feat(cli): index minimized rule evidence with scores

[aidenybai]

Summary

• collect bounded, tokenized source patterns for React Doctor diagnostics
• replace identifier names and literal contents and omit comments, JSX text, regex contents, and file paths
• attach the optional, schema-versioned ruleEvidence field to the same request as the score
• keep the score-filtered diagnostic set and evidence set aligned
• limit evidence to 24 patterns per scan, 3 per rule, and 160 tokens per pattern
• honor --no-telemetry, which also skips the score API and share URL, and show a one-time interactive disclosure
• add the $reproer skill to turn evidence into synthetic, verified fuzz hypotheses without claiming source recovery
• accurately disclose that score submissions include scrubbed diagnostic paths, locations, messages, and help text; may include repository and commit metadata; and produce IP-address and user-agent service logs

Why

Rule counts show which diagnostics fire, but not enough context to diagnose false positives or false negatives. Identifier-redacted syntax patterns provide rule-quality evidence without collecting complete source files or data from third-party plugin findings.

Indexing the patterns with the score submission gives maintainers one source of truth for the diagnostic set, score, run metadata, and evidence. The companion score service validates and stores the optional field while remaining compatible with older clients.

The repro workflow preserves the minimization boundary: it invents neutral identifiers and values, prohibits source-identification searches by default, and promotes only verified synthetic cases into the fuzz corpus.

Companion score storage and legal documentation: https://github.com/millionco/doctor/pull/136

Validation

• nr test
• nr lint
• nr typecheck
• nr format:check
• nr smoke:json-report
• REACT_DOCTOR_NO_TELEMETRY=1 npx react-doctor@latest --verbose --scope changed (100/100, no findings)
• skill package validated with quick_validate.py

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@1626

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@1626

npm i https://pkg.pr.new/react-doctor@1626

commit: 11bb29d

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit 11bb29d.}

[github-actions]

Interactive terminal E2E

Terminal Control verified the built CLI at 11bb29d in a real PTY:

• selected a project interactively and observed Scanning... before the three-second Git delay completed
• waited for the clean result and exercised the compact report
• opened copy context and the GitHub Actions confirmation, then cancelled safely

Download the edited MP4 and PNG evidence

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 502d273. Configure here.}

[cursor]

Evidence collected when score disabled

Medium Severity

collectScoreEvidence is wired whenever rootSpan exists, but not when !options.noScore. In run-inspect, the callback runs while building the scoreService.compute argument, so it still executes under Score.layerOf(null). Config noScore (and other score-skipped paths with telemetry on) therefore reads source and emits rule.evidence_collected for patterns that never leave the process. Nearby resolveLocalGithubViewerPermission already gates on !options.noScore.

Additional Locations (1)

• packages/core/src/run-inspect.ts#L892-L893

 

^{Reviewed by Cursor Bugbot for commit 502d273. Configure here.}