@isentinel/eslint-config 6.0.0 → 6.1.0

package/dist/lint-cli.mjs

@@ -1,18 +1,21 @@
 import { createRequire } from "node:module";
 import process$1 from "node:process";
 import { isPackageExists } from "local-pkg";
+import { Buffer as Buffer$1 } from "node:buffer";
+import fs from "node:fs/promises";
+import path from "node:path";
 import yargs from "yargs";
 import "find-up-simple";
-import fs from "node:fs";
-import path from "node:path";
+import fs$1 from "node:fs";
 import "semver";
 import crypto from "node:crypto";
 import ansis from "ansis";
-import concurrently from "concurrently";
+import { KillOnSignal, LogError, LogExit, LogOutput, Logger, createConcurrently } from "concurrently";
 import { execFileSync, spawn, spawnSync } from "node:child_process";
+import os, { availableParallelism } from "node:os";
 import { Writable } from "node:stream";
+import v8 from "node:v8";
 import { fileURLToPath } from "node:url";
-import os, { availableParallelism } from "node:os";
 import fileEntryCache from "file-entry-cache";
 //#region \0rolldown/runtime.js
 var __create = Object.create;
@@ -38,7 +41,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 }) : target, mod));
 //#endregion
 //#region package.json
-var version = "6.0.0";
+var version = "6.1.0";
 //#endregion
 //#region src/lint-cli/lib/cli/types.ts
 /**
@@ -48,6 +51,78 @@ var version = "6.0.0";
 var CliError = class extends Error {
 	name = "CliError";
 };
+//#endregion
+//#region src/lint-cli/lib/cli/file-list.ts
+/** The `--files0-from` value that names stdin rather than a file. */
+const STDIN_SOURCE = "-";
+/**
+* Split a NUL-delimited, UTF-8 path list (the `git ls-files -z` / `find
+* -print0` shape) into its paths.
+*
+* Every path is terminated by a NUL, though the last terminator may be left off
+* as GNU's own `--files0-from` allows. Nothing else is interpreted: spaces,
+* newlines, quotes, shell metacharacters and leading hyphens all stay part of
+* the name. The bytes must be valid UTF-8 — a lossy decode would lint a file
+* that is not the one selected — and no entry may be empty, since an empty
+* path is never a file and most likely a broken producer.
+*
+* @param bytes - The raw list.
+* @returns The paths, in list order. Empty for an empty list.
+*/
+function decodeFileList(bytes) {
+	const decoder = new TextDecoder("utf-8", {
+		fatal: true,
+		ignoreBOM: true
+	});
+	let text;
+	try {
+		text = decoder.decode(bytes);
+	} catch {
+		throw new CliError("--files0-from: the file list is not valid UTF-8.");
+	}
+	if (text.length === 0) return [];
+	const entries = text.split("\0");
+	if (entries.at(-1) === "") entries.pop();
+	const empty = entries.indexOf("");
+	if (empty !== -1) throw new CliError(`--files0-from: entry ${empty + 1} of the file list is empty; expected NUL-terminated paths.`);
+	return entries;
+}
+/**
+* Fill the run's paths from its `--files0-from` list, reading it once. Options
+* without a list are returned as they are.
+*
+* An empty list stays empty: the caller treats it as nothing to lint, and it
+* must never become the whole-tree default `.`.
+*
+* @param options - The parsed CLI options.
+* @param cwd - The directory a relative list path resolves against.
+* @param stdin - The stream `-` reads.
+* @returns The options with `paths` set from the list.
+* @rejects {CliError} When the list cannot be read or is malformed.
+*/
+async function readFileList(options, cwd, stdin) {
+	const source = options.filesFrom;
+	if (source === void 0) return options;
+	const bytes = source === STDIN_SOURCE ? await readAll(stdin) : await readFile(source, cwd);
+	return {
+		...options,
+		paths: decodeFileList(bytes)
+	};
+}
+async function readFile(source, cwd) {
+	try {
+		return await fs.readFile(path.resolve(cwd, source));
+	} catch (err) {
+		throw new CliError(`--files0-from: cannot read "${source}": ${err instanceof Error ? err.message : String(err)}`);
+	}
+}
+async function readAll(stream) {
+	const chunks = [];
+	for await (const chunk of stream) if (typeof chunk === "string") chunks.push(Buffer$1.from(chunk, "utf8"));
+	else if (chunk instanceof Uint8Array) chunks.push(Buffer$1.from(chunk));
+	else throw new CliError("--files0-from: stdin produced a non-byte chunk.");
+	return Buffer$1.concat(chunks);
+}
 /**
 * The real TS/JS-family file extensions {@link GLOB_SRC_EXT} encodes (the glob
 * additionally matches non-existent combinations such as `cjsx`). Kept next to
@@ -288,6 +363,13 @@ function splitArgs(input) {
 //#endregion
 //#region src/lint-cli/lib/cli/options.ts
 /**
+* The ESLint flags that make it lint source text read from its own stdin. The
+* engine's stdin carries its argument list (see `bootstrap.ts`), so these can
+* never work through the runner and are refused rather than silently linting
+* empty input.
+*/
+const STDIN_SOURCE_FLAGS = ["--stdin", "--stdin-filename"];
+/**
 * Parse and validate an `isentinel-lint` argv slice (without the node/bin
 * prefix). Throws {@link CliError} on any invalid combination.
 *
@@ -305,7 +387,11 @@ function parseArguments(argv, environment = process$1.env) {
 	const tail = separator === -1 ? [] : argv.slice(separator);
 	const eslintExtract = extractValueOption(head, "eslint-args");
 	const oxlintExtract = extractValueOption(eslintExtract.rest, "oxlint-args");
-	const parsed = yargs([...oxlintExtract.rest, ...tail]).scriptName("isentinel-lint").parserConfiguration({
+	const filesExtract = extractValueOption(oxlintExtract.rest, "files0-from");
+	if (filesExtract.occurrences > 1) throw new CliError("Option --files0-from may only be given once.");
+	const filesFrom = filesExtract.value;
+	if (filesFrom?.length === 0) throw new CliError("Option --files0-from requires a path, or - for stdin.");
+	const parsed = yargs([...filesExtract.rest, ...tail]).scriptName("isentinel-lint").parserConfiguration({
 		"boolean-negation": true,
 		"populate--": true
 	}).option("eslint", {
@@ -359,18 +445,22 @@ function parseArguments(argv, environment = process$1.env) {
 		if (eslintOnly) eslintArgs.push(...passthrough);
 		else oxlintArgs.push(...passthrough);
 	}
+	const stdinFlag = eslintArgs.find(isStdinSourceFlag);
+	if (stdinFlag !== void 0) throw new CliError(`Cannot forward ${stdinFlag} to ESLint: isentinel-lint lints files, not source text on stdin. Run ESLint directly to lint stdin.`);
 	const paths = parsed._.map(String).filter((value) => value.length > 0);
+	if (filesFrom !== void 0 && paths.length > 0) throw new CliError("Cannot combine --files0-from with positional paths; put every path in the list.");
 	return {
 		agents: parsed.agents ?? isInAgentSession(environment),
 		cache: parsed.cache,
 		concurrency: parseConcurrency(parsed.concurrency),
 		eslint: eslintOnly,
 		eslintArgs,
+		filesFrom,
 		fix,
 		oxlint: oxlintOnly,
 		oxlintArgs,
 		oxlintTypeAware: parsed.oxlintTypeAware,
-		paths: paths.length > 0 ? paths : ["."],
+		paths: filesFrom !== void 0 || paths.length > 0 ? paths : ["."],
 		print: parsed.print === true,
 		typeAware
 	};
@@ -389,6 +479,7 @@ function extractValueOption(argv, name) {
 	const inline = `${flag}=`;
 	const rest = [];
 	let value;
+	let occurrences = 0;
 	for (let index = 0; index < argv.length; index += 1) {
 		const token = argv[index];
 		if (token === void 0) continue;
@@ -396,20 +487,26 @@ function extractValueOption(argv, name) {
 			const next = argv[index + 1];
 			if (next === void 0) throw new CliError(`Option ${flag} requires a value.`);
 			value = next;
+			occurrences += 1;
 			index += 1;
 			continue;
 		}
 		if (token.startsWith(inline)) {
 			value = token.slice(inline.length);
+			occurrences += 1;
 			continue;
 		}
 		rest.push(token);
 	}
 	return {
+		occurrences,
 		rest,
 		value
 	};
 }
+function isStdinSourceFlag(token) {
+	return STDIN_SOURCE_FLAGS.some((flag) => token === flag || token.startsWith(`${flag}=`));
+}
 function parseConcurrency(value) {
 	if (value === void 0) return;
 	if (value === "off") return "off";
@@ -474,6 +571,188 @@ function resolveRunContext(cwd, environment, mutate) {
 	};
 }
 //#endregion
+//#region src/lint-cli/lib/plan/heap.ts
+/**
+* Environment variable that sets the heap of a program-building ESLint child.
