react-doctor 0.2.13 → 0.2.14-dev.09fe1ff

package/dist/index.js

@@ -59,6 +59,7 @@ var Diagnostic = class extends Schema.Class("Diagnostic")({
 	plugin: Schema.String,
 	rule: Schema.String,
 	severity: Severity,
+	title: Schema.optional(Schema.String),
 	message: Schema.String,
 	help: Schema.String,
 	url: Schema.optional(Schema.String),
@@ -2094,6 +2095,8 @@ const isFile = (filePath) => {
 	}
 };
 const SOURCE_FILE_PATTERN = /\.(tsx?|jsx?)$/;
+const GENERATED_BUNDLE_FILE_PATTERN = /\.(iife|umd|global|min)\.js$/i;
+const MINIFIED_SNIFF_BYTES = 65536;
 const GIT_LS_FILES_MAX_BUFFER_BYTES = 50 * 1024 * 1024;
 const IGNORED_DIRECTORIES = new Set([
 	".git",
@@ -2109,6 +2112,34 @@ const IGNORED_DIRECTORIES = new Set([
 	"out",
 	"storybook-static"
 ]);
+const isLintableSourceFile = (filePath) => SOURCE_FILE_PATTERN.test(filePath) && !GENERATED_BUNDLE_FILE_PATTERN.test(filePath);
+const isMinifiedSource = (absolutePath) => {
+	let fileDescriptor;
+	try {
+		fileDescriptor = fs.openSync(absolutePath, "r");
+		const buffer = Buffer.alloc(MINIFIED_SNIFF_BYTES);
+		const bytesRead = fs.readSync(fileDescriptor, buffer, 0, MINIFIED_SNIFF_BYTES, 0);
+		const prefix = buffer.toString("utf8", 0, bytesRead);
+		const lines = prefix.split("\n");
+		const longestLineLength = lines.reduce((longest, line) => Math.max(longest, line.length), 0);
+		const averageLineLength = prefix.length / lines.length;
+		return longestLineLength > 1e3 && averageLineLength > 500;
+	} catch {
+		return false;
+	} finally {
+		if (fileDescriptor !== void 0) fs.closeSync(fileDescriptor);
+	}
+};
+const isLargeMinifiedFile = (absolutePath) => {
+	let sizeBytes;
+	try {
+		sizeBytes = fs.statSync(absolutePath).size;
+	} catch {
+		return false;
+	}
+	if (sizeBytes < 2e4) return false;
+	return isMinifiedSource(absolutePath);
+};
 const IGNORABLE_READDIR_ERROR_CODES = new Set([
 	"EACCES",
 	"EPERM",
@@ -2139,7 +2170,7 @@ const countSourceFilesViaFilesystem = (rootDirectory) => {
 				if (!entry.name.startsWith(".") && !IGNORED_DIRECTORIES.has(entry.name)) stack.push(path.join(currentDirectory, entry.name));
 				continue;
 			}
-			if (entry.isFile() && SOURCE_FILE_PATTERN.test(entry.name)) count++;
+			if (entry.isFile() && isLintableSourceFile(entry.name) && !isLargeMinifiedFile(path.join(currentDirectory, entry.name))) count++;
 		}
 	}
 	return count;
@@ -2157,7 +2188,7 @@ const countSourceFilesViaGit = (rootDirectory) => {
 		maxBuffer: GIT_LS_FILES_MAX_BUFFER_BYTES
 	});
 	if (result.error || result.status !== 0) return null;
-	return result.stdout.split("\0").filter((filePath) => filePath.length > 0 && SOURCE_FILE_PATTERN.test(filePath)).length;
+	return result.stdout.split("\0").filter((filePath) => filePath.length > 0 && isLintableSourceFile(filePath) && !isLargeMinifiedFile(path.resolve(rootDirectory, filePath))).length;
 };
 const countSourceFiles = (rootDirectory) => countSourceFilesViaGit(rootDirectory) ?? countSourceFilesViaFilesystem(rootDirectory);
 const cachedPackageJsons = /* @__PURE__ */ new Map();
@@ -3240,7 +3271,15 @@ const STAGED_FILES_PROJECT_CONFIG_FILENAMES = [
 ];
 const OXLINT_OUTPUT_MAX_BYTES = 50 * 1024 * 1024;
 const OXLINT_SPAWN_TIMEOUT_MS = 6e4;
+const DEAD_CODE_WORKER_MAX_OLD_SPACE_MB = 8192;
 const RECOMMENDED_PNPM_MINIMUM_RELEASE_AGE_MINUTES = 10080;
+const DIAGNOSTIC_CATEGORY_BUCKETS = [
+	"Security",
+	"Bugs",
+	"Performance",
+	"Accessibility",
+	"Maintainability"
+];
 const MAX_GLOB_PATTERN_LENGTH_CHARS = 1024;
 const CONFIG_CACHE_TTL_MS = 300 * 1e3;
 var InvalidGlobPatternError = class extends Error {
@@ -3862,10 +3901,13 @@ const collectStringSet = (values) => {
 *    wins over `test-noise`)
 * 2. severity overrides (top-level `rules` / `categories`, with
 *    `"off"` dropping)
-* 3. ignore filters (rules / file patterns / per-file overrides)
-* 4. `rn-no-raw-text` suppression via configured `textComponents` and
+* 3. warning suppression (only when `showWarnings` is false: drops every
+*    `"warning"`-severity diagnostic unless a severity override opts a
+*    specific rule / category back in)
+* 4. ignore filters (rules / file patterns / per-file overrides)
+* 5. `rn-no-raw-text` suppression via configured `textComponents` and
 *    `rawTextWrapperComponents` (config-driven JSX enclosure checks)
-* 5. inline suppressions (`// react-doctor-disable-next-line ...`)
+* 6. inline suppressions (`// react-doctor-disable-next-line ...`)
 *
 * Returns `null` when the diagnostic is dropped, the (possibly
 * severity-restamped) diagnostic otherwise.
@@ -3875,7 +3917,7 @@ const collectStringSet = (values) => {
 * `mergeAndFilterDiagnostics` wrapper apply this closure per element.
