refactor: reduce production dependency surface

[aidenybai]

Why

Before, the published CLI depended on @babel/code-frame and figures for a small subset of their behavior, while the private eval runner depended on p-limit for a basic FIFO concurrency cap. After, focused TypeScript implementations preserve those contracts with a smaller production dependency graph.

Development dependencies are intentionally unchanged. @astrojs/compiler remains because React Doctor uses its official Astro-to-TSX conversion and source maps before linting .astro files.

What changed

• render syntax-highlighted diagnostic code frames locally, including caret labels and bounded multi-line ranges
• provide the four terminal symbols used by the Ink UI with the same Unicode fallback behavior
• replace eval-runner p-limit usage with a tested FIFO concurrency limiter
• remove only @babel/code-frame, figures, and p-limit from production dependency declarations
• add a patch changeset for the published CLI implementation change

Eval results

Not run: this changes dependency implementations only and does not change rule detection behavior.

Test plan

• nr test — 15/15 tasks passed; React Doctor 2,454 tests passed
• FORCE_COLOR=1 nr test tests/build-code-frame.test.ts — 6/6 passed
• nr test:deslop — 525 deslop-js and 17 deslop-cli tests passed
• nr lint — passed with existing fuzz-corpus warnings only
• nr typecheck — 16/16 tasks passed
• nr format:check — passed
• nr check:published-deps — all five published packages passed
• nr smoke:json-report — passed
• nr smoke:packed-cli-install — passed with zero forbidden packages

---

Note

Low Risk
Dependency-trimming refactor with local replacements and coverage for code frames and concurrency. Main residual risk is subtle CLI rendering or eval scheduling differences versus the removed libraries.

Overview
Shrinks the production dependency surface by replacing three narrow helpers with local TypeScript implementations.

Published CLI (react-doctor): drops @babel/code-frame and figures. Diagnostic frames now go through local renderCodeFrame / highlightCodeLine, and Ink menus use a small terminalSymbols map with the same Unicode fallbacks.

Evals: drops p-limit in favor of a tested FIFO createConcurrencyLimit, wired through sandbox cleanup, attempt runners, and paired NDJSON writes.

Adds a patch changeset for the CLI change.

^{Reviewed by Cursor Bugbot for commit 4d3298a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@1632

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@1632

npm i https://pkg.pr.new/react-doctor@1632

commit: 4d3298a

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit 4d3298a.}

[github-actions]

Interactive terminal E2E

Terminal Control verified the built CLI at 4d3298a in a real PTY:

• selected a project interactively and observed Scanning... before the three-second Git delay completed
• waited for the clean result and exercised the compact report
• opened copy context and the GitHub Actions confirmation, then cancelled safely

Download the edited MP4 and PNG evidence