+*/
+const HEAP_ENV = "LINT_TYPED_HEAP_MB";
+/**
+* Share of the machine's memory the program-building workers may claim between
+* them. The rest is left for the oxlint child, the fast pass, the editor and
+* the OS, all of which run alongside the type-aware pass locally.
+*/
+const HEAP_BUDGET_SHARE = .5;
+const BYTES_PER_MB = 1024 * 1024;
+const MAX_OLD_SPACE = /--max[-_]old[-_]space[-_]size\b/;
+/**
+* Read the machine's memory facts.
+*
+* @returns The available memory and V8's default heap limit, in MB.
+*/
+function probeMemory() {
+	const total = os.totalmem();
+	const constrained = process$1.constrainedMemory();
+	return {
+		availableMb: Math.floor((constrained > 0 ? Math.min(total, constrained) : total) / BYTES_PER_MB),
+		defaultHeapMb: Math.floor(v8.getHeapStatistics().heap_size_limit / BYTES_PER_MB)
+	};
+}
+/**
+* Resolve the heap setting from the environment. An invalid {@link HEAP_ENV}
+* falls back to `auto`, as the other numeric knobs fall back to their
+* defaults.
+*
+* @param environment - Where {@link HEAP_ENV} and `NODE_OPTIONS` are read.
+* @returns Which of the four modes applies, with its size when fixed.
+*/
+function resolveHeapSetting(environment) {
+	if (MAX_OLD_SPACE.test(environment["NODE_OPTIONS"] ?? "")) return { kind: "inherited" };
+	const raw = environment[HEAP_ENV]?.trim();
+	if (raw === "off") return { kind: "off" };
+	const mb = parseBoundedInteger(raw, 1);
+	return mb === void 0 ? { kind: "auto" } : {
+		kind: "fixed",
+		mb
+	};
+}
+/**
+* The memory all program-building workers may claim together, in MB.
+*
+* @param memory - What the machine offers.
+* @returns The budget share of the available memory, in MB.
+*/
+function heapBudgetMb(memory) {
+	return Math.floor(memory.availableMb * HEAP_BUDGET_SHARE);
+}
+/**
+* The most program-building workers the budget can hold, or `undefined` when
+* the setting places no limit. Each worker is counted at the heap it may grow
+* to: the requested size, or {@link AUTO_HEAP_FLOOR} times Node's default
+* under `auto`. Never below one.
+*
+* @param budget - The setting and the machine it applies to.
+* @returns How many workers fit, if the setting limits them.
+*/
+function heapWorkerCap({ memory, setting }) {
+	if (setting.kind !== "auto" && setting.kind !== "fixed") return;
+	const perWorker = setting.kind === "fixed" ? setting.mb : memory.defaultHeapMb * 2;
+	return Math.max(1, Math.floor(heapBudgetMb(memory) / perWorker));
+}
+/**
+* The heap each worker of a program-building pass gets, or `undefined` for
+* Node's default. `auto` splits the budget across the workers and only raises
+* the limit: a share below the default adds no flag.
+*
+* @param budget - The setting and the machine it applies to.
+* @param concurrency - The pass's resolved concurrency (`off` lints on the
+*   main thread, which is one heap).
+* @returns The size in MB to pass to Node, if it should change.
+*/
+function heapPerWorkerMb({ memory, setting }, concurrency) {
+	if (setting.kind === "fixed") return setting.mb;
+	if (setting.kind !== "auto") return;
+	const share = Math.floor(heapBudgetMb(memory) / workerCount(concurrency));
+	return share > memory.defaultHeapMb ? share : void 0;
+}
+/**
+* Pair the run's heap setting with the machine it applies to.
+*
+* @param environment - Where {@link HEAP_ENV} and `NODE_OPTIONS` are read.
+* @param memory - What the machine offers.
+* @returns Everything sizing needs to give a program-building pass its heap.
+*/
+function resolveHeapBudget(environment, memory) {
+	return {
+		memory,
+		nodeOptions: environment["NODE_OPTIONS"],
+		setting: resolveHeapSetting(environment)
+	};
+}
+/**
+* The worker cap of a program-building pass once the heap budget is applied.
+* An explicit `LINT_MAX_WORKERS` is never tightened.
+*
+* @param maxWorkers - The pass's cap before the budget.
+* @param explicit - Whether `LINT_MAX_WORKERS` set that cap.
+* @param budget - The setting and the machine it applies to.
+* @returns The cap to size the pass against.
+*/
+function capWorkersForHeap(maxWorkers, explicit, budget) {
+	const cap = explicit ? void 0 : heapWorkerCap(budget);
+	return cap === void 0 ? maxWorkers : Math.min(maxWorkers, cap);
+}
+/**
+* Plan the heap of one program-building child from its sizing.
+*
+* @param label - The child's label, for the `--print` line.
+* @param budget - The setting and the machine it applies to.
+* @param sizing - The child's concurrency and file count.
+* @returns Its `NODE_OPTIONS`, its `--print` line and whether it is watched.
+*/
+function planPassHeap(label, budget, sizing) {
+	const heapMb = heapPerWorkerMb(budget, sizing.concurrency);
+	return {
+		nodeOptions: heapNodeOptions(budget, heapMb),
+		note: describeHeapPlan(label, budget, sizing, heapMb),
+		watch: budget.setting.kind !== "off"
+	};
+}
+/**
+* The number of heaps a concurrency value runs: `off` lints on the main
+* thread, which is one.
+*
+* @param concurrency - A resolved ESLint concurrency.
+* @returns How many threads lint.
+*/
+function workerCount(concurrency) {
+	return concurrency === "off" ? 1 : concurrency;
+}
+/**
+* The `NODE_OPTIONS` a program-building child runs under: the inherited value
+* with the heap flag appended. Node's `worker_threads` take their heap limit
+* from `--max-old-space-size` when it is set, so this one flag reaches every
+* ESLint worker.
+*
+* @param budget - Carries the inherited `NODE_OPTIONS`.
+* @param heapMb - The size in MB for each worker, if it should change.
+* @returns The value to set, or `undefined` to leave `NODE_OPTIONS` alone.
