@docker-doctor/cli 0.5.1 → 0.5.3

package/dist/{src-DYLANvt2.cjs → src-D4rVJg36.cjs}

@@ -33,7 +33,7 @@ node_path = __toESM(node_path, 1);
 let yaml = require("yaml");
 
 //#region package.json
-var version = "0.5.1";
+var version = "0.5.3";
 
 //#endregion
 //#region ../core/src/project-info/ignore.ts
@@ -100,6 +100,7 @@ const walk = async (dir, fileList = []) => {
 	}));
 	return fileList;
 };
+const toPosixRelative = (rootDir, file) => node_path.default.relative(rootDir, file).split(node_path.default.sep).join("/");
 const discoverProject = async (rootDir, options) => {
 	const allFiles = await walk(rootDir);
 	const dockerfiles = [];
@@ -107,10 +108,13 @@ const discoverProject = async (rootDir, options) => {
 	const dockerignores = [];
 	const isIgnored = createIgnoreMatcher(options?.ignoreFiles);
 	for (const file of allFiles) {
-		const relative = node_path.default.relative(rootDir, file);
+		const relative = toPosixRelative(rootDir, file);
 		if (isIgnored(relative)) continue;
 		const base = node_path.default.basename(file).toLowerCase();
-		if (base === ".dockerignore") dockerignores.push(relative);
+		if (base.endsWith(".dockerignore")) {
+			dockerignores.push(relative);
+			continue;
+		}
 		if (base === "dockerfile" || base.startsWith("dockerfile.") || base.endsWith(".dockerfile")) dockerfiles.push(relative);
 		if (base === "docker-compose.yml" || base === "docker-compose.yaml" || base === "compose.yml" || base === "compose.yaml" || (base.startsWith("docker-compose.") || base.startsWith("compose.")) && (base.endsWith(".yml") || base.endsWith(".yaml"))) composeFiles.push(relative);
 	}
@@ -121,6 +125,72 @@ const discoverProject = async (rootDir, options) => {
 	};
 };
 
+//#endregion
+//#region ../core/src/errors/config-error.ts
+var ConfigError = class extends Error {
+	_tag = "ConfigError";
+	constructor(options) {
+		super(options.message);
+		this.name = "ConfigError";
+	}
+};
+
+//#endregion
+//#region ../core/src/errors/parse-error.ts
+var ParseError = class extends Error {
+	_tag = "ParseError";
+	file;
+	constructor(options) {
+		super(options.message);
+		this.name = "ParseError";
+		this.file = options.file;
+	}
+};
+
+//#endregion
+//#region ../core/src/parsers/shell-quotes.ts
+/**
+* Replaces every character inside a single- or double-quoted region with a
+* space, keeping the quotes themselves and the string length, so callers can
+* run position-sensitive regexes over shell text without matching inside
+* string literals. A backslash inside double quotes escapes the next
+* character; single quotes have no escapes (POSIX sh). An unclosed quote
+* masks to the end of the text.
+*
+* What this deliberately does NOT do: it is not a tokenizer. It performs no
+* variable or command expansion, knows nothing about subshells, backslash
+* line continuations, `$'...'` or `<<` heredoc bodies, and does not split
+* words. It only blanks quoted spans so regexes keep their positions.
