deploy.restart_policy`) so services restart on crashes or host reboot.",
 	key: "docker-doctor/require-restart-policy",
 	message: "Set restart policy for services"
 };
@@ -420,7 +520,7 @@ const useDependsOnCondition = {
 		return diagnostics;
 	},
 	defaultSeverity: "info",
-	help: "Instead of a simple service list, use 'depends_on: { dependency: { condition: service_healthy } }' to ensure dependencies are fully ready before starting.",
+	help: "Instead of a simple service list, use `depends_on: { dependency: { condition: service_healthy } }` to ensure dependencies are fully ready before starting.",
 	key: "docker-doctor/use-depends-on-condition",
 	message: "Use long-form depends_on with healthcheck conditions"
 };
@@ -431,54 +531,6 @@ const composeRules = [
 	useDependsOnCondition
 ];
 
-//#endregion
-//#region ../core/src/parsers/image-ref.ts
-const parseImageRef = (ref) => {
-	if (ref.includes("${") || ref.startsWith("$")) return {
-		isVariable: true,
-		name: ref
-	};
-	let remainder = ref;
-	let digest;
-	const atIndex = remainder.indexOf("@");
-	if (atIndex !== -1) {
-		digest = remainder.slice(atIndex + 1);
-		remainder = remainder.slice(0, atIndex);
-	}
-	let tag;
-	const lastColonIndex = remainder.lastIndexOf(":");
-	const lastSlashIndex = remainder.lastIndexOf("/");
-	if (lastColonIndex !== -1 && lastColonIndex > lastSlashIndex) {
-		tag = remainder.slice(lastColonIndex + 1);
-		remainder = remainder.slice(0, lastColonIndex);
-	}
-	let registry;
-	const firstSlashIndex = remainder.indexOf("/");
-	if (firstSlashIndex !== -1) {
-		const firstSegment = remainder.slice(0, firstSlashIndex);
-		if (firstSegment.includes(".") || firstSegment.includes(":") || firstSegment === "localhost") {
-			registry = firstSegment;
-			remainder = remainder.slice(firstSlashIndex + 1);
-		}
-	}
-	return {
-		digest,
-		isVariable: false,
-		name: remainder,
-		registry,
-		tag
-	};
-};
-const collectStageAliases = (instructions) => {
-	const aliases = /* @__PURE__ */ new Set();
-	for (const inst of instructions) {
-		if (inst.instruction !== "FROM") continue;
-		const match = /\sas\s+(?<alias>\S+)/iu.exec(inst.args);
-		if (match?.groups?.alias) aliases.add(match.groups.alias.toLowerCase());
-	}
-	return aliases;
-};
-
 //#endregion
 //#region ../core/src/rules/image-size.ts
 const createDiagnostic$2 = (file, ruleKey, severity, message, help, line) => ({
@@ -495,21 +547,21 @@ const preferSlimBase = {
 		const diagnostics = [];
 		const stageAliases = collectStageAliases(instructions);
 		for (const inst of instructions) if (inst.instruction === "FROM") {
-			const imagePart = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
-			if (!imagePart || imagePart === "scratch") continue;
+			const imagePart = parseFromArgs(inst.args).base;
+			if (!imagePart || isScratch(imagePart)) continue;
 			const ref = parseImageRef(imagePart);
 			if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) continue;
 			if (ref.digest) continue;
 			if (!ref.tag) continue;
-			const tag = ref.tag.toLowerCase();
-			if (!(tag.includes("alpine") || tag.includes("slim") || tag.includes("distroless"))) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
+			const haystack = `${ref.name} ${ref.tag}`.toLowerCase();
+			if (!(haystack.includes("alpine") || haystack.includes("slim") || haystack.includes("distroless") || haystack.includes("busybox"))) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "info",
-	help: "Prefer tags with '-slim', '-alpine', or use distroless base images to minimize the default operating system footprint.",
+	help: "Prefer tags with `-slim`, `-alpine`, or use distroless base images to minimize the default operating system footprint.",