+*/
+function heapNodeOptions({ nodeOptions }, heapMb) {
+	if (heapMb === void 0) return;
+	const flag = `--max-old-space-size=${String(heapMb)}`;
+	const inherited = nodeOptions?.trim() ?? "";
+	return inherited.length > 0 ? `${inherited} ${flag}` : flag;
+}
+/**
+* How the `--print` line names a heap the runner left alone.
+*
+* @param budget - Says whether the user's `NODE_OPTIONS` set it.
+* @returns The user's heap, or Node's default with its size.
+*/
+function unchangedHeap({ memory, setting }) {
+	return setting.kind === "inherited" ? "the NODE_OPTIONS heap" : `Node's default heap (${String(memory.defaultHeapMb)} MB)`;
+}
+/**
+* Describe the memory plan of a program-building pass for `--print`.
+*
+* @param label - The pass's child label.
+* @param budget - The setting and the machine it applies to.
+* @param sizing - The pass's concurrency and file count.
+* @param heapMb - The size given to each worker, if it changed.
+* @returns One stderr line naming the workers, files per worker and heap.
+*/
+function describeHeapPlan(label, budget, { concurrency, dirtyCount }, heapMb) {
+	const workers = workerCount(concurrency);
+	const heap = heapMb === void 0 ? unchangedHeap(budget) : `${String(heapMb)} MB heap`;
+	const source = {
+		auto: `auto, budget ${String(heapBudgetMb(budget.memory))} MB`,
+		fixed: HEAP_ENV,
+		inherited: "NODE_OPTIONS",
+		off: `${HEAP_ENV}=off`
+	}[budget.setting.kind];
+	return `isentinel-lint: ${label} pass: ${String(workers)} worker(s), ~${String(Math.ceil(dirtyCount / workers))} files per worker, ${heap} per worker (${source}).\n`;
+}
+//#endregion
 //#region src/lint-cli/lib/state.ts
 /**
 * Directory (relative to the project root) where the CLI keeps its persisted
@@ -514,7 +793,7 @@ function statePath(cwd, name, ...parts) {
 */
 function readFileIfPresent(filePath) {
 	try {
-		return fs.readFileSync(filePath, "utf8");
+		return fs$1.readFileSync(filePath, "utf8");
 	} catch {
 		return;
 	}
@@ -555,12 +834,12 @@ function writeState(filePath, data) {
 	})}\n`;
 	const temporary = `${filePath}.${process$1.pid}.tmp`;
 	try {
-		fs.mkdirSync(path.dirname(filePath), { recursive: true });
-		fs.writeFileSync(temporary, content);
-		fs.renameSync(temporary, filePath);
+		fs$1.mkdirSync(path.dirname(filePath), { recursive: true });
+		fs$1.writeFileSync(temporary, content);
+		fs$1.renameSync(temporary, filePath);
 	} catch {
 		try {
-			fs.rmSync(temporary, { force: true });
+			fs$1.rmSync(temporary, { force: true });
 		} catch {}
 	}
 }
@@ -595,7 +874,7 @@ function swapState(filePath, value) {
 function touchState(filePath) {
 	try {
 		const now = Date.now() / 1e3;
-		fs.utimesSync(filePath, now, now);
+		fs$1.utimesSync(filePath, now, now);
 	} catch {}
 }
 /**
@@ -688,7 +967,23 @@ function resolveAgentsFormatter() {
 */
 function resolveIgnoredHelper() {
 	const built = fileURLToPath(new URL("./lint-ignored.mjs", import.meta.url));
-	return fs.existsSync(built) ? built : fileURLToPath(new URL("../../ignored-child.ts", import.meta.url));
+	return fs$1.existsSync(built) ? built : fileURLToPath(new URL("../../ignored-child.ts", import.meta.url));
+}
+/**
+* Resolve the engine bootstrap shipped alongside this entry (built from
+* `src/lint-cli/bootstrap.ts` to `lint-bootstrap.mjs`), which every engine
+* child is launched through so its arguments travel over stdin.
+*
+* Falls back to the TypeScript source exactly as {@link resolveIgnoredHelper}
+* does, for the same reason: the fixture tests run from `src`. Unlike that
+* helper there is no degraded mode — without the bootstrap no engine runs — so
+* the shipped path is checked by the integration tests against the build.
+*
+* @returns The absolute path to the bootstrap module.
+*/
+function resolveBootstrap() {
+	const built = fileURLToPath(new URL("./lint-bootstrap.mjs", import.meta.url));
+	return fs$1.existsSync(built) ? built : fileURLToPath(new URL("../../bootstrap.ts", import.meta.url));
 }
 /**
 * The path a package's manifest declares as the bin of the package's own name,
@@ -735,65 +1030,33 @@ function resolveManifest(name, cwd) {
 	}
 }
 //#endregion
-//#region src/lint-cli/lib/exec/shell.ts
-const SAFE_TOKEN = /^[\w@+=:,./-]+$/;
+//#region src/lint-cli/lib/exec/execute.ts
 /**
-* Render a command as a shell-equivalent line (env prefix + logical binary +
-* arguments) for `--print`. Uses POSIX quoting for stable, cross-platform
-* output.
-*
-* @param command - The child command to render.
-* @returns The shell-equivalent command line.
+* What V8 writes when a heap fills: `ERR_WORKER_OUT_OF_MEMORY` from a worker,
+* `JavaScript heap out of memory` from the main thread.
 */
-function formatCommandLine(command) {
-	const environmentPrefix = Object.entries(command.env).flatMap(([key, value]) => value === void 0 ? [] : [`${key}=${quotePosix(value)}`]).join(" ");
-	const body = [command.bin, ...command.args].map(quotePosix).join(" ");
-	return environmentPrefix.length > 0 ? `${environmentPrefix} ${body}` : body;
-}
+const OUT_OF_MEMORY = /ERR_WORKER_OUT_OF_MEMORY|heap out of memory/;
+/** The signals that cancel a run, matching `concurrently`'s `KillOnSignal`. */
+const CANCEL_SIGNALS = [
+	"SIGHUP",
+	"SIGINT",
+	"SIGTERM"
+];
 /**
-* Build the command string concurrently runs through a shell. The tool is
-* launched via `node <binJs>` so no `.cmd`/`.ps1` shim quoting is involved.
-*
-* @param nodePath - Absolute path to the Node executable.
-* @param binJsPath - Absolute path to the tool's JavaScript entry.
-* @param args - The tool arguments.
-* @param platform - The platform whose shell quoting rules to apply.
-* @returns The shell command string.
+* The first cancelling signal received while this run's children were running.
+* Shared across `execute` calls on purpose: a run is a sequence of them (three
+* for a `--fix` run), and once the user has cancelled one of them none of
+* the rest may start. {@link resetCancellation} Scopes it to one run.
 */
-function buildShellCommand(nodePath, binJsPath, args, platform) {
-	const tokens = [
-		nodePath,
-		binJsPath,
-		...args
-	];
-	if (platform === "win32") {
-		const offending = tokens.find((token) => token.includes("%"));
-		if (offending !== void 0) throw new CliError(`Cannot safely pass "${offending}" to cmd.exe: "%" triggers environment-variable expansion even inside quotes. Remove it, or run the tool directly.`);
-	}
-	const quote = platform === "win32" ? quoteWindows : quotePosix;
-	return tokens.map(quote).join(" ");
-}
-function quotePosix(token) {
-	if (token.length > 0 && SAFE_TOKEN.test(token)) return token;
-	return `'${token.replaceAll("'", "'\\''")}'`;
-}
-function quoteWindows(token) {
-	if (token.length > 0 && SAFE_TOKEN.test(token)) return token;
-	let escaped = "";
-	let slashes = 0;
-	for (const char of token) {
-		if (char === "\\") {
-			slashes += 1;
-			escaped += char;
-			continue;
-		}
-		escaped += char === "\"" ? `${"\\".repeat(slashes)}\\"` : char;
-		slashes = 0;
-	}
-	return `"${escaped}${"\\".repeat(slashes)}"`;
+let cancelledBy;
+/**
+* Forget any cancellation recorded by an earlier run in this process. Called
+* as a run starts, so a second `runLint` in the same process is not refused
+* for a signal the first one received.
