react-doctor 0.5.8-dev.31c0657 → 0.5.8-dev.5774deb

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/dist/cli.js +299 -91
  2. package/dist/index.js +179 -66
  3. package/dist/lsp.js +180 -66
  4. package/package.json +2 -2
package/dist/lsp.js CHANGED
@@ -6021,7 +6021,7 @@ const composePassthrough = /* @__PURE__ */ dual(2, (left, right) => (input) => {
6021
6021
  * @since 2.0.0
6022
6022
  */
6023
6023
  const Scheduler = /* @__PURE__ */ Reference("effect/Scheduler", { defaultValue: () => new MixedScheduler() });
6024
- const setImmediate = "setImmediate" in globalThis ? (f) => {
6024
+ const setImmediate$1 = "setImmediate" in globalThis ? (f) => {
6025
6025
  const timer = globalThis.setImmediate(f);
6026
6026
  return () => globalThis.clearImmediate(timer);
6027
6027
  } : (f) => {
@@ -6065,7 +6065,7 @@ var PriorityBuckets = class {
6065
6065
  var MixedScheduler = class {
6066
6066
  executionMode;
6067
6067
  setImmediate;
6068
- constructor(executionMode = "async", setImmediateFn = setImmediate) {
6068
+ constructor(executionMode = "async", setImmediateFn = setImmediate$1) {
6069
6069
  this.executionMode = executionMode;
6070
6070
  this.setImmediate = setImmediateFn;
6071
6071
  }
@@ -6090,7 +6090,7 @@ var MixedSchedulerDispatcher = class {
6090
6090
  tasks = /* @__PURE__ */ new PriorityBuckets();
6091
6091
  running = void 0;
6092
6092
  setImmediate;
6093
- constructor(setImmediateFn = setImmediate) {
6093
+ constructor(setImmediateFn = setImmediate$1) {
6094
6094
  this.setImmediate = setImmediateFn;
6095
6095
  }
6096
6096
  /**
@@ -33730,6 +33730,7 @@ const MILLISECONDS_PER_SECOND = 1e3;
33730
33730
  const SCORE_API_URL = "https://www.react.doctor/api/score";
33731
33731
  const FETCH_TIMEOUT_MS = 1e4;
33732
33732
  const GITHUB_VIEWER_PERMISSION_TIMEOUT_MS = 2e3;
33733
+ const SPAWN_ARGS_MAX_LENGTH_CHARS = 24e3;
33733
33734
  const PER_WORKER_MEM_BUDGET_BYTES = 1024 * 1024 * 1024;
33734
33735
  const DEFAULT_BRANCH_CANDIDATES = ["main", "master"];
33735
33736
  const ADOPTABLE_LINT_CONFIG_FILENAMES = [".oxlintrc.json", ".eslintrc.json"];
@@ -33810,6 +33811,7 @@ const DEAD_CODE_PHASE_TIMEOUT_MS = 15e4;
33810
33811
  const LINT_PHASE_TIMEOUT_MS = 3e5;
33811
33812
  const SCAN_TOTAL_DEADLINE_MS = 9e5;
33812
33813
  const DEAD_CODE_WORKER_MAX_OLD_SPACE_MB = 8192;
33814
+ const DEAD_CODE_WORKER_MEM_BUDGET_BYTES = 2 * 1024 * 1024 * 1024;
33813
33815
  const DEAD_CODE_TIMEOUT_CEILING_MS = 6e5;
33814
33816
  const DEAD_CODE_PHASE_TIMEOUT_OVER_WORKER_MS = 3e4;
33815
33817
  const DEAD_CODE_OVERLAP_PARSE_SHARE = .4;
@@ -34546,7 +34548,10 @@ for (const [legacyRuleKey, nativeRuleKey] of Object.entries(LEGACY_RULE_KEY_TO_N
34546
34548
  NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS.set(nativeRuleKey, aliases);
34547
34549
  }
34548
34550
  const getLegacyRuleKeysForNative = (ruleKey) => NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS.get(ruleKey) ?? [];
34549
- const canonicalizeRuleKey = (ruleKey) => LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY[ruleKey] ?? ruleKey;
34551
+ const canonicalizeRuleKey = (ruleKey) => {
34552
+ const nativeRuleKey = LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY[ruleKey];
34553
+ return typeof nativeRuleKey === "string" ? nativeRuleKey : ruleKey;
34554
+ };
34550
34555
  const isReactDoctorShortIdOf = (bareRuleKey, qualifiedRuleKey) => !bareRuleKey.includes("/") && qualifiedRuleKey === `react-doctor/${bareRuleKey}`;
34551
34556
  const isSameRuleKey = (candidateRuleKey, targetRuleKey) => {
34552
34557
  const canonicalCandidate = canonicalizeRuleKey(candidateRuleKey);
