feat: add source-patched native Oxlint path

[aidenybai]

Summary

• patch the pinned Oxc source and compile React Doctor rules as native Rust rules
• preserve exact JavaScript diagnostic messages, spans, severity, suppressions, configuration, and file gating
• keep the JavaScript plugin as the fallback for the one deliberately excluded Socket/WebSocket rule and environments without the native binding
• ship the experiment as a separate react-doctor-rust launcher; the stable react-doctor entry point is unchanged
• do not maintain an Oxc fork

Current hardening — 1b3f93d25, f08f1e9f2, and 070e6b008

• fix Linux ABI compatibility: the Ubuntu-built binding failed to load on Debian 12/glibc 2.36 because it required GLIBC_2.39; build Linux x64/arm64 in official manylinux_2_28 containers and add two glibc 2.28 tarball install smokes, retaining the existing six
• allow 120 minutes for the Intel macOS native build after the 60-minute limit canceled active compilation; other targets retain 60 minutes and all targets retain one Cargo job
• preserve canonical U+FEFF whitespace handling for postMessage channel constructors, typed receivers, and guarded local data bindings; Worker, WebSocket, EventSource, and other same-application suppressions remain intact
• reject unexpected process exit codes and empty output in required-native mode instead of treating failed native analysis as a clean scan; stable-engine handling is unchanged
• fingerprint the Rust overlays, upstream manifest, patch, build generator, and native CI configuration in every artifact; assembly rejects stale or mixed-source binaries before replacing package output
• add three exact scan fixtures, canonical and fuzz regressions, twelve subprocess failure cases, and source-provenance tests
• refreshed origin/main at fd23edca7: already included in this branch; no synchronization commit was needed
• no Changeset: this is internal experimental native-parity hardening

Current coverage

• 906 canonical rules: 864 AST rules and 42 security scan rules
• all 864 AST rules are native registered, generating 1,734 Oxc implementations
• 41 of 42 security scan rules are native
• 905 of 906 canonical behaviors are native-backed
• 55 of 56 Security rules are native; the sole exclusion is local-rpc-native-bridge-risk, which explicitly detects localhost WebSocket handlers executing native commands
• all 7 project-analysis rules are native: circular-dependency, duplicate-jsx-subtree, unused-dependency, unused-dev-dependency, unused-export, unused-file, and unused-type
• newest AST rules: no-secrets-in-client-code, jsx-no-target-blank, and window-open-without-noopener
• newest scan cohort adds 33 rules covering agent and MCP tool capabilities, generated artifacts, secrets, Firebase, crypto/JWT/session handling, command/path/import risks, postMessage origin checks, redirects, webhooks, and related trust boundaries
• 2,541 exact AST fixture diagnostics
• 41 native scan rules across 230 exact fixtures
• 6 graph rules plus duplicate JSX across 4 exact project-analysis cases
• 522,000 strict required-fire fuzz mutations
• newest three-rule AST target corpus: 48 repositories, 181 diagnostics, 0 differences
• native security scan target corpus: 43 repositories, 50 diagnostics, 0 differences
• last complete integrated AST target corpus: 47 repositories, 2,848 diagnostics, 0 differences
• integrated corpus retains the last confirmed 181,665 diagnostics across 47 repositories

Scope

• excludes only local-rpc-native-bridge-risk; Socket.IO/WebSocket native-command bridge analysis remains out of scope
• retains postmessage-origin-risk, whose canonical behavior explicitly suppresses WebSocket, Worker, MessagePort, BroadcastChannel, and EventSource handlers
• native project analysis retains the canonical TypeScript graph/candidate construction
• the stable package preserves independent per-cohort fallback; react-doctor-rust instead treats any missing, incompatible, malformed, or failed native analysis as a hard failure

Experimental package and CI

• adds the separate react-doctor-rust launcher package
• adds matching optional native packages for macOS arm64/x64, Linux glibc arm64/x64, and Windows x64 MSVC
• validates package/binding version equality and required N-API exports before starting the CLI
• sets required-native mode so lint, retained security scans, project analysis, and duplicate JSX cannot silently fall back
• builds each target independently, runs exact fixture/scan/project parity on its native runner, verifies artifact and patch SHA-256 metadata, assembles 8 tarballs, and smoke-installs them on every supported platform
• includes Node 20.19 smoke coverage on Linux and Node 22.18 smoke coverage on all five targets
• keeps the package private and CI-only; there is no publish workflow in this PR
• release assembly requires explicit matching react-doctor-rust and already-published react-doctor versions
• postpublish smoke mode installs only react-doctor-rust@<exact-version> so registry optional-dependency selection is tested independently
• musl remains unsupported until it has its own native build and install-smoke lane

