@docker-doctor/cli 0.5.0 → 0.5.2

package/dist/index.d.cts

@@ -13,6 +13,7 @@ interface Diagnostic {
   severity: DiagnosticSeverity;
   message: string;
   help: string;
+  category?: RuleCategory;
   line?: number;
   column?: number;
 }
@@ -45,34 +46,34 @@ interface DockerDoctorConfig {
 }
 //#endregion
 //#region ../core/src/project-info/discover.d.ts
-declare const discoverProject: (rootDir: string, options?: {
+export declare const discoverProject: (rootDir: string, options?: {
   ignoreFiles?: readonly string[];
 }) => Promise<ProjectInfo>;
 //#endregion
 //#region ../core/src/parsers/dockerfile-parser.d.ts
-declare const parseDockerfile: (content: string) => DockerfileInstruction[];
+export declare const parseDockerfile: (content: string, file?: string) => DockerfileInstruction[];
 //#endregion
 //#region ../core/src/parsers/compose-parser.d.ts
-declare const parseCompose: (content: string, filepath: string) => unknown;
+export declare const parseCompose: (content: string, filepath: string) => unknown;
 //#endregion
 //#region ../core/src/runners/dockerfile-runner.d.ts
-declare const runDockerfileRules: (instructions: DockerfileInstruction[], file: string, projectFiles: string[], rulesConfig?: Record<string, RuleSeverity>, categoriesConfig?: Record<string, RuleSeverity>) => Diagnostic[];
+export declare const runDockerfileRules: (instructions: DockerfileInstruction[], file: string, projectFiles: string[], rulesConfig?: Record<string, RuleSeverity>, categoriesConfig?: Record<string, RuleSeverity>) => Diagnostic[];
 //#endregion
 //#region ../core/src/runners/compose-runner.d.ts
-declare const runComposeRules: (composeContent: unknown, file: string, rulesConfig?: Record<string, RuleSeverity>, categoriesConfig?: Record<string, RuleSeverity>, locate?: ComposeLocator) => Diagnostic[];
+export declare const runComposeRules: (composeContent: unknown, file: string, rulesConfig?: Record<string, RuleSeverity>, categoriesConfig?: Record<string, RuleSeverity>, locate?: ComposeLocator) => Diagnostic[];
 //#endregion
 //#region ../core/src/rules/index.d.ts
-declare const allRules: RuleDefinition[];
-declare const findRule: (key: string) => RuleDefinition | undefined;
+export declare const allRules: RuleDefinition[];
+export declare const findRule: (key: string) => RuleDefinition | undefined;
 //#endregion
 //#region ../core/src/config/define-config.d.ts
-declare const defineConfig: (config: DockerDoctorConfig) => DockerDoctorConfig;
+export declare const defineConfig: (config: DockerDoctorConfig) => DockerDoctorConfig;
 //#endregion
 //#region ../core/src/config/loader.d.ts
-declare const loadConfig: (rootDir: string, customPath?: string, onWarning?: (message: string) => void) => Promise<DockerDoctorConfig>;
+export declare const loadConfig: (rootDir: string, customPath?: string, onWarning?: (message: string) => void) => Promise<DockerDoctorConfig>;
 //#endregion
 //#region ../core/src/scoring.d.ts
-declare const calculateScore: (diagnostics: Diagnostic[]) => {
+export declare const calculateScore: (diagnostics: Diagnostic[]) => {
   score: number;
   label: string;
 };
@@ -80,6 +81,7 @@ declare const calculateScore: (diagnostics: Diagnostic[]) => {
 //#region ../core/src/report.d.ts
 interface JsonReport {
   diagnostics: {
+    category: RuleCategory;
     column?: number;
     file: string;
     help: string;
@@ -94,10 +96,10 @@ interface JsonReport {
   score: number;
   timestamp: string;
 }
-declare const toJsonReport: (diagnostics: Diagnostic[], score: number, label: string, project: ProjectInfo) => JsonReport;
+export declare const toJsonReport: (diagnostics: Diagnostic[], score: number, label: string, project: ProjectInfo) => JsonReport;
 //#endregion
 //#region src/index.d.ts
-declare const version: string;
+export declare const version: string;
 //#endregion
