react-doctor 0.7.1-dev.64452aa → 0.7.1-dev.7cf4d0b

package/dist/cli.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="57f4381b-7060-58c6-88a4-95b4c97d3b74")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7b7c23b7-250e-5339-af06-e3e3b5eb5f98")}catch(e){}}();
 import { createRequire } from "node:module";
 import * as NodeChildProcess from "node:child_process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
@@ -9,7 +9,7 @@ import * as NFS from "node:fs";
 import fs, { mkdtempSync, rmSync } from "node:fs";
 import process$1 from "node:process";
 import * as ts from "typescript";
-import reactDoctorPlugin, { ALL_REACT_DOCTOR_RULE_KEYS, CROSS_FILE_DEPENDENCY_COLLECTORS, CROSS_FILE_RULE_IDS, FRAMEWORK_SPECIFIC_RULE_KEYS, MOTION_LIBRARY_PACKAGES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES, classifySecurityScanFile, collectCrossFileDependencyProbes, shouldReadSecurityScanContent } from "oxlint-plugin-react-doctor";
+import reactDoctorPlugin, { ALL_REACT_DOCTOR_RULE_KEYS, CROSS_FILE_DEPENDENCY_COLLECTORS, CROSS_FILE_RULE_IDS, FRAMEWORK_SPECIFIC_RULE_KEYS, MOTION_LIBRARY_PACKAGES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES, classifySecurityScanFile, collectCrossFileDependencyProbes, resetManifestCaches, shouldReadSecurityScanContent } from "oxlint-plugin-react-doctor";
 import * as OS from "node:os";
 import os, { tmpdir } from "node:os";
 import { parseJSON5 } from "confbox";
@@ -35968,8 +35968,10 @@ const isFile = (filePath) => {
 };
 const SOURCE_FILE_PATTERN = /\.(tsx?|jsx?|mts|mjs)$/;
 const GENERATED_BUNDLE_FILE_PATTERN = /\.(iife|umd|global|min)\.m?js$/i;
+const GENERATED_SOURCE_DIRECTORY_PATTERN = /(?:^|\/)__generated__\//;
 const MINIFIED_SNIFF_BYTES = 65536;
 const GIT_LS_FILES_MAX_BUFFER_BYTES = 50 * 1024 * 1024;
+const SCANNED_DOT_DIRECTORIES = new Set([".dumi", ".storybook"]);
 const IGNORED_DIRECTORIES = new Set([
 	".angular",
 	".astro",
@@ -36154,8 +36156,9 @@ const SUPPLY_CHAIN_OVERLAP_TIMEOUT_MS = 9e4;
 const SUPPLY_CHAIN_CACHE_TTL_MS = 864e5;
 const SUPPLY_CHAIN_CACHE_SUBDIR = "supply-chain";
 const SUPPLY_CHAIN_IGNORED_PACKAGES = new Set(["next"]);
-const hasIgnoredPathSegment = (relativePath) => relativePath.split(/[/\\]/).slice(0, -1).some((segment) => IGNORED_DIRECTORIES.has(segment));
-const isLintableSourceFile = (filePath) => SOURCE_FILE_PATTERN.test(filePath) && !GENERATED_BUNDLE_FILE_PATTERN.test(filePath);
+const isIgnoredDirectoryName = (directoryName) => IGNORED_DIRECTORIES.has(directoryName) || directoryName.startsWith(".") && !SCANNED_DOT_DIRECTORIES.has(directoryName);
+const hasIgnoredPathSegment = (relativePath) => relativePath.split(/[/\\]/).slice(0, -1).some((segment) => isIgnoredDirectoryName(segment));
+const isLintableSourceFile = (filePath) => SOURCE_FILE_PATTERN.test(filePath) && !GENERATED_BUNDLE_FILE_PATTERN.test(filePath) && !GENERATED_SOURCE_DIRECTORY_PATTERN.test(filePath);
 const isMinifiedSource = (absolutePath) => {
 	let fileDescriptor;
 	try {
@@ -36216,7 +36219,7 @@ function* walkSourceTreeFiles(rootDirectory) {
 		for (const entry of readDirectoryEntries(currentDirectory)) {
 			const absolutePath = Path.join(currentDirectory, entry.name);
 			if (entry.isDirectory()) {
-				if (!IGNORED_DIRECTORIES.has(entry.name)) stack.push(absolutePath);
+				if (!isIgnoredDirectoryName(entry.name)) stack.push(absolutePath);
 				continue;
 			}
 			if (entry.isFile()) yield {
@@ -36262,6 +36265,23 @@ const listSourceFilesViaFilesystem = (rootDirectory) => {
 const listSourceFilesWithSize = (rootDirectory) => collectSizedSourceFiles(rootDirectory, (listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory)).sort());
 const listSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).map((entry) => entry.path);
 const countSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).length;
+/**
+* The chain of ancestor directories of `startDirectory`, nearest first, up to
+* and including the filesystem root. With `includeStart`, the chain begins at
+* `startDirectory` itself; otherwise at its parent. The one place the "walk up
+* the tree" traversal is expressed, so each caller adds only its own match /
+* stop policy instead of re-deriving the `path.dirname` loop.
+*/
+const ancestorDirectories = (startDirectory, { includeStart }) => {
+	const directories = [];
+	let currentDirectory = includeStart ? startDirectory : Path.dirname(startDirectory);
+	while (true) {
+		directories.push(currentDirectory);
+		const parentDirectory = Path.dirname(currentDirectory);
+		if (parentDirectory === currentDirectory) return directories;
+		currentDirectory = parentDirectory;
+	}
+};
 const cachedPackageJsons = /* @__PURE__ */ new Map();
 const readPackageJsonUncached = (packageJsonPath) => {
 	try {
@@ -36292,11 +36312,7 @@ const isMonorepoRoot = (directory) => {
 	return Array.isArray(packageJson.workspaces) || Boolean(packageJson.workspaces?.packages);
 };
 const findMonorepoRoot = (startDirectory) => {
-	let currentDirectory = Path.dirname(startDirectory);
-	while (currentDirectory !== Path.dirname(currentDirectory)) {
-		if (isMonorepoRoot(currentDirectory)) return currentDirectory;
-		currentDirectory = Path.dirname(currentDirectory);
-	}
+	for (const directory of ancestorDirectories(startDirectory, { includeStart: false })) if (isMonorepoRoot(directory)) return directory;
 	return null;
 };
 /**
@@ -36942,6 +36958,74 @@ const findDependencyInfoFromMonorepoRoot = (directory) => {
 		framework: rootInfo.framework !== "unknown" ? rootInfo.framework : workspaceInfo.framework
 	};
 };
+/**
+* Walk up from `startDirectory` to the nearest ancestor that owns a
+* `package.json`, stopping at (and including) the enclosing project boundary
+* — the working tree's git root or a monorepo root. Lets a scan of a package
+* subfolder that has no `package.json` of its own adopt the nearest enclosing
+* package as its project root, so it inherits that package's dependency +
+* framework detection instead of synthesizing an empty (React-blind) project.
+*
+* Generalizes the older monorepo-root-only lookup: the nearest ancestor is the
+* most specific owning package (a leaf workspace, not just the repo root), so
+* a subfolder of one workspace no longer borrows a sibling's capabilities.
+*
+* Returns `null` when no ancestor `package.json` exists inside the project
+* boundary (a loose tree of files, or a subfolder of a package-less repo).
+*/
+const findNearestAncestorPackageJson = (startDirectory) => {
+	if (isProjectBoundary(startDirectory)) return null;
+	for (const directory of ancestorDirectories(startDirectory, { includeStart: false })) {
+		if (isFile(Path.join(directory, "package.json"))) return directory;
+		if (isProjectBoundary(directory)) return null;
+	}
+	return null;
+};
+/**
+* Last-resort React detection: locate React the way Node's `node_modules`
+* resolution would from `directory` — check each `node_modules/react` up the
+* tree — but bounded to the enclosing repo so a globally installed React can't
+* masquerade as the project's version. Stops at (and including) the nearest
+* project boundary — the git root or a monorepo root — and returns the first
+* installed `version`.
