@docker-doctor/cli 0.5.1 → 0.5.3

package/dist/{src-NqSwkGiS.mjs → src-CklEIXTX.mjs}

@@ -4,7 +4,7 @@ import path from "node:path";
 import { LineCounter, isAlias, isMap, isScalar, isSeq, parse, parseDocument } from "yaml";
 
 //#region package.json
-var version = "0.5.1";
+var version = "0.5.3";
 
 //#endregion
 //#region ../core/src/project-info/ignore.ts
@@ -71,6 +71,7 @@ const walk = async (dir, fileList = []) => {
 	}));
 	return fileList;
 };
+const toPosixRelative = (rootDir, file) => path.relative(rootDir, file).split(path.sep).join("/");
 const discoverProject = async (rootDir, options) => {
 	const allFiles = await walk(rootDir);
 	const dockerfiles = [];
@@ -78,10 +79,13 @@ const discoverProject = async (rootDir, options) => {
 	const dockerignores = [];
 	const isIgnored = createIgnoreMatcher(options?.ignoreFiles);
 	for (const file of allFiles) {
-		const relative = path.relative(rootDir, file);
+		const relative = toPosixRelative(rootDir, file);
 		if (isIgnored(relative)) continue;
 		const base = path.basename(file).toLowerCase();
-		if (base === ".dockerignore") dockerignores.push(relative);
+		if (base.endsWith(".dockerignore")) {
+			dockerignores.push(relative);
+			continue;
+		}
 		if (base === "dockerfile" || base.startsWith("dockerfile.") || base.endsWith(".dockerfile")) dockerfiles.push(relative);
 		if (base === "docker-compose.yml" || base === "docker-compose.yaml" || base === "compose.yml" || base === "compose.yaml" || (base.startsWith("docker-compose.") || base.startsWith("compose.")) && (base.endsWith(".yml") || base.endsWith(".yaml"))) composeFiles.push(relative);
 	}
@@ -92,6 +96,72 @@ const discoverProject = async (rootDir, options) => {
 	};
 };
 
+//#endregion
+//#region ../core/src/errors/config-error.ts
+var ConfigError = class extends Error {
+	_tag = "ConfigError";
+	constructor(options) {
+		super(options.message);
+		this.name = "ConfigError";
+	}
+};
+
+//#endregion
+//#region ../core/src/errors/parse-error.ts
+var ParseError = class extends Error {
+	_tag = "ParseError";
+	file;
+	constructor(options) {
+		super(options.message);
+		this.name = "ParseError";
+		this.file = options.file;
+	}
+};
+
+//#endregion
+//#region ../core/src/parsers/shell-quotes.ts
+/**
+* Replaces every character inside a single- or double-quoted region with a
+* space, keeping the quotes themselves and the string length, so callers can
+* run position-sensitive regexes over shell text without matching inside
+* string literals. A backslash inside double quotes escapes the next
+* character; single quotes have no escapes (POSIX sh). An unclosed quote
+* masks to the end of the text.
+*
+* What this deliberately does NOT do: it is not a tokenizer. It performs no
+* variable or command expansion, knows nothing about subshells, backslash
+* line continuations, `$'...'` or `<<` heredoc bodies, and does not split
+* words. It only blanks quoted spans so regexes keep their positions.
