react-doctor 0.2.5 → 0.2.7

package/dist/index.js

@@ -1,25 +1,26 @@
 import { createRequire } from "node:module";
 import * as Schema from "effect/Schema";
 import * as fs$1 from "node:fs";
-import fs, { existsSync, readdirSync } from "node:fs";
+import fs, { existsSync, readFileSync, readdirSync } from "node:fs";
 import * as Path from "node:path";
 import path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 import reactDoctorPlugin, { ALL_REACT_DOCTOR_RULE_KEYS, FRAMEWORK_SPECIFIC_RULE_KEYS, MOTION_LIBRARY_PACKAGES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES } from "oxlint-plugin-react-doctor";
 import * as Cause from "effect/Cause";
-import * as Config$1 from "effect/Config";
 import * as Effect from "effect/Effect";
+import * as Config$1 from "effect/Config";
 import * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
 import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
 import * as Otlp from "effect/unstable/observability/Otlp";
 import * as Context from "effect/Context";
+import * as Console from "effect/Console";
+import * as Fiber from "effect/Fiber";
 import * as Filter from "effect/Filter";
 import * as Option from "effect/Option";
 import * as Ref from "effect/Ref";
 import * as Stream from "effect/Stream";
 import * as Cache from "effect/Cache";
-import * as Console from "effect/Console";
 import * as NodeChildProcessSpawner from "@effect/platform-node-shared/NodeChildProcessSpawner";
 import * as NodeFileSystem from "@effect/platform-node-shared/NodeFileSystem";
 import * as NodePath from "@effect/platform-node-shared/NodePath";
@@ -2191,6 +2192,17 @@ const findMonorepoRoot = (startDirectory) => {
 	}
 	return null;
 };
+/**
+* True when `directory` looks like a project root we shouldn't walk
+* past — either the working tree's git root (a `.git` entry sits
+* here) or an npm/pnpm/yarn/bun monorepo root.
+*
+* Used as the stop-condition for the ancestor walks performed by
+* `detectUserLintConfigPaths`, `loadConfigWithSource`, and
+* `detectReactCompiler`. All three previously inlined their own
+* byte-equivalent copy.
+*/
+const isProjectBoundary = (directory) => fs.existsSync(path.join(directory, ".git")) || isMonorepoRoot(directory);
 const REACT_COMPILER_PACKAGES = new Set([
 	"babel-plugin-react-compiler",
 	"react-compiler-runtime",
@@ -2241,24 +2253,20 @@ const hasCompilerInConfigFile = (filePath) => {
 	return REACT_COMPILER_ENABLED_FLAG_PATTERN.test(content) || REACT_COMPILER_PACKAGE_REFERENCE_PATTERN.test(content);
 };
 const hasCompilerInConfigFiles = (directory, filenames) => filenames.some((filename) => hasCompilerInConfigFile(path.join(directory, filename)));
-const isProjectBoundary$2 = (directory) => {
-	if (fs.existsSync(path.join(directory, ".git"))) return true;
-	return isMonorepoRoot(directory);
-};
 const detectReactCompiler = (directory, packageJson) => {
 	if (hasCompilerPackage(packageJson)) return true;
 	if (hasCompilerInConfigFiles(directory, NEXT_CONFIG_FILENAMES)) return true;
 	if (hasCompilerInConfigFiles(directory, BABEL_CONFIG_FILENAMES)) return true;
 	if (hasCompilerInConfigFiles(directory, VITE_CONFIG_FILENAMES)) return true;
 	if (hasCompilerInConfigFiles(directory, EXPO_APP_CONFIG_FILENAMES)) return true;
-	if (isProjectBoundary$2(directory)) return false;
+	if (isProjectBoundary(directory)) return false;
 	let ancestorDirectory = path.dirname(directory);
 	while (ancestorDirectory !== path.dirname(ancestorDirectory)) {
 		const ancestorPackagePath = path.join(ancestorDirectory, "package.json");
 		if (isFile(ancestorPackagePath)) {
 			if (hasCompilerPackage(readPackageJson(ancestorPackagePath))) return true;
 		}
-		if (isProjectBoundary$2(ancestorDirectory)) return false;
+		if (isProjectBoundary(ancestorDirectory)) return false;
 		ancestorDirectory = path.dirname(ancestorDirectory);
 	}
 	return false;
@@ -2987,6 +2995,7 @@ const isTailwindAtLeast = (detected, required) => {
 const JSX_FILE_PATTERN = /\.(tsx|jsx)$/;
 const SCORE_API_URL = "https://www.react.doctor/api/score";
 const FETCH_TIMEOUT_MS = 1e4;
+const GITHUB_VIEWER_PERMISSION_TIMEOUT_MS = 2e3;
 const DEFAULT_BRANCH_CANDIDATES = ["main", "master"];
 const ADOPTABLE_LINT_CONFIG_FILENAMES = [".oxlintrc.json", ".eslintrc.json"];
 const GIT_SHOW_MAX_BUFFER_BYTES = 10 * 1024 * 1024;
@@ -3009,6 +3018,7 @@ const OXLINT_OUTPUT_MAX_BYTES = 50 * 1024 * 1024;
 const OXLINT_SPAWN_TIMEOUT_MS = 6e4;
 const RECOMMENDED_PNPM_MINIMUM_RELEASE_AGE_MINUTES = 10080;
 const MAX_GLOB_PATTERN_LENGTH_CHARS = 1024;
+const CONFIG_CACHE_TTL_MS = 300 * 1e3;
 var InvalidGlobPatternError = class extends Error {
 	pattern;
 	reason;
@@ -3103,6 +3113,18 @@ const isDiagnosticIgnoredByOverrides = (diagnostic, rootDirectory, overrides) =>
 	const ruleIdentifier = `${diagnostic.plugin}/${diagnostic.rule}`;
 	return overrides.some((override) => override.filePatterns.some((pattern) => pattern.test(relativeFilePath)) && (override.ruleIds.size === 0 || override.ruleIds.has(ruleIdentifier)));
 };
+const SEVERITY_FOR_OVERRIDE = {
+	error: "error",
+	warn: "warning"
+};
+const restampSeverity = (diagnostic, override) => {
+	const targetSeverity = SEVERITY_FOR_OVERRIDE[override];
+	if (diagnostic.severity === targetSeverity) return diagnostic;
+	return {
+		...diagnostic,
+		severity: targetSeverity
+	};
+};
 /**
 * Assembles the internal `RuleSeverityControls` shape from a user
 * config's top-level `rules` and `categories` fields — the
@@ -3120,25 +3142,115 @@ const buildRuleSeverityControls = (config) => {
 		...config.categories !== void 0 ? { categories: config.categories } : {}
 	};
 };
-/**
-* Projects a diagnostic onto the three axes rule-targeted controls
-* reason about:
-*
-* - `ruleKey` — the fully-qualified `"<plugin>/<rule>"` form users
-*   put in config files (consumed by top-level `rules` severity and
-*   `surfaces.*.{include,exclude}Rules`).
-* - `category` — the diagnostic's category label (consumed by
-*   top-level `categories` severity and
-*   `surfaces.*.{include,exclude}Categories`).
-* - `tags` — behavioral tags from the rule registry (consumed by
-*   `ignore.tags` and `surfaces.*.{include,exclude}Tags`). Empty
-*   for non-`react-doctor` plugins.
-*/
-const getDiagnosticRuleIdentity = (diagnostic) => ({
-	ruleKey: `${diagnostic.plugin}/${diagnostic.rule}`,
-	category: diagnostic.category,
-	tags: diagnostic.plugin === "react-doctor" ? reactDoctorPlugin.rules[diagnostic.rule]?.tags ?? [] : []
-});
+const JSX_OPENER_TAG_PATTERN = /<[A-Za-z][\w.]*/g;
+const JSX_TAG_NAME_FOLLOW = /[A-Za-z]/;
+const isOpenerMatchInsideLineComment = (line, openerCharIndex) => {
+	let stringDelimiter = null;
+	for (let charIndex = 0; charIndex < openerCharIndex; charIndex++) {
+		const character = line[charIndex];
+		if (stringDelimiter !== null) {
+			if (character === "\\") {
+				charIndex++;
+				continue;
+			}
+			if (character === stringDelimiter) stringDelimiter = null;
+			continue;
+		}
+		if (character === "\"" || character === "'" || character === "`") {
+			stringDelimiter = character;
+			continue;
+		}
+		if (character === "/" && line[charIndex + 1] === "/") return true;
+	}
+	return false;
+};
+const findOpenerTagOnLine = (line) => {
+	for (const match of line.matchAll(JSX_OPENER_TAG_PATTERN)) {
+		if (match.index === void 0) continue;
+		if (!isOpenerMatchInsideLineComment(line, match.index)) return { startCharIndex: match.index + match[0].length };
+	}
+	return null;
+};
+const findJsxOpenerSpan = (lines, openerLineIndex) => {
+	const openerLine = lines[openerLineIndex];
+	if (openerLine === void 0) return null;
+	const opener = findOpenerTagOnLine(openerLine);
+	if (!opener) return null;
+	const lookaheadLimit = Math.min(lines.length, openerLineIndex + 32);
+	let braceDepth = 0;
+	let innerAngleDepth = 0;
+	let stringDelimiter = null;
+	for (let lineIndex = openerLineIndex; lineIndex < lookaheadLimit; lineIndex++) {
+		const currentLine = lines[lineIndex];
+		const startCharForLine = lineIndex === openerLineIndex ? opener.startCharIndex : 0;
+		for (let charIndex = startCharForLine; charIndex < currentLine.length; charIndex++) {
+			const character = currentLine[charIndex];
+			if (stringDelimiter !== null) {
+				if (character === "\\") {
+					charIndex++;
+					continue;
+				}
+				if (character === stringDelimiter) stringDelimiter = null;
+				continue;
+			}
+			if (character === "\"" || character === "'" || character === "`") {
+				stringDelimiter = character;
+				continue;
+			}
+			if (character === "{") {
+				braceDepth++;
+				continue;
+			}
+			if (character === "}") {
+				braceDepth--;
+				continue;
+			}
+			if (braceDepth !== 0) continue;
+			if (character === "<") {
+				const followCharacter = currentLine[charIndex + 1];
+				if (followCharacter !== void 0 && JSX_TAG_NAME_FOLLOW.test(followCharacter)) innerAngleDepth++;
+				continue;
+			}
+			if (character !== ">") continue;
+			const previousCharacter = currentLine[charIndex - 1];
+			const nextCharacter = currentLine[charIndex + 1];
+			if (previousCharacter === "=" || nextCharacter === "=") continue;
+			if (innerAngleDepth > 0) {
+				innerAngleDepth--;
+				continue;
+			}
+			return lineIndex;
+		}
+	}
+	return null;
+};
