* fix: ignore TypeScript type-only positions in no-unguarded-browser-global-at-module-scope
The rule was incorrectly flagging browser-global names (window, navigator, etc.) when they appeared as property keys in TypeScript interfaces and type aliases. These are type-only positions that TypeScript erases during compilation, so no runtime reference error occurs.
Add isTypeScriptTypePosition check to skip identifiers in TS type contexts before reporting. Add regression tests covering interface properties, type alias properties, and the preserved behavior for actual runtime references.
Fixes#1667
Co-authored-by: Skosh <skoshx@users.noreply.github.com>
* chore: add changeset for #1667 fix
Co-authored-by: Skosh <skoshx@users.noreply.github.com>
* test: add edge case tests for TypeScript type positions
Co-authored-by: Skosh <skoshx@users.noreply.github.com>
* test: preserve type-only browser global regression
* docs(changeset): clarify type-only global fix
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Skosh <skoshx@users.noreply.github.com>
Co-authored-by: Aiden Bai <aiden.bai05@gmail.com>
* fix: extract entry points from implicit sub-projects outside workspace patterns
When the root package.json declares workspaces, sub-projects outside the
declared workspace globs were discovered but their entry points (main, bin,
exports) were skipped. This caused false positives in unused-file detection.
The fix removes the isDeclaredWorkspace predicate from entry extraction -
any package with a valid package.json should have its entry points extracted
regardless of workspace pattern matching.
Fixes#1665
Co-authored-by: Skosh <skoshx@users.noreply.github.com>
* chore: add changeset for issue #1665 fix
Co-authored-by: Skosh <skoshx@users.noreply.github.com>
* test: consolidate implicit workspace entry regression
* docs(changeset): clarify implicit entry fix
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Skosh <skoshx@users.noreply.github.com>
Co-authored-by: Aiden Bai <aiden.bai05@gmail.com>
* fix: prevent stack overflow in function resolution with depth limiting
Add depth limiting to resolveExactLocalFunction to prevent infinite
recursion when resolving function references through deeply nested
expressions, TypeScript path aliases, or complex import chains.
The function now enforces a configurable depth limit
(FUNCTION_RESOLUTION_MAX_DEPTH = 15) and returns null when exhausted
rather than continuing to recurse.
- Add FUNCTION_RESOLUTION_MAX_DEPTH constant (15 levels)
- Thread remainingDepth parameter through all resolution helpers
- Add unit tests for depth limiting
- Add regression test for zustand + Next.js + path aliases case
Closes#1657
Co-authored-by: Skosh <skoshx@users.noreply.github.com>
* test: exercise function resolution stack guard
* refactor: share function chain fixture builder
* test: tighten function resolution regressions
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Skosh <skoshx@users.noreply.github.com>
Co-authored-by: Aiden Bai <aiden.bai05@gmail.com>
* feat(cli): record React-aware browser traces
Add an interactive Playwright scanner that streams DevTools traces to disk and reports React rendering hotspots for humans and agents.
* fix(cli): use shared telemetry anonymizer
Keep runtime URL redaction on the canonical core utility after the telemetry helper consolidation.
* feat(cli): visualize component renders during traces
Flash labeled component outlines during runtime scans so users can connect slow interactions to the React work they trigger.
* feat(skill): add runtime performance workflow
Guide agents through repeatable React traces so performance findings stay tied to measured interactions.
* docs(cli): guide runtime scan setup
Explain the recording flow, browser isolation, authenticated sessions, output formats, and trace privacy directly in command help.
* fix(cli): harden runtime trace capture
Preserve evidence across navigations while keeping structured output, telemetry, trace files, and attached-browser cleanup safe under failures and cancellation.
* fix(cli): preserve latest navigation evidence
Keep cross-document layout shifts comparable and retain the most recent bounded performance entries so the recorded interaction remains represented.
* fix(cli): bound runtime scan browser resources
Prevent trace deadlocks, cross-tab capture, and unbounded browser evidence while preserving navigation data through an isolated validated relay.
* fix(cli): preserve busy-page runtime snapshots
Stop tracing concurrently with final probe collection and allow busy pages enough time to flush their bounded performance evidence.
* feat(cli): prompt for runtime scan URL
Let people start an interactive runtime scan without remembering the URL argument while keeping agents and CI deterministic.
* feat(cli): suggest local apps for runtime scans
Replace the bare URL field with a polished chooser that discovers common localhost development servers while preserving custom URL entry.
* fix(cli): use scan terminology in runtime flow
Keep the interactive copy aligned with the command users invoked instead of switching between recording and profiling language.
* fix(cli): center runtime chooser in full terminal
Render the interactive URL chooser as a terminal-sized view so it no longer appears anchored to the previous cursor position.
* fix(cli): harden runtime scan edge cases
Capture popup evidence without leaking browser pages, support redirected interactive output and IPv6 localhost apps, and keep bounded reports honest.