 	key: "docker-doctor/prefer-slim-base",
-	message: "Use slim, alpine, or distroless base images"
+	message: "Prefer slim, alpine, or distroless base images"
 };
 const cleanPackageCache = {
 	category: "Image Size",
@@ -523,34 +575,47 @@ const cleanPackageCache = {
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "For apt-get, append '&& rm -rf /var/lib/apt/lists/*'. For apk, use 'apk add --no-cache'. For dnf/yum, run 'yum clean all'.",
+	help: "For apt-get, append `&& rm -rf /var/lib/apt/lists/*`. For apk, use `apk add --no-cache`. For dnf/yum, run `yum clean all`.",
 	key: "docker-doctor/clean-package-cache",
 	message: "Clean up package manager cache in the same RUN layer"
 };
+const installsDevDependencies = (args) => (args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install")) && !args.includes("--production") && !args.includes("--omit=dev") && !args.includes("prune");
 const avoidDevDependencies = {
 	category: "Image Size",
 	check(instructions, file) {
 		const diagnostics = [];
-		let isLastStage = false;
-		let fromCount = 0;
-		for (const inst of instructions) if (inst.instruction === "FROM") fromCount += 1;
-		let currentStage = 0;
-		for (const inst of instructions) {
-			if (inst.instruction === "FROM") {
-				currentStage += 1;
-				isLastStage = currentStage === fromCount;
-			}
-			if (isLastStage && inst.instruction === "RUN") {
-				const { args } = inst;
-				if ((args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install")) && !args.includes("--production") && !args.includes("--omit=dev") && !args.includes("prune")) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' in the final stage without omitting devDependencies.`, this.help, inst.line));
+		const stages = [];
+		for (const inst of instructions) if (inst.instruction === "FROM") {
+			const { base, stage } = parseFromArgs(inst.args);
+			stages.push({
+				base: base?.toLowerCase() ?? "",
+				name: stage?.toLowerCase() ?? null,
+				runs: []
+			});
+		} else if (inst.instruction === "RUN" && stages.length > 0) stages.at(-1)?.runs.push(inst);
+		if (stages.length === 0) return diagnostics;
+		const auditedIndices = [];
+		let index = stages.length - 1;
+		while (index >= 0) {
+			auditedIndices.push(index);
+			const { base } = stages[index];
+			index = stages.slice(0, index).findIndex((s) => s.name !== null && s.name === base);
+		}
+		const finalIndex = stages.length - 1;
+		for (const stageIndex of auditedIndices.toReversed()) {
+			const stage = stages[stageIndex];
+			for (const inst of stage.runs) {
+				if (!installsDevDependencies(inst.args)) continue;
+				const where = stageIndex === finalIndex ? "in the final stage" : `in stage '${stage.name}', whose layers the final stage inherits,`;
+				diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' ${where} without omitting devDependencies.`, this.help, inst.line));
 			}
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "For Node.js, run 'npm prune --production' or install only production dependencies ('npm ci --omit=dev') in the runtime stage.",
+	help: "For Node.js, run `npm prune --production` or install only production dependencies (`npm ci --omit=dev`) in the runtime stage.",
 	key: "docker-doctor/avoid-dev-dependencies",
-	message: "Avoid installing development dependencies in final production stage"
+	message: "Avoid installing dev dependencies in the final stage"
 };
 const imageSizeRules = [
 	preferSlimBase,
@@ -579,7 +644,7 @@ const useMultiStage = {
 	defaultSeverity: "info",
 	help: "Use multi-stage builds (multiple FROM statements) to separate build dependencies from the runtime image and reduce size.",