+*/
+function resetCancellation() {
+	cancelledBy = void 0;
 }
-//#endregion
-//#region src/lint-cli/lib/exec/execute.ts
 /** Prefix colour per child label for `concurrently`; kept visually distinct. */
 const PREFIX_COLOR = {
 	eslint: "blue",
@@ -802,6 +1065,17 @@ const PREFIX_COLOR = {
 	typed: "cyan"
 };
 /**
+* The hint printed after a program-building child ran out of heap, below the
+* engine's own stack trace.
+*
+* @param label - The child's label.
+* @returns One stderr line.
+*/
+function outOfMemoryHint(label) {
+	return `isentinel-lint: the ${label} ESLint pass ran out of memory. Set ${HEAP_ENV}=<mb> to give each worker more heap; the runner starts fewer workers to keep them in budget.
+`;
+}
+/**
 * Run the composed children and aggregate their exit codes.
 *
 * Sequential when the caller asks for it: a lone child gains nothing from the
@@ -818,7 +1092,8 @@ const PREFIX_COLOR = {
 * @returns The aggregated exit code.
 */
 async function execute(commands, cwd, sequential) {
-	return sequential ? runSequential(commands, cwd) : startGroup(commands, cwd);
+	const code = await (sequential ? runSequential(commands, cwd) : startGroup(commands, cwd));
+	return cancelledCode() ?? code;
 }
 /**
 * Run a staged set of children: spawn `commands` now, then resolve the rest and
@@ -845,13 +1120,19 @@ async function execute(commands, cwd, sequential) {
 async function executeStaged(commands, cwd, resolveDeferred) {
 	const eager = startGroup(commands, cwd);
 	const deferred = resolveDeferred();
-	if (deferred.length === 0) return eager;
+	await new Promise((resolve) => {
+		setImmediate(resolve);
+	});
+	if (cancelledBy !== void 0 || deferred.length === 0) {
+		const eagerCode = await eager;
+		return cancelledCode() ?? eagerCode;
+	}
 	const held = createHeldOutput();
 	const later = startGroup(deferred, cwd, held.stream);
 	const eagerCode = await eager;
 	held.release();
 	const deferredCode = await later;
-	return eagerCode === 0 ? deferredCode : eagerCode;
+	return cancelledCode() ?? (eagerCode === 0 ? deferredCode : eagerCode);
 }
 /**
 * Announce a child on stderr once it has been spawned. `concurrently` groups
@@ -867,30 +1148,188 @@ function announce(command) {
 	process$1.stderr.write(`${prefix} spawned ${command.bin}\n`);
 }
 /**
+* The names the children of one group are registered and logged under: the
+* engine, never its arguments. `concurrently` prints the name on each child's
+* exit line, so it must stay short however many files the child lints. The
+* line already carries the pass as its prefix (`[fast] eslint exited with code
+* 1`), so the pass only joins the name when two children share an engine.
+*
+* @param commands - The group's children.
+* @returns Each child paired with a name unique within the group.
+*/
+function nameCommands(commands) {
+	const taken = /* @__PURE__ */ new Set();
+	return commands.map((command) => {
+		const base = commands.filter((other) => other.bin === command.bin).length > 1 ? `${command.bin} (${command.label})` : command.bin;
+		let name = base;
+		let suffix = 1;
+		while (taken.has(name)) {
+			suffix += 1;
+			name = `${base} #${String(suffix)}`;
+		}
+		taken.add(name);
+		return [name, command];
+	});
+}
+/**
+* Spawn an engine child through the bootstrap and stream it its arguments.
+*
+* The OS command line is always `node <bootstrap> <bin>`, with no shell, so its
+* length does not depend on the file list and no path is ever interpreted by a
+* shell. The complete argument list follows as JSON on the child's stdin,
+* which is why stdin is always a pipe here whatever the caller asked for.
+*
+* @param launch - The child and its resolved bin.
+* @param options - Spawn options (cwd, env, stdout/stderr handling).
+* @returns The spawned child.
+*/
+function launchEngine({ bin, command }, options) {
+	const stdio = Array.isArray(options.stdio) ? options.stdio : [];
+	const child = spawn(process$1.execPath, [resolveBootstrap(), bin], {
+		...options,
+		shell: false,
+		stdio: [
+			"pipe",
+			stdio[1] ?? "inherit",
+			stdio[2] ?? "inherit"
+		]
+	});
+	child.stdin?.on("error", () => {});
+	child.stdin?.end(JSON.stringify(command.args));
+	return child;
+}
+/**
+* Kill a group's children and stop it spawning more when its output stream
+* fails — typically `EPIPE` once the reader of a piped report (`| head`) has
+* gone. Mirrors `concurrently`'s own `OutputErrorHandler`, which its package
+* exports do not expose.
+*
+* @param outputStream - The stream the group writes to.
+* @param abortController - Aborts the group.
+* @returns The flow controller.
+*/
+function killOnOutputError(outputStream, abortController) {
+	return { handle: (commands) => {
+		function onError() {
+			for (const command of commands) command.kill();
+			abortController.abort();
+		}
+		outputStream.on("error", onError);
+		return {
+			commands,
+			onFinish: () => {
+				outputStream.off("error", onError);
+			}
+		};
+	} };
+}
+/**
+* Record a cancelling signal for as long as children are running, and hand it
+* to `onSignal`. Listening at all replaces Node's default of exiting on the
+* signal, which is what lets the children be stopped and reaped first rather
+* than orphaned.
+*
+* @param onSignal - Forwards the signal to the running children; omitted when
+*   something else (`concurrently`'s `KillOnSignal`) already does.
+* @returns Removes the listeners.
+*/
+function trackCancellation(onSignal) {
+	function listener(signal) {
+		cancelledBy ??= signal;
+		onSignal?.(signal);
+	}
+	for (const signal of CANCEL_SIGNALS) process$1.on(signal, listener);
+	return () => {
+		for (const signal of CANCEL_SIGNALS) process$1.off(signal, listener);
+	};
+}
+/**
+* Watch a child's stderr for V8's out-of-memory report. Reads alongside
+* whatever else consumes the stream, and never alters it.
+*
+* @param child - The spawned child.
+* @param onExhausted - Called once, when the report is seen.
+*/
+function watchOutOfMemory(child, onExhausted) {
+	let tail = "";
+	let seen = false;
+	child.stderr?.on("data", (chunk) => {
+		if (seen) return;
+		const text = tail + String(chunk);
+		if (OUT_OF_MEMORY.test(text)) {
+			seen = true;
+			onExhausted();
+			return;
+		}
+		tail = text.slice(-64);
+	});
+}
+/**
 * Start every command as one `concurrently` group and announce the children.
 * Unlike the previous `killOthersOn: ["failure"]` behaviour, an ordinary lint
 * failure in one child no longer kills its siblings — each runs to the end so
 * the user keeps every result. The resolved code is non-zero when any child
 * exited non-zero; the promise never rejects.
 *
+* Built on `concurrently`'s core rather than its default export, because the
+* wrapper always launches a command *string* through a shell (`cmd.exe` on
+* Windows), and that string would have to carry every lint target. Here the
+* group's spawner launches each engine directly through the bootstrap (see
+* {@link launchEngine}); the command string is only the label `concurrently`
+* logs. The controllers are the ones the wrapper wires that do anything under
+* the options this runner always used — output and error logging, exit lines,
+* signal forwarding and the broken-output-pipe guard — and nothing else.
