@docker-doctor/cli 0.5.3 → 0.6.1

package/dist/{src-D4rVJg36.cjs → src-C7XK6Kp-.cjs}

@@ -31,9 +31,10 @@ node_fs_promises = __toESM(node_fs_promises, 1);
 let node_path = require("node:path");
 node_path = __toESM(node_path, 1);
 let yaml = require("yaml");
+let node_url = require("node:url");
 
 //#region package.json
-var version = "0.5.3";
+var version = "0.6.1";
 
 //#endregion
 //#region ../core/src/project-info/ignore.ts
@@ -73,6 +74,17 @@ const globToRegExp = (pattern) => {
 	}
 	return new RegExp(`${source}$`, "u");
 };
+const LEADING_DOT_SLASH_RE = /^(?:\.\/)+/u;
+/**
+* Accepts two spellings people bring from `.gitignore`. A leading `./` is
+* dropped because patterns are already root-relative, and a trailing `/`
+* means the whole directory. `vendor/` and `./vendor/**` both become
+* `vendor/**`.
+*/
+const normalizeIgnorePattern = (pattern) => {
+	const rootRelative = pattern.replace(LEADING_DOT_SLASH_RE, "");
+	return rootRelative.endsWith("/") ? `${rootRelative}**` : rootRelative;
+};
 /**
 * Builds a predicate over root-relative paths from `ignore.files`
 * patterns. Windows separators in the tested path are normalized to `/`
@@ -80,7 +92,7 @@ const globToRegExp = (pattern) => {
 */
 const createIgnoreMatcher = (patterns) => {
 	if (!patterns || patterns.length === 0) return () => false;
-	const regexps = patterns.map(globToRegExp);
+	const regexps = patterns.map(normalizeIgnorePattern).map(globToRegExp);
 	return (relativePath) => {
 		const normalized = relativePath.replaceAll("\\", "/");
 		return regexps.some((regexp) => regexp.test(normalized));
@@ -89,20 +101,66 @@ const createIgnoreMatcher = (patterns) => {
 
 //#endregion
 //#region ../core/src/project-info/discover.ts
-const walk = async (dir, fileList = []) => {
-	const files = await node_fs_promises.default.readdir(dir, { withFileTypes: true });
+const PRUNED_DIRECTORIES = [
+	".git",
+	".hg",
+	".svn",
+	"node_modules",
+	"bower_components",
+	".pnpm-store",
+	".yarn",
+	".venv",
+	"venv",
+	"__pycache__",
+	".tox",
+	".mypy_cache",
+	".pytest_cache",
+	".ruff_cache",
+	".gradle",
+	".turbo",
+	".next",
+	".nuxt",
+	".svelte-kit",
+	".parcel-cache",
+	".cache",
+	"coverage",
+	"dist"
+];
+const PRUNED = new Set(PRUNED_DIRECTORIES);
+const toPosixRelative = (rootDir, file) => node_path.default.relative(rootDir, file).split(node_path.default.sep).join("/");
+const SUBTREE_SUFFIX = "/**";
+const createPrunedDirectoryMatcher = (patterns = []) => createIgnoreMatcher(patterns.map(normalizeIgnorePattern).filter((pattern) => pattern.endsWith(SUBTREE_SUFFIX)).map((pattern) => pattern.slice(0, -3)));
+const isPermissionError = (error) => error instanceof Error && "code" in error && (error.code === "EACCES" || error.code === "EPERM");
+const walk = async (dir, options, fileList = []) => {
+	let files;
+	try {
+		files = await node_fs_promises.default.readdir(dir, { withFileTypes: true });
+	} catch (error) {
+		if (dir !== options.rootDir && isPermissionError(error)) {
+			options.onSkippedDirectory?.(toPosixRelative(options.rootDir, dir));
+			return fileList;
+		}
+		throw error;
+	}
 	await Promise.all(files.map(async (file) => {
 		const filePath = node_path.default.join(dir, file.name);
+		if (file.isSymbolicLink()) {
+			fileList.push(filePath);
+			return;
+		}
 		if (file.isDirectory()) {
-			if (file.name === "node_modules" || file.name === ".git" || file.name === ".next" || file.name === "dist" || file.name === ".turbo") return;
-			await walk(filePath, fileList);
+			if (PRUNED.has(file.name) || options.isPrunedByConfig(toPosixRelative(options.rootDir, filePath))) return;
+			await walk(filePath, options, fileList);
 		} else fileList.push(filePath);
 	}));
 	return fileList;
 };
-const toPosixRelative = (rootDir, file) => node_path.default.relative(rootDir, file).split(node_path.default.sep).join("/");
 const discoverProject = async (rootDir, options) => {
-	const allFiles = await walk(rootDir);
+	const allFiles = await walk(rootDir, {
+		isPrunedByConfig: createPrunedDirectoryMatcher(options?.ignoreFiles),
+		onSkippedDirectory: options?.onSkippedDirectory,
+		rootDir
+	});
