react-doctor 0.2.5 → 0.2.7

package/dist/{cli-logger-CISyjOAb.js → cli-logger-C35LXalM.js}

@@ -4,23 +4,24 @@ import { spawn, spawnSync } from "node:child_process";
 import * as Path from "node:path";
 import path from "node:path";
 import * as fs$1 from "node:fs";
-import fs, { existsSync, readdirSync } from "node:fs";
+import fs, { existsSync, readFileSync, readdirSync } from "node:fs";
 import * as Schema from "effect/Schema";
 import reactDoctorPlugin, { ALL_REACT_DOCTOR_RULE_KEYS, FRAMEWORK_SPECIFIC_RULE_KEYS, MOTION_LIBRARY_PACKAGES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES } from "oxlint-plugin-react-doctor";
 import * as Cause from "effect/Cause";
-import * as Config$1 from "effect/Config";
 import * as Effect from "effect/Effect";
+import * as Config$1 from "effect/Config";
 import * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
 import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
 import * as Otlp from "effect/unstable/observability/Otlp";
 import * as Context from "effect/Context";
+import * as Console from "effect/Console";
+import * as Fiber from "effect/Fiber";
 import * as Filter from "effect/Filter";
 import * as Option from "effect/Option";
 import * as Ref from "effect/Ref";
 import * as Stream from "effect/Stream";
 import * as Cache from "effect/Cache";
-import * as Console from "effect/Console";
 import * as NodeChildProcessSpawner from "@effect/platform-node-shared/NodeChildProcessSpawner";
 import * as NodeFileSystem from "@effect/platform-node-shared/NodeFileSystem";
 import * as NodePath from "@effect/platform-node-shared/NodePath";
@@ -2165,6 +2166,17 @@ const findMonorepoRoot = (startDirectory) => {
 	}
 	return null;
 };
+/**
+* True when `directory` looks like a project root we shouldn't walk
+* past — either the working tree's git root (a `.git` entry sits
+* here) or an npm/pnpm/yarn/bun monorepo root.
+*
+* Used as the stop-condition for the ancestor walks performed by
+* `detectUserLintConfigPaths`, `loadConfigWithSource`, and
+* `detectReactCompiler`. All three previously inlined their own
+* byte-equivalent copy.
+*/
+const isProjectBoundary = (directory) => fs.existsSync(path.join(directory, ".git")) || isMonorepoRoot(directory);
 const REACT_COMPILER_PACKAGES = new Set([
 	"babel-plugin-react-compiler",
 	"react-compiler-runtime",
@@ -2215,24 +2227,20 @@ const hasCompilerInConfigFile = (filePath) => {
 	return REACT_COMPILER_ENABLED_FLAG_PATTERN.test(content) || REACT_COMPILER_PACKAGE_REFERENCE_PATTERN.test(content);
 };
 const hasCompilerInConfigFiles = (directory, filenames) => filenames.some((filename) => hasCompilerInConfigFile(path.join(directory, filename)));
-const isProjectBoundary$2 = (directory) => {
-	if (fs.existsSync(path.join(directory, ".git"))) return true;
-	return isMonorepoRoot(directory);
-};
 const detectReactCompiler = (directory, packageJson) => {
 	if (hasCompilerPackage(packageJson)) return true;
 	if (hasCompilerInConfigFiles(directory, NEXT_CONFIG_FILENAMES)) return true;
 	if (hasCompilerInConfigFiles(directory, BABEL_CONFIG_FILENAMES)) return true;
 	if (hasCompilerInConfigFiles(directory, VITE_CONFIG_FILENAMES)) return true;
 	if (hasCompilerInConfigFiles(directory, EXPO_APP_CONFIG_FILENAMES)) return true;
-	if (isProjectBoundary$2(directory)) return false;
+	if (isProjectBoundary(directory)) return false;
 	let ancestorDirectory = path.dirname(directory);
 	while (ancestorDirectory !== path.dirname(ancestorDirectory)) {
 		const ancestorPackagePath = path.join(ancestorDirectory, "package.json");
 		if (isFile(ancestorPackagePath)) {
 			if (hasCompilerPackage(readPackageJson(ancestorPackagePath))) return true;
 		}
-		if (isProjectBoundary$2(ancestorDirectory)) return false;
+		if (isProjectBoundary(ancestorDirectory)) return false;
 		ancestorDirectory = path.dirname(ancestorDirectory);
 	}
 	return false;
@@ -2956,10 +2964,10 @@ const isTailwindAtLeast = (detected, required) => {
 	return detected.minor >= required.minor;
 };
 const JSX_FILE_PATTERN = /\.(tsx|jsx)$/;
-const MILLISECONDS_PER_SECOND = 1e3;
 const SCORE_API_URL = "https://www.react.doctor/api/score";
 const SHARE_BASE_URL = "https://www.react.doctor/share";
 const FETCH_TIMEOUT_MS = 1e4;
+const GITHUB_VIEWER_PERMISSION_TIMEOUT_MS = 2e3;
 const DEFAULT_BRANCH_CANDIDATES = ["main", "master"];
 const ADOPTABLE_LINT_CONFIG_FILENAMES = [".oxlintrc.json", ".eslintrc.json"];
 const OXLINT_NODE_REQUIREMENT = "^20.19.0 || >=22.12.0";
@@ -2985,6 +2993,7 @@ const OXLINT_OUTPUT_MAX_BYTES = 50 * 1024 * 1024;
 const OXLINT_SPAWN_TIMEOUT_MS = 6e4;
 const RECOMMENDED_PNPM_MINIMUM_RELEASE_AGE_MINUTES = 10080;
 const MAX_GLOB_PATTERN_LENGTH_CHARS = 1024;
+const CONFIG_CACHE_TTL_MS = 300 * 1e3;
 var InvalidGlobPatternError = class extends Error {
 	pattern;
 	reason;
@@ -3079,6 +3088,18 @@ const isDiagnosticIgnoredByOverrides = (diagnostic, rootDirectory, overrides) =>
 	const ruleIdentifier = `${diagnostic.plugin}/${diagnostic.rule}`;
 	return overrides.some((override) => override.filePatterns.some((pattern) => pattern.test(relativeFilePath)) && (override.ruleIds.size === 0 || override.ruleIds.has(ruleIdentifier)));
 };
+const SEVERITY_FOR_OVERRIDE = {
+	error: "error",
+	warn: "warning"
+};
+const restampSeverity = (diagnostic, override) => {
+	const targetSeverity = SEVERITY_FOR_OVERRIDE[override];
+	if (diagnostic.severity === targetSeverity) return diagnostic;
+	return {
+		...diagnostic,
+		severity: targetSeverity
+	};
+};
 /**
 * Assembles the internal `RuleSeverityControls` shape from a user
 * config's top-level `rules` and `categories` fields — the
@@ -3096,25 +3117,115 @@ const buildRuleSeverityControls = (config) => {
 		...config.categories !== void 0 ? { categories: config.categories } : {}
 	};
 };
-/**
-* Projects a diagnostic onto the three axes rule-targeted controls
-* reason about:
-*
-* - `ruleKey` — the fully-qualified `"<plugin>/<rule>"` form users
-*   put in config files (consumed by top-level `rules` severity and
-*   `surfaces.*.{include,exclude}Rules`).
-* - `category` — the diagnostic's category label (consumed by
-*   top-level `categories` severity and
-*   `surfaces.*.{include,exclude}Categories`).
-* - `tags` — behavioral tags from the rule registry (consumed by
-*   `ignore.tags` and `surfaces.*.{include,exclude}Tags`). Empty
-*   for non-`react-doctor` plugins.
-*/
-const getDiagnosticRuleIdentity = (diagnostic) => ({
-	ruleKey: `${diagnostic.plugin}/${diagnostic.rule}`,
-	category: diagnostic.category,
-	tags: diagnostic.plugin === "react-doctor" ? reactDoctorPlugin.rules[diagnostic.rule]?.tags ?? [] : []
-});
+const JSX_OPENER_TAG_PATTERN = /<[A-Za-z][\w.]*/g;
+const JSX_TAG_NAME_FOLLOW = /[A-Za-z]/;
+const isOpenerMatchInsideLineComment = (line, openerCharIndex) => {
+	let stringDelimiter = null;
+	for (let charIndex = 0; charIndex < openerCharIndex; charIndex++) {
+		const character = line[charIndex];
+		if (stringDelimiter !== null) {
+			if (character === "\\") {
+				charIndex++;
+				continue;
+			}
+			if (character === stringDelimiter) stringDelimiter = null;
+			continue;
+		}
+		if (character === "\"" || character === "'" || character === "`") {
+			stringDelimiter = character;
+			continue;
+		}
+		if (character === "/" && line[charIndex + 1] === "/") return true;
+	}
+	return false;
+};
+const findOpenerTagOnLine = (line) => {
+	for (const match of line.matchAll(JSX_OPENER_TAG_PATTERN)) {
+		if (match.index === void 0) continue;
+		if (!isOpenerMatchInsideLineComment(line, match.index)) return { startCharIndex: match.index + match[0].length };
+	}
+	return null;
+};
+const findJsxOpenerSpan = (lines, openerLineIndex) => {
+	const openerLine = lines[openerLineIndex];
+	if (openerLine === void 0) return null;
+	const opener = findOpenerTagOnLine(openerLine);
+	if (!opener) return null;
+	const lookaheadLimit = Math.min(lines.length, openerLineIndex + 32);
+	let braceDepth = 0;
+	let innerAngleDepth = 0;
+	let stringDelimiter = null;
+	for (let lineIndex = openerLineIndex; lineIndex < lookaheadLimit; lineIndex++) {
+		const currentLine = lines[lineIndex];
+		const startCharForLine = lineIndex === openerLineIndex ? opener.startCharIndex : 0;
+		for (let charIndex = startCharForLine; charIndex < currentLine.length; charIndex++) {
+			const character = currentLine[charIndex];
+			if (stringDelimiter !== null) {
+				if (character === "\\") {
+					charIndex++;
+					continue;
+				}
+				if (character === stringDelimiter) stringDelimiter = null;
+				continue;
+			}
+			if (character === "\"" || character === "'" || character === "`") {
+				stringDelimiter = character;
+				continue;
+			}
+			if (character === "{") {
+				braceDepth++;
+				continue;
+			}
+			if (character === "}") {
+				braceDepth--;
+				continue;
+			}
+			if (braceDepth !== 0) continue;
+			if (character === "<") {
+				const followCharacter = currentLine[charIndex + 1];
+				if (followCharacter !== void 0 && JSX_TAG_NAME_FOLLOW.test(followCharacter)) innerAngleDepth++;
+				continue;
+			}
+			if (character !== ">") continue;
+			const previousCharacter = currentLine[charIndex - 1];
+			const nextCharacter = currentLine[charIndex + 1];
+			if (previousCharacter === "=" || nextCharacter === "=") continue;
+			if (innerAngleDepth > 0) {
+				innerAngleDepth--;
+				continue;
+			}
+			return lineIndex;
+		}
+	}
+	return null;
+};
+const findEnclosingMultilineJsxOpenerStart = (lines, diagnosticLineIndex) => {
+	for (let candidateIndex = diagnosticLineIndex - 1; candidateIndex >= 0 && diagnosticLineIndex - candidateIndex <= 32; candidateIndex--) {
+		const openerCloseIndex = findJsxOpenerSpan(lines, candidateIndex);
+		if (openerCloseIndex !== null && openerCloseIndex >= diagnosticLineIndex) return candidateIndex;
+	}
+	return null;
+};
+const DISABLE_NEXT_LINE_PATTERN = /(?:\/\/|\/\*)\s*react-doctor-disable-next-line\b(?:\s+([^\r\n]*?))?\s*(?:\*\/)?\s*\}?\s*$/;
+const findStackedDisableCommentsAbove = (lines, anchorIndex) => {
+	const collected = [];
+	let isStillInChain = true;
+	for (let candidateIndex = anchorIndex - 1; candidateIndex >= 0 && anchorIndex - candidateIndex <= 10; candidateIndex--) {
+		const candidateLine = lines[candidateIndex];
+		if (candidateLine === void 0) break;
+		const match = candidateLine.match(DISABLE_NEXT_LINE_PATTERN);
+		if (match) {
+			collected.push({
+				commentLineIndex: candidateIndex,
+				ruleList: match[1],
+				isInChain: isStillInChain
+			});
+			continue;
+		}
+		isStillInChain = false;
+	}
+	return collected;
+};
 const LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY = {
 	"effect/no-adjust-state-on-prop-change": "react-doctor/no-adjust-state-on-prop-change",
 	"effect/no-chain-state-updates": "react-doctor/no-chain-state-updates",
@@ -3245,6 +3356,111 @@ const getEquivalentRuleKeys = (ruleKey) => {
 	const nativeRuleKey = canonicalizeRuleKey(ruleKey);
 	return [nativeRuleKey, ...getLegacyRuleKeysForNative(nativeRuleKey)];
 };
+const stripDescriptionTail = (ruleList) => {
+	const descriptionMatch = ruleList.match(/(?:^|\s)--\s/);
+	if (!descriptionMatch || descriptionMatch.index === void 0) return ruleList;
+	return ruleList.slice(0, descriptionMatch.index);
+};
+const isRuleListedInComment = (ruleList, ruleId) => {
+	const trimmed = ruleList?.trim();
+	if (!trimmed) return true;
+	const ruleSection = stripDescriptionTail(trimmed).trim();
+	if (!ruleSection) return true;
+	return ruleSection.split(/[,\s]+/).some((token) => isSameRuleKey(token.trim(), ruleId));
+};
+const DISABLE_LINE_PATTERN = /(?:\/\/|\/\*)\s*react-doctor-disable-line\b(?:\s+([^\r\n]*?))?\s*(?:\*\/)?\s*\}?\s*$/;
+const formatLineGap = (gapLineCount) => `${gapLineCount} line${gapLineCount === 1 ? "" : "s"}`;
+const hasChainSuppressor = (comments, ruleId) => comments.some((comment) => comment.isInChain && isRuleListedInComment(comment.ruleList, ruleId));
+const findAdjacentRuleListMismatch = (comments, ruleId) => comments.find((comment) => comment.isInChain && Boolean(comment.ruleList?.trim()) && !isRuleListedInComment(comment.ruleList, ruleId));
+const findOutOfChainMatch = (comments, ruleId) => comments.find((comment) => !comment.isInChain && isRuleListedInComment(comment.ruleList, ruleId));
+const buildAdjacentMismatchHint = (comment, ruleId) => {
+	const ruleListText = comment.ruleList?.trim() ?? "";
+	return `An adjacent react-doctor-disable-next-line at line ${comment.commentLineIndex + 1} lists "${ruleListText}" — ${ruleId} is not in that list. Use the comma form: react-doctor-disable-next-line ${ruleListText}, ${ruleId}`;
+};
+const buildGapHint = (comment, diagnosticLineIndex, ruleId) => {
+	const commentLineNumber = comment.commentLineIndex + 1;
+	const diagnosticLineNumber = diagnosticLineIndex + 1;
+	return `A react-doctor-disable-next-line for ${ruleId} sits at line ${commentLineNumber}, but ${formatLineGap(diagnosticLineNumber - commentLineNumber - 1)} of code separate it from the diagnostic on line ${diagnosticLineNumber}. Move the comment immediately above line ${diagnosticLineNumber}, or extract the surrounding code into a helper so the suppression is adjacent.`;
+};
+const classifyFromComments = (commentsByAnchor, diagnosticLineIndex, ruleId) => {
+	for (const comments of commentsByAnchor) {
+		const adjacentMismatch = findAdjacentRuleListMismatch(comments, ruleId);
+		if (adjacentMismatch) return buildAdjacentMismatchHint(adjacentMismatch, ruleId);
+		const outOfChainMatch = findOutOfChainMatch(comments, ruleId);
+		if (outOfChainMatch) return buildGapHint(outOfChainMatch, diagnosticLineIndex, ruleId);
+	}
+	return null;
+};
+const evaluateSuppression = (lines, diagnosticLineIndex, ruleId) => {
+	const sameLineMatch = lines[diagnosticLineIndex]?.match(DISABLE_LINE_PATTERN);
+	if (sameLineMatch && isRuleListedInComment(sameLineMatch[1], ruleId)) return {
+		isSuppressed: true,
+		nearMissHint: null
+	};
+	const directComments = findStackedDisableCommentsAbove(lines, diagnosticLineIndex);
+	if (hasChainSuppressor(directComments, ruleId)) return {
+		isSuppressed: true,
+		nearMissHint: null
+	};
+	const openerStartIndex = findEnclosingMultilineJsxOpenerStart(lines, diagnosticLineIndex);
+	const openerComments = openerStartIndex !== null && openerStartIndex > 0 ? findStackedDisableCommentsAbove(lines, openerStartIndex) : [];
+	if (hasChainSuppressor(openerComments, ruleId)) return {
+		isSuppressed: true,
+		nearMissHint: null
+	};
+	return {
+		isSuppressed: false,
+		nearMissHint: classifyFromComments([directComments, openerComments], diagnosticLineIndex, ruleId)
+	};
+};
+/**
+* Projects a diagnostic onto the three axes rule-targeted controls
+* reason about:
+*
+* - `ruleKey` — the fully-qualified `"<plugin>/<rule>"` form users
+*   put in config files (consumed by top-level `rules` severity and
+*   `surfaces.*.{include,exclude}Rules`).