+*
 * @param commands - The child commands to run.
 * @param cwd - The working directory.
 * @param outputStream - Where the group writes its child output; defaults to
 *   stdout. A staged run passes a held stream (see {@link createHeldOutput}).
 * @returns The aggregated exit code.
 */
-async function startGroup(commands, cwd, outputStream) {
-	const { result } = concurrently(commands.map((command) => {
+async function startGroup(commands, cwd, outputStream = process$1.stdout) {
+	if (cancelledBy !== void 0 || commands.length === 0) return 0;
+	const launches = new Map(nameCommands(commands).map(([name, command]) => {
+		return [name, {
+			bin: resolveLocalBin(command.bin, cwd),
+			command
+		}];
+	}));
+	const logger = new Logger({});
+	const exhausted = /* @__PURE__ */ new Set();
+	const abortController = new AbortController();
+	const stopTracking = trackCancellation();
+	const { result } = createConcurrently(Array.from(launches, ([name, { command }]) => {
 		return {
 			name: command.label,
-			command: buildShellCommand(process$1.execPath, resolveLocalBin(command.bin, cwd), command.args, process$1.platform),
+			command: name,
 			env: command.env,
 			prefixColor: PREFIX_COLOR[command.label]
 		};
 	}), {
+		abortSignal: abortController.signal,
+		controllers: [
+			new LogError({ logger }),
+			new LogOutput({ logger }),
+			new LogExit({ logger }),
+			new KillOnSignal({
+				abortController,
+				process: process$1
+			}),
+			killOnOutputError(outputStream, abortController)
+		],
 		cwd,
 		group: true,
-		outputStream
+		logger,
+		outputStream,
+		spawn: (name, options) => {
+			const launch = launches.get(name);
+			if (launch === void 0) throw new Error(`isentinel-lint: no engine registered as "${name}".`);
+			const child = launchEngine(launch, options);
+			if (launch.command.watchHeap) watchOutOfMemory(child, () => {
+				exhausted.add(launch.command.label);
+			});
+			return child;
+		}
 	});
 	for (const command of commands) announce(command);
 	try {
@@ -898,31 +1337,70 @@ async function startGroup(commands, cwd, outputStream) {
 		return 0;
 	} catch {
 		return 1;
+	} finally {
+		stopTracking();
+		for (const label of exhausted) process$1.stderr.write(outOfMemoryHint(label));
 	}
 }
+function signalExitCode(signal) {
+	return 128 + os.constants.signals[signal];
+}
+/**
+* The exit code for a cancelled run (`128 + signal number`, as a shell reports
+* it), or `undefined` when nothing cancelled it.
+*
+* @returns The exit code, when cancelled.
+*/
+function cancelledCode() {
+	return cancelledBy === void 0 ? void 0 : signalExitCode(cancelledBy);
+}
 async function spawnChild(command, cwd) {
-	const binJsPath = resolveLocalBin(command.bin, cwd);
+	const bin = resolveLocalBin(command.bin, cwd);
+	const watched = command.watchHeap;
+	let exhausted = false;
 	return new Promise((resolve) => {
-		const child = spawn(process$1.execPath, [binJsPath, ...command.args], {
+		const child = launchEngine({
+			bin,
+			command
+		}, {
 			cwd,
 			env: {
 				...process$1.env,
 				...command.env
 			},
-			stdio: "inherit"
+			stdio: [
+				"inherit",
+				"inherit",
+				watched ? "pipe" : "inherit"
+			]
 		});
+		if (watched) {
+			child.stderr?.on("data", (chunk) => {
+				process$1.stderr.write(chunk);
+			});
+			watchOutOfMemory(child, () => {
+				exhausted = true;
+			});
+		}
 		announce(command);
+		const stopTracking = trackCancellation((signal) => {
+			child.kill(signal);
+		});
 		child.on("error", () => {
+			stopTracking();
 			resolve(1);
 		});
-		child.on("close", (code) => {
-			resolve(code ?? 1);
+		child.on("close", (code, signal) => {
+			stopTracking();
+			if (exhausted) process$1.stderr.write(outOfMemoryHint(command.label));
+			resolve(code ?? (signal === null ? 1 : signalExitCode(signal)));
 		});
 	});
 }
 async function runSequential(commands, cwd) {
 	let exitCode = 0;
 	for (const command of commands) {
+		if (cancelledBy !== void 0) break;
 		const code = await spawnChild(command, cwd);
 		if (code !== 0) exitCode = code;
 	}
@@ -961,6 +1439,26 @@ function createHeldOutput() {
 	};
 }
 //#endregion
+//#region src/lint-cli/lib/exec/shell.ts
+const SAFE_TOKEN = /^[\w@+=:,./-]+$/;
+/**
+* Render a command as a shell-equivalent line (env prefix + logical binary +
+* arguments) for `--print`. Uses POSIX quoting for stable, cross-platform
+* output.
+*
+* @param command - The child command to render.
+* @returns The shell-equivalent command line.
+*/
+function formatCommandLine(command) {
+	const environmentPrefix = Object.entries(command.env).flatMap(([key, value]) => value === void 0 ? [] : [`${key}=${quotePosix(value)}`]).join(" ");
+	const body = [command.bin, ...command.args].map(quotePosix).join(" ");
+	return environmentPrefix.length > 0 ? `${environmentPrefix} ${body}` : body;
+}
+function quotePosix(token) {
+	if (token.length > 0 && SAFE_TOKEN.test(token)) return token;
+	return `'${token.replaceAll("'", "'\\''")}'`;
+}
+//#endregion
 //#region src/lint-cli/lib/plan/command.ts
 /**
 * Compose the oxlint child command.
@@ -974,12 +1472,13 @@ function composeOxlintCommand(options, context) {
 	if (options.agents) args.push("--format", "agent");
 	if (context.oxlintTypeAware) args.push("--type-aware");
 	if (options.fix) args.push("--fix");
-	args.push("--no-error-on-unmatched-pattern", ...options.oxlintArgs, ...context.paths);
+	args.push("--no-error-on-unmatched-pattern", ...options.oxlintArgs, ...pathArguments(context.paths));
 	return {
 		args,
 		bin: "oxlint",
 		env: {},
-		label: "oxc"
+		label: "oxc",
+		watchHeap: false
 	};
 }
 /**
@@ -996,14 +1495,30 @@ function composeEslintCommand(options, context) {
 	if (options.cache && context.ci) args.push("--cache-strategy", "content");
 	if (options.agents) args.push("--format", context.agentsFormatterPath);
 	if (context.fix) args.push("--fix");
-	args.push(...options.eslintArgs, ...context.paths);
+	args.push(...options.eslintArgs, ...pathArguments(context.paths));
+	const environment = { ESLINT_TYPE_AWARE: context.typeAwareEnv };
+	if (context.heap?.nodeOptions !== void 0) environment["NODE_OPTIONS"] = context.heap.nodeOptions;
 	return {
 		args,
 		bin: "eslint",
-		env: { ESLINT_TYPE_AWARE: context.typeAwareEnv },
-		label: context.eslintLabel
+		env: environment,
+		label: context.eslintLabel,
+		watchHeap: context.heap?.watch ?? false
 	};
 }
+/**
+* The lint targets as the tail of an engine's argument list. A relative target
+* that starts with `-` would be read as a flag, so it is passed as `./<path>`.