+*/
+const maskQuotedText = (text) => {
+	let out = "";
+	let quote = null;
+	let index = 0;
+	while (index < text.length) {
+		const char = text[index];
+		if (quote === null) {
+			if (char === "\"" || char === "'") quote = char;
+			out += char;
+			index += 1;
+			continue;
+		}
+		if (char === quote) {
+			quote = null;
+			out += char;
+			index += 1;
+			continue;
+		}
+		if (quote === "\"" && char === "\\" && index + 1 < text.length) {
+			out += "  ";
+			index += 2;
+			continue;
+		}
+		out += " ";
+		index += 1;
+	}
+	return out;
+};
+
 //#endregion
 //#region ../core/src/parsers/dockerfile-parser.ts
 const DOCKERFILE_KEYWORDS = /* @__PURE__ */ new Set([
@@ -183,7 +253,10 @@ const matchInstructionKeyword = (lineContent) => {
 	};
 	return null;
 };
-const findHeredocDelimiters = (lineContent) => [...lineContent.matchAll(HEREDOC_OPENER_RE)].map((m) => m.groups?.delim ?? "");
+const findHeredocDelimiters = (lineContent) => {
+	const masked = maskQuotedText(lineContent);
+	return [...lineContent.matchAll(HEREDOC_OPENER_RE)].filter((match) => masked[match.index] === "<").map((match) => match.groups?.delim ?? "");
+};
 const processHeredocLine = (state, trimmed) => {
 	if (trimmed === state.heredocQueue[0]) state.heredocQueue.shift();
 	else state.currentArgs += (state.currentArgs ? " " : "") + trimmed;
@@ -206,7 +279,7 @@ const processInstructionLine = (state, trimmed, lineNum) => {
 	if (state.heredocQueue.length > 0) return;
 	if (!hasContinuation) closeInstruction(state);
 };
-const parseDockerfile = (content) => {
+const parseDockerfile = (content, file = "Dockerfile") => {
 	const state = createParserState();
 	const lines = content.split(/\r?\n/u);
 	for (const [i, rawLine] of lines.entries()) {
@@ -219,32 +292,14 @@ const parseDockerfile = (content) => {
 		if (insideHeredoc) processHeredocLine(state, trimmed);
 		else processInstructionLine(state, trimmed, lineNum);
 	}
+	if (state.heredocQueue.length > 0) throw new ParseError({
+		file,
+		message: `Unterminated heredoc: delimiter "${state.heredocQueue[0]}" (opened on line ${state.startLine}) never closed. BuildKit rejects this Dockerfile too.`
+	});
 	closeInstruction(state);
 	return state.instructions;
 };
 
-//#endregion
-//#region ../core/src/errors/config-error.ts
-var ConfigError = class extends Error {
-	_tag = "ConfigError";
-	constructor(options) {
-		super(options.message);
-		this.name = "ConfigError";
-	}
-};
-
-//#endregion
-//#region ../core/src/errors/parse-error.ts
-var ParseError = class extends Error {
-	_tag = "ParseError";
-	file;
-	constructor(options) {
-		super(options.message);
-		this.name = "ParseError";
-		this.file = options.file;
-	}
-};
-
 //#endregion
 //#region ../core/src/parsers/compose-parser.ts
 const parseCompose = (content, filepath) => {
@@ -478,6 +533,7 @@ const combineAptUpdateInstall = {
 };
 const PIPEFAIL_SETTING_RE = /(?:^|\s)-[A-Za-z]*o\s+pipefail\b/u;
 const HAS_PIPE_RE = /(?<!\|)\|(?!\|)/u;
+const CD_COMMAND_RE = /(?:^|&&|\|\||;|\||\(|`|\$\()\s*cd(?=\s|$)/u;
 const shellDirectiveEnablesPipefail = (args) => {
 	const argv = parseExecForm(args);
 	return argv !== null && PIPEFAIL_SETTING_RE.test(argv.join(" "));
@@ -505,8 +561,9 @@ const usePipefail = {
 			}
 			if (inst.instruction !== "RUN") continue;
 			const { args } = inst;
-			if (!HAS_PIPE_RE.test(args)) continue;
 			const execArgv = parseExecForm(args);
+			const pipeText = execArgv === null ? maskQuotedText(args) : execArgv.join(" ");
+			if (!HAS_PIPE_RE.test(pipeText)) continue;
 			if (!(execArgv === null ? shellHasPipefail || PIPEFAIL_SETTING_RE.test(args) : PIPEFAIL_SETTING_RE.test(execArgv.join(" ")))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.", this.help, inst.line));
 		}
 		return diagnostics;
@@ -535,7 +592,7 @@ const avoidRunCd = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && /\bcd\b/u.test(inst.args)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && CD_COMMAND_RE.test(maskQuotedText(inst.args))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "info",
@@ -598,12 +655,13 @@ const bestPracticesRules = [
 * with a null body (`web:` with nothing under it) is returned as an empty
 * config so rules still check it: it is the least-configured service in
 * the file, not a service to skip. Scalar and array bodies are invalid
-* compose and are dropped.
+* compose and are dropped. A `services:` written as a YAML sequence is
+* invalid Compose and yields no services.