 	key: "docker-doctor/use-multi-stage",
-	message: "Consider using multi-stage builds"
+	message: "Use multi-stage builds"
 };
 const orderLayers = {
 	category: "Performance",
@@ -623,10 +688,16 @@ const minimizeLayers = {
 		return diagnostics;
 	},
 	defaultSeverity: "info",
-	help: "Combine consecutive RUN instructions using '&&' and '\\' to reduce the total layer count and image size.",
+	help: "Combine consecutive RUN instructions using `&&` and `\\` to reduce the total layer count and image size.",
 	key: "docker-doctor/minimize-layers",
 	message: "Minimize the number of image layers"
 };
+const hasDockerignoreFor = (dockerfilePath, projectFiles) => {
+	const lastSlash = dockerfilePath.lastIndexOf("/");
+	const dir = lastSlash === -1 ? "" : dockerfilePath.slice(0, lastSlash);
+	const adjacent = dir === "" ? ".dockerignore" : `${dir}/.dockerignore`;
+	return projectFiles.some((f) => f === adjacent || f === ".dockerignore");
+};
 const useDockerignore = {
 	category: "Performance",
 	check(instructions, file, context) {
@@ -638,15 +709,13 @@ const useDockerignore = {
 				return src === "." || src === "./" || src === "*";
 			}
 			return false;
-		}) && context?.projectFiles) {
-			if (!context.projectFiles.some((f) => f.endsWith(".dockerignore"))) return [createDiagnostic$1(file, this.key, this.defaultSeverity, "Using COPY/ADD with wildcard/directory, but no .dockerignore file was found in the workspace. This can copy local build folders and secrets.", this.help, 1)];
-		}
+		}) && context?.projectFiles && !hasDockerignoreFor(file, context.projectFiles)) return [createDiagnostic$1(file, this.key, this.defaultSeverity, "Using COPY/ADD with a wildcard or directory, but no .dockerignore file was found next to the Dockerfile or at the project root. This can copy local build folders and secrets.", this.help, 1)];
 		return [];
 	},
 	defaultSeverity: "warning",
 	help: "Create a .dockerignore file in the same directory as the Dockerfile to prevent copying unnecessary files (like node_modules, logs, build artifacts).",
 	key: "docker-doctor/use-dockerignore",
-	message: "Ensure .dockerignore is used"
+	message: "Add a .dockerignore file"
 };
 const performanceRules = [
 	useMultiStage,
@@ -665,25 +734,35 @@ const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
 	rule: ruleKey,
 	severity
 });
+const isRootUser = (value) => {
+	const [user] = value.split(":");
+	return user === "root" || user === "0";
+};
 const noRootUser = {
 	category: "Security",
 	check(instructions, file) {
+		const stageUser = /* @__PURE__ */ new Map();
+		let currentStage = null;
 		let lastUser = "root";
 		let lastUserLine = 1;
 		for (const inst of instructions) if (inst.instruction === "FROM") {
-			lastUser = "root";
+			const { base, stage } = parseFromArgs(inst.args);
+			lastUser = stageUser.get(base?.toLowerCase() ?? "") ?? "root";
 			lastUserLine = inst.line;
+			currentStage = stage?.toLowerCase() ?? null;
+			if (currentStage) stageUser.set(currentStage, lastUser);
 		} else if (inst.instruction === "USER") {
 			lastUser = inst.args.trim().toLowerCase();
 			lastUserLine = inst.line;
+			if (currentStage) stageUser.set(currentStage, lastUser);
 		}
-		if (lastUser === "root" || lastUser === "0" || lastUser === "0:0") return [createDiagnostic(file, this.key, this.defaultSeverity, "The container runs as root. Running as root allows potential container breakout vulnerabilities.", this.help, lastUserLine)];
+		if (isRootUser(lastUser)) return [createDiagnostic(file, this.key, this.defaultSeverity, "The container runs as root. Running as root allows potential container breakout vulnerabilities.", this.help, lastUserLine)];
