react-doctor 0.7.1-dev.ce9dabf → 0.7.1-dev.d353dad

package/dist/cli.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="bbc083b3-ec5f-541e-8e68-a28e5b06f6eb")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="47338856-c658-5c78-a5e2-e871c2dafaa7")}catch(e){}}();
 import { createRequire } from "node:module";
 import * as NodeChildProcess from "node:child_process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
@@ -36262,6 +36262,23 @@ const listSourceFilesViaFilesystem = (rootDirectory) => {
 const listSourceFilesWithSize = (rootDirectory) => collectSizedSourceFiles(rootDirectory, (listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory)).sort());
 const listSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).map((entry) => entry.path);
 const countSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).length;
+/**
+* The chain of ancestor directories of `startDirectory`, nearest first, up to
+* and including the filesystem root. With `includeStart`, the chain begins at
+* `startDirectory` itself; otherwise at its parent. The one place the "walk up
+* the tree" traversal is expressed, so each caller adds only its own match /
+* stop policy instead of re-deriving the `path.dirname` loop.
+*/
+const ancestorDirectories = (startDirectory, { includeStart }) => {
+	const directories = [];
+	let currentDirectory = includeStart ? startDirectory : Path.dirname(startDirectory);
+	while (true) {
+		directories.push(currentDirectory);
+		const parentDirectory = Path.dirname(currentDirectory);
+		if (parentDirectory === currentDirectory) return directories;
+		currentDirectory = parentDirectory;
+	}
+};
 const cachedPackageJsons = /* @__PURE__ */ new Map();
 const readPackageJsonUncached = (packageJsonPath) => {
 	try {
@@ -36292,11 +36309,7 @@ const isMonorepoRoot = (directory) => {
 	return Array.isArray(packageJson.workspaces) || Boolean(packageJson.workspaces?.packages);
 };
 const findMonorepoRoot = (startDirectory) => {
-	let currentDirectory = Path.dirname(startDirectory);
-	while (currentDirectory !== Path.dirname(currentDirectory)) {
-		if (isMonorepoRoot(currentDirectory)) return currentDirectory;
-		currentDirectory = Path.dirname(currentDirectory);
-	}
+	for (const directory of ancestorDirectories(startDirectory, { includeStart: false })) if (isMonorepoRoot(directory)) return directory;
 	return null;
 };
 /**
@@ -36942,6 +36955,74 @@ const findDependencyInfoFromMonorepoRoot = (directory) => {
 		framework: rootInfo.framework !== "unknown" ? rootInfo.framework : workspaceInfo.framework
 	};
 };
+/**
+* Walk up from `startDirectory` to the nearest ancestor that owns a
+* `package.json`, stopping at (and including) the enclosing project boundary
+* — the working tree's git root or a monorepo root. Lets a scan of a package
+* subfolder that has no `package.json` of its own adopt the nearest enclosing
+* package as its project root, so it inherits that package's dependency +
+* framework detection instead of synthesizing an empty (React-blind) project.
+*
+* Generalizes the older monorepo-root-only lookup: the nearest ancestor is the
+* most specific owning package (a leaf workspace, not just the repo root), so
+* a subfolder of one workspace no longer borrows a sibling's capabilities.
+*
+* Returns `null` when no ancestor `package.json` exists inside the project
+* boundary (a loose tree of files, or a subfolder of a package-less repo).
+*/
+const findNearestAncestorPackageJson = (startDirectory) => {
+	if (isProjectBoundary(startDirectory)) return null;
+	for (const directory of ancestorDirectories(startDirectory, { includeStart: false })) {
+		if (isFile(Path.join(directory, "package.json"))) return directory;
+		if (isProjectBoundary(directory)) return null;
+	}
+	return null;
+};
+/**
+* Last-resort React detection: locate React the way Node's `node_modules`
+* resolution would from `directory` — check each `node_modules/react` up the
+* tree — but bounded to the enclosing repo so a globally installed React can't
+* masquerade as the project's version. Stops at (and including) the nearest
+* project boundary — the git root or a monorepo root — and returns the first
+* installed `version`.
+*
+* Makes "React is installed and importable" ⇒ "React is detected" an invariant
+* for packages whose only React declaration is a version-less spec
+* (`workspace:*`, `*`, a dist-tag) or where React lives solely in a hoisted
+* `node_modules` the declaration walks never reach — the profile of a component
+* package inside a monorepo. Matching the `node_modules/react` entry rather than
+* its realpath means a project whose `node_modules` is symlinked elsewhere (a
+* Docker volume, a shared store) still counts, while a global install outside
+* the repo does not.
+*
+* Returns `null` when React isn't installed within the repo or its package.json
+* carries no version string. A tree with no boundary marker at all bounds the
+* search to `directory`, so a dependency hoisted above the scanned package there
+* is conservatively not adopted.
+*/
+/**
+* The nearest enclosing project boundary (git root or monorepo root), or
+* `directory` itself when the scan target sits outside any repo. Bounds the
+* node_modules walk so a React hoisted anywhere inside the repo counts, but a
+* React in an ancestor above the repo — a home-directory or global
+* `node_modules` — can't leak in.