 */
 const composeServices = (composeContent) => {
 	if (!composeContent || typeof composeContent !== "object" || !("services" in composeContent)) return [];
 	const { services } = composeContent;
-	if (!services || typeof services !== "object") return [];
+	if (!services || typeof services !== "object" || Array.isArray(services)) return [];
 	const entries = [];
 	for (const [name, config] of Object.entries(services)) if (config === null || config === void 0) entries.push([name, {}]);
 	else if (typeof config === "object" && !Array.isArray(config)) entries.push([name, config]);
@@ -804,6 +862,125 @@ const pinModelVersion = {
 };
 const composeModelRules = [undefinedModelReference, pinModelVersion];
 
+//#endregion
+//#region ../core/src/rules/compose-mounts.ts
+/**
+* Shared parsing for Compose `volumes:` entries, used by every rule that
+* reasons about bind mounts. A Compose volume entry is either the short
+* `[SOURCE:]TARGET[:MODE]` string or the long-syntax object; both collapse
+* to a `VolumeMount`.
+*/
+const INTERPOLATION_WITH_DEFAULT = /\$\{[^}:?-]+:?-(?<fallback>[^}]*)\}/gu;
+const INTERPOLATION_WITHOUT_DEFAULT = /\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*/gu;
+const HOME_INTERPOLATION = /\$\{HOME\}|\$HOME(?![A-Za-z0-9_])/gu;
+const resolveInterpolationDefaults = (value) => value.replace(HOME_INTERPOLATION, "~").replace(INTERPOLATION_WITH_DEFAULT, (_match, fallback) => fallback).replace(INTERPOLATION_WITHOUT_DEFAULT, "");
+const PATH_SHAPED = /^(?:[/.~]|[A-Za-z]:)/u;
+const splitShortSyntax = (spec) => {
+	const parts = [];
+	let depth = 0;
+	let current = "";
+	for (const char of spec) {
+		if (char === "{") depth += 1;
+		else if (char === "}") depth = Math.max(0, depth - 1);
+		if (char === ":" && depth === 0) {
+			parts.push(current);
+			current = "";
+			continue;
+		}
+		current += char;
+	}
+	parts.push(current);
+	return parts;
+};
+const DRIVE_LETTER = /^[A-Za-z]$/u;
+const joinDriveLetter = (parts) => {
+	const [first, second, ...rest] = parts;
+	if (first !== void 0 && second !== void 0 && DRIVE_LETTER.test(first) && /^[\\/]/u.test(second)) return [`${first}:${second}`, ...rest];
+	return parts;
+};
+const shortSyntaxReadOnly = (mode) => mode !== void 0 && mode.split(",").includes("ro");
+const volumeMount = (volume) => {
+	if (typeof volume === "string") {
+		const [source, target, mode] = joinDriveLetter(splitShortSyntax(volume));
+		if (target === void 0) return;
+		return {
+			readOnly: shortSyntaxReadOnly(mode),
+			source,
+			target,
+			type: void 0
+		};
+	}
+	if (volume && typeof volume === "object") {
+		const { read_only: readOnly, source, target, type } = volume;
+		return {
+			readOnly: readOnly === true,
+			source: typeof source === "string" ? source : void 0,
+			target: typeof target === "string" ? target : void 0,
+			type: typeof type === "string" ? type : void 0
+		};
+	}
+};
+/**
+* The host path a bind mount reads from, with interpolation defaults
+* applied and Windows separators folded to `/`. Undefined when the entry is
+* not a bind mount (named volume, tmpfs, anonymous volume) or when the
+* source is an interpolation with no default, which names no host path.
+*/
+const bindMountSource = (mount) => {
+	if (mount.type !== void 0 && mount.type !== "bind") return;
+	if (!mount.source) return;
+	const resolved = resolveInterpolationDefaults(mount.source).replaceAll("\\", "/");
+	if (resolved === "" || !PATH_SHAPED.test(resolved)) return;
+	return resolved;
+};
+const isDockerSocketPath = (hostPath) => hostPath.endsWith("/docker.sock") || hostPath.endsWith("/pipe/docker_engine");
+const DOCKER_SOCKET_TARGET = "/var/run/docker.sock";
+/**
+* Whether the entry bind-mounts the Docker socket, under any of its host
+* spellings. A bare `${VAR}` source names no host path, but a socket target
+* still tells the story.