+* - `category` — the diagnostic's category label (consumed by
+*   top-level `categories` severity and
+*   `surfaces.*.{include,exclude}Categories`).
+* - `tags` — behavioral tags from the rule registry (consumed by
+*   `ignore.tags` and `surfaces.*.{include,exclude}Tags`). Empty
+*   for non-`react-doctor` plugins.
+*/
+const getDiagnosticRuleIdentity = (diagnostic) => ({
+	ruleKey: `${diagnostic.plugin}/${diagnostic.rule}`,
+	category: diagnostic.category,
+	tags: diagnostic.plugin === "react-doctor" ? reactDoctorPlugin.rules[diagnostic.rule]?.tags ?? [] : []
+});
+const compileIgnoredFilePatterns = (userConfig) => {
+	const files = userConfig?.ignore?.files;
+	if (!Array.isArray(files)) return [];
+	return compileGlobPatternsLenient(files.filter((entry) => typeof entry === "string"), (error) => warnConfigIssue(`ignore.files: ${error.message}`));
+};
+const isFileIgnoredByPatterns = (filePath, rootDirectory, patterns) => {
+	if (patterns.length === 0) return false;
+	const relativePath = toRelativePath(filePath, rootDirectory);
+	return patterns.some((pattern) => pattern.test(relativePath));
+};
+const TEST_FILE_DIRECTORY_PATTERN = /(?:^|\/)(?:__tests__|__test__|tests|test|__mocks__|cypress|e2e|playwright)\//;
+const TEST_FILE_SUFFIX_PATTERN = /\.(?:test|spec|stories|story|fixture|fixtures)\.(?:[cm]?[jt]sx?)$/;
+const FIXTURE_PROJECT_PATTERN = /\/(?:fixtures|__fixtures__)\//;
+const SOURCE_ROOT_PATTERN = /\/(?:src|app|lib|components|pages|features|modules|packages|apps|frontend|client)\//g;
+const stripAboveSourceRoot = (relativePath) => {
+	const fixtureMatch = FIXTURE_PROJECT_PATTERN.exec(relativePath);
+	if (fixtureMatch === null) return relativePath;
+	let lastIdx = -1;
+	for (const match of relativePath.matchAll(SOURCE_ROOT_PATTERN)) if (match.index !== void 0 && match.index > lastIdx) lastIdx = match.index;
+	if (lastIdx >= 0) return relativePath.slice(lastIdx);
+	return relativePath.slice(fixtureMatch.index + fixtureMatch[0].length - 1);
+};
+const isTestFilePath = (relativePath) => {
+	if (relativePath.length === 0) return false;
+	const forwardSlashed = relativePath.replaceAll("\\", "/");
+	if (TEST_FILE_SUFFIX_PATTERN.test(forwardSlashed)) return true;
+	const scoped = stripAboveSourceRoot(forwardSlashed);
+	return TEST_FILE_DIRECTORY_PATTERN.test(scoped);
+};
 /**
 * Resolves the user-configured severity override for a rule.
 * Per-rule overrides win over per-category overrides. Returns
@@ -3262,233 +3478,152 @@ const resolveRuleSeverityOverride = (input, controls) => {
 	}
 	return input.category !== void 0 ? controls.categories?.[input.category] : void 0;
 };
-const SEVERITY_FOR_OVERRIDE = {
-	error: "error",
-	warn: "warning"
-};
-const restampSeverity = (diagnostic, override) => {
-	const targetSeverity = SEVERITY_FOR_OVERRIDE[override];
-	if (diagnostic.severity === targetSeverity) return diagnostic;
-	return {
-		...diagnostic,
-		severity: targetSeverity
-	};
-};
-const JSX_OPENER_TAG_PATTERN = /<[A-Za-z][\w.]*/g;
-const JSX_TAG_NAME_FOLLOW = /[A-Za-z]/;
-const isOpenerMatchInsideLineComment = (line, openerCharIndex) => {
-	let stringDelimiter = null;
-	for (let charIndex = 0; charIndex < openerCharIndex; charIndex++) {
-		const character = line[charIndex];
-		if (stringDelimiter !== null) {
-			if (character === "\\") {
-				charIndex++;
-				continue;
-			}
-			if (character === stringDelimiter) stringDelimiter = null;
-			continue;
-		}
-		if (character === "\"" || character === "'" || character === "`") {
-			stringDelimiter = character;
-			continue;
-		}
-		if (character === "/" && line[charIndex + 1] === "/") return true;
-	}
-	return false;
+/**
+* Resolves the absolute path to read for a diagnostic's `filePath`,
+* accounting for the various shapes oxlint emits:
+*
+* - Absolute POSIX (`/abs/path/file.tsx`) — pass through.
+* - Absolute Windows (`C:/...` or `C:\...`) — pass through.
+* - `./relative` or bare relative — join against `rootDirectory`.
+*
+* Shared between the streaming diagnostic pipeline and the legacy
+* array-shaped `mergeAndFilterDiagnostics` wrapper so file-line lookups
+* use one canonical resolution path.
+*/
+const resolveCandidateReadPath = (rootDirectory, filePath) => {
+	const normalizedFile = filePath.replace(/\\/g, "/");
+	if (normalizedFile.startsWith("/") || /^[a-zA-Z]:\//.test(normalizedFile) || /^[a-zA-Z]:\\/.test(filePath)) return filePath;
+	return `${rootDirectory.replace(/\\/g, "/").replace(/\/$/, "")}/${normalizedFile.replace(/^\.\//, "")}`;
 };
-const findOpenerTagOnLine = (line) => {
-	for (const match of line.matchAll(JSX_OPENER_TAG_PATTERN)) {
-		if (match.index === void 0) continue;
-		if (!isOpenerMatchInsideLineComment(line, match.index)) return { startCharIndex: match.index + match[0].length };
+/**
+* Shared raw-line scanners that detect whether a diagnostic site is
+* enclosed by a configured `textComponents` entry or a
+* `rawTextWrapperComponents` entry. Both checks are used by the
+* diagnostic-pipeline's `rn-no-raw-text` suppression step.
+*
+* Heuristic — operates on raw lines without an AST — but good enough
+* to (a) detect a string-only wrapper child and (b) verify the opener
+* actually encloses a given diagnostic position.
+*/
+const OPENING_TAG_PATTERN = /<([A-Z][\w.]*)/;
+const JSX_CHILD_OPEN_PATTERN = /<[A-Za-z]/;
+const escapeRegExpSpecials = (rawText) => rawText.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+const findOpenerAtOrAbove = (lines, upperBoundLineIndex) => {
+	for (let lineIndex = upperBoundLineIndex; lineIndex >= 0; lineIndex--) {
+		const match = lines[lineIndex].match(OPENING_TAG_PATTERN);
+		if (!match) continue;
+		const fullName = match[1];
+		return {
+			fullName,
+			leafName: fullName.includes(".") ? fullName.split(".").at(-1) ?? fullName : fullName,
+			lineIndex
+		};
 	}
 	return null;
 };
-const findJsxOpenerSpan = (lines, openerLineIndex) => {
-	const openerLine = lines[openerLineIndex];
-	if (openerLine === void 0) return null;
-	const opener = findOpenerTagOnLine(openerLine);
-	if (!opener) return null;
-	const lookaheadLimit = Math.min(lines.length, openerLineIndex + 32);
-	let braceDepth = 0;
-	let innerAngleDepth = 0;
-	let stringDelimiter = null;
-	for (let lineIndex = openerLineIndex; lineIndex < lookaheadLimit; lineIndex++) {
-		const currentLine = lines[lineIndex];
-		const startCharForLine = lineIndex === openerLineIndex ? opener.startCharIndex : 0;
-		for (let charIndex = startCharForLine; charIndex < currentLine.length; charIndex++) {
-			const character = currentLine[charIndex];
-			if (stringDelimiter !== null) {
-				if (character === "\\") {
-					charIndex++;
-					continue;
-				}
-				if (character === stringDelimiter) stringDelimiter = null;
-				continue;
-			}
-			if (character === "\"" || character === "'" || character === "`") {
-				stringDelimiter = character;
-				continue;
-			}
-			if (character === "{") {
-				braceDepth++;
-				continue;
-			}
-			if (character === "}") {
-				braceDepth--;
-				continue;
-			}
-			if (braceDepth !== 0) continue;
-			if (character === "<") {
-				const followCharacter = currentLine[charIndex + 1];
-				if (followCharacter !== void 0 && JSX_TAG_NAME_FOLLOW.test(followCharacter)) innerAngleDepth++;
-				continue;
-			}
-			if (character !== ">") continue;
-			const previousCharacter = currentLine[charIndex - 1];
-			const nextCharacter = currentLine[charIndex + 1];
-			if (previousCharacter === "=" || nextCharacter === "=") continue;
-			if (innerAngleDepth > 0) {
-				innerAngleDepth--;
-				continue;
-			}
-			return lineIndex;
-		}
+const resolveJsxRange = (lines, opener) => {
+	const closingPattern = new RegExp(`</(?:${escapeRegExpSpecials(opener.fullName)}|${escapeRegExpSpecials(opener.leafName)})\\s*>`);
+	let closerLineIndex = -1;
+	let closerColumn = -1;
+	for (let lineIndex = opener.lineIndex; lineIndex < lines.length; lineIndex++) {
+		const match = closingPattern.exec(lines[lineIndex]);
+		if (!match) continue;
+		closerLineIndex = lineIndex;
+		closerColumn = match.index;
+		break;
+	}
+	if (closerLineIndex < 0) return null;
+	const openerLine = lines[opener.lineIndex];
+	const tagStartIndex = openerLine.indexOf(`<${opener.fullName}`);
+	if (tagStartIndex < 0) return null;
+	const openerEndIndex = openerLine.indexOf(">", tagStartIndex);
+	let bodyText;
+	if (opener.lineIndex === closerLineIndex) {
+		if (openerEndIndex < 0 || openerEndIndex >= closerColumn) return null;
+		bodyText = openerLine.slice(openerEndIndex + 1, closerColumn);
+	} else {
+		const segments = [];
+		if (openerEndIndex >= 0) segments.push(openerLine.slice(openerEndIndex + 1));
+		for (let lineIndex = opener.lineIndex + 1; lineIndex < closerLineIndex; lineIndex++) segments.push(lines[lineIndex]);
+		segments.push(lines[closerLineIndex].slice(0, closerColumn));
+		bodyText = segments.join("\n");
 	}
-	return null;
+	return {
+		closerLineIndex,
+		closerColumn,
+		bodyText
+	};
 };
-const findEnclosingMultilineJsxOpenerStart = (lines, diagnosticLineIndex) => {
-	for (let candidateIndex = diagnosticLineIndex - 1; candidateIndex >= 0 && diagnosticLineIndex - candidateIndex <= 32; candidateIndex--) {
-		const openerCloseIndex = findJsxOpenerSpan(lines, candidateIndex);
-		if (openerCloseIndex !== null && openerCloseIndex >= diagnosticLineIndex) return candidateIndex;
+/**
+* Returns true when the JSX element opened at or above `diagnosticLine`
+* is named in `textComponentNames`, matching either by full dotted name
+* (`NativeTabs.Trigger.Label`) or by the leaf name (`Label`).