+*/
+const findContainmentRoot = (directory) => {
+	for (const ancestorDirectory of ancestorDirectories(directory, { includeStart: true })) if (isProjectBoundary(ancestorDirectory)) return ancestorDirectory;
+	return directory;
+};
+const resolveInstalledReactVersion = (directory) => {
+	const containmentRoot = findContainmentRoot(directory);
+	for (const ancestorDirectory of ancestorDirectories(directory, { includeStart: true })) {
+		const reactPackageJsonPath = Path.join(ancestorDirectory, "node_modules", "react", "package.json");
+		if (isFile(reactPackageJsonPath)) {
+			const installedVersion = readPackageJson$1(reactPackageJsonPath).version;
+			return typeof installedVersion === "string" ? installedVersion : null;
+		}
+		if (ancestorDirectory === containmentRoot) return null;
+	}
+	return null;
+};
 const findInWorkspacePackageJsons = (rootDirectory, rootPackageJson, select) => {
 	const rootValue = select(rootPackageJson);
 	if (rootValue !== null) return rootValue;
@@ -37278,19 +37359,20 @@ const discoverReactSubprojects = (rootDirectory) => {
 const cachedProjectInfos = /* @__PURE__ */ new Map();
 /**
 * Build a `ProjectInfo` for a directory that has no `package.json` of
-* its own — a monorepo subfolder like `repo/packages`, or any loose tree
-* of TypeScript/JavaScript files. Dependency + framework detection is
-* inherited from the enclosing workspace root when there is one, so
-* scanning a subdirectory of a React monorepo still gets the React
-* capabilities; a standalone non-React directory simply scans with the
-* framework-agnostic rules. Throws only when the directory has nothing
-* to scan (no enclosing project and no source files of its own).
+* its own — a package subfolder like `repo/packages` or `app/src/features`,
+* or any loose tree of TypeScript/JavaScript files. Dependency + framework
+* detection is inherited from the nearest enclosing package (a leaf
+* workspace, a plain app root, or a monorepo root — whichever is closest,
+* bounded by the git root), so scanning a subdirectory of a React project
+* still gets the React capabilities; a standalone non-React directory simply
+* scans with the framework-agnostic rules. Throws only when the directory has
+* nothing to scan (no enclosing project and no source files of its own).
 */
 const discoverProjectWithoutPackageJson = (directory) => {
 	const sourceFileCount = countSourceFiles(directory);
 	const hasOwnTsConfig = NFS.existsSync(Path.join(directory, "tsconfig.json"));
-	const monorepoRoot = findMonorepoRoot(directory);
-	const enclosingProject = monorepoRoot !== null && isFile(Path.join(monorepoRoot, "package.json")) ? discoverProject(monorepoRoot) : null;
+	const enclosingProjectRoot = findNearestAncestorPackageJson(directory);
+	const enclosingProject = enclosingProjectRoot !== null ? discoverProject(enclosingProjectRoot) : null;
 	if (enclosingProject !== null) return {
 		...enclosingProject,
 		rootDirectory: directory,
@@ -37394,6 +37476,7 @@ const discoverProject = (directory) => {
 	if (!reactVersion && reactDeclaration.version && !isCatalogReference(reactDeclaration.version)) reactVersion = reactDeclaration.version;
 	if (!tailwindVersion && tailwindDeclaration.version && !isCatalogReference(tailwindDeclaration.version)) tailwindVersion = tailwindDeclaration.version;
 	if (!zodVersion && zodDeclaration.version && !isCatalogReference(zodDeclaration.version)) zodVersion = zodDeclaration.version;
+	if (!reactVersion || parseReactMajor(reactVersion) === null) reactVersion = resolveInstalledReactVersion(directory) ?? reactVersion;
 	const projectName = packageJson.name ?? Path.basename(directory);
 	const hasTypeScript = NFS.existsSync(Path.join(directory, "tsconfig.json"));
 	const sourceFileCount = countSourceFiles(directory);
@@ -45924,7 +46007,7 @@ const makeNoopConsole = () => ({
 });
 //#endregion
 //#region src/cli/utils/version.ts
-const VERSION = "0.7.1-dev.ce9dabf";
+const VERSION = "0.7.1-dev.d353dad";
 //#endregion
 //#region src/cli/utils/json-mode.ts
 let context = null;
@@ -46293,13 +46376,13 @@ const isDevVersion = (version) => version === "0.0.0" || version.includes("-");
 * uploads source-map artifacts under, so stack frames symbolicate. Honors the
 * standard `SENTRY_RELEASE` override.
 */
-const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.7.1-dev.ce9dabf`;
+const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.7.1-dev.d353dad`;
 /**
 * Deployment environment shown in Sentry's environment filter. Defaults to
 * `production` for tagged releases and `development` for dev/unbuilt versions,
 * overridable via the standard `SENTRY_ENVIRONMENT` env var.