+*/
+const mountsDockerSocket = (mount) => {
+	const source = bindMountSource(mount);
+	if (source !== void 0) return isDockerSocketPath(source);
+	if (mount.type !== void 0 && mount.type !== "bind") return false;
+	if (!mount.source) return false;
+	return resolveInterpolationDefaults(mount.source) === "" && resolveInterpolationDefaults(mount.target ?? "") === DOCKER_SOCKET_TARGET;
+};
+const WINDOWS_DRIVE_ROOT = /^[A-Za-z]:\/?$/u;
+const WINDOWS_DRIVE_PREFIX = /^[A-Za-z]:/u;
+const SYSTEM_DIRECTORIES = [
+	"/etc",
+	"/root",
+	"/home",
+	"/Users",
+	"/proc",
+	"/sys",
+	"/boot",
+	"/run",
+	"/var/run"
+];
+const startsWithDirectory = (hostPath, directory) => hostPath === directory || hostPath.startsWith(`${directory}/`);
+/**
+* Classifies where on the host a bind-mount source points. `project` is a
+* relative path that stays inside the Compose project directory; everything
+* else reaches outside it.
+*/
+const classifyHostPath = (hostPath) => {
+	const collapsed = node_path.default.posix.normalize(hostPath);
+	const normalized = collapsed.length > 1 ? collapsed.replace(/\/+$/u, "") : collapsed;
+	if (normalized === "~") return "home";
+	if (normalized.startsWith("~/")) return normalized.startsWith("~/.") ? "home-dotfile" : "host";
+	if (normalized === "." || normalized.startsWith("./")) return "project";
+	if (normalized === ".." || normalized.startsWith("../")) return "parent";
+	if (WINDOWS_DRIVE_ROOT.test(normalized)) return "root";
+	if (WINDOWS_DRIVE_PREFIX.test(normalized)) return "host";
+	if (normalized === "/") return "root";
+	if (!normalized.startsWith("/")) return "project";
+	for (const directory of SYSTEM_DIRECTORIES) if (startsWithDirectory(normalized, directory)) return "system";
+	return "host";
+};
+
 //#endregion
 //#region ../core/src/rules/secret-keywords.ts
 const SECRET_KEY_PATTERNS = [
@@ -838,55 +1015,6 @@ const noPrivilegedService = {
 	key: "docker-doctor/no-privileged-service",
 	message: "Do not run services in privileged mode"
 };
-const DOCKER_SOCKET_TARGET = "/var/run/docker.sock";
-const INTERPOLATION_WITH_DEFAULT = /\$\{[^}:?-]+:?-(?<fallback>[^}]*)\}/gu;
-const INTERPOLATION_WITHOUT_DEFAULT = /\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*/gu;
-const resolveInterpolationDefaults = (value) => value.replace(INTERPOLATION_WITH_DEFAULT, (_match, fallback) => fallback).replace(INTERPOLATION_WITHOUT_DEFAULT, "");
-const PATH_SHAPED = /^(?:[/.~]|[A-Za-z]:)/u;
-const isDockerSocketPath = (rawPath) => {
-	const normalized = rawPath.replaceAll("\\", "/");
-	return PATH_SHAPED.test(normalized) && (normalized.endsWith("/docker.sock") || normalized.endsWith("/pipe/docker_engine"));
-};
-const splitShortSyntax = (spec) => {
-	const parts = [];
-	let depth = 0;
-	let current = "";
-	for (const char of spec) {
-		if (char === "{") depth += 1;
-		else if (char === "}") depth = Math.max(0, depth - 1);
-		if (char === ":" && depth === 0) {
-			parts.push(current);
-			current = "";
-			continue;
-		}
-		current += char;
-	}
-	parts.push(current);
-	return parts;
-};
-const volumeMount = (volume) => {
-	if (typeof volume === "string") {
-		const [source, target] = splitShortSyntax(volume);
-		return target === void 0 ? void 0 : {
-			source,
-			target
-		};
-	}
-	if (volume && typeof volume === "object") {
-		const { source, target } = volume;
-		return {
-			source: typeof source === "string" ? source : void 0,
-			target: typeof target === "string" ? target : void 0
-		};
-	}
-};
-const mountsDockerSocket = (volume) => {
-	const mount = volumeMount(volume);
-	if (!mount?.source) return false;
-	const resolvedSource = resolveInterpolationDefaults(mount.source);
-	if (resolvedSource !== "") return isDockerSocketPath(resolvedSource);
-	return resolveInterpolationDefaults(mount.target ?? "") === DOCKER_SOCKET_TARGET;
-};
 const noDockerSocketMount = {
 	category: "Compose",
 	check(composeContent, file, context) {
@@ -894,12 +1022,15 @@ const noDockerSocketMount = {
 		for (const [name, config] of composeServices(composeContent)) {
 			const { volumes } = config;
 			if (!Array.isArray(volumes)) continue;
