@isentinel/eslint-config 6.0.0-beta.45 → 6.0.0-beta.46

package/README.md

@@ -255,8 +255,8 @@ Other behaviours:
   (see `FAST_FILES_PER_WORKER`) than the type-aware pass.
 - Keeps a separate ESLint cache per pass so they never invalidate one another:
   `.eslintcache-fast-<key>` (fast pass), `.eslintcache-typeaware-<key>`
-  (type-aware pass), and `.eslintcache-<key>` (the full single-pass config used
-  by `--fix`, CI and `--type-aware=full`). A change to an
+  (type-aware pass), and `.eslintcache-<key>` (the full config, used by CI,
+  `--type-aware=full` and the fix child below). A change to an
   ESLint/oxlint/Prettier/tsconfig file or a lockfile clears each cache that is
   actually older than that change; a change to the root `package.json`
   resolution surface (`exports`, `imports`, `main`, `module`, `types`,
@@ -281,16 +281,46 @@ Other behaviours:
   value naming that branch. It is folded into the key, giving those configs
   separate caches too.
 
-- Runs `--fix` sequentially (`oxlint --fix`, then `eslint --fix`) so two writers
-  never race on the same files.
+- Treats `--fix` as a check followed by a fix, in three steps. `oxlint --fix`
+  goes first and alone, since it rewrites the files the ESLint children are
+  about to read. The run's ESLint passes then run as ordinary **checks** —
+  concurrent, own caches, no writes. By default those are the fast and
+  type-aware passes — the single full pass in CI; an explicit `--type-aware`
+  checks whichever passes that mode selects instead (`full` the single full
+  pass, `only` the type-aware pass alone, `off` the fast pass alone). Finally
+  **one** ESLint child applies fixes to **only the files those checks had
+  messages about**, using the full config (a superset of every pass, so it can
+  fix anything any of them found).
+
+  When the checks report nothing, which is the common case, that last child
+  never spawns and `--fix` costs what a check run costs. Being the run's only
+  ESLint writer, it also cannot race anything.
+
+  The file list comes from the check passes' own caches: ESLint stores each
+  file's result beside its cache entry and replays it on a cache hit, so a warm
+  cache is that pass's whole-tree verdict — including for a pass that
+  auto-skipped, whose verdict stands precisely because nothing it cares about
+  changed. `--no-cache` leaves no verdict to read, so the fix child falls back
+  to linting everything it was given. A target outside the working directory is
+  invisible to the listing the verdict is read against, so it is handed to the
+  fix child as it stands, alongside the reported files; that child runs without
+  the cache, since a stale entry for a file no verdict covers would let ESLint
+  skip it.
+
 - Lets every child run to completion and returns non-zero if any failed — an
   ordinary lint error in one tool no longer kills the others mid-run.
 
 > **Unused eslint-disable directives.** The default two-pass mode does **not**
 > report unused `eslint-disable` directives: a directive naming a rule that
 > lives in the _other_ pass would look unused to the pass that runs it and
-> produce a false positive. `--fix`, CI and `--type-aware=full` runs use the
-> single full config and still report unused directives.
+> produce a false positive. CI and `--type-aware=full` runs use the single full
+> config and still report them.
+>
+> A local `--fix` inherits this from its checks. The fix child runs the full
+> config and would report an unused directive, but it only ever sees the files
+> the checks reported, and a file whose _only_ problem is an unused directive is
+> not one of them — so those directives survive a local fix run. In CI the check
+> is the full config, so they are reported and removed as before.
 
 ### Hybrid detection
 
@@ -317,7 +347,7 @@ Any trailing positional arguments are treated as paths to lint (default `.`).
 | ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------- |
 | `--eslint`                     | Run only ESLint.                                                                                                                   |
 | `--oxlint`                     | Run only oxlint.                                                                                                                   |
-| `--fix`                        | Apply fixes: `oxlint --fix` then `eslint --fix` (sequential).                                                                      |
+| `--fix`                        | Check as usual, then fix only the files the checks reported (one child).                                                           |
 | `--agents`, `--no-agents`      | Force agent-friendly output from both linters on or off (default: on in an agent session).                                         |
 | `--type-aware=off\|only\|full` | Force a single ESLint pass: `off` fast-only, `only` type-aware-only, `full` the whole config in one pass. Cannot mix with `--fix`. |
 | `--no-oxlint-type-aware`       | Skip oxlint's type-aware rules (no `oxlint-tsgolint` needed).                                                                      |

package/dist/cli.mjs

@@ -9,7 +9,7 @@ import path from "node:path";
 import { existsSync, readFileSync } from "fs";
 import { execSync } from "node:child_process";
 //#region package.json
-var version = "6.0.0-beta.45";
+var version = "6.0.0-beta.46";
 var package_default = {
 	name: "@isentinel/eslint-config",
 	version,
@@ -175,7 +175,7 @@ var package_default = {
 	},
 	peerDependencies: {
 		"@vitest/eslint-plugin": "^1.6.4",
-		"eslint": "^10.4.0",
+		"eslint": "^10.10.0",
 		"eslint-plugin-eslint-plugin": "^7.5.0",
 		"eslint-plugin-jest": "^29.15.0",
 		"eslint-plugin-jest-extended": "^3.0.0",
@@ -534,7 +534,7 @@ async function updateEslintFiles(result) {
 //#endregion
 //#region src/cli/constants-generated.ts
 const versionsMap = {
-	"eslint": "10.8.1",
+	"eslint": "10.10.0",
 	"eslint-plugin-jest": "29.16.0",
 	"eslint-plugin-react-jsx": "5.17.3",
 	"eslint-plugin-react-naming-convention": "5.17.3",

