react-doctor 0.7.0 → 0.7.1-dev.1880b15

package/dist/cli.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="96cac03b-44a6-5d88-a5c9-697a5e8cf45e")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="47338856-c658-5c78-a5e2-e871c2dafaa7")}catch(e){}}();
 import { createRequire } from "node:module";
 import * as NodeChildProcess from "node:child_process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
@@ -22405,6 +22405,7 @@ var Diagnostic = class extends Class("Diagnostic")({
 	endLine: optional(Number$1),
 	endColumn: optional(Number$1),
 	category: String$1,
+	matchByOccurrence: optional(Boolean$1),
 	fileContext: optional(Literals(["test", "story"])),
 	suppressionHint: optional(String$1),
 	relatedLocations: optional(ArraySchema(DiagnosticRelatedLocation)),
@@ -22475,6 +22476,16 @@ var JsonReportV1 = class extends Class("JsonReportV1")({
 	* successful `baseline` run (`schemaVersion: 2`) and on non-compare scopes.
 	*/
 	baselineDegraded: optional(Boolean$1),
+	/**
+	* Whether any scanned project resolved a React-compatible runtime (React
+	* or Preact). `false` means every React-runtime rule family was gated off,
+	* so an empty `diagnostics` array is vacuous — NOT the same as a clean
+	* React scan. Consumers gating on the report (CI, verifiers, hooks) should
+	* treat `reactDetected === false` as "wrong scan target", not "all clear".
+	* Absent when nothing was scanned (`projects` is empty), on error reports,
+	* and on reports from older CLI versions.
+	*/
+	reactDetected: optional(Boolean$1),
 	diff: NullOr(JsonReportDiffInfo),
 	projects: ArraySchema(JsonReportProjectEntry),
 	diagnostics: ArraySchema(Diagnostic),
@@ -22500,6 +22511,8 @@ var JsonReportV2 = class extends Class("JsonReportV2")({
 	ok: Boolean$1,
 	directory: String$1,
 	mode: JsonReportMode,
+	/** See `JsonReportV1.reactDetected`. */
+	reactDetected: optional(Boolean$1),
 	diff: NullOr(JsonReportDiffInfo),
 	baseline: JsonReportBaseline,
 	projects: ArraySchema(JsonReportProjectEntry),
@@ -36108,6 +36121,7 @@ const DIAGNOSTIC_CATEGORY_BUCKETS = [
 	"Accessibility",
 	"Maintainability"
 ];
+const OCCURRENCE_MATCHED_CATEGORIES = new Set(["Accessibility"]);
 const APP_ONLY_RULE_KEYS = new Set([
 	"react-hooks-js/static-components",
 	"react-doctor/no-render-prop-children",
@@ -36130,7 +36144,7 @@ const SOCKET_FREE_USER_AGENT = "react-doctor-supply-chain";
 const FILE_LINT_CACHE_FILENAME = "file-lint-cache.json";
 const FILE_LINT_CACHE_MAX_FILE_COUNT = 5e4;
 const SIDECAR_LINT_CACHE_FILENAME = "sidecar-lint-cache.json";
-const CORE_PACKAGE_VERSION = "0.7.0";
+const CORE_PACKAGE_VERSION = "0.7.1";
 const DEAD_CODE_CACHE_FILENAME = "dead-code-cache.json";
 const DEAD_CODE_SUMMARY_CACHE_FILENAME = "dead-code-summaries.json";
 const SUPPLY_CHAIN_PLUGIN = "socket";
@@ -36248,6 +36262,23 @@ const listSourceFilesViaFilesystem = (rootDirectory) => {
 const listSourceFilesWithSize = (rootDirectory) => collectSizedSourceFiles(rootDirectory, (listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory)).sort());
 const listSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).map((entry) => entry.path);
 const countSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).length;
+/**
+* The chain of ancestor directories of `startDirectory`, nearest first, up to
+* and including the filesystem root. With `includeStart`, the chain begins at
+* `startDirectory` itself; otherwise at its parent. The one place the "walk up
+* the tree" traversal is expressed, so each caller adds only its own match /
+* stop policy instead of re-deriving the `path.dirname` loop.
+*/
+const ancestorDirectories = (startDirectory, { includeStart }) => {
+	const directories = [];
+	let currentDirectory = includeStart ? startDirectory : Path.dirname(startDirectory);
+	while (true) {
+		directories.push(currentDirectory);
+		const parentDirectory = Path.dirname(currentDirectory);
+		if (parentDirectory === currentDirectory) return directories;
+		currentDirectory = parentDirectory;
+	}
+};
 const cachedPackageJsons = /* @__PURE__ */ new Map();
 const readPackageJsonUncached = (packageJsonPath) => {
 	try {
@@ -36278,11 +36309,7 @@ const isMonorepoRoot = (directory) => {
 	return Array.isArray(packageJson.workspaces) || Boolean(packageJson.workspaces?.packages);
 };
 const findMonorepoRoot = (startDirectory) => {
-	let currentDirectory = Path.dirname(startDirectory);
-	while (currentDirectory !== Path.dirname(currentDirectory)) {
-		if (isMonorepoRoot(currentDirectory)) return currentDirectory;
-		currentDirectory = Path.dirname(currentDirectory);
-	}
+	for (const directory of ancestorDirectories(startDirectory, { includeStart: false })) if (isMonorepoRoot(directory)) return directory;
 	return null;
 };
 /**
@@ -36928,6 +36955,74 @@ const findDependencyInfoFromMonorepoRoot = (directory) => {
 		framework: rootInfo.framework !== "unknown" ? rootInfo.framework : workspaceInfo.framework
 	};
 };
+/**
+* Walk up from `startDirectory` to the nearest ancestor that owns a
+* `package.json`, stopping at (and including) the enclosing project boundary
+* — the working tree's git root or a monorepo root. Lets a scan of a package
+* subfolder that has no `package.json` of its own adopt the nearest enclosing
+* package as its project root, so it inherits that package's dependency +
+* framework detection instead of synthesizing an empty (React-blind) project.
+*
+* Generalizes the older monorepo-root-only lookup: the nearest ancestor is the
+* most specific owning package (a leaf workspace, not just the repo root), so
+* a subfolder of one workspace no longer borrows a sibling's capabilities.
+*
+* Returns `null` when no ancestor `package.json` exists inside the project
+* boundary (a loose tree of files, or a subfolder of a package-less repo).
+*/
+const findNearestAncestorPackageJson = (startDirectory) => {
+	if (isProjectBoundary(startDirectory)) return null;
+	for (const directory of ancestorDirectories(startDirectory, { includeStart: false })) {
+		if (isFile(Path.join(directory, "package.json"))) return directory;
+		if (isProjectBoundary(directory)) return null;
+	}
+	return null;
+};
+/**
+* Last-resort React detection: locate React the way Node's `node_modules`
+* resolution would from `directory` — check each `node_modules/react` up the
+* tree — but bounded to the enclosing repo so a globally installed React can't
+* masquerade as the project's version. Stops at (and including) the nearest
+* project boundary — the git root or a monorepo root — and returns the first
+* installed `version`.
+*
+* Makes "React is installed and importable" ⇒ "React is detected" an invariant
+* for packages whose only React declaration is a version-less spec
+* (`workspace:*`, `*`, a dist-tag) or where React lives solely in a hoisted
+* `node_modules` the declaration walks never reach — the profile of a component
+* package inside a monorepo. Matching the `node_modules/react` entry rather than
+* its realpath means a project whose `node_modules` is symlinked elsewhere (a
+* Docker volume, a shared store) still counts, while a global install outside
+* the repo does not.
+*
+* Returns `null` when React isn't installed within the repo or its package.json
+* carries no version string. A tree with no boundary marker at all bounds the
+* search to `directory`, so a dependency hoisted above the scanned package there
+* is conservatively not adopted.
+*/
+/**
+* The nearest enclosing project boundary (git root or monorepo root), or
+* `directory` itself when the scan target sits outside any repo. Bounds the
+* node_modules walk so a React hoisted anywhere inside the repo counts, but a
+* React in an ancestor above the repo — a home-directory or global
+* `node_modules` — can't leak in.
+*/
+const findContainmentRoot = (directory) => {
+	for (const ancestorDirectory of ancestorDirectories(directory, { includeStart: true })) if (isProjectBoundary(ancestorDirectory)) return ancestorDirectory;
+	return directory;
+};
+const resolveInstalledReactVersion = (directory) => {
+	const containmentRoot = findContainmentRoot(directory);
+	for (const ancestorDirectory of ancestorDirectories(directory, { includeStart: true })) {
+		const reactPackageJsonPath = Path.join(ancestorDirectory, "node_modules", "react", "package.json");
+		if (isFile(reactPackageJsonPath)) {
+			const installedVersion = readPackageJson$1(reactPackageJsonPath).version;
+			return typeof installedVersion === "string" ? installedVersion : null;
+		}
+		if (ancestorDirectory === containmentRoot) return null;
+	}
+	return null;
+};
 const findInWorkspacePackageJsons = (rootDirectory, rootPackageJson, select) => {
 	const rootValue = select(rootPackageJson);
 	if (rootValue !== null) return rootValue;
@@ -37264,19 +37359,20 @@ const discoverReactSubprojects = (rootDirectory) => {
 const cachedProjectInfos = /* @__PURE__ */ new Map();
 /**
 * Build a `ProjectInfo` for a directory that has no `package.json` of
-* its own — a monorepo subfolder like `repo/packages`, or any loose tree
-* of TypeScript/JavaScript files. Dependency + framework detection is
-* inherited from the enclosing workspace root when there is one, so
-* scanning a subdirectory of a React monorepo still gets the React
-* capabilities; a standalone non-React directory simply scans with the
-* framework-agnostic rules. Throws only when the directory has nothing
-* to scan (no enclosing project and no source files of its own).