 	const dockerfiles = [];
 	const composeFiles = [];
 	const dockerignores = [];
@@ -219,7 +277,7 @@ const HEREDOC_INSTRUCTIONS = /* @__PURE__ */ new Set([
 	"RUN"
 ]);
 const INSTRUCTION_LINE_RE = /^(?<inst>[A-Za-z]+)\s+(?<args>.*)$/u;
-const HEREDOC_OPENER_RE = /(?<=^|\s)<<-?(?<quote>['"]?)(?<delim>\w+)\k<quote>/gu;
+const HEREDOC_OPENER_RE = /(?<=^|\s)<<-?(?<quote>['"]?)(?<delim>[^\s'"<>;&|()]+)\k<quote>/gu;
 const createParserState = () => ({
 	currentArgs: "",
 	currentInstruction: "",
@@ -287,7 +345,7 @@ const parseDockerfile = (content, file = "Dockerfile") => {
 		const lineNum = i + 1;
 		const insideHeredoc = state.heredocQueue.length > 0;
 		if (!insideHeredoc && trimmed.startsWith("#")) continue;
-		if (!state.currentInstruction && !insideHeredoc && trimmed === "") continue;
+		if (!insideHeredoc && trimmed === "") continue;
 		state.rawAccumulator.push(rawLine);
 		if (insideHeredoc) processHeredocLine(state, trimmed);
 		else processInstructionLine(state, trimmed, lineNum);
@@ -366,7 +424,7 @@ const parseExecForm = (args) => {
 //#endregion
 //#region ../core/src/parsers/image-ref.ts
 const parseImageRef = (ref) => {
-	if (ref.includes("${") || ref.startsWith("$")) return {
+	if (ref.includes("$")) return {
 		isVariable: true,
 		name: ref
 	};
@@ -418,6 +476,15 @@ const isHardenedRuntimeImage = (imagePart) => {
 	const { tag } = parseImageRef(imagePart);
 	return !(tag === "dev" || tag?.endsWith("-dev"));
 };
+const DISTROLESS_NONROOT_TAG_RE = /(?:^|-)nonroot(?:-|$)/u;
+/**
+* Distroless images tagged `nonroot` (also `debug-nonroot` and the
+* per-architecture `nonroot-amd64` forms) run as uid 65532.
+*/
+const isDistrolessNonroot = (imagePart) => {
+	const { name, registry, tag } = parseImageRef(imagePart);
+	return registry === "gcr.io" && name.startsWith("distroless/") && tag !== void 0 && DISTROLESS_NONROOT_TAG_RE.test(tag);
+};
 /**
 * Why a reference would resolve differently over time: no tag at all, or
 * the mutable `latest` tag without a digest. `undefined` means the ref is
@@ -447,6 +514,11 @@ const collectStageAliases = (instructions) => {
 	return aliases;
 };
 
+//#endregion
+//#region ../core/src/parsers/run-flags.ts
+const LEADING_RUN_FLAGS_RE = /^(?:--[a-z][a-z-]*(?:=\S*)?\s+)+/u;
+const stripRunFlags = (args) => args.replace(LEADING_RUN_FLAGS_RE, "");
+
 //#endregion
 //#region ../core/src/rules/create-diagnostic.ts
 const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
@@ -458,6 +530,13 @@ const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
 	severity
 });
 
+//#endregion
+//#region ../core/src/rules/package-managers.ts
+const APT_GET_INSTALL_RE = /\bapt-get(?:\s+-\S+)*\s+install\b/u;
+const APT_GET_UPDATE_RE = /\bapt-get(?:\s+-\S+)*\s+update\b/u;
+const hasAptGetInstall = (text) => APT_GET_INSTALL_RE.test(text);
+const hasAptGetUpdate = (text) => APT_GET_UPDATE_RE.test(text);
+
 //#endregion
 //#region ../core/src/rules/best-practices.ts
 const requireHealthcheck = {
@@ -473,6 +552,16 @@ const requireHealthcheck = {
 	key: "docker-doctor/require-healthcheck",
 	message: "Add a HEALTHCHECK instruction"
 };
+const AUTO_EXTRACT_SUFFIXES = [
+	".tar",
+	".tar.gz",
+	".tgz",
+	".tar.bz2",
+	".tbz2",
+	".tbz",
+	".tar.xz",
+	".txz"
+];
 const preferCopyOverAdd = {
 	category: "Best Practices",
 	check(instructions, file) {
@@ -481,7 +570,7 @@ const preferCopyOverAdd = {
 			const src = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
 			if (!src) continue;
 			const isRemote = src.startsWith("http://") || src.startsWith("https://");
-			const isArchive = src.endsWith(".tar") || src.endsWith(".tar.gz") || src.endsWith(".tgz") || src.endsWith(".zip");
+			const isArchive = AUTO_EXTRACT_SUFFIXES.some((suffix) => src.toLowerCase().endsWith(suffix));
 			if (!isRemote && !isArchive) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `ADD instruction used for regular files: '${inst.args}'. COPY is simpler and less prone to magic side effects.`, this.help, inst.line));
 		}
 		return diagnostics;
@@ -519,8 +608,8 @@ const combineAptUpdateInstall = {
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