+const findEnclosingMultilineJsxOpenerStart = (lines, diagnosticLineIndex) => {
+	for (let candidateIndex = diagnosticLineIndex - 1; candidateIndex >= 0 && diagnosticLineIndex - candidateIndex <= 32; candidateIndex--) {
+		const openerCloseIndex = findJsxOpenerSpan(lines, candidateIndex);
+		if (openerCloseIndex !== null && openerCloseIndex >= diagnosticLineIndex) return candidateIndex;
+	}
+	return null;
+};
+const DISABLE_NEXT_LINE_PATTERN = /(?:\/\/|\/\*)\s*react-doctor-disable-next-line\b(?:\s+([^\r\n]*?))?\s*(?:\*\/)?\s*\}?\s*$/;
+const findStackedDisableCommentsAbove = (lines, anchorIndex) => {
+	const collected = [];
+	let isStillInChain = true;
+	for (let candidateIndex = anchorIndex - 1; candidateIndex >= 0 && anchorIndex - candidateIndex <= 10; candidateIndex--) {
+		const candidateLine = lines[candidateIndex];
+		if (candidateLine === void 0) break;
+		const match = candidateLine.match(DISABLE_NEXT_LINE_PATTERN);
+		if (match) {
+			collected.push({
+				commentLineIndex: candidateIndex,
+				ruleList: match[1],
+				isInChain: isStillInChain
+			});
+			continue;
+		}
+		isStillInChain = false;
+	}
+	return collected;
+};
 const LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY = {
 	"effect/no-adjust-state-on-prop-change": "react-doctor/no-adjust-state-on-prop-change",
 	"effect/no-chain-state-updates": "react-doctor/no-chain-state-updates",
@@ -3269,6 +3381,111 @@ const getEquivalentRuleKeys = (ruleKey) => {
 	const nativeRuleKey = canonicalizeRuleKey(ruleKey);
 	return [nativeRuleKey, ...getLegacyRuleKeysForNative(nativeRuleKey)];
 };
+const stripDescriptionTail = (ruleList) => {
+	const descriptionMatch = ruleList.match(/(?:^|\s)--\s/);
+	if (!descriptionMatch || descriptionMatch.index === void 0) return ruleList;
+	return ruleList.slice(0, descriptionMatch.index);
+};
+const isRuleListedInComment = (ruleList, ruleId) => {
+	const trimmed = ruleList?.trim();
+	if (!trimmed) return true;
+	const ruleSection = stripDescriptionTail(trimmed).trim();
+	if (!ruleSection) return true;
+	return ruleSection.split(/[,\s]+/).some((token) => isSameRuleKey(token.trim(), ruleId));
+};
+const DISABLE_LINE_PATTERN = /(?:\/\/|\/\*)\s*react-doctor-disable-line\b(?:\s+([^\r\n]*?))?\s*(?:\*\/)?\s*\}?\s*$/;
+const formatLineGap = (gapLineCount) => `${gapLineCount} line${gapLineCount === 1 ? "" : "s"}`;
+const hasChainSuppressor = (comments, ruleId) => comments.some((comment) => comment.isInChain && isRuleListedInComment(comment.ruleList, ruleId));
+const findAdjacentRuleListMismatch = (comments, ruleId) => comments.find((comment) => comment.isInChain && Boolean(comment.ruleList?.trim()) && !isRuleListedInComment(comment.ruleList, ruleId));
+const findOutOfChainMatch = (comments, ruleId) => comments.find((comment) => !comment.isInChain && isRuleListedInComment(comment.ruleList, ruleId));
+const buildAdjacentMismatchHint = (comment, ruleId) => {
+	const ruleListText = comment.ruleList?.trim() ?? "";
+	return `An adjacent react-doctor-disable-next-line at line ${comment.commentLineIndex + 1} lists "${ruleListText}" — ${ruleId} is not in that list. Use the comma form: react-doctor-disable-next-line ${ruleListText}, ${ruleId}`;
+};
+const buildGapHint = (comment, diagnosticLineIndex, ruleId) => {
+	const commentLineNumber = comment.commentLineIndex + 1;
+	const diagnosticLineNumber = diagnosticLineIndex + 1;
+	return `A react-doctor-disable-next-line for ${ruleId} sits at line ${commentLineNumber}, but ${formatLineGap(diagnosticLineNumber - commentLineNumber - 1)} of code separate it from the diagnostic on line ${diagnosticLineNumber}. Move the comment immediately above line ${diagnosticLineNumber}, or extract the surrounding code into a helper so the suppression is adjacent.`;
+};
+const classifyFromComments = (commentsByAnchor, diagnosticLineIndex, ruleId) => {
+	for (const comments of commentsByAnchor) {
+		const adjacentMismatch = findAdjacentRuleListMismatch(comments, ruleId);
+		if (adjacentMismatch) return buildAdjacentMismatchHint(adjacentMismatch, ruleId);
+		const outOfChainMatch = findOutOfChainMatch(comments, ruleId);
+		if (outOfChainMatch) return buildGapHint(outOfChainMatch, diagnosticLineIndex, ruleId);
+	}
+	return null;
+};
+const evaluateSuppression = (lines, diagnosticLineIndex, ruleId) => {
+	const sameLineMatch = lines[diagnosticLineIndex]?.match(DISABLE_LINE_PATTERN);
+	if (sameLineMatch && isRuleListedInComment(sameLineMatch[1], ruleId)) return {
+		isSuppressed: true,
+		nearMissHint: null
+	};
+	const directComments = findStackedDisableCommentsAbove(lines, diagnosticLineIndex);
+	if (hasChainSuppressor(directComments, ruleId)) return {
+		isSuppressed: true,
+		nearMissHint: null
+	};
+	const openerStartIndex = findEnclosingMultilineJsxOpenerStart(lines, diagnosticLineIndex);
+	const openerComments = openerStartIndex !== null && openerStartIndex > 0 ? findStackedDisableCommentsAbove(lines, openerStartIndex) : [];
+	if (hasChainSuppressor(openerComments, ruleId)) return {
+		isSuppressed: true,
+		nearMissHint: null
+	};
+	return {
+		isSuppressed: false,
+		nearMissHint: classifyFromComments([directComments, openerComments], diagnosticLineIndex, ruleId)
+	};
+};
+/**
+* Projects a diagnostic onto the three axes rule-targeted controls
+* reason about:
+*
+* - `ruleKey` — the fully-qualified `"<plugin>/<rule>"` form users
+*   put in config files (consumed by top-level `rules` severity and
+*   `surfaces.*.{include,exclude}Rules`).
+* - `category` — the diagnostic's category label (consumed by
+*   top-level `categories` severity and
+*   `surfaces.*.{include,exclude}Categories`).
+* - `tags` — behavioral tags from the rule registry (consumed by
+*   `ignore.tags` and `surfaces.*.{include,exclude}Tags`). Empty
+*   for non-`react-doctor` plugins.
+*/
+const getDiagnosticRuleIdentity = (diagnostic) => ({
+	ruleKey: `${diagnostic.plugin}/${diagnostic.rule}`,
+	category: diagnostic.category,
+	tags: diagnostic.plugin === "react-doctor" ? reactDoctorPlugin.rules[diagnostic.rule]?.tags ?? [] : []
+});
+const compileIgnoredFilePatterns = (userConfig) => {
+	const files = userConfig?.ignore?.files;
+	if (!Array.isArray(files)) return [];
+	return compileGlobPatternsLenient(files.filter((entry) => typeof entry === "string"), (error) => warnConfigIssue(`ignore.files: ${error.message}`));
+};
+const isFileIgnoredByPatterns = (filePath, rootDirectory, patterns) => {
+	if (patterns.length === 0) return false;
+	const relativePath = toRelativePath(filePath, rootDirectory);
+	return patterns.some((pattern) => pattern.test(relativePath));
+};
+const TEST_FILE_DIRECTORY_PATTERN = /(?:^|\/)(?:__tests__|__test__|tests|test|__mocks__|cypress|e2e|playwright)\//;
+const TEST_FILE_SUFFIX_PATTERN = /\.(?:test|spec|stories|story|fixture|fixtures)\.(?:[cm]?[jt]sx?)$/;
+const FIXTURE_PROJECT_PATTERN = /\/(?:fixtures|__fixtures__)\//;
+const SOURCE_ROOT_PATTERN = /\/(?:src|app|lib|components|pages|features|modules|packages|apps|frontend|client)\//g;
+const stripAboveSourceRoot = (relativePath) => {
+	const fixtureMatch = FIXTURE_PROJECT_PATTERN.exec(relativePath);
+	if (fixtureMatch === null) return relativePath;
+	let lastIdx = -1;
+	for (const match of relativePath.matchAll(SOURCE_ROOT_PATTERN)) if (match.index !== void 0 && match.index > lastIdx) lastIdx = match.index;
+	if (lastIdx >= 0) return relativePath.slice(lastIdx);
+	return relativePath.slice(fixtureMatch.index + fixtureMatch[0].length - 1);
+};
+const isTestFilePath = (relativePath) => {
+	if (relativePath.length === 0) return false;
+	const forwardSlashed = relativePath.replaceAll("\\", "/");
+	if (TEST_FILE_SUFFIX_PATTERN.test(forwardSlashed)) return true;
+	const scoped = stripAboveSourceRoot(forwardSlashed);
+	return TEST_FILE_DIRECTORY_PATTERN.test(scoped);
+};
 /**
 * Resolves the user-configured severity override for a rule.
 * Per-rule overrides win over per-category overrides. Returns
@@ -3286,233 +3503,152 @@ const resolveRuleSeverityOverride = (input, controls) => {
 	}
 	return input.category !== void 0 ? controls.categories?.[input.category] : void 0;
 };
-const SEVERITY_FOR_OVERRIDE = {
-	error: "error",
-	warn: "warning"
-};
-const restampSeverity = (diagnostic, override) => {
-	const targetSeverity = SEVERITY_FOR_OVERRIDE[override];
-	if (diagnostic.severity === targetSeverity) return diagnostic;
-	return {
-		...diagnostic,
-		severity: targetSeverity
-	};
-};
-const JSX_OPENER_TAG_PATTERN = /<[A-Za-z][\w.]*/g;
-const JSX_TAG_NAME_FOLLOW = /[A-Za-z]/;
-const isOpenerMatchInsideLineComment = (line, openerCharIndex) => {
-	let stringDelimiter = null;
-	for (let charIndex = 0; charIndex < openerCharIndex; charIndex++) {
-		const character = line[charIndex];
-		if (stringDelimiter !== null) {
-			if (character === "\\") {
-				charIndex++;
-				continue;
-			}
-			if (character === stringDelimiter) stringDelimiter = null;
-			continue;
-		}
-		if (character === "\"" || character === "'" || character === "`") {
-			stringDelimiter = character;
-			continue;
-		}
-		if (character === "/" && line[charIndex + 1] === "/") return true;
-	}
-	return false;
+/**
+* Resolves the absolute path to read for a diagnostic's `filePath`,
+* accounting for the various shapes oxlint emits:
+*
+* - Absolute POSIX (`/abs/path/file.tsx`) — pass through.