+* its own — a package subfolder like `repo/packages` or `app/src/features`,
+* or any loose tree of TypeScript/JavaScript files. Dependency + framework
+* detection is inherited from the nearest enclosing package (a leaf
+* workspace, a plain app root, or a monorepo root — whichever is closest,
+* bounded by the git root), so scanning a subdirectory of a React project
+* still gets the React capabilities; a standalone non-React directory simply
+* scans with the framework-agnostic rules. Throws only when the directory has
+* nothing to scan (no enclosing project and no source files of its own).
 */
 const discoverProjectWithoutPackageJson = (directory) => {
 	const sourceFileCount = countSourceFiles(directory);
 	const hasOwnTsConfig = NFS.existsSync(Path.join(directory, "tsconfig.json"));
-	const monorepoRoot = findMonorepoRoot(directory);
-	const enclosingProject = monorepoRoot !== null && isFile(Path.join(monorepoRoot, "package.json")) ? discoverProject(monorepoRoot) : null;
+	const enclosingProjectRoot = findNearestAncestorPackageJson(directory);
+	const enclosingProject = enclosingProjectRoot !== null ? discoverProject(enclosingProjectRoot) : null;
 	if (enclosingProject !== null) return {
 		...enclosingProject,
 		rootDirectory: directory,
@@ -37380,6 +37476,7 @@ const discoverProject = (directory) => {
 	if (!reactVersion && reactDeclaration.version && !isCatalogReference(reactDeclaration.version)) reactVersion = reactDeclaration.version;
 	if (!tailwindVersion && tailwindDeclaration.version && !isCatalogReference(tailwindDeclaration.version)) tailwindVersion = tailwindDeclaration.version;
 	if (!zodVersion && zodDeclaration.version && !isCatalogReference(zodDeclaration.version)) zodVersion = zodDeclaration.version;
+	if (!reactVersion || parseReactMajor(reactVersion) === null) reactVersion = resolveInstalledReactVersion(directory) ?? reactVersion;
 	const projectName = packageJson.name ?? Path.basename(directory);
 	const hasTypeScript = NFS.existsSync(Path.join(directory, "tsconfig.json"));
 	const sourceFileCount = countSourceFiles(directory);
@@ -40237,10 +40334,17 @@ function* collectSecurityScanFiles(rootDirectory) {
 		}
 	}
 }
+/**
+* Whether project discovery resolved a React-compatible runtime (React or
+* Preact, which ships the same hooks + JSX model). This is the same
+* predicate that grants the `react` capability, so `false` means every
+* React-runtime rule family was gated off for the project.
+*/
+const hasReactRuntime = (project) => project.reactVersion !== null || project.preactVersion !== null;
 const buildCapabilities = (project) => {
 	const capabilities = /* @__PURE__ */ new Set();
 	capabilities.add(project.framework);
-	if (project.reactVersion !== null || project.preactVersion !== null) capabilities.add("react");
+	if (hasReactRuntime(project)) capabilities.add("react");
 	if (project.framework === "expo" || project.framework === "react-native" || project.hasReactNativeWorkspace) capabilities.add("react-native");
 	if (project.expoVersion !== null) capabilities.add("expo");
 	if (project.nextjsMajorVersion !== null && project.nextjsMajorVersion >= 15) capabilities.add("nextjs:15");
@@ -41786,7 +41890,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 			})),
 			showStagedContent: (directory, relativePath, options) => runCommand({
 				command: "git",
-				args: ["show", `:${relativePath}`],
+				args: ["show", `:./${relativePath}`],
 				directory,
 				maxStdoutBytes: options?.maxBufferBytes
 			}).pipe(map$3((result) => result.status === 0 ? result.stdout : null)),
@@ -43092,6 +43196,7 @@ const parseRuleCode = (code) => {
 	};
 };
 const resolveDiagnosticCategory = (plugin, rule) => getRuleCategory(rule) ?? lookupOwnString(PLUGIN_CATEGORY_MAP, plugin) ?? "Bugs";
+const resolveMatchByOccurrence = (rule, category) => OCCURRENCE_MATCHED_CATEGORIES.has(category) || Boolean(reactDoctorPlugin.rules[rule]?.matchByOccurrence);
 /**
 * Maps oxlint's non-primary labels (`labels[1..]`) into related source
 * locations. Editors surface these as a diagnostic's
@@ -43155,6 +43260,7 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 		const normalizedFilePath = diagnostic.filename.replaceAll("\\", "/");
 		const primarySpan = primaryLabel?.span;
 		const relatedLocations = buildRelatedLocations(diagnostic.labels, normalizedFilePath);
+		const category = resolveDiagnosticCategory(plugin, rule);
 		return {
 			filePath: normalizedFilePath,
 			plugin,
@@ -43170,7 +43276,8 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 				offset: primarySpan.offset,
 				length: primarySpan.length
 			} : {},
-			category: resolveDiagnosticCategory(plugin, rule),
+			category,
+			...resolveMatchByOccurrence(rule, category) ? { matchByOccurrence: true } : {},
 			...relatedLocations.length > 0 ? { relatedLocations } : {}
 		};
 	});
@@ -45355,6 +45462,7 @@ const buildJsonReport = (input) => {
 	const worstScoredProject = findWorstScoredProject(projects);
 	const summary = summarizeDiagnostics(flattenedDiagnostics, worstScoredProject?.score?.score ?? null, worstScoredProject?.score?.label ?? null);
 	const shared = {
+		...input.scans.length > 0 ? { reactDetected: input.scans.some((scan) => hasReactRuntime(scan.result.project)) } : {},
 		version: input.version,
 		ok: true,
 		directory: input.directory,
@@ -45405,7 +45513,7 @@ const buildSkippedChecks = (input) => {
 };
 const fingerprintDiagnostic = (diagnostic, lineText) => {
 	const ruleKey = `${diagnostic.plugin}/${diagnostic.rule}`;
-	const snippet = lineText === null ? "" : createHash("sha1").update(lineText.trim()).digest("hex");
+	const snippet = lineText === null || diagnostic.matchByOccurrence ? "" : createHash("sha1").update(lineText.trim()).digest("hex");
 	return `${diagnostic.filePath}\u0000${ruleKey}\u0000${snippet}`;
 };
 /**
@@ -45416,6 +45524,17 @@ const fingerprintDiagnostic = (diagnostic, lineText) => {
 * look new, while a genuinely new occurrence (new line text, or one more of
 * the same) surfaces. Identical repeated findings are matched by count.
 *
+* Diagnostics carrying `matchByOccurrence` (resolved at diagnostic creation:
+* every Accessibility-category finding, plus rules opting in via their
+* `matchByOccurrence` metadata flag) drop the line-text snippet and match by
+* `(filePath, plugin/rule)` occurrence count alone. Their identity is the
+* flagged element, not the line's text, so editing the line (reindentation,
+* prettier reflow, collapsing a multi-line JSX element) doesn't reclassify a
+* pre-existing finding as new — while one MORE occurrence of the same rule in
+* the file still surfaces. Expression-level rules keep the line-text snippet:
+* there the flagged expression IS the finding, so changed text means new +
+* fixed.
+*
 * v1 limitation: the fingerprint keys on the head-relative `filePath`, and base
 * content is read at that same path. A file renamed by the change therefore has
 * no base match, so its pre-existing findings are reported as new. This
@@ -45818,6 +45937,7 @@ const METRIC = {
 	scanScore: "scan.score",
 	scanClean: "scan.clean",
 	scanCheckSkipped: "scan.check_skipped",
+	scanNoReactDetected: "scan.no_react_detected",
 	baselineDegraded: "baseline.degraded",
 	ruleFired: "rule.fired",
 	ruleDisabled: "rule.disabled",
@@ -45887,7 +46007,7 @@ const makeNoopConsole = () => ({
 });
 //#endregion
 //#region src/cli/utils/version.ts
-const VERSION = "0.7.0";
+const VERSION = "0.7.1-dev.1880b15";
 //#endregion
 //#region src/cli/utils/json-mode.ts
 let context = null;
@@ -46256,13 +46376,13 @@ const isDevVersion = (version) => version === "0.0.0" || version.includes("-");
 * uploads source-map artifacts under, so stack frames symbolicate. Honors the
 * standard `SENTRY_RELEASE` override.
 */
-const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.7.0`;
+const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.7.1-dev.1880b15`;
 /**
 * Deployment environment shown in Sentry's environment filter. Defaults to
 * `production` for tagged releases and `development` for dev/unbuilt versions,
 * overridable via the standard `SENTRY_ENVIRONMENT` env var.