-export { type Diagnostic, type DockerDoctorConfig, type RuleCategory, type RuleSeverity, allRules, calculateScore, defineConfig, discoverProject, findRule, loadConfig, parseCompose, parseDockerfile, runComposeRules, runDockerfileRules, toJsonReport, version };
+export type { Diagnostic, DockerDoctorConfig, RuleCategory, RuleSeverity };
 //# sourceMappingURL=index.d.cts.map

package/dist/index.d.mts

@@ -13,6 +13,7 @@ interface Diagnostic {
   severity: DiagnosticSeverity;
   message: string;
   help: string;
+  category?: RuleCategory;
   line?: number;
   column?: number;
 }
@@ -45,34 +46,34 @@ interface DockerDoctorConfig {
 }
 //#endregion
 //#region ../core/src/project-info/discover.d.ts
-declare const discoverProject: (rootDir: string, options?: {
+export declare const discoverProject: (rootDir: string, options?: {
   ignoreFiles?: readonly string[];
 }) => Promise<ProjectInfo>;
 //#endregion
 //#region ../core/src/parsers/dockerfile-parser.d.ts
-declare const parseDockerfile: (content: string) => DockerfileInstruction[];
+export declare const parseDockerfile: (content: string, file?: string) => DockerfileInstruction[];
 //#endregion
 //#region ../core/src/parsers/compose-parser.d.ts
-declare const parseCompose: (content: string, filepath: string) => unknown;
+export declare const parseCompose: (content: string, filepath: string) => unknown;
 //#endregion
 //#region ../core/src/runners/dockerfile-runner.d.ts
-declare const runDockerfileRules: (instructions: DockerfileInstruction[], file: string, projectFiles: string[], rulesConfig?: Record<string, RuleSeverity>, categoriesConfig?: Record<string, RuleSeverity>) => Diagnostic[];
+export declare const runDockerfileRules: (instructions: DockerfileInstruction[], file: string, projectFiles: string[], rulesConfig?: Record<string, RuleSeverity>, categoriesConfig?: Record<string, RuleSeverity>) => Diagnostic[];
 //#endregion
 //#region ../core/src/runners/compose-runner.d.ts
-declare const runComposeRules: (composeContent: unknown, file: string, rulesConfig?: Record<string, RuleSeverity>, categoriesConfig?: Record<string, RuleSeverity>, locate?: ComposeLocator) => Diagnostic[];
+export declare const runComposeRules: (composeContent: unknown, file: string, rulesConfig?: Record<string, RuleSeverity>, categoriesConfig?: Record<string, RuleSeverity>, locate?: ComposeLocator) => Diagnostic[];
 //#endregion
 //#region ../core/src/rules/index.d.ts
-declare const allRules: RuleDefinition[];
-declare const findRule: (key: string) => RuleDefinition | undefined;
+export declare const allRules: RuleDefinition[];
+export declare const findRule: (key: string) => RuleDefinition | undefined;
 //#endregion
 //#region ../core/src/config/define-config.d.ts
-declare const defineConfig: (config: DockerDoctorConfig) => DockerDoctorConfig;
+export declare const defineConfig: (config: DockerDoctorConfig) => DockerDoctorConfig;
 //#endregion
 //#region ../core/src/config/loader.d.ts
-declare const loadConfig: (rootDir: string, customPath?: string, onWarning?: (message: string) => void) => Promise<DockerDoctorConfig>;
+export declare const loadConfig: (rootDir: string, customPath?: string, onWarning?: (message: string) => void) => Promise<DockerDoctorConfig>;
 //#endregion
 //#region ../core/src/scoring.d.ts
-declare const calculateScore: (diagnostics: Diagnostic[]) => {
+export declare const calculateScore: (diagnostics: Diagnostic[]) => {
   score: number;
   label: string;
 };
@@ -80,6 +81,7 @@ declare const calculateScore: (diagnostics: Diagnostic[]) => {
 //#region ../core/src/report.d.ts
 interface JsonReport {
   diagnostics: {
+    category: RuleCategory;
     column?: number;
     file: string;
     help: string;
@@ -94,10 +96,10 @@ interface JsonReport {
   score: number;
   timestamp: string;
 }
-declare const toJsonReport: (diagnostics: Diagnostic[], score: number, label: string, project: ProjectInfo) => JsonReport;