+*
+* Makes "React is installed and importable" ⇒ "React is detected" an invariant
+* for packages whose only React declaration is a version-less spec
+* (`workspace:*`, `*`, a dist-tag) or where React lives solely in a hoisted
+* `node_modules` the declaration walks never reach — the profile of a component
+* package inside a monorepo. Matching the `node_modules/react` entry rather than
+* its realpath means a project whose `node_modules` is symlinked elsewhere (a
+* Docker volume, a shared store) still counts, while a global install outside
+* the repo does not.
+*
+* Returns `null` when React isn't installed within the repo or its package.json
+* carries no version string. A tree with no boundary marker at all bounds the
+* search to `directory`, so a dependency hoisted above the scanned package there
+* is conservatively not adopted.
+*/
+/**
+* The nearest enclosing project boundary (git root or monorepo root), or
+* `directory` itself when the scan target sits outside any repo. Bounds the
+* node_modules walk so a React hoisted anywhere inside the repo counts, but a
+* React in an ancestor above the repo — a home-directory or global
+* `node_modules` — can't leak in.
+*/
+const findContainmentRoot = (directory) => {
+	for (const ancestorDirectory of ancestorDirectories(directory, { includeStart: true })) if (isProjectBoundary(ancestorDirectory)) return ancestorDirectory;
+	return directory;
+};
+const resolveInstalledReactVersion = (directory) => {
+	const containmentRoot = findContainmentRoot(directory);
+	for (const ancestorDirectory of ancestorDirectories(directory, { includeStart: true })) {
+		const reactPackageJsonPath = Path.join(ancestorDirectory, "node_modules", "react", "package.json");
+		if (isFile(reactPackageJsonPath)) {
+			const installedVersion = readPackageJson$1(reactPackageJsonPath).version;
+			return typeof installedVersion === "string" ? installedVersion : null;
+		}
+		if (ancestorDirectory === containmentRoot) return null;
+	}
+	return null;
+};
 const findInWorkspacePackageJsons = (rootDirectory, rootPackageJson, select) => {
 	const rootValue = select(rootPackageJson);
 	if (rootValue !== null) return rootValue;
@@ -37098,6 +37182,10 @@ const normalizeCompilerOptions = (compilerOptions) => {
 		hasExplicitLib
 	};
 };
+const normalizeReferencePaths = (references) => {
+	if (!Array.isArray(references)) return [];
+	return references.map((reference) => isPlainObject(reference) && typeof reference.path === "string" ? reference.path : null).filter((referencePath) => referencePath !== null);
+};
 const readTsConfig = (filePath) => {
 	let content;
 	try {
@@ -37109,6 +37197,7 @@ const readTsConfig = (filePath) => {
 	if (!isPlainObject(parsed.config)) return null;
 	return {
 		extends: typeof parsed.config.extends === "string" ? parsed.config.extends : void 0,
+		referencePaths: normalizeReferencePaths(parsed.config.references),
 		compilerOptions: normalizeCompilerOptions(parsed.config.compilerOptions)
 	};
 };
@@ -37149,20 +37238,37 @@ const libEntryIncludesES2023Array = (entry) => {
 };
 const libIncludesES2023 = (lib) => lib.some(libEntryIncludesES2023Array);
 const compilerOptionsArePreES2023 = (compilerOptions) => {
+	if (compilerOptions.target && targetYearIsPreES2023(compilerOptions.target)) return true;
 	if (compilerOptions.hasExplicitLib) return !libIncludesES2023(compilerOptions.lib ?? []);
-	if (compilerOptions.target) return targetYearIsPreES2023(compilerOptions.target);
 	return false;
 };
 const compilerOptionsDeclareTargetOrLib = (compilerOptions) => compilerOptions.hasExplicitLib || compilerOptions.target !== void 0;
-const detectPreES2023FromConfig = (tsConfigPath) => {
+const detectPreES2023FromConfig = (tsConfigPath, visitedConfigPaths = /* @__PURE__ */ new Set()) => {
+	if (visitedConfigPaths.has(tsConfigPath)) return false;
 	const compilerOptions = readResolvedCompilerOptions(tsConfigPath, 0, /* @__PURE__ */ new Set());
 	if (!compilerOptions) return false;
-	if (!compilerOptionsDeclareTargetOrLib(compilerOptions)) return false;
+	if (!compilerOptionsDeclareTargetOrLib(compilerOptions)) {
+		const tsConfig = readTsConfig(tsConfigPath);
+		if (!tsConfig) return false;
+		const nextVisitedConfigPaths = new Set(visitedConfigPaths);
+		nextVisitedConfigPaths.add(tsConfigPath);
+		const configDirectory = Path.dirname(tsConfigPath);
+		return tsConfig.referencePaths.some((referencePath) => {
+			const resolvedReferencePath = Path.resolve(configDirectory, referencePath);
+			const referencedConfigPath = isFile(resolvedReferencePath) ? resolvedReferencePath : Path.join(resolvedReferencePath, TSCONFIG_FILENAME);
+			return isFile(referencedConfigPath) && detectPreES2023FromConfig(referencedConfigPath, nextVisitedConfigPaths);
+		});
+	}
 	return compilerOptionsArePreES2023(compilerOptions);
 };
+const FALLBACK_TSCONFIG_FILENAMES = ["tsconfig.app.json", "tsconfig.build.json"];
 const detectPreES2023Target = (directory) => {
 	const tsConfigPath = Path.join(directory, TSCONFIG_FILENAME);
 	if (isFile(tsConfigPath)) return detectPreES2023FromConfig(tsConfigPath);
+	for (const fallbackFilename of FALLBACK_TSCONFIG_FILENAMES) {
+		const fallbackPath = Path.join(directory, fallbackFilename);
+		if (isFile(fallbackPath)) return detectPreES2023FromConfig(fallbackPath);
+	}
 	return false;
 };
 const REACT_DEPENDENCY_NAMES = new Set([
@@ -37278,19 +37384,20 @@ const discoverReactSubprojects = (rootDirectory) => {
 const cachedProjectInfos = /* @__PURE__ */ new Map();
 /**
 * Build a `ProjectInfo` for a directory that has no `package.json` of
-* its own — a monorepo subfolder like `repo/packages`, or any loose tree
-* of TypeScript/JavaScript files. Dependency + framework detection is
-* inherited from the enclosing workspace root when there is one, so
-* scanning a subdirectory of a React monorepo still gets the React
-* capabilities; a standalone non-React directory simply scans with the
-* framework-agnostic rules. Throws only when the directory has nothing
-* to scan (no enclosing project and no source files of its own).
+* its own — a package subfolder like `repo/packages` or `app/src/features`,
+* or any loose tree of TypeScript/JavaScript files. Dependency + framework
+* detection is inherited from the nearest enclosing package (a leaf
+* workspace, a plain app root, or a monorepo root — whichever is closest,
+* bounded by the git root), so scanning a subdirectory of a React project
+* still gets the React capabilities; a standalone non-React directory simply
+* scans with the framework-agnostic rules. Throws only when the directory has
+* nothing to scan (no enclosing project and no source files of its own).