 */
 const buildDiagnosticPipeline = (input) => {
-	const { rootDirectory, userConfig, readFileLinesSync, respectInlineDisables } = input;
+	const { rootDirectory, userConfig, readFileLinesSync, respectInlineDisables, showWarnings } = input;
 	const severityControls = buildRuleSeverityControls(userConfig);
 	const ignoredRules = new Set(Array.isArray(userConfig?.ignore?.rules) ? userConfig.ignore.rules.filter((rule) => typeof rule === "string") : []);
 	const ignoredFilePatterns = compileIgnoredFilePatterns(userConfig);
@@ -3925,15 +3967,17 @@ const buildDiagnosticPipeline = (input) => {
 	return { apply: (diagnostic) => {
 		if (shouldAutoSuppress(diagnostic)) return null;
 		let current = diagnostic;
+		let explicitSeverityOverride;
 		if (severityControls) {
 			const { ruleKey, category } = getDiagnosticRuleIdentity(current);
-			const override = resolveRuleSeverityOverride({
+			explicitSeverityOverride = resolveRuleSeverityOverride({
 				ruleKey,
 				category
 			}, severityControls);
-			if (override === "off") return null;
-			if (override !== void 0) current = restampSeverity(current, override);
+			if (explicitSeverityOverride === "off") return null;
+			if (explicitSeverityOverride !== void 0) current = restampSeverity(current, explicitSeverityOverride);
 		}
+		if (!showWarnings && current.severity === "warning" && explicitSeverityOverride !== "warn") return null;
 		if (userConfig) {
 			if (isRuleIgnored(`${current.plugin}/${current.rule}`)) return null;
 			if (isFileIgnoredByPatterns(current.filePath, rootDirectory, ignoredFilePatterns)) return null;
@@ -4165,10 +4209,18 @@ const VALID_RULE_SEVERITIES = [
 	"warn",
 	"off"
 ];
+const KNOWN_CATEGORY_LABEL = DIAGNOSTIC_CATEGORY_BUCKETS.join(", ");
+const isDiagnosticCategoryBucket = (value) => DIAGNOSTIC_CATEGORY_BUCKETS.includes(value);
+const filterKnownCategories = (fieldName, categories) => categories.filter((category) => {
+	if (isDiagnosticCategoryBucket(category)) return true;
+	warnConfigIssue(`config field "${fieldName}" lists "${category}", which is not a known category (expected one of: ${KNOWN_CATEGORY_LABEL}); ignoring the entry.`);
+	return false;
+});
 const BOOLEAN_FIELD_NAMES = [
 	"lint",
 	"deadCode",
 	"verbose",
+	"warnings",
 	"customRulesOnly",
 	"share",
 	"noScore",
@@ -4217,13 +4269,15 @@ const validateSurfaceControls = (surface, rawControls) => {
 		warnConfigIssue(`config field "surfaces.${surface}" must be an object (got ${typeof rawControls}); ignoring this surface.`);
 		return;
 	}
-	const validated = {};
+	const validatedSurfaceControls = {};
 	for (const fieldName of SURFACE_CONTROL_FIELD_NAMES) {
 		if (rawControls[fieldName] === void 0) continue;
-		const result = validateStringArrayField(`surfaces.${surface}.${fieldName}`, rawControls[fieldName]);
-		if (result !== void 0) validated[fieldName] = result;
+		const qualifiedName = `surfaces.${surface}.${fieldName}`;
+		const result = validateStringArrayField(qualifiedName, rawControls[fieldName]);
+		if (result === void 0) continue;
+		validatedSurfaceControls[fieldName] = fieldName === "includeCategories" || fieldName === "excludeCategories" ? filterKnownCategories(qualifiedName, result) : result;
 	}
-	return validated;
+	return validatedSurfaceControls;
 };
 const validateSurfacesField = (rawSurfaces) => {
 	if (!isPlainObject$1(rawSurfaces)) {
@@ -4241,7 +4295,7 @@ const validateSurfacesField = (rawSurfaces) => {
 	}
 	return validated;
 };
-const validateSeverityMap = (fieldName, rawMap) => {
+const validateSeverityMap = (fieldName, rawMap, keysAreCategories = false) => {
 	if (!isPlainObject$1(rawMap)) {
 		warnConfigIssue(`config field "${fieldName}" must be an object (got ${typeof rawMap}); ignoring this field.`);
 		return;
@@ -4252,6 +4306,10 @@ const validateSeverityMap = (fieldName, rawMap) => {
 			warnConfigIssue(`config field "${fieldName}" has an empty key; ignoring the entry.`);
 			continue;
 		}
+		if (keysAreCategories && !isDiagnosticCategoryBucket(key)) {
+			warnConfigIssue(`config field "${fieldName}.${key}" is not a known category (expected one of: ${KNOWN_CATEGORY_LABEL}); ignoring the entry.`);
+			continue;
+		}
 		if (!isRuleSeverity(value)) {
 			warnConfigIssue(`config field "${fieldName}.${key}" must be one of: ${VALID_RULE_SEVERITIES.join(", ")} (got ${formatType(value)}); ignoring the entry.`);
 			continue;
@@ -4272,7 +4330,7 @@ const validateConfigTypes = (config) => {
 	for (const fieldName of BOOLEAN_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => coerceMaybeBooleanString(fieldName, value));
 	for (const fieldName of STRING_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateString(fieldName, value));
 	applyFieldValidator(config, validated, "surfaces", validateSurfacesField);
-	for (const fieldName of SEVERITY_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateSeverityMap(fieldName, value));
+	for (const fieldName of SEVERITY_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateSeverityMap(fieldName, value, fieldName === "categories"));
 	applyFieldValidator(config, validated, "plugins", (value) => validateStringArrayField("plugins", value));
 	return validated;
 };
@@ -4356,11 +4414,12 @@ const resolveConfigRootDir = (config, configSourceDirectory) => {
 	}
 	return resolvedRootDir;
 };
-const resolveDiagnoseTarget = (directory) => {
+const resolveDiagnoseTarget = (directory, options = {}) => {
 	if (isFile(path.join(directory, "package.json"))) return directory;
 	const reactSubprojects = discoverReactSubprojects(directory);
 	if (reactSubprojects.length === 0) return null;
 	if (reactSubprojects.length === 1) return reactSubprojects[0].directory;
+	if (options.allowAmbiguous === true) return null;
 	throw new AmbiguousProjectError(directory, reactSubprojects.map((subproject) => path.relative(directory, subproject.directory)).toSorted());
 };
 /**
@@ -4374,7 +4433,8 @@ const resolveDiagnoseTarget = (directory) => {
 *      project root, if configured.
 *   4. Walk into a nested React subproject when the requested
 *      directory has no `package.json` of its own (raises
-*      `AmbiguousProjectError` when multiple candidates exist).
+*      `AmbiguousProjectError` when multiple candidates exist unless
+*      the caller opts into keeping the wrapper directory).
 *
 * Throws `ProjectNotFoundError` when neither the requested directory
 * nor any discoverable nested project has a `package.json`.
@@ -4386,14 +4446,14 @@ const resolveDiagnoseTarget = (directory) => {
 * via its own cache). Routing through `resolveScanTarget` keeps every
 * shell in agreement on what "the scan directory" means.