package/dist/index.d.mts

@@ -1510,7 +1510,9 @@ interface MainRuleDefaults {
     "*": "off";
   };
   "no-unmodified-loop-condition": {
-    "*": "error";
+    "*": ["error", {
+      "checkConditionalExpressions": false;
+    }];
   };
   "no-unneeded-ternary": {
     "*": ["error", {
@@ -6498,7 +6500,7 @@ interface OverrideSiteChains {
 type TestChain = [TestRuleDefaults, SourceFeatureRuleDefaults, MainRuleDefaults];
 type ValidateOptionsWith<O, VK extends VariantKey> = ValidateSite<O, "rules", MainChain, VK> & ValidateSubOptionsFromTable<O, OverrideSiteChains, VK> & ValidateTestOption<O, TestChain, VK>;
 //#endregion
-//#region ../../../setup-pnpm/node_modules/.bin/store/v11/links/@/eslint-config-flat-gitignore/2.3.0/0a594adbd94ca75e2950b1104992894d49bc93f4f2bc935ad192d7104e4c271e/node_modules/eslint-config-flat-gitignore/dist/index.d.mts
+//#region ../../../setup-pnpm/node_modules/.bin/store/v11/links/@/eslint-config-flat-gitignore/2.3.0/48bee61dfbd6416cb227d1c477eb8990bf234fa634e4ccd62a9520a90cc26602/node_modules/eslint-config-flat-gitignore/dist/index.d.mts
 interface FlatGitignoreOptions {
   /**
    * Name of the configuration.
@@ -9343,7 +9345,7 @@ interface RuleOptions {
    * Disallow unmodified loop conditions
    * @see https://eslint.org/docs/latest/rules/no-unmodified-loop-condition
    */
-  'no-unmodified-loop-condition'?: Linter.RuleEntry<[]>;
+  'no-unmodified-loop-condition'?: Linter.RuleEntry<NoUnmodifiedLoopCondition>;
   /**
    * Disallow ternary operators when simpler alternatives exist
    * @see https://eslint.org/docs/latest/rules/no-unneeded-ternary
@@ -19662,6 +19664,10 @@ type NoUnderscoreDangle = [] | [{
   allowInArrayDestructuring?: boolean;
   allowInObjectDestructuring?: boolean;
 }];
+// ----- no-unmodified-loop-condition -----
+type NoUnmodifiedLoopCondition = [] | [{
+  checkConditionalExpressions?: boolean;
+}];
 // ----- no-unneeded-ternary -----
 type NoUnneededTernary = [] | [{
   defaultAssignment?: boolean;

package/dist/index.mjs

@@ -1889,7 +1889,7 @@ async function flawless(options = {}, prettierOptions = {}) {
 	];
 }
 //#endregion
-//#region ../../../setup-pnpm/node_modules/.bin/store/v11/links/@eslint/compat/2.1.0/90f1da88f603538864cab10657b202d55290237a3b641df9ac72b842a3be07f2/node_modules/@eslint/compat/dist/esm/index.js
+//#region ../../../setup-pnpm/node_modules/.bin/store/v11/links/@eslint/compat/2.1.0/c5793be99df3f1294a68a791ed84f1ed609714ef294e5fa5fdeeff97455db3c8/node_modules/@eslint/compat/dist/esm/index.js
 /**
 * @fileoverview Ignore file utilities for the compat package.
 * @author Nicholas C. Zakas
@@ -1918,7 +1918,7 @@ function convertIgnorePatternToMinimatch(pattern) {
 }
 var init_esm$1 = __esmMin((() => {}));
 //#endregion
-//#region ../../../setup-pnpm/node_modules/.bin/store/v11/links/@/eslint-config-flat-gitignore/2.3.0/0a594adbd94ca75e2950b1104992894d49bc93f4f2bc935ad192d7104e4c271e/node_modules/eslint-config-flat-gitignore/dist/index.mjs
+//#region ../../../setup-pnpm/node_modules/.bin/store/v11/links/@/eslint-config-flat-gitignore/2.3.0/48bee61dfbd6416cb227d1c477eb8990bf234fa634e4ccd62a9520a90cc26602/node_modules/eslint-config-flat-gitignore/dist/index.mjs
 var dist_exports = /* @__PURE__ */ __exportAll$2({ default: () => ignore });
 function toArray(array) {
 	array = array ?? [];
@@ -6250,7 +6250,7 @@ async function unicorn({ complementIgnores, nameReplacements, roblox = true, roo
 	];
 }
 //#endregion
-//#region ../../../setup-pnpm/node_modules/.bin/store/v11/links/@/eslint-plugin-yml/3.5.0/a00fc88a04d0f2081267792f61f05ad4ceff0f52e1ff41acbbc866518b4fd9c1/node_modules/eslint-plugin-yml/lib/chunk-CfYAbeIz.mjs
+//#region ../../../setup-pnpm/node_modules/.bin/store/v11/links/@/eslint-plugin-yml/3.5.0/eedfb7e8cfd566a06319a5894d49f61723d6a8793c9b4a69e6556dd999563774/node_modules/eslint-plugin-yml/lib/chunk-CfYAbeIz.mjs
 var __defProp$1, __exportAll$1;
 var init_chunk_CfYAbeIz = __esmMin((() => {
 	__defProp$1 = Object.defineProperty;
@@ -9433,7 +9433,7 @@ var init_lib$1 = __esmMin((() => {
 	({ ...meta_exports$1 });
 }));
 //#endregion
-//#region ../../../setup-pnpm/node_modules/.bin/store/v11/links/@/eslint-plugin-yml/3.5.0/a00fc88a04d0f2081267792f61f05ad4ceff0f52e1ff41acbbc866518b4fd9c1/node_modules/eslint-plugin-yml/lib/index.mjs
+//#region ../../../setup-pnpm/node_modules/.bin/store/v11/links/@/eslint-plugin-yml/3.5.0/eedfb7e8cfd566a06319a5894d49f61723d6a8793c9b4a69e6556dd999563774/node_modules/eslint-plugin-yml/lib/index.mjs
 var lib_exports = /* @__PURE__ */ __exportAll$2({
 	configs: () => configs,
 	default: () => src_default,