+*/
+const maskQuotedText = (text) => {
+	let out = "";
+	let quote = null;
+	let index = 0;
+	while (index < text.length) {
+		const char = text[index];
+		if (quote === null) {
+			if (char === "\"" || char === "'") quote = char;
+			out += char;
+			index += 1;
+			continue;
+		}
+		if (char === quote) {
+			quote = null;
+			out += char;
+			index += 1;
+			continue;
+		}
+		if (quote === "\"" && char === "\\" && index + 1 < text.length) {
+			out += "  ";
+			index += 2;
+			continue;
+		}
+		out += " ";
+		index += 1;
+	}
+	return out;
+};
+
 //#endregion
 //#region ../core/src/parsers/dockerfile-parser.ts
 const DOCKERFILE_KEYWORDS = /* @__PURE__ */ new Set([
@@ -154,7 +224,10 @@ const matchInstructionKeyword = (lineContent) => {
 	};
 	return null;
 };
-const findHeredocDelimiters = (lineContent) => [...lineContent.matchAll(HEREDOC_OPENER_RE)].map((m) => m.groups?.delim ?? "");
+const findHeredocDelimiters = (lineContent) => {
+	const masked = maskQuotedText(lineContent);
+	return [...lineContent.matchAll(HEREDOC_OPENER_RE)].filter((match) => masked[match.index] === "<").map((match) => match.groups?.delim ?? "");
+};
 const processHeredocLine = (state, trimmed) => {
 	if (trimmed === state.heredocQueue[0]) state.heredocQueue.shift();
 	else state.currentArgs += (state.currentArgs ? " " : "") + trimmed;
@@ -177,7 +250,7 @@ const processInstructionLine = (state, trimmed, lineNum) => {
 	if (state.heredocQueue.length > 0) return;
 	if (!hasContinuation) closeInstruction(state);
 };
-const parseDockerfile = (content) => {
+const parseDockerfile = (content, file = "Dockerfile") => {
 	const state = createParserState();
 	const lines = content.split(/\r?\n/u);
 	for (const [i, rawLine] of lines.entries()) {
@@ -190,32 +263,14 @@ const parseDockerfile = (content) => {
 		if (insideHeredoc) processHeredocLine(state, trimmed);
 		else processInstructionLine(state, trimmed, lineNum);
 	}
+	if (state.heredocQueue.length > 0) throw new ParseError({
+		file,
+		message: `Unterminated heredoc: delimiter "${state.heredocQueue[0]}" (opened on line ${state.startLine}) never closed. BuildKit rejects this Dockerfile too.`
+	});
 	closeInstruction(state);
 	return state.instructions;
 };
 
-//#endregion
-//#region ../core/src/errors/config-error.ts
-var ConfigError = class extends Error {
-	_tag = "ConfigError";
-	constructor(options) {
-		super(options.message);
-		this.name = "ConfigError";
-	}
-};
-
-//#endregion
-//#region ../core/src/errors/parse-error.ts
-var ParseError = class extends Error {
-	_tag = "ParseError";
-	file;
-	constructor(options) {
-		super(options.message);
-		this.name = "ParseError";
-		this.file = options.file;
-	}
-};
-
 //#endregion
 //#region ../core/src/parsers/compose-parser.ts
 const parseCompose = (content, filepath) => {
@@ -449,6 +504,7 @@ const combineAptUpdateInstall = {
 };
 const PIPEFAIL_SETTING_RE = /(?:^|\s)-[A-Za-z]*o\s+pipefail\b/u;
 const HAS_PIPE_RE = /(?<!\|)\|(?!\|)/u;
+const CD_COMMAND_RE = /(?:^|&&|\|\||;|\||\(|`|\$\()\s*cd(?=\s|$)/u;
 const shellDirectiveEnablesPipefail = (args) => {
 	const argv = parseExecForm(args);
 	return argv !== null && PIPEFAIL_SETTING_RE.test(argv.join(" "));
@@ -476,8 +532,9 @@ const usePipefail = {
 			}
 			if (inst.instruction !== "RUN") continue;
 			const { args } = inst;
-			if (!HAS_PIPE_RE.test(args)) continue;
 			const execArgv = parseExecForm(args);
+			const pipeText = execArgv === null ? maskQuotedText(args) : execArgv.join(" ");
+			if (!HAS_PIPE_RE.test(pipeText)) continue;
 			if (!(execArgv === null ? shellHasPipefail || PIPEFAIL_SETTING_RE.test(args) : PIPEFAIL_SETTING_RE.test(execArgv.join(" ")))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.", this.help, inst.line));
 		}
 		return diagnostics;
@@ -506,7 +563,7 @@ const avoidRunCd = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && /\bcd\b/u.test(inst.args)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && CD_COMMAND_RE.test(maskQuotedText(inst.args))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "info",
@@ -569,12 +626,13 @@ const bestPracticesRules = [
 * with a null body (`web:` with nothing under it) is returned as an empty
 * config so rules still check it: it is the least-configured service in
 * the file, not a service to skip. Scalar and array bodies are invalid
-* compose and are dropped.
+* compose and are dropped. A `services:` written as a YAML sequence is
+* invalid Compose and yields no services.