 		return [];
 	},
 	defaultSeverity: "warning",
-	help: "Add a non-root user (e.g., 'USER node' or 'USER 1000') to improve security.",
+	help: "Add a non-root user (e.g., `USER node` or `USER 1000`) to improve security.",
 	key: "docker-doctor/no-root-user",
-	message: "Container should not run as root user"
+	message: "Run the container as a non-root user"
 };
 const noSecretsInEnv = {
 	category: "Security",
@@ -724,7 +803,7 @@ const noSecretsInEnv = {
 	defaultSeverity: "error",
 	help: "Use Docker Secrets, build arguments passed at runtime, or environment variables at runtime instead of baking them into the image.",
 	key: "docker-doctor/no-secrets-in-env",
-	message: "Do not store secrets in ENV or ARG instructions"
+	message: "Avoid storing secrets in ENV or ARG instructions"
 };
 const pinImageVersion = {
 	category: "Security",
@@ -732,8 +811,8 @@ const pinImageVersion = {
 		const diagnostics = [];
 		const stageAliases = collectStageAliases(instructions);
 		for (const inst of instructions) if (inst.instruction === "FROM") {
-			const imagePart = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
-			if (!imagePart || imagePart === "scratch") continue;
+			const imagePart = parseFromArgs(inst.args).base;
+			if (!imagePart || isScratch(imagePart)) continue;
 			const ref = parseImageRef(imagePart);
 			if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) continue;
 			if (!(ref.tag || ref.digest)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' does not specify a tag. This makes builds non-deterministic.`, this.help, inst.line));
@@ -742,9 +821,9 @@ const pinImageVersion = {
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Specify a concrete tag instead of 'latest' or no tag (e.g., 'node:22.2.0-alpine' instead of 'node').",
+	help: "Specify a concrete tag instead of `latest` or no tag (e.g., `node:22.2.0-alpine` instead of `node`).",
 	key: "docker-doctor/pin-image-version",
-	message: "Always pin base image versions to specific tags"
+	message: "Pin base images to a specific tag or digest"
 };
 const noAddRemote = {
 	category: "Security",
@@ -758,7 +837,7 @@ const noAddRemote = {
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Use 'RUN curl' or 'RUN wget' instead of ADD for remote URLs, and delete the downloaded archive in the same layer to minimize size.",
+	help: "Use `RUN curl` or `RUN wget` instead of ADD for remote URLs, and delete the downloaded archive in the same layer to minimize size.",
 	key: "docker-doctor/no-add-remote",
 	message: "Avoid using ADD with remote URLs"
 };
@@ -781,15 +860,19 @@ const allComposeRules = [...composeRules];
 const allRules = [...allDockerfileRules, ...allComposeRules];
 const findRule = (key) => allRules.find((rule) => rule.key === key);
 
+//#endregion
+//#region ../core/src/runners/resolve-severity.ts
+const resolveSeverity = (rule, rulesConfig, categoriesConfig) => rulesConfig?.[rule.key] ?? categoriesConfig?.[rule.category] ?? rule.defaultSeverity;
+
 //#endregion
 //#region ../core/src/runners/dockerfile-runner.ts
-const runDockerfileRules = (instructions, file, projectFiles, rulesConfig) => {
+const runDockerfileRules = (instructions, file, projectFiles, rulesConfig, categoriesConfig) => {
 	const diagnostics = [];
 	for (const rule of allDockerfileRules) {
-		const configSeverity = rulesConfig?.[rule.key];
-		if (configSeverity === "off") continue;
+		const severity = resolveSeverity(rule, rulesConfig, categoriesConfig);
+		if (severity === "off") continue;
 		const ruleDiagnostics = rule.check(instructions, file, { projectFiles });
