feat: add source-patched native Oxlint path

[aidenybai]

Summary

• patch the pinned Oxc source and compile React Doctor rules as native Rust rules
• preserve exact JavaScript diagnostic messages, spans, severity, suppressions, configuration, and file gating
• keep the JavaScript plugin as the fallback for deliberately excluded rules and environments without the native binding
• add native import-provenance, static JSX value, contentEditable, React class, JSX-depth, local callback, React Router, WebGPU, Tailwind, inline-style, static rendered-text, navigation, control, typography, presentation, global-namespace provenance, effect-execution, rerender, and semantic reference helpers

Current coverage

• 857 in-scope rule IDs: 843 non-security ordinary AST rules, 7 retained security scans, and 7 project-analysis rules
• 861 Oxc lint registrations generating 1,731 Oxc implementations; 850 registrations are in scope, including all 7 project rules, and 11 existing registrations are now outside scope
• all 7 retained scan rules are native: dangerous-html-sink, nosql-injection-risk, raw-sql-injection-risk, supabase-client-owned-authz-field, supabase-rls-policy-risk, supabase-table-missing-rls, and unsafe-json-in-html
• all 7 project-analysis rules are native: circular-dependency, duplicate-jsx-subtree, unused-dependency, unused-dev-dependency, unused-export, unused-file, and unused-type
• all 857 in-scope behaviors are native-backed (100%); no retained rules remain unported
• newest native rules: effect-needs-cleanup, no-adjust-state-on-prop-change, no-create-object-url-without-revoke, no-hydration-branch-on-browser-global, no-reset-all-state-on-prop-change, no-side-effect-in-state-updater-function, rerender-state-only-in-handlers, rn-list-recyclable-without-types, server-auth-actions, and zustand-no-mutating-state
• latest main synchronization ports source-root-aware test-noise gating, bounded local-function resolution, type-only browser globals, flatMap message parity, nearest Fast Refresh workspace resolution, animation-aware transition durations, static member-hook recognition, React Native translation/static-tree handling, global String semantics, and effect disposer/observer ownership
• 2,537 exact AST fixture diagnostics
• retained security scanners preserve exact native-scan fixture parity
• 520,500 strict required-fire fuzz mutations
• newest ten-rule target corpus: 47 repositories, 1,273 matched diagnostics after one exact production-dedupe normalization, 0 differences
• last complete integrated AST target corpus: 47 repositories, 2,848 diagnostics, 0 differences
• integrated corpus retains the last confirmed 181,665 diagnostics across 47 repositories
• scope excludes all 49 non-retained Security rules, including Socket.IO/RPC/tool-capability concerns and executable static assets; retained security scope covers Supabase, SQL/NoSQL injection, and XSS/unsafe HTML; no Oxc fork is used
• native project analysis retains the canonical TypeScript graph/candidate construction and independent per-cohort fallback; the real binding passes the full core suite

Performance

• integrated clean-heavy p50: JavaScript 461.7 ms, native 54.6 ms, 88.2% faster
• integrated 50,000-finding p50: JavaScript 1,104.8 ms, native 448.9 ms, 59.4% faster
• rerender dependency/ref cohort clean-heavy p50: JavaScript 942.5 ms, native 83.4 ms, 91.2% faster
• rerender dependency/ref cohort finding-heavy p50: JavaScript 2,255.7 ms, native 641.9 ms, 71.5% faster
• eager state initializer cohort clean-heavy p50: JavaScript 961.0 ms, native 78.2 ms, 91.9% faster
• eager state initializer cohort finding-heavy p50: JavaScript 2,180.4 ms, native 638.2 ms, 70.7% faster
• combined 201-rule clean-heavy p50: JavaScript 933.3 ms, native 89.2 ms, 90.4% faster
• combined 201-rule finding-heavy p50: JavaScript 2,268.8 ms, native 657.0 ms, 71.0% faster
• combined 203-rule clean-heavy p50: JavaScript 957.2 ms, native 75.8 ms, 92.1% faster
• combined 203-rule finding-heavy p50: JavaScript 2,306.7 ms, native 640.8 ms, 72.2% faster
• combined 205-rule clean-heavy p50: JavaScript 959.6 ms, native 65.9 ms, 93.1% faster
• combined 205-rule finding-heavy p50: JavaScript 2,225.5 ms, native 648.2 ms, 70.9% faster
• combined 220-rule clean-heavy p50: JavaScript 959.9 ms, native 70.1 ms, 92.7% faster
• combined 220-rule finding-heavy p50: JavaScript 2,268.5 ms, native 646.3 ms, 71.5% faster
• no-event-handler cohort clean-heavy p50: JavaScript 958.3 ms, native 88.4 ms, 90.8% faster
• no-event-handler cohort finding-heavy p50: JavaScript 2,339.6 ms, native 664.0 ms, 71.6% faster
• combined Remotion asset cohort clean-heavy p50: JavaScript 995.3 ms, native 79.0 ms, 92.1% faster
• combined Remotion asset cohort finding-heavy p50: JavaScript 2,317.0 ms, native 637.6 ms, 72.5% faster
• combined React scope and complexity cohort clean-heavy p50: JavaScript 994.3 ms, native 74.7 ms, 92.5% faster
• combined React scope and complexity cohort finding-heavy p50: JavaScript 2,251.0 ms, native 637.9 ms, 71.7% faster
• combined 237-rule render/performance cohort clean-heavy p50: JavaScript 974.6 ms, native 75.8 ms, 92.2% faster
• combined 237-rule render/performance cohort finding-heavy p50: JavaScript 2,327.9 ms, native 634.2 ms, 72.8% faster

Validation

• memory-bounded Rust compile and release builds
• Mordant audits of the generated patched Oxc workspace; findings were limited to upstream code and expected generated utility copies
• exact fixture parity on the integrated branch
• production native-rule allowlist synchronized with the Rust build manifest
• source-patch utility import deduplication supports both LF and CRLF line endings
• targeted strict required-fire fuzzing for every newly ported rule
• latest main-sync cohort passed focused exact corpus parity with 13 diagnostics and 0 differences, plus 3,000 strict required-fire fuzz mutations
• newest ten-rule target corpus across 47 repositories with 0 diagnostic differences
• full tests, lint, typecheck, format, patch verification, and JSON smoke test
• Daytona PR parity remains pending because DAYTONA_API_KEY is not present in this environment

This PR remains draft with all retained rules native-backed.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@1664

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@1664

npm i https://pkg.pr.new/react-doctor@1664

commit: 0ce8d9b

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit 0ce8d9b.}

[github-actions]

Interactive terminal E2E

Terminal Control verified the built CLI at 0ce8d9b in a real PTY:

• selected a project interactively and observed Scanning... before the three-second Git delay completed
• waited for the clean result and exercised the compact report
• opened copy context and the GitHub Actions confirmation, then cancelled safely

Download the edited MP4 and PNG evidence