+export declare const toJsonReport: (diagnostics: Diagnostic[], score: number, label: string, project: ProjectInfo) => JsonReport;
 //#endregion
 //#region src/index.d.ts
-declare const version: string;
+export declare const version: string;
 //#endregion
-export { type Diagnostic, type DockerDoctorConfig, type RuleCategory, type RuleSeverity, allRules, calculateScore, defineConfig, discoverProject, findRule, loadConfig, parseCompose, parseDockerfile, runComposeRules, runDockerfileRules, toJsonReport, version };
+export type { Diagnostic, DockerDoctorConfig, RuleCategory, RuleSeverity };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as runDockerfileRules, d as discoverProject, f as version$1, i as runComposeRules, l as parseCompose, n as calculateScore, o as allRules, r as loadConfig, s as findRule, t as toJsonReport, u as parseDockerfile } from "./src-CpGd43y0.mjs";
+import { a as runDockerfileRules, d as discoverProject, f as version$1, i as runComposeRules, l as parseCompose, n as calculateScore, o as allRules, r as loadConfig, s as findRule, t as toJsonReport, u as parseDockerfile } from "./src-BOGzkp17.mjs";
 
 //#region ../core/src/config/define-config.ts
 const defineConfig = (config) => config;

package/dist/{src-CpGd43y0.mjs → src-BOGzkp17.mjs}

@@ -4,7 +4,7 @@ import path from "node:path";
 import { LineCounter, isAlias, isMap, isScalar, isSeq, parse, parseDocument } from "yaml";
 
 //#region package.json
-var version = "0.5.0";
+var version = "0.5.2";
 
 //#endregion
 //#region ../core/src/project-info/ignore.ts
@@ -71,6 +71,7 @@ const walk = async (dir, fileList = []) => {
 	}));
 	return fileList;
 };
+const toPosixRelative = (rootDir, file) => path.relative(rootDir, file).split(path.sep).join("/");
 const discoverProject = async (rootDir, options) => {
 	const allFiles = await walk(rootDir);
 	const dockerfiles = [];
@@ -78,10 +79,13 @@ const discoverProject = async (rootDir, options) => {
 	const dockerignores = [];
 	const isIgnored = createIgnoreMatcher(options?.ignoreFiles);
 	for (const file of allFiles) {
-		const relative = path.relative(rootDir, file);
+		const relative = toPosixRelative(rootDir, file);
 		if (isIgnored(relative)) continue;
 		const base = path.basename(file).toLowerCase();
-		if (base === ".dockerignore") dockerignores.push(relative);
+		if (base.endsWith(".dockerignore")) {
+			dockerignores.push(relative);
+			continue;
+		}
 		if (base === "dockerfile" || base.startsWith("dockerfile.") || base.endsWith(".dockerfile")) dockerfiles.push(relative);
 		if (base === "docker-compose.yml" || base === "docker-compose.yaml" || base === "compose.yml" || base === "compose.yaml" || (base.startsWith("docker-compose.") || base.startsWith("compose.")) && (base.endsWith(".yml") || base.endsWith(".yaml"))) composeFiles.push(relative);
 	}
@@ -92,6 +96,72 @@ const discoverProject = async (rootDir, options) => {
 	};
 };
 
+//#endregion
+//#region ../core/src/errors/config-error.ts
+var ConfigError = class extends Error {
+	_tag = "ConfigError";
+	constructor(options) {
+		super(options.message);
+		this.name = "ConfigError";
+	}
+};
+
+//#endregion
+//#region ../core/src/errors/parse-error.ts
+var ParseError = class extends Error {
+	_tag = "ParseError";
+	file;
+	constructor(options) {
+		super(options.message);
+		this.name = "ParseError";
+		this.file = options.file;
+	}
+};
+
+//#endregion
+//#region ../core/src/parsers/shell-quotes.ts
+/**
+* Replaces every character inside a single- or double-quoted region with a
+* space, keeping the quotes themselves and the string length, so callers can
+* run position-sensitive regexes over shell text without matching inside
+* string literals. A backslash inside double quotes escapes the next
+* character; single quotes have no escapes (POSIX sh). An unclosed quote
+* masks to the end of the text.