package/dist/lint-cli.mjs

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
 import process$1 from "node:process";
-import { getPackageInfoSync, isPackageExists } from "local-pkg";
+import { isPackageExists } from "local-pkg";
 import yargs from "yargs";
 import "find-up-simple";
 import fs from "node:fs";
@@ -38,7 +38,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 }) : target, mod));
 //#endregion
 //#region package.json
-var version = "6.0.0-beta.45";
+var version = "6.0.0-beta.46";
 //#endregion
 //#region src/lint-cli/lib/cli/types.ts
 /**
@@ -315,7 +315,7 @@ function parseArguments(argv, environment = process$1.env) {
 		description: "Run only oxlint.",
 		type: "boolean"
 	}).option("fix", {
-		description: "Apply fixes (oxlint then ESLint).",
+		description: "Fix the files the checks reported.",
 		type: "boolean"
 	}).option("agents", {
 		description: "Agent-friendly output (default: on in an agent session).",
@@ -349,7 +349,7 @@ function parseArguments(argv, environment = process$1.env) {
 	const oxlintOnly = parsed.oxlint === true;
 	const { typeAware } = parsed;
 	const fix = parsed.fix === true;
-	if (fix && typeAware !== void 0) throw new CliError("Cannot combine --fix with --type-aware; --fix always uses the full config.");
+	if (fix && typeAware !== void 0) throw new CliError("Cannot combine --fix with --type-aware; the fix child always uses the full config.");
 	const eslintArgs = eslintExtract.value !== void 0 ? splitArgs(eslintExtract.value) : [];
 	const oxlintArgs = oxlintExtract.value !== void 0 ? splitArgs(oxlintExtract.value) : [];
 	const rawPassthrough = parsed["--"];
@@ -474,7 +474,157 @@ function resolveRunContext(cwd, environment, mutate) {
 	};
 }
 //#endregion
+//#region src/lint-cli/lib/state.ts
+/**
+* Directory (relative to the project root) where the CLI keeps its persisted
+* state. Lives under `node_modules/.cache` so it is discarded with the
+* dependency tree and never committed.
+*/
+const CACHE_DIRECTORY = path.join("node_modules", ".cache", "isentinel-lint");
+/**
+* The directory every state file lives in.
+*
+* @param cwd - The consumer project root.
+* @returns The absolute path to the runner's cache directory.
+*/
+function stateDirectory(cwd) {
+	return path.resolve(cwd, CACHE_DIRECTORY);
+}
+/**
+* Resolve one state file inside {@link stateDirectory}.
+*
+* @param cwd - The consumer project root.
+* @param name - The state's base name.
+* @param parts - Further hyphen-joined segments, usually the config-variant key
+*   from `resolveCacheKey`. State that is consumed once (a stored hash, a
+*   drained builder) must carry that key, or the first variant to run absorbs
+*   the change on behalf of all of them.
+* @returns The absolute path to the state file.
+*/
+function statePath(cwd, name, ...parts) {
+	return path.join(stateDirectory(cwd), [name, ...parts].join("-"));
+}
+/**
+* Read a UTF-8 file, or `undefined` when it cannot be read for any reason.
+* Shared by every tolerant read in the CLI: state files, and the config-import
+* closure walk.
+*
+* @param filePath - The file to read.
+* @returns The file's content, or `undefined`.
+*/
+function readFileIfPresent(filePath) {
+	try {
+		return fs.readFileSync(filePath, "utf8");
+	} catch {
+		return;
+	}
+}
+/**
+* Read a state file written by {@link writeState}. Every failure mode — the
+* file is missing, unreadable, malformed, or was written by another
+* {@link STATE_VERSION} — degrades to `undefined`, which every caller treats as
+* "unknown" and recomputes from.
+*
+* @template T - The shape this file's writer stores. Asserted, not checked:
+*   only the schema version is verified, exactly as the per-module casts this
+*   replaced did.
+* @param filePath - The state file, from {@link statePath}.
+* @returns The stored payload, or `undefined`.
+*/
+function readState(filePath) {
+	const raw = readFileIfPresent(filePath);
+	return raw === void 0 ? void 0 : parseState(raw);
+}
+/**
+* Persist a state payload, creating the cache directory as needed.
+*
+* The write is atomic (temp file plus rename), since `plan()` runs concurrently
+* across packages in a parallel per-package lint setup and a torn file would be
+* read back as "unknown" at best.
+*
+* Best-effort — a failed write leaves the state unknown, so the next run
+* recomputes rather than trusting something stale.
+*
+* @param filePath - The state file, from {@link statePath}.
+* @param data - The payload to store.
+*/
+function writeState(filePath, data) {
+	const content = `${JSON.stringify({
+		data,
+		version: 2
+	})}\n`;
+	const temporary = `${filePath}.${process$1.pid}.tmp`;
+	try {
+		fs.mkdirSync(path.dirname(filePath), { recursive: true });
+		fs.writeFileSync(temporary, content);
+		fs.renameSync(temporary, filePath);
+	} catch {
+		try {
+			fs.rmSync(temporary, { force: true });
+		} catch {}
+	}
+}
+/**
+* Compare a value against the stored one and replace it when they differ, the
+* compare-and-swap every hash-drift bust runs: the caller acts on the outcome
+* and never on the stored value itself.
+*
+* The value is consumed by the swap — once stored, every later run reads back
+* `"unchanged"` — which is why hash state is keyed per config variant.
+*
+* A stored value this {@link STATE_VERSION} cannot read counts as `"changed"`,
+* so a CLI upgrade invalidates rather than silently adopts what it finds.
+*
+* @param filePath - The state file, from {@link statePath}.
+* @param value - The value this run computed.
+* @returns How the stored value compared.
+*/
+function swapState(filePath, value) {
+	const raw = readFileIfPresent(filePath);
+	if ((raw === void 0 ? void 0 : parseState(raw)) === value) return "unchanged";
+	writeState(filePath, value);
+	return raw === void 0 ? "first" : "changed";
+}
+/**
+* Refresh a state file's mtime without rewriting it, so a reader comparing that
+* mtime against another file's still sees the state as fresh. Best-effort: a
+* missing file simply stays missing.
+*
+* @param filePath - The state file, from {@link statePath}.
+*/
+function touchState(filePath) {
+	try {
+		const now = Date.now() / 1e3;
+		fs.utimesSync(filePath, now, now);
+	} catch {}
+}
+/**
+* Parse one state file's content, or `undefined` when it is malformed or
+* carries another {@link STATE_VERSION}.
+*
+* @template T - The shape this file's writer stores (asserted, not checked).
+* @param raw - The file's content.
+* @returns The stored payload, or `undefined`.
+*/
+function parseState(raw) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null) return;
+	const envelope = parsed;
+	return envelope.version === 2 ? envelope.data : void 0;
+}
+//#endregion
 //#region src/lint-cli/lib/exec/resolve.ts
+/**
+* A synthetic basename for `createRequire`, which resolves relative to a file
+* rather than a directory. Spelled so it can never collide with a real consumer
+* module.
+*/
+const RESOLVE_ANCHOR = "__isentinel-lint__.js";
 /** Memoised {@link resolveLocalBin} results, keyed by `cwd\0name`. */
 const localBinCache = /* @__PURE__ */ new Map();
 /**
@@ -484,6 +634,10 @@ const localBinCache = /* @__PURE__ */ new Map();
 * Windows `.cmd`/`.ps1` quoting hazards. Memoised so the two ESLint passes
 * resolve the same bin once.
 *
+* The walk is Node's own rather than a hand-rolled one: inside a worktree
+* nested in its own checkout the two disagree, and taking the ancestor's copy
+* silently runs a different version of the linter than every other tool sees.
+*
 * @param name - The package name to resolve (for example `eslint`).
 * @param cwd - The directory to resolve from.