 */
-const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.7.0") ? "development" : "production");
+const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.7.1-dev.1880b15") ? "development" : "production");
 /**
 * Performance-tracing sample rate in `[0, 1]`. Reads `SENTRY_TRACES_SAMPLE_RATE`
 * (set to `0` to disable tracing) and falls back to
@@ -58106,7 +58226,7 @@ const buildRuntimeLayers = (input) => {
 	const linterLayer = input.shouldSkipLint ? Linter.layerOf([]) : Linter.layerOxlint;
 	const deadCodeLayer = input.shouldRunDeadCode ? DeadCode.layerNode : DeadCode.layerOf([]);
 	const scoreLayer = input.shouldComputeScore ? Score.layerHttp : Score.layerOf(null);
-	const supplyChainLayer = input.userConfig?.supplyChain?.enabled === false ? SupplyChain.layerOf([]) : SupplyChain.layerNode;
+	const supplyChainLayer = input.shouldRunSupplyChain ? SupplyChain.layerNode : SupplyChain.layerOf([]);
 	const projectLayer = input.projectInfoOverride === void 0 ? Project.layerNode : Project.layerOf(input.projectInfoOverride);
 	const progressLayer = input.shouldShowProgressSpinners ? Progress.layerOra(buildSpinnerProgressHandle) : Progress.layerNoop;
 	const baseLayers = mergeAll$1(projectLayer, input.hasConfigOverride ? Config.layerOf({
@@ -58462,21 +58582,22 @@ const resolveDotenvFingerprint = (projectDirectory) => {
 		return [];
 	}
 };
-const hasHiddenTrackedFileState = (projectDirectory) => {
+const isGitIdentityTrustworthy = (projectDirectory) => {
 	const output = runGit(projectDirectory, ["ls-files", "-v"]);
-	if (output === null) return true;
-	return output.split("\n").some((line) => line.length > 0 && line[0] !== "H");
+	if (output === null) return false;
+	const entryLines = output.split("\n").filter((line) => line.length > 0);
+	return entryLines.length > 0 && entryLines.every((line) => line[0] === "H");
 };
 const resolveCacheFilePath = (projectDirectory) => path.join(resolveReactDoctorCacheDir(projectDirectory), SCAN_RESULT_CACHE_FILENAME);
 const readPersistedCache = (cacheFilePath) => {
 	try {
 		const parsed = JSON.parse(fs.readFileSync(cacheFilePath, "utf8"));
-		if (!isRecord(parsed) || parsed.version !== 3) return {
-			version: 3,
+		if (!isRecord(parsed) || parsed.version !== 4) return {
+			version: 4,
 			entries: []
 		};
 		if (!Array.isArray(parsed.entries)) return {
-			version: 3,
+			version: 4,
 			entries: []
 		};
 		const entries = [];
@@ -58486,12 +58607,12 @@ const readPersistedCache = (cacheFilePath) => {
 			entries.push(entry);
 		}
 		return {
-			version: 3,
+			version: 4,
 			entries
 		};
 	} catch {
 		return {
-			version: 3,
+			version: 4,
 			entries: []
 		};
 	}
@@ -58523,6 +58644,7 @@ const resolveProjectIdentity = (projectDirectory) => {
 		return path.resolve(projectDirectory);
 	}
 };
+const resolveManifestContentHash = (projectDirectory) => hashFileContents(getPackageJsonPath(projectDirectory));
 const fileFingerprint = (filePath) => {
 	try {
 		const stat = fs.statSync(filePath);
@@ -58545,14 +58667,14 @@ const resolveToolchainFingerprint = (nodeBinaryPath) => {
 };
 const buildScanResultCacheKey = (input) => {
 	if (isCacheGloballyDisabled()) return null;
-	if (hasHiddenTrackedFileState(input.projectDirectory)) return null;
+	if (!isGitIdentityTrustworthy(input.projectDirectory)) return null;
 	const worktreeFingerprint = buildWorktreeFingerprint(input.projectDirectory);
 	if (worktreeFingerprint === null) return null;
 	const headSha = readHeadSha(input.projectDirectory);
 	if (headSha === null) return null;
 	if (stringifyStableJson(input.userConfig) === null) return null;
 	const cacheKeyJson = stringifyStableJson({
-		schemaVersion: 3,
+		schemaVersion: 4,
 		projectIdentity: resolveProjectIdentity(input.projectDirectory),
 		headSha,
 		worktreeFingerprint,
@@ -58567,6 +58689,7 @@ const buildScanResultCacheKey = (input) => {
 		engineOptions: {
 			lint: input.options.lint,
 			deadCode: input.options.deadCode,
+			supplyChain: input.options.supplyChain,
 			includePaths: [...input.options.includePaths].sort(),
 			customRulesOnly: input.options.customRulesOnly,
 			respectInlineDisables: input.options.respectInlineDisables,
@@ -58592,17 +58715,24 @@ const createScanResultCache = (projectDirectory) => {
 	for (const entry of persistedCache.entries) entries.set(entry.key, entry);
 	const persist = () => {
 		writePersistedCache(cacheFilePath, {
-			version: 3,
+			version: 4,
 			entries: [...entries.values()].sort((firstEntry, secondEntry) => secondEntry.createdAtMs - firstEntry.createdAtMs).slice(0, 20)
 		});
 	};
 	return {
-		lookup: (key) => entries.get(key)?.payload ?? null,
+		lookup: (key) => {
+			const payload = entries.get(key)?.payload;
+			if (payload === void 0) return null;
+			return resolveProjectIdentity(payload.directory) === resolveProjectIdentity(projectDirectory) && (payload.manifestContentHash ?? null) === resolveManifestContentHash(projectDirectory) ? payload : null;
+		},
 		store: (key, payload) => {
 			entries.set(key, {
 				key,
 				createdAtMs: Date.now(),
-				payload
+				payload: {
+					...payload,
+					manifestContentHash: resolveManifestContentHash(projectDirectory)
+				}
 			});
 			persist();
 		}
@@ -58867,6 +58997,7 @@ const buildScanAttributes = (input) => {
 		maxDurationMs: input.maxDurationMs,
 		lint: input.lint,
 		deadCode: input.deadCode,
+		supplyChain: input.supplyChain,
 		scoreOnly: input.scoreOnly,
 		noScore: input.noScore,
 		respectInlineDisables: input.respectInlineDisables,
@@ -60141,6 +60272,7 @@ const buildIgnoredTags = (userConfig) => {
 const mergeInspectOptions = (inputOptions, userConfig) => ({
 	lint: inputOptions.lint ?? userConfig?.lint ?? true,
 	deadCode: inputOptions.deadCode ?? userConfig?.deadCode ?? true,
+	supplyChain: inputOptions.supplyChain ?? userConfig?.supplyChain?.enabled ?? true,
 	verbose: inputOptions.verbose ?? userConfig?.verbose ?? false,
 	outputDirectory: inputOptions.outputDirectory || null,
 	scoreOnly: inputOptions.scoreOnly ?? false,
@@ -60180,6 +60312,7 @@ const buildRunEventConfig = (options, userConfig, hasCustomConfig, resolvedWorke
 		maxDurationMs: options.maxDurationMs,
 		lint: options.lint,
 		deadCode: options.deadCode,
+		supplyChain: options.supplyChain,
 		scoreOnly: options.scoreOnly,
 		noScore: options.noScore,
 		respectInlineDisables: options.respectInlineDisables,
@@ -60263,6 +60396,7 @@ const runBaselineComparison = async (params) => {
 			projectInfoOverride: params.headProjectInfo,
 			shouldSkipLint: !params.options.lint || !params.resolvedNodeBinaryPath,
 			shouldRunDeadCode: false,
+			shouldRunSupplyChain: params.options.supplyChain,
 			shouldComputeScore: false,
 			shouldShowProgressSpinners: false,
 			oxlintConcurrency: params.options.concurrency
@@ -60351,6 +60485,7 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		configSourceDirectory,
 		shouldSkipLint: !options.lint || lintBindingMissing,
 		shouldRunDeadCode: options.deadCode,
+		shouldRunSupplyChain: options.supplyChain,
 		shouldComputeScore: !options.noScore,
 		shouldShowProgressSpinners,
 		oxlintConcurrency: options.concurrency
@@ -62636,8 +62771,8 @@ const resolveParallelFlag = (parallel) => parallel === false ? 1 : void 0;
 * accepts. Flag-derived fields only (`scoreOnly`, `noScore`, `silent`,
 * `isCi`): every `userConfig` fallback — including `noScore` — lives in
 * `inspect()`'s merge layer, which sees each project's module-merged
-* config. The plain boolean knobs (`lint`, `deadCode`, `verbose`) pass
-* through unchanged for the same reason. This resolver reads
+* config. The plain boolean knobs (`lint`, `deadCode`, `supplyChain`,
+* `verbose`) pass through unchanged for the same reason. This resolver reads
 * `userConfig` only to decide the `--blocking warning` gate.