@@ -35398,7 +35403,7 @@ const resolveScanConcurrency = (requested) => {
35398
35403
  if (!Number.isFinite(requested) || requested < 1) return 1;
35399
35404
  return Math.min(Math.floor(requested), 32);
35400
35405
  };
35401
- const readSystemFacts = () => ({
35406
+ const readSystemFacts$1 = () => ({
35402
35407
  availableCores: os.availableParallelism(),
35403
35408
  totalMemoryBytes: os.totalmem(),
35404
35409
  cgroupMemoryLimitBytes: readCgroupMemoryLimitBytes()
@@ -35419,7 +35424,7 @@ const readSystemFacts = () => ({
35419
35424
  * `facts` is injectable so tests exercise core-bound, memory-bound, cgroup-
35420
35425
  * limited, and ceiling cases without mocking `os` or the filesystem.
35421
35426
  */
35422
- const resolveAutoScanConcurrency = (facts = readSystemFacts()) => {
35427
+ const resolveAutoScanConcurrency = (facts = readSystemFacts$1()) => {
35423
35428
  const availableMemoryBytes = Math.min(facts.totalMemoryBytes, facts.cgroupMemoryLimitBytes ?? Number.POSITIVE_INFINITY);
35424
35429
  const memoryBoundedWorkers = Math.floor(availableMemoryBytes / PER_WORKER_MEM_BUDGET_BYTES);
35425
35430
  return resolveScanConcurrency(Math.min(facts.availableCores, memoryBoundedWorkers));
@@ -35610,6 +35615,12 @@ const BOOLEAN_FIELD_NAMES = [
35610
35615
  "adoptExistingLintConfig"
35611
35616
  ];
35612
35617
  const STRING_FIELD_NAMES = ["rootDir"];
35618
+ const STRING_ARRAY_FIELD_NAMES = [
35619
+ "projects",
35620
+ "textComponents",
35621
+ "rawTextWrapperComponents",
35622
+ "serverAuthFunctionNames"
35623
+ ];
35613
35624
  const SURFACE_CONTROL_FIELD_NAMES = [
35614
35625
  "includeTags",
35615
35626
  "excludeTags",
@@ -35711,6 +35722,7 @@ const validateConfigTypes = (config) => {
35711
35722
  const validated = { ...config };
35712
35723
  for (const fieldName of BOOLEAN_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => coerceMaybeBooleanString(fieldName, value));
35713
35724
  for (const fieldName of STRING_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateString(fieldName, value));
35725
+ for (const fieldName of STRING_ARRAY_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateStringArrayField(fieldName, value));
35714
35726
  applyFieldValidator(config, validated, "surfaces", validateSurfacesField);
35715
35727
  for (const fieldName of SEVERITY_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateSeverityMap(fieldName, value, fieldName === "categories"));
35716
35728
  applyFieldValidator(config, validated, "plugins", (value) => validateStringArrayField("plugins", value));
@@ -36897,7 +36909,10 @@ const shouldEnableRule = (requires, tags, capabilities, ignoredTags, disabledBy)
36897
36909
  }
36898
36910
  return true;
36899
36911
  };
36900
- const checkSecurityScan = (rootDirectory, options = {}) => {
36912
+ const yieldToEventLoop = () => new Promise((resolve) => {
36913
+ setImmediate(resolve);
36914
+ });
36915
+ const createSecurityScanSession = (rootDirectory, options) => {
36901
36916
  const capabilities = options.project ? buildCapabilities(options.project) : /* @__PURE__ */ new Set();
36902
36917
  const ignoredTags = options.ignoredTags ?? /* @__PURE__ */ new Set();
36903
36918
  const enabledScanRules = REACT_DOCTOR_RULES.flatMap((entry) => {
@@ -36912,7 +36927,7 @@ const checkSecurityScan = (rootDirectory, options = {}) => {
36912
36927
  committedFilesOnly: rule.committedFilesOnly === true
36913
36928
  }];
36914
36929
  });
36915
- if (enabledScanRules.length === 0) return [];
36930
+ if (enabledScanRules.length === 0) return null;
36916
36931