 */
-const resolveScanTarget = (requestedDirectory) => {
+const resolveScanTarget = (requestedDirectory, options = {}) => {
 	const absoluteRequested = path.resolve(requestedDirectory);
 	const loadedConfig = loadConfigWithSource(absoluteRequested);
 	const userConfig = loadedConfig?.config ?? null;
 	const configSourceDirectory = loadedConfig?.sourceDirectory ?? null;
 	const redirectedDirectory = resolveConfigRootDir(userConfig, configSourceDirectory);
 	const directoryAfterRedirect = redirectedDirectory ?? absoluteRequested;
-	const resolvedDirectory = resolveDiagnoseTarget(directoryAfterRedirect) ?? directoryAfterRedirect;
+	const resolvedDirectory = resolveDiagnoseTarget(directoryAfterRedirect, options) ?? directoryAfterRedirect;
 	if (!isDirectory(resolvedDirectory)) throw existsSync(resolvedDirectory) ? new NotADirectoryError(resolvedDirectory) : new ProjectNotFoundError(resolvedDirectory);
 	return {
 		resolvedDirectory,
@@ -4572,99 +4632,6 @@ const checkReducedMotion = (rootDirectory) => {
 	return [MISSING_REDUCED_MOTION_DIAGNOSTIC];
 };
 const computeJsxIncludePaths = (includePaths) => includePaths.length > 0 ? includePaths.filter((filePath) => JSX_FILE_PATTERN.test(filePath)) : void 0;
-const toStringSet = (values) => {
-	if (!values || values.length === 0) return /* @__PURE__ */ new Set();
-	return new Set(values.filter((value) => typeof value === "string" && value.length > 0));
-};
-const buildResolvedControls = (surface, userControls) => {
-	const excludeTags = new Set(DEFAULT_SURFACE_EXCLUDED_TAGS[surface]);
-	const includeTags = toStringSet(userControls?.includeTags);
-	for (const tag of includeTags) excludeTags.delete(tag);
-	for (const tag of toStringSet(userControls?.excludeTags)) excludeTags.add(tag);
-	return {
-		includeTags,
-		excludeTags,
-		includeCategories: toStringSet(userControls?.includeCategories),
-		excludeCategories: toStringSet(userControls?.excludeCategories),
-		includeRuleKeys: toStringSet(userControls?.includeRules),
-		excludeRuleKeys: toStringSet(userControls?.excludeRules)
-	};
-};
-const intersects = (values, candidates) => values.some((value) => candidates.has(value));
-const isDiagnosticOnSurface = (diagnostic, surface, config) => {
-	const resolved = buildResolvedControls(surface, config?.surfaces?.[surface]);
-	const { ruleKey, category, tags } = getDiagnosticRuleIdentity(diagnostic);
-	if (resolved.includeRuleKeys.has(ruleKey)) return true;
-	if (resolved.includeCategories.has(category)) return true;
-	if (intersects(tags, resolved.includeTags)) return true;
-	if (resolved.excludeRuleKeys.has(ruleKey)) return false;
-	if (resolved.excludeCategories.has(category)) return false;
-	if (intersects(tags, resolved.excludeTags)) return false;
-	return true;
-};
-const filterDiagnosticsForSurface = (diagnostics, surface, config) => diagnostics.filter((diagnostic) => isDiagnosticOnSurface(diagnostic, surface, config));
-const listSourceFilesViaGit = (rootDirectory) => {
-	const result = spawnSync("git", [
-		"ls-files",
-		"-z",
-		"--cached",
-		"--others",
-		"--exclude-standard"
-	], {
-		cwd: rootDirectory,
-		encoding: "utf-8",
-		maxBuffer: GIT_LS_FILES_MAX_BUFFER_BYTES
-	});
-	if (result.error || result.status !== 0) return null;
-	return result.stdout.split("\0").filter((filePath) => filePath.length > 0 && SOURCE_FILE_PATTERN.test(filePath));
-};
-const listSourceFilesViaFilesystem = (rootDirectory) => {
-	const filePaths = [];
-	const stack = [rootDirectory];
-	while (stack.length > 0) {
-		const currentDirectory = stack.pop();
-		const entries = readDirectoryEntries(currentDirectory);
-		for (const entry of entries) {
-			const absolutePath = path.join(currentDirectory, entry.name);
-			if (entry.isDirectory()) {
-				if (!entry.name.startsWith(".") && !IGNORED_DIRECTORIES.has(entry.name)) stack.push(absolutePath);
-				continue;
-			}
-			if (entry.isFile() && SOURCE_FILE_PATTERN.test(entry.name)) filePaths.push(path.relative(rootDirectory, absolutePath).replace(/\\/g, "/"));
-		}
-	}
-	return filePaths;
-};
-const listSourceFiles = (rootDirectory) => listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory);
-const resolveLintIncludePaths = (rootDirectory, userConfig) => {
-	if (!Array.isArray(userConfig?.ignore?.files) || userConfig.ignore.files.length === 0) return;
-	const ignoredPatterns = compileIgnoredFilePatterns(userConfig);
-	return listSourceFiles(rootDirectory).filter((filePath) => {
-		if (!JSX_FILE_PATTERN.test(filePath)) return false;
-		return !isFileIgnoredByPatterns(filePath, rootDirectory, ignoredPatterns);
-	});
-};
-var Config = class Config extends Context.Service()("react-doctor/Config") {
-	static layerNode = Layer.effect(Config, Effect.gen(function* () {
-		const cache = yield* Cache.make({
-			capacity: 16,
-			timeToLive: CONFIG_CACHE_TTL_MS,
-			lookup: (directory) => Effect.sync(() => {
-				const loaded = loadConfigWithSource(directory);
-				const redirected = resolveConfigRootDir(loaded?.config ?? null, loaded?.sourceDirectory ?? null);
-				return {
-					config: loaded?.config ?? null,
-					resolvedDirectory: redirected ?? directory,
-					configSourceDirectory: loaded?.sourceDirectory ?? null
-				};
-			})
-		});
-		return Config.of({ resolve: Effect.fn("Config.resolve")(function* (directory) {
-			return yield* Cache.get(cache, directory);
-		}) });
-	}));
-	static layerOf = (resolved) => Layer.succeed(Config, Config.of({ resolve: () => Effect.succeed(resolved) }));
-};
 const LINGUIST_ATTRIBUTE_PATTERN = /^linguist-(?:vendored|generated)(?:=([a-zA-Z0-9]+))?$/i;
 const FALSY_VALUES = new Set([
 	"false",
@@ -4746,6 +4713,30 @@ const collectIgnorePatterns = (rootDirectory) => {
 	cachedPatternsByRoot.set(rootDirectory, patterns);
 	return patterns;
 };
+/**
+* Resolves a path to its canonical, symlink-free form, falling back to
+* the input when it cannot be realpath'd (broken symlink, permission
+* error) so a best-effort normalization never throws.