+* - Absolute Windows (`C:/...` or `C:\...`) — pass through.
+* - `./relative` or bare relative — join against `rootDirectory`.
+*
+* Shared between the streaming diagnostic pipeline and the legacy
+* array-shaped `mergeAndFilterDiagnostics` wrapper so file-line lookups
+* use one canonical resolution path.
+*/
+const resolveCandidateReadPath = (rootDirectory, filePath) => {
+	const normalizedFile = filePath.replace(/\\/g, "/");
+	if (normalizedFile.startsWith("/") || /^[a-zA-Z]:\//.test(normalizedFile) || /^[a-zA-Z]:\\/.test(filePath)) return filePath;
+	return `${rootDirectory.replace(/\\/g, "/").replace(/\/$/, "")}/${normalizedFile.replace(/^\.\//, "")}`;
 };
-const findOpenerTagOnLine = (line) => {
-	for (const match of line.matchAll(JSX_OPENER_TAG_PATTERN)) {
-		if (match.index === void 0) continue;
-		if (!isOpenerMatchInsideLineComment(line, match.index)) return { startCharIndex: match.index + match[0].length };
+/**
+* Shared raw-line scanners that detect whether a diagnostic site is
+* enclosed by a configured `textComponents` entry or a
+* `rawTextWrapperComponents` entry. Both checks are used by the
+* diagnostic-pipeline's `rn-no-raw-text` suppression step.
+*
+* Heuristic — operates on raw lines without an AST — but good enough
+* to (a) detect a string-only wrapper child and (b) verify the opener
+* actually encloses a given diagnostic position.
+*/
+const OPENING_TAG_PATTERN = /<([A-Z][\w.]*)/;
+const JSX_CHILD_OPEN_PATTERN = /<[A-Za-z]/;
+const escapeRegExpSpecials = (rawText) => rawText.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+const findOpenerAtOrAbove = (lines, upperBoundLineIndex) => {
+	for (let lineIndex = upperBoundLineIndex; lineIndex >= 0; lineIndex--) {
+		const match = lines[lineIndex].match(OPENING_TAG_PATTERN);
+		if (!match) continue;
+		const fullName = match[1];
+		return {
+			fullName,
+			leafName: fullName.includes(".") ? fullName.split(".").at(-1) ?? fullName : fullName,
+			lineIndex
+		};
 	}
 	return null;
 };
-const findJsxOpenerSpan = (lines, openerLineIndex) => {
-	const openerLine = lines[openerLineIndex];
-	if (openerLine === void 0) return null;
-	const opener = findOpenerTagOnLine(openerLine);
-	if (!opener) return null;
-	const lookaheadLimit = Math.min(lines.length, openerLineIndex + 32);
-	let braceDepth = 0;
-	let innerAngleDepth = 0;
-	let stringDelimiter = null;
-	for (let lineIndex = openerLineIndex; lineIndex < lookaheadLimit; lineIndex++) {
-		const currentLine = lines[lineIndex];
-		const startCharForLine = lineIndex === openerLineIndex ? opener.startCharIndex : 0;
-		for (let charIndex = startCharForLine; charIndex < currentLine.length; charIndex++) {
-			const character = currentLine[charIndex];
-			if (stringDelimiter !== null) {
-				if (character === "\\") {
-					charIndex++;
-					continue;
-				}
-				if (character === stringDelimiter) stringDelimiter = null;
-				continue;
-			}
-			if (character === "\"" || character === "'" || character === "`") {
-				stringDelimiter = character;
-				continue;
-			}
-			if (character === "{") {
-				braceDepth++;
-				continue;
-			}
-			if (character === "}") {
-				braceDepth--;
-				continue;
-			}
-			if (braceDepth !== 0) continue;
-			if (character === "<") {
-				const followCharacter = currentLine[charIndex + 1];
-				if (followCharacter !== void 0 && JSX_TAG_NAME_FOLLOW.test(followCharacter)) innerAngleDepth++;
-				continue;
-			}
-			if (character !== ">") continue;
-			const previousCharacter = currentLine[charIndex - 1];
-			const nextCharacter = currentLine[charIndex + 1];
-			if (previousCharacter === "=" || nextCharacter === "=") continue;
-			if (innerAngleDepth > 0) {
-				innerAngleDepth--;
-				continue;
-			}
-			return lineIndex;
-		}
+const resolveJsxRange = (lines, opener) => {
+	const closingPattern = new RegExp(`</(?:${escapeRegExpSpecials(opener.fullName)}|${escapeRegExpSpecials(opener.leafName)})\\s*>`);
+	let closerLineIndex = -1;
+	let closerColumn = -1;
+	for (let lineIndex = opener.lineIndex; lineIndex < lines.length; lineIndex++) {
+		const match = closingPattern.exec(lines[lineIndex]);
+		if (!match) continue;
+		closerLineIndex = lineIndex;
+		closerColumn = match.index;
+		break;
+	}
+	if (closerLineIndex < 0) return null;
+	const openerLine = lines[opener.lineIndex];
+	const tagStartIndex = openerLine.indexOf(`<${opener.fullName}`);
+	if (tagStartIndex < 0) return null;
+	const openerEndIndex = openerLine.indexOf(">", tagStartIndex);
+	let bodyText;
+	if (opener.lineIndex === closerLineIndex) {
+		if (openerEndIndex < 0 || openerEndIndex >= closerColumn) return null;
+		bodyText = openerLine.slice(openerEndIndex + 1, closerColumn);
+	} else {
+		const segments = [];
+		if (openerEndIndex >= 0) segments.push(openerLine.slice(openerEndIndex + 1));
+		for (let lineIndex = opener.lineIndex + 1; lineIndex < closerLineIndex; lineIndex++) segments.push(lines[lineIndex]);
+		segments.push(lines[closerLineIndex].slice(0, closerColumn));
+		bodyText = segments.join("\n");
 	}
-	return null;
+	return {
+		closerLineIndex,
+		closerColumn,
+		bodyText
+	};
 };
-const findEnclosingMultilineJsxOpenerStart = (lines, diagnosticLineIndex) => {
-	for (let candidateIndex = diagnosticLineIndex - 1; candidateIndex >= 0 && diagnosticLineIndex - candidateIndex <= 32; candidateIndex--) {
-		const openerCloseIndex = findJsxOpenerSpan(lines, candidateIndex);
-		if (openerCloseIndex !== null && openerCloseIndex >= diagnosticLineIndex) return candidateIndex;
+/**
+* Returns true when the JSX element opened at or above `diagnosticLine`
+* is named in `textComponentNames`, matching either by full dotted name
+* (`NativeTabs.Trigger.Label`) or by the leaf name (`Label`).
+*/
+const isInsideTextComponent = (lines, diagnosticLine, textComponentNames) => {
+	for (let lineIndex = diagnosticLine - 1; lineIndex >= 0; lineIndex--) {
+		const match = lines[lineIndex].match(OPENING_TAG_PATTERN);
+		if (!match) continue;
+		const fullTagName = match[1];
+		const leafTagName = fullTagName.includes(".") ? fullTagName.split(".").at(-1) ?? fullTagName : fullTagName;
+		return textComponentNames.has(fullTagName) || textComponentNames.has(leafTagName);
 	}
-	return null;
+	return false;
 };
-const DISABLE_NEXT_LINE_PATTERN = /(?:\/\/|\/\*)\s*react-doctor-disable-next-line\b(?:\s+([^\r\n]*?))?\s*(?:\*\/)?\s*\}?\s*$/;
-const findStackedDisableCommentsAbove = (lines, anchorIndex) => {
-	const collected = [];
-	let isStillInChain = true;
-	for (let candidateIndex = anchorIndex - 1; candidateIndex >= 0 && anchorIndex - candidateIndex <= 10; candidateIndex--) {
-		const candidateLine = lines[candidateIndex];
-		if (candidateLine === void 0) break;
-		const match = candidateLine.match(DISABLE_NEXT_LINE_PATTERN);
-		if (match) {
-			collected.push({
-				commentLineIndex: candidateIndex,
-				ruleList: match[1],
-				isInChain: isStillInChain
-			});
+/**
+* Returns true when the diagnostic position is enclosed by the nearest
+* actually-enclosing opener AND that opener is in `wrapperNames` AND
+* its body has no JSX child elements (i.e. the wrapper holds only
+* stringifiable children). Closed siblings above the diagnostic are
+* skipped — `findOpenerAtOrAbove` keeps walking outward.
+*
+* Diagnostic line and column are 1-indexed; column may be 0 when oxlint
+* omits the span (we treat that as "earliest position on the line",
+* which is conservative for enclosure checks).