 */
-const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.7.1-dev.ce9dabf") ? "development" : "production");
+const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.7.1-dev.d353dad") ? "development" : "production");
 /**
 * Performance-tracing sample rate in `[0, 1]`. Reads `SENTRY_TRACES_SAMPLE_RATE`
 * (set to `0` to disable tracing) and falls back to
@@ -58143,7 +58226,7 @@ const buildRuntimeLayers = (input) => {
 	const linterLayer = input.shouldSkipLint ? Linter.layerOf([]) : Linter.layerOxlint;
 	const deadCodeLayer = input.shouldRunDeadCode ? DeadCode.layerNode : DeadCode.layerOf([]);
 	const scoreLayer = input.shouldComputeScore ? Score.layerHttp : Score.layerOf(null);
-	const supplyChainLayer = input.userConfig?.supplyChain?.enabled === false ? SupplyChain.layerOf([]) : SupplyChain.layerNode;
+	const supplyChainLayer = input.shouldRunSupplyChain ? SupplyChain.layerNode : SupplyChain.layerOf([]);
 	const projectLayer = input.projectInfoOverride === void 0 ? Project.layerNode : Project.layerOf(input.projectInfoOverride);
 	const progressLayer = input.shouldShowProgressSpinners ? Progress.layerOra(buildSpinnerProgressHandle) : Progress.layerNoop;
 	const baseLayers = mergeAll$1(projectLayer, input.hasConfigOverride ? Config.layerOf({
@@ -58499,21 +58582,22 @@ const resolveDotenvFingerprint = (projectDirectory) => {
 		return [];
 	}
 };
-const hasHiddenTrackedFileState = (projectDirectory) => {
+const isGitIdentityTrustworthy = (projectDirectory) => {
 	const output = runGit(projectDirectory, ["ls-files", "-v"]);
-	if (output === null) return true;
-	return output.split("\n").some((line) => line.length > 0 && line[0] !== "H");
+	if (output === null) return false;
+	const entryLines = output.split("\n").filter((line) => line.length > 0);
+	return entryLines.length > 0 && entryLines.every((line) => line[0] === "H");
 };
 const resolveCacheFilePath = (projectDirectory) => path.join(resolveReactDoctorCacheDir(projectDirectory), SCAN_RESULT_CACHE_FILENAME);
 const readPersistedCache = (cacheFilePath) => {
 	try {
 		const parsed = JSON.parse(fs.readFileSync(cacheFilePath, "utf8"));
-		if (!isRecord(parsed) || parsed.version !== 3) return {
-			version: 3,
+		if (!isRecord(parsed) || parsed.version !== 4) return {
+			version: 4,
 			entries: []
 		};
 		if (!Array.isArray(parsed.entries)) return {
-			version: 3,
+			version: 4,
 			entries: []
 		};
 		const entries = [];
@@ -58523,12 +58607,12 @@ const readPersistedCache = (cacheFilePath) => {
 			entries.push(entry);
 		}
 		return {
-			version: 3,
+			version: 4,
 			entries
 		};
 	} catch {
 		return {
-			version: 3,
+			version: 4,
 			entries: []
 		};
 	}
@@ -58560,6 +58644,7 @@ const resolveProjectIdentity = (projectDirectory) => {
 		return path.resolve(projectDirectory);
 	}
 };
+const resolveManifestContentHash = (projectDirectory) => hashFileContents(getPackageJsonPath(projectDirectory));
 const fileFingerprint = (filePath) => {
 	try {
 		const stat = fs.statSync(filePath);
@@ -58582,14 +58667,14 @@ const resolveToolchainFingerprint = (nodeBinaryPath) => {
 };
 const buildScanResultCacheKey = (input) => {
 	if (isCacheGloballyDisabled()) return null;
-	if (hasHiddenTrackedFileState(input.projectDirectory)) return null;
+	if (!isGitIdentityTrustworthy(input.projectDirectory)) return null;
 	const worktreeFingerprint = buildWorktreeFingerprint(input.projectDirectory);
 	if (worktreeFingerprint === null) return null;
 	const headSha = readHeadSha(input.projectDirectory);
 	if (headSha === null) return null;
 	if (stringifyStableJson(input.userConfig) === null) return null;
 	const cacheKeyJson = stringifyStableJson({
-		schemaVersion: 3,
+		schemaVersion: 4,
 		projectIdentity: resolveProjectIdentity(input.projectDirectory),
 		headSha,
 		worktreeFingerprint,
@@ -58604,6 +58689,7 @@ const buildScanResultCacheKey = (input) => {
 		engineOptions: {
 			lint: input.options.lint,
 			deadCode: input.options.deadCode,
+			supplyChain: input.options.supplyChain,
 			includePaths: [...input.options.includePaths].sort(),
 			customRulesOnly: input.options.customRulesOnly,
 			respectInlineDisables: input.options.respectInlineDisables,
@@ -58629,17 +58715,24 @@ const createScanResultCache = (projectDirectory) => {
 	for (const entry of persistedCache.entries) entries.set(entry.key, entry);
 	const persist = () => {
 		writePersistedCache(cacheFilePath, {
-			version: 3,
+			version: 4,
 			entries: [...entries.values()].sort((firstEntry, secondEntry) => secondEntry.createdAtMs - firstEntry.createdAtMs).slice(0, 20)
 		});
 	};
 	return {
-		lookup: (key) => entries.get(key)?.payload ?? null,
+		lookup: (key) => {
+			const payload = entries.get(key)?.payload;
+			if (payload === void 0) return null;
+			return resolveProjectIdentity(payload.directory) === resolveProjectIdentity(projectDirectory) && (payload.manifestContentHash ?? null) === resolveManifestContentHash(projectDirectory) ? payload : null;
+		},
 		store: (key, payload) => {
 			entries.set(key, {
 				key,
 				createdAtMs: Date.now(),
-				payload
+				payload: {
+					...payload,
+					manifestContentHash: resolveManifestContentHash(projectDirectory)
+				}
 			});
 			persist();
 		}
@@ -58904,6 +58997,7 @@ const buildScanAttributes = (input) => {
 		maxDurationMs: input.maxDurationMs,
 		lint: input.lint,
 		deadCode: input.deadCode,
+		supplyChain: input.supplyChain,