 */
 const resolveCliInspectOptions = (flags, userConfig) => {
@@ -62645,6 +62780,7 @@ const resolveCliInspectOptions = (flags, userConfig) => {
 	return {
 		lint: flags.lint,
 		deadCode: flags.deadCode,
+		supplyChain: flags.supplyChain,
 		verbose: flags.verbose,
 		outputDirectory: flags.outputDir,
 		respectInlineDisables: flags.respectInlineDisables === false ? false : void 0,
@@ -62975,6 +63111,11 @@ const finalizeScans = (input) => {
 	const baselineComputed = input.completedScans.length > 0 && input.completedScans.every((scan) => scan.result.baselineDelta !== void 0);
 	const baselineDegraded = input.baselineIntended && !baselineComputed;
 	const mode = baselineDegraded ? "diff" : input.mode;
+	const isReactDetected = input.completedScans.some((scan) => hasReactRuntime(scan.result.project));
+	if (input.completedScans.length > 0 && !isReactDetected) {
+		recordCount(METRIC.scanNoReactDetected, 1);
+		cliLogger.warn(`No React project detected at ${input.resolvedDirectory} — React rules were gated off; this is not the same as a clean scan.`);
+	}
 	const jsonCompletedScans = filterCompletedScansByCategories(input.completedScans, input.categoryFilters);
 	if (input.isJsonMode) {
 		const baseline = baselineComputed && baselineDeltas.length > 0 ? {
@@ -63190,7 +63331,7 @@ const inspectAction = async (directory, flags) => {
 			const scanDirectory = projectScanTarget.resolvedDirectory;
 			const projectConfig = projectDirectory === resolvedDirectory ? userConfig : mergeReactDoctorConfigs(userConfig, projectScanTarget.userConfig ?? void 0);
 			const projectConfigSourceDirectory = projectScanTarget.userConfig?.plugins === void 0 ? scanTarget.configSourceDirectory : projectScanTarget.configSourceDirectory;
-			const supplyChainEnabled = projectConfig?.supplyChain?.enabled !== false;
+			const supplyChainEnabled = flags.supplyChain ?? projectConfig?.supplyChain?.enabled !== false;
 			let includePaths;
 			let supplyChainManifestChanged = false;
 			if (isDiffMode) {
@@ -64110,10 +64251,12 @@ const ROOT_FLAG_SPEC = {
 		"--no-parallel",
 		"--no-respect-inline-disables",
 		"--no-score",
+		"--no-supply-chain",
 		"--no-telemetry",
 		"--no-warnings",
 		"--score",
 		"--staged",
+		"--supply-chain",
 		"--verbose",
 		"--version",
 		"--warnings",
@@ -64362,7 +64505,7 @@ ${highlighter.dim("Learn more:")}
   ${highlighter.info(CI_URL)}
 `;
 const collectCategoryOption = (value, previousValues) => [...previousValues ?? [], value];
-const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("--json-out <path>", "with --json, write the report to a file instead of stdout").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much to scan/report: full (default), files, changed (only new issues vs base), or lines (only changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks").option("--max-duration <seconds>", "scan time budget for the whole run, shared across workspace projects: past it, remaining lint batches and dead-code are skipped and partial results are reported (skipped files are listed in the JSON report)").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
+const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--supply-chain", "enable the dependency supply-chain scan (default)").option("--no-supply-chain", "skip the dependency supply-chain scan (Socket.dev dependency health checks)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("--json-out <path>", "with --json, write the report to a file instead of stdout").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much to scan/report: full (default), files, changed (only new issues vs base), or lines (only changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks").option("--max-duration <seconds>", "scan time budget for the whole run, shared across workspace projects: past it, remaining lint batches and dead-code are skipped and partial results are reported (skipped files are listed in the JSON report)").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
 program.action(inspectAction);
 program.command("why <location>").description("Explain why a rule fired (or why a suppression didn't apply) at a file:line").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple)").option("-c, --cwd <cwd>", "working directory", process.cwd()).option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").action((location, options) => whyAction(location, options));
 program.command("install").alias("setup").description("Install the react-doctor skill into your coding agents and optional git hook").option("-y, --yes", "skip prompts, install for all detected agents").option("--dry-run", "show what would be installed without writing files").option("--agent-hooks", "install native non-blocking agent hooks for Claude Code and Cursor").option("-c, --cwd <cwd>", "working directory", process.cwd()).option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderInstallHelpEpilog).action(installAction);
@@ -64412,4 +64555,4 @@ Promise.resolve().then(() => assertNoRemovedFlags(process.argv)).then(() => prog
 export {};
 
 //# sourceMappingURL=cli.js.map
-//# debugId=96cac03b-44a6-5d88-a5c9-697a5e8cf45e
+//# debugId=47338856-c658-5c78-a5e2-e871c2dafaa7

package/dist/index.d.ts

@@ -9493,6 +9493,17 @@ interface Diagnostic {
   /** 1-indexed end column of the primary span, when derivable. */
   endColumn?: number;
   category: string;
+  /**
+   * Set when the finding's identity is the flagged element itself (a missing
+   * attribute, a wrong element) rather than the flagged line's text — every
+   * Accessibility-category finding, plus rules that opt in via their
+   * `matchByOccurrence` metadata flag. `computeDiagnosticDelta` matches these
+   * by `(filePath, plugin/rule)` occurrence count, so reformatting the flagged
+   * line doesn't reclassify a pre-existing finding as new. Resolved at
+   * diagnostic creation, where rule metadata is available. Absent means
+   * line-text-sensitive matching (the default).
+   */
+  matchByOccurrence?: boolean;
   /**
    * Set when the file never ships to users (`"test"` / `"story"`), so
    * renderers can label the site instead of implying production impact.
@@ -9644,6 +9655,17 @@ interface DiagnoseResult {
   /** See `InspectResult.skippedCheckReasons`. */
   skippedCheckReasons?: Record<string, string>;
   project: ProjectInfo;
+  /**
+   * Whether the scanned project resolved a React-compatible runtime (React
+   * or Preact). `false` means every React-runtime rule family was gated
+   * off, so an empty `diagnostics` array is vacuous — NOT the same as a
+   * clean React scan. Consumers gating on the result should treat
+   * `reactDetected === false` as "wrong scan target", not "all clear".
+   * Mirrors `JsonReport.reactDetected`; same predicate as
+   * `hasReactRuntime(result.project)`. Always set by `diagnose()`;
+   * optional so hand-constructed results keep compiling.
+   */
+  reactDetected?: boolean;
   elapsedMilliseconds: number;
 }
 /**
@@ -9693,6 +9715,13 @@ interface DiagnoseProjectsResult {
   projects: ProjectResult[];
   diagnostics: Diagnostic[];
   score: ScoreResult | null;
+  /**
+   * Whether any successfully scanned project resolved a React-compatible
+   * runtime (React or Preact). Absent when no project scanned successfully.
+   * See `DiagnoseResult.reactDetected` for gating guidance; per-project
+   * detail is on each `ProjectResultOk.reactDetected`.
+   */
+  reactDetected?: boolean;
   elapsedMilliseconds: number;
 } //#endregion
 //#region src/types/handle-error.d.ts
@@ -9888,6 +9917,17 @@ interface JsonReportV1$1 {
   ok: boolean;
   directory: string;
   mode: JsonReportMode;
+  /**
+   * Whether any scanned project resolved a React-compatible runtime (React
+   * or Preact). `false` means every React-runtime rule family was gated off,
+   * so an empty `diagnostics` array is vacuous — NOT the same as a clean
+   * React scan. Consumers gating on the report (CI, verifiers, hooks) should
+   * treat `reactDetected === false` as "wrong scan target", not "all clear"
+   * (per project, `projects[].project.reactVersion` / `preactVersion` say
+   * which roots were non-React). Absent when nothing was scanned (`projects`
+   * is empty), on error reports, and on reports from older CLI versions.
+   */
+  reactDetected?: boolean;
   diff: JsonReportDiffInfo | null;
   projects: JsonReportProjectEntry[];
   /**
@@ -10172,6 +10212,16 @@ declare const summarizeDiagnostics: (diagnostics: Diagnostic[], worstScore?: num
 declare const defineConfig: (config: ReactDoctorConfig) => ReactDoctorConfig; //#endregion
 //#region src/utils/detect-ai-training-environment.d.ts
 //#endregion
+//#region src/utils/has-react-runtime.d.ts
+/**
+ * Whether project discovery resolved a React-compatible runtime (React or
+ * Preact, which ships the same hooks + JSX model). This is the same
+ * predicate that grants the `react` capability, so `false` means every
+ * React-runtime rule family was gated off for the project.