-			const hasUpdate = inst.args.includes("apt-get update");
-			const hasInstall = inst.args.includes("apt-get install");
+			const hasUpdate = hasAptGetUpdate(inst.args);
+			const hasInstall = hasAptGetInstall(inst.args);
 			if (hasUpdate && !hasInstall) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN apt-get update used without apt-get install in the same instruction. This can cause caching issues and build failures.", this.help, inst.line));
 			else if (hasInstall && !hasUpdate) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN apt-get install used without apt-get update in the same instruction. Always combine them to ensure up-to-date package installation.", this.help, inst.line));
 		}
@@ -573,12 +662,14 @@ const usePipefail = {
 	key: "docker-doctor/use-pipefail",
 	message: "Use pipefail to catch pipeline command failures"
 };
+const SURROUNDING_QUOTES_RE$1 = /^(?<quote>["'])(?<inner>.*)\k<quote>$/u;
 const absoluteWorkdir = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "WORKDIR") {
-			const path = inst.args.trim();
+			const trimmed = inst.args.trim();
+			const path = trimmed.match(SURROUNDING_QUOTES_RE$1)?.groups?.inner ?? trimmed;
 			if (!/^(?:\/|\\|\$|[a-zA-Z]:)/u.test(path)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `WORKDIR specifies a relative path '${path}'. For clarity and reliability, always use absolute paths.`, this.help, inst.line));
 		}
 		return diagnostics;
@@ -592,7 +683,7 @@ const avoidRunCd = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && CD_COMMAND_RE.test(maskQuotedText(inst.args))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && CD_COMMAND_RE.test(maskQuotedText(stripRunFlags(inst.args)))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "info",
@@ -600,18 +691,34 @@ const avoidRunCd = {
 	key: "docker-doctor/avoid-run-cd",
 	message: "Avoid changing directories with cd in RUN"
 };
+const PACKAGE_LIST_START_RE = /\b(?:apt-get(?:\s+-\S+)*\s+install|apk\s+add|yum\s+install|dnf\s+install)\b/u;
+const SHELL_SEPARATOR_RE$1 = /[;|]|&&/u;
+const WHITESPACE_RE$1 = /\s+/u;
+const UNCONTINUED_NEWLINE_RE = /(?<!\\[ \t]*)\r?\n/u;
+const collectPackageList = (raw) => {
+	const start = PACKAGE_LIST_START_RE.exec(raw);
+	if (!start) return [];
+	const packages = [];
+	const [command] = raw.slice(start.index + start[0].length).split(UNCONTINUED_NEWLINE_RE);
+	const tokens = command.split(WHITESPACE_RE$1);
+	for (const token of tokens) {
+		if (SHELL_SEPARATOR_RE$1.test(token)) break;
+		if (token !== "" && token !== "\\" && !token.startsWith("-")) packages.push(token);
+	}
+	return packages;
+};
 const sortMultilineArgs = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const { raw } = inst;
-			const isPackageInstall = raw.includes("apt-get install") || raw.includes("apk add") || raw.includes("yum install") || raw.includes("dnf install");
+			const isPackageInstall = hasAptGetInstall(raw) || raw.includes("apk add") || raw.includes("yum install") || raw.includes("dnf install");
 			const hasContinuation = raw.includes("\\\n") || raw.includes("\\\r\n");
 			if (isPackageInstall && hasContinuation) {
-				const packages = raw.split(/\r?\n/u).slice(1).map((line) => line.trim()).filter((line) => line !== "" && !line.startsWith("&&") && !line.startsWith("-") && !line.includes("rm -rf")).map((line) => line.endsWith("\\") ? line.slice(0, -1).trim() : line).filter(Boolean);
+				const packages = collectPackageList(raw);
 				if (packages.length > 1) {
-					const sorted = packages.toSorted((a, b) => a.localeCompare(b));
+					const sorted = packages.toSorted();
 					if (!packages.every((val, idx) => val === sorted[idx])) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Multi-line package arguments are not sorted alphanumerically. Keeping them sorted makes maintenance easier and prevents duplicates.", this.help, inst.line));
 				}
 			}
@@ -623,15 +730,18 @@ const sortMultilineArgs = {
 	key: "docker-doctor/sort-multiline-args",
 	message: "Sort multi-line arguments alphanumerically"
 };
+const USERADD_COMMAND_RE = /\buseradd\b/u;
+const NO_LOG_INIT_FLAG_RE = /(?:^|\s)(?:--no-log-init|-[A-Za-z]*l[A-Za-z]*)(?=\s|$)/u;