+* A `--` separator is not enough: ESLint's bin scans the raw argv for
+* `--init`, `--mcp`, `--stdin` and `--debug` regardless of it, so a listed file
+* named `--init` would start the config wizard.
+*
+* @param paths - The lint targets.
+* @returns The arguments that pass them as paths.
+*/
+function pathArguments(paths) {
+	return paths.map((target) => target.startsWith("-") ? `./${target}` : target);
+}
 //#endregion
 //#region src/lint-cli/lib/plan/compose.ts
 /** The stderr notice emitted when a lint target resolves outside the cwd. */
@@ -1036,6 +1551,7 @@ function composePasses(passes, runPlan, options) {
 			concurrency: pass.concurrency,
 			eslintLabel: pass.descriptor.label,
 			fix: false,
+			heap: pass.heap,
 			paths: options.paths,
 			typeAwareEnv: pass.descriptor.typeAwareEnv
 		}));
@@ -1170,7 +1686,7 @@ function applyHashBust(run, bust, hash) {
 	const cleared = [];
 	for (const base of bust.caches) {
 		const cacheFilePath = path.resolve(run.cwd, cacheFileFor(base, run.key));
-		fs.rmSync(cacheFilePath, { force: true });
+		fs$1.rmSync(cacheFilePath, { force: true });
 		cleared.push(cacheFilePath);
 	}
 	return {
@@ -1447,7 +1963,7 @@ function normalizePath(filePath, platform = process$1.platform) {
 * @returns The loaded cache, or `undefined` when the file does not exist.
 */
 function openCache(cacheFilePath, useChecksum) {
-	if (!fs.existsSync(cacheFilePath)) return;
+	if (!fs$1.existsSync(cacheFilePath)) return;
 	const cache = load(cacheFilePath, useChecksum);
 	return {
 		filesWithMessages: (files) => filesWithMessagesIn(cache, files),
@@ -1457,7 +1973,7 @@ function openCache(cacheFilePath, useChecksum) {
 }
 function safeMtimeMs(filePath) {
 	try {
-		return fs.statSync(filePath).mtimeMs;
+		return fs$1.statSync(filePath).mtimeMs;
 	} catch {
 		return;
 	}
@@ -1474,7 +1990,7 @@ function safeMtimeMs(filePath) {
 function listCacheFiles(cwd) {
 	let entries;
 	try {
-		entries = fs.readdirSync(cwd);
+		entries = fs$1.readdirSync(cwd);
 	} catch {
 		return [];
 	}
@@ -1482,7 +1998,7 @@ function listCacheFiles(cwd) {
 }
 function removeCacheFile(cacheFilePath) {
 	try {
-		fs.rmSync(cacheFilePath, { force: true });
+		fs$1.rmSync(cacheFilePath, { force: true });
 	} catch {}
 }
 /**
@@ -3491,7 +4007,7 @@ const WALK_BUDGET = 8192;
 function findWorkspaceRoot(cwd) {
 	let current = cwd;
 	for (;;) {
-		for (const marker of WORKSPACE_ROOT_MARKERS) if (fs.existsSync(path.join(current, marker))) return current;
+		for (const marker of WORKSPACE_ROOT_MARKERS) if (fs$1.existsSync(path.join(current, marker))) return current;
 		const parent = path.dirname(current);
 		if (parent === current) return cwd;
 		current = parent;
@@ -3535,7 +4051,7 @@ function findWorkspaceMembers(root) {
 	function walk(directory, depth) {
 		let entries;
 		try {
-			entries = fs.readdirSync(directory, { withFileTypes: true });
+			entries = fs$1.readdirSync(directory, { withFileTypes: true });
 		} catch {
 			return true;
 		}
@@ -3545,7 +4061,7 @@ function findWorkspaceMembers(root) {
 			if (budget < 0) return false;
 			const absolute = path.join(directory, entry.name);
 			const relative = toPosix(path.relative(root, absolute));
-			if (isMember(relative) && fs.existsSync(path.join(absolute, "package.json"))) members.push(absolute);
+			if (isMember(relative) && fs$1.existsSync(path.join(absolute, "package.json"))) members.push(absolute);
 			if (depth < maxDepth && !walk(absolute, depth + 1)) return false;
 		}
 		return true;
@@ -3873,7 +4389,7 @@ function oxlintTargets(cwd, targets) {
 		const extension = path.extname(target).toLowerCase();
 		if (extension === "" || TYPE_AWARE_EXTENSION_SET.has(extension)) return true;
 		try {
-			return fs.statSync(path.resolve(cwd, target)).isDirectory();
+			return fs$1.statSync(path.resolve(cwd, target)).isDirectory();
 		} catch {
 			return false;
 		}
@@ -3910,7 +4426,7 @@ function collectAncestorBustFiles(cwd) {
 	for (;;) {
 		let entries = [];
 		try {
-			entries = fs.readdirSync(current, { withFileTypes: true });
+			entries = fs$1.readdirSync(current, { withFileTypes: true });
 		} catch {
 			entries = [];
 		}
@@ -3933,7 +4449,7 @@ function collectAncestorBustFiles(cwd) {
 * @returns The normalized cwd-relative posix target.
 */
 function normalizeTarget(target, cwd) {
-	let value = path.isAbsolute(target) ? toPosix(path.relative(cwd, target)) : toPosix(target);
+	let value = path.isAbsolute(target) ? toPosix(path.relative(cwd, target)) : path.posix.normalize(toPosix(target));
 	if (value.startsWith("./")) value = value.slice(2);
 	while (value.endsWith("/")) value = value.slice(0, -1);
 	return value;
@@ -3960,8 +4476,15 @@ function isOutsideCwd(normalizedTarget) {
 */
 function matchTargets(normalized) {
 	if (normalized.some((target) => target === "" || target === ".")) return () => true;
+	const targets = new Set(normalized);
 	return (relative) => {
-		return normalized.some((target) => relative === target || relative.startsWith(`${target}/`));
+		let candidate = relative;
+		for (;;) {
+			if (targets.has(candidate)) return true;
+			const slash = candidate.lastIndexOf("/");
+			if (slash === -1) return false;
+			candidate = candidate.slice(0, slash);
+		}
 	};
 }
 function isTypeAwareFile(filePath) {
@@ -3974,6 +4497,7 @@ function gitListFiles(cwd, pathSpecs) {
 	try {
 		return execFileSync("git", [
 			"ls-files",
+			"-z",
 			"--cached",
 			"--others",
 			"--exclude-standard",
@@ -3983,7 +4507,7 @@ function gitListFiles(cwd, pathSpecs) {
 			cwd,
 			encoding: "utf8",
 			maxBuffer: 64 * 1024 * 1024
-		}).split("\n").filter((line) => line.length > 0);
+		}).split("\0").filter((line) => line.length > 0);
 	} catch {
 		return;
 	}
@@ -3991,7 +4515,7 @@ function gitListFiles(cwd, pathSpecs) {
 function walkDirectory(root, current, accumulator) {
 	let entries;
 	try {
-		entries = fs.readdirSync(current, { withFileTypes: true });
+		entries = fs$1.readdirSync(current, { withFileTypes: true });
 	} catch {
 		return;
 	}
@@ -4010,7 +4534,7 @@ function walkFallback(cwd, targets) {
 		const absolute = path.resolve(cwd, target);
 		let stat;
 		try {
-			stat = fs.statSync(absolute);
+			stat = fs$1.statSync(absolute);
 		} catch {
 			continue;
 		}
@@ -4049,11 +4573,12 @@ function gitIgnoredTargets(cwd, targets) {
 		const output = execFileSync("git", [
