@isentinel/eslint-config 6.0.0 → 6.0.1

package/README.md

@@ -230,8 +230,8 @@ It resolves the `eslint` and `oxlint` binaries from your project's
 
 By default (a local run, no `--type-aware`, no `--fix`) it runs **three**
 children concurrently via
-[`concurrently`](https://www.npmjs.com/package/concurrently), grouping their
-output:
+[`concurrently`](https://www.npmjs.com/package/concurrently)'s core (no shell),
+grouping their output:
 
 - **oxlint** — the full oxlint pass (including its type-aware rules).
 - **fast pass** — ESLint with only the syntactic (non-type-aware) rules, over
@@ -341,6 +341,32 @@ determined it fails open and runs both engines as before. Explicit `--eslint` /
 
 Any trailing positional arguments are treated as paths to lint (default `.`).
 
+### Large file selections
+
+A git hook that hands the runner thousands of files should not put them on a
+command line: `cmd.exe` stops at 8,191 characters and `CreateProcessW` at
+32,767, so tools end up splitting the list into batches that each start another
+lint stack. Pass the list as data instead:
+
+```bash
+git diff --cached --name-only -z --relative --diff-filter=ACMR | isentinel-lint --files0-from -
+```
+
+`--files0-from <file|->` reads NUL-terminated UTF-8 paths from a file, or from
+stdin for `-` (the `git -z` / `find -print0` shape). Relative entries resolve
+against the working directory, exactly like positional paths (hence `--relative`
+above when running from a sub-package). The paths go through the same planning,
+caching and type-aware skip as positional ones, in one run. An empty list lints
+nothing and exits 0 — it never falls back to `.`. A list that is not valid UTF-8
+or holds an empty entry is refused, as is combining the flag with positional
+paths.
+
+The runner never puts paths on a command line itself either: every oxlint and
+ESLint child is launched as `node <bootstrap> <engine bin>` with no shell, and
+its full argument list is streamed to it over stdin. As a consequence ESLint's
+own `--stdin` / `--stdin-filename` cannot be forwarded through `--eslint-args`
+or `--`.
+
 ### Flags
 
 | Flag                           | Description                                                                                                                        |
@@ -355,6 +381,7 @@ Any trailing positional arguments are treated as paths to lint (default `.`).
 | `--concurrency <n\|off>`       | Override the concurrency heuristic with a fixed worker count.                                                                      |
 | `--eslint-args "<args>"`       | Extra arguments forwarded verbatim to ESLint.                                                                                      |
 | `--oxlint-args "<args>"`       | Extra arguments forwarded verbatim to oxlint.                                                                                      |
+| `--files0-from <file\|->`      | Read the paths to lint from a NUL-delimited UTF-8 list (`-` for stdin); an empty list exits 0.                                     |
 | `--print`                      | Print the composed commands without running them.                                                                                  |
 | `-- <args>`                    | Forward args to the single selected tool (needs `--eslint`/`--oxlint`).                                                            |
 | `-h`, `--help`                 | Show help.                                                                                                                         |

package/dist/cli.mjs

@@ -9,7 +9,7 @@ import path from "node:path";
 import { existsSync, readFileSync } from "fs";
 import { execSync } from "node:child_process";
 //#region package.json
-var version = "6.0.0";
+var version = "6.0.1";
 var package_default = {
 	name: "@isentinel/eslint-config",
 	version,

package/dist/lint-bootstrap.d.mts

@@ -0,0 +1 @@
+export {}

package/dist/lint-bootstrap.mjs

@@ -0,0 +1,98 @@
+import { Buffer } from "node:buffer";
+import process from "node:process";
+import { pathToFileURL } from "node:url";
+//#region src/lint-cli/bootstrap.ts
+/**
+* Engine bootstrap for the lint runner. Spawned as
+* `node <this file> <engine bin>` with the engine's complete argument list as a
+* JSON string array on stdin; it decodes that list, installs it as
+* `process.argv` and then loads the engine's own bin in this same process.
+*
+* It exists to keep file lists off OS command lines: a hook selecting thousands
+* of files would otherwise overflow `CreateProcessW` (32,767 chars) or cmd.exe
+* (8,191) and have to be split into batches, each one starting another lint
+* stack. The command line that launches this process has the same two
+* arguments however many files the run lints.
+*
+* Kept free of imports beyond Node's own so it loads in milliseconds and
+* nothing it pulls in can observe the placeholder `process.argv`.
+*/
+/** The exit code for a launch this bootstrap could not complete. */
+const BOOTSTRAP_FAILURE = 2;
+/**
+* Read stdin to its end. Asynchronous rather than `readFileSync(0)`, which can
+* fail with `EAGAIN` on a non-blocking pipe before the writer has finished.
+*
+* @returns The bytes stdin carried.
+*/
+async function readStdin() {
+	const chunks = [];
+	for await (const chunk of process.stdin) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk), "utf8"));
+	return Buffer.concat(chunks);
+}
+/**
+* Whether a decoded payload is an array of strings. Restated rather than
+* imported from the package's guards, so this entry stays dependency-free.
+*
+* @param value - The decoded payload.
+* @returns Whether every element is a string.
+*/
+function isStringArray(value) {
+	return Array.isArray(value) && value.every((element) => typeof element === "string");
+}
+/**
+* Decode the engine argument list the runner streamed in.
+*
+* @param bytes - The raw stdin payload.
+* @returns The arguments, verbatim.
+*/
+function decodeArguments(bytes) {
+	const decoder = new TextDecoder("utf-8", { fatal: true });
+	const parsed = JSON.parse(decoder.decode(bytes));
+	if (!isStringArray(parsed)) throw new TypeError("expected a JSON array of argument strings on stdin");
+	return parsed;
+}
+/**
+* Read and validate everything the launch needs. Only this phase is the
+* bootstrap's own: its failures are reported as such and exit 2.
+*
+* @returns The launch.
+* @rejects {Error} When the usage, stdin or argument payload is invalid.
+*/
+async function prepare() {
+	const [bin, ...extra] = process.argv.slice(2);
+	if (bin === void 0 || bin.length === 0 || extra.length > 0) throw new Error("usage: node bootstrap <engine bin> (arguments as JSON on stdin)");
+	return {
+		args: decodeArguments(await readStdin()),
+		bin
+	};
+}
+/**
+* Prepare the launch, then become the engine.
+*
+* The engine import stays outside the catch around {@link prepare}: its
+* failures are left to Node's default handling, so they surface (stack and
+* exit code included) exactly as they would from a direct `node <bin>` launch.
+*
+* @rejects {Error} Whatever the engine's own module evaluation throws.
+*/
+async function main() {
+	let launch;
+	try {
+		launch = await prepare();
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		process.stderr.write(`isentinel-lint: could not start the engine: ${message}\n`);
+		process.exitCode = BOOTSTRAP_FAILURE;
+		return;
+	}
+	process.argv = [
+		process.execPath,
+		launch.bin,
+		...launch.args
+	];
+	await import(pathToFileURL(launch.bin).href);
+}
+main();
+//#endregion
+export {};