 */
 const discoverProjectWithoutPackageJson = (directory) => {
 	const sourceFileCount = countSourceFiles(directory);
 	const hasOwnTsConfig = NFS.existsSync(Path.join(directory, "tsconfig.json"));
-	const monorepoRoot = findMonorepoRoot(directory);
-	const enclosingProject = monorepoRoot !== null && isFile(Path.join(monorepoRoot, "package.json")) ? discoverProject(monorepoRoot) : null;
+	const enclosingProjectRoot = findNearestAncestorPackageJson(directory);
+	const enclosingProject = enclosingProjectRoot !== null ? discoverProject(enclosingProjectRoot) : null;
 	if (enclosingProject !== null) return {
 		...enclosingProject,
 		rootDirectory: directory,
@@ -37320,6 +37427,7 @@ const discoverProjectWithoutPackageJson = (directory) => {
 		shopifyFlashListVersion: null,
 		shopifyFlashListMajorVersion: null,
 		hasReanimated: false,
+		reanimatedVersion: null,
 		isPreES2023Target: hasOwnTsConfig && detectPreES2023Target(directory),
 		sourceFileCount
 	};
@@ -37394,6 +37502,7 @@ const discoverProject = (directory) => {
 	if (!reactVersion && reactDeclaration.version && !isCatalogReference(reactDeclaration.version)) reactVersion = reactDeclaration.version;
 	if (!tailwindVersion && tailwindDeclaration.version && !isCatalogReference(tailwindDeclaration.version)) tailwindVersion = tailwindDeclaration.version;
 	if (!zodVersion && zodDeclaration.version && !isCatalogReference(zodDeclaration.version)) zodVersion = zodDeclaration.version;
+	if (!reactVersion || parseReactMajor(reactVersion) === null) reactVersion = resolveInstalledReactVersion(directory) ?? reactVersion;
 	const projectName = packageJson.name ?? Path.basename(directory);
 	const hasTypeScript = NFS.existsSync(Path.join(directory, "tsconfig.json"));
 	const sourceFileCount = countSourceFiles(directory);
@@ -37411,6 +37520,7 @@ const discoverProject = (directory) => {
 		version: findShopifyFlashListVersion(directory, packageJson)
 	}) : null;
 	const hasReanimated = hasReactNativeWorkspace && someWorkspacePackageJson(directory, packageJson, isPackageJsonReanimatedAware);
+	const reanimatedVersion = hasReanimated ? findInWorkspacePackageJsons(directory, packageJson, (workspacePackageJson) => getDependencySpec(workspacePackageJson, REANIMATED_DEPENDENCY_NAME)) : null;
 	const nextjsVersion = framework === "nextjs" ? resolveCatalogBackedDependencyVersion({
 		rootDirectory: directory,
 		rootPackageJson: packageJson,
@@ -37440,6 +37550,7 @@ const discoverProject = (directory) => {
 		shopifyFlashListVersion,
 		shopifyFlashListMajorVersion: shopifyFlashListVersion === null ? null : getLowestDependencyMajor(shopifyFlashListVersion),
 		hasReanimated,
+		reanimatedVersion,
 		isPreES2023Target,
 		sourceFileCount
 	};
@@ -37632,6 +37743,9 @@ const buildRuleSeverityControls = (config) => {
 		...config.buckets !== void 0 ? { buckets: config.buckets } : {}
 	};
 };
+const FOREIGN_INLINE_DISABLE_PATTERN = /(?:\/\/|\/\*)[ \t]*(eslint|oxlint)-disable-(next-line|line)(?![\w-])([^\r\n]*)/;
+const FOREIGN_BLOCK_DISABLE_PATTERN = /\/\*[ \t]*(eslint|oxlint)-disable(?![\w-])([^*\r\n]*)/;
+const FOREIGN_BLOCK_ENABLE_PATTERN = /\/\*[ \t]*(?:eslint|oxlint)-enable(?![\w-])([^*\r\n]*)/;
 const LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY = {
 	"effect/no-adjust-state-on-prop-change": "react-doctor/no-adjust-state-on-prop-change",
 	"effect/no-chain-state-updates": "react-doctor/no-chain-state-updates",
@@ -37709,6 +37823,7 @@ const LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY = {
 	"react/jsx-no-new-function-as-prop": "react-doctor/jsx-no-new-function-as-prop",
 	"react/jsx-no-new-object-as-prop": "react-doctor/jsx-no-new-object-as-prop",
 	"react/jsx-no-script-url": "react-doctor/jsx-no-script-url",
+	"react/jsx-no-target-blank": "react-doctor/jsx-no-target-blank",
 	"react/jsx-no-undef": "react-doctor/jsx-no-undef",
 	"react/jsx-no-useless-fragment": "react-doctor/jsx-no-useless-fragment",
 	"react/jsx-pascal-case": "react-doctor/jsx-pascal-case",
@@ -37793,9 +37908,6 @@ const tokenizeRuleList = (ruleList) => {
 	if (!ruleSection) return [];
 	return ruleSection.split(/[,\s]+/).map((token) => token.trim()).filter(Boolean);
 };
-const FOREIGN_INLINE_DISABLE_PATTERN = /(?:\/\/|\/\*)[ \t]*(eslint|oxlint)-disable-(next-line|line)(?![\w-])([^\r\n]*)/;
-const FOREIGN_BLOCK_DISABLE_PATTERN = /\/\*[ \t]*(eslint|oxlint)-disable(?![\w-])([^*\r\n]*)/;
-const FOREIGN_BLOCK_ENABLE_PATTERN = /\/\*[ \t]*(?:eslint|oxlint)-enable(?![\w-])([^*\r\n]*)/;
 const buildHint = (tool, token, ruleId) => `oxlint matches plugin rules only by their full name, so \`${token}\` in your ${tool}-disable comment does not silence \`${ruleId}\` — add \`${ruleId}\` to the comment (e.g. \`${token}, ${ruleId}\`).`;
 const tokenMisnamesRule = (token, ruleId) => token !== ruleId && isSameRuleKey(token, ruleId);
 const detectInlineNearMiss = (lines, diagnosticLineIndex, ruleId) => {
@@ -37849,6 +37961,53 @@ const detectForeignDisableNearMiss = (lines, diagnosticLineIndex, ruleId) => {
 	if (!ruleId.startsWith("react-doctor/")) return null;
 	return detectInlineNearMiss(lines, diagnosticLineIndex, ruleId) ?? detectBlockNearMiss(lines, diagnosticLineIndex, ruleId);
 };
+const ESLINT_REACT_HOOKS_PLUGIN_PREFIX = "react-hooks/";
+const buildAcceptedTokens = (ruleId) => {
+	const shortRuleId = ruleId.slice(15);
+	return new Set([ruleId, `${ESLINT_REACT_HOOKS_PLUGIN_PREFIX}${shortRuleId}`]);
+};
+const listNamesRule = (ruleList, acceptedTokens) => tokenizeRuleList(ruleList).some((token) => acceptedTokens.has(token));
+const isInlineDisabled = (lines, diagnosticLineIndex, acceptedTokens) => {
+	const candidates = [{
+		line: lines[diagnosticLineIndex],
+		requiredScope: "line"
+	}, {
+		line: lines[diagnosticLineIndex - 1],
+		requiredScope: "next-line"
+	}];
+	for (const { line, requiredScope } of candidates) {
+		const match = line?.match(FOREIGN_INLINE_DISABLE_PATTERN);
+		if (!match) continue;
+		const [, , scope, ruleList] = match;
+		if (scope !== requiredScope) continue;
+		if (listNamesRule(ruleList, acceptedTokens)) return true;
+	}
+	return false;
+};
+const isBlockDisabled = (lines, diagnosticLineIndex, acceptedTokens) => {
+	let isRangeOpen = false;
+	const lastLineIndex = Math.min(diagnosticLineIndex, lines.length - 1);
+	for (let lineIndex = 0; lineIndex <= lastLineIndex; lineIndex++) {
+		const line = lines[lineIndex];
+		if (line === void 0 || !line.includes("-disable") && !line.includes("-enable")) continue;
+		const disableMatch = line.match(FOREIGN_BLOCK_DISABLE_PATTERN);
+		if (disableMatch && listNamesRule(disableMatch[2], acceptedTokens)) {
+			isRangeOpen = true;
+			continue;
+		}