 			"check-ignore",
 			"--no-index",
-			"--stdin"
+			"--stdin",
+			"-z"
 		], {
 			cwd,
 			encoding: "utf8",
-			input: targets.join("\n"),
+			input: `${targets.join("\0")}\0`,
 			maxBuffer: 64 * 1024 * 1024,
 			stdio: [
 				"pipe",
@@ -4061,7 +4586,7 @@ function gitIgnoredTargets(cwd, targets) {
 				"ignore"
 			]
 		});
-		return new Set(output.split("\n").map((line) => line.trim()).filter(Boolean));
+		return new Set(output.split("\0").filter(Boolean));
 	} catch {
 		return /* @__PURE__ */ new Set();
 	}
@@ -4334,7 +4859,7 @@ function queryIgnoredFiles(cwd, targets) {
 				"ignore"
 			]
 		});
-		const parsed = JSON.parse(fs.readFileSync(outFile, "utf8"));
+		const parsed = JSON.parse(fs$1.readFileSync(outFile, "utf8"));
 		if (!isRecord(parsed)) return;
 		const { basePath, entries, ignored, mode } = parsed;
 		if (mode === "answers" && isStringArray(ignored)) return {
@@ -4350,7 +4875,7 @@ function queryIgnoredFiles(cwd, targets) {
 	} catch {
 		return;
 	} finally {
-		fs.rmSync(outFile, { force: true });
+		fs$1.rmSync(outFile, { force: true });
 	}
 }
 //#endregion
@@ -4393,7 +4918,7 @@ function readHybridStatus(cwd) {
 function writeHybridStatus(cwd, oxlint) {
 	let installed;
 	try {
-		installed = fs.existsSync(path.resolve(cwd, "node_modules"));
+		installed = fs$1.existsSync(path.resolve(cwd, "node_modules"));
 	} catch {
 		return;
 	}
@@ -4572,6 +5097,7 @@ function resolveWorkerLimits(environment, availableParallelism, ci) {
 	const explicit = parsePositiveInteger(environment["LINT_MAX_WORKERS"]);
 	const maxWorkers = explicit ?? (ci ? availableParallelism : Math.floor(availableParallelism / 4));
 	return {
+		explicitMaxWorkers: explicit !== void 0,
 		filesPerWorker,
 		maxWorkers,
 		typedMaxWorkers: explicit ?? Math.min(maxWorkers, 6)
@@ -4664,6 +5190,17 @@ function selectPasses(options, ci) {
 	return [FAST_PASS, TYPED_PASS];
 }
 /**
+* Whether a pass builds a TypeScript program in each of its workers. The pass
+* that runs no builder is exactly the one that builds no program, so
+* `invalidation` records both.
+*
+* @param descriptor - The pass.
+* @returns Whether its workers hold a program, and so need heap sizing.
+*/
+function buildsProgram(descriptor) {
+	return descriptor.invalidation !== "none";
+}
+/**
 * The worker cap for a pass. `invalidation` already records whether a pass
 * builds a TypeScript program — the fast pass runs no builder precisely because
 * it builds none — so it doubles as the cap selector rather than restating the
@@ -4674,7 +5211,7 @@ function selectPasses(options, ci) {
 * @returns The worker cap for this pass.
 */
 function maxWorkersFor(descriptor, limits) {
-	return descriptor.invalidation === "none" ? limits.maxWorkers : limits.typedMaxWorkers;
+	return buildsProgram(descriptor) ? limits.typedMaxWorkers : limits.maxWorkers;
 }
 //#endregion
 //#region src/lint-cli/lib/plan/fix.ts
@@ -4739,13 +5276,18 @@ function collectFixTargets(passes, run, files) {
 * @returns The fix child, or `undefined` when nothing was reported.
 */
 function planFixChild(passes, run, inputs) {
-	const { files, limits, options } = inputs;
+	const { files, heap, limits, options } = inputs;
 	const covered = options.cache ? collectFixTargets(passes, run, files) : [];
 	const uncovered = options.cache ? files.outsideCwdTargets : options.paths;
 	const targets = [...covered, ...uncovered];
 	if (targets.length === 0) return;
 	const cacheFile = cacheFileFor(CACHE_FILE_DEFAULT, run.key);
 	if (covered.length > 0) openCache(path.resolve(run.cwd, cacheFile), run.ci)?.removeEntries(covered);
+	const concurrency = options.concurrency ?? computeWorkerCount({
+		dirtyCount: targets.length,
+		filesPerWorker: limits.filesPerWorker,
+		maxWorkers: capWorkersForHeap(limits.typedMaxWorkers, limits.explicitMaxWorkers, heap)
+	});
 	return composeEslintCommand({
 		...options,
 		cache: options.cache && uncovered.length === 0
@@ -4753,13 +5295,13 @@ function planFixChild(passes, run, inputs) {
 		agentsFormatterPath: inputs.agentsFormatterPath,
 		cacheLocation: cacheFile,
 		ci: run.ci,
-		concurrency: options.concurrency ?? computeWorkerCount({
-			dirtyCount: targets.length,
-			filesPerWorker: limits.filesPerWorker,
-			maxWorkers: limits.typedMaxWorkers
-		}),
+		concurrency,
 		eslintLabel: FULL_PASS.label,
 		fix: true,
+		heap: planPassHeap(FULL_PASS.label, heap, {
+			concurrency,
+			dirtyCount: targets.length
+		}),
 		paths: targets,
 		typeAwareEnv: FULL_PASS.typeAwareEnv
 	});
@@ -5096,7 +5638,7 @@ function computeAffectedFiles({ key, cwd }, mode) {
 			if (entryReadable) warnOnce(`no TypeScript files resolved from ${path.basename(configPath)}; skipping type-aware cache invalidation`);
 			return;
 		}
-		fs.mkdirSync(stateDirectory(cwd), { recursive: true });
+		fs$1.mkdirSync(stateDirectory(cwd), { recursive: true });
 		const resolutionGate = computeResolutionGate(cwd);
 		const affected = /* @__PURE__ */ new Set();
 		let warmProjects = 0;
@@ -5143,7 +5685,7 @@ function computeAffectedFiles({ key, cwd }, mode) {
 function hasBuilderState({ key, cwd }, mode) {
 	const prefix = `${path.basename(statePath(cwd, BUILD_INFO_STATE, modeSuffix(mode), key))}-`;
 	try {
-		return fs.readdirSync(stateDirectory(cwd)).some((name) => name.startsWith(prefix) && !name.endsWith(".tmp"));
+		return fs$1.readdirSync(stateDirectory(cwd)).some((name) => name.startsWith(prefix) && !name.endsWith(".tmp"));
 	} catch {
 		return false;
 	}
@@ -5358,10 +5900,10 @@ function persistBuilderState(builder, buildInfoPath) {
 		if (path.normalize(fileName) !== normalizedBuildInfo) return;
 		const temporary = `${fileName}.${process$1.pid}.tmp`;
 		try {
-			fs.writeFileSync(temporary, data);
-			fs.renameSync(temporary, fileName);
+			fs$1.writeFileSync(temporary, data);
+			fs$1.renameSync(temporary, fileName);
 		} catch (err) {
-			fs.rmSync(temporary, { force: true });
+			fs$1.rmSync(temporary, { force: true });
 			throw err;
 		}
 	});
@@ -5376,7 +5918,7 @@ function persistBuilderState(builder, buildInfoPath) {
 */
 function writeGateState(gatePath, gateValue) {
 	if (gateValue === void 0) {
-		fs.rmSync(gatePath, { force: true });
+		fs$1.rmSync(gatePath, { force: true });
 		return;
 	}
 	writeState(gatePath, gateValue);
@@ -5397,7 +5939,7 @@ function writeGateState(gatePath, gateValue) {
 * @returns The affected result.