+*
+* What this deliberately does NOT do: it is not a tokenizer. It performs no
+* variable or command expansion, knows nothing about subshells, backslash
+* line continuations, `$'...'` or `<<` heredoc bodies, and does not split
+* words. It only blanks quoted spans so regexes keep their positions.
+*/
+const maskQuotedText = (text) => {
+	let out = "";
+	let quote = null;
+	let index = 0;
+	while (index < text.length) {
+		const char = text[index];
+		if (quote === null) {
+			if (char === "\"" || char === "'") quote = char;
+			out += char;
+			index += 1;
+			continue;
+		}
+		if (char === quote) {
+			quote = null;
+			out += char;
+			index += 1;
+			continue;
+		}
+		if (quote === "\"" && char === "\\" && index + 1 < text.length) {
+			out += "  ";
+			index += 2;
+			continue;
+		}
+		out += " ";
+		index += 1;
+	}
+	return out;
+};
+
 //#endregion
 //#region ../core/src/parsers/dockerfile-parser.ts
 const DOCKERFILE_KEYWORDS = /* @__PURE__ */ new Set([
@@ -154,7 +224,10 @@ const matchInstructionKeyword = (lineContent) => {
 	};
 	return null;
 };
-const findHeredocDelimiters = (lineContent) => [...lineContent.matchAll(HEREDOC_OPENER_RE)].map((m) => m.groups?.delim ?? "");
+const findHeredocDelimiters = (lineContent) => {
+	const masked = maskQuotedText(lineContent);
+	return [...lineContent.matchAll(HEREDOC_OPENER_RE)].filter((match) => masked[match.index] === "<").map((match) => match.groups?.delim ?? "");
+};
 const processHeredocLine = (state, trimmed) => {
 	if (trimmed === state.heredocQueue[0]) state.heredocQueue.shift();
 	else state.currentArgs += (state.currentArgs ? " " : "") + trimmed;
@@ -177,7 +250,7 @@ const processInstructionLine = (state, trimmed, lineNum) => {
 	if (state.heredocQueue.length > 0) return;
 	if (!hasContinuation) closeInstruction(state);
 };
-const parseDockerfile = (content) => {
+const parseDockerfile = (content, file = "Dockerfile") => {
 	const state = createParserState();
 	const lines = content.split(/\r?\n/u);
 	for (const [i, rawLine] of lines.entries()) {
@@ -190,32 +263,14 @@ const parseDockerfile = (content) => {
 		if (insideHeredoc) processHeredocLine(state, trimmed);
 		else processInstructionLine(state, trimmed, lineNum);
 	}
+	if (state.heredocQueue.length > 0) throw new ParseError({
+		file,
+		message: `Unterminated heredoc: delimiter "${state.heredocQueue[0]}" (opened on line ${state.startLine}) never closed. BuildKit rejects this Dockerfile too.`
+	});
 	closeInstruction(state);
 	return state.instructions;
 };
 
-//#endregion
-//#region ../core/src/errors/config-error.ts
-var ConfigError = class extends Error {
-	_tag = "ConfigError";
-	constructor(options) {
-		super(options.message);
-		this.name = "ConfigError";
-	}
-};
-
-//#endregion
-//#region ../core/src/errors/parse-error.ts
-var ParseError = class extends Error {
-	_tag = "ParseError";
-	file;
-	constructor(options) {
-		super(options.message);
-		this.name = "ParseError";
-		this.file = options.file;
-	}
-};
-
 //#endregion
 //#region ../core/src/parsers/compose-parser.ts
 const parseCompose = (content, filepath) => {
@@ -449,6 +504,7 @@ const combineAptUpdateInstall = {
 };
 const PIPEFAIL_SETTING_RE = /(?:^|\s)-[A-Za-z]*o\s+pipefail\b/u;
 const HAS_PIPE_RE = /(?<!\|)\|(?!\|)/u;
+const CD_COMMAND_RE = /(?:^|&&|\|\||;|\||\(|`|\$\()\s*cd(?=\s|$)/u;
 const shellDirectiveEnablesPipefail = (args) => {
 	const argv = parseExecForm(args);
 	return argv !== null && PIPEFAIL_SETTING_RE.test(argv.join(" "));
@@ -476,8 +532,9 @@ const usePipefail = {
 			}
 			if (inst.instruction !== "RUN") continue;
 			const { args } = inst;
-			if (!HAS_PIPE_RE.test(args)) continue;
 			const execArgv = parseExecForm(args);