+		const enableMatch = line.match(FOREIGN_BLOCK_ENABLE_PATTERN);
+		if (enableMatch) {
+			const enabledRules = tokenizeRuleList(enableMatch[1]);
+			if (enabledRules.length === 0 || enabledRules.some((rule) => acceptedTokens.has(rule))) isRangeOpen = false;
+		}
+	}
+	return isRangeOpen;
+};
+const isCompilerRuleForeignDisabled = (lines, diagnosticLineIndex, ruleId) => {
+	if (!ruleId.startsWith("react-hooks-js/")) return false;
+	const acceptedTokens = buildAcceptedTokens(ruleId);
+	return isInlineDisabled(lines, diagnosticLineIndex, acceptedTokens) || isBlockDisabled(lines, diagnosticLineIndex, acceptedTokens);
+};
 const JSX_OPENER_TAG_PATTERN = /<[A-Za-z][\w.]*/g;
 const JSX_TAG_NAME_FOLLOW = /[A-Za-z]/;
 const isOpenerMatchInsideLineComment = (line, openerCharIndex) => {
@@ -37992,6 +38151,11 @@ const evaluateSuppression = (lines, diagnosticLineIndex, ruleId) => {
 		isSuppressed: true,
 		nearMissHint: null
 	};
+	if (isCompilerRuleForeignDisabled(lines, diagnosticLineIndex, ruleId)) return {
+		isSuppressed: true,
+		nearMissHint: null,
+		isForeignDirective: true
+	};
 	const directComments = findStackedDisableCommentsAbove(lines, diagnosticLineIndex);
 	if (hasChainSuppressor(directComments, ruleId)) return {
 		isSuppressed: true,
@@ -38273,12 +38437,18 @@ const collectStringSet = (values) => {
 	return new Set(values.filter((value) => typeof value === "string"));
 };
 const JSX_NO_UNDEF_IDENTIFIER_PATTERN = /^`([^`]+)`/;
+const NODE_CLI_PATH_SEGMENTS = new Set([
+	"scripts",
+	"bin",
+	"tools"
+]);
+const hasNodeCliPathSegment = (filePath) => filePath.split(/[\\/]/).slice(0, -1).some((segment) => NODE_CLI_PATH_SEGMENTS.has(segment));
 /**
 * Pre-compiles every stateful filter and returns a single
 * `apply(diagnostic)` closure that runs (in order):
 *
 * 1. auto-suppress (test-noise rules in test files; `migration-hint`
-*    wins over `test-noise`)
+*    wins over `test-noise`; `no-console` on Node CLI scripts)
 * 2. severity overrides (top-level `rules` / `categories`, with
 *    `"off"` dropping)
 * 3. warning suppression (only when `showWarnings` is false: drops every
@@ -38376,6 +38546,12 @@ const buildDiagnosticPipeline = (input) => {
 		if (hasRawTextWrappers && isInsideStringOnlyWrapper(lines, diagnostic.line, diagnostic.column, rawTextWrapperComponentNames)) return true;
 		return false;
 	};
+	const isNoConsoleOnNodeCliScript = (diagnostic) => {
+		if (diagnostic.rule !== "no-console") return false;
+		if (hasNodeCliPathSegment(diagnostic.filePath)) return true;
+		const lines = getFileLines(diagnostic.filePath);
+		return lines !== null && Boolean(lines[0]?.startsWith("#!"));
+	};
 	const isJsxNoUndefSuppressedByConfig = (diagnostic) => {
 		if (!hasRuntimeGlobals) return false;
 		if (diagnostic.rule !== "jsx-no-undef") return false;
@@ -38385,6 +38561,7 @@ const buildDiagnosticPipeline = (input) => {
 	return {
 		apply: (diagnostic) => {
 			if (shouldAutoSuppress(diagnostic)) return null;
+			if (isNoConsoleOnNodeCliScript(diagnostic)) return null;
 			let current = diagnostic;
 			let explicitSeverityOverride;
 			let explicitRuleOverride;
@@ -38414,7 +38591,7 @@ const buildDiagnosticPipeline = (input) => {
 				if (lines) {
 					const ruleIdentifier = `${current.plugin}/${current.rule}`;
 					const evaluation = evaluateSuppression(lines, current.line - 1, ruleIdentifier);
-					if (evaluation.isSuppressed) return suppress(current, "inline");
+					if (evaluation.isSuppressed) return suppress(current, evaluation.isForeignDirective ? "foreign-inline" : "inline");
 					if (evaluation.nearMissHint) current = {
 						...current,
 						suppressionHint: evaluation.nearMissHint
@@ -42590,9 +42767,17 @@ const buildNoSecretsRecommendation = (project, fallbackRecommendation) => {
 	return `Move secrets to server-only code. In ${formatFrameworkName(project.framework)}, only \`${publicEnvPrefix}\` env vars are exposed to the browser, and they must not contain secrets`;
 };
 const REANIMATED_SHARED_VALUE_HINT = "If this is a Reanimated shared value, prefer its React Compiler-compatible `.get()` / `.set()` accessors over `.value` — https://docs.swmansion.com/react-native-reanimated/docs/core/useSharedValue/#react-compiler-support";
+const ACCESSORS_MIN_VERSION = "3.15.0";
+const supportsAccessors = (reanimatedVersion) => {
+	if (reanimatedVersion === null) return true;
+	const lowerBound = import_semver.validRange(reanimatedVersion) !== null ? import_semver.minVersion(reanimatedVersion) : import_semver.coerce(reanimatedVersion);
+	if (lowerBound === null) return true;
+	return import_semver.gte(lowerBound, ACCESSORS_MIN_VERSION);
+};
 const appendReanimatedSharedValueHint = (help, rule, project) => {
 	if (rule !== "immutability") return help;
 	if (!project.hasReanimated) return help;
+	if (!supportsAccessors(project.reanimatedVersion)) return help;
 	if (!help) return REANIMATED_SHARED_VALUE_HINT;
 	return `${help}\n\n${REANIMATED_SHARED_VALUE_HINT}`;
 };
@@ -42754,13 +42939,13 @@ const REACT_USE_BINDING_RESOLUTION = {
 	isReactUseBinding: true,
 	isReactNamespaceBinding: false
 };
-const getScriptKind = (filename) => {
+const getScriptKind$2 = (filename) => {
 	if (filename.endsWith(".tsx")) return ts.ScriptKind.TSX;
 	if (filename.endsWith(".jsx")) return ts.ScriptKind.JSX;
 	if (filename.endsWith(".ts")) return ts.ScriptKind.TS;
 	return ts.ScriptKind.JS;
 };
-const getUtf16Offset = (sourceText, utf8Offset) => Buffer.from(sourceText).subarray(0, utf8Offset).toString("utf8").length;
+const getUtf16Offset$1 = (sourceText, utf8Offset) => Buffer.from(sourceText).subarray(0, utf8Offset).toString("utf8").length;
 const unwrapExpression = (expression) => {
 	let currentExpression = expression;
 	while (ts.isParenthesizedExpression(currentExpression) || ts.isAsExpression(currentExpression) || ts.isSatisfiesExpression(currentExpression) || ts.isNonNullExpression(currentExpression) || ts.isTypeAssertionExpression(currentExpression)) currentExpression = currentExpression.expression;
@@ -43009,8 +43194,8 @@ const findUseCallIdentifier = (sourceFile, useOffset) => {
 	return matchedIdentifier;
 };
 const resolveUseCallBinding = (sourceText, filename, utf8Offset) => {
-	const sourceFile = ts.createSourceFile(filename, sourceText, ts.ScriptTarget.Latest, true, getScriptKind(filename));
-	const useIdentifier = findUseCallIdentifier(sourceFile, getUtf16Offset(sourceText, utf8Offset));
+	const sourceFile = ts.createSourceFile(filename, sourceText, ts.ScriptTarget.Latest, true, getScriptKind$2(filename));
+	const useIdentifier = findUseCallIdentifier(sourceFile, getUtf16Offset$1(sourceText, utf8Offset));
 	if (!useIdentifier) return null;