 */
 function runBuilder({ buildInfoPath, gatePath, project, resolutionGate, ts }) {
-	const firstRun = !fs.existsSync(buildInfoPath);
+	const firstRun = !fs$1.existsSync(buildInfoPath);
 	const options = {
 		...project.options,
 		composite: false,
@@ -5480,7 +6022,7 @@ function applyTypeAwareInvalidation(run, { alreadyDirty, cache, cacheLocation, m
 	}
 	const threshold = resolveAffectedBustThreshold(run.environment);
 	if (affectedTargets.length > threshold) {
-		fs.rmSync(cacheLocation, { force: true });
+		fs$1.rmSync(cacheLocation, { force: true });
 		return {
 			busted: true,
 			firstRun: false,
@@ -5539,12 +6081,12 @@ function sizePasses(descriptors, run, inputs) {
 * @returns The number of dirty files.
 */
 function mutatingDirtyCount(descriptor, cacheLocation, targetFiles, { clearedCaches, run }) {
-	const buildsProgram = descriptor.invalidation !== "none";
+	const program = buildsProgram(descriptor);
 	const mode = descriptor.invalidation === "only" ? "only" : void 0;
-	if (clearedCaches.has(cacheLocation) && (!buildsProgram || hasBuilderState(run, mode))) return targetFiles.length;
+	if (clearedCaches.has(cacheLocation) && (!program || hasBuilderState(run, mode))) return targetFiles.length;
 	const cache = openCache(cacheLocation, run.ci);
 	const dirty = new Set((cache?.getUpdatedFiles(targetFiles) ?? targetFiles).map((file) => normalizePath(file)));
-	if (buildsProgram) {
+	if (program) {
 		const outcome = applyTypeAwareInvalidation(run, {
 			alreadyDirty: dirty,
 			cache,
@@ -5601,17 +6143,24 @@ function sizePass(descriptor, context) {
 	const dirtyCount = passDirtyCount(descriptor, cacheFile, context);
 	const conservative = context.files.outsideCwdTargets.length > 0;
 	const filesPerWorker = descriptor.filesPerWorker(context.limits, context.run.environment);
-	const maxWorkers = maxWorkersFor(descriptor, context.limits);
+	const program = buildsProgram(descriptor);
+	const passMaxWorkers = maxWorkersFor(descriptor, context.limits);
+	const maxWorkers = program ? capWorkersForHeap(passMaxWorkers, context.limits.explicitMaxWorkers, context.heap) : passMaxWorkers;
 	const sizingDirtyCount = conservative ? maxWorkers * filesPerWorker : dirtyCount;
 	const concurrency = context.options.concurrency ?? computeWorkerCount({
 		dirtyCount: sizingDirtyCount,
 		filesPerWorker,
 		maxWorkers
 	});
+	const heap = program ? planPassHeap(descriptor.label, context.heap, {
+		concurrency,
+		dirtyCount: sizingDirtyCount
+	}) : void 0;
 	if (context.run.mutate && context.multiPass && descriptor === TYPED_PASS && !conservative && dirtyCount === 0) return {
 		cacheFile,
 		concurrency,
 		descriptor,
+		heap,
 		shouldRun: false,
 		skipReason: TYPED_SKIP_NOTICE
 	};
@@ -5619,6 +6168,7 @@ function sizePass(descriptor, context) {
 		cacheFile,
 		concurrency,
 		descriptor,
+		heap,
 		shouldRun: true,
 		skipReason: void 0
 	};
@@ -5639,9 +6189,10 @@ function sizePass(descriptor, context) {
 *
 * @param options - The parsed CLI options.
 * @param run - The run context (cwd, variant key, environment, mutate).
+* @param memory - The machine's memory facts (injected in tests).
 * @returns The staged run plan.
 */
-function plan(options, run) {
+function plan(options, run, memory = probeMemory()) {
 	const { ci, cwd, environment, mutate } = run;
 	const runEslint = !options.oxlint;
 	const oxlintTypeAware = resolveOxlintTypeAware(options);
@@ -5666,6 +6217,7 @@ function plan(options, run) {
 	const files = collectRepoFiles(cwd, options.paths);
 	const newestBustMtime = maxMtimeMs(files.bustFiles);
 	const limits = resolveWorkerLimits(environment, availableParallelism(), ci);
+	const heap = resolveHeapBudget(environment, memory);
 	const oxlintDecision = resolveOxlintRun(run, {
 		files,
 		runEslint,
@@ -5685,6 +6237,7 @@ function plan(options, run) {
 	const inputs = {
 		clearedCaches,
 		files: sizingFiles,
+		heap,
 		limits,
 		multiPass: descriptors.length > 1,
 		newestBustMtime,
@@ -5712,6 +6265,7 @@ function plan(options, run) {
 			return planFixChild(passes, run, {
 				agentsFormatterPath,
 				files: sizingFiles,
+				heap,
 				limits,
 				options
 			});
@@ -5767,15 +6321,20 @@ function stageDescriptors(descriptors, run, staging) {
 * @param argv - The argument slice (without the node/bin prefix).
 * @param cwd - The working directory (defaults to `process.cwd()`; injected in tests).
 * @param environment - The process environment (defaults to `process.env`).
+* @param stdin - Where `--files0-from -` reads its list (defaults to
+*   `process.stdin`).
 * @returns The process exit code.
 * @rejects {CliError} When the arguments are invalid or a tool is missing.
 */
-async function runLint(argv, cwd = process$1.cwd(), environment = process$1.env) {
-	const options = parseArguments(argv, environment);
+async function runLint(argv, cwd = process$1.cwd(), environment = process$1.env, stdin = process$1.stdin) {
+	resetCancellation();
+	const options = await readFileList(parseArguments(argv, environment), cwd, stdin);
+	if (options.paths.length === 0) return 0;
 	const staged = plan(options, resolveRunContext(cwd, environment, !options.print));
 	const { commands, notice } = compose(staged.eager, options);
 	if (options.print) {
 		for (const command of commands) process$1.stdout.write(`${formatCommandLine(command)}\n`);
+		for (const pass of staged.eager.passes) if (pass.shouldRun && pass.heap !== void 0) process$1.stderr.write(pass.heap.note);
 		return 0;
 	}
 	if (commands.some((command) => command.bin === "oxlint" && command.args.includes("--type-aware")) && !isPackageExists("oxlint-tsgolint", { paths: [cwd] })) throw new CliError("oxlint-tsgolint is not installed, so oxlint cannot run type-aware rules. Install oxlint-tsgolint, or pass --no-oxlint-type-aware to skip type-aware linting.");
@@ -5824,7 +6383,7 @@ async function runChecks(commands, cwd, staged, options) {
 }
 //#endregion
 //#region src/lint-cli/index.ts
-const HELP = `isentinel-lint [flags] [paths...]
+const HELP = `isentinel-lint [flags] [paths... | --files0-from <file|->]
 
 Runs oxlint and ESLint together, sizing ESLint's --concurrency from how many
 files actually need re-linting and managing per-mode caches.
@@ -5844,6 +6403,9 @@ Flags:
   --concurrency <n|off>    Override the concurrency heuristic.
   --eslint-args "<args>"   Extra arguments for ESLint.
   --oxlint-args "<args>"   Extra arguments for oxlint.
+  --files0-from <file|->   Read the paths to lint from a NUL-delimited UTF-8
+                           list (- for stdin) instead of positional arguments.
+                           An empty list lints nothing and exits 0.
   --print                  Print the composed commands without running them.
   -- <args>                Forward args to the single selected tool.
   -h, --help               Show this help.