+*
+* deslop's dead-code module graph is collected with `fast-glob` (which
+* keeps the scan root's symlinks intact) while imports are resolved
+* through `oxc-resolver` (which returns realpath'd targets). When the
+* project root sits behind a symlink — e.g. macOS iCloud-synced
+* `~/Documents` / `~/Desktop`, or a symlinked checkout — those two path
+* spaces diverge: every resolved import misses the graph and the files
+* they point at (commonly every `@/…` alias target) are mis-reported as
+* unreachable. Canonicalizing the root before the scan keeps both path
+* spaces in agreement.
+*/
+const toCanonicalPath = (filePath) => {
+	try {
+		return fs.realpathSync(filePath);
+	} catch {
+		return filePath;
+	}
+};
+const DEAD_CODE_PLUGIN = "deslop";
+const DEAD_CODE_CATEGORY = "Maintainability";
 const TSCONFIG_FILENAMES$1 = ["tsconfig.json", "tsconfig.base.json"];
 const DEAD_CODE_WORKER_SCRIPT = `
 const inputChunks = [];
@@ -4921,7 +4912,11 @@ const buildDeadCodeWorkerError = (workerError) => {
 	return error;
 };
 const createDeadCodeWorker = (input) => {
-	const child = spawn(process.execPath, ["-e", DEAD_CODE_WORKER_SCRIPT], {
+	const child = spawn(process.execPath, [
+		`--max-old-space-size=${DEAD_CODE_WORKER_MAX_OLD_SPACE_MB}`,
+		"-e",
+		DEAD_CODE_WORKER_SCRIPT
+	], {
 		stdio: [
 			"pipe",
 			"pipe",
@@ -4996,7 +4991,8 @@ const runDeadCodeWorkerWithTimeout = (handle, timeoutMs) => new Promise((resolve
 	});
 });
 const checkDeadCode = async (options) => {
-	const { rootDirectory, userConfig } = options;
+	const { userConfig } = options;
+	const rootDirectory = toCanonicalPath(options.rootDirectory);
 	if (!fs.existsSync(path.join(rootDirectory, "package.json"))) return [];
 	const ignorePatterns = collectDeadCodeIgnorePatterns(rootDirectory, userConfig);
 	const result = parseDeadCodeWorkerResult(await runDeadCodeWorkerWithTimeout((options.createWorker ?? createDeadCodeWorker)({
@@ -5009,59 +5005,162 @@ const checkDeadCode = async (options) => {
 	const diagnostics = [];
 	for (const unusedFile of result.unusedFiles) diagnostics.push({
 		filePath: toRelative(unusedFile.path),
-		plugin: "deslop",
+		plugin: DEAD_CODE_PLUGIN,
 		rule: "unused-file",
 		severity: "warning",
 		message: "Unused file — not reachable from any entry point",
 		help: "Delete the file if it is truly unreachable, or import it from an entry point.",
 		line: 0,
 		column: 0,
-		category: "Dead Code"
+		category: DEAD_CODE_CATEGORY
 	});
 	for (const unusedExport of result.unusedExports) {
 		const label = unusedExport.isTypeOnly ? "type export" : "export";
 		diagnostics.push({
 			filePath: toRelative(unusedExport.path),
-			plugin: "deslop",
+			plugin: DEAD_CODE_PLUGIN,
 			rule: unusedExport.isTypeOnly ? "unused-type" : "unused-export",
 			severity: "warning",
 			message: `Unused ${label}: \`${unusedExport.name}\``,
 			help: "Drop the `export` keyword (or remove the declaration) if no other module uses this symbol.",
 			line: unusedExport.line,
 			column: unusedExport.column,
-			category: "Dead Code"
+			category: DEAD_CODE_CATEGORY
 		});
 	}
 	for (const unusedDependency of result.unusedDependencies) {
 		const label = unusedDependency.isDevDependency ? "devDependency" : "dependency";
 		diagnostics.push({
 			filePath: "package.json",
-			plugin: "deslop",
+			plugin: DEAD_CODE_PLUGIN,
 			rule: unusedDependency.isDevDependency ? "unused-dev-dependency" : "unused-dependency",
 			severity: "warning",
 			message: `Unused ${label}: \`${unusedDependency.name}\``,
 			help: "Remove the dependency from package.json if it is genuinely unused.",
 			line: 0,
 			column: 0,
-			category: "Dead Code"
+			category: DEAD_CODE_CATEGORY
 		});
 	}
 	for (const cycle of result.circularDependencies) {
 		if (cycle.files.length === 0) continue;
 		diagnostics.push({
 			filePath: toRelative(cycle.files[0]),
-			plugin: "deslop",
+			plugin: DEAD_CODE_PLUGIN,
 			rule: "circular-dependency",
 			severity: "warning",
 			message: `Circular import cycle: ${cycle.files.map(toRelative).join(" → ")}`,
 			help: "Break the cycle by extracting the shared code into a third module that both files import.",
 			line: 0,
 			column: 0,
-			category: "Dead Code"
+			category: DEAD_CODE_CATEGORY
 		});
 	}
 	return diagnostics;
 };
+const DEAD_CODE_RULE_KEY_PREFIX = `${DEAD_CODE_PLUGIN}/`;
+const isSurfacingOverride = (override) => override === "warn" || override === "error";
+const deadCodeMaySurfaceWhenWarningsHidden = (userConfig) => {
+	const severityControls = buildRuleSeverityControls(userConfig);
+	if (!severityControls) return false;
+	if (isSurfacingOverride(severityControls.categories?.["Maintainability"])) return true;
+	for (const [ruleKey, override] of Object.entries(severityControls.rules ?? {})) if (ruleKey.startsWith(DEAD_CODE_RULE_KEY_PREFIX) && isSurfacingOverride(override)) return true;
+	return false;
+};
+const toStringSet = (values) => {
+	if (!values || values.length === 0) return /* @__PURE__ */ new Set();
+	return new Set(values.filter((value) => typeof value === "string" && value.length > 0));
+};
+const buildResolvedControls = (surface, userControls) => {
+	const excludeTags = new Set(DEFAULT_SURFACE_EXCLUDED_TAGS[surface]);
+	const includeTags = toStringSet(userControls?.includeTags);
+	for (const tag of includeTags) excludeTags.delete(tag);
+	for (const tag of toStringSet(userControls?.excludeTags)) excludeTags.add(tag);
+	return {
+		includeTags,
+		excludeTags,
+		includeCategories: toStringSet(userControls?.includeCategories),
+		excludeCategories: toStringSet(userControls?.excludeCategories),
+		includeRuleKeys: toStringSet(userControls?.includeRules),
+		excludeRuleKeys: toStringSet(userControls?.excludeRules)
+	};
+};