 * @returns The absolute path to the package's JavaScript entry.
@@ -492,12 +646,11 @@ function resolveLocalBin(name, cwd) {
 	const cacheKey = `${cwd}\0${name}`;
 	const cached = localBinCache.get(cacheKey);
 	if (cached !== void 0) return cached;
-	const info = getPackageInfoSync(name, { paths: [cwd] });
-	if (info === void 0) throw new CliError(`Could not find "${name}". Install it in this project to run isentinel-lint.`);
-	const { bin } = info.packageJson;
-	const relative = typeof bin === "string" ? bin : bin?.[name];
+	const manifestPath = resolveManifest(name, cwd);
+	if (manifestPath === void 0) throw new CliError(`Could not find "${name}". Install it in this project to run isentinel-lint.`);
+	const relative = readBinEntry(manifestPath, name);
 	if (relative === void 0) throw new CliError(`Package "${name}" does not declare a "${name}" bin entry.`);
-	const resolved = path.resolve(info.rootPath, relative);
+	const resolved = path.resolve(path.dirname(manifestPath), relative);
 	localBinCache.set(cacheKey, resolved);
 	return resolved;
 }
@@ -537,6 +690,50 @@ function resolveIgnoredHelper() {
 	const built = fileURLToPath(new URL("./lint-ignored.mjs", import.meta.url));
 	return fs.existsSync(built) ? built : fileURLToPath(new URL("../../ignored-child.ts", import.meta.url));
 }
+/**
+* The path a package's manifest declares as the bin of the package's own name,
+* relative to the package root. Both the shorthand string form and the map form
+* count.
+*
+* @param manifestPath - The absolute path to the package's `package.json`.
+* @param name - The bin name to look for.
+* @returns The declared relative path, or undefined when there is none.
+*/
+function readBinEntry(manifestPath, name) {
+	const raw = readFileIfPresent(manifestPath);
+	if (raw === void 0) return;
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return;
+	}
+	if (!isRecord(parsed)) return;
+	const { bin } = parsed;
+	if (typeof bin === "string") return bin;
+	const entry = isRecord(bin) ? bin[name] : void 0;
+	return typeof entry === "string" ? entry : void 0;
+}
+/**
+* Locate a package's manifest exactly as a `require` call from `cwd` would.
+*
+* Reads the manifest as a subpath, so a package whose `exports` map hides
+* `./package.json` counts as unresolvable. Both packages this serves publish
+* it, and one that does not could not be spawned from its `bin` field anyway.
+*
+* @param name - The package name to resolve.
+* @param cwd - The directory to resolve from.
+* @returns The absolute path to the package's `package.json`, or undefined when
+*   the package is not installed.
+*/
+function resolveManifest(name, cwd) {
+	const require = createRequire(path.join(cwd, RESOLVE_ANCHOR));
+	try {
+		return require.resolve(`${name}/package.json`);
+	} catch {
+		return;
+	}
+}
 //#endregion
 //#region src/lint-cli/lib/exec/shell.ts
 const SAFE_TOKEN = /^[\w@+=:,./-]+$/;
@@ -607,12 +804,13 @@ const PREFIX_COLOR = {
 /**
 * Run the composed children and aggregate their exit codes.
 *
-* Sequential when the caller asks for it — `--fix` must not have two children
-* writing the same files at once, and a lone child gains nothing from the
-* concurrently harness. Otherwise every child runs at once. Either way all of
-* them run to completion: an ordinary lint failure in one no longer kills its
-* siblings, so the user keeps every result. The returned code is non-zero when
-* any child exited non-zero.
+* Sequential when the caller asks for it: a lone child gains nothing from the
+* concurrently harness, and the writers of a `--fix` run (the oxlint child, and
+* later the one ESLint child that fixes) are each spawned on their own so
+* nothing is reading a file while one of them rewrites it. Otherwise every
+* child runs at once. Either way all of them run to completion: an ordinary
+* lint failure in one no longer kills its siblings, so the user keeps every
+* result. The returned code is non-zero when any child exited non-zero.
 *
 * @param commands - The child commands to run.
 * @param cwd - The working directory.
@@ -797,7 +995,7 @@ function composeEslintCommand(options, context) {
 	args.push("--no-warn-ignored", "--concurrency", String(context.concurrency));
 	if (options.cache && context.ci) args.push("--cache-strategy", "content");
 	if (options.agents) args.push("--format", context.agentsFormatterPath);
-	if (options.fix) args.push("--fix");
+	if (context.fix) args.push("--fix");
 	args.push(...options.eslintArgs, ...context.paths);
 	return {
 		args,
@@ -837,6 +1035,7 @@ function composePasses(passes, runPlan, options) {
 			ci: runPlan.ci,
 			concurrency: pass.concurrency,
 			eslintLabel: pass.descriptor.label,
+			fix: false,
 			paths: options.paths,
 			typeAwareEnv: pass.descriptor.typeAwareEnv
 		}));
@@ -871,150 +1070,6 @@ function compose(runPlan, options) {
 		notice: notices.length > 0 ? notices.join("") : void 0
 	};
 }
-//#endregion
-//#region src/lint-cli/lib/state.ts
-/**
-* Directory (relative to the project root) where the CLI keeps its persisted
-* state. Lives under `node_modules/.cache` so it is discarded with the
-* dependency tree and never committed.
-*/
-const CACHE_DIRECTORY = path.join("node_modules", ".cache", "isentinel-lint");
-/**
-* The directory every state file lives in.
-*
-* @param cwd - The consumer project root.
-* @returns The absolute path to the runner's cache directory.
-*/
-function stateDirectory(cwd) {
-	return path.resolve(cwd, CACHE_DIRECTORY);
-}
-/**
-* Resolve one state file inside {@link stateDirectory}.
-*
-* @param cwd - The consumer project root.
-* @param name - The state's base name.
-* @param parts - Further hyphen-joined segments, usually the config-variant key
-*   from `resolveCacheKey`. State that is consumed once (a stored hash, a
-*   drained builder) must carry that key, or the first variant to run absorbs
-*   the change on behalf of all of them.
-* @returns The absolute path to the state file.
-*/
-function statePath(cwd, name, ...parts) {
-	return path.join(stateDirectory(cwd), [name, ...parts].join("-"));
-}
-/**
-* Read a UTF-8 file, or `undefined` when it cannot be read for any reason.
-* Shared by every tolerant read in the CLI: state files, and the config-import
-* closure walk.
-*
-* @param filePath - The file to read.
-* @returns The file's content, or `undefined`.
-*/
-function readFileIfPresent(filePath) {
-	try {
-		return fs.readFileSync(filePath, "utf8");
-	} catch {
-		return;
-	}
-}
-/**
-* Read a state file written by {@link writeState}. Every failure mode — the
-* file is missing, unreadable, malformed, or was written by another
-* {@link STATE_VERSION} — degrades to `undefined`, which every caller treats as
-* "unknown" and recomputes from.
-*
-* @template T - The shape this file's writer stores. Asserted, not checked:
-*   only the schema version is verified, exactly as the per-module casts this
-*   replaced did.
-* @param filePath - The state file, from {@link statePath}.
-* @returns The stored payload, or `undefined`.
-*/
-function readState(filePath) {
-	const raw = readFileIfPresent(filePath);
-	return raw === void 0 ? void 0 : parseState(raw);
-}
-/**
-* Persist a state payload, creating the cache directory as needed.
-*
-* The write is atomic (temp file plus rename), since `plan()` runs concurrently
-* across packages in a parallel per-package lint setup and a torn file would be
-* read back as "unknown" at best.
-*
-* Best-effort — a failed write leaves the state unknown, so the next run
-* recomputes rather than trusting something stale.
-*
-* @param filePath - The state file, from {@link statePath}.