* feat(lsp): move editor telemetry to Axiom and unify the opt-out
Completes the cutover. The language server gets the same split as the CLI —
spans and metrics to Axiom, crashes to Sentry — with one difference that matters:
an editor session can run for hours and may never shut down cleanly, so its
exporters use a periodic interval instead of relying on a shutdown flush. Its
counters also now route through `record-metric.ts` rather than calling the Sentry
SDK directly, so they finally carry the run attributes every other metric has.
`is-telemetry-enabled.ts` becomes the single gate for every backend, which fixes
a real hazard: `REACT_DOCTOR_NO_TELEMETRY` was previously honored only by the
language server, and blanking `SENTRY_DSN` no longer silences anything. The evals
harness relied on exactly that, so it would have started reporting eval scans as
production telemetry; it now sets the env flag like the benchmark and delta-audit
runners already did.
Removes what the cutover made dead: the Sentry metric scrubber (no CLI or LSP
metrics flow through Sentry anymore), `resolveTracesSampleRate` and its
constants (neither client records spans), and the span-status and HrTime
constants the deleted tracer bridge used.
Rewrites the AGENTS.md observability section, which described a Sentry-only
architecture, and updates the `--debug` docs wording.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(lsp): correct editor span timing, attribution, and startup export
Give the wide event its real duration. `Effect.makeSpan` stamps the start time
from the clock, and the event is emitted once the burst has already finished —
so start and end landed at the same instant and every editor scan reported a
duration of ~0, even though `durationMs` was correct as an attribute. The span
is now built straight off the tracer, which takes an explicit `startTime`, so
the scan's real window is supplied on both ends. This restores what the Sentry
path got from `startTime`.
Attribute editor telemetry to the editor. Routing LSP counters through
`recordCount` picked up the shared run context, which classified the process as
`command: "inspect"` / `origin: "cli"` — so editor metrics were misfiled in
Axiom and disagreed with the LSP's own Sentry scope, which tags them
`experimental-lsp` / `lsp`. `experimental-lsp` is now a recognized command and
implies the `lsp` origin.
Open the exporters at startup. They were built lazily from the first completed
scan, so a session that recorded session-start counters and was then killed
before any scan finished exported nothing — the shutdown flush found no scope.
Building at init also starts the periodic interval ticking, which is the point
of having one for a daemon.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(cli): send traces, metrics, and the wide event to Axiom
Moves the CLI's telemetry onto the Axiom transport added in the previous commit.
Sentry keeps crash reporting — its source-map symbolication, issue grouping, and
quotable event id have no Axiom equivalent — so error reports, the prefilled
issue link, and the JSON report's `sentryEventId` are unchanged. Because Effect
exposes a single `Tracer` reference, the two backends are mutually exclusive for
spans, so `tracesSampleRate` is pinned to 0 and the Effect-to-Sentry bridge is
deleted.
Metrics and spans move together because they share one runtime, and that sharing
is load-bearing. `telemetry-runtime.ts` builds the layer once into a long-lived
scope; the run root span, the scan program, and the renderer all draw their
tracer from it. Child spans then nest under the run span natively, with no
`ExternalSpan` stitching. More importantly, Effect tracks delta-temporality state
per metrics exporter instance, so building the layer per program would make every
new exporter re-report each counter in full — silently doubling every metric.
`shutdownTelemetry()` is memoized for the same reason: several exit paths can
fire, and a `--debug` user error flushes before the top-level catch does.
`recordCount` / `recordDistribution` keep their exact signatures, so all ~40 call
sites are untouched; only the body changes to write into Effect's metric
registry. Two constraints differ from Sentry: Effect metric attributes are
string-only, so numbers and booleans are stringified while null and undefined are
dropped rather than coerced to "null"; and histograms need explicit buckets, so
distributions share `METRIC_DISTRIBUTION_BOUNDARIES`. Metrics never touch the
tracer, so they are scrubbed at the emit site instead of by the scrubbing tracer.
`--debug` now prints the Axiom trace id, and crashes carry that id plus `runId`
as Sentry tags — so one pasted id resolves in both backends, replacing the
propagation-context linkage that dies with Sentry tracing.
Verified end to end against a local collector with a real scan: one trace request
and one metrics request, root span with `runInspect` nested under it, the full
wide event, `scan.completed` recorded exactly once, and no home directory or
username on the wire.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(cli): close six review findings in the Axiom cutover
Restore export to a user's own collector. `applyObservability` installed a
backend only when first-party Axiom credentials resolved, so anyone who had
pointed React Doctor at their own OTLP endpoint silently stopped getting spans
once the CLI stopped falling back to `layerUserOtlp` unconditionally. The shared
runtime now builds whenever either first-party credentials or
`REACT_DOCTOR_OTLP_*` are present, and `layerObservability` still prefers the
user's endpoint.
Export metrics for commands that never scan. `version`, `install`, `ci`,
`rules`, and early `inspect` exits record counters like `cli.invoked`, but only
the scan path built the exporter — so `shutdownTelemetry` found no scope and
dropped them. It now ensures the runtime exists before closing it, which is a
no-op when a scan already opened one.