  const diagnostics = [];
36917
36932
  const seen = /* @__PURE__ */ new Set();
36918
36933
  const gitIgnoredCache = /* @__PURE__ */ new Map();
@@ -36924,15 +36939,34 @@ const checkSecurityScan = (rootDirectory, options = {}) => {
36924
36939
  }
36925
36940
  return status === true;
36926
36941
  };
36927
- for (const file of collectSecurityScanFiles(rootDirectory)) for (const { entry, scan, committedFilesOnly } of enabledScanRules) for (const finding of scan(file)) {
36928
- if (committedFilesOnly && isFileGitIgnored(file)) continue;
36929
- const diagnostic = buildSecurityScanDiagnostic(finding, entry, file.relativePath);
36930
- const key = `${diagnostic.rule}:${diagnostic.filePath}:${diagnostic.line}:${diagnostic.column}:${diagnostic.message}`;
36931
- if (seen.has(key)) continue;
36932
- seen.add(key);
36933
- diagnostics.push(diagnostic);
36942
+ const scanFile = (file) => {
36943
+ for (const { entry, scan, committedFilesOnly } of enabledScanRules) for (const finding of scan(file)) {
36944
+ if (committedFilesOnly && isFileGitIgnored(file)) continue;
36945
+ const diagnostic = buildSecurityScanDiagnostic(finding, entry, file.relativePath);
36946
+ const key = `${diagnostic.rule}:${diagnostic.filePath}:${diagnostic.line}:${diagnostic.column}:${diagnostic.message}`;
36947
+ if (seen.has(key)) continue;
36948
+ seen.add(key);
36949
+ diagnostics.push(diagnostic);
36950
+ }
36951
+ };
36952
+ return {
36953
+ scanFile,
36954
+ diagnostics
36955
+ };
36956
+ };
36957
+ const checkSecurityScanCooperative = async (rootDirectory, options = {}) => {
36958
+ const session = createSecurityScanSession(rootDirectory, options);
36959
+ if (session === null) return [];
36960
+ let filesSinceYield = 0;
36961
+ for (const file of collectSecurityScanFiles(rootDirectory)) {
36962
+ session.scanFile(file);
36963
+ filesSinceYield += 1;
36964
+ if (filesSinceYield >= 16) {
36965
+ filesSinceYield = 0;
36966
+ await yieldToEventLoop();
36967
+ }
36934
36968
  }
36935
- return diagnostics;
36969
+ return session.diagnostics;
36936
36970
  };
36937
36971
  var import_picocolors = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
36938
36972
  let p = process || {}, argv = p.argv || [], env = p.env || {};
@@ -37149,6 +37183,74 @@ const collectDeadCodeIgnorePatterns = (rootDirectory) => {
37149
37183
  return [...seen].filter((pattern) => pattern.length > 0);
37150
37184
  };
37151
37185
  const collectDeadCodeEntryPatterns = (rootDirectory) => [...new Set(collectKnipPatterns(rootDirectory, "entry"))].filter((pattern) => pattern.length > 0);
37186
+ const readSystemFacts = () => ({
37187
+ availableCores: os.availableParallelism(),
37188
+ totalMemoryBytes: os.totalmem(),
37189
+ cgroupMemoryLimitBytes: readCgroupMemoryLimitBytes()
37190
+ });
37191
+ /**
37192
+ * How many real deslop dead-code child processes may run at once, across the
37193
+ * concurrent per-project `runInspect` fibers of one CLI run. The cap is the
37194
+ * smaller of the core count and the number of `DEAD_CODE_WORKER_MEM_BUDGET_BYTES`
37195
+ * workers that fit in available memory, floored at 1.
37196
+ *
37197
+ * On a roomy dev box / CI runner this resolves high enough that every
37198
+ * concurrently-scanned project still spawns its own worker (no serialization vs
37199
+ * the prior uncapped behavior); on a memory-constrained runner it collapses
37200
+ * toward 1, so the `withDeadCodeWorkerSlot` semaphore serializes the spawns
37201
+ * instead of oversubscribing memory with N simultaneous children — the global
37202
+ * cap the per-project spawn path lacked.