 */
 const composeServices = (composeContent) => {
 	if (!composeContent || typeof composeContent !== "object" || !("services" in composeContent)) return [];
 	const { services } = composeContent;
-	if (!services || typeof services !== "object") return [];
+	if (!services || typeof services !== "object" || Array.isArray(services)) return [];
 	const entries = [];
 	for (const [name, config] of Object.entries(services)) if (config === null || config === void 0) entries.push([name, {}]);
 	else if (typeof config === "object" && !Array.isArray(config)) entries.push([name, config]);
@@ -775,6 +833,125 @@ const pinModelVersion = {
 };
 const composeModelRules = [undefinedModelReference, pinModelVersion];
 
+//#endregion
+//#region ../core/src/rules/compose-mounts.ts
+/**
+* Shared parsing for Compose `volumes:` entries, used by every rule that
+* reasons about bind mounts. A Compose volume entry is either the short
+* `[SOURCE:]TARGET[:MODE]` string or the long-syntax object; both collapse
+* to a `VolumeMount`.
+*/
+const INTERPOLATION_WITH_DEFAULT = /\$\{[^}:?-]+:?-(?<fallback>[^}]*)\}/gu;
+const INTERPOLATION_WITHOUT_DEFAULT = /\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*/gu;
+const HOME_INTERPOLATION = /\$\{HOME\}|\$HOME(?![A-Za-z0-9_])/gu;
+const resolveInterpolationDefaults = (value) => value.replace(HOME_INTERPOLATION, "~").replace(INTERPOLATION_WITH_DEFAULT, (_match, fallback) => fallback).replace(INTERPOLATION_WITHOUT_DEFAULT, "");
+const PATH_SHAPED = /^(?:[/.~]|[A-Za-z]:)/u;
+const splitShortSyntax = (spec) => {
+	const parts = [];
+	let depth = 0;
+	let current = "";
+	for (const char of spec) {
+		if (char === "{") depth += 1;
+		else if (char === "}") depth = Math.max(0, depth - 1);
+		if (char === ":" && depth === 0) {
+			parts.push(current);
+			current = "";
+			continue;
+		}
+		current += char;
+	}
+	parts.push(current);
+	return parts;
+};
+const DRIVE_LETTER = /^[A-Za-z]$/u;
+const joinDriveLetter = (parts) => {
+	const [first, second, ...rest] = parts;
+	if (first !== void 0 && second !== void 0 && DRIVE_LETTER.test(first) && /^[\\/]/u.test(second)) return [`${first}:${second}`, ...rest];
+	return parts;
+};
+const shortSyntaxReadOnly = (mode) => mode !== void 0 && mode.split(",").includes("ro");
+const volumeMount = (volume) => {
+	if (typeof volume === "string") {
+		const [source, target, mode] = joinDriveLetter(splitShortSyntax(volume));
+		if (target === void 0) return;
+		return {
+			readOnly: shortSyntaxReadOnly(mode),
+			source,
+			target,
+			type: void 0
+		};
+	}
+	if (volume && typeof volume === "object") {
+		const { read_only: readOnly, source, target, type } = volume;
+		return {
+			readOnly: readOnly === true,
+			source: typeof source === "string" ? source : void 0,
+			target: typeof target === "string" ? target : void 0,
+			type: typeof type === "string" ? type : void 0
+		};
+	}
+};
+/**
+* The host path a bind mount reads from, with interpolation defaults
+* applied and Windows separators folded to `/`. Undefined when the entry is
+* not a bind mount (named volume, tmpfs, anonymous volume) or when the
+* source is an interpolation with no default, which names no host path.
+*/
+const bindMountSource = (mount) => {
+	if (mount.type !== void 0 && mount.type !== "bind") return;
+	if (!mount.source) return;
+	const resolved = resolveInterpolationDefaults(mount.source).replaceAll("\\", "/");
+	if (resolved === "" || !PATH_SHAPED.test(resolved)) return;
+	return resolved;
+};
+const isDockerSocketPath = (hostPath) => hostPath.endsWith("/docker.sock") || hostPath.endsWith("/pipe/docker_engine");
+const DOCKER_SOCKET_TARGET = "/var/run/docker.sock";
+/**
+* Whether the entry bind-mounts the Docker socket, under any of its host
+* spellings. A bare `${VAR}` source names no host path, but a socket target
+* still tells the story.