+*/
+const isInsideTextComponent = (lines, diagnosticLine, textComponentNames) => {
+	for (let lineIndex = diagnosticLine - 1; lineIndex >= 0; lineIndex--) {
+		const match = lines[lineIndex].match(OPENING_TAG_PATTERN);
+		if (!match) continue;
+		const fullTagName = match[1];
+		const leafTagName = fullTagName.includes(".") ? fullTagName.split(".").at(-1) ?? fullTagName : fullTagName;
+		return textComponentNames.has(fullTagName) || textComponentNames.has(leafTagName);
 	}
-	return null;
+	return false;
 };
-const DISABLE_NEXT_LINE_PATTERN = /(?:\/\/|\/\*)\s*react-doctor-disable-next-line\b(?:\s+([^\r\n]*?))?\s*(?:\*\/)?\s*\}?\s*$/;
-const findStackedDisableCommentsAbove = (lines, anchorIndex) => {
-	const collected = [];
-	let isStillInChain = true;
-	for (let candidateIndex = anchorIndex - 1; candidateIndex >= 0 && anchorIndex - candidateIndex <= 10; candidateIndex--) {
-		const candidateLine = lines[candidateIndex];
-		if (candidateLine === void 0) break;
-		const match = candidateLine.match(DISABLE_NEXT_LINE_PATTERN);
-		if (match) {
-			collected.push({
-				commentLineIndex: candidateIndex,
-				ruleList: match[1],
-				isInChain: isStillInChain
-			});
+/**
+* Returns true when the diagnostic position is enclosed by the nearest
+* actually-enclosing opener AND that opener is in `wrapperNames` AND
+* its body has no JSX child elements (i.e. the wrapper holds only
+* stringifiable children). Closed siblings above the diagnostic are
+* skipped — `findOpenerAtOrAbove` keeps walking outward.
+*
+* Diagnostic line and column are 1-indexed; column may be 0 when oxlint
+* omits the span (we treat that as "earliest position on the line",
+* which is conservative for enclosure checks).
+*/
+const isInsideStringOnlyWrapper = (lines, diagnosticLine, diagnosticColumn, wrapperNames) => {
+	const diagnosticLineIndex = diagnosticLine - 1;
+	const diagnosticColumnIndex = Math.max(0, diagnosticColumn - 1);
+	let upperBoundLineIndex = diagnosticLineIndex;
+	while (upperBoundLineIndex >= 0) {
+		const opener = findOpenerAtOrAbove(lines, upperBoundLineIndex);
+		if (!opener) return false;
+		const range = resolveJsxRange(lines, opener);
+		if (range === null) {
+			upperBoundLineIndex = opener.lineIndex - 1;
 			continue;
 		}
-		isStillInChain = false;
-	}
-	return collected;
-};
-const stripDescriptionTail = (ruleList) => {
-	const descriptionMatch = ruleList.match(/(?:^|\s)--\s/);
-	if (!descriptionMatch || descriptionMatch.index === void 0) return ruleList;
-	return ruleList.slice(0, descriptionMatch.index);
-};
-const isRuleListedInComment = (ruleList, ruleId) => {
-	const trimmed = ruleList?.trim();
-	if (!trimmed) return true;
-	const ruleSection = stripDescriptionTail(trimmed).trim();
-	if (!ruleSection) return true;
-	return ruleSection.split(/[,\s]+/).some((token) => isSameRuleKey(token.trim(), ruleId));
-};
-const DISABLE_LINE_PATTERN = /(?:\/\/|\/\*)\s*react-doctor-disable-line\b(?:\s+([^\r\n]*?))?\s*(?:\*\/)?\s*\}?\s*$/;
-const formatLineGap = (gapLineCount) => `${gapLineCount} line${gapLineCount === 1 ? "" : "s"}`;
-const hasChainSuppressor = (comments, ruleId) => comments.some((comment) => comment.isInChain && isRuleListedInComment(comment.ruleList, ruleId));
-const findAdjacentRuleListMismatch = (comments, ruleId) => comments.find((comment) => comment.isInChain && Boolean(comment.ruleList?.trim()) && !isRuleListedInComment(comment.ruleList, ruleId));
-const findOutOfChainMatch = (comments, ruleId) => comments.find((comment) => !comment.isInChain && isRuleListedInComment(comment.ruleList, ruleId));
-const buildAdjacentMismatchHint = (comment, ruleId) => {
-	const ruleListText = comment.ruleList?.trim() ?? "";
-	return `An adjacent react-doctor-disable-next-line at line ${comment.commentLineIndex + 1} lists "${ruleListText}" — ${ruleId} is not in that list. Use the comma form: react-doctor-disable-next-line ${ruleListText}, ${ruleId}`;
-};
-const buildGapHint = (comment, diagnosticLineIndex, ruleId) => {
-	const commentLineNumber = comment.commentLineIndex + 1;
-	const diagnosticLineNumber = diagnosticLineIndex + 1;
-	return `A react-doctor-disable-next-line for ${ruleId} sits at line ${commentLineNumber}, but ${formatLineGap(diagnosticLineNumber - commentLineNumber - 1)} of code separate it from the diagnostic on line ${diagnosticLineNumber}. Move the comment immediately above line ${diagnosticLineNumber}, or extract the surrounding code into a helper so the suppression is adjacent.`;
-};
-const classifyFromComments = (commentsByAnchor, diagnosticLineIndex, ruleId) => {
-	for (const comments of commentsByAnchor) {
-		const adjacentMismatch = findAdjacentRuleListMismatch(comments, ruleId);
-		if (adjacentMismatch) return buildAdjacentMismatchHint(adjacentMismatch, ruleId);
-		const outOfChainMatch = findOutOfChainMatch(comments, ruleId);
-		if (outOfChainMatch) return buildGapHint(outOfChainMatch, diagnosticLineIndex, ruleId);
+		if (range.closerLineIndex < diagnosticLineIndex || range.closerLineIndex === diagnosticLineIndex && range.closerColumn <= diagnosticColumnIndex) {
+			upperBoundLineIndex = opener.lineIndex - 1;
+			continue;
+		}
+		if (!wrapperNames.has(opener.fullName) && !wrapperNames.has(opener.leafName)) return false;
+		return !JSX_CHILD_OPEN_PATTERN.test(range.bodyText);
 	}
-	return null;
-};
-const evaluateSuppression = (lines, diagnosticLineIndex, ruleId) => {
-	const sameLineMatch = lines[diagnosticLineIndex]?.match(DISABLE_LINE_PATTERN);
-	if (sameLineMatch && isRuleListedInComment(sameLineMatch[1], ruleId)) return {
-		isSuppressed: true,
-		nearMissHint: null
-	};
-	const directComments = findStackedDisableCommentsAbove(lines, diagnosticLineIndex);
-	if (hasChainSuppressor(directComments, ruleId)) return {
-		isSuppressed: true,
-		nearMissHint: null
-	};
-	const openerStartIndex = findEnclosingMultilineJsxOpenerStart(lines, diagnosticLineIndex);
-	const openerComments = openerStartIndex !== null && openerStartIndex > 0 ? findStackedDisableCommentsAbove(lines, openerStartIndex) : [];
-	if (hasChainSuppressor(openerComments, ruleId)) return {
-		isSuppressed: true,
-		nearMissHint: null
-	};
-	return {
-		isSuppressed: false,
-		nearMissHint: classifyFromComments([directComments, openerComments], diagnosticLineIndex, ruleId)
-	};
-};
-const compileIgnoredFilePatterns = (userConfig) => {
-	const files = userConfig?.ignore?.files;
-	if (!Array.isArray(files)) return [];
-	return compileGlobPatternsLenient(files.filter((entry) => typeof entry === "string"), (error) => warnConfigIssue(`ignore.files: ${error.message}`));
-};
-const isFileIgnoredByPatterns = (filePath, rootDirectory, patterns) => {
-	if (patterns.length === 0) return false;
-	const relativePath = toRelativePath(filePath, rootDirectory);
-	return patterns.some((pattern) => pattern.test(relativePath));
-};
-const resolveCandidateReadPath = (rootDirectory, filePath) => {
-	const normalizedFile = filePath.replace(/\\/g, "/");
-	if (normalizedFile.startsWith("/") || /^[a-zA-Z]:\//.test(normalizedFile) || /^[a-zA-Z]:\\/.test(filePath)) return filePath;
-	return `${rootDirectory.replace(/\\/g, "/").replace(/\/$/, "")}/${normalizedFile.replace(/^\.\//, "")}`;
-};
-const TEST_FILE_DIRECTORY_PATTERN = /(?:^|\/)(?:__tests__|__test__|tests|test|__mocks__|cypress|e2e|playwright)\//;
-const TEST_FILE_SUFFIX_PATTERN = /\.(?:test|spec|stories|story|fixture|fixtures)\.(?:[cm]?[jt]sx?)$/;
-const FIXTURE_PROJECT_PATTERN = /\/(?:fixtures|__fixtures__)\//;
-const SOURCE_ROOT_PATTERN = /\/(?:src|app|lib|components|pages|features|modules|packages|apps|frontend|client)\//g;
-const stripAboveSourceRoot = (relativePath) => {
-	const fixtureMatch = FIXTURE_PROJECT_PATTERN.exec(relativePath);
-	if (fixtureMatch === null) return relativePath;
-	let lastIdx = -1;
-	for (const match of relativePath.matchAll(SOURCE_ROOT_PATTERN)) if (match.index !== void 0 && match.index > lastIdx) lastIdx = match.index;
-	if (lastIdx >= 0) return relativePath.slice(lastIdx);
-	return relativePath.slice(fixtureMatch.index + fixtureMatch[0].length - 1);
+	return false;
 };
-const isTestFilePath = (relativePath) => {
-	if (relativePath.length === 0) return false;
-	const forwardSlashed = relativePath.replaceAll("\\", "/");
-	if (TEST_FILE_SUFFIX_PATTERN.test(forwardSlashed)) return true;
-	const scoped = stripAboveSourceRoot(forwardSlashed);
-	return TEST_FILE_DIRECTORY_PATTERN.test(scoped);
+const collectStringSet = (values) => {
+	if (!Array.isArray(values)) return /* @__PURE__ */ new Set();
+	return new Set(values.filter((value) => typeof value === "string"));
 };
 /**
 * Pre-compiles every stateful filter and returns a single
-* `apply(diagnostic)` closure that runs:
+* `apply(diagnostic)` closure that runs (in order):
 *
 * 1. auto-suppress (test-noise rules in test files; `migration-hint`
 *    wins over `test-noise`)
 * 2. severity overrides (top-level `rules` / `categories`, with
 *    `"off"` dropping)
 * 3. ignore filters (rules / file patterns / per-file overrides)
-* 4. inline suppressions (`// react-doctor-disable-next-line ...`)
+* 4. `rn-no-raw-text` suppression via configured `textComponents` and
+*    `rawTextWrapperComponents` (config-driven JSX enclosure checks)
+* 5. inline suppressions (`// react-doctor-disable-next-line ...`)
 *
 * Returns `null` when the diagnostic is dropped, the (possibly
-* severity-restamped) diagnostic otherwise. Shared by `runInspect`'s
-* streaming pipeline and the array-shaped `mergeAndFilterDiagnostics`
-* — single source of truth.
+* severity-restamped) diagnostic otherwise.
+*
+* This is the single source of truth for diagnostic filtering — both
+* `runInspect`'s streaming pipeline and the array-shaped
+* `mergeAndFilterDiagnostics` wrapper apply this closure per element.