+const intersects = (values, candidates) => values.some((value) => candidates.has(value));
+const isDiagnosticOnSurface = (diagnostic, surface, config) => {
+	const resolved = buildResolvedControls(surface, config?.surfaces?.[surface]);
+	const { ruleKey, category, tags } = getDiagnosticRuleIdentity(diagnostic);
+	if (resolved.includeRuleKeys.has(ruleKey)) return true;
+	if (resolved.includeCategories.has(category)) return true;
+	if (intersects(tags, resolved.includeTags)) return true;
+	if (resolved.excludeRuleKeys.has(ruleKey)) return false;
+	if (resolved.excludeCategories.has(category)) return false;
+	if (intersects(tags, resolved.excludeTags)) return false;
+	return true;
+};
+const filterDiagnosticsForSurface = (diagnostics, surface, config) => diagnostics.filter((diagnostic) => isDiagnosticOnSurface(diagnostic, surface, config));
+const excludeMinifiedFiles = (rootDirectory, relativePaths) => relativePaths.filter((relativePath) => !isLargeMinifiedFile(path.resolve(rootDirectory, relativePath)));
+const listSourceFilesViaGit = (rootDirectory) => {
+	const result = spawnSync("git", [
+		"ls-files",
+		"-z",
+		"--cached",
+		"--others",
+		"--exclude-standard"
+	], {
+		cwd: rootDirectory,
+		encoding: "utf-8",
+		maxBuffer: GIT_LS_FILES_MAX_BUFFER_BYTES
+	});
+	if (result.error || result.status !== 0) return null;
+	return result.stdout.split("\0").filter((filePath) => filePath.length > 0 && isLintableSourceFile(filePath));
+};
+const listSourceFilesViaFilesystem = (rootDirectory) => {
+	const filePaths = [];
+	const stack = [rootDirectory];
+	while (stack.length > 0) {
+		const currentDirectory = stack.pop();
+		const entries = readDirectoryEntries(currentDirectory);
+		for (const entry of entries) {
+			const absolutePath = path.join(currentDirectory, entry.name);
+			if (entry.isDirectory()) {
+				if (!entry.name.startsWith(".") && !IGNORED_DIRECTORIES.has(entry.name)) stack.push(absolutePath);
+				continue;
+			}
+			if (entry.isFile() && isLintableSourceFile(entry.name)) filePaths.push(path.relative(rootDirectory, absolutePath).replace(/\\/g, "/"));
+		}
+	}
+	return filePaths;
+};
+const listSourceFiles = (rootDirectory) => excludeMinifiedFiles(rootDirectory, listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory));
+const resolveLintIncludePaths = (rootDirectory, userConfig) => {
+	if (!Array.isArray(userConfig?.ignore?.files) || userConfig.ignore.files.length === 0) return;
+	const ignoredPatterns = compileIgnoredFilePatterns(userConfig);
+	return listSourceFiles(rootDirectory).filter((filePath) => {
+		if (!JSX_FILE_PATTERN.test(filePath)) return false;
+		return !isFileIgnoredByPatterns(filePath, rootDirectory, ignoredPatterns);
+	});
+};
+var Config = class Config extends Context.Service()("react-doctor/Config") {
+	static layerNode = Layer.effect(Config, Effect.gen(function* () {
+		const cache = yield* Cache.make({
+			capacity: 16,
+			timeToLive: CONFIG_CACHE_TTL_MS,
+			lookup: (directory) => Effect.sync(() => {
+				const loaded = loadConfigWithSource(directory);
+				const redirected = resolveConfigRootDir(loaded?.config ?? null, loaded?.sourceDirectory ?? null);
+				return {
+					config: loaded?.config ?? null,
+					resolvedDirectory: redirected ?? directory,
+					configSourceDirectory: loaded?.sourceDirectory ?? null
+				};
+			})
+		});
+		return Config.of({ resolve: Effect.fn("Config.resolve")(function* (directory) {
+			return yield* Cache.get(cache, directory);
+		}) });
+	}));
+	static layerOf = (resolved) => Layer.succeed(Config, Config.of({ resolve: () => Effect.succeed(resolved) }));
+};
 /**
 * `DeadCode` runs whole-project reachability analysis and streams
 * diagnostics. Reachability is a whole-project property — the
@@ -5567,12 +5666,12 @@ const findFilesWithDisableDirectivesViaGit = async (rootDirectory, includePaths)
 		return null;
 	}
 	if (grepResult === null) return null;
-	return grepResult.stdout.split("\n").filter((filePath) => filePath.length > 0 && SOURCE_FILE_PATTERN.test(filePath));
+	return grepResult.stdout.split("\n").filter((filePath) => filePath.length > 0 && isLintableSourceFile(filePath));
 };
 const findFilesWithDisableDirectivesViaFilesystem = (rootDirectory, includePaths) => {
 	const matches = [];
 	const checkFile = (relativePath) => {
-		if (!SOURCE_FILE_PATTERN.test(relativePath)) return;
+		if (!isLintableSourceFile(relativePath)) return;
 		const absolutePath = path.join(rootDirectory, relativePath);
 		let content;
 		try {
@@ -5939,6 +6038,149 @@ const appendReanimatedSharedValueHint = (help, rule, project) => {
 	if (!help) return REANIMATED_SHARED_VALUE_HINT;
 	return `${help}\n\n${REANIMATED_SHARED_VALUE_HINT}`;
 };
+const REDACTED_PLACEHOLDER = "<redacted>";
+const KEEP_PREFIX = `$1${REDACTED_PLACEHOLDER}`;
+const KNOWN_SECRET_RULES = [
+	{
+		pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+		replacement: REDACTED_PLACEHOLDER
+	},
+	{
+		pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g,
+		replacement: REDACTED_PLACEHOLDER
+	},
+	{
+		pattern: /(?<=:\/\/)[^\s/:@]+:[^\s/@]+(?=@)/g,
+		replacement: REDACTED_PLACEHOLDER
+	},
+	{
+		pattern: /\b(AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA|A3T[A-Z0-9])[0-9A-Z]{16,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(gh[pousr]_)[A-Za-z0-9]{36,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(github_pat_)[A-Za-z0-9_]{22,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(glpat-)[A-Za-z0-9_-]{20,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(xox[baprs]-)[A-Za-z0-9-]{10,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /(?<=hooks\.slack\.com\/services\/)[A-Za-z0-9/+_-]{20,}/g,
+		replacement: REDACTED_PLACEHOLDER
+	},
+	{