+ */
+declare const hasReactRuntime: (project: ProjectInfo) => boolean; //#endregion
+//#region src/utils/is-errno-exception.d.ts
+//#endregion
 //#region ../api/dist/index.d.ts
 //#region src/diagnose.d.ts
 interface Diagnose {
@@ -10198,5 +10248,5 @@ interface ToJsonReportOptions {
 }
 declare const toJsonReport: (result: DiagnoseResult, options: ToJsonReportOptions) => JsonReport;
 //#endregion
-export { AmbiguousProjectError, type DiagnoseOptions, type DiagnoseProjectsInput, type DiagnoseProjectsResult, type DiagnoseResult, type Diagnostic, type DiffInfo, type JsonReport, type JsonReportDiffInfo, type JsonReportError, type JsonReportMode, type JsonReportProjectEntry, type JsonReportSummary, NoReactDependencyError, NotADirectoryError, PackageJsonNotFoundError, type ProjectDefinition, type ProjectInfo, ProjectNotFoundError, type ProjectResult, type ProjectResultError, type ProjectResultOk, type ReactDoctorConfig, ReactDoctorError, type ScoreResult, buildJsonReport, buildJsonReportError, clearCaches, defineConfig, diagnose, filterSourceFiles, getDiffInfo, isProjectDiscoveryError, isReactDoctorError, summarizeDiagnostics, toJsonReport };
+export { AmbiguousProjectError, type DiagnoseOptions, type DiagnoseProjectsInput, type DiagnoseProjectsResult, type DiagnoseResult, type Diagnostic, type DiffInfo, type JsonReport, type JsonReportDiffInfo, type JsonReportError, type JsonReportMode, type JsonReportProjectEntry, type JsonReportSummary, NoReactDependencyError, NotADirectoryError, PackageJsonNotFoundError, type ProjectDefinition, type ProjectInfo, ProjectNotFoundError, type ProjectResult, type ProjectResultError, type ProjectResultOk, type ReactDoctorConfig, ReactDoctorError, type ScoreResult, buildJsonReport, buildJsonReportError, clearCaches, defineConfig, diagnose, filterSourceFiles, getDiffInfo, hasReactRuntime, isProjectDiscoveryError, isReactDoctorError, summarizeDiagnostics, toJsonReport };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5c52dece-7b5e-5102-9381-7d05fa45734f")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f00947fe-3794-5d73-a491-232b535dc962")}catch(e){}}();
 import { r as __toESM$1, t as __commonJSMin$1 } from "./chunk-N93fKeF6.js";
 import { createRequire } from "node:module";
 import * as NFS from "node:fs";
@@ -19304,6 +19304,7 @@ var Diagnostic = class extends Class("Diagnostic")({
 	endLine: optional(Number$1),
 	endColumn: optional(Number$1),
 	category: String$1,
+	matchByOccurrence: optional(Boolean$1),
 	fileContext: optional(Literals(["test", "story"])),
 	suppressionHint: optional(String$1),
 	relatedLocations: optional(ArraySchema(DiagnosticRelatedLocation)),
@@ -19374,6 +19375,16 @@ var JsonReportV1 = class extends Class("JsonReportV1")({
 	* successful `baseline` run (`schemaVersion: 2`) and on non-compare scopes.
 	*/
 	baselineDegraded: optional(Boolean$1),
+	/**
+	* Whether any scanned project resolved a React-compatible runtime (React
+	* or Preact). `false` means every React-runtime rule family was gated off,
+	* so an empty `diagnostics` array is vacuous — NOT the same as a clean
+	* React scan. Consumers gating on the report (CI, verifiers, hooks) should
+	* treat `reactDetected === false` as "wrong scan target", not "all clear".
+	* Absent when nothing was scanned (`projects` is empty), on error reports,
+	* and on reports from older CLI versions.
+	*/
+	reactDetected: optional(Boolean$1),
 	diff: NullOr(JsonReportDiffInfo),
 	projects: ArraySchema(JsonReportProjectEntry),
 	diagnostics: ArraySchema(Diagnostic),
@@ -19399,6 +19410,8 @@ var JsonReportV2 = class extends Class("JsonReportV2")({
 	ok: Boolean$1,
 	directory: String$1,
 	mode: JsonReportMode,
+	/** See `JsonReportV1.reactDetected`. */
+	reactDetected: optional(Boolean$1),
 	diff: NullOr(JsonReportDiffInfo),
 	baseline: JsonReportBaseline,
 	projects: ArraySchema(JsonReportProjectEntry),
@@ -32907,6 +32920,7 @@ const DIAGNOSTIC_CATEGORY_BUCKETS = [
 	"Accessibility",
 	"Maintainability"
 ];
+const OCCURRENCE_MATCHED_CATEGORIES = new Set(["Accessibility"]);
 const APP_ONLY_RULE_KEYS = new Set([
 	"react-hooks-js/static-components",
 	"react-doctor/no-render-prop-children",
@@ -32929,7 +32943,7 @@ const SOCKET_FREE_USER_AGENT = "react-doctor-supply-chain";
 const FILE_LINT_CACHE_FILENAME = "file-lint-cache.json";
 const FILE_LINT_CACHE_MAX_FILE_COUNT = 5e4;
 const SIDECAR_LINT_CACHE_FILENAME = "sidecar-lint-cache.json";
-const CORE_PACKAGE_VERSION = "0.7.0";
+const CORE_PACKAGE_VERSION = "0.7.1";
 const DEAD_CODE_CACHE_FILENAME = "dead-code-cache.json";
 const DEAD_CODE_SUMMARY_CACHE_FILENAME = "dead-code-summaries.json";
 const SUPPLY_CHAIN_PLUGIN = "socket";
@@ -33050,6 +33064,23 @@ const listSourceFilesViaFilesystem = (rootDirectory) => {
 const listSourceFilesWithSize = (rootDirectory) => collectSizedSourceFiles(rootDirectory, (listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory)).sort());
 const listSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).map((entry) => entry.path);
 const countSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).length;
+/**
+* The chain of ancestor directories of `startDirectory`, nearest first, up to
+* and including the filesystem root. With `includeStart`, the chain begins at
+* `startDirectory` itself; otherwise at its parent. The one place the "walk up
+* the tree" traversal is expressed, so each caller adds only its own match /
+* stop policy instead of re-deriving the `path.dirname` loop.
+*/
+const ancestorDirectories = (startDirectory, { includeStart }) => {
+	const directories = [];
+	let currentDirectory = includeStart ? startDirectory : Path.dirname(startDirectory);
+	while (true) {
+		directories.push(currentDirectory);
+		const parentDirectory = Path.dirname(currentDirectory);
+		if (parentDirectory === currentDirectory) return directories;
+		currentDirectory = parentDirectory;
+	}
+};
 const cachedPackageJsons = /* @__PURE__ */ new Map();
 const clearPackageJsonCache = () => {
 	cachedPackageJsons.clear();
@@ -33083,11 +33114,7 @@ const isMonorepoRoot = (directory) => {
 	return Array.isArray(packageJson.workspaces) || Boolean(packageJson.workspaces?.packages);
 };
 const findMonorepoRoot = (startDirectory) => {
-	let currentDirectory = Path.dirname(startDirectory);
-	while (currentDirectory !== Path.dirname(currentDirectory)) {
-		if (isMonorepoRoot(currentDirectory)) return currentDirectory;
-		currentDirectory = Path.dirname(currentDirectory);
-	}
+	for (const directory of ancestorDirectories(startDirectory, { includeStart: false })) if (isMonorepoRoot(directory)) return directory;
 	return null;
 };
 /**
@@ -33733,6 +33760,74 @@ const findDependencyInfoFromMonorepoRoot = (directory) => {
 		framework: rootInfo.framework !== "unknown" ? rootInfo.framework : workspaceInfo.framework
 	};
 };
+/**
+* Walk up from `startDirectory` to the nearest ancestor that owns a
+* `package.json`, stopping at (and including) the enclosing project boundary
+* — the working tree's git root or a monorepo root. Lets a scan of a package
+* subfolder that has no `package.json` of its own adopt the nearest enclosing
+* package as its project root, so it inherits that package's dependency +
+* framework detection instead of synthesizing an empty (React-blind) project.
+*
+* Generalizes the older monorepo-root-only lookup: the nearest ancestor is the
+* most specific owning package (a leaf workspace, not just the repo root), so
+* a subfolder of one workspace no longer borrows a sibling's capabilities.
+*
+* Returns `null` when no ancestor `package.json` exists inside the project
+* boundary (a loose tree of files, or a subfolder of a package-less repo).
+*/
+const findNearestAncestorPackageJson = (startDirectory) => {
+	if (isProjectBoundary(startDirectory)) return null;
+	for (const directory of ancestorDirectories(startDirectory, { includeStart: false })) {
+		if (isFile(Path.join(directory, "package.json"))) return directory;
+		if (isProjectBoundary(directory)) return null;
+	}
+	return null;
+};
+/**
+* Last-resort React detection: locate React the way Node's `node_modules`
+* resolution would from `directory` — check each `node_modules/react` up the
+* tree — but bounded to the enclosing repo so a globally installed React can't
+* masquerade as the project's version. Stops at (and including) the nearest
+* project boundary — the git root or a monorepo root — and returns the first
+* installed `version`.
+*
+* Makes "React is installed and importable" ⇒ "React is detected" an invariant
+* for packages whose only React declaration is a version-less spec
+* (`workspace:*`, `*`, a dist-tag) or where React lives solely in a hoisted
+* `node_modules` the declaration walks never reach — the profile of a component
+* package inside a monorepo. Matching the `node_modules/react` entry rather than
+* its realpath means a project whose `node_modules` is symlinked elsewhere (a
+* Docker volume, a shared store) still counts, while a global install outside
+* the repo does not.