 	return resolveIdentifierBinding(useIdentifier, collectReactImportBindings(sourceFile), sourceFile);
 };
@@ -43031,6 +43216,201 @@ const shouldSuppressLocalUseHookDiagnostic = (diagnostic, rootDirectory) => {
 	const bindingResolution = resolveUseCallBinding(sourceText, absolutePath, primaryLabel.span.offset);
 	return bindingResolution !== null && !bindingResolution.isReactUseBinding;
 };
+const SUPPRESSED_COMPILER_CODES = new Set(["react-hooks-js(immutability)", "react-hooks-js(refs)"]);
+const WORKLET_DIRECTIVE = "worklet";
+const WORKLET_ACCEPTING_CALLEES = new Set([
+	"useAnimatedStyle",
+	"useAnimatedProps",
+	"useDerivedValue",
+	"useAnimatedReaction",
+	"useAnimatedScrollHandler",
+	"useAnimatedGestureHandler",
+	"useFrameCallback",
+	"runOnUI",
+	"executeOnUIRuntimeSync"
+]);
+const GESTURE_ROOT_IDENTIFIER = "Gesture";
+const getScriptKind$1 = (filename) => {
+	if (filename.endsWith(".tsx")) return ts.ScriptKind.TSX;
+	if (filename.endsWith(".jsx")) return ts.ScriptKind.JSX;
+	if (filename.endsWith(".ts")) return ts.ScriptKind.TS;
+	return ts.ScriptKind.JS;
+};
+const getUtf16Offset = (sourceText, utf8Offset) => Buffer.from(sourceText).subarray(0, utf8Offset).toString("utf8").length;
+const hasWorkletDirective = (node) => {
+	if (!ts.isFunctionDeclaration(node) && !ts.isFunctionExpression(node) && !ts.isArrowFunction(node) && !ts.isMethodDeclaration(node)) return false;
+	const body = node.body;
+	if (!body || !ts.isBlock(body)) return false;
+	for (const statement of body.statements) {
+		if (!ts.isExpressionStatement(statement)) return false;
+		if (!ts.isStringLiteral(statement.expression)) return false;
+		if (statement.expression.text === WORKLET_DIRECTIVE) return true;
+	}
+	return false;
+};
+const rootIdentifierOfCallChain = (expression) => {
+	let currentExpression = expression;
+	while (true) {
+		if (ts.isIdentifier(currentExpression)) return currentExpression.text;
+		if (ts.isPropertyAccessExpression(currentExpression)) {
+			currentExpression = currentExpression.expression;
+			continue;
+		}
+		if (ts.isCallExpression(currentExpression)) {
+			currentExpression = currentExpression.expression;
+			continue;
+		}
+		return null;
+	}
+};
+const isWorkletAcceptingCall = (callExpression) => {
+	const callee = callExpression.expression;
+	if (ts.isIdentifier(callee)) return WORKLET_ACCEPTING_CALLEES.has(callee.text);
+	if (ts.isPropertyAccessExpression(callee)) {
+		if (WORKLET_ACCEPTING_CALLEES.has(callee.name.text)) return true;
+		return rootIdentifierOfCallChain(callee) === GESTURE_ROOT_IDENTIFIER;
+	}
+	return false;
+};
+const isFunctionWorklet = (functionNode) => {
+	if (hasWorkletDirective(functionNode)) return true;
+	const parent = functionNode.parent;
+	return ts.isCallExpression(parent) && parent.arguments.some((argument) => argument === functionNode) && isWorkletAcceptingCall(parent);
+};
+const findNodeAtOffset = (sourceFile, targetOffset) => {
+	let matchedNode = null;
+	const visit = (node) => {
+		if (node.getStart(sourceFile) > targetOffset || node.getEnd() <= targetOffset) return;
+		matchedNode = node;
+		ts.forEachChild(node, visit);
+	};
+	visit(sourceFile);
+	return matchedNode;
+};
+const isOffsetInsideWorklet = (sourceFile, targetOffset) => {
+	let currentNode = findNodeAtOffset(sourceFile, targetOffset);
+	while (currentNode) {
+		if (ts.isFunctionLike(currentNode) && isFunctionWorklet(currentNode)) return true;
+		currentNode = currentNode.parent;
+	}
+	return false;
+};
+const shouldSuppressCompilerFindingInWorklet = (diagnostic, project, rootDirectory) => {
+	if (!SUPPRESSED_COMPILER_CODES.has(diagnostic.code)) return false;
+	if (!project.hasReanimated) return false;
+	const primaryLabel = diagnostic.labels[0];
+	if (!primaryLabel) return false;
+	const absolutePath = Path.isAbsolute(diagnostic.filename) ? diagnostic.filename : Path.join(rootDirectory, diagnostic.filename);
+	let sourceText;
+	try {
+		sourceText = NFS.readFileSync(absolutePath, "utf-8");
+	} catch {
+		return false;
+	}
+	return isOffsetInsideWorklet(ts.createSourceFile(absolutePath, sourceText, ts.ScriptTarget.Latest, true, getScriptKind$1(absolutePath)), getUtf16Offset(sourceText, primaryLabel.span.offset));
+};
+const MANUAL_MEMOIZATION_PLUGIN = "react-doctor";
+const MANUAL_MEMOIZATION_RULE = "react-compiler-no-manual-memoization";
+const REACT_COMPILER_PLUGIN = "react-hooks-js";
+const getScriptKind = (filename) => {
+	if (filename.endsWith(".tsx")) return ts.ScriptKind.TSX;
+	if (filename.endsWith(".jsx")) return ts.ScriptKind.JSX;
+	if (filename.endsWith(".ts")) return ts.ScriptKind.TS;
+	return ts.ScriptKind.JS;
+};
+const isManualMemoizationDiagnostic = (diagnostic) => diagnostic.plugin === MANUAL_MEMOIZATION_PLUGIN && diagnostic.rule === MANUAL_MEMOIZATION_RULE;
+const nodeLineRange = (sourceFile, node) => ({
+	startLine: sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1,
+	endLine: sourceFile.getLineAndCharacterOfPosition(node.getEnd()).line + 1
+});
+const findOutermostEnclosingFunctionRange = (sourceFile, targetLine) => {
+	let foundRange = null;
+	const visit = (node) => {
+		if (foundRange) return;
+		if (ts.isFunctionLike(node)) {
+			const range = nodeLineRange(sourceFile, node);
+			if (range.startLine <= targetLine && targetLine <= range.endLine) foundRange = range;
+			return;
+		}
+		ts.forEachChild(node, visit);
+	};
+	visit(sourceFile);
+	return foundRange;
+};
+const NEWLINE_BYTE = 10;
+const lineOfUtf8Offset = (sourceBuffer, utf8Offset) => {
+	let lineNumber = 1;
+	const scanEnd = Math.min(utf8Offset, sourceBuffer.length);
+	for (let byteIndex = 0; byteIndex < scanEnd; byteIndex++) if (sourceBuffer[byteIndex] === NEWLINE_BYTE) lineNumber++;
+	return lineNumber;
+};
+/**
+* Drops `react-doctor/react-compiler-no-manual-memoization` diagnostics
+* whose enclosing function also carries a `react-hooks-js` (React
+* Compiler) diagnostic. Every react-hooks-js finding marks a function the
+* compiler could NOT compile (a bail-out / skip / preserve-manual-
+* memoization failure), so "React Compiler already caches every value
+* here" is false for that function and the manual memoization is
+* load-bearing, not dead weight.
+*
+* Matching is per enclosing function, not per file: a bailed-out
+* component must not silence redundant-memo findings in a sibling
+* component the compiler did optimize.
+*
+* Module-scope `memo(() => …)` wrappers have no enclosing function; for
+* those the memo call's own span is the containment range, so a bail-out
+* inside the inline-wrapped component still suppresses. Every failure
+* path (unreadable file, missing span) fails open and keeps the
+* diagnostic.