-* @param data - The payload to store.
-*/
-function writeState(filePath, data) {
-	const content = `${JSON.stringify({
-		data,
-		version: 2
-	})}\n`;
-	const temporary = `${filePath}.${process$1.pid}.tmp`;
-	try {
-		fs.mkdirSync(path.dirname(filePath), { recursive: true });
-		fs.writeFileSync(temporary, content);
-		fs.renameSync(temporary, filePath);
-	} catch {
-		try {
-			fs.rmSync(temporary, { force: true });
-		} catch {}
-	}
-}
-/**
-* Compare a value against the stored one and replace it when they differ, the
-* compare-and-swap every hash-drift bust runs: the caller acts on the outcome
-* and never on the stored value itself.
-*
-* The value is consumed by the swap — once stored, every later run reads back
-* `"unchanged"` — which is why hash state is keyed per config variant.
-*
-* A stored value this {@link STATE_VERSION} cannot read counts as `"changed"`,
-* so a CLI upgrade invalidates rather than silently adopts what it finds.
-*
-* @param filePath - The state file, from {@link statePath}.
-* @param value - The value this run computed.
-* @returns How the stored value compared.
-*/
-function swapState(filePath, value) {
-	const raw = readFileIfPresent(filePath);
-	if ((raw === void 0 ? void 0 : parseState(raw)) === value) return "unchanged";
-	writeState(filePath, value);
-	return raw === void 0 ? "first" : "changed";
-}
-/**
-* Refresh a state file's mtime without rewriting it, so a reader comparing that
-* mtime against another file's still sees the state as fresh. Best-effort: a
-* missing file simply stays missing.
-*
-* @param filePath - The state file, from {@link statePath}.
-*/
-function touchState(filePath) {
-	try {
-		const now = Date.now() / 1e3;
-		fs.utimesSync(filePath, now, now);
-	} catch {}
-}
-/**
-* Parse one state file's content, or `undefined` when it is malformed or
-* carries another {@link STATE_VERSION}.
-*
-* @template T - The shape this file's writer stores (asserted, not checked).
-* @param raw - The file's content.
-* @returns The stored payload, or `undefined`.
-*/
-function parseState(raw) {
-	let parsed;
-	try {
-		parsed = JSON.parse(raw);
-	} catch {
-		return;
-	}
-	if (typeof parsed !== "object" || parsed === null) return;
-	const envelope = parsed;
-	return envelope.version === 2 ? envelope.data : void 0;
-}
 /**
 * Base name of every ESLint cache file the runner manages. Each real file adds
 * a pass suffix and a config-variant key (see {@link cacheFileFor}), so this
@@ -1303,6 +1358,7 @@ function toPosix(value) {
 }
 //#endregion
 //#region src/lint-cli/lib/cache/entries.ts
+const CASE_INSENSITIVE_PLATFORMS = /* @__PURE__ */ new Set(["darwin", "win32"]);
 /**
 * Compute the newest modification time across the given files. Callers hash the
 * cache-bust set once per run and compare each pass's cache mtime against the
@@ -1359,22 +1415,32 @@ function sweepStaleCaches(cwd, newestBustMtimeMs) {
 	return removed;
 }
 /**
-* Normalize a path for cache-key comparison: absolute, forward-slash and
-* lower-cased. TypeScript emits forward-slash paths while ESLint keys the cache
-* with OS-native ones, and Windows paths are case-insensitive — this collapses
+* Normalize a path for cache-key comparison: absolute and forward-slash, plus
+* lower-cased where the platform's filesystem is case-insensitive. TypeScript
+* emits forward-slash paths while ESLint keys the cache with OS-native ones,
+* and Windows and macOS reach the same file under either case — this collapses
 * all of those into a single comparable form.
 *
+* Case survives everywhere else: on a case-sensitive filesystem `src/Foo.ts`
+* and `src/foo.ts` are two files with two cache entries, and folding them
+* together would let one shadow the other's verdict.
+*
 * @param filePath - The path to normalize.
+* @param platform - The platform whose filesystem the paths live on.
 * @returns The canonical key.
 */
-function normalizePath(filePath) {
-	return toPosix(path.resolve(filePath)).toLowerCase();
+function normalizePath(filePath, platform = process$1.platform) {
+	const resolved = toPosix(path.resolve(filePath));
+	return CASE_INSENSITIVE_PLATFORMS.has(platform) ? resolved.toLowerCase() : resolved;
 }
 /**
 * Open an ESLint cache for reuse, or `undefined` when the file is missing (the
-* caller then treats every target file as dirty). The returned handle backs
-* both {@link DirtyCache.getUpdatedFiles} and {@link DirtyCache.removeEntries}
-* so a pass parses the cache once instead of twice.
+* caller then treats every target file as dirty).
+*
+* The two reads share one parsed handle. The removal parses its own, because
+* asking a cache which files changed restamps every entry it looked at with
+* that file's current size and mtime: persisting that handle would hand ESLint
+* the previous run's results under a stamp saying they are current.
 *
 * @param cacheFilePath - The ESLint cache file to open.
 * @param useChecksum - Compare by content checksum instead of metadata.
@@ -1382,10 +1448,11 @@ function normalizePath(filePath) {
 */
 function openCache(cacheFilePath, useChecksum) {
 	if (!fs.existsSync(cacheFilePath)) return;
-	const cache = fileEntryCache.createFromFile(cacheFilePath, useChecksum);
+	const cache = load(cacheFilePath, useChecksum);
 	return {
+		filesWithMessages: (files) => filesWithMessagesIn(cache, files),
 		getUpdatedFiles: (files) => cache.getUpdatedFiles(files),
-		removeEntries: (files) => removeEntriesFrom(cache, files)
+		removeEntries: (files) => removeEntriesFrom(load(cacheFilePath, useChecksum), files)
 	};
 }
 function safeMtimeMs(filePath) {
@@ -1418,9 +1485,45 @@ function removeCacheFile(cacheFilePath) {
 		fs.rmSync(cacheFilePath, { force: true });
 	} catch {}
 }
-function removeEntriesFrom(cache, files) {
+/**
+* Load a cache file the way ESLint's own `LintResultCache` does. The two read
+* and write the same entries, and a reader whose change detection disagrees
+* with the writer's reports every file as dirty.
+*
+* @param cacheFilePath - The ESLint cache file to load.
+* @param useChecksum - Compare by content checksum instead of metadata.
+* @returns The loaded cache.
+*/
+function load(cacheFilePath, useChecksum) {
+	return fileEntryCache.createFromFile(cacheFilePath, {
+		useCheckSum: useChecksum,
+		useModifiedTime: !useChecksum
+	});
+}
+/**
+* Index a cache's entry keys by their normalized form, so a caller holding
+* paths from elsewhere — TypeScript's forward slashes, a git listing — can find
+* the entry ESLint wrote under an OS-native path.
+*
+* @param cache - The loaded cache to index.
+* @returns Normalized path to the key the cache stores it under.
+*/
+function keysByNormalizedPath(cache) {
 	const keyByNormalized = /* @__PURE__ */ new Map();
 	for (const key of cache.cache.keys()) keyByNormalized.set(normalizePath(key), key);
+	return keyByNormalized;
+}
+function filesWithMessagesIn(cache, files) {
+	const keyByNormalized = keysByNormalizedPath(cache);
+	return files.filter((file) => {
+		const key = keyByNormalized.get(normalizePath(file));
+		if (key === void 0) return false;
+		const messages = cache.cache.getKey(key)?.data?.results?.messages;
+		return messages !== void 0 && messages.length > 0;
+	});
+}
+function removeEntriesFrom(cache, files) {
+	const keyByNormalized = keysByNormalizedPath(cache);
 	let removed = 0;
 	for (const file of files) {
 		const key = keyByNormalized.get(normalizePath(file));
@@ -1429,7 +1532,7 @@ function removeEntriesFrom(cache, files) {
 			removed += 1;
 		}
 	}
-	if (removed > 0) cache.cache.save(true);
+	if (removed > 0) cache.cache.save();
 	return removed;
 }
 //#endregion