 		scoreOnly: input.scoreOnly,
 		noScore: input.noScore,
 		respectInlineDisables: input.respectInlineDisables,
@@ -60178,6 +60272,7 @@ const buildIgnoredTags = (userConfig) => {
 const mergeInspectOptions = (inputOptions, userConfig) => ({
 	lint: inputOptions.lint ?? userConfig?.lint ?? true,
 	deadCode: inputOptions.deadCode ?? userConfig?.deadCode ?? true,
+	supplyChain: inputOptions.supplyChain ?? userConfig?.supplyChain?.enabled ?? true,
 	verbose: inputOptions.verbose ?? userConfig?.verbose ?? false,
 	outputDirectory: inputOptions.outputDirectory || null,
 	scoreOnly: inputOptions.scoreOnly ?? false,
@@ -60217,6 +60312,7 @@ const buildRunEventConfig = (options, userConfig, hasCustomConfig, resolvedWorke
 		maxDurationMs: options.maxDurationMs,
 		lint: options.lint,
 		deadCode: options.deadCode,
+		supplyChain: options.supplyChain,
 		scoreOnly: options.scoreOnly,
 		noScore: options.noScore,
 		respectInlineDisables: options.respectInlineDisables,
@@ -60300,6 +60396,7 @@ const runBaselineComparison = async (params) => {
 			projectInfoOverride: params.headProjectInfo,
 			shouldSkipLint: !params.options.lint || !params.resolvedNodeBinaryPath,
 			shouldRunDeadCode: false,
+			shouldRunSupplyChain: params.options.supplyChain,
 			shouldComputeScore: false,
 			shouldShowProgressSpinners: false,
 			oxlintConcurrency: params.options.concurrency
@@ -60388,6 +60485,7 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		configSourceDirectory,
 		shouldSkipLint: !options.lint || lintBindingMissing,
 		shouldRunDeadCode: options.deadCode,
+		shouldRunSupplyChain: options.supplyChain,
 		shouldComputeScore: !options.noScore,
 		shouldShowProgressSpinners,
 		oxlintConcurrency: options.concurrency
@@ -62673,8 +62771,8 @@ const resolveParallelFlag = (parallel) => parallel === false ? 1 : void 0;
 * accepts. Flag-derived fields only (`scoreOnly`, `noScore`, `silent`,
 * `isCi`): every `userConfig` fallback — including `noScore` — lives in
 * `inspect()`'s merge layer, which sees each project's module-merged
-* config. The plain boolean knobs (`lint`, `deadCode`, `verbose`) pass
-* through unchanged for the same reason. This resolver reads
+* config. The plain boolean knobs (`lint`, `deadCode`, `supplyChain`,
+* `verbose`) pass through unchanged for the same reason. This resolver reads
 * `userConfig` only to decide the `--blocking warning` gate.
 */
 const resolveCliInspectOptions = (flags, userConfig) => {
@@ -62682,6 +62780,7 @@ const resolveCliInspectOptions = (flags, userConfig) => {
 	return {
 		lint: flags.lint,
 		deadCode: flags.deadCode,
+		supplyChain: flags.supplyChain,
 		verbose: flags.verbose,
 		outputDirectory: flags.outputDir,
 		respectInlineDisables: flags.respectInlineDisables === false ? false : void 0,
@@ -63232,7 +63331,7 @@ const inspectAction = async (directory, flags) => {
 			const scanDirectory = projectScanTarget.resolvedDirectory;
 			const projectConfig = projectDirectory === resolvedDirectory ? userConfig : mergeReactDoctorConfigs(userConfig, projectScanTarget.userConfig ?? void 0);
 			const projectConfigSourceDirectory = projectScanTarget.userConfig?.plugins === void 0 ? scanTarget.configSourceDirectory : projectScanTarget.configSourceDirectory;
-			const supplyChainEnabled = projectConfig?.supplyChain?.enabled !== false;
+			const supplyChainEnabled = flags.supplyChain ?? projectConfig?.supplyChain?.enabled !== false;
 			let includePaths;
 			let supplyChainManifestChanged = false;
 			if (isDiffMode) {
@@ -64152,10 +64251,12 @@ const ROOT_FLAG_SPEC = {
 		"--no-parallel",
 		"--no-respect-inline-disables",
 		"--no-score",
+		"--no-supply-chain",
 		"--no-telemetry",
 		"--no-warnings",
 		"--score",
 		"--staged",
+		"--supply-chain",
 		"--verbose",
 		"--version",
 		"--warnings",
@@ -64404,7 +64505,7 @@ ${highlighter.dim("Learn more:")}
   ${highlighter.info(CI_URL)}
 `;
 const collectCategoryOption = (value, previousValues) => [...previousValues ?? [], value];
-const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("--json-out <path>", "with --json, write the report to a file instead of stdout").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much to scan/report: full (default), files, changed (only new issues vs base), or lines (only changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks").option("--max-duration <seconds>", "scan time budget for the whole run, shared across workspace projects: past it, remaining lint batches and dead-code are skipped and partial results are reported (skipped files are listed in the JSON report)").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
+const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--supply-chain", "enable the dependency supply-chain scan (default)").option("--no-supply-chain", "skip the dependency supply-chain scan (Socket.dev dependency health checks)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("--json-out <path>", "with --json, write the report to a file instead of stdout").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much to scan/report: full (default), files, changed (only new issues vs base), or lines (only changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks").option("--max-duration <seconds>", "scan time budget for the whole run, shared across workspace projects: past it, remaining lint batches and dead-code are skipped and partial results are reported (skipped files are listed in the JSON report)").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