+*/
+const suppressMemoizationInBailedOutFunctions = (diagnostics, rootDirectory) => {
+	const compilerDiagnosticLinesByFile = /* @__PURE__ */ new Map();
+	let hasManualMemoizationDiagnostic = false;
+	for (const diagnostic of diagnostics) {
+		if (isManualMemoizationDiagnostic(diagnostic)) {
+			hasManualMemoizationDiagnostic = true;
+			continue;
+		}
+		if (diagnostic.plugin !== REACT_COMPILER_PLUGIN || diagnostic.line <= 0) continue;
+		const lines = compilerDiagnosticLinesByFile.get(diagnostic.filePath);
+		if (lines) lines.push(diagnostic.line);
+		else compilerDiagnosticLinesByFile.set(diagnostic.filePath, [diagnostic.line]);
+	}
+	if (!hasManualMemoizationDiagnostic || compilerDiagnosticLinesByFile.size === 0) return diagnostics;
+	const parsedFileCache = /* @__PURE__ */ new Map();
+	const readAndParse = (filePath) => {
+		const cached = parsedFileCache.get(filePath);
+		if (cached !== void 0) return cached;
+		const absolutePath = Path.isAbsolute(filePath) ? filePath : Path.resolve(rootDirectory || ".", filePath);
+		let parsed;
+		try {
+			const buffer = NFS.readFileSync(absolutePath);
+			parsed = {
+				sourceFile: ts.createSourceFile(absolutePath, buffer.toString("utf8"), ts.ScriptTarget.Latest, true, getScriptKind(absolutePath)),
+				buffer
+			};
+		} catch {
+			parsed = null;
+		}
+		parsedFileCache.set(filePath, parsed);
+		return parsed;
+	};
+	const isInsideBailedOutFunction = (diagnostic) => {
+		const compilerLines = compilerDiagnosticLinesByFile.get(diagnostic.filePath);
+		if (!compilerLines || diagnostic.line <= 0) return false;
+		const parsed = readAndParse(diagnostic.filePath);
+		if (!parsed) return false;
+		let containmentRange = findOutermostEnclosingFunctionRange(parsed.sourceFile, diagnostic.line);
+		if (!containmentRange && diagnostic.offset !== void 0 && diagnostic.length !== void 0) containmentRange = {
+			startLine: diagnostic.line,
+			endLine: lineOfUtf8Offset(parsed.buffer, diagnostic.offset + diagnostic.length)
+		};
+		if (!containmentRange) return false;
+		const { startLine, endLine } = containmentRange;
+		return compilerLines.some((compilerLine) => startLine <= compilerLine && compilerLine <= endLine);
+	};
+	return diagnostics.filter((diagnostic) => !isManualMemoizationDiagnostic(diagnostic) || !isInsideBailedOutFunction(diagnostic));
+};
 const FILEPATH_WITH_LOCATION_PATTERN = /\S+\.\w+:\d+:\d+[\s\S]*$/;
 const LEADING_SEVERITY_LABEL_PATTERN = /^(?:Error|Warning):\s*/;
 const TRAILING_PERIOD_PATTERN = /\.$/;
@@ -43170,7 +43550,7 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 		minifiedFileCache.set(absolutePath, minified);
 		return minified;
 	};
-	return parsed.diagnostics.filter((diagnostic) => diagnostic.code && isLintableSourceFile(diagnostic.filename) && !isMinifiedDiagnosticFile(diagnostic.filename) && !shouldSuppressLocalUseHookDiagnostic(diagnostic, rootDirectory)).map((diagnostic) => {
+	return suppressMemoizationInBailedOutFunctions(parsed.diagnostics.filter((diagnostic) => diagnostic.code && isLintableSourceFile(diagnostic.filename) && !isMinifiedDiagnosticFile(diagnostic.filename) && !shouldSuppressLocalUseHookDiagnostic(diagnostic, rootDirectory) && !shouldSuppressCompilerFindingInWorklet(diagnostic, project, rootDirectory)).map((diagnostic) => {
 		const { plugin, rule } = parseRuleCode(diagnostic.code);
 		const primaryLabel = diagnostic.labels[0];
 		const cleaned = cleanDiagnosticMessage(diagnostic.message, diagnostic.help, plugin, rule, project);
@@ -43197,7 +43577,7 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 			...resolveMatchByOccurrence(rule, category) ? { matchByOccurrence: true } : {},
 			...relatedLocations.length > 0 ? { relatedLocations } : {}
 		};
-	});
+	}), rootDirectory);
 };
 const buildOxlintChildEnv = (sourceEnv) => {
 	const childEnv = {};
@@ -43708,6 +44088,7 @@ const runOxlint = async (options) => {
 	const serverAuthFunctionNames = Array.isArray(userConfig?.serverAuthFunctionNames) ? userConfig.serverAuthFunctionNames.filter((entry) => typeof entry === "string" && entry.length > 0) : void 0;
 	const severityControls = buildRuleSeverityControls(userConfig);
 	validateRuleRegistration();
+	resetManifestCaches();
 	if (includePaths !== void 0 && includePaths.length === 0) return [];
 	const pluginPath = resolvePluginPath();
 	const extendsPaths = (adoptExistingLintConfig && !customRulesOnly ? detectUserLintConfigPaths(rootDirectory) : []).filter(canOxlintExtendConfig);
@@ -44370,9 +44751,10 @@ const CONTEXT_AXES = [
 	}
 ];
 const SCORE_AXES = [...GATED_AXES, ...CONTEXT_AXES];
-const worstGatedAxis = (score) => {
-	let worst = GATED_AXES[0];
-	for (const axis of GATED_AXES) if (score[axis.key] < score[worst.key]) worst = axis;
+const gatedAxesForSection = (section) => section === "devDependencies" ? GATED_AXES.filter((axis) => axis.key !== "vulnerability") : GATED_AXES;
+const worstGatedAxis = (score, gatedAxes) => {
+	let worst = gatedAxes[0];
+	for (const axis of gatedAxes) if (score[axis.key] < score[worst.key]) worst = axis;
 	return worst;
 };
 const clampScore = (value) => {
@@ -44396,6 +44778,69 @@ const resolveConcreteVersion = (spec) => {
 	if (range === null || range === "*") return null;
 	return import_semver.minVersion(trimmed)?.version ?? null;
 };
+const readTextFileOrNull = (filePath) => {
+	try {
+		return NFS.readFileSync(filePath, "utf-8");
+	} catch {
+		return null;
+	}
+};
+const buildNpmLockLookup = (lockText) => {
+	let parsed;
+	try {
+		parsed = JSON.parse(lockText);
+	} catch {
+		return null;
+	}
+	if (typeof parsed !== "object" || parsed === null) return null;
+	const lock = parsed;
+	return (name) => {
+		const entry = lock.packages?.[`node_modules/${name}`] ?? lock.dependencies?.[name];
+		return typeof entry?.version === "string" ? entry.version : null;
+	};
+};
+const buildYarnLockLookup = (lockText) => {
+	const lines = lockText.split(/\r?\n/);
+	return (name, spec) => {
+		const descriptor = `${name}@${spec}`;
+		const berryDescriptor = `${name}@npm:${spec}`;
+		for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
+			const line = lines[lineIndex];
+			if (line.startsWith(" ") || line.startsWith("#") || !line.includes(":")) continue;
+			const descriptors = line.replace(/:\s*$/, "").split(",").map((part) => part.trim().replace(/^"|"$/g, ""));
+			if (!descriptors.includes(descriptor) && !descriptors.includes(berryDescriptor)) continue;
+			for (let bodyIndex = lineIndex + 1; bodyIndex < lines.length && (lines[bodyIndex].startsWith(" ") || lines[bodyIndex] === ""); bodyIndex += 1) {
+				const versionMatch = /^\s+version:?\s+"?([^"\s]+)"?/.exec(lines[bodyIndex]);