Namespace the environment overrides as `REACT_DOCTOR_AXIOM_*`. The bare
`AXIOM_TOKEN` / `AXIOM_DATASET` names are Axiom's own, and anyone already
running Axiom likely has them exported — reading them would redirect React
Doctor's telemetry into an unrelated account without the user asking.
Carry the Axiom trace id and run id on crash reports as a *context* rather than
tags. Both are unique per run, and tags are the indexed low-cardinality
dimension — AGENTS.md calls this out for `runId` specifically.
Also replaces an inline nanosecond conversion with a named constant, and defers
`LSP_TELEMETRY_EXPORT_INTERVAL_MS` to the commit that actually reads it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(cli): embed the Axiom ingest token
Enables first-party telemetry. Until now the constant was empty, so
`resolveAxiomTelemetryOptions` returned null and the CLI recorded into Effect's
registry and dropped everything on exit — the merge blocker called out on this
stack.
The token is `ingest:create` only, scoped to the `react-doctor` (Events) and
`react-doctor-metrics` (OTel Metrics) datasets, with no expiry and no
organization permissions. It ships in the published tarball and is therefore
extractable; that was the deliberate trade (the alternative — proxying ingest
through `www.react.doctor`, which already hosts the score API — remains
available if abuse shows up). Detection is an Axiom monitor on anomalous ingest
volume; rotation is a patch release.
Verified against the live service: `/v1/traces` and `/v1/metrics` both return
200 for protobuf payloads with their respective dataset headers, which also
confirms the protobuf serialization choice end to end rather than just against
a local collector.
Two tests moved with it. They asserted the "no token configured" path, which is
no longer reachable through the environment; they now assert the embedded
defaults resolve, and — the part that actually matters — that Axiom's own
unprefixed `AXIOM_*` variables still cannot redirect the destination.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(core): add Axiom OTLP transport and an anonymizing tracer
Adds the export path for shipping traces and metrics to Axiom, plus the
anonymization guarantee that has to come with it. Nothing emits yet — the CLI
still routes telemetry to Sentry; this is the engine-side groundwork.
`layerAxiomTraces` and `layerAxiomMetrics` are composed by hand rather than
through `Otlp.layer`, because Axiom routes each signal to a different dataset
via a different header and `Otlp.layer` passes one `headers` object to every
signal. Serialization is protobuf, not JSON: Axiom's `/v1/metrics` accepts
`application/x-protobuf` only. `OtlpSerialization.layerProtobuf` ships with
Effect, so this adds no dependency.
They are separate layers on purpose. Effect tracks delta-temporality state on
the metrics exporter instance, so a second exporter in one process starts with
no previous snapshot and re-reports every counter's full value — doubling every
metric. `telemetry-payload.test.ts` pins that behavior so a future refactor that
merges them fails loudly instead of silently doubling data.
OTLP has no `beforeSend` hook, so Sentry's central scrubber has no equivalent.
`makeScrubbingTracer` wraps the tracer and runs every span name, attribute, and
event payload through `anonymizeText` on the way to the exporter, and is applied
inside `layerAxiomTraces` so an attribute added later cannot bypass it.
`anonymize-text.ts` moves to core (both its scrubbers already lived there) and
`run-inspect.ts` now scrubs `inspect.directory` at the source rather than relying
on the backstop.
`TELEMETRY_SHUTDOWN_TIMEOUT_MS` is 1s, tighter than Sentry's 2s error flush: the
metrics exporter passes `maxBatchSize: "disabled"` internally, which skips
Effect's empty-buffer short-circuit, so it POSTs on every scope close whether or
not anything was recorded. On a firewalled machine that request cannot fail fast,
and unlike the Sentry flush it would run on every scan rather than only on crashes.
Verified against a local collector: correct per-signal datasets and protobuf
content type, and no home directory, username, or secret reaches the wire.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(core): close three review findings in the Axiom transport
Scrub the failure a span ended with. The OTLP tracer runs `Cause.prettyErrors`
over the exit and exports each result as `exception.type` / `exception.message` /
`exception.stacktrace`. None of those go through `span.attribute`, so they
bypassed the scrubbing tracer entirely — and stack traces are full of absolute
paths, meaning any failing scan shipped the user's home directory. This was the
one route into the payload the backstop didn't cover. Interrupt-only causes are
left alone; the exporter emits a fixed label for them and never touches the
error text.
Honor `exportIntervalMs` for traces. It was threaded through to the metrics
exporter but not the tracer, so a long-lived process — the language server —
would hold spans for the full ten-minute default no matter what interval it
asked for.
Trim trailing slashes without a regex. `/\/+$/` backtracks quadratically on a
domain made mostly of slashes, which CodeQL flags as a polynomial-regex denial
of service because the value comes from the caller.
Also corrects a doc comment that still described metrics as being built at exit,
which stopped being true when the CLI moved to a single shared scope.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Aiden Bai