feat: config foundation — extends, zod validation, concurrency, barrelAllowlist

[aidenybai]

First of a three-PR split of #286 ("Support mature-codebase adoption workflows natively"). This one lands the foundational config surface; the next two stack on top of it.

Why this PR exists

Three independent config knobs grouped on a shared zod-based validator. None of these change the scan execution path — they affect config loading, project orchestration, and one rule's allowlist.

What's in it

extends — config inheritance

{
  "extends": ["../../react-doctor.base.json"],
  "customRulesOnly": true
}

• One or more parent configs, string or string array. Each parent can itself extend further.
• Cycle and depth guards (max 16) keep pathological configs from hanging the loader.
• Semantics match tsconfig / eslint: later entries override earlier ones on scalar conflicts; arrays concat + dedupe; nested objects merge field-by-field; the current config always wins over anything it extends.
• Tests cover deep chains, missing parents, array concat, and cycle breakage through symlinked directories.

zod-based validation framework

Replaces ~280 lines of hand-rolled typeof === "..." / Array.isArray / isPlainObject checks in validate-config-types.ts with a declarative zod schema map.

• One FieldDescriptor entry per ReactDoctorConfig field ({ expectedDescription, schema }).
• One parseFieldOrWarn helper preserves the exact stderr message shape the existing --json mode and the 14 validate-config-types tests rely on (config field "X" must be …; ignoring this field).
• filteringArrayTransform higher-order helper unifies the drop-and-warn-but-keep-valid-siblings semantics across extends, barrelAllowlist, and the surface include/exclude lists.
• 8 boolean fields generated from a single array instead of being hand-spelled three times each.
• zod ^4 added as a dependency of @react-doctor/core.

concurrency — parallel runner

react-doctor . --concurrency 4

• --concurrency <n> CLI flag + top-level concurrency config field.
• Workspace projects scan in parallel via runWithConcurrency (output ordering preserved).
• Default 1; clamped to [1, 32].

barrelAllowlist — no-barrel-import allowlist

{
  "barrelAllowlist": ["packages/*/src/index.ts", "src/components/ui/index.ts"]
}

• Globs matched against the resolved barrel index file's project-relative path.
• The rule reads the list from plugin settings and skips reports against any matching barrel.
• Differs from ignore.overrides[].rules: this keys on the imported barrel path (one entry exempts every importer), whereas the override system keys on the importer (one entry per importer file).

Stats

• 20 new tests across extends-config, merge-configs, validate-config-types, matches-barrel-allowlist, and run-with-concurrency.
• All 1192 tests passing; lint / typecheck / format clean.

What's NOT in this PR

• Baseline mode — in stacked PR 2.
• Touched-line enforcement — in stacked PR 2.
• PR comment markdown / sticky comment integration — in stacked PR 3.
• action.yml knob additions for the new inputs — in stacked PRs 2/3.

Originally landed as part of #286; that PR is being closed in favor of this 3-way split.

  

[reactreview]

🔴 No new issues

0/100 (unchanged)

^{Reviewed by react-review for commit ebb1c04. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
react-doctor-website	Ready	Preview, Comment	May 17, 2026 0:13am

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e42aee0. Configure here.}