+		pattern: /\b((?:sk|rk)_(?:live|test)_)[0-9A-Za-z]{10,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(sk-(?:proj-|ant-)?)[A-Za-z0-9_-]{20,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(AIza)[0-9A-Za-z_-]{35,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(ya29\.)[0-9A-Za-z_-]{20,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(npm_)[A-Za-z0-9]{36,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(SG\.)[A-Za-z0-9_-]{22,}\.[A-Za-z0-9_-]{43,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(SK)[0-9a-fA-F]{32,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(dop_v1_)[a-f0-9]{64,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(shp(?:at|ca|pa|ss)_)[a-fA-F0-9]{32,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(sq0[a-z]{3}-)[0-9A-Za-z_-]{22,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b([0-9]{8,10}:AA)[0-9A-Za-z_-]{32,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /(?<=\bBearer\s)[A-Za-z0-9._~+/=-]{16,}/g,
+		replacement: REDACTED_PLACEHOLDER
+	},
+	{
+		pattern: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g,
+		replacement: REDACTED_PLACEHOLDER
+	}
+];
+const CANDIDATE_TOKEN_PATTERN = /[A-Za-z0-9_][A-Za-z0-9_-]*/g;
+const HEX_DIGEST_PATTERN = /^(?:[0-9a-f]{32}|[0-9a-f]{40}|[0-9a-f]{64})$/;
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const HAS_LETTER_PATTERN = /[A-Za-z]/;
+const HAS_DIGIT_PATTERN = /[0-9]/;
+const shannonEntropyBits = (value) => {
+	const counts = /* @__PURE__ */ new Map();
+	for (const char of value) counts.set(char, (counts.get(char) ?? 0) + 1);
+	let bits = 0;
+	for (const count of counts.values()) {
+		const probability = count / value.length;
+		bits -= probability * Math.log2(probability);
+	}
+	return bits;
+};
+const looksLikeHighEntropySecret = (token) => {
+	if (token.length < 32) return false;
+	if (!HAS_LETTER_PATTERN.test(token) || !HAS_DIGIT_PATTERN.test(token)) return false;
+	if (HEX_DIGEST_PATTERN.test(token) || UUID_PATTERN.test(token)) return false;
+	return shannonEntropyBits(token) >= 3;
+};
+const redactHighEntropyTokens = (text) => text.replace(CANDIDATE_TOKEN_PATTERN, (token) => looksLikeHighEntropySecret(token) ? REDACTED_PLACEHOLDER : token);
+/**
+* Masks API keys, tokens, private keys, credentialed URLs, and emails
+* found anywhere inside a free-text string, returning the scrubbed text.
+* Applied to every diagnostic's `message` / `help` at construction time
+* so secrets never reach the terminal, the JSON report, or the score
+* API — react-doctor must never echo or transmit a user's secrets.
+*
+* Provider tokens keep their non-secret, type-identifying prefix (e.g.
+* `sk_live_<redacted>`, `ghp_<redacted>`, `AKIA<redacted>`) so the leaked
+* credential's type stays visible; structural or unknown-format secrets
+* with no meaningful prefix are masked whole.
+*
+* Runs the high-precision known-shape detectors first, then a generic
+* entropy-gated sweep for unknown-format secrets. Idempotent: the inert
+* `<redacted>` placeholder matches none of the detectors and is too
+* short for the generic sweep, so re-running leaves the text unchanged.
+*
+* Accepts `unknown` on purpose: callers feed it diagnostic `message` /
+* `help` that originate from oxlint JSON, which is only shape-checked at
+* the top level (the per-field `string` types are assumed, not validated).
+* A malformed non-string value returns `""` instead of throwing on
+* `.replace`, so one bad diagnostic can't abort parsing the whole batch.
+*/
+const redactSensitiveText = (text) => {
+	if (typeof text !== "string" || text === "") return "";
+	let redacted = text;
+	for (const rule of KNOWN_SECRET_RULES) redacted = redacted.replace(rule.pattern, rule.replacement);
+	return redactHighEntropyTokens(redacted);
+};
 const REACT_MODULE_SOURCE = "react";
 const REQUIRE_IDENTIFIER = "require";
 const USE_IDENTIFIER = "use";
@@ -6233,25 +6475,26 @@ const shouldSuppressLocalUseHookDiagnostic = (diagnostic, rootDirectory) => {
 	return bindingResolution !== null && !bindingResolution.isReactUseBinding;
 };
 const FILEPATH_WITH_LOCATION_PATTERN = /\S+\.\w+:\d+:\d+[\s\S]*$/;
-const REACT_COMPILER_MESSAGE = "React Compiler can't optimize this code";
+const REACT_COMPILER_TITLE = "React Compiler can't optimize this";
+const REACT_COMPILER_MESSAGE = "This component misses React Compiler's automatic memoization & re-renders more than it should. Rewrite the flagged code so the compiler can optimize it.";
 const PLUGIN_CATEGORY_MAP = {
-	react: "Correctness",
-	"react-hooks": "Correctness",
-	"react-hooks-js": "React Compiler",
-	"react-doctor": "Other",
+	react: "Bugs",
+	"react-hooks": "Bugs",
+	"react-hooks-js": "Performance",
+	"react-doctor": "Bugs",
 	"jsx-a11y": "Accessibility",
-	effect: "State & Effects",
-	eslint: "Correctness",
-	oxc: "Correctness",
-	typescript: "Correctness",
-	unicorn: "Correctness",
-	import: "Bundle Size",
-	promise: "Correctness",
-	n: "Correctness",
-	node: "Correctness",
-	vitest: "Correctness",
-	jest: "Correctness",
-	nextjs: "Next.js"
+	effect: "Bugs",
+	eslint: "Bugs",
+	oxc: "Bugs",
+	typescript: "Bugs",
+	unicorn: "Bugs",
+	import: "Performance",
+	promise: "Bugs",
+	n: "Bugs",
+	node: "Bugs",
+	vitest: "Bugs",
+	jest: "Bugs",
+	nextjs: "Bugs"
 };
 const lookupOwnString = (record, key) => Object.hasOwn(record, key) ? record[key] : void 0;
 const getRuleRecommendation = (ruleName, project) => {
@@ -6259,7 +6502,16 @@ const getRuleRecommendation = (ruleName, project) => {
 	return reactDoctorPlugin.rules[ruleName]?.recommendation;
 };
 const getRuleCategory = (ruleName) => reactDoctorPlugin.rules[ruleName]?.category;
+const getRuleTitle = (ruleName) => reactDoctorPlugin.rules[ruleName]?.title;
+const resolveDiagnosticTitle = (plugin, rule) => plugin === "react-hooks-js" ? REACT_COMPILER_TITLE : getRuleTitle(rule);