+			const pipeText = execArgv === null ? maskQuotedText(args) : execArgv.join(" ");
+			if (!HAS_PIPE_RE.test(pipeText)) continue;
 			if (!(execArgv === null ? shellHasPipefail || PIPEFAIL_SETTING_RE.test(args) : PIPEFAIL_SETTING_RE.test(execArgv.join(" ")))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.", this.help, inst.line));
 		}
 		return diagnostics;
@@ -506,7 +563,7 @@ const avoidRunCd = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && /\bcd\b/u.test(inst.args)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && CD_COMMAND_RE.test(maskQuotedText(inst.args))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "info",
@@ -569,12 +626,13 @@ const bestPracticesRules = [
 * with a null body (`web:` with nothing under it) is returned as an empty
 * config so rules still check it: it is the least-configured service in
 * the file, not a service to skip. Scalar and array bodies are invalid
-* compose and are dropped.
+* compose and are dropped. A `services:` written as a YAML sequence is
+* invalid Compose and yields no services.
 */
 const composeServices = (composeContent) => {
 	if (!composeContent || typeof composeContent !== "object" || !("services" in composeContent)) return [];
 	const { services } = composeContent;
-	if (!services || typeof services !== "object") return [];
+	if (!services || typeof services !== "object" || Array.isArray(services)) return [];
 	const entries = [];
 	for (const [name, config] of Object.entries(services)) if (config === null || config === void 0) entries.push([name, {}]);
 	else if (typeof config === "object" && !Array.isArray(config)) entries.push([name, config]);
@@ -600,7 +658,9 @@ const requireResourceLimits = {
 		const diagnostics = [];
 		for (const [name, config] of composeServices(composeContent)) {
 			const limits = (config.deploy?.resources)?.limits;
-			if (!limits || !limits.cpus && !limits.memory) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' does not have CPU or memory limits defined. A resource leak in this service could crash the host.`, this.help, context?.locate?.(["services", name])));
+			const hasDeployLimits = Boolean(limits?.cpus || limits?.memory);
+			const hasServiceLevelLimits = Boolean(config.mem_limit || config.cpus || config.cpu_quota);
+			if (!(hasDeployLimits || hasServiceLevelLimits)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' does not have CPU or memory limits defined. A resource leak in this service could crash the host.`, this.help, context?.locate?.(["services", name])));
 		}
 		return diagnostics;
 	},
@@ -717,24 +777,52 @@ const undefinedModelReference = {
 	key: "docker-doctor/undefined-model-reference",
 	message: "Service model references must be declared in top-level models"
 };
+const collectModelBindings = (composeContent) => {
+	const bindings = [];
+	for (const [name, config] of Object.entries(topLevelModels(composeContent))) {
+		if (!config || typeof config !== "object") continue;
+		const { model } = config;
+		if (typeof model === "string") bindings.push({
+			model,
+			path: [
+				"models",
+				name,
+				"model"
+			],
+			subject: `Model '${name}' artifact`
+		});
+	}
+	for (const [name, config] of composeServices(composeContent)) {
+		const { provider } = config;
+		if (!provider || typeof provider !== "object") continue;
+		const { type, options } = provider;
+		if (type !== "model" || !options || typeof options !== "object") continue;
+		const { model } = options;
+		if (typeof model === "string") bindings.push({
+			model,
+			path: [
+				"services",
+				name,
+				"provider",
+				"options",
+				"model"
+			],
+			subject: `Service '${name}' model provider`
+		});
+	}