-			for (const [index, volume] of volumes.entries()) if (mountsDockerSocket(volume)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts the Docker socket. Anything running in this container can control the Docker daemon: start privileged containers, read every volume, and escape to the host.`, this.help, context?.locate?.([
-				"services",
-				name,
-				"volumes",
-				index
-			])));
+			for (const [index, volume] of volumes.entries()) {
+				const mount = volumeMount(volume);
+				if (mount && mountsDockerSocket(mount)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts the Docker socket. Anything running in this container can control the Docker daemon: start privileged containers, read every volume, and escape to the host.`, this.help, context?.locate?.([
+					"services",
+					name,
+					"volumes",
+					index
+				])));
+			}
 		}
 		return diagnostics;
 	},
@@ -908,6 +1039,69 @@ const noDockerSocketMount = {
 	key: "docker-doctor/no-docker-socket-mount",
 	message: "Do not bind-mount the Docker socket into services"
 };
+const BROAD_SCOPE_REASONS = {
+	home: "the whole home directory",
+	"home-dotfile": "a hidden directory under the home directory, where credentials and tool configuration live",
+	parent: "a directory above the Compose project",
+	root: "the host's root filesystem",
+	system: "a host system directory"
+};
+const noBroadBindMount = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) {
+			const { volumes } = config;
+			if (!Array.isArray(volumes)) continue;
+			for (const [index, volume] of volumes.entries()) {
+				const mount = volumeMount(volume);
+				if (!mount || mountsDockerSocket(mount)) continue;
+				const source = bindMountSource(mount);
+				if (source === void 0) continue;
+				const reason = BROAD_SCOPE_REASONS[classifyHostPath(source)];
+				if (reason === void 0) continue;
+				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts '${source}', ${reason}. Everything under it is readable by the container, and a writable mount is the foothold for VM-escape bugs like CVE-2026-77179.`, this.help, context?.locate?.([
+					"services",
+					name,
+					"volumes",
+					index
+				])));
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Mount the narrowest directory the service actually reads (`./data`, not `~` or `/`), and add `:ro` unless the service must write to it. Host paths the service only needs at build time belong in the image instead.",
+	key: "docker-doctor/no-broad-bind-mount",
+	message: "Do not bind-mount broad host directories into services"
+};
+const preferReadOnlyBindMount = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) {
+			const { volumes } = config;
+			if (!Array.isArray(volumes)) continue;
+			for (const [index, volume] of volumes.entries()) {
+				const mount = volumeMount(volume);
+				if (!mount || mount.readOnly || mountsDockerSocket(mount)) continue;
+				const source = bindMountSource(mount);
+				if (source === void 0 || classifyHostPath(source) === "project") continue;
+				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts host path '${source}' read-write. A writable host mount lets the container change files outside the project, and is the foothold for VM-escape bugs like CVE-2026-77179.`, this.help, context?.locate?.([
+					"services",
+					name,
+					"volumes",
+					index
+				])));
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "info",
+	help: "Append `:ro` to the short syntax, or set `read_only: true` in the long syntax, unless the service must write to the host path.",
+	key: "docker-doctor/prefer-read-only-bind-mount",
+	message: "Bind mounts outside the project should be read-only"
+};
 const noPlaintextSecrets = {
 	category: "Compose",
 	check(composeContent, file, context) {
@@ -949,6 +1143,8 @@ const noPlaintextSecrets = {
 const composeSecurityRules = [
 	noPrivilegedService,
 	noDockerSocketMount,
+	noBroadBindMount,
+	preferReadOnlyBindMount,
 	noPlaintextSecrets
 ];
 
@@ -1271,12 +1467,16 @@ const resolveSeverity = (rule, rulesConfig, categoriesConfig) => rulesConfig?.[r
 //#endregion
 //#region ../core/src/runners/dockerfile-runner.ts