+*/
+const isInsideStringOnlyWrapper = (lines, diagnosticLine, diagnosticColumn, wrapperNames) => {
+	const diagnosticLineIndex = diagnosticLine - 1;
+	const diagnosticColumnIndex = Math.max(0, diagnosticColumn - 1);
+	let upperBoundLineIndex = diagnosticLineIndex;
+	while (upperBoundLineIndex >= 0) {
+		const opener = findOpenerAtOrAbove(lines, upperBoundLineIndex);
+		if (!opener) return false;
+		const range = resolveJsxRange(lines, opener);
+		if (range === null) {
+			upperBoundLineIndex = opener.lineIndex - 1;
 			continue;
 		}
-		isStillInChain = false;
-	}
-	return collected;
-};
-const stripDescriptionTail = (ruleList) => {
-	const descriptionMatch = ruleList.match(/(?:^|\s)--\s/);
-	if (!descriptionMatch || descriptionMatch.index === void 0) return ruleList;
-	return ruleList.slice(0, descriptionMatch.index);
-};
-const isRuleListedInComment = (ruleList, ruleId) => {
-	const trimmed = ruleList?.trim();
-	if (!trimmed) return true;
-	const ruleSection = stripDescriptionTail(trimmed).trim();
-	if (!ruleSection) return true;
-	return ruleSection.split(/[,\s]+/).some((token) => isSameRuleKey(token.trim(), ruleId));
-};
-const DISABLE_LINE_PATTERN = /(?:\/\/|\/\*)\s*react-doctor-disable-line\b(?:\s+([^\r\n]*?))?\s*(?:\*\/)?\s*\}?\s*$/;
-const formatLineGap = (gapLineCount) => `${gapLineCount} line${gapLineCount === 1 ? "" : "s"}`;
-const hasChainSuppressor = (comments, ruleId) => comments.some((comment) => comment.isInChain && isRuleListedInComment(comment.ruleList, ruleId));
-const findAdjacentRuleListMismatch = (comments, ruleId) => comments.find((comment) => comment.isInChain && Boolean(comment.ruleList?.trim()) && !isRuleListedInComment(comment.ruleList, ruleId));
-const findOutOfChainMatch = (comments, ruleId) => comments.find((comment) => !comment.isInChain && isRuleListedInComment(comment.ruleList, ruleId));
-const buildAdjacentMismatchHint = (comment, ruleId) => {
-	const ruleListText = comment.ruleList?.trim() ?? "";
-	return `An adjacent react-doctor-disable-next-line at line ${comment.commentLineIndex + 1} lists "${ruleListText}" — ${ruleId} is not in that list. Use the comma form: react-doctor-disable-next-line ${ruleListText}, ${ruleId}`;
-};
-const buildGapHint = (comment, diagnosticLineIndex, ruleId) => {
-	const commentLineNumber = comment.commentLineIndex + 1;
-	const diagnosticLineNumber = diagnosticLineIndex + 1;
-	return `A react-doctor-disable-next-line for ${ruleId} sits at line ${commentLineNumber}, but ${formatLineGap(diagnosticLineNumber - commentLineNumber - 1)} of code separate it from the diagnostic on line ${diagnosticLineNumber}. Move the comment immediately above line ${diagnosticLineNumber}, or extract the surrounding code into a helper so the suppression is adjacent.`;
-};
-const classifyFromComments = (commentsByAnchor, diagnosticLineIndex, ruleId) => {
-	for (const comments of commentsByAnchor) {
-		const adjacentMismatch = findAdjacentRuleListMismatch(comments, ruleId);
-		if (adjacentMismatch) return buildAdjacentMismatchHint(adjacentMismatch, ruleId);
-		const outOfChainMatch = findOutOfChainMatch(comments, ruleId);
-		if (outOfChainMatch) return buildGapHint(outOfChainMatch, diagnosticLineIndex, ruleId);
+		if (range.closerLineIndex < diagnosticLineIndex || range.closerLineIndex === diagnosticLineIndex && range.closerColumn <= diagnosticColumnIndex) {
+			upperBoundLineIndex = opener.lineIndex - 1;
+			continue;
+		}
+		if (!wrapperNames.has(opener.fullName) && !wrapperNames.has(opener.leafName)) return false;
+		return !JSX_CHILD_OPEN_PATTERN.test(range.bodyText);
 	}
-	return null;
-};
-const evaluateSuppression = (lines, diagnosticLineIndex, ruleId) => {
-	const sameLineMatch = lines[diagnosticLineIndex]?.match(DISABLE_LINE_PATTERN);
-	if (sameLineMatch && isRuleListedInComment(sameLineMatch[1], ruleId)) return {
-		isSuppressed: true,
-		nearMissHint: null
-	};
-	const directComments = findStackedDisableCommentsAbove(lines, diagnosticLineIndex);
-	if (hasChainSuppressor(directComments, ruleId)) return {
-		isSuppressed: true,
-		nearMissHint: null
-	};
-	const openerStartIndex = findEnclosingMultilineJsxOpenerStart(lines, diagnosticLineIndex);
-	const openerComments = openerStartIndex !== null && openerStartIndex > 0 ? findStackedDisableCommentsAbove(lines, openerStartIndex) : [];
-	if (hasChainSuppressor(openerComments, ruleId)) return {
-		isSuppressed: true,
-		nearMissHint: null
-	};
-	return {
-		isSuppressed: false,
-		nearMissHint: classifyFromComments([directComments, openerComments], diagnosticLineIndex, ruleId)
-	};
-};
-const compileIgnoredFilePatterns = (userConfig) => {
-	const files = userConfig?.ignore?.files;
-	if (!Array.isArray(files)) return [];
-	return compileGlobPatternsLenient(files.filter((entry) => typeof entry === "string"), (error) => warnConfigIssue(`ignore.files: ${error.message}`));
-};
-const isFileIgnoredByPatterns = (filePath, rootDirectory, patterns) => {
-	if (patterns.length === 0) return false;
-	const relativePath = toRelativePath(filePath, rootDirectory);
-	return patterns.some((pattern) => pattern.test(relativePath));
-};
-const resolveCandidateReadPath = (rootDirectory, filePath) => {
-	const normalizedFile = filePath.replace(/\\/g, "/");
-	if (normalizedFile.startsWith("/") || /^[a-zA-Z]:\//.test(normalizedFile) || /^[a-zA-Z]:\\/.test(filePath)) return filePath;
-	return `${rootDirectory.replace(/\\/g, "/").replace(/\/$/, "")}/${normalizedFile.replace(/^\.\//, "")}`;
-};
-const TEST_FILE_DIRECTORY_PATTERN = /(?:^|\/)(?:__tests__|__test__|tests|test|__mocks__|cypress|e2e|playwright)\//;
-const TEST_FILE_SUFFIX_PATTERN = /\.(?:test|spec|stories|story|fixture|fixtures)\.(?:[cm]?[jt]sx?)$/;
-const FIXTURE_PROJECT_PATTERN = /\/(?:fixtures|__fixtures__)\//;
-const SOURCE_ROOT_PATTERN = /\/(?:src|app|lib|components|pages|features|modules|packages|apps|frontend|client)\//g;
-const stripAboveSourceRoot = (relativePath) => {
-	const fixtureMatch = FIXTURE_PROJECT_PATTERN.exec(relativePath);
-	if (fixtureMatch === null) return relativePath;
-	let lastIdx = -1;
-	for (const match of relativePath.matchAll(SOURCE_ROOT_PATTERN)) if (match.index !== void 0 && match.index > lastIdx) lastIdx = match.index;
-	if (lastIdx >= 0) return relativePath.slice(lastIdx);
-	return relativePath.slice(fixtureMatch.index + fixtureMatch[0].length - 1);
+	return false;
 };
-const isTestFilePath = (relativePath) => {
-	if (relativePath.length === 0) return false;
-	const forwardSlashed = relativePath.replaceAll("\\", "/");
-	if (TEST_FILE_SUFFIX_PATTERN.test(forwardSlashed)) return true;
-	const scoped = stripAboveSourceRoot(forwardSlashed);
-	return TEST_FILE_DIRECTORY_PATTERN.test(scoped);
+const collectStringSet = (values) => {
+	if (!Array.isArray(values)) return /* @__PURE__ */ new Set();
+	return new Set(values.filter((value) => typeof value === "string"));
 };
 /**
 * Pre-compiles every stateful filter and returns a single
-* `apply(diagnostic)` closure that runs:
+* `apply(diagnostic)` closure that runs (in order):
 *
 * 1. auto-suppress (test-noise rules in test files; `migration-hint`
 *    wins over `test-noise`)
 * 2. severity overrides (top-level `rules` / `categories`, with
 *    `"off"` dropping)
 * 3. ignore filters (rules / file patterns / per-file overrides)
-* 4. inline suppressions (`// react-doctor-disable-next-line ...`)
+* 4. `rn-no-raw-text` suppression via configured `textComponents` and
+*    `rawTextWrapperComponents` (config-driven JSX enclosure checks)
+* 5. inline suppressions (`// react-doctor-disable-next-line ...`)
 *
 * Returns `null` when the diagnostic is dropped, the (possibly
-* severity-restamped) diagnostic otherwise. Shared by `runInspect`'s
-* streaming pipeline and the array-shaped `mergeAndFilterDiagnostics`
-* — single source of truth.
+* severity-restamped) diagnostic otherwise.
+*
+* This is the single source of truth for diagnostic filtering — both
+* `runInspect`'s streaming pipeline and the array-shaped
+* `mergeAndFilterDiagnostics` wrapper apply this closure per element.
 */
 const buildDiagnosticPipeline = (input) => {
 	const { rootDirectory, userConfig, readFileLinesSync, respectInlineDisables } = input;
@@ -3520,6 +3656,10 @@ const buildDiagnosticPipeline = (input) => {
 	const ignoredRules = new Set(Array.isArray(userConfig?.ignore?.rules) ? userConfig.ignore.rules.filter((rule) => typeof rule === "string") : []);
 	const ignoredFilePatterns = compileIgnoredFilePatterns(userConfig);
 	const compiledOverrides = compileIgnoreOverrides(userConfig);
+	const textComponentNames = collectStringSet(userConfig?.textComponents);
+	const rawTextWrapperComponentNames = collectStringSet(userConfig?.rawTextWrapperComponents);
+	const hasTextComponents = textComponentNames.size > 0;
+	const hasRawTextWrappers = rawTextWrapperComponentNames.size > 0;
 	const fileLinesCache = /* @__PURE__ */ new Map();
 	const testFileCache = /* @__PURE__ */ new Map();
 	const getFileLines = (filePath) => {
@@ -3548,6 +3688,16 @@ const buildDiagnosticPipeline = (input) => {
 		for (const ignored of ignoredRules) if (isSameRuleKey(ignored, ruleIdentifier)) return true;
 		return false;
 	};
+	const isRnRawTextSuppressedByConfig = (diagnostic) => {
+		if (diagnostic.rule !== "rn-no-raw-text") return false;
+		if (diagnostic.line <= 0) return false;
+		if (!hasTextComponents && !hasRawTextWrappers) return false;
+		const lines = getFileLines(diagnostic.filePath);
+		if (!lines) return false;
+		if (hasTextComponents && isInsideTextComponent(lines, diagnostic.line, textComponentNames)) return true;
+		if (hasRawTextWrappers && isInsideStringOnlyWrapper(lines, diagnostic.line, diagnostic.column, rawTextWrapperComponentNames)) return true;
+		return false;
+	};
 	return { apply: (diagnostic) => {
 		if (shouldAutoSuppress(diagnostic)) return null;
 		let current = diagnostic;
@@ -3564,6 +3714,7 @@ const buildDiagnosticPipeline = (input) => {
 			if (isRuleIgnored(`${current.plugin}/${current.rule}`)) return null;
 			if (isFileIgnoredByPatterns(current.filePath, rootDirectory, ignoredFilePatterns)) return null;
 			if (isDiagnosticIgnoredByOverrides(current, rootDirectory, compiledOverrides)) return null;
+			if (isRnRawTextSuppressedByConfig(current)) return null;
 		}
 		if (respectInlineDisables && current.line > 0) {
 			const lines = getFileLines(current.filePath);
@@ -3690,6 +3841,27 @@ var ReactDoctorError = class extends Schema.TaggedErrorClass()("ReactDoctorError
 const formatReactDoctorError = (error) => error.reason.message;
 const isSplittableReactDoctorError = (error) => error instanceof ReactDoctorError && error.reason._tag === "OxlintBatchExceeded";
 const isReactDoctorError = (error) => error instanceof ReactDoctorError;
+/**
+* Tagged-reason → legacy thrown-class boundary shared by every public
+* shell (`inspect()` in `react-doctor`, `diagnose()` in `@react-doctor/api`).