+	return bindings;
+};
 const pinModelVersion = {
 	category: "Compose",
 	check(composeContent, file, context) {
 		const diagnostics = [];
-		for (const [name, config] of Object.entries(topLevelModels(composeContent))) {
-			if (!config || typeof config !== "object") continue;
-			const { model } = config;
-			if (typeof model !== "string") continue;
+		for (const { subject, model, path } of collectModelBindings(composeContent)) {
 			const ref = parseImageRef(model);
 			if (ref.isVariable) continue;
 			const issue = mutableRefIssue(ref);
 			if (!issue) continue;
-			const detail = issue === "untagged" ? `Model '${name}' artifact '${model}' does not specify a tag.` : `Model '${name}' artifact '${model}' uses the mutable 'latest' tag.`;
-			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `${detail} Every pull may fetch different weights.`, this.help, context?.locate?.([
-				"models",
-				name,
-				"model"
-			])));
+			const detail = issue === "untagged" ? `${subject} '${model}' does not specify a tag.` : `${subject} '${model}' uses the mutable 'latest' tag.`;
+			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `${detail} Every pull may fetch different weights.`, this.help, context?.locate?.(path)));
 		}
 		return diagnostics;
 	},
@@ -748,18 +836,21 @@ const composeModelRules = [undefinedModelReference, pinModelVersion];
 //#endregion
 //#region ../core/src/rules/secret-keywords.ts
 const SECRET_KEY_PATTERNS = [
-	/(?:^|[_-])password(?:[_-]|$)/iu,
+	/password(?:[_-]|$)/iu,
 	/(?:^|[_-])secret(?:[_-]|$)/iu,
 	/(?:^|[_-])token(?:[_-]|$)/iu,
 	/(?:^|[_-])api_key(?:[_-]|$)/iu,
+	/(?:^|[_-])apikey(?:[_-]|$)/iu,
 	/(?:^|[_-])private_key(?:[_-]|$)/iu,
-	/(?:^|[_-])auth(?:[_-]|$)/iu
+	/(?:^|[_-])auth(?:[_-]|$)/iu,
+	/(?:^|[_-])pat(?:[_-]|$)/iu
 ];
 const isSecretKey = (key) => SECRET_KEY_PATTERNS.some((regex) => regex.test(key));
+const CREDENTIAL_FREE_URL = /^[a-z][a-z0-9+.-]*:\/\/[^@/\s]*(?:\/|$)/iu;
+const isLiteralSecretValue = (value) => value.length > 0 && !value.startsWith("$") && !CREDENTIAL_FREE_URL.test(value);
 
 //#endregion
 //#region ../core/src/rules/compose-security.ts
-const DOCKER_SOCKET = "/var/run/docker.sock";
 const noPrivilegedService = {
 	category: "Compose",
 	check(composeContent, file, context) {
@@ -776,10 +867,54 @@ const noPrivilegedService = {
 	key: "docker-doctor/no-privileged-service",
 	message: "Do not run services in privileged mode"
 };
+const DOCKER_SOCKET_TARGET = "/var/run/docker.sock";
+const INTERPOLATION_WITH_DEFAULT = /\$\{[^}:?-]+:?-(?<fallback>[^}]*)\}/gu;
+const INTERPOLATION_WITHOUT_DEFAULT = /\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*/gu;
+const resolveInterpolationDefaults = (value) => value.replace(INTERPOLATION_WITH_DEFAULT, (_match, fallback) => fallback).replace(INTERPOLATION_WITHOUT_DEFAULT, "");
+const PATH_SHAPED = /^(?:[/.~]|[A-Za-z]:)/u;
+const isDockerSocketPath = (rawPath) => {
+	const normalized = rawPath.replaceAll("\\", "/");
+	return PATH_SHAPED.test(normalized) && (normalized.endsWith("/docker.sock") || normalized.endsWith("/pipe/docker_engine"));
+};
+const splitShortSyntax = (spec) => {
+	const parts = [];
+	let depth = 0;
+	let current = "";
+	for (const char of spec) {
+		if (char === "{") depth += 1;
+		else if (char === "}") depth = Math.max(0, depth - 1);
+		if (char === ":" && depth === 0) {
+			parts.push(current);
+			current = "";
+			continue;
+		}
+		current += char;
+	}
+	parts.push(current);
+	return parts;
+};
+const volumeMount = (volume) => {
+	if (typeof volume === "string") {
+		const [source, target] = splitShortSyntax(volume);
+		return target === void 0 ? void 0 : {
+			source,
+			target
+		};
+	}