 program.action(inspectAction);
 program.command("why <location>").description("Explain why a rule fired (or why a suppression didn't apply) at a file:line").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple)").option("-c, --cwd <cwd>", "working directory", process.cwd()).option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").action((location, options) => whyAction(location, options));
 program.command("install").alias("setup").description("Install the react-doctor skill into your coding agents and optional git hook").option("-y, --yes", "skip prompts, install for all detected agents").option("--dry-run", "show what would be installed without writing files").option("--agent-hooks", "install native non-blocking agent hooks for Claude Code and Cursor").option("-c, --cwd <cwd>", "working directory", process.cwd()).option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderInstallHelpEpilog).action(installAction);
@@ -64454,4 +64555,4 @@ Promise.resolve().then(() => assertNoRemovedFlags(process.argv)).then(() => prog
 export {};
 
 //# sourceMappingURL=cli.js.map
-//# debugId=bbc083b3-ec5f-541e-8e68-a28e5b06f6eb
+//# debugId=47338856-c658-5c78-a5e2-e871c2dafaa7

package/dist/index.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f1919957-a013-5ded-b0ed-3d2e8469d0e2")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f00947fe-3794-5d73-a491-232b535dc962")}catch(e){}}();
 import { r as __toESM$1, t as __commonJSMin$1 } from "./chunk-N93fKeF6.js";
 import { createRequire } from "node:module";
 import * as NFS from "node:fs";
@@ -33064,6 +33064,23 @@ const listSourceFilesViaFilesystem = (rootDirectory) => {
 const listSourceFilesWithSize = (rootDirectory) => collectSizedSourceFiles(rootDirectory, (listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory)).sort());
 const listSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).map((entry) => entry.path);
 const countSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).length;
+/**
+* The chain of ancestor directories of `startDirectory`, nearest first, up to
+* and including the filesystem root. With `includeStart`, the chain begins at
+* `startDirectory` itself; otherwise at its parent. The one place the "walk up
+* the tree" traversal is expressed, so each caller adds only its own match /
+* stop policy instead of re-deriving the `path.dirname` loop.
+*/
+const ancestorDirectories = (startDirectory, { includeStart }) => {
+	const directories = [];
+	let currentDirectory = includeStart ? startDirectory : Path.dirname(startDirectory);
+	while (true) {
+		directories.push(currentDirectory);
+		const parentDirectory = Path.dirname(currentDirectory);
+		if (parentDirectory === currentDirectory) return directories;
+		currentDirectory = parentDirectory;
+	}
+};
 const cachedPackageJsons = /* @__PURE__ */ new Map();
 const clearPackageJsonCache = () => {
 	cachedPackageJsons.clear();
@@ -33097,11 +33114,7 @@ const isMonorepoRoot = (directory) => {
 	return Array.isArray(packageJson.workspaces) || Boolean(packageJson.workspaces?.packages);
 };
 const findMonorepoRoot = (startDirectory) => {
-	let currentDirectory = Path.dirname(startDirectory);
-	while (currentDirectory !== Path.dirname(currentDirectory)) {
-		if (isMonorepoRoot(currentDirectory)) return currentDirectory;
-		currentDirectory = Path.dirname(currentDirectory);
-	}
+	for (const directory of ancestorDirectories(startDirectory, { includeStart: false })) if (isMonorepoRoot(directory)) return directory;
 	return null;
 };
 /**
@@ -33747,6 +33760,74 @@ const findDependencyInfoFromMonorepoRoot = (directory) => {
 		framework: rootInfo.framework !== "unknown" ? rootInfo.framework : workspaceInfo.framework
 	};
 };
+/**
+* Walk up from `startDirectory` to the nearest ancestor that owns a
+* `package.json`, stopping at (and including) the enclosing project boundary
+* — the working tree's git root or a monorepo root. Lets a scan of a package
+* subfolder that has no `package.json` of its own adopt the nearest enclosing
+* package as its project root, so it inherits that package's dependency +
+* framework detection instead of synthesizing an empty (React-blind) project.
+*
+* Generalizes the older monorepo-root-only lookup: the nearest ancestor is the
+* most specific owning package (a leaf workspace, not just the repo root), so
+* a subfolder of one workspace no longer borrows a sibling's capabilities.
+*
+* Returns `null` when no ancestor `package.json` exists inside the project
+* boundary (a loose tree of files, or a subfolder of a package-less repo).
+*/
+const findNearestAncestorPackageJson = (startDirectory) => {
+	if (isProjectBoundary(startDirectory)) return null;
+	for (const directory of ancestorDirectories(startDirectory, { includeStart: false })) {
+		if (isFile(Path.join(directory, "package.json"))) return directory;
+		if (isProjectBoundary(directory)) return null;
+	}
+	return null;
+};
+/**
+* Last-resort React detection: locate React the way Node's `node_modules`
+* resolution would from `directory` — check each `node_modules/react` up the
+* tree — but bounded to the enclosing repo so a globally installed React can't
+* masquerade as the project's version. Stops at (and including) the nearest
+* project boundary — the git root or a monorepo root — and returns the first
+* installed `version`.