37203
+ *
37204
+ * Mirrors `resolveAutoScanConcurrency` (lint), but budgets memory per the
37205
+ * heavier dead-code worker. `facts` is injectable for tests.
37206
+ */
37207
+ const resolveDeadCodeConcurrency = (facts = readSystemFacts()) => {
37208
+ const availableMemoryBytes = Math.min(facts.totalMemoryBytes, facts.cgroupMemoryLimitBytes ?? Number.POSITIVE_INFINITY);
37209
+ const memoryBoundedWorkers = Math.floor(availableMemoryBytes / DEAD_CODE_WORKER_MEM_BUDGET_BYTES);
37210
+ return Math.max(1, Math.min(facts.availableCores, memoryBoundedWorkers));
37211
+ };
37212
+ let availableSlots = -1;
37213
+ const waiters = [];
37214
+ const releaseSlot = () => {
37215
+ const nextWaiter = waiters.shift();
37216
+ if (nextWaiter !== void 0) nextWaiter();
37217
+ else availableSlots += 1;
37218
+ };
37219
+ /**
37220
+ * Runs `task` once a dead-code worker slot is free, releasing the slot when the
37221
+ * task settles (success or failure). With a high cap (roomy machine) every
37222
+ * caller proceeds immediately; with a low cap (constrained runner) callers
37223
+ * queue and run as slots free.
37224
+ *
37225
+ * `abortSignal` short-circuits the WAIT: if it's already aborted, or fires while
37226
+ * this caller is queued, the call rejects without acquiring a slot or running
37227
+ * `task` — so a cancelled scan (e.g. lint failed) doesn't sit in the queue and
37228
+ * then spawn a child only to tear it down. A queued caller that aborts removes
37229
+ * its own waiter so a later release never hands a slot to a dead request.
37230
+ */
37231
+ const withDeadCodeWorkerSlot = async (task, abortSignal) => {
37232
+ if (abortSignal?.aborted) throw new Error("Dead-code worker aborted.");
37233
+ if (availableSlots < 0) availableSlots = resolveDeadCodeConcurrency();
37234
+ if (availableSlots > 0) availableSlots -= 1;
37235
+ else await new Promise((resolve, reject) => {
37236
+ const waiter = () => {
37237
+ abortSignal?.removeEventListener("abort", onAbort);
37238
+ resolve();
37239
+ };
37240
+ const onAbort = () => {
37241
+ const queuedIndex = waiters.indexOf(waiter);
37242
+ if (queuedIndex !== -1) waiters.splice(queuedIndex, 1);
37243
+ reject(/* @__PURE__ */ new Error("Dead-code worker aborted."));
37244
+ };
37245
+ waiters.push(waiter);
37246
+ abortSignal?.addEventListener("abort", onAbort, { once: true });
37247
+ });
37248
+ try {
37249
+ return await task();
37250
+ } finally {
37251
+ releaseSlot();
37252
+ }
37253
+ };
37152
37254
  /**
37153
37255
  * Resolves a path to its canonical, symlink-free form, falling back to
37154
37256
  * the input when it cannot be realpath'd (broken symlink, permission
@@ -37439,14 +37541,17 @@ const checkDeadCode = async (options) => {
37439
37541
  if (!NFS.existsSync(Path.join(rootDirectory, "package.json"))) return [];
37440
37542
  const entryPatterns = collectDeadCodeEntryPatterns(rootDirectory);
37441
37543
  const ignorePatterns = collectDeadCodeIgnorePatterns(rootDirectory);
37442
- const result = parseDeadCodeWorkerResult(await runDeadCodeWorkerWithTimeout((options.createWorker ?? createDeadCodeWorker)({
37443
- rootDirectory,
37444
- entryPatterns,
37445
- tsConfigPath: resolveTsConfigPath(rootDirectory),
37446
- ignorePatterns,
37447
- deslopJsModuleSpecifier: options.deslopJsModuleSpecifier ?? import.meta.resolve("deslop-js"),
37448
- parseConcurrency: options.parseConcurrency
37449
- }), options.workerTimeoutMs ?? 12e4, options.abortSignal));