 */
 const buildDiagnosticPipeline = (input) => {
 	const { rootDirectory, userConfig, readFileLinesSync, respectInlineDisables } = input;
@@ -3496,6 +3631,10 @@ const buildDiagnosticPipeline = (input) => {
 	const ignoredRules = new Set(Array.isArray(userConfig?.ignore?.rules) ? userConfig.ignore.rules.filter((rule) => typeof rule === "string") : []);
 	const ignoredFilePatterns = compileIgnoredFilePatterns(userConfig);
 	const compiledOverrides = compileIgnoreOverrides(userConfig);
+	const textComponentNames = collectStringSet(userConfig?.textComponents);
+	const rawTextWrapperComponentNames = collectStringSet(userConfig?.rawTextWrapperComponents);
+	const hasTextComponents = textComponentNames.size > 0;
+	const hasRawTextWrappers = rawTextWrapperComponentNames.size > 0;
 	const fileLinesCache = /* @__PURE__ */ new Map();
 	const testFileCache = /* @__PURE__ */ new Map();
 	const getFileLines = (filePath) => {
@@ -3524,6 +3663,16 @@ const buildDiagnosticPipeline = (input) => {
 		for (const ignored of ignoredRules) if (isSameRuleKey(ignored, ruleIdentifier)) return true;
 		return false;
 	};
+	const isRnRawTextSuppressedByConfig = (diagnostic) => {
+		if (diagnostic.rule !== "rn-no-raw-text") return false;
+		if (diagnostic.line <= 0) return false;
+		if (!hasTextComponents && !hasRawTextWrappers) return false;
+		const lines = getFileLines(diagnostic.filePath);
+		if (!lines) return false;
+		if (hasTextComponents && isInsideTextComponent(lines, diagnostic.line, textComponentNames)) return true;
+		if (hasRawTextWrappers && isInsideStringOnlyWrapper(lines, diagnostic.line, diagnostic.column, rawTextWrapperComponentNames)) return true;
+		return false;
+	};
 	return { apply: (diagnostic) => {
 		if (shouldAutoSuppress(diagnostic)) return null;
 		let current = diagnostic;
@@ -3540,6 +3689,7 @@ const buildDiagnosticPipeline = (input) => {
 			if (isRuleIgnored(`${current.plugin}/${current.rule}`)) return null;
 			if (isFileIgnoredByPatterns(current.filePath, rootDirectory, ignoredFilePatterns)) return null;
 			if (isDiagnosticIgnoredByOverrides(current, rootDirectory, compiledOverrides)) return null;
+			if (isRnRawTextSuppressedByConfig(current)) return null;
 		}
 		if (respectInlineDisables && current.line > 0) {
 			const lines = getFileLines(current.filePath);
@@ -3666,6 +3816,27 @@ var ReactDoctorError = class extends Schema.TaggedErrorClass()("ReactDoctorError
 const formatReactDoctorError = (error) => error.reason.message;
 const isSplittableReactDoctorError = (error) => error instanceof ReactDoctorError && error.reason._tag === "OxlintBatchExceeded";
 const isReactDoctorError = (error) => error instanceof ReactDoctorError;
+/**
+* Tagged-reason → legacy thrown-class boundary shared by every public
+* shell (`inspect()` in `react-doctor`, `diagnose()` in `@react-doctor/api`).
+*
+* `Effect.catchReasons` dispatches on the tagged-error sub-channel
+* without manual `instanceof` checks. Each handler converts a tagged
+* reason into the historical thrown class advertised by the legacy
+* public-API contract (via `Effect.die`, which `Effect.runPromise`
+* re-throws unchanged). The `orElse` branch re-`die`s the original
+* `ReactDoctorError` instance so advanced callers can still narrow on
+* `error.reason._tag` while grep-stderr users keep the same
+* `error.message` they always saw.
+*
+* Adding a new legacy thrown class is a one-line change on the
+* `Effect.catchReasons` map — both shells pick it up automatically.
+*/
+const restoreLegacyThrow = (effect) => effect.pipe(Effect.catchReasons("ReactDoctorError", {
+	NoReactDependency: (reason) => Effect.die(new NoReactDependencyError(reason.directory)),
+	ProjectNotFound: (reason) => Effect.die(new ProjectNotFoundError(reason.directory)),
+	AmbiguousProject: (reason) => Effect.die(new AmbiguousProjectError(reason.directory, [...reason.candidates]))
+}, (_reason, error) => Effect.die(error)));
 const TRACER_PROJECT_NAME = "react-doctor";
 const OTEL_ENDPOINT = Config$1.string("REACT_DOCTOR_OTLP_ENDPOINT").pipe(Config$1.option);
 const OTEL_AUTH_HEADER = Config$1.redacted("REACT_DOCTOR_OTLP_AUTH_HEADER").pipe(Config$1.option);
@@ -3708,216 +3879,6 @@ Context.Reference("react-doctor/OxlintSpawnTimeoutMs", { defaultValue: () => {
 } });
 Context.Reference("react-doctor/OxlintOutputMaxBytes", { defaultValue: () => OXLINT_OUTPUT_MAX_BYTES });
 Context.Reference("react-doctor/StagedFilesTempDirPrefix", { defaultValue: () => "react-doctor-staged-" });
-const PNPM_WORKSPACE_FILE = "pnpm-workspace.yaml";
-const PNPM_LOCKFILE = "pnpm-lock.yaml";
-const PACKAGE_JSON_FILE = "package.json";
-const PNPM_HARDENING_RULE_KEY = "require-pnpm-hardening";
-const UTF8_BOM_CHAR = "";
-const HARDENING_SETTING_KEYS = new Set([
-	"minimumReleaseAge",
-	"blockExoticSubdeps",
-	"trustPolicy"
-]);
-const stripInlineComment = (rawValue) => {
-	let activeQuote = null;
-	for (let charIndex = 0; charIndex < rawValue.length; charIndex += 1) {
-		const currentChar = rawValue[charIndex];
-		if (activeQuote !== null) {
-			if (currentChar === activeQuote) activeQuote = null;
-			continue;
-		}
-		if (currentChar === "\"" || currentChar === "'") {
-			activeQuote = currentChar;
-			continue;
-		}
-		if (currentChar !== "#") continue;
-		const previousChar = rawValue[charIndex - 1];
-		if (charIndex === 0 || previousChar !== void 0 && /\s/.test(previousChar)) return rawValue.slice(0, charIndex);
-	}
-	return rawValue;
-};
-const unquote = (rawValue) => rawValue.replace(/^["']|["']$/g, "");
-const stripBom = (rawContent) => rawContent.startsWith(UTF8_BOM_CHAR) ? rawContent.slice(1) : rawContent;
-const parseHardeningSettings = (content) => {
-	let minimumReleaseAge = null;
-	let blockExoticSubdeps = null;
-	let trustPolicy = null;
-	const lines = stripBom(content).split(/\r?\n/);
-	for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
-		const lineText = lines[lineIndex];
-		if (lineText === void 0) continue;
-		if (lineText.search(/\S/) !== 0) continue;
-		const trimmedLine = lineText.trim();
-		if (trimmedLine.startsWith("#")) continue;
-		const colonIndex = trimmedLine.indexOf(":");
-		if (colonIndex <= 0) continue;
-		const settingKey = unquote(trimmedLine.slice(0, colonIndex).trim());
-		if (!HARDENING_SETTING_KEYS.has(settingKey)) continue;
-		const inlineValue = stripInlineComment(trimmedLine.slice(colonIndex + 1)).trim();
-		if (inlineValue.length === 0) continue;
-		const scalar = {
-			value: unquote(inlineValue),
-			line: lineIndex + 1,
-			column: lineText.search(/\S/) + 1
-		};
-		if (settingKey === "minimumReleaseAge") minimumReleaseAge = scalar;
-		else if (settingKey === "blockExoticSubdeps") blockExoticSubdeps = scalar;
-		else if (settingKey === "trustPolicy") trustPolicy = scalar;
-	}
-	return {
-		minimumReleaseAge,
-		blockExoticSubdeps,
-		trustPolicy
-	};
-};
-const isPnpmManagedProject = (rootDirectory) => {
-	if (isFile(path.join(rootDirectory, PNPM_LOCKFILE))) return true;
-	if (isFile(path.join(rootDirectory, PNPM_WORKSPACE_FILE))) return true;
-	const packageJsonPath = path.join(rootDirectory, PACKAGE_JSON_FILE);
-	if (!isFile(packageJsonPath)) return false;
-	try {
-		const packageJsonRaw = fs.readFileSync(packageJsonPath, "utf-8");
-		const packageJson = JSON.parse(packageJsonRaw);
-		if (packageJson !== null && typeof packageJson === "object" && "packageManager" in packageJson && typeof packageJson.packageManager === "string" && packageJson.packageManager.startsWith("pnpm@")) return true;
-	} catch {
-		return false;
-	}
-	return false;
-};
-const buildHardeningDiagnostic = (input) => ({
-	filePath: PNPM_WORKSPACE_FILE,
-	plugin: "react-doctor",
-	rule: PNPM_HARDENING_RULE_KEY,
-	severity: "warning",
-	message: input.message,
-	help: input.help,
-	line: input.line ?? 0,
-	column: input.column ?? 0,
-	category: "Security"
-});
-const checkPnpmHardening = (rootDirectory) => {
-	if (!isPnpmManagedProject(rootDirectory)) return [];
-	const workspacePath = path.join(rootDirectory, PNPM_WORKSPACE_FILE);
-	const settings = parseHardeningSettings(isFile(workspacePath) ? fs.readFileSync(workspacePath, "utf-8") : "");
-	const diagnostics = [];
-	if (settings.minimumReleaseAge === null) diagnostics.push(buildHardeningDiagnostic({
-		message: "pnpm-workspace.yaml is missing `minimumReleaseAge` — newly published versions can ship malware that gets caught and unpublished within hours",
-		help: `Add \`minimumReleaseAge: ${RECOMMENDED_PNPM_MINIMUM_RELEASE_AGE_MINUTES}\` (7 days) to pnpm-workspace.yaml to delay installs until releases have had time to be vetted`
-	}));
-	if (settings.blockExoticSubdeps !== null && settings.blockExoticSubdeps.value.toLowerCase() === "false") diagnostics.push(buildHardeningDiagnostic({
-		line: settings.blockExoticSubdeps.line,
-		column: settings.blockExoticSubdeps.column,
-		message: "`blockExoticSubdeps: false` allows transitive deps from `git:`, `file:`, or tarball URLs — a known supply-chain bypass of the npm registry",
-		help: "Set `blockExoticSubdeps: true` (the default in recent pnpm v11) so transitive deps must come from the registry"
-	}));
-	if (settings.trustPolicy === null) diagnostics.push(buildHardeningDiagnostic({
-		message: "pnpm-workspace.yaml is missing `trustPolicy` — without `no-downgrade`, pnpm silently accepts packages whose trust signals (provenance, signatures) weaken between updates",
-		help: "Add `trustPolicy: no-downgrade` to pnpm-workspace.yaml"
-	}));
-	else if (settings.trustPolicy.value !== "no-downgrade") diagnostics.push(buildHardeningDiagnostic({
-		line: settings.trustPolicy.line,
-		column: settings.trustPolicy.column,
-		message: `\`trustPolicy: ${settings.trustPolicy.value}\` is weaker than \`no-downgrade\` — packages may lose trust signals between updates without you noticing`,
-		help: "Set `trustPolicy: no-downgrade` so pnpm refuses to downgrade trust between resolutions"
-	}));
-	return diagnostics;
-};
-const REDUCED_MOTION_GREP_PATTERN = "prefers-reduced-motion|useReducedMotion|MotionConfig|reducedMotion";
-const REDUCED_MOTION_FILE_GLOBS = [
-	"*.ts",
-	"*.tsx",
-	"*.js",
-	"*.jsx",
-	"*.css",
-	"*.scss"
-];
-const MISSING_REDUCED_MOTION_DIAGNOSTIC = {
-	filePath: "package.json",
-	plugin: "react-doctor",
-	rule: "require-reduced-motion",
-	severity: "error",
-	message: "Project uses a motion library but has no prefers-reduced-motion handling — required for accessibility (WCAG 2.3.3)",
-	help: "Add `useReducedMotion()` from your animation library, or a `@media (prefers-reduced-motion: reduce)` CSS query",
-	line: 0,
-	column: 0,
-	category: "Accessibility"
-};
-const checkReducedMotion = (rootDirectory) => {
-	const packageJsonPath = path.join(rootDirectory, "package.json");
-	if (!isFile(packageJsonPath)) return [];
-	let hasMotionLibrary = false;
-	try {
-		const packageJson = readPackageJson(packageJsonPath);
-		const allDependencies = {
-			...packageJson.dependencies,
-			...packageJson.devDependencies
-		};
-		hasMotionLibrary = Object.keys(allDependencies).some((packageName) => MOTION_LIBRARY_PACKAGES.has(packageName));
-	} catch {
-		return [];
-	}
-	if (!hasMotionLibrary) return [];
-	const result = spawnSync("git", [
-		"grep",
-		"-ql",
-		"-E",
-		REDUCED_MOTION_GREP_PATTERN,
-		"--",
-		...REDUCED_MOTION_FILE_GLOBS
-	], {
-		cwd: rootDirectory,
-		stdio: [
-			"ignore",
-			"pipe",
-			"pipe"
-		]
-	});
-	if (result.error) return [MISSING_REDUCED_MOTION_DIAGNOSTIC];
-	if (result.status === 0) return [];
-	return [MISSING_REDUCED_MOTION_DIAGNOSTIC];
-};
-const computeJsxIncludePaths = (includePaths) => includePaths.length > 0 ? includePaths.filter((filePath) => JSX_FILE_PATTERN.test(filePath)) : void 0;
-const listSourceFilesViaGit = (rootDirectory) => {
-	const result = spawnSync("git", [
-		"ls-files",
-		"-z",
-		"--cached",
-		"--others",
-		"--exclude-standard"
-	], {
-		cwd: rootDirectory,
-		encoding: "utf-8",
-		maxBuffer: GIT_LS_FILES_MAX_BUFFER_BYTES
-	});
-	if (result.error || result.status !== 0) return null;
-	return result.stdout.split("\0").filter((filePath) => filePath.length > 0 && SOURCE_FILE_PATTERN.test(filePath));
-};
-const listSourceFilesViaFilesystem = (rootDirectory) => {
-	const filePaths = [];
-	const stack = [rootDirectory];
-	while (stack.length > 0) {
-		const currentDirectory = stack.pop();