package/dist/lint-cli.mjs

@@ -1,18 +1,20 @@
 import { createRequire } from "node:module";
 import process$1 from "node:process";
 import { isPackageExists } from "local-pkg";
+import { Buffer as Buffer$1 } from "node:buffer";
+import fs from "node:fs/promises";
+import path from "node:path";
 import yargs from "yargs";
 import "find-up-simple";
-import fs from "node:fs";
-import path from "node:path";
+import fs$1 from "node:fs";
 import "semver";
 import crypto from "node:crypto";
 import ansis from "ansis";
-import concurrently from "concurrently";
+import { KillOnSignal, LogError, LogExit, LogOutput, Logger, createConcurrently } from "concurrently";
 import { execFileSync, spawn, spawnSync } from "node:child_process";
+import os, { availableParallelism } from "node:os";
 import { Writable } from "node:stream";
 import { fileURLToPath } from "node:url";
-import os, { availableParallelism } from "node:os";
 import fileEntryCache from "file-entry-cache";
 //#region \0rolldown/runtime.js
 var __create = Object.create;
@@ -38,7 +40,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 }) : target, mod));
 //#endregion
 //#region package.json
-var version = "6.0.0";
+var version = "6.0.1";
 //#endregion
 //#region src/lint-cli/lib/cli/types.ts
 /**
@@ -48,6 +50,78 @@ var version = "6.0.0";
 var CliError = class extends Error {
 	name = "CliError";
 };
+//#endregion
+//#region src/lint-cli/lib/cli/file-list.ts
+/** The `--files0-from` value that names stdin rather than a file. */
+const STDIN_SOURCE = "-";
+/**
+* Split a NUL-delimited, UTF-8 path list (the `git ls-files -z` / `find
+* -print0` shape) into its paths.
+*
+* Every path is terminated by a NUL, though the last terminator may be left off
+* as GNU's own `--files0-from` allows. Nothing else is interpreted: spaces,
+* newlines, quotes, shell metacharacters and leading hyphens all stay part of
+* the name. The bytes must be valid UTF-8 — a lossy decode would lint a file
+* that is not the one selected — and no entry may be empty, since an empty
+* path is never a file and most likely a broken producer.
+*
+* @param bytes - The raw list.
+* @returns The paths, in list order. Empty for an empty list.
+*/
+function decodeFileList(bytes) {
+	const decoder = new TextDecoder("utf-8", {
+		fatal: true,
+		ignoreBOM: true
+	});
+	let text;
+	try {
+		text = decoder.decode(bytes);
+	} catch {
+		throw new CliError("--files0-from: the file list is not valid UTF-8.");
+	}
+	if (text.length === 0) return [];
+	const entries = text.split("\0");
+	if (entries.at(-1) === "") entries.pop();
+	const empty = entries.indexOf("");
+	if (empty !== -1) throw new CliError(`--files0-from: entry ${empty + 1} of the file list is empty; expected NUL-terminated paths.`);
+	return entries;
+}
+/**
+* Fill the run's paths from its `--files0-from` list, reading it once. Options
+* without a list are returned as they are.
+*
+* An empty list stays empty: the caller treats it as nothing to lint, and it
+* must never become the whole-tree default `.`.
+*
+* @param options - The parsed CLI options.
+* @param cwd - The directory a relative list path resolves against.
+* @param stdin - The stream `-` reads.
+* @returns The options with `paths` set from the list.
+* @rejects {CliError} When the list cannot be read or is malformed.
+*/
+async function readFileList(options, cwd, stdin) {
+	const source = options.filesFrom;
+	if (source === void 0) return options;
+	const bytes = source === STDIN_SOURCE ? await readAll(stdin) : await readFile(source, cwd);
+	return {
+		...options,
+		paths: decodeFileList(bytes)
+	};
+}
+async function readFile(source, cwd) {
+	try {
+		return await fs.readFile(path.resolve(cwd, source));
+	} catch (err) {
+		throw new CliError(`--files0-from: cannot read "${source}": ${err instanceof Error ? err.message : String(err)}`);
+	}
+}
+async function readAll(stream) {
+	const chunks = [];
+	for await (const chunk of stream) if (typeof chunk === "string") chunks.push(Buffer$1.from(chunk, "utf8"));
+	else if (chunk instanceof Uint8Array) chunks.push(Buffer$1.from(chunk));
+	else throw new CliError("--files0-from: stdin produced a non-byte chunk.");
+	return Buffer$1.concat(chunks);
+}
 /**
 * The real TS/JS-family file extensions {@link GLOB_SRC_EXT} encodes (the glob
 * additionally matches non-existent combinations such as `cjsx`). Kept next to
@@ -288,6 +362,13 @@ function splitArgs(input) {
 //#endregion
 //#region src/lint-cli/lib/cli/options.ts
 /**
+* The ESLint flags that make it lint source text read from its own stdin. The
+* engine's stdin carries its argument list (see `bootstrap.ts`), so these can
+* never work through the runner and are refused rather than silently linting
+* empty input.
+*/
+const STDIN_SOURCE_FLAGS = ["--stdin", "--stdin-filename"];
+/**
 * Parse and validate an `isentinel-lint` argv slice (without the node/bin
 * prefix). Throws {@link CliError} on any invalid combination.
 *
@@ -305,7 +386,11 @@ function parseArguments(argv, environment = process$1.env) {
 	const tail = separator === -1 ? [] : argv.slice(separator);
 	const eslintExtract = extractValueOption(head, "eslint-args");
 	const oxlintExtract = extractValueOption(eslintExtract.rest, "oxlint-args");
-	const parsed = yargs([...oxlintExtract.rest, ...tail]).scriptName("isentinel-lint").parserConfiguration({