+*
+* `Effect.catchReasons` dispatches on the tagged-error sub-channel
+* without manual `instanceof` checks. Each handler converts a tagged
+* reason into the historical thrown class advertised by the legacy
+* public-API contract (via `Effect.die`, which `Effect.runPromise`
+* re-throws unchanged). The `orElse` branch re-`die`s the original
+* `ReactDoctorError` instance so advanced callers can still narrow on
+* `error.reason._tag` while grep-stderr users keep the same
+* `error.message` they always saw.
+*
+* Adding a new legacy thrown class is a one-line change on the
+* `Effect.catchReasons` map — both shells pick it up automatically.
+*/
+const restoreLegacyThrow = (effect) => effect.pipe(Effect.catchReasons("ReactDoctorError", {
+	NoReactDependency: (reason) => Effect.die(new NoReactDependencyError(reason.directory)),
+	ProjectNotFound: (reason) => Effect.die(new ProjectNotFoundError(reason.directory)),
+	AmbiguousProject: (reason) => Effect.die(new AmbiguousProjectError(reason.directory, [...reason.candidates]))
+}, (_reason, error) => Effect.die(error)));
 const TRACER_PROJECT_NAME = "react-doctor";
 const OTEL_ENDPOINT = Config$1.string("REACT_DOCTOR_OTLP_ENDPOINT").pipe(Config$1.option);
 const OTEL_AUTH_HEADER = Config$1.redacted("REACT_DOCTOR_OTLP_AUTH_HEADER").pipe(Config$1.option);
@@ -3732,216 +3904,6 @@ Context.Reference("react-doctor/OxlintSpawnTimeoutMs", { defaultValue: () => {
 } });
 Context.Reference("react-doctor/OxlintOutputMaxBytes", { defaultValue: () => OXLINT_OUTPUT_MAX_BYTES });
 Context.Reference("react-doctor/StagedFilesTempDirPrefix", { defaultValue: () => "react-doctor-staged-" });
-const PNPM_WORKSPACE_FILE = "pnpm-workspace.yaml";
-const PNPM_LOCKFILE = "pnpm-lock.yaml";
-const PACKAGE_JSON_FILE = "package.json";
-const PNPM_HARDENING_RULE_KEY = "require-pnpm-hardening";
-const UTF8_BOM_CHAR = "";
-const HARDENING_SETTING_KEYS = new Set([
-	"minimumReleaseAge",
-	"blockExoticSubdeps",
-	"trustPolicy"
-]);
-const stripInlineComment = (rawValue) => {
-	let activeQuote = null;
-	for (let charIndex = 0; charIndex < rawValue.length; charIndex += 1) {
-		const currentChar = rawValue[charIndex];
-		if (activeQuote !== null) {
-			if (currentChar === activeQuote) activeQuote = null;
-			continue;
-		}
-		if (currentChar === "\"" || currentChar === "'") {
-			activeQuote = currentChar;
-			continue;
-		}
-		if (currentChar !== "#") continue;
-		const previousChar = rawValue[charIndex - 1];
-		if (charIndex === 0 || previousChar !== void 0 && /\s/.test(previousChar)) return rawValue.slice(0, charIndex);
-	}
-	return rawValue;
-};
-const unquote = (rawValue) => rawValue.replace(/^["']|["']$/g, "");
-const stripBom = (rawContent) => rawContent.startsWith(UTF8_BOM_CHAR) ? rawContent.slice(1) : rawContent;
-const parseHardeningSettings = (content) => {
-	let minimumReleaseAge = null;
-	let blockExoticSubdeps = null;
-	let trustPolicy = null;
-	const lines = stripBom(content).split(/\r?\n/);
-	for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
-		const lineText = lines[lineIndex];
-		if (lineText === void 0) continue;
-		if (lineText.search(/\S/) !== 0) continue;
-		const trimmedLine = lineText.trim();
-		if (trimmedLine.startsWith("#")) continue;
-		const colonIndex = trimmedLine.indexOf(":");
-		if (colonIndex <= 0) continue;
-		const settingKey = unquote(trimmedLine.slice(0, colonIndex).trim());
-		if (!HARDENING_SETTING_KEYS.has(settingKey)) continue;
-		const inlineValue = stripInlineComment(trimmedLine.slice(colonIndex + 1)).trim();
-		if (inlineValue.length === 0) continue;
-		const scalar = {
-			value: unquote(inlineValue),
-			line: lineIndex + 1,
-			column: lineText.search(/\S/) + 1
-		};
-		if (settingKey === "minimumReleaseAge") minimumReleaseAge = scalar;
-		else if (settingKey === "blockExoticSubdeps") blockExoticSubdeps = scalar;
-		else if (settingKey === "trustPolicy") trustPolicy = scalar;
-	}
-	return {
-		minimumReleaseAge,
-		blockExoticSubdeps,
-		trustPolicy
-	};
-};
-const isPnpmManagedProject = (rootDirectory) => {
-	if (isFile(path.join(rootDirectory, PNPM_LOCKFILE))) return true;
-	if (isFile(path.join(rootDirectory, PNPM_WORKSPACE_FILE))) return true;
-	const packageJsonPath = path.join(rootDirectory, PACKAGE_JSON_FILE);
-	if (!isFile(packageJsonPath)) return false;
-	try {
-		const packageJsonRaw = fs.readFileSync(packageJsonPath, "utf-8");
-		const packageJson = JSON.parse(packageJsonRaw);
-		if (packageJson !== null && typeof packageJson === "object" && "packageManager" in packageJson && typeof packageJson.packageManager === "string" && packageJson.packageManager.startsWith("pnpm@")) return true;
-	} catch {
-		return false;
-	}
-	return false;
-};
-const buildHardeningDiagnostic = (input) => ({
-	filePath: PNPM_WORKSPACE_FILE,
-	plugin: "react-doctor",
-	rule: PNPM_HARDENING_RULE_KEY,
-	severity: "warning",
-	message: input.message,
-	help: input.help,
-	line: input.line ?? 0,
-	column: input.column ?? 0,
-	category: "Security"
-});
-const checkPnpmHardening = (rootDirectory) => {
-	if (!isPnpmManagedProject(rootDirectory)) return [];
-	const workspacePath = path.join(rootDirectory, PNPM_WORKSPACE_FILE);
-	const settings = parseHardeningSettings(isFile(workspacePath) ? fs.readFileSync(workspacePath, "utf-8") : "");
-	const diagnostics = [];
-	if (settings.minimumReleaseAge === null) diagnostics.push(buildHardeningDiagnostic({
-		message: "pnpm-workspace.yaml is missing `minimumReleaseAge` — newly published versions can ship malware that gets caught and unpublished within hours",
-		help: `Add \`minimumReleaseAge: ${RECOMMENDED_PNPM_MINIMUM_RELEASE_AGE_MINUTES}\` (7 days) to pnpm-workspace.yaml to delay installs until releases have had time to be vetted`
-	}));
-	if (settings.blockExoticSubdeps !== null && settings.blockExoticSubdeps.value.toLowerCase() === "false") diagnostics.push(buildHardeningDiagnostic({
-		line: settings.blockExoticSubdeps.line,
-		column: settings.blockExoticSubdeps.column,
-		message: "`blockExoticSubdeps: false` allows transitive deps from `git:`, `file:`, or tarball URLs — a known supply-chain bypass of the npm registry",
-		help: "Set `blockExoticSubdeps: true` (the default in recent pnpm v11) so transitive deps must come from the registry"
-	}));
-	if (settings.trustPolicy === null) diagnostics.push(buildHardeningDiagnostic({
-		message: "pnpm-workspace.yaml is missing `trustPolicy` — without `no-downgrade`, pnpm silently accepts packages whose trust signals (provenance, signatures) weaken between updates",
-		help: "Add `trustPolicy: no-downgrade` to pnpm-workspace.yaml"
-	}));
-	else if (settings.trustPolicy.value !== "no-downgrade") diagnostics.push(buildHardeningDiagnostic({
-		line: settings.trustPolicy.line,
-		column: settings.trustPolicy.column,
-		message: `\`trustPolicy: ${settings.trustPolicy.value}\` is weaker than \`no-downgrade\` — packages may lose trust signals between updates without you noticing`,
-		help: "Set `trustPolicy: no-downgrade` so pnpm refuses to downgrade trust between resolutions"
-	}));
-	return diagnostics;
-};
-const REDUCED_MOTION_GREP_PATTERN = "prefers-reduced-motion|useReducedMotion|MotionConfig|reducedMotion";
-const REDUCED_MOTION_FILE_GLOBS = [
-	"*.ts",
-	"*.tsx",
-	"*.js",
-	"*.jsx",
-	"*.css",
-	"*.scss"
-];
-const MISSING_REDUCED_MOTION_DIAGNOSTIC = {
-	filePath: "package.json",
-	plugin: "react-doctor",
-	rule: "require-reduced-motion",
-	severity: "error",
-	message: "Project uses a motion library but has no prefers-reduced-motion handling — required for accessibility (WCAG 2.3.3)",