+				if (versionMatch) return versionMatch[1];
+			}
+			return null;
+		}
+		return null;
+	};
+};
+const buildPnpmLockLookup = (lockText) => {
+	return (name) => {
+		const entryPattern = new RegExp(`^ {4,8}['"]?${name.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&")}['"]?:\\s*$`);
+		const lines = lockText.split(/\r?\n/);
+		for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
+			if (!entryPattern.test(lines[lineIndex])) continue;
+			for (let bodyIndex = lineIndex + 1; bodyIndex < lines.length && /^ {5,}\S/.test(lines[bodyIndex]); bodyIndex += 1) {
+				const versionMatch = /^\s+version:\s+['"]?([^'"\s(]+)/.exec(lines[bodyIndex]);
+				if (versionMatch) return versionMatch[1];
+			}
+		}
+		return null;
+	};
+};
+const buildLockedVersionLookup = (rootDirectory) => {
+	const npmLockText = readTextFileOrNull(Path.join(rootDirectory, "package-lock.json"));
+	if (npmLockText !== null) return buildNpmLockLookup(npmLockText);
+	const yarnLockText = readTextFileOrNull(Path.join(rootDirectory, "yarn.lock"));
+	if (yarnLockText !== null) return buildYarnLockLookup(yarnLockText);
+	const pnpmLockText = readTextFileOrNull(Path.join(rootDirectory, "pnpm-lock.yaml"));
+	if (pnpmLockText !== null) return buildPnpmLockLookup(pnpmLockText);
+	return null;
+};
 const locateDependencyKey = (packageJsonText, section, name) => {
 	const needle = `"${name}"`;
 	const sectionHeader = new RegExp(`"${section}"\\s*:\\s*\\{`);
@@ -44422,7 +44867,7 @@ const locateDependencyKey = (packageJsonText, section, name) => {
 	}
 	return null;
 };
-const collectDependenciesToScore = (packageJson, packageJsonText, includeDevDependencies) => {
+const collectDependenciesToScore = (packageJson, packageJsonText, includeDevDependencies, lockedVersionLookup) => {
 	const sectionByName = /* @__PURE__ */ new Map();
 	for (const name of Object.keys(packageJson.dependencies ?? {})) sectionByName.set(name, "dependencies");
 	if (includeDevDependencies) {
@@ -44432,13 +44877,18 @@ const collectDependenciesToScore = (packageJson, packageJsonText, includeDevDepe
 	for (const [name, section] of sectionByName) {
 		if (SUPPLY_CHAIN_IGNORED_PACKAGES.has(name)) continue;
 		const spec = (packageJson[section] ?? {})[name] ?? "";
-		const version = resolveConcreteVersion(spec);
-		if (version === null) continue;
+		const floorVersion = resolveConcreteVersion(spec);
+		if (floorVersion === null) continue;
+		const lockedVersion = lockedVersionLookup?.(name, spec) ?? null;
+		const lockSatisfiesSpec = lockedVersion !== null && import_semver.valid(lockedVersion) !== null && import_semver.satisfies(lockedVersion, spec);
+		const isExactPin = import_semver.valid(spec.trim()) !== null;
 		const location = locateDependencyKey(packageJsonText, section, name);
 		dependencies.push({
 			name,
-			version,
+			version: lockSatisfiesSpec ? lockedVersion : floorVersion,
 			spec,
+			section,
+			resolution: isExactPin ? "pin" : lockSatisfiesSpec ? "locked" : "floor",
 			line: location?.line ?? 0,
 			column: location?.column ?? 0
 		});
@@ -44589,7 +45039,11 @@ const formatAlertReason = (topAlerts, totalCount) => {
 	}
 	return `Socket flagged ${totalCount} alerts (${topAlerts.map((alert) => friendlyAlertType(alert.type)).join(", ")}${totalCount > topAlerts.length ? ` (+${totalCount - topAlerts.length} more)` : ""}); most severe: ${displaySeverity(topAlerts[0].severity)}.`;
 };
-const formatDependencyIdentity = (dependency) => import_semver.valid(dependency.spec) !== null ? `${dependency.name}@${dependency.version}` : `${dependency.name}@${dependency.version} (lowest version "${dependency.spec}" allows)`;
+const formatDependencyIdentity = (dependency) => {
+	if (dependency.resolution === "pin") return `${dependency.name}@${dependency.version}`;
+	if (dependency.resolution === "locked") return `${dependency.name}@${dependency.version} (lockfile resolution of "${dependency.spec}")`;
+	return `${dependency.name}@${dependency.version} (lowest version "${dependency.spec}" allows)`;
+};
 const buildSupplyChainHelp = (dependency, failingAxis, topAlerts, packagePageUrl, options) => {
 	const hasCriticalAlert = topAlerts.some((alert) => alert.severity.toLowerCase() === "critical");
 	const entry = `\`"${dependency.name}": "${dependency.spec}"\``;
@@ -44632,7 +45086,7 @@ const buildLowScoreDiagnostic = (dependency, artifact, failingAxis, options) =>
 const checkSupplyChain = (input) => gen(function* () {
 	const options = resolveOptions(input.userConfig);
 	const packageJsonPath = Path.join(input.rootDirectory, "package.json");
-	const dependencies = collectDependenciesToScore(readPackageJson$1(packageJsonPath), readPackageJsonText(packageJsonPath), options.includeDevDependencies);
+	const dependencies = collectDependenciesToScore(readPackageJson$1(packageJsonPath), readPackageJsonText(packageJsonPath), options.includeDevDependencies, buildLockedVersionLookup(input.rootDirectory));
 	if (dependencies.length === 0) return [];
 	const cacheDirectory = isSupplyChainCacheDisabled() ? null : resolveReactDoctorCacheDir(input.rootDirectory);
 	if (cacheDirectory !== null) pruneExpiredSocketCache(cacheDirectory);
@@ -44641,7 +45095,7 @@ const checkSupplyChain = (input) => gen(function* () {
 	for (let index = 0; index < dependencies.length; index += 1) {
 		const artifact = artifacts[index];
 		if (!artifact) continue;
-		const worstAxis = worstGatedAxis(artifact.score);
+		const worstAxis = worstGatedAxis(artifact.score, gatedAxesForSection(dependencies[index].section));
 		if (toHundred(artifact.score[worstAxis.key]) >= options.minScore) continue;
 		diagnostics.push(buildLowScoreDiagnostic(dependencies[index], artifact, worstAxis, options));
 	}
@@ -45924,7 +46378,7 @@ const makeNoopConsole = () => ({
 });
 //#endregion
 //#region src/cli/utils/version.ts
-const VERSION = "0.7.1-dev.64452aa";
+const VERSION = "0.7.1-dev.7cf4d0b";
 //#endregion
 //#region src/cli/utils/json-mode.ts
 let context = null;
@@ -46293,13 +46747,13 @@ const isDevVersion = (version) => version === "0.0.0" || version.includes("-");
 * uploads source-map artifacts under, so stack frames symbolicate. Honors the
 * standard `SENTRY_RELEASE` override.
 */
-const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.7.1-dev.64452aa`;
+const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.7.1-dev.7cf4d0b`;
 /**
 * Deployment environment shown in Sentry's environment filter. Defaults to
 * `production` for tagged releases and `development` for dev/unbuilt versions,
 * overridable via the standard `SENTRY_ENVIRONMENT` env var.