+*/
+const mountsDockerSocket = (mount) => {
+	const source = bindMountSource(mount);
+	if (source !== void 0) return isDockerSocketPath(source);
+	if (mount.type !== void 0 && mount.type !== "bind") return false;
+	if (!mount.source) return false;
+	return resolveInterpolationDefaults(mount.source) === "" && resolveInterpolationDefaults(mount.target ?? "") === DOCKER_SOCKET_TARGET;
+};
+const WINDOWS_DRIVE_ROOT = /^[A-Za-z]:\/?$/u;
+const WINDOWS_DRIVE_PREFIX = /^[A-Za-z]:/u;
+const SYSTEM_DIRECTORIES = [
+	"/etc",
+	"/root",
+	"/home",
+	"/Users",
+	"/proc",
+	"/sys",
+	"/boot",
+	"/run",
+	"/var/run"
+];
+const startsWithDirectory = (hostPath, directory) => hostPath === directory || hostPath.startsWith(`${directory}/`);
+/**
+* Classifies where on the host a bind-mount source points. `project` is a
+* relative path that stays inside the Compose project directory; everything
+* else reaches outside it.
+*/
+const classifyHostPath = (hostPath) => {
+	const collapsed = path.posix.normalize(hostPath);
+	const normalized = collapsed.length > 1 ? collapsed.replace(/\/+$/u, "") : collapsed;
+	if (normalized === "~") return "home";
+	if (normalized.startsWith("~/")) return normalized.startsWith("~/.") ? "home-dotfile" : "host";
+	if (normalized === "." || normalized.startsWith("./")) return "project";
+	if (normalized === ".." || normalized.startsWith("../")) return "parent";
+	if (WINDOWS_DRIVE_ROOT.test(normalized)) return "root";
+	if (WINDOWS_DRIVE_PREFIX.test(normalized)) return "host";
+	if (normalized === "/") return "root";
+	if (!normalized.startsWith("/")) return "project";
+	for (const directory of SYSTEM_DIRECTORIES) if (startsWithDirectory(normalized, directory)) return "system";
+	return "host";
+};
+
 //#endregion
 //#region ../core/src/rules/secret-keywords.ts
 const SECRET_KEY_PATTERNS = [
@@ -809,55 +986,6 @@ const noPrivilegedService = {
 	key: "docker-doctor/no-privileged-service",
 	message: "Do not run services in privileged mode"
 };
-const DOCKER_SOCKET_TARGET = "/var/run/docker.sock";
-const INTERPOLATION_WITH_DEFAULT = /\$\{[^}:?-]+:?-(?<fallback>[^}]*)\}/gu;
-const INTERPOLATION_WITHOUT_DEFAULT = /\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*/gu;
-const resolveInterpolationDefaults = (value) => value.replace(INTERPOLATION_WITH_DEFAULT, (_match, fallback) => fallback).replace(INTERPOLATION_WITHOUT_DEFAULT, "");
-const PATH_SHAPED = /^(?:[/.~]|[A-Za-z]:)/u;
-const isDockerSocketPath = (rawPath) => {
-	const normalized = rawPath.replaceAll("\\", "/");
-	return PATH_SHAPED.test(normalized) && (normalized.endsWith("/docker.sock") || normalized.endsWith("/pipe/docker_engine"));
-};
-const splitShortSyntax = (spec) => {
-	const parts = [];
-	let depth = 0;
-	let current = "";
-	for (const char of spec) {
-		if (char === "{") depth += 1;
-		else if (char === "}") depth = Math.max(0, depth - 1);
-		if (char === ":" && depth === 0) {
-			parts.push(current);
-			current = "";
-			continue;
-		}
-		current += char;
-	}
-	parts.push(current);
-	return parts;
-};
-const volumeMount = (volume) => {
-	if (typeof volume === "string") {
-		const [source, target] = splitShortSyntax(volume);
-		return target === void 0 ? void 0 : {
-			source,
-			target
-		};
-	}
-	if (volume && typeof volume === "object") {
-		const { source, target } = volume;
-		return {
-			source: typeof source === "string" ? source : void 0,
-			target: typeof target === "string" ? target : void 0
-		};
-	}
-};
-const mountsDockerSocket = (volume) => {
-	const mount = volumeMount(volume);
-	if (!mount?.source) return false;
-	const resolvedSource = resolveInterpolationDefaults(mount.source);
-	if (resolvedSource !== "") return isDockerSocketPath(resolvedSource);
-	return resolveInterpolationDefaults(mount.target ?? "") === DOCKER_SOCKET_TARGET;
-};
 const noDockerSocketMount = {
 	category: "Compose",
 	check(composeContent, file, context) {
@@ -865,12 +993,15 @@ const noDockerSocketMount = {
 		for (const [name, config] of composeServices(composeContent)) {
 			const { volumes } = config;
 			if (!Array.isArray(volumes)) continue;