+*
+* Returns `null` when React isn't installed within the repo or its package.json
+* carries no version string. A tree with no boundary marker at all bounds the
+* search to `directory`, so a dependency hoisted above the scanned package there
+* is conservatively not adopted.
+*/
+/**
+* The nearest enclosing project boundary (git root or monorepo root), or
+* `directory` itself when the scan target sits outside any repo. Bounds the
+* node_modules walk so a React hoisted anywhere inside the repo counts, but a
+* React in an ancestor above the repo — a home-directory or global
+* `node_modules` — can't leak in.
+*/
+const findContainmentRoot = (directory) => {
+	for (const ancestorDirectory of ancestorDirectories(directory, { includeStart: true })) if (isProjectBoundary(ancestorDirectory)) return ancestorDirectory;
+	return directory;
+};
+const resolveInstalledReactVersion = (directory) => {
+	const containmentRoot = findContainmentRoot(directory);
+	for (const ancestorDirectory of ancestorDirectories(directory, { includeStart: true })) {
+		const reactPackageJsonPath = Path.join(ancestorDirectory, "node_modules", "react", "package.json");
+		if (isFile(reactPackageJsonPath)) {
+			const installedVersion = readPackageJson(reactPackageJsonPath).version;
+			return typeof installedVersion === "string" ? installedVersion : null;
+		}
+		if (ancestorDirectory === containmentRoot) return null;
+	}
+	return null;
+};
 const findInWorkspacePackageJsons = (rootDirectory, rootPackageJson, select) => {
 	const rootValue = select(rootPackageJson);
 	if (rootValue !== null) return rootValue;
@@ -34072,19 +34167,20 @@ const clearProjectCache = () => {
 };
 /**
 * Build a `ProjectInfo` for a directory that has no `package.json` of
-* its own — a monorepo subfolder like `repo/packages`, or any loose tree
-* of TypeScript/JavaScript files. Dependency + framework detection is
-* inherited from the enclosing workspace root when there is one, so
-* scanning a subdirectory of a React monorepo still gets the React
-* capabilities; a standalone non-React directory simply scans with the
-* framework-agnostic rules. Throws only when the directory has nothing
-* to scan (no enclosing project and no source files of its own).
+* its own — a package subfolder like `repo/packages` or `app/src/features`,
+* or any loose tree of TypeScript/JavaScript files. Dependency + framework
+* detection is inherited from the nearest enclosing package (a leaf
+* workspace, a plain app root, or a monorepo root — whichever is closest,
+* bounded by the git root), so scanning a subdirectory of a React project
+* still gets the React capabilities; a standalone non-React directory simply
+* scans with the framework-agnostic rules. Throws only when the directory has
+* nothing to scan (no enclosing project and no source files of its own).
 */
 const discoverProjectWithoutPackageJson = (directory) => {
 	const sourceFileCount = countSourceFiles(directory);
 	const hasOwnTsConfig = NFS.existsSync(Path.join(directory, "tsconfig.json"));
-	const monorepoRoot = findMonorepoRoot(directory);
-	const enclosingProject = monorepoRoot !== null && isFile(Path.join(monorepoRoot, "package.json")) ? discoverProject(monorepoRoot) : null;
+	const enclosingProjectRoot = findNearestAncestorPackageJson(directory);
+	const enclosingProject = enclosingProjectRoot !== null ? discoverProject(enclosingProjectRoot) : null;
 	if (enclosingProject !== null) return {
 		...enclosingProject,
 		rootDirectory: directory,
@@ -34188,6 +34284,7 @@ const discoverProject = (directory) => {
 	if (!reactVersion && reactDeclaration.version && !isCatalogReference(reactDeclaration.version)) reactVersion = reactDeclaration.version;
 	if (!tailwindVersion && tailwindDeclaration.version && !isCatalogReference(tailwindDeclaration.version)) tailwindVersion = tailwindDeclaration.version;
 	if (!zodVersion && zodDeclaration.version && !isCatalogReference(zodDeclaration.version)) zodVersion = zodDeclaration.version;
+	if (!reactVersion || parseReactMajor(reactVersion) === null) reactVersion = resolveInstalledReactVersion(directory) ?? reactVersion;
 	const projectName = packageJson.name ?? Path.basename(directory);
 	const hasTypeScript = NFS.existsSync(Path.join(directory, "tsconfig.json"));
 	const sourceFileCount = countSourceFiles(directory);
@@ -37010,10 +37107,17 @@ function* collectSecurityScanFiles(rootDirectory) {
 		}
 	}
 }
+/**
+* Whether project discovery resolved a React-compatible runtime (React or
+* Preact, which ships the same hooks + JSX model). This is the same
+* predicate that grants the `react` capability, so `false` means every
+* React-runtime rule family was gated off for the project.
+*/
+const hasReactRuntime = (project) => project.reactVersion !== null || project.preactVersion !== null;
 const buildCapabilities = (project) => {
 	const capabilities = /* @__PURE__ */ new Set();
 	capabilities.add(project.framework);
-	if (project.reactVersion !== null || project.preactVersion !== null) capabilities.add("react");
+	if (hasReactRuntime(project)) capabilities.add("react");
 	if (project.framework === "expo" || project.framework === "react-native" || project.hasReactNativeWorkspace) capabilities.add("react-native");
 	if (project.expoVersion !== null) capabilities.add("expo");
 	if (project.nextjsMajorVersion !== null && project.nextjsMajorVersion >= 15) capabilities.add("nextjs:15");
@@ -38543,7 +38647,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 			})),
 			showStagedContent: (directory, relativePath, options) => runCommand({
 				command: "git",
-				args: ["show", `:${relativePath}`],
+				args: ["show", `:./${relativePath}`],
 				directory,
 				maxStdoutBytes: options?.maxBufferBytes
 			}).pipe(map$3((result) => result.status === 0 ? result.stdout : null)),
@@ -39849,6 +39953,7 @@ const parseRuleCode = (code) => {
 	};
 };
 const resolveDiagnosticCategory = (plugin, rule) => getRuleCategory(rule) ?? lookupOwnString(PLUGIN_CATEGORY_MAP, plugin) ?? "Bugs";
+const resolveMatchByOccurrence = (rule, category) => OCCURRENCE_MATCHED_CATEGORIES.has(category) || Boolean(reactDoctorPlugin.rules[rule]?.matchByOccurrence);
 /**
 * Maps oxlint's non-primary labels (`labels[1..]`) into related source
 * locations. Editors surface these as a diagnostic's
@@ -39912,6 +40017,7 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 		const normalizedFilePath = diagnostic.filename.replaceAll("\\", "/");
 		const primarySpan = primaryLabel?.span;
 		const relatedLocations = buildRelatedLocations(diagnostic.labels, normalizedFilePath);
+		const category = resolveDiagnosticCategory(plugin, rule);
 		return {
 			filePath: normalizedFilePath,
 			plugin,
@@ -39927,7 +40033,8 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 				offset: primarySpan.offset,
 				length: primarySpan.length
 			} : {},
-			category: resolveDiagnosticCategory(plugin, rule),
+			category,
+			...resolveMatchByOccurrence(rule, category) ? { matchByOccurrence: true } : {},
 			...relatedLocations.length > 0 ? { relatedLocations } : {}
 		};
 	});
@@ -42088,6 +42195,7 @@ const buildJsonReport = (input) => {
 	const worstScoredProject = findWorstScoredProject(projects);
 	const summary = summarizeDiagnostics(flattenedDiagnostics, worstScoredProject?.score?.score ?? null, worstScoredProject?.score?.label ?? null);
 	const shared = {
+		...input.scans.length > 0 ? { reactDetected: input.scans.some((scan) => hasReactRuntime(scan.result.project)) } : {},
 		version: input.version,
 		ok: true,
 		directory: input.directory,
@@ -42317,6 +42425,7 @@ const outputToDiagnoseResult = (output, elapsedMilliseconds) => {
 		skippedChecks,
 		...Object.keys(skippedCheckReasons).length > 0 ? { skippedCheckReasons } : {},
 		project: output.project,
+		reactDetected: hasReactRuntime(output.project),
 		elapsedMilliseconds
 	};
 };
@@ -42372,10 +42481,12 @@ const diagnoseProjectBatch = async (input) => {
 	const startTime = globalThis.performance.now();
 	const { projects, concurrency, config: batchConfig, ...baseOptions } = input;
 	const projectResults = await mapWithConcurrency(projects, concurrency ?? 4, (projectDefinition) => diagnoseProject(projectDefinition, baseOptions, batchConfig));
+	const succeededProjects = projectResults.filter((projectResult) => projectResult.ok);
 	return {
 		projects: projectResults,
-		diagnostics: projectResults.flatMap((projectResult) => projectResult.ok ? projectResult.diagnostics : []),
+		diagnostics: succeededProjects.flatMap((projectResult) => projectResult.diagnostics),
 		score: findWorstScore(projectResults),
+		...succeededProjects.length > 0 ? { reactDetected: succeededProjects.some((projectResult) => projectResult.reactDetected) } : {},
 		elapsedMilliseconds: globalThis.performance.now() - startTime
 	};
 };
@@ -42410,7 +42521,7 @@ const toJsonReport = (result, options) => buildJsonReport({
 	totalElapsedMilliseconds: result.elapsedMilliseconds
 });
 //#endregion
-export { AmbiguousProjectError, NoReactDependencyError, NotADirectoryError, PackageJsonNotFoundError, ProjectNotFoundError, ReactDoctorError, buildJsonReport, buildJsonReportError, clearCaches, defineConfig, diagnose, filterSourceFiles, getDiffInfo, isProjectDiscoveryError, isReactDoctorError, summarizeDiagnostics, toJsonReport };
+export { AmbiguousProjectError, NoReactDependencyError, NotADirectoryError, PackageJsonNotFoundError, ProjectNotFoundError, ReactDoctorError, buildJsonReport, buildJsonReportError, clearCaches, defineConfig, diagnose, filterSourceFiles, getDiffInfo, hasReactRuntime, isProjectDiscoveryError, isReactDoctorError, summarizeDiagnostics, toJsonReport };
 
 //# sourceMappingURL=index.js.map
-//# debugId=5c52dece-7b5e-5102-9381-7d05fa45734f
+//# debugId=f00947fe-3794-5d73-a491-232b535dc962

package/dist/lsp.js

@@ -19333,6 +19333,7 @@ var Diagnostic = class extends Class("Diagnostic")({
 	endLine: optional(Number$1),
 	endColumn: optional(Number$1),
 	category: String$1,
+	matchByOccurrence: optional(Boolean$1),
 	fileContext: optional(Literals(["test", "story"])),
 	suppressionHint: optional(String$1),
 	relatedLocations: optional(ArraySchema(DiagnosticRelatedLocation)),
@@ -19410,6 +19411,16 @@ var JsonReportV1 = class extends Class("JsonReportV1")({
 	* successful `baseline` run (`schemaVersion: 2`) and on non-compare scopes.