+	if (volume && typeof volume === "object") {
+		const { source, target } = volume;
+		return {
+			source: typeof source === "string" ? source : void 0,
+			target: typeof target === "string" ? target : void 0
+		};
+	}
+};
 const mountsDockerSocket = (volume) => {
-	if (typeof volume === "string") return volume.split(":")[0] === DOCKER_SOCKET;
-	if (volume && typeof volume === "object") return volume.source === DOCKER_SOCKET;
-	return false;
+	const mount = volumeMount(volume);
+	if (!mount?.source) return false;
+	const resolvedSource = resolveInterpolationDefaults(mount.source);
+	if (resolvedSource !== "") return isDockerSocketPath(resolvedSource);
+	return resolveInterpolationDefaults(mount.target ?? "") === DOCKER_SOCKET_TARGET;
 };
 const noDockerSocketMount = {
 	category: "Compose",
@@ -802,7 +937,6 @@ const noDockerSocketMount = {
 	key: "docker-doctor/no-docker-socket-mount",
 	message: "Do not bind-mount the Docker socket into services"
 };
-const isLiteralSecretValue = (value) => typeof value === "string" && value.length > 0 && !value.startsWith("$");
 const noPlaintextSecrets = {
 	category: "Compose",
 	check(composeContent, file, context) {
@@ -818,7 +952,7 @@ const noPlaintextSecrets = {
 				if (eqIndex <= 0) continue;
 				const key = entry.slice(0, eqIndex);
 				const value = entry.slice(eqIndex + 1);
-				if (isSecretKey(key) && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
+				if (isSecretKey(key) && typeof value === "string" && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
 					"services",
 					name,
 					"environment",
@@ -826,7 +960,7 @@ const noPlaintextSecrets = {
 				]));
 			}
 			else if (environment && typeof environment === "object") {
-				for (const [key, value] of Object.entries(environment)) if (isSecretKey(key) && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
+				for (const [key, value] of Object.entries(environment)) if (isSecretKey(key) && typeof value === "string" && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
 					"services",
 					name,
 					"environment",
@@ -1074,7 +1208,7 @@ const noSecretsInEnv = {
 				const match = args.match(/^(?<key>[^\s]+)\s+(?<value>.*)$/u);
 				if (match?.groups) {
 					const { key, value } = match.groups;
-					if (isSecretKey(key) && value && !value.startsWith("$") && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
+					if (isSecretKey(key) && isLiteralSecretValue(value) && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
 				}
 			} else {
 				const parts = args.split(/\s+/u);
@@ -1086,7 +1220,7 @@ const noSecretsInEnv = {
 						key = part.slice(0, eqIndex);
 						value = part.slice(eqIndex + 1);
 					} else key = part;
-					if (isSecretKey(key) && value && !value.startsWith("$") && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
+					if (isSecretKey(key) && isLiteralSecretValue(value) && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
 				}
 			}
 		}
@@ -1166,12 +1300,16 @@ const resolveSeverity = (rule, rulesConfig, categoriesConfig) => rulesConfig?.[r
 //#endregion
 //#region ../core/src/runners/dockerfile-runner.ts
 const runDockerfileRules = (instructions, file, projectFiles, rulesConfig, categoriesConfig) => {
+	if (instructions.length === 0) return [];
 	const diagnostics = [];
 	for (const rule of allDockerfileRules) {
 		const severity = resolveSeverity(rule, rulesConfig, categoriesConfig);
 		if (severity === "off") continue;
 		const ruleDiagnostics = rule.check(instructions, file, { projectFiles });
-		if (severity !== rule.defaultSeverity) for (const diag of ruleDiagnostics) diag.severity = severity;
+		for (const diag of ruleDiagnostics) {
+			diag.category = rule.category;