@@ -3699,7 +3802,9 @@ function collectRepoFiles(cwd, targets) {
 	const relatives = listFiles(cwd, ["."]);
 	const isBustFile = (0, import_picomatch.default)([...CACHE_BUST_PATTERNS], { dot: true });
 	const normalizedTargets = targets.map((target) => normalizeTarget(target, cwd));
-	const targetsOutsideCwd = normalizedTargets.some((target) => isOutsideCwd(target));
+	const outsideCwdTargets = targets.filter((target) => {
+		return isOutsideCwd(normalizeTarget(target, cwd));
+	});
 	const isWithinTargets = matchTargets(normalizedTargets);
 	const bustFiles = collectAncestorBustFiles(cwd);
 	const lintable = [];
@@ -3716,7 +3821,7 @@ function collectRepoFiles(cwd, targets) {
 		bustFiles,
 		configFiles: bustFiles.filter(isConfigEntryPoint),
 		lintable,
-		targetsOutsideCwd,
+		outsideCwdTargets,
 		typeAware
 	};
 }
@@ -3974,12 +4079,6 @@ function gitIgnoredTargets(cwd, targets) {
 * failure this feature cannot have.
 */
 /**
-* A synthetic basename for `createRequire`, which resolves relative to a file
-* rather than a directory. Spelled so it can never collide with a real consumer
-* module.
-*/
-const RESOLVE_ANCHOR = "__isentinel-lint__.js";
-/**
 * Resolve the ESLint the consumer's config will be linted with: their own,
 * resolved from `cwd`, falling back to the one resolvable from this file (the
 * hoisted peer dependency) when `cwd` has no `node_modules` of its own — the
@@ -4528,7 +4627,10 @@ const TYPED_PASS = {
 	typeAwareEnv: "only",
 	typeAwareOnly: true
 };
-/** The full-config pass (env unset, `.eslintcache`): CI, `--fix`, `=full`. */
+/**
+* The full-config pass (env unset, `.eslintcache`): CI, `=full`, and the child
+* a `--fix` run spawns over the files its checks reported (see `planFixChild`).
+*/
 const FULL_PASS = {
 	cacheFileBase: CACHE_FILE_DEFAULT,
 	filesPerWorker: (limits) => limits.filesPerWorker,
@@ -4539,19 +4641,23 @@ const FULL_PASS = {
 };
 /**
 * Select the ESLint passes for the resolved mode. An explicit `--type-aware`
-* always wins: `=full` (and `--fix`) collapse to the single full pass, while
-* `=off`/`=only` run their one pass even in CI. Only when no mode is given does
-* CI change the default — collapsing the concurrent two-pass split to one full
-* pass; a local default run keeps the split (the typed pass may later be
-* skipped). CI's `--cache-strategy content` is applied by the command composer
-* to whichever pass runs, independently of this selection.
+* always wins: `=full` collapses to the single full pass, while `=off`/`=only`
+* run their one pass even in CI. Only when no mode is given does CI change the
+* default — collapsing the concurrent two-pass split to one full pass; a local
+* default run keeps the split (the typed pass may later be skipped). CI's
+* `--cache-strategy content` is applied by the command composer to whichever
+* pass runs, independently of this selection.
+*
+* `--fix` selects nothing of its own. Its ESLint children are the same checks
+* any other run has, and the fix itself is one further child composed from what
+* they reported (see `planFixChild`), which is why the checks stay concurrent.
 *
 * @param options - The parsed CLI options.
 * @param ci - Whether the run is in CI.
 * @returns The pass descriptors to plan, in run order.
 */
 function selectPasses(options, ci) {
-	if (options.fix || options.typeAware === "full") return [FULL_PASS];
+	if (options.typeAware === "full") return [FULL_PASS];
 	if (options.typeAware === "off") return [FAST_PASS];
 	if (options.typeAware === "only") return [TYPED_PASS];
 	if (ci) return [FULL_PASS];
@@ -4571,6 +4677,94 @@ function maxWorkersFor(descriptor, limits) {
 	return descriptor.invalidation === "none" ? limits.maxWorkers : limits.typedMaxWorkers;
 }
 //#endregion
+//#region src/lint-cli/lib/plan/fix.ts
+/**
+* The files the check passes had a message about, in pass order and without
+* duplicates.
+*
+* Read out of each pass's own cache rather than out of its output. ESLint
+* stores the lint result beside every entry and replays it on a cache hit, so
+* the cache is the pass's whole-tree verdict whichever files it actually
+* re-linted this run — including for a pass that auto-skipped, whose verdict
+* stands precisely because nothing it cares about changed.
+*
+* Each pass only contributes the targets it lints: the type-aware pass never
+* sees the JSON and Markdown the fast pass covers.
+*
+* @param passes - The planned passes, run and auto-skipped alike.
+* @param run - The run context.
+* @param files - The lint-target lists to look the verdict up against.
+* @returns The reported files, empty when every pass came back clean.
+*/
+function collectFixTargets(passes, run, files) {
+	const targets = /* @__PURE__ */ new Set();
+	for (const pass of passes) {
+		const cache = openCache(path.resolve(run.cwd, pass.cacheFile), run.ci);
+		const candidates = pass.descriptor.typeAwareOnly ? files.typeAware : files.lintable;
+		const reported = cache?.filesWithMessages(candidates) ?? [];
+		for (const file of reported) targets.add(file);
+	}
+	return [...targets];
+}
+/**
+* Compose the one ESLint child a `--fix` run spawns after its checks, or
+* `undefined` when they reported nothing and there is nothing to fix.
+*
+* The child runs the full config — a superset of both check configs, so it can
+* fix anything either of them found — over only the reported files. Being one
+* child, it is also the run's only ESLint writer.
+*
+* Its cache entries for those files are dropped first. The full config's cache
+* gets none of the invalidation the check caches do (no builder runs against
+* it), so it can hold a stale clean entry for a file the checks have since
+* found a message on, and ESLint would skip the very file it was handed.
+*
+* The child's targets are the union of what the verdicts cover and what they
+* cannot. `--no-cache` records no verdict at all, so the whole run falls back
+* to its own paths — the whole tree, as a fix run always used to lint. An
+* out-of-cwd target is invisible to the cwd-relative listing the verdicts are
+* looked up against (see {@link RepoFiles.outsideCwdTargets}), so it is passed
+* through as it stands while every in-cwd file stays narrowed to what the
+* checks reported.
+*
+* A raw path names no file whose cache entry can be dropped, so a child
+* carrying one runs without the cache rather than risk a stale clean entry
+* making ESLint skip it. That costs only the write: the covered files' entries
+* have just been dropped, so the cache would have saved that child no linting
+* anyway.
+*
+* @param passes - The planned passes whose verdicts narrow the child.
+* @param run - The run context.
+* @param inputs - The lint-target lists, CLI options, limits and formatter path.
+* @returns The fix child, or `undefined` when nothing was reported.
+*/
+function planFixChild(passes, run, inputs) {
+	const { files, limits, options } = inputs;
+	const covered = options.cache ? collectFixTargets(passes, run, files) : [];
+	const uncovered = options.cache ? files.outsideCwdTargets : options.paths;
+	const targets = [...covered, ...uncovered];
+	if (targets.length === 0) return;
+	const cacheFile = cacheFileFor(CACHE_FILE_DEFAULT, run.key);
+	if (covered.length > 0) openCache(path.resolve(run.cwd, cacheFile), run.ci)?.removeEntries(covered);
+	return composeEslintCommand({
+		...options,
+		cache: options.cache && uncovered.length === 0
+	}, {
+		agentsFormatterPath: inputs.agentsFormatterPath,
+		cacheLocation: cacheFile,
+		ci: run.ci,
+		concurrency: options.concurrency ?? computeWorkerCount({
+			dirtyCount: targets.length,