+const useraddWritesLoginLogs = (args) => args.split(SHELL_SEPARATOR_RE$1).some((command) => USERADD_COMMAND_RE.test(command) && !NO_LOG_INIT_FLAG_RE.test(command));
 const useraddNoLogInit = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && /\buseradd\b/u.test(inst.args) && !inst.args.includes("--no-log-init")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && useraddWritesLoginLogs(inst.args)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Pass `--no-log-init` flag to useradd (e.g., `RUN useradd --no-log-init -r -g mygroup myuser`).",
+	help: "Pass `--no-log-init` or its short form `-l` to useradd (e.g., `RUN useradd --no-log-init -r -g mygroup myuser`).",
 	key: "docker-doctor/useradd-no-log-init",
 	message: "Use --no-log-init with useradd"
 };
@@ -650,6 +760,13 @@ const bestPracticesRules = [
 
 //#endregion
 //#region ../core/src/rules/compose-services.ts
+const TRUE_SPELLINGS = /* @__PURE__ */ new Set([
+	"true",
+	"y",
+	"yes",
+	"on"
+]);
+const isComposeTrue = (value) => value === true || typeof value === "string" && TRUE_SPELLINGS.has(value.trim().toLowerCase());
 /**
 * Narrows an unknown compose document to its service entries. A service
 * with a null body (`web:` with nothing under it) is returned as an empty
@@ -873,7 +990,10 @@ const composeModelRules = [undefinedModelReference, pinModelVersion];
 const INTERPOLATION_WITH_DEFAULT = /\$\{[^}:?-]+:?-(?<fallback>[^}]*)\}/gu;
 const INTERPOLATION_WITHOUT_DEFAULT = /\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*/gu;
 const HOME_INTERPOLATION = /\$\{HOME\}|\$HOME(?![A-Za-z0-9_])/gu;
-const resolveInterpolationDefaults = (value) => value.replace(HOME_INTERPOLATION, "~").replace(INTERPOLATION_WITH_DEFAULT, (_match, fallback) => fallback).replace(INTERPOLATION_WITHOUT_DEFAULT, "");
+const PWD_INTERPOLATION = /\$\{PWD\}|\$PWD(?![A-Za-z0-9_])/gu;
+const LEADING_INTERPOLATION_RE = /^\$(?:\{[^}]*\}|[A-Za-z_][A-Za-z0-9_]*)/u;
+const applyFoldsAndDefaults = (value) => value.replace(HOME_INTERPOLATION, "~").replace(PWD_INTERPOLATION, ".").replace(INTERPOLATION_WITH_DEFAULT, (_match, fallback) => fallback);
+const resolveInterpolationDefaults = (value) => applyFoldsAndDefaults(value).replace(INTERPOLATION_WITHOUT_DEFAULT, "");
 const PATH_SHAPED = /^(?:[/.~]|[A-Za-z]:)/u;
 const splitShortSyntax = (spec) => {
 	const parts = [];
@@ -913,7 +1033,7 @@ const volumeMount = (volume) => {
 	if (volume && typeof volume === "object") {
 		const { read_only: readOnly, source, target, type } = volume;
 		return {
-			readOnly: readOnly === true,
+			readOnly: isComposeTrue(readOnly),
 			source: typeof source === "string" ? source : void 0,
 			target: typeof target === "string" ? target : void 0,
 			type: typeof type === "string" ? type : void 0
@@ -924,12 +1044,16 @@ const volumeMount = (volume) => {
 * The host path a bind mount reads from, with interpolation defaults
 * applied and Windows separators folded to `/`. Undefined when the entry is
 * not a bind mount (named volume, tmpfs, anonymous volume) or when the
-* source is an interpolation with no default, which names no host path.
+* source starts with an interpolation that has no default. A source such as
+* `${DATA_DIR}/pg` names no known host location, so no rule can say whether
+* it is inside the project.
 */
 const bindMountSource = (mount) => {
 	if (mount.type !== void 0 && mount.type !== "bind") return;
 	if (!mount.source) return;
-	const resolved = resolveInterpolationDefaults(mount.source).replaceAll("\\", "/");
+	const withDefaults = applyFoldsAndDefaults(mount.source);
+	if (LEADING_INTERPOLATION_RE.test(withDefaults)) return;
+	const resolved = withDefaults.replace(INTERPOLATION_WITHOUT_DEFAULT, "").replaceAll("\\", "/");
 	if (resolved === "" || !PATH_SHAPED.test(resolved)) return;
 	return resolved;
 };
@@ -937,15 +1061,16 @@ const isDockerSocketPath = (hostPath) => hostPath.endsWith("/docker.sock") || ho
 const DOCKER_SOCKET_TARGET = "/var/run/docker.sock";
 /**
 * Whether the entry bind-mounts the Docker socket, under any of its host
-* spellings. A bare `${VAR}` source names no host path, but a socket target
-* still tells the story.