37544
+ const spawnAndRun = () => {
37545
+ return runDeadCodeWorkerWithTimeout((options.createWorker ?? createDeadCodeWorker)({
37546
+ rootDirectory,
37547
+ entryPatterns,
37548
+ tsConfigPath: resolveTsConfigPath(rootDirectory),
37549
+ ignorePatterns,
37550
+ deslopJsModuleSpecifier: options.deslopJsModuleSpecifier ?? import.meta.resolve("deslop-js"),
37551
+ parseConcurrency: options.parseConcurrency
37552
+ }), options.workerTimeoutMs ?? 12e4, options.abortSignal);
37553
+ };
37554
+ const result = parseDeadCodeWorkerResult(options.createWorker === void 0 ? await withDeadCodeWorkerSlot(spawnAndRun, options.abortSignal) : await spawnAndRun());
37450
37555
  const toRelative = (filePath) => toRelativeFilePath(rootDirectory, filePath);
37451
37556
  const diagnostics = [];
37452
37557
  for (const unusedFile of result.unusedFiles) diagnostics.push({
@@ -37847,43 +37952,46 @@ var Git = class Git extends Service()("react-doctor/Git") {
37847
37952
  * reason: GitInvocationFailed })` so the rest of the codebase
37848
37953
  * sees a single failure channel.
37849
37954
  */
37850
- const runCommand = (input) => scoped(gen(function* () {
37851
- const handle = yield* spawner.spawn(make$1(input.command, [...input.args], {
37852
- cwd: input.directory,
37853
- env: input.env,
37854
- extendEnv: true
37855
- }));
37856
- const maxStdoutBytes = input.maxStdoutBytes;
37857
- const stdoutByteCount = yield* make$13(0);
37858
- const [stdout, stderr, status] = yield* all([
37859
- mkString(decodeText(maxStdoutBytes === void 0 ? handle.stdout : handle.stdout.pipe(tap((chunk) => updateAndGet(stdoutByteCount, (total) => total + chunk.length).pipe(flatMap$2((total) => total > maxStdoutBytes ? fail$4(new ReactDoctorError({ reason: new GitInvocationFailed({
37860
- args: [...input.args],
37861
- directory: input.directory,
37862
- cause: /* @__PURE__ */ new Error(`git stdout exceeded ${maxStdoutBytes} bytes`)
37863
- }) })) : void_)))))),
37864
- mkString(decodeText(handle.stderr)),
37865
- handle.exitCode
37866
- ], { concurrency: 3 });
37867
- return {
37868
- status,
37869
- stdout,
37870
- stderr
37871
- };
37872
- })).pipe(catchTag$1("PlatformError", (cause) => {
37873
- if (input.command !== "git") return succeed$2({
37955
+ const runCommand = (input) => {
37956
+ const foldSpawnFailure = (cause) => input.command !== "git" ? succeed$2({
37874
37957
  status: 127,
37875
37958
  stdout: "",
37876
37959
  stderr: String(cause)
37877
- });
37878
- return new ReactDoctorError({ reason: new GitInvocationFailed({
37960
+ }) : fail$4(new ReactDoctorError({ reason: new GitInvocationFailed({
37879
37961
  args: [...input.args],
37880
37962
  directory: input.directory,
37881
37963
  cause
37882
- }) });
37883
- }), withSpan("git.exec", { attributes: {
37884
- "git.command": input.command,
37885
- "git.subcommand": input.args[0] ?? ""
37886
- } }));
37964
+ }) }));
37965
+ return scoped(gen(function* () {
37966
+ if (!isDirectory(input.directory)) return yield* foldSpawnFailure(`spawn ENOTDIR (cwd is not a directory: ${input.directory})`);
37967
+ const argvLengthChars = input.command.length + 1 + input.args.reduce((total, arg) => total + arg.length + 1, 0);
37968
+ if (argvLengthChars > 24e3) return yield* foldSpawnFailure(`spawn ENAMETOOLONG (${argvLengthChars} argv chars exceed ${SPAWN_ARGS_MAX_LENGTH_CHARS})`);
37969
+ const handle = yield* spawner.spawn(make$1(input.command, [...input.args], {