-	help: "Add `useReducedMotion()` from your animation library, or a `@media (prefers-reduced-motion: reduce)` CSS query",
-	line: 0,
-	column: 0,
-	category: "Accessibility"
-};
-const checkReducedMotion = (rootDirectory) => {
-	const packageJsonPath = path.join(rootDirectory, "package.json");
-	if (!isFile(packageJsonPath)) return [];
-	let hasMotionLibrary = false;
-	try {
-		const packageJson = readPackageJson(packageJsonPath);
-		const allDependencies = {
-			...packageJson.dependencies,
-			...packageJson.devDependencies
-		};
-		hasMotionLibrary = Object.keys(allDependencies).some((packageName) => MOTION_LIBRARY_PACKAGES.has(packageName));
-	} catch {
-		return [];
-	}
-	if (!hasMotionLibrary) return [];
-	const result = spawnSync("git", [
-		"grep",
-		"-ql",
-		"-E",
-		REDUCED_MOTION_GREP_PATTERN,
-		"--",
-		...REDUCED_MOTION_FILE_GLOBS
-	], {
-		cwd: rootDirectory,
-		stdio: [
-			"ignore",
-			"pipe",
-			"pipe"
-		]
-	});
-	if (result.error) return [MISSING_REDUCED_MOTION_DIAGNOSTIC];
-	if (result.status === 0) return [];
-	return [MISSING_REDUCED_MOTION_DIAGNOSTIC];
-};
-const computeJsxIncludePaths = (includePaths) => includePaths.length > 0 ? includePaths.filter((filePath) => JSX_FILE_PATTERN.test(filePath)) : void 0;
-const listSourceFilesViaGit = (rootDirectory) => {
-	const result = spawnSync("git", [
-		"ls-files",
-		"-z",
-		"--cached",
-		"--others",
-		"--exclude-standard"
-	], {
-		cwd: rootDirectory,
-		encoding: "utf-8",
-		maxBuffer: GIT_LS_FILES_MAX_BUFFER_BYTES
-	});
-	if (result.error || result.status !== 0) return null;
-	return result.stdout.split("\0").filter((filePath) => filePath.length > 0 && SOURCE_FILE_PATTERN.test(filePath));
-};
-const listSourceFilesViaFilesystem = (rootDirectory) => {
-	const filePaths = [];
-	const stack = [rootDirectory];
-	while (stack.length > 0) {
-		const currentDirectory = stack.pop();
-		const entries = readDirectoryEntries(currentDirectory);
-		for (const entry of entries) {
-			const absolutePath = path.join(currentDirectory, entry.name);
-			if (entry.isDirectory()) {
-				if (!entry.name.startsWith(".") && !IGNORED_DIRECTORIES.has(entry.name)) stack.push(absolutePath);
-				continue;
-			}
-			if (entry.isFile() && SOURCE_FILE_PATTERN.test(entry.name)) filePaths.push(path.relative(rootDirectory, absolutePath).replace(/\\/g, "/"));
-		}
-	}
-	return filePaths;
-};
-const listSourceFiles = (rootDirectory) => listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory);
-const resolveLintIncludePaths = (rootDirectory, userConfig) => {
-	if (!Array.isArray(userConfig?.ignore?.files) || userConfig.ignore.files.length === 0) return;
-	const ignoredPatterns = compileIgnoredFilePatterns(userConfig);
-	return listSourceFiles(rootDirectory).filter((filePath) => {
-		if (!JSX_FILE_PATTERN.test(filePath)) return false;
-		return !isFileIgnoredByPatterns(filePath, rootDirectory, ignoredPatterns);
-	});
-};
 const DIAGNOSTIC_SURFACES = [
 	"cli",
 	"prComment",
@@ -3949,6 +3911,22 @@ const DIAGNOSTIC_SURFACES = [
 	"ciFailure"
 ];
 const isDiagnosticSurface = (value) => typeof value === "string" && DIAGNOSTIC_SURFACES.includes(value);
+/**
+* Built-in surface exclusions applied before any user config.
+*
+* `design`-tagged rules are weak-signal style cleanup — they still ship
+* to the local CLI so developers see them while editing, but they're
+* removed from the PR comment surface, the score, and the CI gate so
+* they can't bury real React findings or fail a build over a Tailwind
+* shorthand. Override per-surface via `config.surfaces.<surface>` to
+* promote individual rules back in by tag, category, or rule id.
+*/
+const DEFAULT_SURFACE_EXCLUDED_TAGS = {
+	cli: [],
+	prComment: ["design"],
+	score: ["design"],
+	ciFailure: ["design"]
+};
 const VALID_RULE_SEVERITIES = [
 	"error",
 	"warn",
@@ -4099,59 +4077,342 @@ const loadConfigFromDirectory = (directory) => {
 	}
 	return null;
 };
-const isProjectBoundary$1 = (directory) => fs.existsSync(path.join(directory, ".git")) || isMonorepoRoot(directory);
-const cachedConfigs = /* @__PURE__ */ new Map();
-const clearConfigCache = () => {
-	cachedConfigs.clear();
+const cachedConfigs = /* @__PURE__ */ new Map();
+const clearConfigCache = () => {
+	cachedConfigs.clear();
+};
+const loadConfigWithSource = (rootDirectory) => {
+	const cached = cachedConfigs.get(rootDirectory);
+	if (cached !== void 0) return cached;
+	const localConfig = loadConfigFromDirectory(rootDirectory);
+	if (localConfig) {
+		cachedConfigs.set(rootDirectory, localConfig);
+		return localConfig;
+	}
+	if (isProjectBoundary(rootDirectory)) {
+		cachedConfigs.set(rootDirectory, null);
+		return null;
+	}
+	let ancestorDirectory = path.dirname(rootDirectory);
+	while (ancestorDirectory !== path.dirname(ancestorDirectory)) {
+		const ancestorConfig = loadConfigFromDirectory(ancestorDirectory);
+		if (ancestorConfig) {
+			cachedConfigs.set(rootDirectory, ancestorConfig);
+			return ancestorConfig;
+		}
+		if (isProjectBoundary(ancestorDirectory)) {
+			cachedConfigs.set(rootDirectory, null);
+			return null;
+		}
+		ancestorDirectory = path.dirname(ancestorDirectory);
+	}
+	cachedConfigs.set(rootDirectory, null);
+	return null;
+};
+const resolveConfigRootDir = (config, configSourceDirectory) => {
+	if (!config || !configSourceDirectory) return null;
+	const rawRootDir = config.rootDir;
+	if (typeof rawRootDir !== "string") return null;
+	const trimmedRootDir = rawRootDir.trim();
+	if (trimmedRootDir.length === 0) return null;
+	const resolvedRootDir = path.isAbsolute(trimmedRootDir) ? trimmedRootDir : path.resolve(configSourceDirectory, trimmedRootDir);
+	if (resolvedRootDir === configSourceDirectory) return null;
+	if (!isDirectory(resolvedRootDir)) {
+		Effect.runSync(Console.warn(`react-doctor config "rootDir" points to "${rawRootDir}" (resolved to ${resolvedRootDir}), which is not a directory. Ignoring.`));
+		return null;
+	}
+	return resolvedRootDir;
+};
+const resolveDiagnoseTarget = (directory) => {
+	if (isFile(path.join(directory, "package.json"))) return directory;
+	const reactSubprojects = discoverReactSubprojects(directory);
+	if (reactSubprojects.length === 0) return null;
+	if (reactSubprojects.length === 1) return reactSubprojects[0].directory;
+	throw new AmbiguousProjectError(directory, reactSubprojects.map((subproject) => path.relative(directory, subproject.directory)).toSorted());
+};
+/**
+* The canonical entry-point translation shared by every public shell
+* (`inspect()`, `diagnose()`, and the CLI's `inspectAction`):
+*
+*   1. Resolve the requested directory to absolute.
+*   2. Load `react-doctor.config.(json|js)` / `package.json#reactDoctor`
+*      if present.
+*   3. Honor `config.rootDir` to redirect the scan to a nested
+*      project root, if configured.
+*   4. Walk into a nested React subproject when the requested
+*      directory has no `package.json` of its own (raises
+*      `AmbiguousProjectError` when multiple candidates exist).
+*
+* Throws `ProjectNotFoundError` when neither the requested directory
+* nor any discoverable nested project has a `package.json`.
+*
+* Before this helper existed, the same three-step dance was reproduced
+* in `api/diagnose.ts`, `react-doctor/inspect.ts`, and the CLI's
+* `cli/commands/inspect.ts` — each loading the config independently
+* (the orchestrator's `Config.layerNode` then loads it a fourth time
+* via its own cache). Routing through `resolveScanTarget` keeps every
+* shell in agreement on what "the scan directory" means.
