[aidenybai]

Why

Webhook scans could report handler names found only in generated-source prose, regular expressions, or template text. The warning could also point to that data instead of a later retained code match.

What changed

• Classify every existing match against bounded ASCII AST source positions. Discard proven data matches and report the first retained match.
• Preserve the complete legacy finding when parsing, source spans, or any match position are unsupported. Existing path/request/verification gates and single-token quoted-literal behavior remain intact.
• Inspect source spelling only for nodes that consume it, while validating every node span. Six cold-work regressions preserve findings and locations; no CPU speedup is claimed.
• Replace the mutation-pairing wall-clock assertion after its observed macOS CI failure with the reviewed deterministic regression checks. Detector behavior is unchanged by that test repair.
• Include two synthetic fuzz fixtures and a patch changeset.

Test plan

• Current head 25e5930c75: 111 focused tests passed. All seven local checks passed, including 34,137 tests with 1,118 skips, typecheck, lint, formatting, registry generation, a forced serial build, and JSON report smoke. Lint reported no warnings in the 11 changed paths.
• Strict fuzzing: 500 iterations, seed 42, target firing required; 512 executions, 13 fires, zero findings. Aggregate firing does not establish coverage of every new classifier branch.
• Built API and CLI scans each compared all 54 synthetic modules under target-only and default-plus-explicit-target profiles. Target warnings changed from 52 to 37: 22 whole findings removed and seven relocated findings added. The stable positive control and unrelated findings were preserved. The controlled React 18 host metadata and explicit opt-in are part of this evidence.
• Remote sample parity against the exact PR-base cache completed across 20 project roots in six repositories: 1,721 analyzed files and 3,308 whole diagnostics unchanged; zero additions, removals, or skipped projects. One candidate evaluator invocation reused the baseline without rerunning it. Existing evaluator retries for failed or incomplete jobs remain enabled.

The sample does not establish full-corpus parity, target activation in every sampled project, or a performance improvement. Synthetic API/CLI scans do not execute application or provider code.

When combining this with #2105, preserve the legacy empty-result guard, then Shopify suppression, then this classifier/fallback sequence. The overlap audit is source-only; no combined branch runtime is claimed.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@2107

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@2107

npm i https://pkg.pr.new/react-doctor@2107

commit: 25e5930

[github-actions]

Interactive terminal E2E

Terminal Control verified the built CLI at 25e5930 in a real PTY:

• selected a project interactively and observed Scanning... before the three-second Git delay completed
• waited for the clean result and exercised the compact report
• opened copy context and the GitHub Actions confirmation, then cancelled safely

Download the edited MP4 and PNG evidence