+	const filesExtract = extractValueOption(oxlintExtract.rest, "files0-from");
+	if (filesExtract.occurrences > 1) throw new CliError("Option --files0-from may only be given once.");
+	const filesFrom = filesExtract.value;
+	if (filesFrom?.length === 0) throw new CliError("Option --files0-from requires a path, or - for stdin.");
+	const parsed = yargs([...filesExtract.rest, ...tail]).scriptName("isentinel-lint").parserConfiguration({
 		"boolean-negation": true,
 		"populate--": true
 	}).option("eslint", {
@@ -359,18 +444,22 @@ function parseArguments(argv, environment = process$1.env) {
 		if (eslintOnly) eslintArgs.push(...passthrough);
 		else oxlintArgs.push(...passthrough);
 	}
+	const stdinFlag = eslintArgs.find(isStdinSourceFlag);
+	if (stdinFlag !== void 0) throw new CliError(`Cannot forward ${stdinFlag} to ESLint: isentinel-lint lints files, not source text on stdin. Run ESLint directly to lint stdin.`);
 	const paths = parsed._.map(String).filter((value) => value.length > 0);
+	if (filesFrom !== void 0 && paths.length > 0) throw new CliError("Cannot combine --files0-from with positional paths; put every path in the list.");
 	return {
 		agents: parsed.agents ?? isInAgentSession(environment),
 		cache: parsed.cache,
 		concurrency: parseConcurrency(parsed.concurrency),
 		eslint: eslintOnly,
 		eslintArgs,
+		filesFrom,
 		fix,
 		oxlint: oxlintOnly,
 		oxlintArgs,
 		oxlintTypeAware: parsed.oxlintTypeAware,
-		paths: paths.length > 0 ? paths : ["."],
+		paths: filesFrom !== void 0 || paths.length > 0 ? paths : ["."],
 		print: parsed.print === true,
 		typeAware
 	};
@@ -389,6 +478,7 @@ function extractValueOption(argv, name) {
 	const inline = `${flag}=`;
 	const rest = [];
 	let value;
+	let occurrences = 0;
 	for (let index = 0; index < argv.length; index += 1) {
 		const token = argv[index];
 		if (token === void 0) continue;
@@ -396,20 +486,26 @@ function extractValueOption(argv, name) {
 			const next = argv[index + 1];
 			if (next === void 0) throw new CliError(`Option ${flag} requires a value.`);
 			value = next;
+			occurrences += 1;
 			index += 1;
 			continue;
 		}
 		if (token.startsWith(inline)) {
 			value = token.slice(inline.length);
+			occurrences += 1;
 			continue;
 		}
 		rest.push(token);
 	}
 	return {
+		occurrences,
 		rest,
 		value
 	};
 }
+function isStdinSourceFlag(token) {
+	return STDIN_SOURCE_FLAGS.some((flag) => token === flag || token.startsWith(`${flag}=`));
+}
 function parseConcurrency(value) {
 	if (value === void 0) return;
 	if (value === "off") return "off";
@@ -514,7 +610,7 @@ function statePath(cwd, name, ...parts) {
 */
 function readFileIfPresent(filePath) {
 	try {
-		return fs.readFileSync(filePath, "utf8");
+		return fs$1.readFileSync(filePath, "utf8");
 	} catch {
 		return;
 	}
@@ -555,12 +651,12 @@ function writeState(filePath, data) {
 	})}\n`;
 	const temporary = `${filePath}.${process$1.pid}.tmp`;
 	try {
-		fs.mkdirSync(path.dirname(filePath), { recursive: true });
-		fs.writeFileSync(temporary, content);
-		fs.renameSync(temporary, filePath);
+		fs$1.mkdirSync(path.dirname(filePath), { recursive: true });
+		fs$1.writeFileSync(temporary, content);
+		fs$1.renameSync(temporary, filePath);
 	} catch {
 		try {
-			fs.rmSync(temporary, { force: true });
+			fs$1.rmSync(temporary, { force: true });
 		} catch {}
 	}
 }
@@ -595,7 +691,7 @@ function swapState(filePath, value) {
 function touchState(filePath) {
 	try {
 		const now = Date.now() / 1e3;
-		fs.utimesSync(filePath, now, now);
+		fs$1.utimesSync(filePath, now, now);
 	} catch {}
 }
 /**
@@ -688,7 +784,23 @@ function resolveAgentsFormatter() {
 */
 function resolveIgnoredHelper() {
 	const built = fileURLToPath(new URL("./lint-ignored.mjs", import.meta.url));
-	return fs.existsSync(built) ? built : fileURLToPath(new URL("../../ignored-child.ts", import.meta.url));
+	return fs$1.existsSync(built) ? built : fileURLToPath(new URL("../../ignored-child.ts", import.meta.url));
+}
+/**
+* Resolve the engine bootstrap shipped alongside this entry (built from
+* `src/lint-cli/bootstrap.ts` to `lint-bootstrap.mjs`), which every engine
+* child is launched through so its arguments travel over stdin.
+*
+* Falls back to the TypeScript source exactly as {@link resolveIgnoredHelper}
+* does, for the same reason: the fixture tests run from `src`. Unlike that
+* helper there is no degraded mode — without the bootstrap no engine runs — so
+* the shipped path is checked by the integration tests against the build.
+*
+* @returns The absolute path to the bootstrap module.
+*/
+function resolveBootstrap() {
+	const built = fileURLToPath(new URL("./lint-bootstrap.mjs", import.meta.url));
+	return fs$1.existsSync(built) ? built : fileURLToPath(new URL("../../bootstrap.ts", import.meta.url));
 }
 /**
 * The path a package's manifest declares as the bin of the package's own name,
@@ -735,65 +847,28 @@ function resolveManifest(name, cwd) {
 	}
 }
 //#endregion
-//#region src/lint-cli/lib/exec/shell.ts
-const SAFE_TOKEN = /^[\w@+=:,./-]+$/;
+//#region src/lint-cli/lib/exec/execute.ts
+/** The signals that cancel a run, matching `concurrently`'s `KillOnSignal`. */
+const CANCEL_SIGNALS = [
+	"SIGHUP",
+	"SIGINT",
+	"SIGTERM"
+];
 /**
-* Render a command as a shell-equivalent line (env prefix + logical binary +