+*/
+const resolveScanTarget = (requestedDirectory) => {
+	const absoluteRequested = path.resolve(requestedDirectory);
+	const loadedConfig = loadConfigWithSource(absoluteRequested);
+	const userConfig = loadedConfig?.config ?? null;
+	const configSourceDirectory = loadedConfig?.sourceDirectory ?? null;
+	const redirectedDirectory = resolveConfigRootDir(userConfig, configSourceDirectory);
+	const directoryAfterRedirect = redirectedDirectory ?? absoluteRequested;
+	return {
+		resolvedDirectory: resolveDiagnoseTarget(directoryAfterRedirect) ?? directoryAfterRedirect,
+		requestedDirectory: absoluteRequested,
+		userConfig,
+		configSourceDirectory,
+		didRedirectViaRootDir: redirectedDirectory !== null
+	};
+};
+const PNPM_WORKSPACE_FILE = "pnpm-workspace.yaml";
+const PNPM_LOCKFILE = "pnpm-lock.yaml";
+const PACKAGE_JSON_FILE = "package.json";
+const PNPM_HARDENING_RULE_KEY = "require-pnpm-hardening";
+const UTF8_BOM_CHAR = "";
+const HARDENING_SETTING_KEYS = new Set([
+	"minimumReleaseAge",
+	"blockExoticSubdeps",
+	"trustPolicy"
+]);
+const stripInlineComment = (rawValue) => {
+	let activeQuote = null;
+	for (let charIndex = 0; charIndex < rawValue.length; charIndex += 1) {
+		const currentChar = rawValue[charIndex];
+		if (activeQuote !== null) {
+			if (currentChar === activeQuote) activeQuote = null;
+			continue;
+		}
+		if (currentChar === "\"" || currentChar === "'") {
+			activeQuote = currentChar;
+			continue;
+		}
+		if (currentChar !== "#") continue;
+		const previousChar = rawValue[charIndex - 1];
+		if (charIndex === 0 || previousChar !== void 0 && /\s/.test(previousChar)) return rawValue.slice(0, charIndex);
+	}
+	return rawValue;
+};
+const unquote = (rawValue) => rawValue.replace(/^["']|["']$/g, "");
+const stripBom = (rawContent) => rawContent.startsWith(UTF8_BOM_CHAR) ? rawContent.slice(1) : rawContent;
+const parseHardeningSettings = (content) => {
+	let minimumReleaseAge = null;
+	let blockExoticSubdeps = null;
+	let trustPolicy = null;
+	const lines = stripBom(content).split(/\r?\n/);
+	for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
+		const lineText = lines[lineIndex];
+		if (lineText === void 0) continue;
+		if (lineText.search(/\S/) !== 0) continue;
+		const trimmedLine = lineText.trim();
+		if (trimmedLine.startsWith("#")) continue;
+		const colonIndex = trimmedLine.indexOf(":");
+		if (colonIndex <= 0) continue;
+		const settingKey = unquote(trimmedLine.slice(0, colonIndex).trim());
+		if (!HARDENING_SETTING_KEYS.has(settingKey)) continue;
+		const inlineValue = stripInlineComment(trimmedLine.slice(colonIndex + 1)).trim();
+		if (inlineValue.length === 0) continue;
+		const scalar = {
+			value: unquote(inlineValue),
+			line: lineIndex + 1,
+			column: lineText.search(/\S/) + 1
+		};
+		if (settingKey === "minimumReleaseAge") minimumReleaseAge = scalar;
+		else if (settingKey === "blockExoticSubdeps") blockExoticSubdeps = scalar;
+		else if (settingKey === "trustPolicy") trustPolicy = scalar;
+	}
+	return {
+		minimumReleaseAge,
+		blockExoticSubdeps,
+		trustPolicy
+	};
+};
+const isPnpmManagedProject = (rootDirectory) => {
+	if (isFile(path.join(rootDirectory, PNPM_LOCKFILE))) return true;
+	if (isFile(path.join(rootDirectory, PNPM_WORKSPACE_FILE))) return true;
+	const packageJsonPath = path.join(rootDirectory, PACKAGE_JSON_FILE);
+	if (!isFile(packageJsonPath)) return false;
+	try {
+		const packageJsonRaw = fs.readFileSync(packageJsonPath, "utf-8");
+		const packageJson = JSON.parse(packageJsonRaw);
+		if (packageJson !== null && typeof packageJson === "object" && "packageManager" in packageJson && typeof packageJson.packageManager === "string" && packageJson.packageManager.startsWith("pnpm@")) return true;
+	} catch {
+		return false;
+	}
+	return false;
+};
+const buildHardeningDiagnostic = (input) => ({
+	filePath: PNPM_WORKSPACE_FILE,
+	plugin: "react-doctor",
+	rule: PNPM_HARDENING_RULE_KEY,
+	severity: "warning",
+	message: input.message,
+	help: input.help,
+	line: input.line ?? 0,
+	column: input.column ?? 0,
+	category: "Security"
+});
+const checkPnpmHardening = (rootDirectory) => {
+	if (!isPnpmManagedProject(rootDirectory)) return [];
+	const workspacePath = path.join(rootDirectory, PNPM_WORKSPACE_FILE);
+	const settings = parseHardeningSettings(isFile(workspacePath) ? fs.readFileSync(workspacePath, "utf-8") : "");
+	const diagnostics = [];
+	if (settings.minimumReleaseAge === null) diagnostics.push(buildHardeningDiagnostic({
+		message: "pnpm-workspace.yaml is missing `minimumReleaseAge` — newly published versions can ship malware that gets caught and unpublished within hours",
+		help: `Add \`minimumReleaseAge: ${RECOMMENDED_PNPM_MINIMUM_RELEASE_AGE_MINUTES}\` (7 days) to pnpm-workspace.yaml to delay installs until releases have had time to be vetted`
+	}));
+	if (settings.blockExoticSubdeps !== null && settings.blockExoticSubdeps.value.toLowerCase() === "false") diagnostics.push(buildHardeningDiagnostic({
+		line: settings.blockExoticSubdeps.line,
+		column: settings.blockExoticSubdeps.column,
+		message: "`blockExoticSubdeps: false` allows transitive deps from `git:`, `file:`, or tarball URLs — a known supply-chain bypass of the npm registry",
+		help: "Set `blockExoticSubdeps: true` (the default in recent pnpm v11) so transitive deps must come from the registry"
+	}));
+	if (settings.trustPolicy === null) diagnostics.push(buildHardeningDiagnostic({
+		message: "pnpm-workspace.yaml is missing `trustPolicy` — without `no-downgrade`, pnpm silently accepts packages whose trust signals (provenance, signatures) weaken between updates",
+		help: "Add `trustPolicy: no-downgrade` to pnpm-workspace.yaml"
+	}));
+	else if (settings.trustPolicy.value !== "no-downgrade") diagnostics.push(buildHardeningDiagnostic({
+		line: settings.trustPolicy.line,
+		column: settings.trustPolicy.column,
+		message: `\`trustPolicy: ${settings.trustPolicy.value}\` is weaker than \`no-downgrade\` — packages may lose trust signals between updates without you noticing`,
+		help: "Set `trustPolicy: no-downgrade` so pnpm refuses to downgrade trust between resolutions"
+	}));
+	return diagnostics;
+};
+const REDUCED_MOTION_GREP_PATTERN = "prefers-reduced-motion|useReducedMotion|MotionConfig|reducedMotion";
+const REDUCED_MOTION_FILE_GLOBS = [
+	"*.ts",
+	"*.tsx",
+	"*.js",
+	"*.jsx",
+	"*.css",
+	"*.scss"
+];
+const MISSING_REDUCED_MOTION_DIAGNOSTIC = {
+	filePath: "package.json",
+	plugin: "react-doctor",
+	rule: "require-reduced-motion",
+	severity: "error",
+	message: "Project uses a motion library but has no prefers-reduced-motion handling — required for accessibility (WCAG 2.3.3)",
+	help: "Add `useReducedMotion()` from your animation library, or a `@media (prefers-reduced-motion: reduce)` CSS query",
+	line: 0,
+	column: 0,
+	category: "Accessibility"
+};
+const checkReducedMotion = (rootDirectory) => {
+	const packageJsonPath = path.join(rootDirectory, "package.json");
+	if (!isFile(packageJsonPath)) return [];
+	let hasMotionLibrary = false;
+	try {
+		const packageJson = readPackageJson(packageJsonPath);
+		const allDependencies = {
+			...packageJson.dependencies,
+			...packageJson.devDependencies
+		};
+		hasMotionLibrary = Object.keys(allDependencies).some((packageName) => MOTION_LIBRARY_PACKAGES.has(packageName));
+	} catch {
+		return [];
+	}
+	if (!hasMotionLibrary) return [];
+	const result = spawnSync("git", [
+		"grep",
+		"-ql",
+		"-E",
+		REDUCED_MOTION_GREP_PATTERN,
+		"--",
+		...REDUCED_MOTION_FILE_GLOBS
+	], {
+		cwd: rootDirectory,
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+	if (result.error) return [MISSING_REDUCED_MOTION_DIAGNOSTIC];
+	if (result.status === 0) return [];
+	return [MISSING_REDUCED_MOTION_DIAGNOSTIC];
+};
+const computeJsxIncludePaths = (includePaths) => includePaths.length > 0 ? includePaths.filter((filePath) => JSX_FILE_PATTERN.test(filePath)) : void 0;
+const toStringSet = (values) => {
+	if (!values || values.length === 0) return /* @__PURE__ */ new Set();
+	return new Set(values.filter((value) => typeof value === "string" && value.length > 0));
+};
+const buildResolvedControls = (surface, userControls) => {
+	const excludeTags = new Set(DEFAULT_SURFACE_EXCLUDED_TAGS[surface]);
+	const includeTags = toStringSet(userControls?.includeTags);
+	for (const tag of includeTags) excludeTags.delete(tag);
+	for (const tag of toStringSet(userControls?.excludeTags)) excludeTags.add(tag);
+	return {
+		includeTags,
+		excludeTags,
+		includeCategories: toStringSet(userControls?.includeCategories),
+		excludeCategories: toStringSet(userControls?.excludeCategories),
+		includeRuleKeys: toStringSet(userControls?.includeRules),
+		excludeRuleKeys: toStringSet(userControls?.excludeRules)
+	};
 };
-const loadConfigWithSource = (rootDirectory) => {
-	const cached = cachedConfigs.get(rootDirectory);
-	if (cached !== void 0) return cached;
-	const localConfig = loadConfigFromDirectory(rootDirectory);
-	if (localConfig) {
-		cachedConfigs.set(rootDirectory, localConfig);
-		return localConfig;
-	}
-	if (isProjectBoundary$1(rootDirectory)) {
-		cachedConfigs.set(rootDirectory, null);
-		return null;
-	}
-	let ancestorDirectory = path.dirname(rootDirectory);
-	while (ancestorDirectory !== path.dirname(ancestorDirectory)) {
-		const ancestorConfig = loadConfigFromDirectory(ancestorDirectory);
-		if (ancestorConfig) {
-			cachedConfigs.set(rootDirectory, ancestorConfig);
-			return ancestorConfig;
-		}
-		if (isProjectBoundary$1(ancestorDirectory)) {
-			cachedConfigs.set(rootDirectory, null);
-			return null;
+const intersects = (values, candidates) => values.some((value) => candidates.has(value));
+const isDiagnosticOnSurface = (diagnostic, surface, config) => {
+	const resolved = buildResolvedControls(surface, config?.surfaces?.[surface]);
+	const { ruleKey, category, tags } = getDiagnosticRuleIdentity(diagnostic);
+	if (resolved.includeRuleKeys.has(ruleKey)) return true;
+	if (resolved.includeCategories.has(category)) return true;
+	if (intersects(tags, resolved.includeTags)) return true;
+	if (resolved.excludeRuleKeys.has(ruleKey)) return false;