-			for (const [index, volume] of volumes.entries()) if (mountsDockerSocket(volume)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts the Docker socket. Anything running in this container can control the Docker daemon: start privileged containers, read every volume, and escape to the host.`, this.help, context?.locate?.([
-				"services",
-				name,
-				"volumes",
-				index
-			])));
+			for (const [index, volume] of volumes.entries()) {
+				const mount = volumeMount(volume);
+				if (mount && mountsDockerSocket(mount)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts the Docker socket. Anything running in this container can control the Docker daemon: start privileged containers, read every volume, and escape to the host.`, this.help, context?.locate?.([
+					"services",
+					name,
+					"volumes",
+					index
+				])));
+			}
 		}
 		return diagnostics;
 	},
@@ -879,6 +1010,69 @@ const noDockerSocketMount = {
 	key: "docker-doctor/no-docker-socket-mount",
 	message: "Do not bind-mount the Docker socket into services"
 };
+const BROAD_SCOPE_REASONS = {
+	home: "the whole home directory",
+	"home-dotfile": "a hidden directory under the home directory, where credentials and tool configuration live",
+	parent: "a directory above the Compose project",
+	root: "the host's root filesystem",
+	system: "a host system directory"
+};
+const noBroadBindMount = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) {
+			const { volumes } = config;
+			if (!Array.isArray(volumes)) continue;
+			for (const [index, volume] of volumes.entries()) {
+				const mount = volumeMount(volume);
+				if (!mount || mountsDockerSocket(mount)) continue;
+				const source = bindMountSource(mount);
+				if (source === void 0) continue;
+				const reason = BROAD_SCOPE_REASONS[classifyHostPath(source)];
+				if (reason === void 0) continue;
+				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts '${source}', ${reason}. Everything under it is readable by the container, and a writable mount is the foothold for VM-escape bugs like CVE-2026-77179.`, this.help, context?.locate?.([
+					"services",
+					name,
+					"volumes",
+					index
+				])));
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Mount the narrowest directory the service actually reads (`./data`, not `~` or `/`), and add `:ro` unless the service must write to it. Host paths the service only needs at build time belong in the image instead.",
+	key: "docker-doctor/no-broad-bind-mount",
+	message: "Do not bind-mount broad host directories into services"
+};
+const preferReadOnlyBindMount = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) {
+			const { volumes } = config;
+			if (!Array.isArray(volumes)) continue;
+			for (const [index, volume] of volumes.entries()) {
+				const mount = volumeMount(volume);
+				if (!mount || mount.readOnly || mountsDockerSocket(mount)) continue;
+				const source = bindMountSource(mount);
+				if (source === void 0 || classifyHostPath(source) === "project") continue;
+				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts host path '${source}' read-write. A writable host mount lets the container change files outside the project, and is the foothold for VM-escape bugs like CVE-2026-77179.`, this.help, context?.locate?.([
+					"services",
+					name,
+					"volumes",
+					index
+				])));
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "info",
+	help: "Append `:ro` to the short syntax, or set `read_only: true` in the long syntax, unless the service must write to the host path.",
+	key: "docker-doctor/prefer-read-only-bind-mount",
+	message: "Bind mounts outside the project should be read-only"
+};
 const noPlaintextSecrets = {
 	category: "Compose",
 	check(composeContent, file, context) {
@@ -920,6 +1114,8 @@ const noPlaintextSecrets = {
 const composeSecurityRules = [
 	noPrivilegedService,
 	noDockerSocketMount,
+	noBroadBindMount,
+	preferReadOnlyBindMount,
 	noPlaintextSecrets
 ];
 
@@ -1242,12 +1438,16 @@ const resolveSeverity = (rule, rulesConfig, categoriesConfig) => rulesConfig?.[r
 //#endregion
 //#region ../core/src/runners/dockerfile-runner.ts
 const runDockerfileRules = (instructions, file, projectFiles, rulesConfig, categoriesConfig) => {
