Verify the safe multi-framework TypeScript analyzer profile

[BleedingDev]

Question

Which pinned, safe, non-mutating analyzer profile can scan untrusted public TypeScript snapshots within the MVP deadline? Resolve the exact Ultracite/Oxlint core and React, Angular, Vue, Svelte, and Solid presets; whether Knip has a trustworthy static-only mode; the roles of the strictest TSConfig gap check, JSCPD, Zizmor, and OSV; each tool's JSON contract, license, telemetry, resource behavior, overlap, and applicability limits.

[BleedingDev]

Research dispatched.

• Branch: research/analyzer-profile
• Temporary worktree: /tmp/codebase-radar-research.O8qi1B/worktrees/analyzers
• Shared brief: /tmp/codebase-radar-research.O8qi1B/brief.md
• Primary report: /tmp/codebase-radar-research.O8qi1B/reports/analyzers.md
• Branch context pointer: docs/research/analyzer-profile.md

The branch is throwaway and will contain the report snapshot; implementation remains on main.

[BleedingDev]

Resolved by the analyzer-profile research branch.

Ship pinned Ultracite/Oxlint, a strictest-TSConfig comparator, JSCPD, offline Zizmor, and explicit-JavaScript-lockfile OSV as bounded direct subprocesses. React receives native enrichment and Vue limited script enrichment; Angular, Svelte, and Solid receive the universal TypeScript/JavaScript baseline without template-semantic claims. Defer Knip because its credible stock mode executes target JS/TS configurations and a hardened no-dependency mode is too incomplete for default prioritization.