+*
+* Makes "React is installed and importable" ⇒ "React is detected" an invariant
+* for packages whose only React declaration is a version-less spec
+* (`workspace:*`, `*`, a dist-tag) or where React lives solely in a hoisted
+* `node_modules` the declaration walks never reach — the profile of a component
+* package inside a monorepo. Matching the `node_modules/react` entry rather than
+* its realpath means a project whose `node_modules` is symlinked elsewhere (a
+* Docker volume, a shared store) still counts, while a global install outside
+* the repo does not.
+*
+* Returns `null` when React isn't installed within the repo or its package.json
+* carries no version string. A tree with no boundary marker at all bounds the
+* search to `directory`, so a dependency hoisted above the scanned package there
+* is conservatively not adopted.
+*/
+/**
+* The nearest enclosing project boundary (git root or monorepo root), or
+* `directory` itself when the scan target sits outside any repo. Bounds the
+* node_modules walk so a React hoisted anywhere inside the repo counts, but a
+* React in an ancestor above the repo — a home-directory or global
+* `node_modules` — can't leak in.
+*/
+const findContainmentRoot = (directory) => {
+	for (const ancestorDirectory of ancestorDirectories(directory, { includeStart: true })) if (isProjectBoundary(ancestorDirectory)) return ancestorDirectory;
+	return directory;
+};
+const resolveInstalledReactVersion = (directory) => {
+	const containmentRoot = findContainmentRoot(directory);
+	for (const ancestorDirectory of ancestorDirectories(directory, { includeStart: true })) {
+		const reactPackageJsonPath = Path.join(ancestorDirectory, "node_modules", "react", "package.json");
+		if (isFile(reactPackageJsonPath)) {
+			const installedVersion = readPackageJson(reactPackageJsonPath).version;
+			return typeof installedVersion === "string" ? installedVersion : null;
+		}
+		if (ancestorDirectory === containmentRoot) return null;
+	}
+	return null;
+};
 const findInWorkspacePackageJsons = (rootDirectory, rootPackageJson, select) => {
 	const rootValue = select(rootPackageJson);
 	if (rootValue !== null) return rootValue;
@@ -34086,19 +34167,20 @@ const clearProjectCache = () => {
 };
 /**
 * Build a `ProjectInfo` for a directory that has no `package.json` of
-* its own — a monorepo subfolder like `repo/packages`, or any loose tree
-* of TypeScript/JavaScript files. Dependency + framework detection is
-* inherited from the enclosing workspace root when there is one, so
-* scanning a subdirectory of a React monorepo still gets the React
-* capabilities; a standalone non-React directory simply scans with the
-* framework-agnostic rules. Throws only when the directory has nothing
-* to scan (no enclosing project and no source files of its own).
+* its own — a package subfolder like `repo/packages` or `app/src/features`,
+* or any loose tree of TypeScript/JavaScript files. Dependency + framework
+* detection is inherited from the nearest enclosing package (a leaf
+* workspace, a plain app root, or a monorepo root — whichever is closest,
+* bounded by the git root), so scanning a subdirectory of a React project
+* still gets the React capabilities; a standalone non-React directory simply
+* scans with the framework-agnostic rules. Throws only when the directory has
+* nothing to scan (no enclosing project and no source files of its own).
 */
 const discoverProjectWithoutPackageJson = (directory) => {
 	const sourceFileCount = countSourceFiles(directory);
 	const hasOwnTsConfig = NFS.existsSync(Path.join(directory, "tsconfig.json"));
-	const monorepoRoot = findMonorepoRoot(directory);
-	const enclosingProject = monorepoRoot !== null && isFile(Path.join(monorepoRoot, "package.json")) ? discoverProject(monorepoRoot) : null;
+	const enclosingProjectRoot = findNearestAncestorPackageJson(directory);
+	const enclosingProject = enclosingProjectRoot !== null ? discoverProject(enclosingProjectRoot) : null;
 	if (enclosingProject !== null) return {
 		...enclosingProject,
 		rootDirectory: directory,
@@ -34202,6 +34284,7 @@ const discoverProject = (directory) => {
 	if (!reactVersion && reactDeclaration.version && !isCatalogReference(reactDeclaration.version)) reactVersion = reactDeclaration.version;
 	if (!tailwindVersion && tailwindDeclaration.version && !isCatalogReference(tailwindDeclaration.version)) tailwindVersion = tailwindDeclaration.version;
 	if (!zodVersion && zodDeclaration.version && !isCatalogReference(zodDeclaration.version)) zodVersion = zodDeclaration.version;
+	if (!reactVersion || parseReactMajor(reactVersion) === null) reactVersion = resolveInstalledReactVersion(directory) ?? reactVersion;
 	const projectName = packageJson.name ?? Path.basename(directory);
 	const hasTypeScript = NFS.existsSync(Path.join(directory, "tsconfig.json"));
 	const sourceFileCount = countSourceFiles(directory);
@@ -42441,4 +42524,4 @@ const toJsonReport = (result, options) => buildJsonReport({
 export { AmbiguousProjectError, NoReactDependencyError, NotADirectoryError, PackageJsonNotFoundError, ProjectNotFoundError, ReactDoctorError, buildJsonReport, buildJsonReportError, clearCaches, defineConfig, diagnose, filterSourceFiles, getDiffInfo, hasReactRuntime, isProjectDiscoveryError, isReactDoctorError, summarizeDiagnostics, toJsonReport };
 
 //# sourceMappingURL=index.js.map
-//# debugId=f1919957-a013-5ded-b0ed-3d2e8469d0e2
+//# debugId=f00947fe-3794-5d73-a491-232b535dc962

package/dist/lsp.js

@@ -33123,6 +33123,23 @@ const listSourceFilesViaFilesystem = (rootDirectory) => {
 const listSourceFilesWithSize = (rootDirectory) => collectSizedSourceFiles(rootDirectory, (listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory)).sort());
 const listSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).map((entry) => entry.path);
 const countSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).length;
+/**
+* The chain of ancestor directories of `startDirectory`, nearest first, up to
+* and including the filesystem root. With `includeStart`, the chain begins at
+* `startDirectory` itself; otherwise at its parent. The one place the "walk up
+* the tree" traversal is expressed, so each caller adds only its own match /
+* stop policy instead of re-deriving the `path.dirname` loop.