+	if (instructions.length === 0) return [];
 	const diagnostics = [];
 	for (const rule of allDockerfileRules) {
 		const severity = resolveSeverity(rule, rulesConfig, categoriesConfig);
 		if (severity === "off") continue;
 		const ruleDiagnostics = rule.check(instructions, file, { projectFiles });
-		if (severity !== rule.defaultSeverity) for (const diag of ruleDiagnostics) diag.severity = severity;
+		for (const diag of ruleDiagnostics) {
+			diag.category = rule.category;
+			if (severity !== rule.defaultSeverity) diag.severity = severity;
+		}
 		diagnostics.push(...ruleDiagnostics);
 	}
 	return diagnostics;
@@ -1261,7 +1461,10 @@ const runComposeRules = (composeContent, file, rulesConfig, categoriesConfig, lo
 		const severity = resolveSeverity(rule, rulesConfig, categoriesConfig);
 		if (severity === "off") continue;
 		const ruleDiagnostics = rule.check(composeContent, file, { locate });
-		if (severity !== rule.defaultSeverity) for (const diag of ruleDiagnostics) diag.severity = severity;
+		for (const diag of ruleDiagnostics) {
+			diag.category = rule.category;
+			if (severity !== rule.defaultSeverity) diag.severity = severity;
+		}
 		diagnostics.push(...ruleDiagnostics);
 	}
 	return diagnostics;
@@ -1371,6 +1574,16 @@ const parseConfigFile = async (filePath, format, parse) => {
 		throw new ConfigError({ message: `Failed to parse config ${format}: ${msg}` });
 	}
 };
+const TYPESCRIPT_CONFIG_PATTERN = /\.[cm]?ts$/u;
+const TYPE_STRIPPING_FAILURES = {
+	ERR_UNKNOWN_FILE_EXTENSION: "this Node.js is not stripping TypeScript types, which needs 22.18 or newer with stripping left on (--no-experimental-strip-types turns it off)",
+	ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING: "Node.js never strips TypeScript types for files under node_modules, on any version, so the config has to live outside it"
+};
+const typeStrippingFailure = (filePath, error) => {
+	if (!TYPESCRIPT_CONFIG_PATTERN.test(filePath)) return;
+	if (typeof error !== "object" || error === null || !("code" in error) || typeof error.code !== "string") return;
+	return TYPE_STRIPPING_FAILURES[error.code];
+};
 const importConfig = async (filePath) => {
 	if (filePath.endsWith(".json")) return parseConfigFile(filePath, "JSON", JSON.parse);
 	if (filePath.endsWith(".yaml") || filePath.endsWith(".yml")) return parseConfigFile(filePath, "YAML", parse);
@@ -1378,6 +1591,8 @@ const importConfig = async (filePath) => {
 		const configModule = await import(filePath);
 		return configModule.default || configModule;
 	} catch (error) {
+		const reason = typeStrippingFailure(filePath, error);
+		if (reason) throw new ConfigError({ message: `Cannot load ${filePath} on Node.js ${process.version}: ${reason}. A docker-doctor.config.yaml or .json needs no TypeScript support at all.` });
 		const msg = error instanceof Error ? error.message : String(error);
 		throw new ConfigError({ message: `Failed to load config file ${filePath}: ${msg}` });
 	}
@@ -1472,9 +1687,15 @@ const calculateScore = (diagnostics) => {
 
 //#endregion
 //#region ../core/src/report.ts
-const REPORT_SCHEMA_VERSION = 2;
+const REPORT_SCHEMA_VERSION = 3;
+const resolveCategory = (diagnostic) => {
+	const category = diagnostic.category ?? findRule(diagnostic.rule)?.category;
+	if (!category) throw new Error(`Diagnostic for unknown rule "${diagnostic.rule}" has no category`);
+	return category;
+};
 const toJsonReport = (diagnostics, score, label, project) => ({
 	diagnostics: diagnostics.map((d) => ({
+		category: resolveCategory(d),
 		column: d.column,
 		file: d.file,
 		help: d.help,
@@ -1485,11 +1706,11 @@ const toJsonReport = (diagnostics, score, label, project) => ({
 	})),
 	label,
 	project,
-	schemaVersion: 2,
+	schemaVersion: 3,
 	score,
 	timestamp: (/* @__PURE__ */ new Date()).toISOString()
 });
 
 //#endregion
 export { runDockerfileRules as a, createComposeLocator as c, discoverProject as d, version as f, runComposeRules as i, parseCompose as l, calculateScore as n, allRules as o, loadConfig as r, findRule as s, toJsonReport as t, parseDockerfile as u };
-//# sourceMappingURL=src-NqSwkGiS.mjs.map
+//# sourceMappingURL=src-CklEIXTX.mjs.map