37970
+ cwd: input.directory,
37971
+ env: input.env,
37972
+ extendEnv: true
37973
+ }));
37974
+ const maxStdoutBytes = input.maxStdoutBytes;
37975
+ const stdoutByteCount = yield* make$13(0);
37976
+ const [stdout, stderr, status] = yield* all([
37977
+ mkString(decodeText(maxStdoutBytes === void 0 ? handle.stdout : handle.stdout.pipe(tap((chunk) => updateAndGet(stdoutByteCount, (total) => total + chunk.length).pipe(flatMap$2((total) => total > maxStdoutBytes ? fail$4(new ReactDoctorError({ reason: new GitInvocationFailed({
37978
+ args: [...input.args],
37979
+ directory: input.directory,
37980
+ cause: /* @__PURE__ */ new Error(`git stdout exceeded ${maxStdoutBytes} bytes`)
37981
+ }) })) : void_)))))),
37982
+ mkString(decodeText(handle.stderr)),
37983
+ handle.exitCode
37984
+ ], { concurrency: 3 });
37985
+ return {
37986
+ status,
37987
+ stdout,
37988
+ stderr
37989
+ };
37990
+ })).pipe(catchTag$1("PlatformError", foldSpawnFailure), withSpan("git.exec", { attributes: {
37991
+ "git.command": input.command,
37992
+ "git.subcommand": input.args[0] ?? ""
37993
+ } }));
37994
+ };
37887
37995
  const runGit = (directory, args) => runCommand({
37888
37996
  command: "git",
37889
37997
  args,
@@ -37916,7 +38024,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
37916
38024
  "rev-parse",
37917
38025
  "--verify",
37918
38026
  branch
37919
- ]).pipe(map$3((result) => result.status === 0));
38027
+ ]).pipe(map$3((result) => result.status === 0), catch_$1((error) => error.reason._tag === "GitInvocationFailed" ? succeed$2(false) : fail$4(error)));
37920
38028
  const headSha = (directory) => runGit(directory, ["rev-parse", "HEAD"]).pipe(map$3((result) => result.status === 0 ? trimOrNull(result.stdout) : null));
37921
38029
  const mergeBase = (input) => isSafeGitRevision(input.ref) ? runGit(input.directory, [
37922
38030
  "merge-base",
@@ -38130,7 +38238,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
38130
38238
  ]);
38131
38239
  if (result.status !== 0) return null;
38132
38240
  return parseChangedLineRanges(result.stdout);
38133
- }).pipe(withSpan("Git.changedLineRanges"))
38241
+ }).pipe(catch_$1((error) => error.reason._tag === "GitInvocationFailed" ? succeed$2(null) : fail$4(error)), withSpan("Git.changedLineRanges"))
38134
38242
  });
38135
38243
  })).pipe(provide$2(layer$2.pipe(provide$2(mergeAll$1(layer$1, layer)))));
38136
38244
  /**
@@ -40607,7 +40715,10 @@ const formatLintFailText = (reasonTag, nodeVersion) => {
40607
40715
  * diagnostics).
40608
40716
  * 2. beforeLint hook (e.g. CLI renders the project-detection block)
40609
40717
  * 3. environment checks (reduced-motion + pnpm hardening +
40610
- * expo/react-native + security scan), collected synchronously
40718
+ * expo/react-native), collected synchronously. The heavier
40719
+ * content-regex security scan is forked instead (like supply-chain
40720
+ * below) and joined before the concat, so its CPU overlaps lint
40721
+ * rather than blocking the event loop before it.
40611
40722
  * 4. The supply-chain check (Socket.dev) is forked onto a background
40612
40723
  * fiber so its ~100% network-bound time overlaps the ~100%
40613
40724
  * CPU/subprocess-bound lint pass below, collapsing two serial
@@ -40627,7 +40738,7 @@ const formatLintFailText = (reasonTag, nodeVersion) => {
40627
40738
  * order, so terminal output is identical either way; supply-chain
40628
40739
  * rides alongside without a spinner.