+*/
+const ancestorDirectories = (startDirectory, { includeStart }) => {
+	const directories = [];
+	let currentDirectory = includeStart ? startDirectory : Path.dirname(startDirectory);
+	while (true) {
+		directories.push(currentDirectory);
+		const parentDirectory = Path.dirname(currentDirectory);
+		if (parentDirectory === currentDirectory) return directories;
+		currentDirectory = parentDirectory;
+	}
+};
 const cachedPackageJsons = /* @__PURE__ */ new Map();
 const clearPackageJsonCache = () => {
 	cachedPackageJsons.clear();
@@ -33156,11 +33173,7 @@ const isMonorepoRoot = (directory) => {
 	return Array.isArray(packageJson.workspaces) || Boolean(packageJson.workspaces?.packages);
 };
 const findMonorepoRoot = (startDirectory) => {
-	let currentDirectory = Path.dirname(startDirectory);
-	while (currentDirectory !== Path.dirname(currentDirectory)) {
-		if (isMonorepoRoot(currentDirectory)) return currentDirectory;
-		currentDirectory = Path.dirname(currentDirectory);
-	}
+	for (const directory of ancestorDirectories(startDirectory, { includeStart: false })) if (isMonorepoRoot(directory)) return directory;
 	return null;
 };
 /**
@@ -33806,6 +33819,74 @@ const findDependencyInfoFromMonorepoRoot = (directory) => {
 		framework: rootInfo.framework !== "unknown" ? rootInfo.framework : workspaceInfo.framework
 	};
 };
+/**
+* Walk up from `startDirectory` to the nearest ancestor that owns a
+* `package.json`, stopping at (and including) the enclosing project boundary
+* — the working tree's git root or a monorepo root. Lets a scan of a package
+* subfolder that has no `package.json` of its own adopt the nearest enclosing
+* package as its project root, so it inherits that package's dependency +
+* framework detection instead of synthesizing an empty (React-blind) project.
+*
+* Generalizes the older monorepo-root-only lookup: the nearest ancestor is the
+* most specific owning package (a leaf workspace, not just the repo root), so
+* a subfolder of one workspace no longer borrows a sibling's capabilities.
+*
+* Returns `null` when no ancestor `package.json` exists inside the project
+* boundary (a loose tree of files, or a subfolder of a package-less repo).
+*/
+const findNearestAncestorPackageJson = (startDirectory) => {
+	if (isProjectBoundary(startDirectory)) return null;
+	for (const directory of ancestorDirectories(startDirectory, { includeStart: false })) {
+		if (isFile(Path.join(directory, "package.json"))) return directory;
+		if (isProjectBoundary(directory)) return null;
+	}
+	return null;
+};
+/**
+* Last-resort React detection: locate React the way Node's `node_modules`
+* resolution would from `directory` — check each `node_modules/react` up the
+* tree — but bounded to the enclosing repo so a globally installed React can't
+* masquerade as the project's version. Stops at (and including) the nearest
+* project boundary — the git root or a monorepo root — and returns the first
+* installed `version`.
+*
+* Makes "React is installed and importable" ⇒ "React is detected" an invariant
+* for packages whose only React declaration is a version-less spec
+* (`workspace:*`, `*`, a dist-tag) or where React lives solely in a hoisted
+* `node_modules` the declaration walks never reach — the profile of a component
+* package inside a monorepo. Matching the `node_modules/react` entry rather than
+* its realpath means a project whose `node_modules` is symlinked elsewhere (a
+* Docker volume, a shared store) still counts, while a global install outside
+* the repo does not.
+*
+* Returns `null` when React isn't installed within the repo or its package.json
+* carries no version string. A tree with no boundary marker at all bounds the
+* search to `directory`, so a dependency hoisted above the scanned package there
+* is conservatively not adopted.
+*/
+/**
+* The nearest enclosing project boundary (git root or monorepo root), or
+* `directory` itself when the scan target sits outside any repo. Bounds the
+* node_modules walk so a React hoisted anywhere inside the repo counts, but a
+* React in an ancestor above the repo — a home-directory or global
+* `node_modules` — can't leak in.
