chore(dev): add React Doctor audit command

package.json

@@ -43,7 +43,8 @@
     "perf:test": "node --test scripts/perf/report.test.mjs",
     "dev:profile": "cross-env CVR_REACT_DIAGNOSTICS=profiler node scripts/dev.mjs dev",
     "react:ab": "node scripts/react/ab.mjs",
-    "dev:wdyr": "cross-env CVR_REACT_DIAGNOSTICS=wdyr node scripts/dev.mjs dev"
+    "dev:wdyr": "cross-env CVR_REACT_DIAGNOSTICS=wdyr node scripts/dev.mjs dev",
+    "audit:react": "node scripts/react/doctor.mjs"
   },
   "dependencies": {
     "@dnd-kit/collision": "^0.5.0",
@@ -139,7 +140,8 @@
     "webdriverio": "10.1.0",
     "ws": "8.22.1",
     "playwright": "1.64.1",
-    "@welldone-software/why-did-you-render": "10.0.1"
+    "@welldone-software/why-did-you-render": "10.0.1",
+    "react-doctor": "0.9.21"
   },
   "lint-staged": {
     "*.{ts,tsx,js,mjs}": [

scripts/react/README.md

@@ -13,6 +13,13 @@ mutually exclusive; `CVR_REACT_DIAGNOSTICS` accepts only `profiler` or `wdyr` on
 the development server. Each mode uses its own Vite cache. Production builds
 ignore this variable and include neither diagnostic entry nor runtime.
 
+`pnpm audit:react` scans supported source files under `src`. Pass file paths to
+limit the scan, for example `pnpm audit:react src/hooks/use-proxy-delay-state.ts`;
+add `--json` for the original structured report. Diagnostics are advisory.
+Execution errors and incomplete scans fail the command. Telemetry, remote scores
+and supply-chain scanning are disabled; the command does not fix code, erase
+historical diagnostics or run in CI.
+
 Install the browser explicitly with `pnpm exec playwright install chromium`.
 Then run `pnpm react:ab --base <ref> --head <ref>`. Both Git trees run against
 one installed dependency set and the same fixed DNS, delay-hook and proxy-tab

scripts/react/doctor.mjs

@@ -0,0 +1,77 @@
+import { spawnSync } from 'node:child_process'
+import { statSync } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { parseArgs } from 'node:util'
+
+import { globSync } from 'glob'
+
+const { values, positionals } = parseArgs({
+  options: { json: { type: 'boolean' } },
+  allowPositionals: true,
+})
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..')
+const files = positionals.length
+  ? positionals
+  : globSync('src/**/*.{js,jsx,ts,tsx,mjs,cjs,mts,cts,html}', {
+      cwd: root,
+      nodir: true,
+    }).sort()
+if (files.length === 0) throw new Error('No source files found')
+for (const file of files) {
+  if (
+    !/\.(?:[jt]sx?|[cm][jt]s|html)$/.test(file) ||
+    !statSync(path.resolve(root, file)).isFile()
+  )
+    throw new Error(`Expected a source file: ${file}`)
+}
+const executable = fileURLToPath(
+  new URL('../bin/react-doctor.js', import.meta.resolve('react-doctor')),
+)
+const result = spawnSync(
+  process.execPath,
+  [
+    executable,
+    ...files,
+    '--json',
+    '--no-telemetry',
+    '--no-supply-chain',
+    '--blocking',
+    'none',
+    '--yes',
+  ],
+  {
+    cwd: root,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'inherit'],
+    maxBuffer: 64 * 1024 * 1024,
+  },
+)
+if (result.error) throw result.error
+if (result.signal)
+  throw new Error(`React Doctor terminated by ${result.signal}`)
+const report = JSON.parse(result.stdout)
+if (values.json) {
+  process.stdout.write(result.stdout)
+} else {
+  for (const diagnostic of report.diagnostics) {
+    console.log(
+      `${diagnostic.filePath}:${diagnostic.line}:${diagnostic.column} ${diagnostic.severity} ${diagnostic.plugin}/${diagnostic.rule}\n  ${diagnostic.message}`,
+    )
+  }
+  console.log(
+    `${report.summary.totalDiagnosticCount} advisory diagnostics across ${report.projects.reduce((count, project) => count + project.analyzedFileCount, 0)} analyzed files`,
+  )
+}
+// In 0.9.21, --blocking none also masks linter execution failures.
+const incomplete = report.projects.filter((project) => !project.complete)
+if (report.error) console.error(report.error.message)
+for (const project of incomplete) {
+  console.error(
+    'Incomplete React Doctor scan:',
+    project.directory,
+    project.skippedCheckReasons,
+  )
+}
+process.exitCode =
+  result.status || (!report.ok || incomplete.length > 0 ? 1 : 0)