40629
40740
  * 6. Join the supply-chain fiber, then assemble the diagnostics in a
40630
- * FIXED order (env, supply-chain, lint, dead-code) so the output is
40741
+ * FIXED order (env, security-scan, supply-chain, lint, dead-code) so the output is
40631
40742
  * byte-identical regardless of which fiber settled first. The
40632
40743
  * viewer-permission fiber is joined later, during score-metadata
40633
40744
  * assembly (it feeds score metadata, not diagnostics). The per-element
@@ -40688,12 +40799,12 @@ const runInspect = (input, hooks = {}) => gen(function* () {
40688
40799
  ...checkPnpmHardening(scanDirectory),
40689
40800
  ...checkReactServerComponentsAdvisory(scanDirectory, project),
40690
40801
  ...checkExpoProject(scanDirectory, project),
40691
- ...checkReactNativeProject(scanDirectory, project),
40692
- ...checkSecurityScan(scanDirectory, {
40693
- project,
40694
- ignoredTags: input.ignoredTags
40695
- })
40802
+ ...checkReactNativeProject(scanDirectory, project)
40696
40803
  ])));
40804
+ const securityScanFiber = yield* forkChild(runCollect(applyPerElementPipeline(isDiffMode ? empty$4 : unwrap(promise(() => checkSecurityScanCooperative(scanDirectory, {
40805
+ project,
40806
+ ignoredTags: input.ignoredTags
40807
+ })).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)))))).pipe(withSpan("SecurityScan.run")));
40697
40808
  const shouldRunSupplyChain = !isDiffMode || (input.supplyChainManifestChanged ?? false);
40698
40809
  const supplyChainOverlapTimeout = yield* SupplyChainOverlapTimeoutMs;
40699
40810
  const supplyChainFiber = yield* forkChild(shouldRunSupplyChain ? runCollect(applyPerElementPipeline(supplyChainService.run({
@@ -40829,9 +40940,11 @@ const runInspect = (input, hooks = {}) => gen(function* () {
40829
40940
  else yield* scanProgress.succeed(`Scanned ${scannedFilesLabel} in ${scanElapsedSeconds}s${workerCountSuffix}`);
40830
40941
  const supplyChainResult = yield* join(supplyChainFiber);
40831
40942
  const supplyChainCollected = supplyChainResult.diagnostics;
40943
+ const securityScanCollected = yield* join(securityScanFiber);
40832
40944
  yield* reporterService.finalize;
40833
40945
  const finalDiagnostics = sortDiagnosticsStable(assignFixGroups([
40834
40946
  ...envCollected,
40947
+ ...securityScanCollected,
40835
40948
  ...supplyChainCollected,
40836
40949
  ...lintCollected,
40837
40950
  ...deadCodeCollected
@@ -42903,6 +43016,7 @@ const SENTRY_FLUSH_TIMEOUT_MS = 2e3;
42903
43016
  const METRIC = {
42904
43017
  cliInvoked: "cli.invoked",
42905
43018
  cliError: "cli.error",
43019
+ cliEnvironmentError: "cli.env_error",
42906
43020
  projectDetected: "project.detected",
42907
43021
  projectPathSelected: "project.path_selected",
42908
43022
  projectConfigSelected: "project.config_selected",
@@ -43249,5 +43363,5 @@ const startLanguageServer = () => {
43249
43363
  };
43250
43364
  //#endregion
43251
43365
  export { startLanguageServer };
43252
- !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9ee72ccc-703c-588f-b7e4-c92657144721")}catch(e){}}();
43253
- //# debugId=9ee72ccc-703c-588f-b7e4-c92657144721
43366
+ !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="bb5309e5-ce90-551d-bf0a-7db0ea302f24")}catch(e){}}();
43367
+ //# debugId=bb5309e5-ce90-551d-bf0a-7db0ea302f24
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "react-doctor",
3
- "version": "0.5.8-dev.31c0657",
3
+ "version": "0.5.8-dev.5774deb",
4
4
  "description": "Your agent writes bad React. This catches it",
5
5
  "keywords": [
6
6
  "accessibility",
@@ -63,7 +63,7 @@
63
63
  "vscode-languageserver": "^9.0.1",
64
64
  "vscode-languageserver-textdocument": "^1.0.12",
65
65
  "vscode-uri": "^3.1.0",
66
- "oxlint-plugin-react-doctor": "0.5.8-dev.31c0657",
66
+ "oxlint-plugin-react-doctor": "0.5.8-dev.5774deb",
67
67
  "deslop-js": "0.5.8"
68
68
  },
69
69
  "devDependencies": {