 */
-const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.7.1-dev.64452aa") ? "development" : "production");
+const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.7.1-dev.7cf4d0b") ? "development" : "production");
 /**
 * Performance-tracing sample rate in `[0, 1]`. Reads `SENTRY_TRACES_SAMPLE_RATE`
 * (set to `0` to disable tracing) and falls back to
@@ -58143,7 +58597,7 @@ const buildRuntimeLayers = (input) => {
 	const linterLayer = input.shouldSkipLint ? Linter.layerOf([]) : Linter.layerOxlint;
 	const deadCodeLayer = input.shouldRunDeadCode ? DeadCode.layerNode : DeadCode.layerOf([]);
 	const scoreLayer = input.shouldComputeScore ? Score.layerHttp : Score.layerOf(null);
-	const supplyChainLayer = input.userConfig?.supplyChain?.enabled === false ? SupplyChain.layerOf([]) : SupplyChain.layerNode;
+	const supplyChainLayer = input.shouldRunSupplyChain ? SupplyChain.layerNode : SupplyChain.layerOf([]);
 	const projectLayer = input.projectInfoOverride === void 0 ? Project.layerNode : Project.layerOf(input.projectInfoOverride);
 	const progressLayer = input.shouldShowProgressSpinners ? Progress.layerOra(buildSpinnerProgressHandle) : Progress.layerNoop;
 	const baseLayers = mergeAll$1(projectLayer, input.hasConfigOverride ? Config.layerOf({
@@ -58606,6 +59060,7 @@ const buildScanResultCacheKey = (input) => {
 		engineOptions: {
 			lint: input.options.lint,
 			deadCode: input.options.deadCode,
+			supplyChain: input.options.supplyChain,
 			includePaths: [...input.options.includePaths].sort(),
 			customRulesOnly: input.options.customRulesOnly,
 			respectInlineDisables: input.options.respectInlineDisables,
@@ -58815,13 +59270,15 @@ const buildOutcomeAttributes = (input) => {
 		const countBySource = {
 			config: 0,
 			override: 0,
-			inline: 0
+			inline: 0,
+			"foreign-inline": 0
 		};
 		for (const suppression of input.suppressedRuleCounts) countBySource[suppression.source] += suppression.count;
-		suppressionRollup.suppressed = countBySource.config + countBySource.override + countBySource.inline;
+		suppressionRollup.suppressed = countBySource.config + countBySource.override + countBySource.inline + countBySource["foreign-inline"];
 		suppressionRollup.suppressedConfig = countBySource.config;
 		suppressionRollup.suppressedOverride = countBySource.override;
 		suppressionRollup.suppressedInline = countBySource.inline;
+		suppressionRollup.suppressedForeignInline = countBySource["foreign-inline"];
 	}
 	const attributes = {
 		...withNamespace("outcome", {
@@ -58913,6 +59370,7 @@ const buildScanAttributes = (input) => {
 		maxDurationMs: input.maxDurationMs,
 		lint: input.lint,
 		deadCode: input.deadCode,
+		supplyChain: input.supplyChain,
 		scoreOnly: input.scoreOnly,
 		noScore: input.noScore,
 		respectInlineDisables: input.respectInlineDisables,
@@ -60187,6 +60645,7 @@ const buildIgnoredTags = (userConfig) => {
 const mergeInspectOptions = (inputOptions, userConfig) => ({
 	lint: inputOptions.lint ?? userConfig?.lint ?? true,
 	deadCode: inputOptions.deadCode ?? userConfig?.deadCode ?? true,
+	supplyChain: inputOptions.supplyChain ?? userConfig?.supplyChain?.enabled ?? true,
 	verbose: inputOptions.verbose ?? userConfig?.verbose ?? false,
 	outputDirectory: inputOptions.outputDirectory || null,
 	scoreOnly: inputOptions.scoreOnly ?? false,
@@ -60226,6 +60685,7 @@ const buildRunEventConfig = (options, userConfig, hasCustomConfig, resolvedWorke
 		maxDurationMs: options.maxDurationMs,
 		lint: options.lint,
 		deadCode: options.deadCode,
+		supplyChain: options.supplyChain,
 		scoreOnly: options.scoreOnly,
 		noScore: options.noScore,
 		respectInlineDisables: options.respectInlineDisables,
@@ -60309,6 +60769,7 @@ const runBaselineComparison = async (params) => {
 			projectInfoOverride: params.headProjectInfo,
 			shouldSkipLint: !params.options.lint || !params.resolvedNodeBinaryPath,
 			shouldRunDeadCode: false,
+			shouldRunSupplyChain: params.options.supplyChain,
 			shouldComputeScore: false,
 			shouldShowProgressSpinners: false,
 			oxlintConcurrency: params.options.concurrency
@@ -60397,6 +60858,7 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		configSourceDirectory,
 		shouldSkipLint: !options.lint || lintBindingMissing,
 		shouldRunDeadCode: options.deadCode,
+		shouldRunSupplyChain: options.supplyChain,
 		shouldComputeScore: !options.noScore,
 		shouldShowProgressSpinners,
 		oxlintConcurrency: options.concurrency
@@ -62682,8 +63144,8 @@ const resolveParallelFlag = (parallel) => parallel === false ? 1 : void 0;
 * accepts. Flag-derived fields only (`scoreOnly`, `noScore`, `silent`,
 * `isCi`): every `userConfig` fallback — including `noScore` — lives in
 * `inspect()`'s merge layer, which sees each project's module-merged
-* config. The plain boolean knobs (`lint`, `deadCode`, `verbose`) pass
-* through unchanged for the same reason. This resolver reads
+* config. The plain boolean knobs (`lint`, `deadCode`, `supplyChain`,
+* `verbose`) pass through unchanged for the same reason. This resolver reads
 * `userConfig` only to decide the `--blocking warning` gate.
 */
 const resolveCliInspectOptions = (flags, userConfig) => {
@@ -62691,6 +63153,7 @@ const resolveCliInspectOptions = (flags, userConfig) => {
 	return {
 		lint: flags.lint,
 		deadCode: flags.deadCode,
+		supplyChain: flags.supplyChain,
 		verbose: flags.verbose,
 		outputDirectory: flags.outputDir,
 		respectInlineDisables: flags.respectInlineDisables === false ? false : void 0,
@@ -63241,7 +63704,7 @@ const inspectAction = async (directory, flags) => {
 			const scanDirectory = projectScanTarget.resolvedDirectory;
 			const projectConfig = projectDirectory === resolvedDirectory ? userConfig : mergeReactDoctorConfigs(userConfig, projectScanTarget.userConfig ?? void 0);
 			const projectConfigSourceDirectory = projectScanTarget.userConfig?.plugins === void 0 ? scanTarget.configSourceDirectory : projectScanTarget.configSourceDirectory;
-			const supplyChainEnabled = projectConfig?.supplyChain?.enabled !== false;
+			const supplyChainEnabled = flags.supplyChain ?? projectConfig?.supplyChain?.enabled !== false;
 			let includePaths;
 			let supplyChainManifestChanged = false;
 			if (isDiffMode) {
@@ -64161,10 +64624,12 @@ const ROOT_FLAG_SPEC = {
 		"--no-parallel",
 		"--no-respect-inline-disables",
 		"--no-score",
+		"--no-supply-chain",
 		"--no-telemetry",
 		"--no-warnings",
 		"--score",
 		"--staged",
+		"--supply-chain",
 		"--verbose",
 		"--version",
 		"--warnings",
@@ -64413,7 +64878,7 @@ ${highlighter.dim("Learn more:")}
   ${highlighter.info(CI_URL)}
 `;
 const collectCategoryOption = (value, previousValues) => [...previousValues ?? [], value];
-const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("--json-out <path>", "with --json, write the report to a file instead of stdout").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much to scan/report: full (default), files, changed (only new issues vs base), or lines (only changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks").option("--max-duration <seconds>", "scan time budget for the whole run, shared across workspace projects: past it, remaining lint batches and dead-code are skipped and partial results are reported (skipped files are listed in the JSON report)").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
+const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--supply-chain", "enable the dependency supply-chain scan (default)").option("--no-supply-chain", "skip the dependency supply-chain scan (Socket.dev dependency health checks)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("--json-out <path>", "with --json, write the report to a file instead of stdout").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much to scan/report: full (default), files, changed (only new issues vs base), or lines (only changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks").option("--max-duration <seconds>", "scan time budget for the whole run, shared across workspace projects: past it, remaining lint batches and dead-code are skipped and partial results are reported (skipped files are listed in the JSON report)").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
 program.action(inspectAction);
 program.command("why <location>").description("Explain why a rule fired (or why a suppression didn't apply) at a file:line").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple)").option("-c, --cwd <cwd>", "working directory", process.cwd()).option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").action((location, options) => whyAction(location, options));
 program.command("install").alias("setup").description("Install the react-doctor skill into your coding agents and optional git hook").option("-y, --yes", "skip prompts, install for all detected agents").option("--dry-run", "show what would be installed without writing files").option("--agent-hooks", "install native non-blocking agent hooks for Claude Code and Cursor").option("-c, --cwd <cwd>", "working directory", process.cwd()).option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderInstallHelpEpilog).action(installAction);
@@ -64463,4 +64928,4 @@ Promise.resolve().then(() => assertNoRemovedFlags(process.argv)).then(() => prog
 export {};
 
 //# sourceMappingURL=cli.js.map
-//# debugId=57f4381b-7060-58c6-88a4-95b4c97d3b74
+//# debugId=7b7c23b7-250e-5339-af06-e3e3b5eb5f98