 const cleanDiagnosticMessage = (message, help, plugin, rule, project) => {
+	const cleaned = resolveCleanedDiagnostic(typeof message === "string" ? message : "", typeof help === "string" ? help : "", plugin, rule, project);
+	return {
+		message: redactSensitiveText(cleaned.message),
+		help: redactSensitiveText(cleaned.help)
+	};
+};
+const resolveCleanedDiagnostic = (message, help, plugin, rule, project) => {
 	if (plugin === "react-hooks-js") return {
 		message: REACT_COMPILER_MESSAGE,
 		help: appendReanimatedSharedValueHint(message.replace(FILEPATH_WITH_LOCATION_PATTERN, "").trim() || help, rule, project)
@@ -6280,7 +6532,7 @@ const parseRuleCode = (code) => {
 		rule: match[2]
 	};
 };
-const resolveDiagnosticCategory = (plugin, rule) => getRuleCategory(rule) ?? lookupOwnString(PLUGIN_CATEGORY_MAP, plugin) ?? "Other";
+const resolveDiagnosticCategory = (plugin, rule) => getRuleCategory(rule) ?? lookupOwnString(PLUGIN_CATEGORY_MAP, plugin) ?? "Bugs";
 const isOxlintOutput = (value) => {
 	if (typeof value !== "object" || value === null) return false;
 	const candidate = value;
@@ -6304,7 +6556,16 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 		throw new ReactDoctorError({ reason: new OxlintOutputUnparseable({ preview: stdout.slice(0, 200) }) });
 	}
 	if (!isOxlintOutput(parsed)) throw new ReactDoctorError({ reason: new OxlintOutputUnparseable({ preview: stdout.slice(0, 200) }) });
-	return parsed.diagnostics.filter((diagnostic) => diagnostic.code && SOURCE_FILE_PATTERN.test(diagnostic.filename) && !shouldSuppressLocalUseHookDiagnostic(diagnostic, rootDirectory)).map((diagnostic) => {
+	const minifiedFileCache = /* @__PURE__ */ new Map();
+	const isMinifiedDiagnosticFile = (filename) => {
+		const absolutePath = path.isAbsolute(filename) ? filename : path.resolve(rootDirectory || ".", filename);
+		const cached = minifiedFileCache.get(absolutePath);
+		if (cached !== void 0) return cached;
+		const minified = isMinifiedSource(absolutePath);
+		minifiedFileCache.set(absolutePath, minified);
+		return minified;
+	};
+	return parsed.diagnostics.filter((diagnostic) => diagnostic.code && isLintableSourceFile(diagnostic.filename) && !isMinifiedDiagnosticFile(diagnostic.filename) && !shouldSuppressLocalUseHookDiagnostic(diagnostic, rootDirectory)).map((diagnostic) => {
 		const { plugin, rule } = parseRuleCode(diagnostic.code);
 		const primaryLabel = diagnostic.labels[0];
 		const cleaned = cleanDiagnosticMessage(diagnostic.message, diagnostic.help, plugin, rule, project);
@@ -6313,6 +6574,7 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 			plugin,
 			rule,
 			severity: diagnostic.severity,
+			title: resolveDiagnosticTitle(plugin, rule),
 			message: cleaned.message,
 			help: cleaned.help,
 			url: diagnostic.url,
@@ -6464,11 +6726,14 @@ const spawnLintBatches = async (input) => {
 				onFileProgress(scannedFileCount + batchFileIndex, totalFileCount);
 			}
 		}, 50) : null;
-		const batchDiagnostics = await spawnLintBatch(batch);
-		if (progressInterval !== null) clearInterval(progressInterval);
-		allDiagnostics.push(...batchDiagnostics);
-		scannedFileCount += batch.length;
-		onFileProgress?.(scannedFileCount, totalFileCount);
+		try {
+			const batchDiagnostics = await spawnLintBatch(batch);
+			allDiagnostics.push(...batchDiagnostics);
+			scannedFileCount += batch.length;
+			onFileProgress?.(scannedFileCount, totalFileCount);
+		} finally {
+			if (progressInterval !== null) clearInterval(progressInterval);
+		}
 	}
 	if (droppedFiles.length > 0 && onPartialFailure) {
 		const previewFiles = droppedFiles.slice(0, 3).join(", ");
@@ -6727,7 +6992,8 @@ var Progress = class Progress extends Context.Service()("react-doctor/Progress")
 	static layerNoop = Layer.succeed(Progress, Progress.of({ start: () => Effect.succeed({
 		update: () => Effect.void,
 		succeed: () => Effect.void,
-		fail: () => Effect.void
+		fail: () => Effect.void,
+		stop: () => Effect.void
 	}) }));
 	static layerCapture = Layer.effect(Progress, Effect.map(ProgressCapture, (events) => Progress.of({ start: (text) => Effect.gen(function* () {
 		yield* Ref.update(events, (existing) => [...existing, {
@@ -6746,6 +7012,10 @@ var Progress = class Progress extends Context.Service()("react-doctor/Progress")
 			fail: (displayText) => Ref.update(events, (existing) => [...existing, {
 				_tag: "Failed",
 				text: displayText
+			}]),
+			stop: () => Ref.update(events, (existing) => [...existing, {
+				_tag: "Stopped",
+				text
 			}])
 		};
 	}) }))).pipe(Layer.provideMerge(ProgressCapture.layer));
@@ -6817,17 +7087,21 @@ var Reporter = class Reporter extends Context.Service()("react-doctor/Reporter")
 		});
 	}));
 };
-const parseScoreResult = (value) => {
-	if (typeof value !== "object" || value === null) return null;
-	if (!("score" in value) || !("label" in value)) return null;
-	const scoreValue = Reflect.get(value, "score");
-	const labelValue = Reflect.get(value, "label");
-	if (typeof scoreValue !== "number" || typeof labelValue !== "string") return null;
-	return {
-		score: scoreValue,
-		label: labelValue
-	};
-};
+const RulePrioritySchema = Schema.Struct({
+	priority: Schema.NullOr(Schema.Number),
+	tier: Schema.Literals([
+		"P0",
+		"P1",
+		"P2",
+		"P3"
+	])
+});
+const ScoreApiResponseSchema = Schema.Struct({
+	score: Schema.Number,
+	label: Schema.String,
+	rules: Schema.optional(Schema.Record(Schema.String, RulePrioritySchema))
+});
+const parseScoreResult = (value) => Option.getOrNull(Schema.decodeUnknownOption(ScoreApiResponseSchema)(value));
 const stripFilePaths = (diagnostics) => diagnostics.map(({ filePath: _filePath, ...rest }) => rest);
 const isAbortError = (error) => error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError");