+			if (severity !== rule.defaultSeverity) diag.severity = severity;
+		}
 		diagnostics.push(...ruleDiagnostics);
 	}
 	return diagnostics;
@@ -1185,7 +1323,10 @@ const runComposeRules = (composeContent, file, rulesConfig, categoriesConfig, lo
 		const severity = resolveSeverity(rule, rulesConfig, categoriesConfig);
 		if (severity === "off") continue;
 		const ruleDiagnostics = rule.check(composeContent, file, { locate });
-		if (severity !== rule.defaultSeverity) for (const diag of ruleDiagnostics) diag.severity = severity;
+		for (const diag of ruleDiagnostics) {
+			diag.category = rule.category;
+			if (severity !== rule.defaultSeverity) diag.severity = severity;
+		}
 		diagnostics.push(...ruleDiagnostics);
 	}
 	return diagnostics;
@@ -1295,6 +1436,16 @@ const parseConfigFile = async (filePath, format, parse) => {
 		throw new ConfigError({ message: `Failed to parse config ${format}: ${msg}` });
 	}
 };
+const TYPESCRIPT_CONFIG_PATTERN = /\.[cm]?ts$/u;
+const TYPE_STRIPPING_FAILURES = {
+	ERR_UNKNOWN_FILE_EXTENSION: "this Node.js is not stripping TypeScript types, which needs 22.18 or newer with stripping left on (--no-experimental-strip-types turns it off)",
+	ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING: "Node.js never strips TypeScript types for files under node_modules, on any version, so the config has to live outside it"
+};
+const typeStrippingFailure = (filePath, error) => {
+	if (!TYPESCRIPT_CONFIG_PATTERN.test(filePath)) return;
+	if (typeof error !== "object" || error === null || !("code" in error) || typeof error.code !== "string") return;
+	return TYPE_STRIPPING_FAILURES[error.code];
+};
 const importConfig = async (filePath) => {
 	if (filePath.endsWith(".json")) return parseConfigFile(filePath, "JSON", JSON.parse);
 	if (filePath.endsWith(".yaml") || filePath.endsWith(".yml")) return parseConfigFile(filePath, "YAML", parse);
@@ -1302,6 +1453,8 @@ const importConfig = async (filePath) => {
 		const configModule = await import(filePath);
 		return configModule.default || configModule;
 	} catch (error) {
+		const reason = typeStrippingFailure(filePath, error);
+		if (reason) throw new ConfigError({ message: `Cannot load ${filePath} on Node.js ${process.version}: ${reason}. A docker-doctor.config.yaml or .json needs no TypeScript support at all.` });
 		const msg = error instanceof Error ? error.message : String(error);
 		throw new ConfigError({ message: `Failed to load config file ${filePath}: ${msg}` });
 	}
@@ -1396,9 +1549,15 @@ const calculateScore = (diagnostics) => {
 
 //#endregion
 //#region ../core/src/report.ts
-const REPORT_SCHEMA_VERSION = 2;
+const REPORT_SCHEMA_VERSION = 3;
+const resolveCategory = (diagnostic) => {
+	const category = diagnostic.category ?? findRule(diagnostic.rule)?.category;
+	if (!category) throw new Error(`Diagnostic for unknown rule "${diagnostic.rule}" has no category`);
+	return category;
+};
 const toJsonReport = (diagnostics, score, label, project) => ({
 	diagnostics: diagnostics.map((d) => ({
+		category: resolveCategory(d),
 		column: d.column,
 		file: d.file,
 		help: d.help,
@@ -1409,11 +1568,11 @@ const toJsonReport = (diagnostics, score, label, project) => ({
 	})),
 	label,
 	project,
-	schemaVersion: 2,
+	schemaVersion: 3,
 	score,
 	timestamp: (/* @__PURE__ */ new Date()).toISOString()
 });
 
 //#endregion
 export { runDockerfileRules as a, createComposeLocator as c, discoverProject as d, version as f, runComposeRules as i, parseCompose as l, calculateScore as n, allRules as o, loadConfig as r, findRule as s, toJsonReport as t, parseDockerfile as u };
-//# sourceMappingURL=src-CpGd43y0.mjs.map
+//# sourceMappingURL=src-BOGzkp17.mjs.map