+* spellings. A source that starts with `${VAR}` names no known host path,
+* but a `/docker.sock` suffix or a socket target still identifies it.
 */
 const mountsDockerSocket = (mount) => {
 	const source = bindMountSource(mount);
 	if (source !== void 0) return isDockerSocketPath(source);
 	if (mount.type !== void 0 && mount.type !== "bind") return false;
 	if (!mount.source) return false;
-	return resolveInterpolationDefaults(mount.source) === "" && resolveInterpolationDefaults(mount.target ?? "") === DOCKER_SOCKET_TARGET;
+	const remainder = resolveInterpolationDefaults(mount.source);
+	return isDockerSocketPath(remainder) || remainder === "" && resolveInterpolationDefaults(mount.target ?? "") === DOCKER_SOCKET_TARGET;
 };
 const WINDOWS_DRIVE_ROOT = /^[A-Za-z]:\/?$/u;
 const WINDOWS_DRIVE_PREFIX = /^[A-Za-z]:/u;
@@ -993,9 +1118,15 @@ const SECRET_KEY_PATTERNS = [
 	/(?:^|[_-])auth(?:[_-]|$)/iu,
 	/(?:^|[_-])pat(?:[_-]|$)/iu
 ];
-const isSecretKey = (key) => SECRET_KEY_PATTERNS.some((regex) => regex.test(key));
+const SECRET_LOCATION_SUFFIX = /[_-](?:file|path)$/iu;
+const isSecretKey = (key) => !SECRET_LOCATION_SUFFIX.test(key) && SECRET_KEY_PATTERNS.some((regex) => regex.test(key));
 const CREDENTIAL_FREE_URL = /^[a-z][a-z0-9+.-]*:\/\/[^@/\s]*(?:\/|$)/iu;
-const isLiteralSecretValue = (value) => value.length > 0 && !value.startsWith("$") && !CREDENTIAL_FREE_URL.test(value);
+const SWITCH_VALUE = /^(?:true|false|yes|no|on|off)$/iu;
+const SURROUNDING_QUOTES_RE = /^(?<quote>["'])(?<inner>.*)\k<quote>$/su;
+const isLiteralSecretValue = (value) => {
+	const unquoted = value.match(SURROUNDING_QUOTES_RE)?.groups?.inner ?? value;
+	return unquoted.length > 0 && !unquoted.startsWith("$") && !SWITCH_VALUE.test(unquoted) && !CREDENTIAL_FREE_URL.test(unquoted);
+};
 
 //#endregion
 //#region ../core/src/rules/compose-security.ts
@@ -1003,7 +1134,7 @@ const noPrivilegedService = {
 	category: "Compose",
 	check(composeContent, file, context) {
 		const diagnostics = [];
-		for (const [name, config] of composeServices(composeContent)) if (config.privileged === true) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' runs in privileged mode. A privileged container has full access to the host's devices and kernel, so compromising this service compromises the host.`, this.help, context?.locate?.([
+		for (const [name, config] of composeServices(composeContent)) if (isComposeTrue(config.privileged)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' runs in privileged mode. A privileged container has full access to the host's devices and kernel, so compromising this service compromises the host.`, this.help, context?.locate?.([
 			"services",
 			name,
 			"privileged"
@@ -1102,6 +1233,10 @@ const preferReadOnlyBindMount = {
 	key: "docker-doctor/prefer-read-only-bind-mount",
 	message: "Bind mounts outside the project should be read-only"
 };
+const literalValue = (value) => {
+	if (typeof value === "string") return value;
+	if (typeof value === "number") return String(value);
+};
 const noPlaintextSecrets = {
 	category: "Compose",
 	check(composeContent, file, context) {
@@ -1117,15 +1252,16 @@ const noPlaintextSecrets = {
 				if (eqIndex <= 0) continue;
 				const key = entry.slice(0, eqIndex);
 				const value = entry.slice(eqIndex + 1);
-				if (isSecretKey(key) && typeof value === "string" && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
+				if (isSecretKey(key) && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
 					"services",
 					name,
 					"environment",
 					index
 				]));
 			}
-			else if (environment && typeof environment === "object") {
-				for (const [key, value] of Object.entries(environment)) if (isSecretKey(key) && typeof value === "string" && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
+			else if (environment && typeof environment === "object") for (const [key, value] of Object.entries(environment)) {
+				const literal = literalValue(value);
+				if (literal !== void 0 && isSecretKey(key) && isLiteralSecretValue(literal)) flag(name, key, context?.locate?.([
 					"services",
 					name,
 					"environment",
@@ -1150,13 +1286,56 @@ const composeSecurityRules = [
 
 //#endregion
 //#region ../core/src/rules/image-size.ts