 const describeFailure = (error) => {
@@ -6991,15 +7265,18 @@ const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 		repo
 	}).pipe(Effect.orElseSucceed(() => null)) : Effect.succeed(null));
 	const lintIncludePaths = computeJsxIncludePaths([...input.includePaths]) ?? resolveLintIncludePaths(scanDirectory, resolvedConfig.config);
+	const scannedFilePaths = input.suppressScanSummary ? (lintIncludePaths ?? (yield* filesService.listSourceFiles(scanDirectory))).map((relativePath) => path.resolve(scanDirectory, relativePath)) : [];
 	const beforeLint = hooks.beforeLint ?? NO_HOOKS.beforeLint;
 	const afterLint = hooks.afterLint ?? NO_HOOKS.afterLint;
 	yield* beforeLint(project, lintIncludePaths ?? void 0);
 	const isDiffMode = input.includePaths.length > 0;
+	const showWarnings = input.warnings ?? resolvedConfig.config?.warnings ?? false;
 	const transform = buildDiagnosticPipeline({
 		rootDirectory: scanDirectory,
 		userConfig: resolvedConfig.config,
 		readFileLinesSync: fileReader(filesService, scanDirectory),
-		respectInlineDisables: input.respectInlineDisables
+		respectInlineDisables: input.respectInlineDisables,
+		showWarnings
 	});
 	const applyPerElementPipeline = (rawStream) => rawStream.pipe(Stream.filterMap(filterMapNullable(transform.apply)), Stream.tap((diagnostic) => reporterService.emit(diagnostic)));
 	const environmentDiagnostics = isDiffMode ? [] : [...checkReducedMotion(scanDirectory), ...checkPnpmHardening(scanDirectory)];
@@ -7045,7 +7322,7 @@ const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 	const lintFailureState = yield* Ref.get(lintFailure);
 	yield* afterLint(lintFailureState.didFail);
 	if (lintFailureState.didFail) yield* scanProgress.fail(formatLintFailText(lintFailureState.reasonTag, process.version));
-	const shouldRunDeadCode = input.runDeadCode && !isDiffMode;
+	const shouldRunDeadCode = input.runDeadCode && !isDiffMode && (showWarnings || deadCodeMaySurfaceWhenWarningsHidden(resolvedConfig.config));
 	const deadCodeCollected = lintFailureState.didFail || !shouldRunDeadCode ? [] : yield* scanProgress.update("Analyzing dead code...").pipe(Effect.andThen(Stream.runCollect(applyPerElementPipeline(deadCodeService.run({
 		rootDirectory: scanDirectory,
 		userConfig: resolvedConfig.config
@@ -7057,9 +7334,11 @@ const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 		return Stream.empty;
 	}))))))));
 	const deadCodeFailureState = yield* Ref.get(deadCodeFailure);
-	const scanElapsedSeconds = ((Date.now() - scanStartTime) / 1e3).toFixed(1);
+	const scanElapsedMilliseconds = Date.now() - scanStartTime;
+	const scanElapsedSeconds = (scanElapsedMilliseconds / 1e3).toFixed(1);
 	const totalFileCount = lastReportedTotalFileCount || (lintIncludePaths?.length ?? project.sourceFileCount);
 	if (!lintFailureState.didFail) if (deadCodeFailureState.didFail) yield* scanProgress.fail(DEAD_CODE_FAIL_TEXT);
+	else if (input.suppressScanSummary) yield* scanProgress.stop();
 	else yield* scanProgress.succeed(`Scanned ${totalFileCount} ${totalFileCount === 1 ? "file" : "files"} in ${scanElapsedSeconds}s`);
 	yield* reporterService.finalize;
 	const finalDiagnostics = [
@@ -7100,7 +7379,10 @@ const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 		lintFailureReasonKind: lintFailureState.reasonKind,
 		lintPartialFailures,
 		didDeadCodeFail: deadCodeFailureState.didFail,
-		deadCodeFailureReason: deadCodeFailureState.reason
+		deadCodeFailureReason: deadCodeFailureState.reason,
+		scannedFileCount: totalFileCount,
+		scannedFilePaths,
+		scanElapsedMilliseconds
 	};
 }).pipe(Effect.withSpan("runInspect", { attributes: {
 	"inspect.directory": input.directory,
@@ -7226,7 +7508,7 @@ const isPathInsideDirectory = (childAbsolutePath, parentAbsolutePath) => {
 	static layerNode = Layer.effect(StagedFiles, Effect.gen(function* () {
 		const git = yield* Git;
 		return StagedFiles.of({
-			discoverSourceFiles: (directory) => git.stagedFilePaths(directory).pipe(Effect.map((entries) => entries.filter((entry) => SOURCE_FILE_PATTERN.test(entry)))),
+			discoverSourceFiles: (directory) => git.stagedFilePaths(directory).pipe(Effect.map((entries) => entries.filter(isLintableSourceFile))),
 			materialize: ({ directory, stagedFiles, tempDirectory }) => Effect.gen(function* () {
 				const materializedFiles = [];
 				const resolvedTempDirectory = path.resolve(tempDirectory);
@@ -7435,7 +7717,7 @@ const getDiffInfo = (directory, explicitBaseBranch) => Effect.runPromise(Effect.
 	GitBaseBranchInvalid: (reason) => Effect.die(new Error(reason.detail)),
 	GitBaseBranchMissing: (reason) => Effect.die(new Error(reason.message))
 })));
-const filterSourceFiles = (filePaths) => filePaths.filter((filePath) => SOURCE_FILE_PATTERN.test(filePath));
+const filterSourceFiles = (filePaths) => filePaths.filter(isLintableSourceFile);
 var import_picocolors = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	let p = process || {}, argv = p.argv || [], env = p.env || {};
 	let isColorSupported = !(!!env.NO_COLOR || argv.includes("--no-color")) && (!!env.FORCE_COLOR || argv.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env.TERM !== "dumb" || !!env.CI);
@@ -7522,6 +7804,7 @@ const buildInspectProgram = (scanTarget, options, configOverride) => {
 		includePaths,
 		customRulesOnly: effectiveConfig?.customRulesOnly ?? false,
 		respectInlineDisables: options.respectInlineDisables ?? effectiveConfig?.respectInlineDisables ?? true,
+		warnings: options.warnings ?? effectiveConfig?.warnings ?? false,
 		adoptExistingLintConfig: effectiveConfig?.adoptExistingLintConfig ?? true,
 		ignoredTags: new Set(effectiveConfig?.ignore?.tags ?? []),
 		runDeadCode: options.deadCode ?? effectiveConfig?.deadCode ?? true,