-* arguments) for `--print`. Uses POSIX quoting for stable, cross-platform
-* output.
-*
-* @param command - The child command to render.
-* @returns The shell-equivalent command line.
+* The first cancelling signal received while this run's children were running.
+* Shared across `execute` calls on purpose: a run is a sequence of them (three
+* for a `--fix` run), and once the user has cancelled one of them none of
+* the rest may start. {@link resetCancellation} Scopes it to one run.
 */
-function formatCommandLine(command) {
-	const environmentPrefix = Object.entries(command.env).flatMap(([key, value]) => value === void 0 ? [] : [`${key}=${quotePosix(value)}`]).join(" ");
-	const body = [command.bin, ...command.args].map(quotePosix).join(" ");
-	return environmentPrefix.length > 0 ? `${environmentPrefix} ${body}` : body;
-}
+let cancelledBy;
 /**
-* Build the command string concurrently runs through a shell. The tool is
-* launched via `node <binJs>` so no `.cmd`/`.ps1` shim quoting is involved.
-*
-* @param nodePath - Absolute path to the Node executable.
-* @param binJsPath - Absolute path to the tool's JavaScript entry.
-* @param args - The tool arguments.
-* @param platform - The platform whose shell quoting rules to apply.
-* @returns The shell command string.
+* Forget any cancellation recorded by an earlier run in this process. Called
+* as a run starts, so a second `runLint` in the same process is not refused
+* for a signal the first one received.
 */
-function buildShellCommand(nodePath, binJsPath, args, platform) {
-	const tokens = [
-		nodePath,
-		binJsPath,
-		...args
-	];
-	if (platform === "win32") {
-		const offending = tokens.find((token) => token.includes("%"));
-		if (offending !== void 0) throw new CliError(`Cannot safely pass "${offending}" to cmd.exe: "%" triggers environment-variable expansion even inside quotes. Remove it, or run the tool directly.`);
-	}
-	const quote = platform === "win32" ? quoteWindows : quotePosix;
-	return tokens.map(quote).join(" ");
-}
-function quotePosix(token) {
-	if (token.length > 0 && SAFE_TOKEN.test(token)) return token;
-	return `'${token.replaceAll("'", "'\\''")}'`;
+function resetCancellation() {
+	cancelledBy = void 0;
 }
-function quoteWindows(token) {
-	if (token.length > 0 && SAFE_TOKEN.test(token)) return token;
-	let escaped = "";
-	let slashes = 0;
-	for (const char of token) {
-		if (char === "\\") {
-			slashes += 1;
-			escaped += char;
-			continue;
-		}
-		escaped += char === "\"" ? `${"\\".repeat(slashes)}\\"` : char;
-		slashes = 0;
-	}
-	return `"${escaped}${"\\".repeat(slashes)}"`;
-}
-//#endregion
-//#region src/lint-cli/lib/exec/execute.ts
 /** Prefix colour per child label for `concurrently`; kept visually distinct. */
 const PREFIX_COLOR = {
 	eslint: "blue",
@@ -818,7 +893,8 @@ const PREFIX_COLOR = {
 * @returns The aggregated exit code.
 */
 async function execute(commands, cwd, sequential) {
-	return sequential ? runSequential(commands, cwd) : startGroup(commands, cwd);
+	const code = await (sequential ? runSequential(commands, cwd) : startGroup(commands, cwd));
+	return cancelledCode() ?? code;
 }
 /**
 * Run a staged set of children: spawn `commands` now, then resolve the rest and
@@ -845,13 +921,19 @@ async function execute(commands, cwd, sequential) {
 async function executeStaged(commands, cwd, resolveDeferred) {
 	const eager = startGroup(commands, cwd);
 	const deferred = resolveDeferred();
-	if (deferred.length === 0) return eager;
+	await new Promise((resolve) => {
+		setImmediate(resolve);
+	});
+	if (cancelledBy !== void 0 || deferred.length === 0) {
+		const eagerCode = await eager;
+		return cancelledCode() ?? eagerCode;
+	}
 	const held = createHeldOutput();
 	const later = startGroup(deferred, cwd, held.stream);
 	const eagerCode = await eager;
 	held.release();
 	const deferredCode = await later;
-	return eagerCode === 0 ? deferredCode : eagerCode;
+	return cancelledCode() ?? (eagerCode === 0 ? deferredCode : eagerCode);
 }
 /**
 * Announce a child on stderr once it has been spawned. `concurrently` groups
@@ -867,30 +949,162 @@ function announce(command) {
 	process$1.stderr.write(`${prefix} spawned ${command.bin}\n`);
 }
 /**
+* The names the children of one group are registered and logged under: the
+* engine, never its arguments. `concurrently` prints the name on each child's
+* exit line, so it must stay short however many files the child lints. The
+* line already carries the pass as its prefix (`[fast] eslint exited with code
+* 1`), so the pass only joins the name when two children share an engine.
+*
+* @param commands - The group's children.
+* @returns Each child paired with a name unique within the group.
+*/
+function nameCommands(commands) {
+	const taken = /* @__PURE__ */ new Set();
+	return commands.map((command) => {
+		const base = commands.filter((other) => other.bin === command.bin).length > 1 ? `${command.bin} (${command.label})` : command.bin;
+		let name = base;
+		let suffix = 1;
+		while (taken.has(name)) {
+			suffix += 1;
+			name = `${base} #${String(suffix)}`;
+		}
+		taken.add(name);
+		return [name, command];
+	});
+}
+/**
+* Spawn an engine child through the bootstrap and stream it its arguments.
+*
+* The OS command line is always `node <bootstrap> <bin>`, with no shell, so its
+* length does not depend on the file list and no path is ever interpreted by a