-		const entries = readDirectoryEntries(currentDirectory);
-		for (const entry of entries) {
-			const absolutePath = path.join(currentDirectory, entry.name);
-			if (entry.isDirectory()) {
-				if (!entry.name.startsWith(".") && !IGNORED_DIRECTORIES.has(entry.name)) stack.push(absolutePath);
-				continue;
-			}
-			if (entry.isFile() && SOURCE_FILE_PATTERN.test(entry.name)) filePaths.push(path.relative(rootDirectory, absolutePath).replace(/\\/g, "/"));
-		}
-	}
-	return filePaths;
-};
-const listSourceFiles = (rootDirectory) => listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory);
-const resolveLintIncludePaths = (rootDirectory, userConfig) => {
-	if (!Array.isArray(userConfig?.ignore?.files) || userConfig.ignore.files.length === 0) return;
-	const ignoredPatterns = compileIgnoredFilePatterns(userConfig);
-	return listSourceFiles(rootDirectory).filter((filePath) => {
-		if (!JSX_FILE_PATTERN.test(filePath)) return false;
-		return !isFileIgnoredByPatterns(filePath, rootDirectory, ignoredPatterns);
-	});
-};
 const DIAGNOSTIC_SURFACES = [
 	"cli",
 	"prComment",
@@ -4091,56 +4052,339 @@ const loadConfigFromDirectory = (directory) => {
 	}
 	return null;
 };
-const isProjectBoundary$1 = (directory) => fs.existsSync(path.join(directory, ".git")) || isMonorepoRoot(directory);
-const cachedConfigs = /* @__PURE__ */ new Map();
-const loadConfigWithSource = (rootDirectory) => {
-	const cached = cachedConfigs.get(rootDirectory);
-	if (cached !== void 0) return cached;
-	const localConfig = loadConfigFromDirectory(rootDirectory);
-	if (localConfig) {
-		cachedConfigs.set(rootDirectory, localConfig);
-		return localConfig;
-	}
-	if (isProjectBoundary$1(rootDirectory)) {
-		cachedConfigs.set(rootDirectory, null);
-		return null;
-	}
-	let ancestorDirectory = path.dirname(rootDirectory);
-	while (ancestorDirectory !== path.dirname(ancestorDirectory)) {
-		const ancestorConfig = loadConfigFromDirectory(ancestorDirectory);
-		if (ancestorConfig) {
-			cachedConfigs.set(rootDirectory, ancestorConfig);
-			return ancestorConfig;
-		}
-		if (isProjectBoundary$1(ancestorDirectory)) {
-			cachedConfigs.set(rootDirectory, null);
-			return null;
+const cachedConfigs = /* @__PURE__ */ new Map();
+const loadConfigWithSource = (rootDirectory) => {
+	const cached = cachedConfigs.get(rootDirectory);
+	if (cached !== void 0) return cached;
+	const localConfig = loadConfigFromDirectory(rootDirectory);
+	if (localConfig) {
+		cachedConfigs.set(rootDirectory, localConfig);
+		return localConfig;
+	}
+	if (isProjectBoundary(rootDirectory)) {
+		cachedConfigs.set(rootDirectory, null);
+		return null;
+	}
+	let ancestorDirectory = path.dirname(rootDirectory);
+	while (ancestorDirectory !== path.dirname(ancestorDirectory)) {
+		const ancestorConfig = loadConfigFromDirectory(ancestorDirectory);
+		if (ancestorConfig) {
+			cachedConfigs.set(rootDirectory, ancestorConfig);
+			return ancestorConfig;
+		}
+		if (isProjectBoundary(ancestorDirectory)) {
+			cachedConfigs.set(rootDirectory, null);
+			return null;
+		}
+		ancestorDirectory = path.dirname(ancestorDirectory);
+	}
+	cachedConfigs.set(rootDirectory, null);
+	return null;
+};
+const resolveConfigRootDir = (config, configSourceDirectory) => {
+	if (!config || !configSourceDirectory) return null;
+	const rawRootDir = config.rootDir;
+	if (typeof rawRootDir !== "string") return null;
+	const trimmedRootDir = rawRootDir.trim();
+	if (trimmedRootDir.length === 0) return null;
+	const resolvedRootDir = path.isAbsolute(trimmedRootDir) ? trimmedRootDir : path.resolve(configSourceDirectory, trimmedRootDir);
+	if (resolvedRootDir === configSourceDirectory) return null;
+	if (!isDirectory(resolvedRootDir)) {
+		Effect.runSync(Console.warn(`react-doctor config "rootDir" points to "${rawRootDir}" (resolved to ${resolvedRootDir}), which is not a directory. Ignoring.`));
+		return null;
+	}
+	return resolvedRootDir;
+};
+const resolveDiagnoseTarget = (directory) => {
+	if (isFile(path.join(directory, "package.json"))) return directory;
+	const reactSubprojects = discoverReactSubprojects(directory);
+	if (reactSubprojects.length === 0) return null;
+	if (reactSubprojects.length === 1) return reactSubprojects[0].directory;
+	throw new AmbiguousProjectError(directory, reactSubprojects.map((subproject) => path.relative(directory, subproject.directory)).toSorted());
+};
+/**
+* The canonical entry-point translation shared by every public shell
+* (`inspect()`, `diagnose()`, and the CLI's `inspectAction`):
+*
+*   1. Resolve the requested directory to absolute.
+*   2. Load `react-doctor.config.(json|js)` / `package.json#reactDoctor`
+*      if present.
+*   3. Honor `config.rootDir` to redirect the scan to a nested
+*      project root, if configured.
+*   4. Walk into a nested React subproject when the requested
+*      directory has no `package.json` of its own (raises
+*      `AmbiguousProjectError` when multiple candidates exist).
+*
+* Throws `ProjectNotFoundError` when neither the requested directory
+* nor any discoverable nested project has a `package.json`.
+*
+* Before this helper existed, the same three-step dance was reproduced
+* in `api/diagnose.ts`, `react-doctor/inspect.ts`, and the CLI's
+* `cli/commands/inspect.ts` — each loading the config independently
+* (the orchestrator's `Config.layerNode` then loads it a fourth time
+* via its own cache). Routing through `resolveScanTarget` keeps every
+* shell in agreement on what "the scan directory" means.
+*/
+const resolveScanTarget = (requestedDirectory) => {
+	const absoluteRequested = path.resolve(requestedDirectory);
+	const loadedConfig = loadConfigWithSource(absoluteRequested);
+	const userConfig = loadedConfig?.config ?? null;
+	const configSourceDirectory = loadedConfig?.sourceDirectory ?? null;
+	const redirectedDirectory = resolveConfigRootDir(userConfig, configSourceDirectory);
+	const directoryAfterRedirect = redirectedDirectory ?? absoluteRequested;
+	return {
+		resolvedDirectory: resolveDiagnoseTarget(directoryAfterRedirect) ?? directoryAfterRedirect,
+		requestedDirectory: absoluteRequested,
+		userConfig,
+		configSourceDirectory,
+		didRedirectViaRootDir: redirectedDirectory !== null
+	};
+};
+const PNPM_WORKSPACE_FILE = "pnpm-workspace.yaml";
+const PNPM_LOCKFILE = "pnpm-lock.yaml";
+const PACKAGE_JSON_FILE = "package.json";
+const PNPM_HARDENING_RULE_KEY = "require-pnpm-hardening";
+const UTF8_BOM_CHAR = "";
+const HARDENING_SETTING_KEYS = new Set([
+	"minimumReleaseAge",
+	"blockExoticSubdeps",
+	"trustPolicy"
+]);
+const stripInlineComment = (rawValue) => {
+	let activeQuote = null;
+	for (let charIndex = 0; charIndex < rawValue.length; charIndex += 1) {
+		const currentChar = rawValue[charIndex];
+		if (activeQuote !== null) {
+			if (currentChar === activeQuote) activeQuote = null;
+			continue;
+		}
+		if (currentChar === "\"" || currentChar === "'") {
+			activeQuote = currentChar;
+			continue;
+		}
+		if (currentChar !== "#") continue;
+		const previousChar = rawValue[charIndex - 1];
+		if (charIndex === 0 || previousChar !== void 0 && /\s/.test(previousChar)) return rawValue.slice(0, charIndex);
+	}
+	return rawValue;
+};
+const unquote = (rawValue) => rawValue.replace(/^["']|["']$/g, "");
+const stripBom = (rawContent) => rawContent.startsWith(UTF8_BOM_CHAR) ? rawContent.slice(1) : rawContent;
+const parseHardeningSettings = (content) => {
+	let minimumReleaseAge = null;
+	let blockExoticSubdeps = null;
+	let trustPolicy = null;
+	const lines = stripBom(content).split(/\r?\n/);
+	for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
+		const lineText = lines[lineIndex];
+		if (lineText === void 0) continue;
+		if (lineText.search(/\S/) !== 0) continue;
+		const trimmedLine = lineText.trim();
+		if (trimmedLine.startsWith("#")) continue;
+		const colonIndex = trimmedLine.indexOf(":");
+		if (colonIndex <= 0) continue;
+		const settingKey = unquote(trimmedLine.slice(0, colonIndex).trim());
+		if (!HARDENING_SETTING_KEYS.has(settingKey)) continue;
+		const inlineValue = stripInlineComment(trimmedLine.slice(colonIndex + 1)).trim();
+		if (inlineValue.length === 0) continue;
+		const scalar = {
+			value: unquote(inlineValue),
+			line: lineIndex + 1,
+			column: lineText.search(/\S/) + 1
+		};
+		if (settingKey === "minimumReleaseAge") minimumReleaseAge = scalar;
+		else if (settingKey === "blockExoticSubdeps") blockExoticSubdeps = scalar;
+		else if (settingKey === "trustPolicy") trustPolicy = scalar;
+	}
+	return {
+		minimumReleaseAge,
+		blockExoticSubdeps,
+		trustPolicy
+	};
+};
+const isPnpmManagedProject = (rootDirectory) => {
+	if (isFile(path.join(rootDirectory, PNPM_LOCKFILE))) return true;
+	if (isFile(path.join(rootDirectory, PNPM_WORKSPACE_FILE))) return true;
+	const packageJsonPath = path.join(rootDirectory, PACKAGE_JSON_FILE);
+	if (!isFile(packageJsonPath)) return false;
+	try {
+		const packageJsonRaw = fs.readFileSync(packageJsonPath, "utf-8");
+		const packageJson = JSON.parse(packageJsonRaw);
+		if (packageJson !== null && typeof packageJson === "object" && "packageManager" in packageJson && typeof packageJson.packageManager === "string" && packageJson.packageManager.startsWith("pnpm@")) return true;
+	} catch {
+		return false;
+	}
+	return false;
+};
+const buildHardeningDiagnostic = (input) => ({
+	filePath: PNPM_WORKSPACE_FILE,
+	plugin: "react-doctor",
+	rule: PNPM_HARDENING_RULE_KEY,
+	severity: "warning",
+	message: input.message,
+	help: input.help,
+	line: input.line ?? 0,
+	column: input.column ?? 0,
+	category: "Security"
+});
+const checkPnpmHardening = (rootDirectory) => {
+	if (!isPnpmManagedProject(rootDirectory)) return [];
+	const workspacePath = path.join(rootDirectory, PNPM_WORKSPACE_FILE);
+	const settings = parseHardeningSettings(isFile(workspacePath) ? fs.readFileSync(workspacePath, "utf-8") : "");
+	const diagnostics = [];
+	if (settings.minimumReleaseAge === null) diagnostics.push(buildHardeningDiagnostic({
+		message: "pnpm-workspace.yaml is missing `minimumReleaseAge` — newly published versions can ship malware that gets caught and unpublished within hours",
+		help: `Add \`minimumReleaseAge: ${RECOMMENDED_PNPM_MINIMUM_RELEASE_AGE_MINUTES}\` (7 days) to pnpm-workspace.yaml to delay installs until releases have had time to be vetted`
+	}));
+	if (settings.blockExoticSubdeps !== null && settings.blockExoticSubdeps.value.toLowerCase() === "false") diagnostics.push(buildHardeningDiagnostic({
+		line: settings.blockExoticSubdeps.line,
+		column: settings.blockExoticSubdeps.column,
+		message: "`blockExoticSubdeps: false` allows transitive deps from `git:`, `file:`, or tarball URLs — a known supply-chain bypass of the npm registry",
+		help: "Set `blockExoticSubdeps: true` (the default in recent pnpm v11) so transitive deps must come from the registry"
+	}));
+	if (settings.trustPolicy === null) diagnostics.push(buildHardeningDiagnostic({
+		message: "pnpm-workspace.yaml is missing `trustPolicy` — without `no-downgrade`, pnpm silently accepts packages whose trust signals (provenance, signatures) weaken between updates",
+		help: "Add `trustPolicy: no-downgrade` to pnpm-workspace.yaml"
+	}));
+	else if (settings.trustPolicy.value !== "no-downgrade") diagnostics.push(buildHardeningDiagnostic({
+		line: settings.trustPolicy.line,
+		column: settings.trustPolicy.column,
+		message: `\`trustPolicy: ${settings.trustPolicy.value}\` is weaker than \`no-downgrade\` — packages may lose trust signals between updates without you noticing`,
+		help: "Set `trustPolicy: no-downgrade` so pnpm refuses to downgrade trust between resolutions"
+	}));
+	return diagnostics;
+};
+const REDUCED_MOTION_GREP_PATTERN = "prefers-reduced-motion|useReducedMotion|MotionConfig|reducedMotion";
+const REDUCED_MOTION_FILE_GLOBS = [
+	"*.ts",
+	"*.tsx",
+	"*.js",
+	"*.jsx",
+	"*.css",
+	"*.scss"
+];
+const MISSING_REDUCED_MOTION_DIAGNOSTIC = {
+	filePath: "package.json",
+	plugin: "react-doctor",
+	rule: "require-reduced-motion",
+	severity: "error",
+	message: "Project uses a motion library but has no prefers-reduced-motion handling — required for accessibility (WCAG 2.3.3)",
+	help: "Add `useReducedMotion()` from your animation library, or a `@media (prefers-reduced-motion: reduce)` CSS query",
+	line: 0,
+	column: 0,
+	category: "Accessibility"
+};
+const checkReducedMotion = (rootDirectory) => {
