git:20260706.6203394 to git:20261006.d3c45b9

12 added, 71 removed. Audit A to A.

---

name: react-doctor

- description: Installs and runs Million's React Doctor to audit a React or Next.js codebase for performance, security, correctness, and architecture issues. Use when the user mentions react-doctor, React Doctor, millionco/react-doctor, performance audits, code health, bundle size, or suspicious React patterns.

+ description: Run Core's pinned local React Doctor audit after React or Next.js edits; fix actionable correctness, accessibility, composition, performance, and design findings and validate exact exceptions across all eight targets. Use when the user mentions React Doctor or requests React diagnostics or cleanup.

---

- # React Doctor (Million)

- Run an automated audit of a React/Next.js codebase and turn the diagnostics into a prioritized fix list.

- ## Quick Start

- In this repository, use the repo-owned first-party helper from the repo root:

- ```bash

- bun run react-doctor:first-party -- --full --offline --fail-on none

- ```

- The human guide is `docs/guides/development/react-doctor.md`. It is the source of truth for configured ignores, advisory `blocking` behavior, and PR wording.

- ## Workflow

- 1. Confirm you are at the project root (the directory containing `package.json`).

- 2. Read `docs/guides/development/react-doctor.md`.

- 3. Run the configured repo audit:

- - `bun run react-doctor:first-party -- --full --offline --fail-on none`

- 4. Convert the output into an actionable plan:

- - Capture the overall score (0-100).

- - List the top issues by severity (errors first).

- - For each issue, include the file path, what to change, and why it matters.

- 5. Fix issues starting with highest severity and highest leverage (security/correctness before perf polish).

- 6. Re-run the configured audit and confirm the result for `apps` and `packages`.

- 7. Report results honestly as the configured first-party audit. Do not imply that ignored rules were fixed.

- ## Next.js App Router Notes

- When triaging results for Next.js App Router projects, prioritize:

- - Async Client Components (often accidental `"use client"` leaks)

- - Client-side fetching for server-owned data (prefer Server Components / Route Handlers)

- - Missing or incorrect `metadata` exports

- - Server Actions without auth checks

- - Excessive client bundle growth (barrel imports, large dependencies)

- ## Expected Output

- When reporting results back, format as:

- ```markdown

- React Doctor score: <number>/100

- Top findings:

- - <severity> <short title> -- <path(s)>

- - ...

- Fix plan:

- 1. <most important fix> (why)

- 2. ...

- Verification:

- - bun run react-doctor:first-party -- --full --offline --fail-on none

- ```

+ # React Doctor in Core

- ## Triggers

+ Read `docs/guides/development/react-doctor.md` before auditing. It owns the commands, applicable-rule profile, generated boundaries, exact exception policy, and verification language.

- - User mentions react-doctor, React Doctor, or millionco/react-doctor

- - User asks for a React or Next.js audit covering performance, correctness, security, or architecture

- - User wants a focused code health pass on suspicious React patterns or bundle growth

+ 1. Inspect the owning source, tests, package/framework contracts, and nearest `AGENTS.md`. Preserve public APIs, Base UI/base-maia, financial and permission behavior, stable drafts, and existing View Transition owners.

+ 2. Run `bun run react-doctor:audit`. This uses React Doctor 0.9.17's public CLI on a disposable physical source copy. Read every target's JSON and stderr plus `actionable.json`; skipped checks or stale evidence are failures.

+ 3. Prioritize demonstrated correctness and accessibility defects, then bounded composition, design, and performance improvements. Add regression coverage before substantive behavior fixes and retain pending-focus, hydration, stale-response, and financial assertions.

+ 4. Review each suspected false positive against complete source and actual consumers. Record exact identities, reason, source/test evidence hashes, and a reconsideration condition in `docs/qa/react-doctor/exceptions.json`. Unknown or deferred debt remains actionable. Never add blanket rule ignores or manufacture a consumer.

+ 5. Run focused native checks after each batch and Chromium/axe where controls or layouts change. Use `bun run test:react-cleanup` for the isolated synthetic real-component suite; disclose its authenticated/provider limits.

+ 6. Finish with affected builds, formatting, workspace-aware lint/typecheck, `bunx --no-install vitest run --coverage --maxWorkers=4`, `bun run react-doctor:raw`, and `bun run react-doctor:check`. Acceptance is zero unexcepted warnings/errors across all eight completed targets with no skipped applicable checks.

+ 7. Report actual fix/exception counts, exclusions, test/build/browser results, and material limits. Leave work local and uncommitted unless publication is separately authorized.

- ## Checklist

+ Scoring, sharing, telemetry, and network-backed supply-chain checks remain disabled. Do not request a numeric score or call the result a dependency-security certification. The classic `react-in-jsx-scope` requirement is disabled in the applicable profile because Next.js uses automatic JSX; the raw inventory re-enables it for transparency. Never add unnecessary imports to satisfy that obsolete requirement.

- - [ ] Read `docs/guides/development/react-doctor.md`

- - [ ] `bun run react-doctor:first-party -- --full --offline --fail-on none`

- - [ ] Findings summarized with file paths

- - [ ] Fixes applied in severity order

- - [ ] Audit re-run and configured-audit score verified

- - [ ] Known ignores and advisory `blocking` behavior reported honestly

+ For interactive diagnostics only, `bun run react-doctor:first-party -- --full --offline --fail-on none` retains legacy argument compatibility. Its advisory exit status does not replace the strict check. No private scanner API is part of the permanent workflow.