+* shell. The complete argument list follows as JSON on the child's stdin,
+* which is why stdin is always a pipe here whatever the caller asked for.
+*
+* @param launch - The child and its resolved bin.
+* @param options - Spawn options (cwd, env, stdout/stderr handling).
+* @returns The spawned child.
+*/
+function launchEngine({ bin, command }, options) {
+	const stdio = Array.isArray(options.stdio) ? options.stdio : [];
+	const child = spawn(process$1.execPath, [resolveBootstrap(), bin], {
+		...options,
+		shell: false,
+		stdio: [
+			"pipe",
+			stdio[1] ?? "inherit",
+			stdio[2] ?? "inherit"
+		]
+	});
+	child.stdin?.on("error", () => {});
+	child.stdin?.end(JSON.stringify(command.args));
+	return child;
+}
+/**
+* Kill a group's children and stop it spawning more when its output stream
+* fails — typically `EPIPE` once the reader of a piped report (`| head`) has
+* gone. Mirrors `concurrently`'s own `OutputErrorHandler`, which its package
+* exports do not expose.
+*
+* @param outputStream - The stream the group writes to.
+* @param abortController - Aborts the group.
+* @returns The flow controller.
+*/
+function killOnOutputError(outputStream, abortController) {
+	return { handle: (commands) => {
+		function onError() {
+			for (const command of commands) command.kill();
+			abortController.abort();
+		}
+		outputStream.on("error", onError);
+		return {
+			commands,
+			onFinish: () => {
+				outputStream.off("error", onError);
+			}
+		};
+	} };
+}
+/**
+* Record a cancelling signal for as long as children are running, and hand it
+* to `onSignal`. Listening at all replaces Node's default of exiting on the
+* signal, which is what lets the children be stopped and reaped first rather
+* than orphaned.
+*
+* @param onSignal - Forwards the signal to the running children; omitted when
+*   something else (`concurrently`'s `KillOnSignal`) already does.
+* @returns Removes the listeners.
+*/
+function trackCancellation(onSignal) {
+	function listener(signal) {
+		cancelledBy ??= signal;
+		onSignal?.(signal);
+	}
+	for (const signal of CANCEL_SIGNALS) process$1.on(signal, listener);
+	return () => {
+		for (const signal of CANCEL_SIGNALS) process$1.off(signal, listener);
+	};
+}
+/**
 * Start every command as one `concurrently` group and announce the children.
 * Unlike the previous `killOthersOn: ["failure"]` behaviour, an ordinary lint
 * failure in one child no longer kills its siblings — each runs to the end so
 * the user keeps every result. The resolved code is non-zero when any child
 * exited non-zero; the promise never rejects.
 *
+* Built on `concurrently`'s core rather than its default export, because the
+* wrapper always launches a command *string* through a shell (`cmd.exe` on
+* Windows), and that string would have to carry every lint target. Here the
+* group's spawner launches each engine directly through the bootstrap (see
+* {@link launchEngine}); the command string is only the label `concurrently`
+* logs. The controllers are the ones the wrapper wires that do anything under
+* the options this runner always used — output and error logging, exit lines,
+* signal forwarding and the broken-output-pipe guard — and nothing else.
+*
 * @param commands - The child commands to run.
 * @param cwd - The working directory.
 * @param outputStream - Where the group writes its child output; defaults to
 *   stdout. A staged run passes a held stream (see {@link createHeldOutput}).
 * @returns The aggregated exit code.
 */
-async function startGroup(commands, cwd, outputStream) {
-	const { result } = concurrently(commands.map((command) => {
+async function startGroup(commands, cwd, outputStream = process$1.stdout) {
+	if (cancelledBy !== void 0 || commands.length === 0) return 0;
+	const launches = new Map(nameCommands(commands).map(([name, command]) => {
+		return [name, {
+			bin: resolveLocalBin(command.bin, cwd),
+			command
+		}];
+	}));
+	const logger = new Logger({});
+	const abortController = new AbortController();
+	const stopTracking = trackCancellation();
+	const { result } = createConcurrently(Array.from(launches, ([name, { command }]) => {
 		return {
 			name: command.label,
-			command: buildShellCommand(process$1.execPath, resolveLocalBin(command.bin, cwd), command.args, process$1.platform),
+			command: name,
 			env: command.env,
 			prefixColor: PREFIX_COLOR[command.label]
 		};
 	}), {
+		abortSignal: abortController.signal,
+		controllers: [
+			new LogError({ logger }),
+			new LogOutput({ logger }),
+			new LogExit({ logger }),
+			new KillOnSignal({
+				abortController,
+				process: process$1
+			}),
+			killOnOutputError(outputStream, abortController)
+		],
 		cwd,
 		group: true,
-		outputStream
+		logger,
+		outputStream,
+		spawn: (name, options) => {
+			const launch = launches.get(name);
+			if (launch === void 0) throw new Error(`isentinel-lint: no engine registered as "${name}".`);
+			return launchEngine(launch, options);
+		}
 	});
 	for (const command of commands) announce(command);
 	try {
@@ -898,12 +1112,29 @@ async function startGroup(commands, cwd, outputStream) {
 		return 0;
 	} catch {
 		return 1;
+	} finally {
+		stopTracking();
 	}
 }
+function signalExitCode(signal) {
+	return 128 + os.constants.signals[signal];
+}
+/**