+const NODE_ENV_ASSIGNMENT_RE = /(?:^|\s)NODE_ENV(?:=|\s+)["']?(?<value>[^\s"']*)/u;
+const collectStages = (instructions) => {
+	const stages = [];
+	const productionEnv = [];
+	for (const inst of instructions) if (inst.instruction === "FROM") {
+		const { base, stage } = parseFromArgs(inst.args);
+		const baseKey = base?.toLowerCase() ?? "";
+		const parent = stages.findIndex((s) => s.name !== null && s.name === baseKey);
+		productionEnv.push(parent !== -1 && productionEnv[parent]);
+		stages.push({
+			base: baseKey,
+			from: inst,
+			name: stage?.toLowerCase() ?? null,
+			runs: []
+		});
+	} else if (inst.instruction === "ENV" && stages.length > 0) {
+		const value = NODE_ENV_ASSIGNMENT_RE.exec(inst.args)?.groups?.value;
+		if (value !== void 0) productionEnv[stages.length - 1] = value === "production";
+	} else if (inst.instruction === "RUN" && stages.length > 0 && !productionEnv[stages.length - 1]) stages.at(-1)?.runs.push(inst);
+	return stages;
+};
+const shippedStages = (stages) => {
+	const shipped = [];
+	let index = stages.length - 1;
+	while (index >= 0) {
+		shipped.unshift(stages[index]);
+		const { base } = stages[index];
+		index = stages.slice(0, index).findIndex((s) => s.name !== null && s.name === base);
+	}
+	return shipped;
+};
+const MINIMAL_BASE_MARKERS = [
+	"alpine",
+	"slim",
+	"distroless",
+	"busybox",
+	"chainguard",
+	"wolfi",
+	"chiseled",
+	"minideb",
+	"nanoserver"
+];
+const MINIMAL_BASE_SEGMENT_RE = /(?:^|[/_. -])(?:minimal|micro)(?:$|[/_. -])/u;
 const preferSlimBase = {
 	category: "Image Size",
 	check(instructions, file) {
 		const diagnostics = [];
 		const stageAliases = collectStageAliases(instructions);
-		for (const inst of instructions) if (inst.instruction === "FROM") {
-			const imagePart = parseFromArgs(inst.args).base;
+		for (const { from } of shippedStages(collectStages(instructions))) {
+			const imagePart = parseFromArgs(from.args).base;
 			if (!imagePart || isScratch(imagePart)) continue;
 			const ref = parseImageRef(imagePart);
 			if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) continue;
@@ -1164,7 +1343,7 @@ const preferSlimBase = {
 			if (ref.digest) continue;
 			if (!ref.tag) continue;
 			const haystack = `${ref.name} ${ref.tag}`.toLowerCase();
-			if (!(haystack.includes("alpine") || haystack.includes("slim") || haystack.includes("distroless") || haystack.includes("busybox"))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
+			if (!(MINIMAL_BASE_MARKERS.some((marker) => haystack.includes(marker)) || MINIMAL_BASE_SEGMENT_RE.test(haystack))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, from.line));
 		}
 		return diagnostics;
 	},
@@ -1176,6 +1355,8 @@ const preferSlimBase = {
 const BUILDKIT_MOUNT_FLAG_RE = /--mount=(?<spec>\S+)/gu;
 const CACHE_TARGET_KEY_RE = /^(?:target|dst|destination)=/u;
 const cacheMountTargets = (args) => [...args.matchAll(BUILDKIT_MOUNT_FLAG_RE)].map((match) => (match.groups?.spec ?? "").split(",")).filter((options) => options.includes("type=cache")).flatMap((options) => options.filter((option) => CACHE_TARGET_KEY_RE.test(option)).map((option) => option.slice(option.indexOf("=") + 1)));
+const RECURSIVE_RM_RE = /\brm\s+(?:-[A-Za-z]+\s+)*-[A-Za-z]*[rR][A-Za-z]*\s(?<operands>[^;&|]*)/gu;
+const removesRecursively = (args, dir) => [...args.matchAll(RECURSIVE_RM_RE)].some((match) => (match.groups?.operands ?? "").includes(dir));
 const APT_CACHE_DIRS = ["/var/lib/apt", "/var/cache/apt"];
 const APK_CACHE_DIRS = ["/var/cache/apk", "/etc/apk/cache"];
 const hasCacheMountFor = (args, cacheDirs) => cacheMountTargets(args).some((target) => cacheDirs.some((dir) => target === dir || target.startsWith(`${dir}/`)));
@@ -1185,8 +1366,8 @@ const cleanPackageCache = {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const { args } = inst;
-			if (args.includes("apt-get install") && !args.includes("rm -rf /var/lib/apt/lists") && !hasCacheMountFor(args, APT_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
-			if (args.includes("apk add") && !args.includes("--no-cache") && !args.includes("rm -rf /var/cache/apk") && !hasCacheMountFor(args, APK_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