 const runDockerfileRules = (instructions, file, projectFiles, rulesConfig, categoriesConfig) => {
+	if (instructions.length === 0) return [];
 	const diagnostics = [];
 	for (const rule of allDockerfileRules) {
 		const severity = resolveSeverity(rule, rulesConfig, categoriesConfig);
 		if (severity === "off") continue;
 		const ruleDiagnostics = rule.check(instructions, file, { projectFiles });
-		if (severity !== rule.defaultSeverity) for (const diag of ruleDiagnostics) diag.severity = severity;
+		for (const diag of ruleDiagnostics) {
+			diag.category = rule.category;
+			if (severity !== rule.defaultSeverity) diag.severity = severity;
+		}
 		diagnostics.push(...ruleDiagnostics);
 	}
 	return diagnostics;
@@ -1290,7 +1490,10 @@ const runComposeRules = (composeContent, file, rulesConfig, categoriesConfig, lo
 		const severity = resolveSeverity(rule, rulesConfig, categoriesConfig);
 		if (severity === "off") continue;
 		const ruleDiagnostics = rule.check(composeContent, file, { locate });
-		if (severity !== rule.defaultSeverity) for (const diag of ruleDiagnostics) diag.severity = severity;
+		for (const diag of ruleDiagnostics) {
+			diag.category = rule.category;
+			if (severity !== rule.defaultSeverity) diag.severity = severity;
+		}
 		diagnostics.push(...ruleDiagnostics);
 	}
 	return diagnostics;
@@ -1400,6 +1603,16 @@ const parseConfigFile = async (filePath, format, parse) => {
 		throw new ConfigError({ message: `Failed to parse config ${format}: ${msg}` });
 	}
 };
+const TYPESCRIPT_CONFIG_PATTERN = /\.[cm]?ts$/u;
+const TYPE_STRIPPING_FAILURES = {
+	ERR_UNKNOWN_FILE_EXTENSION: "this Node.js is not stripping TypeScript types, which needs 22.18 or newer with stripping left on (--no-experimental-strip-types turns it off)",
+	ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING: "Node.js never strips TypeScript types for files under node_modules, on any version, so the config has to live outside it"
+};
+const typeStrippingFailure = (filePath, error) => {
+	if (!TYPESCRIPT_CONFIG_PATTERN.test(filePath)) return;
+	if (typeof error !== "object" || error === null || !("code" in error) || typeof error.code !== "string") return;
+	return TYPE_STRIPPING_FAILURES[error.code];
+};
 const importConfig = async (filePath) => {
 	if (filePath.endsWith(".json")) return parseConfigFile(filePath, "JSON", JSON.parse);
 	if (filePath.endsWith(".yaml") || filePath.endsWith(".yml")) return parseConfigFile(filePath, "YAML", yaml.parse);
@@ -1407,6 +1620,8 @@ const importConfig = async (filePath) => {
 		const configModule = await import(filePath);
 		return configModule.default || configModule;
 	} catch (error) {
+		const reason = typeStrippingFailure(filePath, error);
+		if (reason) throw new ConfigError({ message: `Cannot load ${filePath} on Node.js ${process.version}: ${reason}. A docker-doctor.config.yaml or .json needs no TypeScript support at all.` });
 		const msg = error instanceof Error ? error.message : String(error);
 		throw new ConfigError({ message: `Failed to load config file ${filePath}: ${msg}` });
 	}
@@ -1501,9 +1716,15 @@ const calculateScore = (diagnostics) => {
 
 //#endregion
 //#region ../core/src/report.ts
-const REPORT_SCHEMA_VERSION = 2;
+const REPORT_SCHEMA_VERSION = 3;
+const resolveCategory = (diagnostic) => {
+	const category = diagnostic.category ?? findRule(diagnostic.rule)?.category;
+	if (!category) throw new Error(`Diagnostic for unknown rule "${diagnostic.rule}" has no category`);
+	return category;
+};
 const toJsonReport = (diagnostics, score, label, project) => ({
 	diagnostics: diagnostics.map((d) => ({
+		category: resolveCategory(d),
 		column: d.column,
 		file: d.file,
 		help: d.help,
@@ -1514,7 +1735,7 @@ const toJsonReport = (diagnostics, score, label, project) => ({
 	})),
 	label,
 	project,
-	schemaVersion: 2,
+	schemaVersion: 3,
 	score,
 	timestamp: (/* @__PURE__ */ new Date()).toISOString()
 });
@@ -1598,4 +1819,4 @@ Object.defineProperty(exports, 'version', {
     return version;
   }
 });
-//# sourceMappingURL=src-DYLANvt2.cjs.map
+//# sourceMappingURL=src-D4rVJg36.cjs.map