+* The exit code for a cancelled run (`128 + signal number`, as a shell reports
+* it), or `undefined` when nothing cancelled it.
+*
+* @returns The exit code, when cancelled.
+*/
+function cancelledCode() {
+	return cancelledBy === void 0 ? void 0 : signalExitCode(cancelledBy);
+}
 async function spawnChild(command, cwd) {
-	const binJsPath = resolveLocalBin(command.bin, cwd);
+	const bin = resolveLocalBin(command.bin, cwd);
 	return new Promise((resolve) => {
-		const child = spawn(process$1.execPath, [binJsPath, ...command.args], {
+		const child = launchEngine({
+			bin,
+			command
+		}, {
 			cwd,
 			env: {
 				...process$1.env,
@@ -912,17 +1143,23 @@ async function spawnChild(command, cwd) {
 			stdio: "inherit"
 		});
 		announce(command);
+		const stopTracking = trackCancellation((signal) => {
+			child.kill(signal);
+		});
 		child.on("error", () => {
+			stopTracking();
 			resolve(1);
 		});
-		child.on("close", (code) => {
-			resolve(code ?? 1);
+		child.on("close", (code, signal) => {
+			stopTracking();
+			resolve(code ?? (signal === null ? 1 : signalExitCode(signal)));
 		});
 	});
 }
 async function runSequential(commands, cwd) {
 	let exitCode = 0;
 	for (const command of commands) {
+		if (cancelledBy !== void 0) break;
 		const code = await spawnChild(command, cwd);
 		if (code !== 0) exitCode = code;
 	}
@@ -961,6 +1198,26 @@ function createHeldOutput() {
 	};
 }
 //#endregion
+//#region src/lint-cli/lib/exec/shell.ts
+const SAFE_TOKEN = /^[\w@+=:,./-]+$/;
+/**
+* Render a command as a shell-equivalent line (env prefix + logical binary +
+* arguments) for `--print`. Uses POSIX quoting for stable, cross-platform
+* output.
+*
+* @param command - The child command to render.
+* @returns The shell-equivalent command line.
+*/
+function formatCommandLine(command) {
+	const environmentPrefix = Object.entries(command.env).flatMap(([key, value]) => value === void 0 ? [] : [`${key}=${quotePosix(value)}`]).join(" ");
+	const body = [command.bin, ...command.args].map(quotePosix).join(" ");
+	return environmentPrefix.length > 0 ? `${environmentPrefix} ${body}` : body;
+}
+function quotePosix(token) {
+	if (token.length > 0 && SAFE_TOKEN.test(token)) return token;
+	return `'${token.replaceAll("'", "'\\''")}'`;
+}
+//#endregion
 //#region src/lint-cli/lib/plan/command.ts
 /**
 * Compose the oxlint child command.
@@ -974,7 +1231,7 @@ function composeOxlintCommand(options, context) {
 	if (options.agents) args.push("--format", "agent");
 	if (context.oxlintTypeAware) args.push("--type-aware");
 	if (options.fix) args.push("--fix");
-	args.push("--no-error-on-unmatched-pattern", ...options.oxlintArgs, ...context.paths);
+	args.push("--no-error-on-unmatched-pattern", ...options.oxlintArgs, ...pathArguments(context.paths));
 	return {
 		args,
 		bin: "oxlint",
@@ -996,7 +1253,7 @@ function composeEslintCommand(options, context) {
 	if (options.cache && context.ci) args.push("--cache-strategy", "content");
 	if (options.agents) args.push("--format", context.agentsFormatterPath);
 	if (context.fix) args.push("--fix");
-	args.push(...options.eslintArgs, ...context.paths);
+	args.push(...options.eslintArgs, ...pathArguments(context.paths));
 	return {
 		args,
 		bin: "eslint",
@@ -1004,6 +1261,19 @@ function composeEslintCommand(options, context) {
 		label: context.eslintLabel
 	};
 }
+/**
+* The lint targets as the tail of an engine's argument list. A relative target
+* that starts with `-` would be read as a flag, so it is passed as `./<path>`.
+* A `--` separator is not enough: ESLint's bin scans the raw argv for
+* `--init`, `--mcp`, `--stdin` and `--debug` regardless of it, so a listed file
+* named `--init` would start the config wizard.
+*
+* @param paths - The lint targets.
+* @returns The arguments that pass them as paths.
+*/
+function pathArguments(paths) {
+	return paths.map((target) => target.startsWith("-") ? `./${target}` : target);
+}
 //#endregion
 //#region src/lint-cli/lib/plan/compose.ts
 /** The stderr notice emitted when a lint target resolves outside the cwd. */
@@ -1170,7 +1440,7 @@ function applyHashBust(run, bust, hash) {
 	const cleared = [];
 	for (const base of bust.caches) {
 		const cacheFilePath = path.resolve(run.cwd, cacheFileFor(base, run.key));
-		fs.rmSync(cacheFilePath, { force: true });
+		fs$1.rmSync(cacheFilePath, { force: true });
 		cleared.push(cacheFilePath);
 	}
 	return {
@@ -1447,7 +1717,7 @@ function normalizePath(filePath, platform = process$1.platform) {
 * @returns The loaded cache, or `undefined` when the file does not exist.
 */
 function openCache(cacheFilePath, useChecksum) {
-	if (!fs.existsSync(cacheFilePath)) return;
+	if (!fs$1.existsSync(cacheFilePath)) return;
 	const cache = load(cacheFilePath, useChecksum);
 	return {
 		filesWithMessages: (files) => filesWithMessagesIn(cache, files),
@@ -1457,7 +1727,7 @@ function openCache(cacheFilePath, useChecksum) {
 }
 function safeMtimeMs(filePath) {
 	try {
-		return fs.statSync(filePath).mtimeMs;
+		return fs$1.statSync(filePath).mtimeMs;
 	} catch {
 		return;
 	}
@@ -1474,7 +1744,7 @@ function safeMtimeMs(filePath) {
 function listCacheFiles(cwd) {
 	let entries;
 	try {
-		entries = fs.readdirSync(cwd);
+		entries = fs$1.readdirSync(cwd);
 	} catch {
 		return [];
 	}
@@ -1482,7 +1752,7 @@ function listCacheFiles(cwd) {
 }
 function removeCacheFile(cacheFilePath) {