+	const packageJsonPath = path.join(rootDirectory, "package.json");
+	if (!isFile(packageJsonPath)) return [];
+	let hasMotionLibrary = false;
+	try {
+		const packageJson = readPackageJson(packageJsonPath);
+		const allDependencies = {
+			...packageJson.dependencies,
+			...packageJson.devDependencies
+		};
+		hasMotionLibrary = Object.keys(allDependencies).some((packageName) => MOTION_LIBRARY_PACKAGES.has(packageName));
+	} catch {
+		return [];
+	}
+	if (!hasMotionLibrary) return [];
+	const result = spawnSync("git", [
+		"grep",
+		"-ql",
+		"-E",
+		REDUCED_MOTION_GREP_PATTERN,
+		"--",
+		...REDUCED_MOTION_FILE_GLOBS
+	], {
+		cwd: rootDirectory,
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+	if (result.error) return [MISSING_REDUCED_MOTION_DIAGNOSTIC];
+	if (result.status === 0) return [];
+	return [MISSING_REDUCED_MOTION_DIAGNOSTIC];
+};
+const computeJsxIncludePaths = (includePaths) => includePaths.length > 0 ? includePaths.filter((filePath) => JSX_FILE_PATTERN.test(filePath)) : void 0;
+const toStringSet = (values) => {
+	if (!values || values.length === 0) return /* @__PURE__ */ new Set();
+	return new Set(values.filter((value) => typeof value === "string" && value.length > 0));
+};
+const buildResolvedControls = (surface, userControls) => {
+	const excludeTags = new Set(DEFAULT_SURFACE_EXCLUDED_TAGS[surface]);
+	const includeTags = toStringSet(userControls?.includeTags);
+	for (const tag of includeTags) excludeTags.delete(tag);
+	for (const tag of toStringSet(userControls?.excludeTags)) excludeTags.add(tag);
+	return {
+		includeTags,
+		excludeTags,
+		includeCategories: toStringSet(userControls?.includeCategories),
+		excludeCategories: toStringSet(userControls?.excludeCategories),
+		includeRuleKeys: toStringSet(userControls?.includeRules),
+		excludeRuleKeys: toStringSet(userControls?.excludeRules)
+	};
+};
+const intersects = (values, candidates) => values.some((value) => candidates.has(value));
+const isDiagnosticOnSurface = (diagnostic, surface, config) => {
+	const resolved = buildResolvedControls(surface, config?.surfaces?.[surface]);
+	const { ruleKey, category, tags } = getDiagnosticRuleIdentity(diagnostic);
+	if (resolved.includeRuleKeys.has(ruleKey)) return true;
+	if (resolved.includeCategories.has(category)) return true;
+	if (intersects(tags, resolved.includeTags)) return true;
+	if (resolved.excludeRuleKeys.has(ruleKey)) return false;
+	if (resolved.excludeCategories.has(category)) return false;
+	if (intersects(tags, resolved.excludeTags)) return false;
+	return true;
+};
+const filterDiagnosticsForSurface = (diagnostics, surface, config) => diagnostics.filter((diagnostic) => isDiagnosticOnSurface(diagnostic, surface, config));
+const listSourceFilesViaGit = (rootDirectory) => {
+	const result = spawnSync("git", [
+		"ls-files",
+		"-z",
+		"--cached",
+		"--others",
+		"--exclude-standard"
+	], {
+		cwd: rootDirectory,
+		encoding: "utf-8",
+		maxBuffer: GIT_LS_FILES_MAX_BUFFER_BYTES
+	});
+	if (result.error || result.status !== 0) return null;
+	return result.stdout.split("\0").filter((filePath) => filePath.length > 0 && SOURCE_FILE_PATTERN.test(filePath));
+};
+const listSourceFilesViaFilesystem = (rootDirectory) => {
+	const filePaths = [];
+	const stack = [rootDirectory];
+	while (stack.length > 0) {
+		const currentDirectory = stack.pop();
+		const entries = readDirectoryEntries(currentDirectory);
+		for (const entry of entries) {
+			const absolutePath = path.join(currentDirectory, entry.name);
+			if (entry.isDirectory()) {
+				if (!entry.name.startsWith(".") && !IGNORED_DIRECTORIES.has(entry.name)) stack.push(absolutePath);
+				continue;
+			}
+			if (entry.isFile() && SOURCE_FILE_PATTERN.test(entry.name)) filePaths.push(path.relative(rootDirectory, absolutePath).replace(/\\/g, "/"));
 		}
-		ancestorDirectory = path.dirname(ancestorDirectory);
 	}
-	cachedConfigs.set(rootDirectory, null);
-	return null;
+	return filePaths;
 };
-const resolveConfigRootDir = (config, configSourceDirectory) => {
-	if (!config || !configSourceDirectory) return null;
-	const rawRootDir = config.rootDir;
-	if (typeof rawRootDir !== "string") return null;
-	const trimmedRootDir = rawRootDir.trim();
-	if (trimmedRootDir.length === 0) return null;
-	const resolvedRootDir = path.isAbsolute(trimmedRootDir) ? trimmedRootDir : path.resolve(configSourceDirectory, trimmedRootDir);
-	if (resolvedRootDir === configSourceDirectory) return null;
-	if (!isDirectory(resolvedRootDir)) {
-		Effect.runSync(Console.warn(`react-doctor config "rootDir" points to "${rawRootDir}" (resolved to ${resolvedRootDir}), which is not a directory. Ignoring.`));
-		return null;
-	}
-	return resolvedRootDir;
+const listSourceFiles = (rootDirectory) => listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory);
+const resolveLintIncludePaths = (rootDirectory, userConfig) => {
+	if (!Array.isArray(userConfig?.ignore?.files) || userConfig.ignore.files.length === 0) return;
+	const ignoredPatterns = compileIgnoredFilePatterns(userConfig);
+	return listSourceFiles(rootDirectory).filter((filePath) => {
+		if (!JSX_FILE_PATTERN.test(filePath)) return false;
+		return !isFileIgnoredByPatterns(filePath, rootDirectory, ignoredPatterns);
+	});
 };
-const CONFIG_CACHE_CAPACITY = 16;
-const CONFIG_CACHE_TTL_MS = 300 * 1e3;
 var Config = class Config extends Context.Service()("react-doctor/Config") {
 	static layerNode = Layer.effect(Config, Effect.gen(function* () {
 		const cache = yield* Cache.make({
-			capacity: CONFIG_CACHE_CAPACITY,
+			capacity: 16,
 			timeToLive: CONFIG_CACHE_TTL_MS,
 			lookup: (directory) => Effect.sync(() => {
 				const loaded = loadConfigWithSource(directory);
@@ -4427,6 +4671,20 @@ const parseGithubRepoFromRemoteUrl = (remoteUrl) => {
 	const urlMatch = /^(?:https?:\/\/github\.com\/|ssh:\/\/git@github\.com\/)([^/\s]+)\/([^/\s]+)$/.exec(withoutGitSuffix);
 	return urlMatch ? `${urlMatch[1]}/${urlMatch[2]}` : null;
 };
+const parseGithubRepo = (repo) => {
+	const [owner, name, ...extraParts] = repo.split("/");
+	if (owner === void 0 || name === void 0 || extraParts.length > 0) return null;
+	if (owner.length === 0 || name.length === 0) return null;
+	return {
+		owner,
+		name
+	};
+};
+const parseGithubViewerPermission = (stdout) => {
+	const value = trimOrNull(stdout);
+	if (value === null || value === "null") return null;
+	return /^[A-Z_]+$/.test(value) ? value.toLowerCase() : null;
+};
 const splitNullSeparated = (value) => value.split("\0").filter((entry) => entry.length > 0);
 /**
 * `Git` wraps every `git`-via-subprocess call react-doctor makes
@@ -4452,9 +4710,10 @@ var Git = class Git extends Context.Service()("react-doctor/Git") {
 		* reason: GitInvocationFailed })` so the rest of the codebase
 		* sees a single failure channel.
 		*/
-		const runGit = (directory, args) => Effect.scoped(Effect.gen(function* () {
-			const handle = yield* spawner.spawn(ChildProcess.make("git", [...args], {
-				cwd: directory,
+		const runCommand = (input) => Effect.scoped(Effect.gen(function* () {
+			const handle = yield* spawner.spawn(ChildProcess.make(input.command, [...input.args], {
+				cwd: input.directory,
+				env: input.env,
 				extendEnv: true
 			}));
 			const [stdout, stderr, status] = yield* Effect.all([
@@ -4467,11 +4726,23 @@ var Git = class Git extends Context.Service()("react-doctor/Git") {
 				stdout,
 				stderr
 			};
-		})).pipe(Effect.catchTag("PlatformError", (cause) => new ReactDoctorError({ reason: new GitInvocationFailed({
-			args: [...args],
-			directory,
-			cause
-		}) })));
+		})).pipe(Effect.catchTag("PlatformError", (cause) => {
+			if (input.command !== "git") return Effect.succeed({
+				status: 127,
+				stdout: "",
+				stderr: String(cause)
+			});
+			return new ReactDoctorError({ reason: new GitInvocationFailed({
+				args: [...input.args],
+				directory: input.directory,
+				cause
+			}) });
+		}));
+		const runGit = (directory, args) => runCommand({
+			command: "git",
+			args,
+			directory
+		});
 		const currentBranch = (directory) => runGit(directory, [
 			"rev-parse",
 			"--abbrev-ref",
@@ -4506,11 +4777,43 @@ var Git = class Git extends Context.Service()("react-doctor/Git") {
 			"--get",
 			"remote.origin.url"
 		]).pipe(Effect.map((result) => result.status === 0 ? parseGithubRepoFromRemoteUrl(result.stdout) : null));
+		const githubViewerPermission = (input) => Effect.gen(function* () {
+			const parsedRepo = parseGithubRepo(input.repo);
+			if (parsedRepo === null) return null;
+			const resultOption = yield* runCommand({
+				command: "gh",
+				args: [
+					"api",
+					"graphql",
+					"-F",
+					`owner=${parsedRepo.owner}`,
+					"-F",
+					`name=${parsedRepo.name}`,
+					"-f",
+					`query=
+            query(\$owner: String!, \$name: String!) {
+              repository(owner: \$owner, name: \$name) {
+                viewerPermission
+              }
+            }
+          `,
+					"--jq",
+					".data.repository.viewerPermission"
+				],
+				directory: input.directory,
+				env: { GH_PROMPT_DISABLED: "1" }
+			}).pipe(Effect.timeoutOption(GITHUB_VIEWER_PERMISSION_TIMEOUT_MS));
+			if (Option.isNone(resultOption)) return null;
+			const result = resultOption.value;
+			if (result.status !== 0) return null;
+			return parseGithubViewerPermission(result.stdout);
+		}).pipe(Effect.catch(() => Effect.succeed(null)));
 		return Git.of({
 			currentBranch,
 			defaultBranch,
 			headSha,
 			githubRepo,
+			githubViewerPermission,
 			branchExists,
 			diffSelection: ({ directory, explicitBaseBranch }) => Effect.gen(function* () {
 				if (explicitBaseBranch !== void 0 && explicitBaseBranch.trim().length === 0) return yield* Effect.fail(new ReactDoctorError({ reason: new GitBaseBranchInvalid({ detail: "Diff base branch cannot be empty." }) }));
@@ -4605,6 +4908,7 @@ var Git = class Git extends Context.Service()("react-doctor/Git") {
 		defaultBranch: () => Effect.succeed(snapshot.defaultBranch ?? null),
 		headSha: () => Effect.succeed(snapshot.headSha ?? null),
 		githubRepo: () => Effect.succeed(snapshot.githubRepo ?? null),
+		githubViewerPermission: () => Effect.succeed(snapshot.githubViewerPermission ?? null),
 		branchExists: (_directory, branch) => Effect.succeed(snapshot.branchExists?.get(branch) ?? false),
 		diffSelection: () => Effect.succeed(snapshot.diffSelection ?? null),
 		stagedFilePaths: () => Effect.succeed(snapshot.stagedFiles ?? []),
@@ -4720,7 +5024,6 @@ const findFirstLintConfigInDirectory = (directory) => {
 	}
 	return null;
 };
-const isProjectBoundary = (directory) => fs.existsSync(path.join(directory, ".git")) || isMonorepoRoot(directory);
 const detectUserLintConfigPaths = (rootDirectory) => {
 	const directLintConfig = findFirstLintConfigInDirectory(rootDirectory);
 	if (directLintConfig) return [directLintConfig];
@@ -4856,7 +5159,6 @@ const shouldEnableRule = (requires, tags, capabilities, ignoredTags, disabledBy)
 	}
 	return true;
 };
-const esmRequire$1 = createRequire(import.meta.url);
 /**
 * Loads a plugin module via the local require resolver and extracts
 * `(name, ruleNames)` from either `module.exports.meta + rules` or
@@ -4883,15 +5185,16 @@ const readPluginShape = (pluginSpecifier, loadModule) => {
 		ruleNames: new Set(Object.keys(rules))
 	};
 };
+const bundledRequire = createRequire(import.meta.url);
 const resolveReactHooksJsPlugin = (hasReactCompiler, customRulesOnly) => {
 	if (!hasReactCompiler || customRulesOnly) return null;
 	let pluginSpecifier;
 	try {
-		pluginSpecifier = esmRequire$1.resolve("eslint-plugin-react-hooks");
+		pluginSpecifier = bundledRequire.resolve("eslint-plugin-react-hooks");
 	} catch {
 		return null;
 	}
-	const { ruleNames } = readPluginShape(pluginSpecifier, (spec) => esmRequire$1(spec));
+	const { ruleNames } = readPluginShape(pluginSpecifier, (spec) => bundledRequire(spec));
 	return {
 		entry: {
 			name: "react-hooks-js",
@@ -5585,7 +5888,6 @@ const spawnOxlint = (args, rootDirectory, nodeBinaryPath) => new Promise((resolv
 		resolve(output);
 	});
 });
-const PREVIEW_COUNT = 3;
 /**
 * Runs every prebuilt file batch through oxlint, with binary-split
 * retry on the splittable error classes (timeout / output-too-large /
@@ -5600,7 +5902,8 @@ const PREVIEW_COUNT = 3;
 * with a slimmer config in that case.