 	*/
 	baselineDegraded: optional(Boolean$1),
+	/**
+	* Whether any scanned project resolved a React-compatible runtime (React
+	* or Preact). `false` means every React-runtime rule family was gated off,
+	* so an empty `diagnostics` array is vacuous — NOT the same as a clean
+	* React scan. Consumers gating on the report (CI, verifiers, hooks) should
+	* treat `reactDetected === false` as "wrong scan target", not "all clear".
+	* Absent when nothing was scanned (`projects` is empty), on error reports,
+	* and on reports from older CLI versions.
+	*/
+	reactDetected: optional(Boolean$1),
 	diff: NullOr(JsonReportDiffInfo),
 	projects: ArraySchema(JsonReportProjectEntry),
 	diagnostics: ArraySchema(Diagnostic),
@@ -19435,6 +19446,8 @@ var JsonReportV2 = class extends Class("JsonReportV2")({
 	ok: Boolean$1,
 	directory: String$1,
 	mode: JsonReportMode,
+	/** See `JsonReportV1.reactDetected`. */
+	reactDetected: optional(Boolean$1),
 	diff: NullOr(JsonReportDiffInfo),
 	baseline: JsonReportBaseline,
 	projects: ArraySchema(JsonReportProjectEntry),
@@ -32966,6 +32979,7 @@ const DIAGNOSTIC_CATEGORY_BUCKETS = [
 	"Accessibility",
 	"Maintainability"
 ];
+const OCCURRENCE_MATCHED_CATEGORIES = new Set(["Accessibility"]);
 const APP_ONLY_RULE_KEYS = new Set([
 	"react-hooks-js/static-components",
 	"react-doctor/no-render-prop-children",
@@ -32988,7 +33002,7 @@ const SOCKET_FREE_USER_AGENT = "react-doctor-supply-chain";
 const FILE_LINT_CACHE_FILENAME = "file-lint-cache.json";
 const FILE_LINT_CACHE_MAX_FILE_COUNT = 5e4;
 const SIDECAR_LINT_CACHE_FILENAME = "sidecar-lint-cache.json";
-const CORE_PACKAGE_VERSION = "0.7.0";
+const CORE_PACKAGE_VERSION = "0.7.1";
 const DEAD_CODE_CACHE_FILENAME = "dead-code-cache.json";
 const DEAD_CODE_SUMMARY_CACHE_FILENAME = "dead-code-summaries.json";
 const SUPPLY_CHAIN_PLUGIN = "socket";
@@ -33109,6 +33123,23 @@ const listSourceFilesViaFilesystem = (rootDirectory) => {
 const listSourceFilesWithSize = (rootDirectory) => collectSizedSourceFiles(rootDirectory, (listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory)).sort());
 const listSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).map((entry) => entry.path);
 const countSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).length;
+/**
+* The chain of ancestor directories of `startDirectory`, nearest first, up to
+* and including the filesystem root. With `includeStart`, the chain begins at
+* `startDirectory` itself; otherwise at its parent. The one place the "walk up
+* the tree" traversal is expressed, so each caller adds only its own match /
+* stop policy instead of re-deriving the `path.dirname` loop.
+*/
+const ancestorDirectories = (startDirectory, { includeStart }) => {
+	const directories = [];
+	let currentDirectory = includeStart ? startDirectory : Path.dirname(startDirectory);
+	while (true) {
+		directories.push(currentDirectory);
+		const parentDirectory = Path.dirname(currentDirectory);
+		if (parentDirectory === currentDirectory) return directories;
+		currentDirectory = parentDirectory;
+	}
+};
 const cachedPackageJsons = /* @__PURE__ */ new Map();
 const clearPackageJsonCache = () => {
 	cachedPackageJsons.clear();
@@ -33142,11 +33173,7 @@ const isMonorepoRoot = (directory) => {
 	return Array.isArray(packageJson.workspaces) || Boolean(packageJson.workspaces?.packages);
 };
 const findMonorepoRoot = (startDirectory) => {
-	let currentDirectory = Path.dirname(startDirectory);
-	while (currentDirectory !== Path.dirname(currentDirectory)) {
-		if (isMonorepoRoot(currentDirectory)) return currentDirectory;
-		currentDirectory = Path.dirname(currentDirectory);
-	}
+	for (const directory of ancestorDirectories(startDirectory, { includeStart: false })) if (isMonorepoRoot(directory)) return directory;
 	return null;
 };
 /**
@@ -33792,6 +33819,74 @@ const findDependencyInfoFromMonorepoRoot = (directory) => {
 		framework: rootInfo.framework !== "unknown" ? rootInfo.framework : workspaceInfo.framework
 	};
 };
+/**
+* Walk up from `startDirectory` to the nearest ancestor that owns a
+* `package.json`, stopping at (and including) the enclosing project boundary
+* — the working tree's git root or a monorepo root. Lets a scan of a package
+* subfolder that has no `package.json` of its own adopt the nearest enclosing
+* package as its project root, so it inherits that package's dependency +
+* framework detection instead of synthesizing an empty (React-blind) project.
+*
+* Generalizes the older monorepo-root-only lookup: the nearest ancestor is the
+* most specific owning package (a leaf workspace, not just the repo root), so
+* a subfolder of one workspace no longer borrows a sibling's capabilities.
+*
+* Returns `null` when no ancestor `package.json` exists inside the project
+* boundary (a loose tree of files, or a subfolder of a package-less repo).
+*/
+const findNearestAncestorPackageJson = (startDirectory) => {
+	if (isProjectBoundary(startDirectory)) return null;
+	for (const directory of ancestorDirectories(startDirectory, { includeStart: false })) {
+		if (isFile(Path.join(directory, "package.json"))) return directory;
+		if (isProjectBoundary(directory)) return null;
+	}
+	return null;
+};
+/**
+* Last-resort React detection: locate React the way Node's `node_modules`
+* resolution would from `directory` — check each `node_modules/react` up the
+* tree — but bounded to the enclosing repo so a globally installed React can't
+* masquerade as the project's version. Stops at (and including) the nearest
+* project boundary — the git root or a monorepo root — and returns the first
+* installed `version`.
+*
+* Makes "React is installed and importable" ⇒ "React is detected" an invariant
+* for packages whose only React declaration is a version-less spec
+* (`workspace:*`, `*`, a dist-tag) or where React lives solely in a hoisted
+* `node_modules` the declaration walks never reach — the profile of a component
+* package inside a monorepo. Matching the `node_modules/react` entry rather than
+* its realpath means a project whose `node_modules` is symlinked elsewhere (a
+* Docker volume, a shared store) still counts, while a global install outside
+* the repo does not.
+*
+* Returns `null` when React isn't installed within the repo or its package.json
+* carries no version string. A tree with no boundary marker at all bounds the
+* search to `directory`, so a dependency hoisted above the scanned package there
+* is conservatively not adopted.
+*/
+/**
+* The nearest enclosing project boundary (git root or monorepo root), or
+* `directory` itself when the scan target sits outside any repo. Bounds the
+* node_modules walk so a React hoisted anywhere inside the repo counts, but a
+* React in an ancestor above the repo — a home-directory or global
+* `node_modules` — can't leak in.