 	try {
-		fs.rmSync(cacheFilePath, { force: true });
+		fs$1.rmSync(cacheFilePath, { force: true });
 	} catch {}
 }
 /**
@@ -3491,7 +3761,7 @@ const WALK_BUDGET = 8192;
 function findWorkspaceRoot(cwd) {
 	let current = cwd;
 	for (;;) {
-		for (const marker of WORKSPACE_ROOT_MARKERS) if (fs.existsSync(path.join(current, marker))) return current;
+		for (const marker of WORKSPACE_ROOT_MARKERS) if (fs$1.existsSync(path.join(current, marker))) return current;
 		const parent = path.dirname(current);
 		if (parent === current) return cwd;
 		current = parent;
@@ -3535,7 +3805,7 @@ function findWorkspaceMembers(root) {
 	function walk(directory, depth) {
 		let entries;
 		try {
-			entries = fs.readdirSync(directory, { withFileTypes: true });
+			entries = fs$1.readdirSync(directory, { withFileTypes: true });
 		} catch {
 			return true;
 		}
@@ -3545,7 +3815,7 @@ function findWorkspaceMembers(root) {
 			if (budget < 0) return false;
 			const absolute = path.join(directory, entry.name);
 			const relative = toPosix(path.relative(root, absolute));
-			if (isMember(relative) && fs.existsSync(path.join(absolute, "package.json"))) members.push(absolute);
+			if (isMember(relative) && fs$1.existsSync(path.join(absolute, "package.json"))) members.push(absolute);
 			if (depth < maxDepth && !walk(absolute, depth + 1)) return false;
 		}
 		return true;
@@ -3873,7 +4143,7 @@ function oxlintTargets(cwd, targets) {
 		const extension = path.extname(target).toLowerCase();
 		if (extension === "" || TYPE_AWARE_EXTENSION_SET.has(extension)) return true;
 		try {
-			return fs.statSync(path.resolve(cwd, target)).isDirectory();
+			return fs$1.statSync(path.resolve(cwd, target)).isDirectory();
 		} catch {
 			return false;
 		}
@@ -3910,7 +4180,7 @@ function collectAncestorBustFiles(cwd) {
 	for (;;) {
 		let entries = [];
 		try {
-			entries = fs.readdirSync(current, { withFileTypes: true });
+			entries = fs$1.readdirSync(current, { withFileTypes: true });
 		} catch {
 			entries = [];
 		}
@@ -3933,7 +4203,7 @@ function collectAncestorBustFiles(cwd) {
 * @returns The normalized cwd-relative posix target.
 */
 function normalizeTarget(target, cwd) {
-	let value = path.isAbsolute(target) ? toPosix(path.relative(cwd, target)) : toPosix(target);
+	let value = path.isAbsolute(target) ? toPosix(path.relative(cwd, target)) : path.posix.normalize(toPosix(target));
 	if (value.startsWith("./")) value = value.slice(2);
 	while (value.endsWith("/")) value = value.slice(0, -1);
 	return value;
@@ -3960,8 +4230,15 @@ function isOutsideCwd(normalizedTarget) {
 */
 function matchTargets(normalized) {
 	if (normalized.some((target) => target === "" || target === ".")) return () => true;
+	const targets = new Set(normalized);
 	return (relative) => {
-		return normalized.some((target) => relative === target || relative.startsWith(`${target}/`));
+		let candidate = relative;
+		for (;;) {
+			if (targets.has(candidate)) return true;
+			const slash = candidate.lastIndexOf("/");
+			if (slash === -1) return false;
+			candidate = candidate.slice(0, slash);
+		}
 	};
 }
 function isTypeAwareFile(filePath) {
@@ -3974,6 +4251,7 @@ function gitListFiles(cwd, pathSpecs) {
 	try {
 		return execFileSync("git", [
 			"ls-files",
+			"-z",
 			"--cached",
 			"--others",
 			"--exclude-standard",
@@ -3983,7 +4261,7 @@ function gitListFiles(cwd, pathSpecs) {
 			cwd,
 			encoding: "utf8",
 			maxBuffer: 64 * 1024 * 1024
-		}).split("\n").filter((line) => line.length > 0);
+		}).split("\0").filter((line) => line.length > 0);
 	} catch {
 		return;
 	}
@@ -3991,7 +4269,7 @@ function gitListFiles(cwd, pathSpecs) {
 function walkDirectory(root, current, accumulator) {
 	let entries;
 	try {
-		entries = fs.readdirSync(current, { withFileTypes: true });
+		entries = fs$1.readdirSync(current, { withFileTypes: true });
 	} catch {
 		return;
 	}
@@ -4010,7 +4288,7 @@ function walkFallback(cwd, targets) {
 		const absolute = path.resolve(cwd, target);
 		let stat;
 		try {
-			stat = fs.statSync(absolute);
+			stat = fs$1.statSync(absolute);
 		} catch {
 			continue;
 		}
@@ -4049,11 +4327,12 @@ function gitIgnoredTargets(cwd, targets) {
 		const output = execFileSync("git", [
 			"check-ignore",
 			"--no-index",
-			"--stdin"
+			"--stdin",
+			"-z"
 		], {
 			cwd,
 			encoding: "utf8",
-			input: targets.join("\n"),
+			input: `${targets.join("\0")}\0`,
 			maxBuffer: 64 * 1024 * 1024,
 			stdio: [
 				"pipe",
@@ -4061,7 +4340,7 @@ function gitIgnoredTargets(cwd, targets) {
 				"ignore"
 			]
 		});
-		return new Set(output.split("\n").map((line) => line.trim()).filter(Boolean));
+		return new Set(output.split("\0").filter(Boolean));
 	} catch {
 		return /* @__PURE__ */ new Set();
 	}
@@ -4334,7 +4613,7 @@ function queryIgnoredFiles(cwd, targets) {
 				"ignore"
 			]
 		});
-		const parsed = JSON.parse(fs.readFileSync(outFile, "utf8"));
+		const parsed = JSON.parse(fs$1.readFileSync(outFile, "utf8"));
 		if (!isRecord(parsed)) return;
 		const { basePath, entries, ignored, mode } = parsed;
 		if (mode === "answers" && isStringArray(ignored)) return {
@@ -4350,7 +4629,7 @@ function queryIgnoredFiles(cwd, targets) {
 	} catch {
 		return;
 	} finally {
-		fs.rmSync(outFile, { force: true });
+		fs$1.rmSync(outFile, { force: true });
 	}
 }
 //#endregion