 */
 const spawnLintBatches = async (input) => {
-	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, onPartialFailure } = input;
+	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, onPartialFailure, onFileProgress } = input;
+	const totalFileCount = fileBatches.reduce((sum, batch) => sum + batch.length, 0);
 	const allDiagnostics = [];
 	const droppedFiles = [];
 	let firstDropReason = null;
@@ -5619,10 +5922,24 @@ const spawnLintBatches = async (input) => {
 			return [...await spawnLintBatch(batch.slice(0, splitIndex)), ...await spawnLintBatch(batch.slice(splitIndex))];
 		}
 	};
-	for (const batch of fileBatches) allDiagnostics.push(...await spawnLintBatch(batch));
+	let scannedFileCount = 0;
+	for (const batch of fileBatches) {
+		let batchFileIndex = 0;
+		const progressInterval = onFileProgress && batch.length > 1 ? setInterval(() => {
+			if (batchFileIndex < batch.length) {
+				batchFileIndex += 1;
+				onFileProgress(scannedFileCount + batchFileIndex, totalFileCount);
+			}
+		}, 50) : null;
+		const batchDiagnostics = await spawnLintBatch(batch);
+		if (progressInterval !== null) clearInterval(progressInterval);
+		allDiagnostics.push(...batchDiagnostics);
+		scannedFileCount += batch.length;
+		onFileProgress?.(scannedFileCount, totalFileCount);
+	}
 	if (droppedFiles.length > 0 && onPartialFailure) {
-		const previewFiles = droppedFiles.slice(0, PREVIEW_COUNT).join(", ");
-		const remainderHint = droppedFiles.length > PREVIEW_COUNT ? `, +${droppedFiles.length - PREVIEW_COUNT} more` : "";
+		const previewFiles = droppedFiles.slice(0, 3).join(", ");
+		const remainderHint = droppedFiles.length > 3 ? `, +${droppedFiles.length - 3} more` : "";
 		const reasonHint = firstDropReason ? ` — first failure: ${firstDropReason}` : "";
 		onPartialFailure(`${droppedFiles.length} file(s) failed to lint and were skipped (${previewFiles}${remainderHint})${reasonHint}`);
 	}
@@ -5742,7 +6059,8 @@ const runOxlint = async (options) => {
 			rootDirectory,
 			nodeBinaryPath,
 			project,
-			onPartialFailure
+			onPartialFailure,
+			onFileProgress: options.onFileProgress
 		});
 		writeOxlintConfig(configPath, buildConfig(extendsPaths));
 		try {
@@ -5823,7 +6141,8 @@ var Linter = class Linter extends Context.Service()("react-doctor/Linter") {
 				configSourceDirectory: input.configSourceDirectory,
 				onPartialFailure: (reason) => {
 					collectedFailures.push(reason);
-				}
+				},
+				onFileProgress: input.onFileProgress
 			}),
 			catch: ensureReactDoctorError
 		});
@@ -5850,6 +6169,48 @@ var Linter = class Linter extends Context.Service()("react-doctor/Linter") {
 		return stream;
 	} }));
 };
+var ProgressCapture = class ProgressCapture extends Context.Service()("react-doctor/ProgressCapture") {
+	static layer = Layer.effect(ProgressCapture, Ref.make([]));
+};
+/**
+* `Progress` is the terminal-feedback service. Layer slot for ora
+* (CLI), log lines, GitHub Action `::group::`, or a no-op for silent
+* modes. Tests use `layerCapture` to record start/succeed/fail
+* events into a Ref instead of mocking the underlying spinner module.
+*/
+var Progress = class Progress extends Context.Service()("react-doctor/Progress") {
+	/**
+	* Layer that uses an injected factory. The cli package provides
+	* its own factory backed by the existing ora-based `spinner.ts`
+	* helper; this layer keeps the core package free of an ora dep.
+	*/
+	static layerOra = (factory) => Layer.succeed(Progress, Progress.of({ start: (text) => Effect.sync(() => factory(text)) }));
+	static layerNoop = Layer.succeed(Progress, Progress.of({ start: () => Effect.succeed({
+		update: () => Effect.void,
+		succeed: () => Effect.void,
+		fail: () => Effect.void
+	}) }));
+	static layerCapture = Layer.effect(Progress, Effect.map(ProgressCapture, (events) => Progress.of({ start: (text) => Effect.gen(function* () {
+		yield* Ref.update(events, (existing) => [...existing, {
+			_tag: "Started",
+			text
+		}]);
+		return {
+			update: (displayText) => Ref.update(events, (existing) => [...existing, {
+				_tag: "Updated",
+				text: displayText
+			}]),
+			succeed: (displayText) => Ref.update(events, (existing) => [...existing, {
+				_tag: "Succeeded",
+				text: displayText
+			}]),
+			fail: (displayText) => Ref.update(events, (existing) => [...existing, {
+				_tag: "Failed",
+				text: displayText
+			}])
+		};
+	}) }))).pipe(Layer.provideMerge(ProgressCapture.layer));
+};
 const translateProjectInfoError = (cause, directory) => {
 	if (cause instanceof NoReactDependencyError) return new ReactDoctorError({ reason: new NoReactDependency({ directory: cause.directory }) });
 	if (cause instanceof ProjectNotFoundError) return new ReactDoctorError({ reason: new ProjectNotFound({ directory: cause.directory }) });
@@ -5947,7 +6308,11 @@ const calculateScore = async (diagnostics, options = {}) => {
 			...options.metadata?.framework ? { framework: options.metadata.framework } : {},
 			...options.metadata?.reactVersion ? { reactVersion: options.metadata.reactVersion } : {},
 			...typeof options.metadata?.sourceFileCount === "number" ? { sourceFileCount: options.metadata.sourceFileCount } : {},
-			...options.metadata?.defaultBranch ? { defaultBranch: options.metadata.defaultBranch } : {}
+			...options.metadata?.defaultBranch ? { defaultBranch: options.metadata.defaultBranch } : {},
+			...options.metadata?.doctorVersion ? { doctorVersion: options.metadata.doctorVersion } : {},
+			...options.metadata?.githubEventName ? { githubEventName: options.metadata.githubEventName } : {},
+			...options.metadata?.githubActorAssociation ? { githubActorAssociation: options.metadata.githubActorAssociation } : {},
+			...options.metadata?.githubViewerPermission ? { githubViewerPermission: options.metadata.githubViewerPermission } : {}
 		}));
 		const response = await fetch(requestUrl, {
 			method: "POST",
@@ -5992,6 +6357,32 @@ var Score = class Score extends Context.Service()("react-doctor/Score") {
 	}) }));
 	static layerOf = (result) => Layer.succeed(Score, Score.of({ compute: () => Effect.succeed(result) }));
 };
+const getObjectProperty = (value, propertyName) => {
+	if (typeof value !== "object" || value === null) return void 0;
+	return Reflect.get(value, propertyName);
+};
+const getStringProperty = (value, propertyName) => {
+	const propertyValue = getObjectProperty(value, propertyName);
+	return typeof propertyValue === "string" && propertyValue.length > 0 ? propertyValue : void 0;
+};
+const readGithubEventPayload = (eventPath) => {
+	if (eventPath === void 0 || eventPath.length === 0) return null;
+	try {
+		return JSON.parse(readFileSync(eventPath, "utf8"));
+	} catch {
+		return null;
+	}
+};
+const resolveGithubActionsScoreMetadata = (environment = process.env) => {
+	if (environment.GITHUB_ACTIONS !== "true") return {};
+	const pullRequest = getObjectProperty(readGithubEventPayload(environment.GITHUB_EVENT_PATH), "pull_request");
+	const eventName = environment.GITHUB_EVENT_NAME;
+	const actorAssociation = getStringProperty(pullRequest, "author_association");
+	return {
+		...eventName !== void 0 && eventName.length > 0 ? { githubEventName: eventName } : {},
+		...actorAssociation !== void 0 ? { githubActorAssociation: actorAssociation } : {}
+	};
+};
 const NO_HOOKS = {
 	beforeLint: () => Effect.void,
 	afterLint: () => Effect.void
@@ -6007,26 +6398,33 @@ const fileReader = (filesService, rootDirectory) => (filePath) => {
 	}));
 	return lines === null ? null : [...lines];
 };
+const LINT_FAIL_TEXT = "Scanning failed (lint, non-fatal).";
+const LINT_NATIVE_BINDING_FAIL_TEXT = (nodeVersion) => `Scanning failed — oxlint native binding not found (Node ${nodeVersion}).`;
+const DEAD_CODE_FAIL_TEXT = "Scanning failed (dead-code analysis, non-fatal).";
+const formatLintFailText = (reasonTag, nodeVersion) => {
+	if (reasonTag === "OxlintUnavailable" || reasonTag === "OxlintSpawnFailed") return LINT_NATIVE_BINDING_FAIL_TEXT(nodeVersion);
+	return LINT_FAIL_TEXT;
+};
 /**
 * The full inspect orchestration as a single composable Effect.
 *
-* Wires the 8 services into a streaming pipeline:
+* Phases:
 *
-*   Config.resolve(directory)
-*     -> Project.discover(resolvedDirectory)
-*     -> Git metadata for score attribution
-*     -> Stream.fromIterable(env diagnostics: reduced-motion + pnpm hardening)
-*     -> Stream.concat(Linter.run(...))    [folds ReactDoctorError into Ref]
-*     -> Stream.concat(DeadCode.run(...))  [folds Error into Ref]
-*     -> Stream.filterMap(perElementPipeline.apply)  [auto-suppress / severity / ignore / inline]
-*     -> Stream.tap(Reporter.emit)         [side-channel: future LSP / NDJSON]
-*     -> Stream.runCollect
-*     -> Score.compute(filtered)
+*   1. Config.resolve(directory) → Project.discover → Git metadata
+*   2. beforeLint hook (e.g. CLI renders the project-detection block)
+*   3. environment checks (reduced-motion + pnpm hardening)
+*   4. Linter.run + DeadCode.run — forked as concurrent fibers so
+*      their wall-clock times overlap. Progress spinners stay
+*      sequential (lint first, then dead-code) for clean terminal
+*      output. GitHub viewer permission also runs as a background
+*      fiber during this phase.
+*   5. afterLint hook
+*   6. Reporter.finalize
+*   7. Score.compute against the surface-filtered diagnostic set
 *
-* Lint and dead-code failures are folded via `Stream.catchTag` into
-* Ref state on the orchestrator side — they don't sink the whole
-* scan, and the renderer (cli or programmatic api) surfaces them
-* via `skippedCheckReasons`.
+* The orchestrator owns spinner lifecycle via `Progress`; callers
+* choose `Progress.layerOra(...)` for CLI feedback or
+* `Progress.layerNoop` for silent / programmatic runs.