+			if (hasAptGetInstall(args) && !removesRecursively(args, "/var/lib/apt/lists") && !hasCacheMountFor(args, APT_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
+			if (args.includes("apk add") && !args.includes("--no-cache") && !removesRecursively(args, "/var/cache/apk") && !hasCacheMountFor(args, APK_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -1195,36 +1376,51 @@ const cleanPackageCache = {
 	key: "docker-doctor/clean-package-cache",
 	message: "Clean up package manager cache in the same RUN layer"
 };
-const installsDevDependencies = (args) => (args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install")) && !args.includes("--production") && !args.includes("--omit=dev") && !args.includes("prune");
+const SHELL_SEPARATOR_RE = /\s*(?:&&|\|\||;|\|)\s*/u;
+const WHITESPACE_RE = /\s+/u;
+const ENV_ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=/u;
+const NODE_PACKAGE_MANAGERS = /* @__PURE__ */ new Set([
+	"npm",
+	"yarn",
+	"pnpm",
+	"bun"
+]);
+const INSTALL_VERBS = /* @__PURE__ */ new Set([
+	"install",
+	"ci",
+	"i"
+]);
+const NON_DEV_INSTALL_FLAGS = /* @__PURE__ */ new Set([
+	"-g",
+	"--global",
+	"--production",
+	"--production=true",
+	"--omit=dev",
+	"--only=prod",
+	"--only=production",
+	"--prod",
+	"-P",
+	"-p"
+]);
+const segmentInstallsDevDependencies = (segment) => {
+	const tokens = segment.split(WHITESPACE_RE).filter(Boolean);
+	const commandStart = tokens.findIndex((token) => !ENV_ASSIGNMENT_RE.test(token));
+	if (commandStart === -1) return false;
+	const [manager, verb, ...options] = tokens.slice(commandStart);
+	if (!(NODE_PACKAGE_MANAGERS.has(manager) && INSTALL_VERBS.has(verb))) return false;
+	return !tokens.slice(0, commandStart).includes("NODE_ENV=production") && options.every((option) => option.startsWith("-") && !NON_DEV_INSTALL_FLAGS.has(option));
+};
+const installsDevDependencies = (args) => !args.includes("prune") && maskQuotedText(stripRunFlags(args)).split(SHELL_SEPARATOR_RE).some(segmentInstallsDevDependencies);
 const avoidDevDependencies = {
 	category: "Image Size",
 	check(instructions, file) {
 		const diagnostics = [];
-		const stages = [];
-		for (const inst of instructions) if (inst.instruction === "FROM") {
-			const { base, stage } = parseFromArgs(inst.args);
-			stages.push({
-				base: base?.toLowerCase() ?? "",
-				name: stage?.toLowerCase() ?? null,
-				runs: []
-			});
-		} else if (inst.instruction === "RUN" && stages.length > 0) stages.at(-1)?.runs.push(inst);
-		if (stages.length === 0) return diagnostics;
-		const auditedIndices = [];
-		let index = stages.length - 1;
-		while (index >= 0) {
-			auditedIndices.push(index);
-			const { base } = stages[index];
-			index = stages.slice(0, index).findIndex((s) => s.name !== null && s.name === base);
-		}
-		const finalIndex = stages.length - 1;
-		for (const stageIndex of auditedIndices.toReversed()) {
-			const stage = stages[stageIndex];
-			for (const inst of stage.runs) {
-				if (!installsDevDependencies(inst.args)) continue;
-				const where = stageIndex === finalIndex ? "in the final stage" : `in stage '${stage.name}', whose layers the final stage inherits,`;
-				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' ${where} without omitting devDependencies.`, this.help, inst.line));
-			}
+		const stages = collectStages(instructions);
+		const finalStage = stages.at(-1);
+		for (const stage of shippedStages(stages)) for (const inst of stage.runs) {
+			if (!installsDevDependencies(inst.args)) continue;
+			const where = stage === finalStage ? "in the final stage" : `in stage '${stage.name}', whose layers the final stage inherits,`;
+			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' ${where} without omitting devDependencies.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -1241,11 +1437,12 @@ const imageSizeRules = [
 
 //#endregion
 //#region ../core/src/rules/performance.ts
+const BUILD_TOOL_COMMAND_RE = /(?:^|&&|\|\||;|\||\(|`|\$\()\s*(?:make|cmake)(?=\s|$)/u;
 const useMultiStage = {
 	category: "Performance",
 	check(instructions, file) {
 		if (instructions.filter((inst) => inst.instruction === "FROM").length === 1) {
-			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || inst.args.includes("make")))) return [createDiagnostic(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