+			filesPerWorker: limits.filesPerWorker,
+			maxWorkers: limits.typedMaxWorkers
+		}),
+		eslintLabel: FULL_PASS.label,
+		fix: true,
+		paths: targets,
+		typeAwareEnv: FULL_PASS.typeAwareEnv
+	});
+}
+//#endregion
 //#region src/lint-cli/lib/typescript/buildinfo.ts
 /**
 * Whether the program described by an existing `.tsbuildinfo` is exactly the
@@ -5405,7 +5599,7 @@ function passDirtyCount(descriptor, cacheFile, context) {
 function sizePass(descriptor, context) {
 	const cacheFile = cacheFileFor(descriptor.cacheFileBase, context.run.key);
 	const dirtyCount = passDirtyCount(descriptor, cacheFile, context);
-	const conservative = context.files.targetsOutsideCwd;
+	const conservative = context.files.outsideCwdTargets.length > 0;
 	const filesPerWorker = descriptor.filesPerWorker(context.limits, context.run.environment);
 	const maxWorkers = maxWorkersFor(descriptor, context.limits);
 	const sizingDirtyCount = conservative ? maxWorkers * filesPerWorker : dirtyCount;
@@ -5465,7 +5659,8 @@ function plan(options, run) {
 			passes: [],
 			targetsOutsideCwd: false
 		},
-		resolveDeferred: void 0
+		resolveDeferred: void 0,
+		resolveFixChild: void 0
 	};
 	const descriptors = selectPasses(options, ci);
 	const files = collectRepoFiles(cwd, options.paths);
@@ -5495,10 +5690,11 @@ function plan(options, run) {
 		newestBustMtime,
 		options
 	};
-	const staged = stageDescriptors(descriptors, options, run, {
+	const targetsOutsideCwd = files.outsideCwdTargets.length > 0;
+	const staged = stageDescriptors(descriptors, run, {
 		multiPass: inputs.multiPass,
-		oxlint: oxlintDecision.run,
-		targetsOutsideCwd: sizingFiles.targetsOutsideCwd
+		oxlint: oxlintDecision.run && !options.fix,
+		targetsOutsideCwd
 	});
 	return {
 		eager: {
@@ -5509,9 +5705,17 @@ function plan(options, run) {
 			oxlintReason: oxlintDecision.reason,
 			oxlintTypeAware,
 			passes: sizePasses(staged.eager, run, inputs),
-			targetsOutsideCwd: files.targetsOutsideCwd
+			targetsOutsideCwd
 		},
-		resolveDeferred: staged.deferred.length > 0 ? () => sizePasses(staged.deferred, run, inputs) : void 0
+		resolveDeferred: staged.deferred.length > 0 ? () => sizePasses(staged.deferred, run, inputs) : void 0,
+		resolveFixChild: mutate && options.fix ? (passes) => {
+			return planFixChild(passes, run, {
+				agentsFormatterPath,
+				files: sizingFiles,
+				limits,
+				options
+			});
+		} : void 0
 	};
 }
 function resolveOxlintTypeAware(options) {
@@ -5523,12 +5727,10 @@ function resolveOxlintTypeAware(options) {
 * runs the TypeScript builder is ever held back — that is the whole cost being
 * moved off the critical path.
 *
-* Everything else stays eager, and four cases opt out of staging entirely:
+* Everything else stays eager, and three cases opt out of staging entirely:
 *
 * - `--print` (`mutate` false) runs no builder anyway and must stay one pure
 *   snapshot printed in a single go;
-* - `--fix` runs its children one at a time, so a later spawn buys nothing and
-*   there is no reason to reopen the write race the sequential path prevents;
 * - a run with no eager child at all, where holding the builder-backed pass
 *   back would only delay the whole run;
 * - a run whose one eager child could end up alone, because the type-aware pass
@@ -5537,19 +5739,18 @@ function resolveOxlintTypeAware(options) {
 *   prefixed, piped harness for no gain.
 *
 * @param descriptors - The selected passes, in run order.
-* @param options - The parsed CLI options.
 * @param run - The run context.
 * @param staging - The oxlint decision and the auto-skip inputs.
 * @returns The two stages, each in run order.
 */
-function stageDescriptors(descriptors, options, run, staging) {
+function stageDescriptors(descriptors, run, staging) {
 	const eager = descriptors.filter((descriptor) => descriptor.invalidation === "none");
 	const deferred = descriptors.filter((descriptor) => descriptor.invalidation !== "none");
 	const unstaged = {
 		deferred: [],
 		eager: descriptors
 	};
-	if (!run.mutate || options.fix || deferred.length === 0) return unstaged;
+	if (!run.mutate || deferred.length === 0) return unstaged;
 	const eagerChildren = (staging.oxlint ? 1 : 0) + eager.length;
 	const mayAutoSkip = staging.multiPass && !staging.targetsOutsideCwd;
 	if (eagerChildren === 0 || eagerChildren === 1 && mayAutoSkip) return unstaged;
@@ -5579,13 +5780,47 @@ async function runLint(argv, cwd = process$1.cwd(), environment = process$1.env)
 	}
 	if (commands.some((command) => command.bin === "oxlint" && command.args.includes("--type-aware")) && !isPackageExists("oxlint-tsgolint", { paths: [cwd] })) throw new CliError("oxlint-tsgolint is not installed, so oxlint cannot run type-aware rules. Install oxlint-tsgolint, or pass --no-oxlint-type-aware to skip type-aware linting.");
 	if (notice !== void 0) process$1.stderr.write(notice);
+	const { resolveFixChild } = staged;
+	if (resolveFixChild === void 0) return (await runChecks(commands, cwd, staged, options)).code;
+	const byBin = Object.groupBy(commands, (command) => command.bin);
+	const oxlintCode = await execute(byBin.oxlint ?? [], cwd, true);
+	const checks = await runChecks(byBin.eslint ?? [], cwd, staged, options);
+	const fixChild = resolveFixChild(checks.passes);
+	if (fixChild === void 0) return oxlintCode || checks.code;
+	return oxlintCode || await execute([fixChild], cwd, true);
+}
+/**
+* Run a run's ESLint check children and report which passes they covered.
+*
+* A staged run is concurrent by construction (the planner only stages when at
+* least one other child is already linting). Its type-aware pass is planned —
+* TypeScript builder and all — only once the children above are running, and
+* its notice is emitted as soon as it is known rather than held to the end of
+* the run.
+*
+* @param commands - The composed check children.
+* @param cwd - The working directory.
+* @param staged - The staged plan the commands came from.
+* @param options - The parsed CLI options.
+* @returns The aggregated exit code and every pass that was planned.
+*/
+async function runChecks(commands, cwd, staged, options) {
+	const passes = [...staged.eager.passes];
 	const { resolveDeferred } = staged;
-	if (resolveDeferred === void 0) return execute(commands, cwd, options.fix || commands.length <= 1);
-	return executeStaged(commands, cwd, () => {
-		const later = composePasses(resolveDeferred(), staged.eager, options);
-		if (later.notice !== void 0) process$1.stderr.write(later.notice);
-		return later.commands;
-	});
+	if (resolveDeferred === void 0) return {
+		code: await execute(commands, cwd, commands.length <= 1),
+		passes
+	};
+	return {
+		code: await executeStaged(commands, cwd, () => {
+			const deferred = resolveDeferred();
+			passes.push(...deferred);
+			const later = composePasses(deferred, staged.eager, options);
+			if (later.notice !== void 0) process$1.stderr.write(later.notice);
+			return later.commands;
+		}),
+		passes
+	};
 }
 //#endregion
 //#region src/lint-cli/index.ts
@@ -5597,7 +5832,8 @@ files actually need re-linting and managing per-mode caches.
 Flags:
   --eslint                 Run only ESLint.
   --oxlint                 Run only oxlint.
-  --fix                    Apply fixes: oxlint --fix then eslint --fix.
+  --fix                    Check as usual, then fix only the files the checks
+                           reported, in one further ESLint child.
   --agents, --no-agents    Emit agent-friendly output. On by default when an AI
                            agent session is detected (AI_AGENT, CLAUDECODE, ...).
   --type-aware=off|only|full