 */
 const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 	const projectService = yield* Project;
@@ -6037,6 +6435,7 @@ const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 	const scoreService = yield* Score;
 	const deadCodeService = yield* DeadCode;
 	const gitService = yield* Git;
+	const progressService = yield* Progress;
 	const partialFailuresRef = yield* LintPartialFailures;
 	const resolvedConfig = yield* configService.resolve(input.directory);
 	const scanDirectory = resolvedConfig.resolvedDirectory;
@@ -6047,18 +6446,25 @@ const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 		gitService.headSha(scanDirectory).pipe(Effect.orElseSucceed(() => null)),
 		gitService.defaultBranch(scanDirectory).pipe(Effect.orElseSucceed(() => null))
 	], { concurrency: 3 });
-	const scoreMetadata = {
-		...repo !== null ? { repo } : {},
-		...sha !== null ? { sha } : {},
-		framework: project.framework,
-		...project.reactVersion !== null ? { reactVersion: project.reactVersion } : {},
-		sourceFileCount: project.sourceFileCount,
-		...defaultBranch !== null ? { defaultBranch } : {}
-	};
+	const githubActionsScoreMetadata = input.isCi ? resolveGithubActionsScoreMetadata() : {};
+	const githubViewerPermissionFiber = yield* Effect.forkChild(input.resolveLocalGithubViewerPermission === true && !input.isCi && repo !== null ? gitService.githubViewerPermission({
+		directory: scanDirectory,
+		repo
+	}).pipe(Effect.orElseSucceed(() => null)) : Effect.succeed(null));
 	const lintIncludePaths = computeJsxIncludePaths([...input.includePaths]) ?? resolveLintIncludePaths(scanDirectory, resolvedConfig.config);
 	const beforeLint = hooks.beforeLint ?? NO_HOOKS.beforeLint;
 	const afterLint = hooks.afterLint ?? NO_HOOKS.afterLint;
 	yield* beforeLint(project, lintIncludePaths ?? void 0);
+	const isDiffMode = input.includePaths.length > 0;
+	const transform = buildDiagnosticPipeline({
+		rootDirectory: scanDirectory,
+		userConfig: resolvedConfig.config,
+		readFileLinesSync: fileReader(filesService, scanDirectory),
+		respectInlineDisables: input.respectInlineDisables
+	});
+	const applyPerElementPipeline = (rawStream) => rawStream.pipe(Stream.filterMap(filterMapNullable(transform.apply)), Stream.tap((diagnostic) => reporterService.emit(diagnostic)));
+	const environmentDiagnostics = isDiffMode ? [] : [...checkReducedMotion(scanDirectory), ...checkPnpmHardening(scanDirectory)];
+	const envCollected = yield* Stream.runCollect(applyPerElementPipeline(Stream.fromIterable(environmentDiagnostics)));
 	const lintFailure = yield* Ref.make({
 		didFail: false,
 		reason: null,
@@ -6068,15 +6474,20 @@ const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 		didFail: false,
 		reason: null
 	});
-	const isDiffMode = input.includePaths.length > 0;
-	const transform = buildDiagnosticPipeline({
+	const shouldRunDeadCode = input.runDeadCode && !isDiffMode;
+	const deadCodeFiber = yield* Effect.forkChild(shouldRunDeadCode ? Stream.runCollect(applyPerElementPipeline(deadCodeService.run({
 		rootDirectory: scanDirectory,
-		userConfig: resolvedConfig.config,
-		readFileLinesSync: fileReader(filesService, scanDirectory),
-		respectInlineDisables: input.respectInlineDisables
-	});
-	const environmentDiagnostics = isDiffMode ? [] : [...checkReducedMotion(scanDirectory), ...checkPnpmHardening(scanDirectory)];
-	const emptyDiagnosticStream = Stream.empty;
+		userConfig: resolvedConfig.config
+	}).pipe(Stream.catchTag("ReactDoctorError", (error) => Stream.unwrap(Effect.gen(function* () {
+		yield* Ref.set(deadCodeFailure, {
+			didFail: true,
+			reason: error.message
+		});
+		return Stream.empty;
+	})))))) : Effect.succeed([]));
+	const scanProgress = yield* progressService.start("Scanning...");
+	const scanStartTime = Date.now();
+	let lastReportedTotalFileCount = 0;
 	const rawLintStream = linterService.run({
 		rootDirectory: scanDirectory,
 		project,
@@ -6087,34 +6498,54 @@ const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 		adoptExistingLintConfig: input.adoptExistingLintConfig,
 		ignoredTags: input.ignoredTags,
 		userConfig: resolvedConfig.config ?? void 0,
-		configSourceDirectory: resolvedConfig.configSourceDirectory ?? void 0
+		configSourceDirectory: resolvedConfig.configSourceDirectory ?? void 0,
+		onFileProgress: (scannedFileCount, totalFileCount) => {
+			lastReportedTotalFileCount = totalFileCount;
+			Effect.runSync(scanProgress.update(`Scanning (${scannedFileCount}/${totalFileCount})...`));
+		}
 	}).pipe(Stream.catchTag("ReactDoctorError", (error) => Stream.unwrap(Effect.gen(function* () {
 		yield* Ref.set(lintFailure, {
 			didFail: true,
 			reason: error.message,
 			reasonTag: error.reason._tag
 		});
-		return emptyDiagnosticStream;
+		return Stream.empty;
 	}))));
-	const deadCodeStream = input.runDeadCode && !isDiffMode ? deadCodeService.run({
-		rootDirectory: scanDirectory,
-		userConfig: resolvedConfig.config
-	}).pipe(Stream.catchTag("ReactDoctorError", (error) => Stream.unwrap(Effect.gen(function* () {
-		yield* Ref.set(deadCodeFailure, {
-			didFail: true,
-			reason: error.message
-		});
-		return emptyDiagnosticStream;
-	})))) : emptyDiagnosticStream;
-	const transformedStream = Stream.fromIterable(environmentDiagnostics).pipe(Stream.concat(rawLintStream), Stream.concat(deadCodeStream), Stream.filterMap(filterMapNullable(transform.apply)), Stream.tap((diagnostic) => reporterService.emit(diagnostic)));
-	const survivingDiagnostics = yield* Stream.runCollect(transformedStream);
-	yield* reporterService.finalize;
+	const lintCollected = yield* Stream.runCollect(applyPerElementPipeline(rawLintStream));
 	const lintFailureState = yield* Ref.get(lintFailure);
-	const deadCodeFailureState = yield* Ref.get(deadCodeFailure);
 	yield* afterLint(lintFailureState.didFail);
-	const finalDiagnostics = [...survivingDiagnostics];
+	if (lintFailureState.didFail) {
+		yield* Fiber.interrupt(deadCodeFiber);
+		yield* scanProgress.fail(formatLintFailText(lintFailureState.reasonTag, process.version));
+	}
+	const deadCodeCollected = lintFailureState.didFail ? [] : yield* Fiber.join(deadCodeFiber);
+	const deadCodeFailureState = yield* Ref.get(deadCodeFailure);
+	const scanElapsedSeconds = ((Date.now() - scanStartTime) / 1e3).toFixed(1);
+	const totalFileCount = lastReportedTotalFileCount || (lintIncludePaths?.length ?? project.sourceFileCount);
+	if (!lintFailureState.didFail) if (deadCodeFailureState.didFail) yield* scanProgress.fail(DEAD_CODE_FAIL_TEXT);
+	else yield* scanProgress.succeed(`Scanned ${totalFileCount} ${totalFileCount === 1 ? "file" : "files"} in ${scanElapsedSeconds}s`);
+	yield* reporterService.finalize;
+	const finalDiagnostics = [
+		...envCollected,
+		...lintCollected,
+		...deadCodeCollected
+	];
+	const githubViewerPermission = yield* Fiber.join(githubViewerPermissionFiber);
+	const scoreMetadata = {
+		...repo !== null ? { repo } : {},
+		...sha !== null ? { sha } : {},
+		framework: project.framework,
+		...project.reactVersion !== null ? { reactVersion: project.reactVersion } : {},
+		sourceFileCount: project.sourceFileCount,
+		...defaultBranch !== null ? { defaultBranch } : {},
+		...input.doctorVersion !== void 0 ? { doctorVersion: input.doctorVersion } : {},
+		...githubActionsScoreMetadata,
+		...githubViewerPermission !== null ? { githubViewerPermission } : {}
+	};
+	const scoreSurface = input.scoreSurface ?? "score";
+	const scoreDiagnostics = filterDiagnosticsForSurface([...finalDiagnostics], scoreSurface, resolvedConfig.config);
 	const score = lintFailureState.didFail ? null : yield* scoreService.compute({
-		diagnostics: finalDiagnostics,
+		diagnostics: scoreDiagnostics,
 		isCi: input.isCi,
 		metadata: scoreMetadata
 	});
@@ -6137,9 +6568,10 @@ const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 	"inspect.directory": input.directory,
 	"inspect.includePathCount": input.includePaths.length,
 	"inspect.runDeadCode": input.runDeadCode,
-	"inspect.isCi": input.isCi
+	"inspect.isCi": input.isCi,
+	"inspect.scoreSurface": input.scoreSurface ?? "score"
 } }));
-Layer.mergeAll(Project.layerNode, Config.layerNode, DeadCode.layerNode, Files.layerNode, Git.layerNode, Linter.layerOxlint, LintPartialFailures.layerLive, Reporter.layerNoop, Score.layerHttp);
+Layer.mergeAll(Project.layerNode, Config.layerNode, DeadCode.layerNode, Files.layerNode, Git.layerNode, Linter.layerOxlint, LintPartialFailures.layerLive, Progress.layerNoop, Reporter.layerNoop, Score.layerHttp);
 const parseNodeVersion = (versionString) => {
 	const [major = 0, minor = 0, patch = 0] = versionString.replace(/^v/, "").trim().split(".").map(Number);
 	return {
@@ -6250,37 +6682,6 @@ var NodeResolver = class NodeResolver extends Context.Service()("react-doctor/No
 		});
 	});
 };
-var ProgressCapture = class ProgressCapture extends Context.Service()("react-doctor/ProgressCapture") {
-	static layer = Layer.effect(ProgressCapture, Ref.make([]));
-};
-(class Progress extends Context.Service()("react-doctor/Progress") {
-	/**
-	* Layer that uses an injected factory. The cli package provides
-	* its own factory backed by the existing ora-based `spinner.ts`
-	* helper; this layer keeps the core package free of an ora dep.
-	*/
-	static layerOra = (factory) => Layer.succeed(Progress, Progress.of({ start: (text) => Effect.sync(() => factory(text)) }));
-	static layerNoop = Layer.succeed(Progress, Progress.of({ start: () => Effect.succeed({
-		succeed: () => Effect.void,
-		fail: () => Effect.void
-	}) }));
-	static layerCapture = Layer.effect(Progress, Effect.map(ProgressCapture, (events) => Progress.of({ start: (text) => Effect.gen(function* () {
-		yield* Ref.update(events, (existing) => [...existing, {
-			_tag: "Started",
-			text
-		}]);
-		return {
-			succeed: (displayText) => Ref.update(events, (existing) => [...existing, {
-				_tag: "Succeeded",
-				text: displayText
-			}]),
-			fail: (displayText) => Ref.update(events, (existing) => [...existing, {
-				_tag: "Failed",
-				text: displayText
-			}])
-		};
-	}) }))).pipe(Layer.provideMerge(ProgressCapture.layer));
-});
 /**
 * Zip-Slip defense: `git diff --cached --name-only` is the source
 * of `relativePath`, and git normalizes paths during ordinary
@@ -6492,37 +6893,6 @@ const buildJsonReport = (input) => {
 		error: null
 	};
 };
-const toStringSet = (values) => {
-	if (!values || values.length === 0) return /* @__PURE__ */ new Set();
-	return new Set(values.filter((value) => typeof value === "string" && value.length > 0));
-};
-const buildResolvedControls = (surface, userControls) => {
-	const excludeTags = new Set(DEFAULT_SURFACE_EXCLUDED_TAGS[surface]);
-	const includeTags = toStringSet(userControls?.includeTags);
-	for (const tag of includeTags) excludeTags.delete(tag);
-	for (const tag of toStringSet(userControls?.excludeTags)) excludeTags.add(tag);
-	return {
-		includeTags,
-		excludeTags,
-		includeCategories: toStringSet(userControls?.includeCategories),
-		excludeCategories: toStringSet(userControls?.excludeCategories),
-		includeRuleKeys: toStringSet(userControls?.includeRules),
-		excludeRuleKeys: toStringSet(userControls?.excludeRules)
-	};
-};
-const intersects = (values, candidates) => values.some((value) => candidates.has(value));
-const isDiagnosticOnSurface = (diagnostic, surface, config) => {
-	const resolved = buildResolvedControls(surface, config?.surfaces?.[surface]);
-	const { ruleKey, category, tags } = getDiagnosticRuleIdentity(diagnostic);
-	if (resolved.includeRuleKeys.has(ruleKey)) return true;
-	if (resolved.includeCategories.has(category)) return true;
-	if (intersects(tags, resolved.includeTags)) return true;
-	if (resolved.excludeRuleKeys.has(ruleKey)) return false;
-	if (resolved.excludeCategories.has(category)) return false;
-	if (intersects(tags, resolved.excludeTags)) return false;
-	return true;
-};
-const filterDiagnosticsForSurface = (diagnostics, surface, config) => diagnostics.filter((diagnostic) => isDiagnosticOnSurface(diagnostic, surface, config));
 /**
 * Programmatic façade over `Git.diffSelection`. Async because the
 * Git service runs through Effect's `ChildProcess` (true subprocess
@@ -6674,6 +7044,6 @@ const cliLogger = {
 	}
 };
 //#endregion
-export { formatReactDoctorError as A, toRelativePath as B, buildJsonReportError as C, filterSourceFiles as D, filterDiagnosticsForSurface as E, layerOtlp as F, listWorkspacePackages as I, loadConfigWithSource as L, groupBy as M, highlighter as N, formatErrorChain as O, isReactDoctorError as P, resolveConfigRootDir as R, buildJsonReport as S, discoverReactSubprojects as T, Reporter as _, Config as a, Score as b, Git as c, MILLISECONDS_PER_SECOND as d, NoReactDependencyError as f, ProjectNotFoundError as g, Project as h, CANONICAL_GITHUB_URL as i, getDiffInfo as j, formatFrameworkName as k, LintPartialFailures as l, OXLINT_NODE_REQUIREMENT as m, cli_logger_exports as n, DeadCode as o, NodeResolver as p, AmbiguousProjectError as r, Files as s, cliLogger as t, Linter as u, SHARE_BASE_URL as v, calculateScore as w, StagedFiles as x, SKILL_NAME as y, runInspect as z };
+export { isReactDoctorError as A, filterSourceFiles as C, groupBy as D, getDiffInfo as E, runInspect as F, toRelativePath as I, listWorkspacePackages as M, resolveScanTarget as N, highlighter as O, restoreLegacyThrow as P, filterDiagnosticsForSurface as S, formatReactDoctorError as T, Score as _, DeadCode as a, buildJsonReportError as b, LintPartialFailures as c, OXLINT_NODE_REQUIREMENT as d, Progress as f, SKILL_NAME as g, SHARE_BASE_URL as h, Config as i, layerOtlp as j, isMonorepoRoot as k, Linter as l, Reporter as m, cli_logger_exports as n, Files as o, Project as p, CANONICAL_GITHUB_URL as r, Git as s, cliLogger as t, NodeResolver as u, StagedFiles as v, formatErrorChain as w, discoverReactSubprojects as x, buildJsonReport as y };
 
-//# sourceMappingURL=cli-logger-CISyjOAb.js.map
+//# sourceMappingURL=cli-logger-C35LXalM.js.map