-		if (configSeverity) for (const diag of ruleDiagnostics) diag.severity = configSeverity;
+		if (severity !== rule.defaultSeverity) for (const diag of ruleDiagnostics) diag.severity = severity;
 		diagnostics.push(...ruleDiagnostics);
 	}
 	return diagnostics;
@@ -797,13 +880,13 @@ const runDockerfileRules = (instructions, file, projectFiles, rulesConfig) => {
 
 //#endregion
 //#region ../core/src/runners/compose-runner.ts
-const runComposeRules = (composeContent, file, rulesConfig) => {
+const runComposeRules = (composeContent, file, rulesConfig, categoriesConfig) => {
 	const diagnostics = [];
 	for (const rule of allComposeRules) {
-		const configSeverity = rulesConfig?.[rule.key];
-		if (configSeverity === "off") continue;
+		const severity = resolveSeverity(rule, rulesConfig, categoriesConfig);
+		if (severity === "off") continue;
 		const ruleDiagnostics = rule.check(composeContent, file);
-		if (configSeverity) for (const diag of ruleDiagnostics) diag.severity = configSeverity;
+		if (severity !== rule.defaultSeverity) for (const diag of ruleDiagnostics) diag.severity = severity;
 		diagnostics.push(...ruleDiagnostics);
 	}
 	return diagnostics;
@@ -871,6 +954,30 @@ const validateConfig = (input) => {
 	return result;
 };
 
+//#endregion
+//#region ../core/src/config/unknown-keys.ts
+const KNOWN_CATEGORIES = [
+	"Best Practices",
+	"Compose",
+	"Image Size",
+	"Performance",
+	"Security"
+];
+const keysOf = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? Object.keys(value) : [];
+const collectUnknownConfigKeys = (raw) => {
+	if (typeof raw !== "object" || raw === null) return {
+		categories: [],
+		rules: []
+	};
+	const knownRuleKeys = new Set(allRules.map((rule) => rule.key));
+	const knownCategories = new Set(KNOWN_CATEGORIES);
+	const { categories, rules } = raw;
+	return {
+		categories: keysOf(categories).filter((key) => !knownCategories.has(key)),
+		rules: keysOf(rules).filter((key) => !knownRuleKeys.has(key))
+	};
+};
+
 //#endregion
 //#region ../core/src/config/loader.ts
 const fileExists = async (filePath) => {
@@ -900,7 +1007,12 @@ const importConfig = async (filePath) => {
 		throw new ConfigError({ message: `Failed to load config file ${filePath}: ${msg}` });
 	}
 };
-const loadConfig = async (rootDir, customPath) => {
+const warnUnknownKeys = (raw, onWarning) => {
+	const unknown = collectUnknownConfigKeys(raw);
+	for (const key of unknown.rules) onWarning(`Unknown rule "${key}" in config — it matches no rule and has no effect.`);
+	for (const key of unknown.categories) onWarning(`Unknown category "${key}" in config — categories are case-sensitive (e.g. "Best Practices", "Security").`);
+};
+const loadConfig = async (rootDir, customPath, onWarning) => {
 	let configObject = null;
 	if (customPath) {
 		const fullPath = path.resolve(rootDir, customPath);
@@ -933,7 +1045,9 @@ const loadConfig = async (rootDir, customPath) => {
 	}
 	if (!configObject) return {};
 	try {
-		return validateConfig(configObject);
+		const config = validateConfig(configObject);
+		if (onWarning) warnUnknownKeys(configObject, onWarning);
+		return config;
 	} catch (error) {
 		const msg = error instanceof Error ? error.message : String(error);
 		throw new ConfigError({ message: `Invalid configuration format: ${msg}` });
@@ -1003,4 +1117,4 @@ const toJsonReport = (diagnostics, score, label, project) => ({
 
 //#endregion
 export { runDockerfileRules as a, parseCompose as c, version as d, runComposeRules as i, parseDockerfile as l, calculateScore as n, allRules as o, loadConfig as r, findRule as s, toJsonReport as t, discoverProject as u };
-//# sourceMappingURL=src-DHveWSuN.mjs.map
+//# sourceMappingURL=src-TK9DRoRo.mjs.map