package/dist/lint-ignored.mjs

@@ -29,6 +29,14 @@ function isStringArray(value) {
 	return Array.isArray(value) && value.every((item) => typeof item === "string");
 }
 //#endregion
+//#region src/lint-cli/lib/exec/resolve.ts
+/**
+* A synthetic basename for `createRequire`, which resolves relative to a file
+* rather than a directory. Spelled so it can never collide with a real consumer
+* module.
+*/
+const RESOLVE_ANCHOR = "__isentinel-lint__.js";
+//#endregion
 //#region src/lint-cli/lib/exec/eslint-install.ts
 /**
 * Locating the ESLint installation a run's config is resolved against.
@@ -41,12 +49,6 @@ function isStringArray(value) {
 * failure this feature cannot have.
 */
 /**
-* A synthetic basename for `createRequire`, which resolves relative to a file
-* rather than a directory. Spelled so it can never collide with a real consumer
-* module.
-*/
-const RESOLVE_ANCHOR = "__isentinel-lint__.js";
-/**
 * Resolve the ESLint the consumer's config will be linted with: their own,
 * resolved from `cwd`, falling back to the one resolvable from this file (the
 * hoisted peer dependency) when `cwd` has no `node_modules` of its own — the

package/dist/oxlint.d.mts

@@ -6660,7 +6660,7 @@ interface RuleOptions {
    * Disallow unmodified loop conditions
    * @see https://eslint.org/docs/latest/rules/no-unmodified-loop-condition
    */
-  'no-unmodified-loop-condition'?: Linter.RuleEntry<[]>;
+  'no-unmodified-loop-condition'?: Linter.RuleEntry<NoUnmodifiedLoopCondition>;
   /**
    * Disallow ternary operators when simpler alternatives exist
    * @see https://eslint.org/docs/latest/rules/no-unneeded-ternary
@@ -16979,6 +16979,10 @@ type NoUnderscoreDangle = [] | [{
   allowInArrayDestructuring?: boolean;
   allowInObjectDestructuring?: boolean;
 }];
+// ----- no-unmodified-loop-condition -----
+type NoUnmodifiedLoopCondition = [] | [{
+  checkConditionalExpressions?: boolean;
+}];
 // ----- no-unneeded-ternary -----
 type NoUnneededTernary = [] | [{
   defaultAssignment?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isentinel/eslint-config",
-  "version": "6.0.0-beta.45",
+  "version": "6.0.0-beta.46",
   "description": "iSentinel's ESLint config",
   "keywords": [
     "eslint-config",
@@ -122,7 +122,7 @@
     "@types/yargs": "17.0.35",
     "@vitest/eslint-plugin": "1.6.26",
     "bumpp": "12.0.0",
-    "eslint": "10.8.1",
+    "eslint": "10.10.0",
     "eslint-plugin-erasable-syntax-only": "0.4.2",
     "eslint-plugin-eslint-plugin": "7.5.0",
     "eslint-plugin-jest": "29.16.0",
@@ -145,11 +145,11 @@
     "typescript": "6.0.3",
     "unplugin-unused": "0.5.7",
     "vitest": "4.1.10",
-    "@isentinel/eslint-config": "6.0.0-beta.45"
+    "@isentinel/eslint-config": "6.0.0-beta.46"
   },
   "peerDependencies": {
     "@vitest/eslint-plugin": "^1.6.4",
-    "eslint": "^10.4.0",
+    "eslint": "^10.10.0",
     "eslint-plugin-eslint-plugin": "^7.5.0",
     "eslint-plugin-jest": "^29.15.0",
     "eslint-plugin-jest-extended": "^3.0.0",