Previously measured performance

• integrated clean-heavy p50: JavaScript 461.7 ms, native 54.6 ms, 88.2% faster
• integrated 50,000-finding p50: JavaScript 1,104.8 ms, native 448.9 ms, 59.4% faster
• combined 237-rule render/performance cohort clean-heavy p50: JavaScript 974.6 ms, native 75.8 ms, 92.2% faster
• combined 237-rule render/performance cohort finding-heavy p50: JavaScript 2,327.9 ms, native 634.2 ms, 72.8% faster

Validation at 070e6b008

• single-job compile check and release build passed against Oxlint 1.79.0 at 1b3f93d25; the follow-up changes CI/build provenance and docs, with no Rust detector changes
• exact native AST parity: 2,541 diagnostics, with required firing coverage for all 864 rules
• native scan parity: 41 rules, 230 exact fixtures
• native project parity: 6 graph rules and duplicate JSX across 4 cases
• current security AST target corpus: 48 repositories, 181 diagnostics, 0 differences
• native scan corpus: 43 repositories, 50 diagnostics, 0 differences
• postMessage strict required-fire fuzz: 500 mutations; 505 programs executed, 2 firing programs, 0 findings
• full tests: 12/12 tasks passed with package execution serialized, including 27,616 plugin tests; an initial Ink timing assertion failed under concurrent package execution and passed in isolation and the serial full rerun, without threshold changes
• lint, typecheck, format, JSON-report smoke, source-patch verification, launcher/provenance tests, and git diff --check passed
• independent review and deslop complete; source fingerprint remains current after formatting
• latest hosted ordinary checks passed, including the complete test matrix on its first attempt at 070e6b008; all five native platform builds and runtime parity gates, package assembly, and all eight real tarball installation smokes passed in Native Oxlint run 33959810583
• both Linux x64 and arm64 glibc 2.28/Node 20.19 installation smokes passed, alongside the existing six platform/Node lanes
• downloaded the genuine final CI package artifact and independently verified all eight tarball checksums and the current source fingerprint across five platforms; an additional local macOS arm64 tarball installation smoke passed. Artifact directory: /tmp/react-doctor-rust-tarballs-070e6b008/
• preceding f08f1e9f2 run passed Linux x64/arm64, macOS arm64, and Windows native builds and all runtime parity gates; Intel macOS hit the 60-minute build limit with rustc still active and no compiler error, leaving package assembly and smokes skipped. The final follow-up changes only that timeout and reruns the complete matrix.
• manylinux setup validation passed: actual glibc 2.28/GCC 14.2.1 image runs official Node 20.19.0 and 22.18.0 binaries; workflow validation (actionlint) passed
• independent Debian 12 smoke passed with the exact f08f1e9f2 Linux x64 CI artifact: glibc 2.36, Node 22.23.2, all six required APIs loaded; binary and current source fingerprints match. The previous Ubuntu-built artifact failed in this same environment.
• ordinary macOS CI initially failed two unchanged timing-ratio assertions; all 41 focused tests passed locally, and the CI retry passed without detector or threshold changes; the full ordinary matrix was green at f08f1e9f2
• nonblocking staged-hook warning investigated: existing no-json-parse-stringify-clone finding in the exact scan-parity JSON normalizer; it predates these changes, and replacing it with structuredClone would change wire semantics
• bounded paired Daytona host/TypeScript comparison at 1b3f93d25 finished incomplete after 33m51s: 46/48 roots, covering 232 nested projects; Supabase failed report validation and Next.js timed out after retries. Both streaming validators rejected the artifacts, so no diagnostic/performance parity claim is made. The evaluator did not activate the native binding. Artifacts: tmp/parity-pr-1664-1b3f93d25/

The integrated corpus retains the last confirmed 181,665 diagnostics. A new full AST corpus run was stopped after exact fixture validation to prioritize the affected scan corpus and rebuild; it does not replace that historical total.

Final refresh: local and remote branch HEAD are 070e6b008204c9792843c389af6f304713f7a261; origin/main remains fd23edca7eaa76b7f2b66795cfc829cc1967b7f3, already included. No tracked working-tree changes remain.

This PR remains open and draft. Publishing and merging are out of scope.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@1664

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@1664

npm i https://pkg.pr.new/react-doctor@1664

commit: 070e6b0

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit 070e6b0.}

[github-actions]

Interactive terminal E2E

Terminal Control verified the built CLI at 070e6b0 in a real PTY:

• selected a project interactively and observed Scanning... before the three-second Git delay completed
• waited for the clean result and exercised the compact report
• opened copy context and the GitHub Actions confirmation, then cancelled safely

Download the edited MP4 and PNG evidence

[aidenybai]

bugbot run

[cursor]

Skipping Bugbot: Bugbot is disabled for this repository. Visit the Bugbot dashboard to update your settings.