fix(core): scope React subproject discovery to skip app-data dirs and bound depth

[aidenybai]

Fixes #545.

Root cause

Running npx react-doctor from a home directory (no package.json / workspace manifest in cwd) falls through to discoverReactSubprojectsByFilesystem, which recursively walks the entire home tree with no depth bound and only prunes dotfiles + build artifacts (IGNORED_DIRECTORIES). It therefore descends ~9 levels into editor internals like AppData\Local\Programs\Microsoft VS Code\…\extensions\copilot, whose package.json declares a React dependency (hasReactDependency matches any of react/react-native/next/preact). Combined with the user's real Downloads projects, that yielded 4 candidates, and resolveDiagnoseTarget throws AmbiguousProjectError — aborting the run with Multiple React projects found.

Fix

In the filesystem-fallback crawl (packages/core/src/project-info/discover-react-subprojects.ts):

• Skip OS/editor app-data directories — AppData, Application Data, Library. This prunes the VS Code extension branch (and similar vendored installs) at the top level. The reported false positive lived under AppData.
• Bound the crawl depth (MAX_SCAN_DEPTH = 6) as a backstop against pathological vendored trees that escape the name list. Projects discovered via the filesystem fallback realistically sit only a few levels down.

Both guards apply only to the filesystem fallback (used when the scan root has no manifest); manifest/workspace resolution is unchanged, and the shared IGNORED_DIRECTORIES set is untouched so in-project source scans are unaffected.

Tests

Added two cases to discover-project.test.ts:

• A home-directory layout with a React package vendored under AppData/.../extensions/copilot plus a real Downloads/.../frontend — only the real project is returned (direct CLI error: Multiple React projects found under C:\Users\Admin (4 candidates): AppData\Local\Programs\Microsoft VS Code\f6cfa2ea24\resources\app\extensions\copilot, Downloads\Agna_Resumo_Clickup\frontend, Downloads\BuildScraper\docs-portal, Downloads\BuildS #545 repro).
• A React package nested past MAX_SCAN_DEPTH is not discovered.

All 73 tests in discover-project.test.ts pass; typecheck clean.

---

Note

Low Risk
Discovery-only change in the filesystem fallback path; workspace/manifest resolution is untouched, with targeted tests for the new guards.

Overview
Fixes #545 by tightening the filesystem-only React subproject crawl used when the scan root has no package.json or workspace manifest.

The recursive walk now skips OS/editor app-data directory names (AppData, Application Data, Library) so vendored React packages inside editor installs are not counted as user projects. It also caps descent at depth 6 so deeply nested vendored trees are not discovered. Manifest-based workspace discovery is unchanged.

Tests cover a home-directory layout with a fake VS Code extension under AppData plus a real app under Downloads, and a React package beyond the depth limit.

^{Reviewed by Cursor Bugbot for commit a417849. Bugbot is set up for automated code reviews on this repo. Configure here.}