@@ -4393,7 +4672,7 @@ function readHybridStatus(cwd) {
 function writeHybridStatus(cwd, oxlint) {
 	let installed;
 	try {
-		installed = fs.existsSync(path.resolve(cwd, "node_modules"));
+		installed = fs$1.existsSync(path.resolve(cwd, "node_modules"));
 	} catch {
 		return;
 	}
@@ -5096,7 +5375,7 @@ function computeAffectedFiles({ key, cwd }, mode) {
 			if (entryReadable) warnOnce(`no TypeScript files resolved from ${path.basename(configPath)}; skipping type-aware cache invalidation`);
 			return;
 		}
-		fs.mkdirSync(stateDirectory(cwd), { recursive: true });
+		fs$1.mkdirSync(stateDirectory(cwd), { recursive: true });
 		const resolutionGate = computeResolutionGate(cwd);
 		const affected = /* @__PURE__ */ new Set();
 		let warmProjects = 0;
@@ -5143,7 +5422,7 @@ function computeAffectedFiles({ key, cwd }, mode) {
 function hasBuilderState({ key, cwd }, mode) {
 	const prefix = `${path.basename(statePath(cwd, BUILD_INFO_STATE, modeSuffix(mode), key))}-`;
 	try {
-		return fs.readdirSync(stateDirectory(cwd)).some((name) => name.startsWith(prefix) && !name.endsWith(".tmp"));
+		return fs$1.readdirSync(stateDirectory(cwd)).some((name) => name.startsWith(prefix) && !name.endsWith(".tmp"));
 	} catch {
 		return false;
 	}
@@ -5358,10 +5637,10 @@ function persistBuilderState(builder, buildInfoPath) {
 		if (path.normalize(fileName) !== normalizedBuildInfo) return;
 		const temporary = `${fileName}.${process$1.pid}.tmp`;
 		try {
-			fs.writeFileSync(temporary, data);
-			fs.renameSync(temporary, fileName);
+			fs$1.writeFileSync(temporary, data);
+			fs$1.renameSync(temporary, fileName);
 		} catch (err) {
-			fs.rmSync(temporary, { force: true });
+			fs$1.rmSync(temporary, { force: true });
 			throw err;
 		}
 	});
@@ -5376,7 +5655,7 @@ function persistBuilderState(builder, buildInfoPath) {
 */
 function writeGateState(gatePath, gateValue) {
 	if (gateValue === void 0) {
-		fs.rmSync(gatePath, { force: true });
+		fs$1.rmSync(gatePath, { force: true });
 		return;
 	}
 	writeState(gatePath, gateValue);
@@ -5397,7 +5676,7 @@ function writeGateState(gatePath, gateValue) {
 * @returns The affected result.
 */
 function runBuilder({ buildInfoPath, gatePath, project, resolutionGate, ts }) {
-	const firstRun = !fs.existsSync(buildInfoPath);
+	const firstRun = !fs$1.existsSync(buildInfoPath);
 	const options = {
 		...project.options,
 		composite: false,
@@ -5480,7 +5759,7 @@ function applyTypeAwareInvalidation(run, { alreadyDirty, cache, cacheLocation, m
 	}
 	const threshold = resolveAffectedBustThreshold(run.environment);
 	if (affectedTargets.length > threshold) {
-		fs.rmSync(cacheLocation, { force: true });
+		fs$1.rmSync(cacheLocation, { force: true });
 		return {
 			busted: true,
 			firstRun: false,
@@ -5767,11 +6046,15 @@ function stageDescriptors(descriptors, run, staging) {
 * @param argv - The argument slice (without the node/bin prefix).
 * @param cwd - The working directory (defaults to `process.cwd()`; injected in tests).
 * @param environment - The process environment (defaults to `process.env`).
+* @param stdin - Where `--files0-from -` reads its list (defaults to
+*   `process.stdin`).
 * @returns The process exit code.
 * @rejects {CliError} When the arguments are invalid or a tool is missing.
 */
-async function runLint(argv, cwd = process$1.cwd(), environment = process$1.env) {
-	const options = parseArguments(argv, environment);
+async function runLint(argv, cwd = process$1.cwd(), environment = process$1.env, stdin = process$1.stdin) {
+	resetCancellation();
+	const options = await readFileList(parseArguments(argv, environment), cwd, stdin);
+	if (options.paths.length === 0) return 0;
 	const staged = plan(options, resolveRunContext(cwd, environment, !options.print));
 	const { commands, notice } = compose(staged.eager, options);
 	if (options.print) {
@@ -5824,7 +6107,7 @@ async function runChecks(commands, cwd, staged, options) {
 }
 //#endregion
 //#region src/lint-cli/index.ts
-const HELP = `isentinel-lint [flags] [paths...]
+const HELP = `isentinel-lint [flags] [paths... | --files0-from <file|->]
 
 Runs oxlint and ESLint together, sizing ESLint's --concurrency from how many
 files actually need re-linting and managing per-mode caches.
@@ -5844,6 +6127,9 @@ Flags:
   --concurrency <n|off>    Override the concurrency heuristic.
   --eslint-args "<args>"   Extra arguments for ESLint.
   --oxlint-args "<args>"   Extra arguments for oxlint.
+  --files0-from <file|->   Read the paths to lint from a NUL-delimited UTF-8
+                           list (- for stdin) instead of positional arguments.
+                           An empty list lints nothing and exits 0.
   --print                  Print the composed commands without running them.
   -- <args>                Forward args to the single selected tool.
   -h, --help               Show this help.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isentinel/eslint-config",
-  "version": "6.0.0",
+  "version": "6.0.1",
   "description": "iSentinel's ESLint config",
   "keywords": [
     "eslint-config",
@@ -145,7 +145,7 @@
     "typescript": "6.0.3",
     "unplugin-unused": "0.5.7",
     "vitest": "4.1.10",
-    "@isentinel/eslint-config": "6.0.0"
+    "@isentinel/eslint-config": "6.0.1"
   },
   "peerDependencies": {
     "@vitest/eslint-plugin": "^1.6.4",