+*/
+const findContainmentRoot = (directory) => {
+	for (const ancestorDirectory of ancestorDirectories(directory, { includeStart: true })) if (isProjectBoundary(ancestorDirectory)) return ancestorDirectory;
+	return directory;
+};
+const resolveInstalledReactVersion = (directory) => {
+	const containmentRoot = findContainmentRoot(directory);
+	for (const ancestorDirectory of ancestorDirectories(directory, { includeStart: true })) {
+		const reactPackageJsonPath = Path.join(ancestorDirectory, "node_modules", "react", "package.json");
+		if (isFile(reactPackageJsonPath)) {
+			const installedVersion = readPackageJson(reactPackageJsonPath).version;
+			return typeof installedVersion === "string" ? installedVersion : null;
+		}
+		if (ancestorDirectory === containmentRoot) return null;
+	}
+	return null;
+};
 const findInWorkspacePackageJsons = (rootDirectory, rootPackageJson, select) => {
 	const rootValue = select(rootPackageJson);
 	if (rootValue !== null) return rootValue;
@@ -34131,19 +34226,20 @@ const clearProjectCache = () => {
 };
 /**
 * Build a `ProjectInfo` for a directory that has no `package.json` of
-* its own — a monorepo subfolder like `repo/packages`, or any loose tree
-* of TypeScript/JavaScript files. Dependency + framework detection is
-* inherited from the enclosing workspace root when there is one, so
-* scanning a subdirectory of a React monorepo still gets the React
-* capabilities; a standalone non-React directory simply scans with the
-* framework-agnostic rules. Throws only when the directory has nothing
-* to scan (no enclosing project and no source files of its own).
+* its own — a package subfolder like `repo/packages` or `app/src/features`,
+* or any loose tree of TypeScript/JavaScript files. Dependency + framework
+* detection is inherited from the nearest enclosing package (a leaf
+* workspace, a plain app root, or a monorepo root — whichever is closest,
+* bounded by the git root), so scanning a subdirectory of a React project
+* still gets the React capabilities; a standalone non-React directory simply
+* scans with the framework-agnostic rules. Throws only when the directory has
+* nothing to scan (no enclosing project and no source files of its own).
 */
 const discoverProjectWithoutPackageJson = (directory) => {
 	const sourceFileCount = countSourceFiles(directory);
 	const hasOwnTsConfig = NFS.existsSync(Path.join(directory, "tsconfig.json"));
-	const monorepoRoot = findMonorepoRoot(directory);
-	const enclosingProject = monorepoRoot !== null && isFile(Path.join(monorepoRoot, "package.json")) ? discoverProject(monorepoRoot) : null;
+	const enclosingProjectRoot = findNearestAncestorPackageJson(directory);
+	const enclosingProject = enclosingProjectRoot !== null ? discoverProject(enclosingProjectRoot) : null;
 	if (enclosingProject !== null) return {
 		...enclosingProject,
 		rootDirectory: directory,
@@ -34247,6 +34343,7 @@ const discoverProject = (directory) => {
 	if (!reactVersion && reactDeclaration.version && !isCatalogReference(reactDeclaration.version)) reactVersion = reactDeclaration.version;
 	if (!tailwindVersion && tailwindDeclaration.version && !isCatalogReference(tailwindDeclaration.version)) tailwindVersion = tailwindDeclaration.version;
 	if (!zodVersion && zodDeclaration.version && !isCatalogReference(zodDeclaration.version)) zodVersion = zodDeclaration.version;
+	if (!reactVersion || parseReactMajor(reactVersion) === null) reactVersion = resolveInstalledReactVersion(directory) ?? reactVersion;
 	const projectName = packageJson.name ?? Path.basename(directory);
 	const hasTypeScript = NFS.existsSync(Path.join(directory, "tsconfig.json"));
 	const sourceFileCount = countSourceFiles(directory);
@@ -36995,10 +37092,17 @@ function* collectSecurityScanFiles(rootDirectory) {
 		}
 	}
 }
+/**
+* Whether project discovery resolved a React-compatible runtime (React or
+* Preact, which ships the same hooks + JSX model). This is the same
+* predicate that grants the `react` capability, so `false` means every
+* React-runtime rule family was gated off for the project.
+*/
+const hasReactRuntime = (project) => project.reactVersion !== null || project.preactVersion !== null;
 const buildCapabilities = (project) => {
 	const capabilities = /* @__PURE__ */ new Set();
 	capabilities.add(project.framework);
-	if (project.reactVersion !== null || project.preactVersion !== null) capabilities.add("react");
+	if (hasReactRuntime(project)) capabilities.add("react");
 	if (project.framework === "expo" || project.framework === "react-native" || project.hasReactNativeWorkspace) capabilities.add("react-native");
 	if (project.expoVersion !== null) capabilities.add("expo");
 	if (project.nextjsMajorVersion !== null && project.nextjsMajorVersion >= 15) capabilities.add("nextjs:15");
@@ -38528,7 +38632,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 			})),
 			showStagedContent: (directory, relativePath, options) => runCommand({
 				command: "git",
-				args: ["show", `:${relativePath}`],
+				args: ["show", `:./${relativePath}`],
 				directory,
 				maxStdoutBytes: options?.maxBufferBytes
 			}).pipe(map$3((result) => result.status === 0 ? result.stdout : null)),
@@ -39834,6 +39938,7 @@ const parseRuleCode = (code) => {
 	};
 };
 const resolveDiagnosticCategory = (plugin, rule) => getRuleCategory(rule) ?? lookupOwnString(PLUGIN_CATEGORY_MAP, plugin) ?? "Bugs";
+const resolveMatchByOccurrence = (rule, category) => OCCURRENCE_MATCHED_CATEGORIES.has(category) || Boolean(reactDoctorPlugin.rules[rule]?.matchByOccurrence);
 /**
 * Maps oxlint's non-primary labels (`labels[1..]`) into related source
 * locations. Editors surface these as a diagnostic's
@@ -39897,6 +40002,7 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 		const normalizedFilePath = diagnostic.filename.replaceAll("\\", "/");
 		const primarySpan = primaryLabel?.span;
 		const relatedLocations = buildRelatedLocations(diagnostic.labels, normalizedFilePath);
+		const category = resolveDiagnosticCategory(plugin, rule);
 		return {
 			filePath: normalizedFilePath,
 			plugin,
@@ -39912,7 +40018,8 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 				offset: primarySpan.offset,
 				length: primarySpan.length
 			} : {},
-			category: resolveDiagnosticCategory(plugin, rule),
+			category,
+			...resolveMatchByOccurrence(rule, category) ? { matchByOccurrence: true } : {},
 			...relatedLocations.length > 0 ? { relatedLocations } : {}
 		};
 	});
@@ -42085,7 +42192,7 @@ const computeConfigFingerprint = (projectDirectory, version) => {
 /** Display name used in client-facing messages and progress titles. */
 const SERVER_DISPLAY_NAME = "React Doctor";
 /** Server version reported in `serverInfo`; injected at build, `dev` from source. */
-const SERVER_VERSION = "0.7.0";
+const SERVER_VERSION = "0.7.1";
 /** `Diagnostic.source` shown next to every published diagnostic. */
 const DIAGNOSTIC_SOURCE = "react-doctor";
 /**
@@ -43792,6 +43899,7 @@ const METRIC = {
 	scanScore: "scan.score",
 	scanClean: "scan.clean",
 	scanCheckSkipped: "scan.check_skipped",
+	scanNoReactDetected: "scan.no_react_detected",
 	baselineDegraded: "baseline.degraded",
 	ruleFired: "rule.fired",
 	ruleDisabled: "rule.disabled",
@@ -44135,5 +44243,5 @@ const startLanguageServer = () => {
 };
 //#endregion
 export { startLanguageServer };
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1b40bd68-7ad4-55e0-a6bd-91b6cdcd0ba8")}catch(e){}}();
-//# debugId=1b40bd68-7ad4-55e0-a6bd-91b6cdcd0ba8
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8bc40ab2-982a-5d5d-a65c-9733ec980391")}catch(e){}}();
+//# debugId=8bc40ab2-982a-5d5d-a65c-9733ec980391

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-doctor",
-  "version": "0.7.0",
+  "version": "0.7.1-dev.1880b15",
   "description": "Your agent writes bad React. This catches it",
   "keywords": [
     "accessibility",
@@ -65,8 +65,8 @@
     "vscode-languageserver-textdocument": "^1.0.12",
     "vscode-uri": "^3.1.0",
     "yaml": "^2.9.0",
-    "deslop-js": "0.7.0",
-    "oxlint-plugin-react-doctor": "0.7.0"
+    "deslop-js": "0.7.1",
+    "oxlint-plugin-react-doctor": "0.7.1-dev.1880b15"
   },
   "devDependencies": {
     "@types/babel__code-frame": "^7.27.0",
@@ -74,9 +74,9 @@
     "@xterm/headless": "^6.0.0",
     "commander": "^14.0.3",
     "ora": "^9.4.0",
-    "@react-doctor/api": "0.7.0",
-    "@react-doctor/core": "0.7.0",
-    "@react-doctor/language-server": "0.7.0"
+    "@react-doctor/language-server": "0.7.1",
+    "@react-doctor/core": "0.7.1",
+    "@react-doctor/api": "0.7.1"
   },
   "engines": {
     "node": "^20.19.0 || >=22.13.0"