+			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || BUILD_TOOL_COMMAND_RE.test(maskQuotedText(stripRunFlags(inst.args)))))) return [createDiagnostic(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
 		}
 		return [];
 	},
@@ -1304,7 +1501,8 @@ const hasDockerignoreFor = (dockerfilePath, projectFiles) => {
 	const lastSlash = dockerfilePath.lastIndexOf("/");
 	const dir = lastSlash === -1 ? "" : dockerfilePath.slice(0, lastSlash);
 	const adjacent = dir === "" ? ".dockerignore" : `${dir}/.dockerignore`;
-	return projectFiles.some((f) => f === adjacent || f === ".dockerignore");
+	const perDockerfile = `${dockerfilePath}.dockerignore`;
+	return projectFiles.some((f) => f === adjacent || f === perDockerfile || f === ".dockerignore");
 };
 const useDockerignore = {
 	category: "Performance",
@@ -1347,7 +1545,7 @@ const noRootUser = {
 		let lastUserLine = 1;
 		for (const inst of instructions) if (inst.instruction === "FROM") {
 			const { base, stage } = parseFromArgs(inst.args);
-			const baseDefaultUser = base && isHardenedRuntimeImage(base) ? "nonroot" : "root";
+			const baseDefaultUser = base && (isHardenedRuntimeImage(base) || isDistrolessNonroot(base)) ? "nonroot" : "root";
 			lastUser = stageUser.get(base?.toLowerCase() ?? "") ?? baseDefaultUser;
 			lastUserLine = inst.line;
 			currentStage = stage?.toLowerCase() ?? null;
@@ -1426,14 +1624,16 @@ const noAddRemote = {
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "ADD") {
-			const src = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
-			if (!src) continue;
+			const parts = inst.args.split(/\s+/u);
+			const src = parts.find((p) => !p.startsWith("--"));
+			const isVerified = parts.some((p) => p.startsWith("--checksum="));
+			if (!src || isVerified) continue;
 			if (src.startsWith("http://") || src.startsWith("https://")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `ADD instruction uses a remote URL '${src}'. Remote files added via ADD cannot be cleaned up in later layers, increasing image size.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Use `RUN curl` or `RUN wget` instead of ADD for remote URLs, and delete the downloaded archive in the same layer to minimize size.",
+	help: "Add `--checksum=sha256:<digest>` so BuildKit verifies the download, or use `RUN curl` or `RUN wget` and delete the downloaded archive in the same layer to minimize size.",
 	key: "docker-doctor/no-add-remote",
 	message: "Avoid using ADD with remote URLs"
 };
@@ -1617,7 +1817,7 @@ const importConfig = async (filePath) => {
 	if (filePath.endsWith(".json")) return parseConfigFile(filePath, "JSON", JSON.parse);
 	if (filePath.endsWith(".yaml") || filePath.endsWith(".yml")) return parseConfigFile(filePath, "YAML", yaml.parse);
 	try {
-		const configModule = await import(filePath);
+		const configModule = await import((0, node_url.pathToFileURL)(filePath).href);
 		return configModule.default || configModule;
 	} catch (error) {
 		const reason = typeStrippingFailure(filePath, error);
@@ -1716,13 +1916,13 @@ const calculateScore = (diagnostics) => {
 
 //#endregion
 //#region ../core/src/report.ts
-const REPORT_SCHEMA_VERSION = 3;
+const REPORT_SCHEMA_VERSION = 4;
 const resolveCategory = (diagnostic) => {
 	const category = diagnostic.category ?? findRule(diagnostic.rule)?.category;
 	if (!category) throw new Error(`Diagnostic for unknown rule "${diagnostic.rule}" has no category`);
 	return category;
 };
-const toJsonReport = (diagnostics, score, label, project) => ({
+const toJsonReport = (diagnostics, score, label, project, failures = []) => ({
 	diagnostics: diagnostics.map((d) => ({
 		category: resolveCategory(d),
 		column: d.column,
@@ -1733,9 +1933,13 @@ const toJsonReport = (diagnostics, score, label, project) => ({
 		rule: d.rule,
 		severity: d.severity
 	})),
+	failures: failures.map(({ file, message }) => ({
+		file,
+		message
+	})),
 	label,
 	project,
-	schemaVersion: 3,
+	schemaVersion: 4,
 	score,
 	timestamp: (/* @__PURE__ */ new Date()).toISOString()
 });
@@ -1819,4 +2023,4 @@ Object.defineProperty(exports, 'version', {
     return version;
   }
 });
-//# sourceMappingURL=src-D4rVJg36.cjs.map
+//# sourceMappingURL=src-C7XK6Kp-.cjs.map