+*/
+const findContainmentRoot = (directory) => {
+	for (const ancestorDirectory of ancestorDirectories(directory, { includeStart: true })) if (isProjectBoundary(ancestorDirectory)) return ancestorDirectory;
+	return directory;
+};
+const resolveInstalledReactVersion = (directory) => {
+	const containmentRoot = findContainmentRoot(directory);
+	for (const ancestorDirectory of ancestorDirectories(directory, { includeStart: true })) {
+		const reactPackageJsonPath = Path.join(ancestorDirectory, "node_modules", "react", "package.json");
+		if (isFile(reactPackageJsonPath)) {
+			const installedVersion = readPackageJson(reactPackageJsonPath).version;
+			return typeof installedVersion === "string" ? installedVersion : null;
+		}
+		if (ancestorDirectory === containmentRoot) return null;
+	}
+	return null;
+};
 const findInWorkspacePackageJsons = (rootDirectory, rootPackageJson, select) => {
 	const rootValue = select(rootPackageJson);
 	if (rootValue !== null) return rootValue;
@@ -34145,19 +34226,20 @@ const clearProjectCache = () => {
 };
 /**
 * Build a `ProjectInfo` for a directory that has no `package.json` of
-* its own — a monorepo subfolder like `repo/packages`, or any loose tree
-* of TypeScript/JavaScript files. Dependency + framework detection is
-* inherited from the enclosing workspace root when there is one, so
-* scanning a subdirectory of a React monorepo still gets the React
-* capabilities; a standalone non-React directory simply scans with the
-* framework-agnostic rules. Throws only when the directory has nothing
-* to scan (no enclosing project and no source files of its own).
+* its own — a package subfolder like `repo/packages` or `app/src/features`,
+* or any loose tree of TypeScript/JavaScript files. Dependency + framework
+* detection is inherited from the nearest enclosing package (a leaf
+* workspace, a plain app root, or a monorepo root — whichever is closest,
+* bounded by the git root), so scanning a subdirectory of a React project
+* still gets the React capabilities; a standalone non-React directory simply
+* scans with the framework-agnostic rules. Throws only when the directory has
+* nothing to scan (no enclosing project and no source files of its own).
 */
 const discoverProjectWithoutPackageJson = (directory) => {
 	const sourceFileCount = countSourceFiles(directory);
 	const hasOwnTsConfig = NFS.existsSync(Path.join(directory, "tsconfig.json"));
-	const monorepoRoot = findMonorepoRoot(directory);
-	const enclosingProject = monorepoRoot !== null && isFile(Path.join(monorepoRoot, "package.json")) ? discoverProject(monorepoRoot) : null;
+	const enclosingProjectRoot = findNearestAncestorPackageJson(directory);
+	const enclosingProject = enclosingProjectRoot !== null ? discoverProject(enclosingProjectRoot) : null;
 	if (enclosingProject !== null) return {
 		...enclosingProject,
 		rootDirectory: directory,
@@ -34261,6 +34343,7 @@ const discoverProject = (directory) => {
 	if (!reactVersion && reactDeclaration.version && !isCatalogReference(reactDeclaration.version)) reactVersion = reactDeclaration.version;
 	if (!tailwindVersion && tailwindDeclaration.version && !isCatalogReference(tailwindDeclaration.version)) tailwindVersion = tailwindDeclaration.version;
 	if (!zodVersion && zodDeclaration.version && !isCatalogReference(zodDeclaration.version)) zodVersion = zodDeclaration.version;
+	if (!reactVersion || parseReactMajor(reactVersion) === null) reactVersion = resolveInstalledReactVersion(directory) ?? reactVersion;
 	const projectName = packageJson.name ?? Path.basename(directory);
 	const hasTypeScript = NFS.existsSync(Path.join(directory, "tsconfig.json"));
 	const sourceFileCount = countSourceFiles(directory);
@@ -44160,5 +44243,5 @@ const startLanguageServer = () => {
 };
 //#endregion
 export { startLanguageServer };
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0cab34bf-65ac-5994-9a93-41f1b5670387")}catch(e){}}();
-//# debugId=0cab34bf-65ac-5994-9a93-41f1b5670387
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8bc40ab2-982a-5d5d-a65c-9733ec980391")}catch(e){}}();
+//# debugId=8bc40ab2-982a-5d5d-a65c-9733ec980391

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-doctor",
-  "version": "0.7.1-dev.ce9dabf",
+  "version": "0.7.1-dev.d353dad",
   "description": "Your agent writes bad React. This catches it",
   "keywords": [
     "accessibility",
@@ -66,7 +66,7 @@
     "vscode-uri": "^3.1.0",
     "yaml": "^2.9.0",
     "deslop-js": "0.7.1",
-    "oxlint-plugin-react-doctor": "0.7.1-dev.ce9dabf"
+    "oxlint-plugin-react-doctor": "0.7.1-dev.d353dad"
   },
   "devDependencies": {
     "@types/babel__code-frame": "^7.27.0",
@@ -74,9 +74,9 @@
     "@xterm/headless": "^6.0.0",
     "commander": "^14.0.3",
     "ora": "^9.4.0",
-    "@react-doctor/language-server": "0.7.1",
+    "@react-doctor/core": "0.7.1",
     "@react-doctor/api": "0.7.1",
-    "@react-doctor/core": "0.7.1"
+    "@react-doctor/language-server": "0.7.1"
   },
   "engines": {
     "node": "^20.19.0 || >=22.13.0"