+	if (resolved.excludeCategories.has(category)) return false;
+	if (intersects(tags, resolved.excludeTags)) return false;
+	return true;
+};
+const filterDiagnosticsForSurface = (diagnostics, surface, config) => diagnostics.filter((diagnostic) => isDiagnosticOnSurface(diagnostic, surface, config));
+const listSourceFilesViaGit = (rootDirectory) => {
+	const result = spawnSync("git", [
+		"ls-files",
+		"-z",
+		"--cached",
+		"--others",
+		"--exclude-standard"
+	], {
+		cwd: rootDirectory,
+		encoding: "utf-8",
+		maxBuffer: GIT_LS_FILES_MAX_BUFFER_BYTES
+	});
+	if (result.error || result.status !== 0) return null;
+	return result.stdout.split("\0").filter((filePath) => filePath.length > 0 && SOURCE_FILE_PATTERN.test(filePath));
+};
+const listSourceFilesViaFilesystem = (rootDirectory) => {
+	const filePaths = [];
+	const stack = [rootDirectory];
+	while (stack.length > 0) {
+		const currentDirectory = stack.pop();
+		const entries = readDirectoryEntries(currentDirectory);
+		for (const entry of entries) {
+			const absolutePath = path.join(currentDirectory, entry.name);
+			if (entry.isDirectory()) {
+				if (!entry.name.startsWith(".") && !IGNORED_DIRECTORIES.has(entry.name)) stack.push(absolutePath);
+				continue;
+			}
+			if (entry.isFile() && SOURCE_FILE_PATTERN.test(entry.name)) filePaths.push(path.relative(rootDirectory, absolutePath).replace(/\\/g, "/"));
 		}
-		ancestorDirectory = path.dirname(ancestorDirectory);
 	}
-	cachedConfigs.set(rootDirectory, null);
-	return null;
+	return filePaths;
 };
-const resolveConfigRootDir = (config, configSourceDirectory) => {
-	if (!config || !configSourceDirectory) return null;
-	const rawRootDir = config.rootDir;
-	if (typeof rawRootDir !== "string") return null;
-	const trimmedRootDir = rawRootDir.trim();
-	if (trimmedRootDir.length === 0) return null;
-	const resolvedRootDir = path.isAbsolute(trimmedRootDir) ? trimmedRootDir : path.resolve(configSourceDirectory, trimmedRootDir);
-	if (resolvedRootDir === configSourceDirectory) return null;
-	if (!isDirectory(resolvedRootDir)) {
-		Effect.runSync(Console.warn(`react-doctor config "rootDir" points to "${rawRootDir}" (resolved to ${resolvedRootDir}), which is not a directory. Ignoring.`));
-		return null;
-	}
-	return resolvedRootDir;
+const listSourceFiles = (rootDirectory) => listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory);
+const resolveLintIncludePaths = (rootDirectory, userConfig) => {
+	if (!Array.isArray(userConfig?.ignore?.files) || userConfig.ignore.files.length === 0) return;
+	const ignoredPatterns = compileIgnoredFilePatterns(userConfig);
+	return listSourceFiles(rootDirectory).filter((filePath) => {
+		if (!JSX_FILE_PATTERN.test(filePath)) return false;
+		return !isFileIgnoredByPatterns(filePath, rootDirectory, ignoredPatterns);
+	});
 };
-const CONFIG_CACHE_CAPACITY = 16;
-const CONFIG_CACHE_TTL_MS = 300 * 1e3;
 var Config = class Config extends Context.Service()("react-doctor/Config") {
 	static layerNode = Layer.effect(Config, Effect.gen(function* () {
 		const cache = yield* Cache.make({
-			capacity: CONFIG_CACHE_CAPACITY,
+			capacity: 16,
 			timeToLive: CONFIG_CACHE_TTL_MS,
 			lookup: (directory) => Effect.sync(() => {
 				const loaded = loadConfigWithSource(directory);
@@ -4441,6 +4702,20 @@ const parseGithubRepoFromRemoteUrl = (remoteUrl) => {
 	const urlMatch = /^(?:https?:\/\/github\.com\/|ssh:\/\/git@github\.com\/)([^/\s]+)\/([^/\s]+)$/.exec(withoutGitSuffix);
 	return urlMatch ? `${urlMatch[1]}/${urlMatch[2]}` : null;
 };
+const parseGithubRepo = (repo) => {
+	const [owner, name, ...extraParts] = repo.split("/");
+	if (owner === void 0 || name === void 0 || extraParts.length > 0) return null;
+	if (owner.length === 0 || name.length === 0) return null;
+	return {
+		owner,
+		name
+	};
+};
+const parseGithubViewerPermission = (stdout) => {
+	const value = trimOrNull(stdout);
+	if (value === null || value === "null") return null;
+	return /^[A-Z_]+$/.test(value) ? value.toLowerCase() : null;
+};
 const splitNullSeparated = (value) => value.split("\0").filter((entry) => entry.length > 0);
 /**
 * `Git` wraps every `git`-via-subprocess call react-doctor makes
@@ -4466,9 +4741,10 @@ var Git = class Git extends Context.Service()("react-doctor/Git") {
 		* reason: GitInvocationFailed })` so the rest of the codebase
 		* sees a single failure channel.
 		*/
-		const runGit = (directory, args) => Effect.scoped(Effect.gen(function* () {
-			const handle = yield* spawner.spawn(ChildProcess.make("git", [...args], {
-				cwd: directory,
+		const runCommand = (input) => Effect.scoped(Effect.gen(function* () {
+			const handle = yield* spawner.spawn(ChildProcess.make(input.command, [...input.args], {
+				cwd: input.directory,
+				env: input.env,
 				extendEnv: true
 			}));
 			const [stdout, stderr, status] = yield* Effect.all([
@@ -4481,11 +4757,23 @@ var Git = class Git extends Context.Service()("react-doctor/Git") {
 				stdout,
 				stderr
 			};
-		})).pipe(Effect.catchTag("PlatformError", (cause) => new ReactDoctorError({ reason: new GitInvocationFailed({
-			args: [...args],
-			directory,
-			cause
-		}) })));
+		})).pipe(Effect.catchTag("PlatformError", (cause) => {
+			if (input.command !== "git") return Effect.succeed({
+				status: 127,
+				stdout: "",
+				stderr: String(cause)
+			});
+			return new ReactDoctorError({ reason: new GitInvocationFailed({
+				args: [...input.args],
+				directory: input.directory,
+				cause
+			}) });
+		}));
+		const runGit = (directory, args) => runCommand({
+			command: "git",
+			args,
+			directory
+		});
 		const currentBranch = (directory) => runGit(directory, [
 			"rev-parse",
 			"--abbrev-ref",
@@ -4520,11 +4808,43 @@ var Git = class Git extends Context.Service()("react-doctor/Git") {
 			"--get",
 			"remote.origin.url"
 		]).pipe(Effect.map((result) => result.status === 0 ? parseGithubRepoFromRemoteUrl(result.stdout) : null));
+		const githubViewerPermission = (input) => Effect.gen(function* () {
+			const parsedRepo = parseGithubRepo(input.repo);
+			if (parsedRepo === null) return null;
+			const resultOption = yield* runCommand({
+				command: "gh",
+				args: [
+					"api",
+					"graphql",
+					"-F",
+					`owner=${parsedRepo.owner}`,
+					"-F",
+					`name=${parsedRepo.name}`,
+					"-f",
+					`query=
+            query(\$owner: String!, \$name: String!) {
+              repository(owner: \$owner, name: \$name) {
+                viewerPermission
+              }
+            }
+          `,
+					"--jq",
+					".data.repository.viewerPermission"
+				],
+				directory: input.directory,
+				env: { GH_PROMPT_DISABLED: "1" }
+			}).pipe(Effect.timeoutOption(GITHUB_VIEWER_PERMISSION_TIMEOUT_MS));
+			if (Option.isNone(resultOption)) return null;
+			const result = resultOption.value;
+			if (result.status !== 0) return null;
+			return parseGithubViewerPermission(result.stdout);
+		}).pipe(Effect.catch(() => Effect.succeed(null)));
 		return Git.of({
 			currentBranch,
 			defaultBranch,
 			headSha,
 			githubRepo,
+			githubViewerPermission,
 			branchExists,
 			diffSelection: ({ directory, explicitBaseBranch }) => Effect.gen(function* () {
 				if (explicitBaseBranch !== void 0 && explicitBaseBranch.trim().length === 0) return yield* Effect.fail(new ReactDoctorError({ reason: new GitBaseBranchInvalid({ detail: "Diff base branch cannot be empty." }) }));
@@ -4619,6 +4939,7 @@ var Git = class Git extends Context.Service()("react-doctor/Git") {
 		defaultBranch: () => Effect.succeed(snapshot.defaultBranch ?? null),
 		headSha: () => Effect.succeed(snapshot.headSha ?? null),
 		githubRepo: () => Effect.succeed(snapshot.githubRepo ?? null),
+		githubViewerPermission: () => Effect.succeed(snapshot.githubViewerPermission ?? null),
 		branchExists: (_directory, branch) => Effect.succeed(snapshot.branchExists?.get(branch) ?? false),
 		diffSelection: () => Effect.succeed(snapshot.diffSelection ?? null),
 		stagedFilePaths: () => Effect.succeed(snapshot.stagedFiles ?? []),
@@ -4734,7 +5055,6 @@ const findFirstLintConfigInDirectory = (directory) => {
 	}
 	return null;
 };
-const isProjectBoundary = (directory) => fs.existsSync(path.join(directory, ".git")) || isMonorepoRoot(directory);
 const detectUserLintConfigPaths = (rootDirectory) => {
 	const directLintConfig = findFirstLintConfigInDirectory(rootDirectory);
 	if (directLintConfig) return [directLintConfig];
@@ -4870,7 +5190,6 @@ const shouldEnableRule = (requires, tags, capabilities, ignoredTags, disabledBy)
 	}
 	return true;
 };
-const esmRequire$1 = createRequire(import.meta.url);
 /**
 * Loads a plugin module via the local require resolver and extracts
 * `(name, ruleNames)` from either `module.exports.meta + rules` or
@@ -4897,15 +5216,16 @@ const readPluginShape = (pluginSpecifier, loadModule) => {
 		ruleNames: new Set(Object.keys(rules))
 	};
 };
+const bundledRequire = createRequire(import.meta.url);
 const resolveReactHooksJsPlugin = (hasReactCompiler, customRulesOnly) => {
 	if (!hasReactCompiler || customRulesOnly) return null;
 	let pluginSpecifier;
 	try {
-		pluginSpecifier = esmRequire$1.resolve("eslint-plugin-react-hooks");
+		pluginSpecifier = bundledRequire.resolve("eslint-plugin-react-hooks");
 	} catch {
 		return null;
 	}
-	const { ruleNames } = readPluginShape(pluginSpecifier, (spec) => esmRequire$1(spec));
+	const { ruleNames } = readPluginShape(pluginSpecifier, (spec) => bundledRequire(spec));
 	return {
 		entry: {
 			name: "react-hooks-js",
@@ -5599,7 +5919,6 @@ const spawnOxlint = (args, rootDirectory, nodeBinaryPath) => new Promise((resolv
 		resolve(output);
 	});
 });
-const PREVIEW_COUNT = 3;
 /**
 * Runs every prebuilt file batch through oxlint, with binary-split
 * retry on the splittable error classes (timeout / output-too-large /
@@ -5614,7 +5933,8 @@ const PREVIEW_COUNT = 3;
 * with a slimmer config in that case.
 */
 const spawnLintBatches = async (input) => {
-	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, onPartialFailure } = input;
+	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, onPartialFailure, onFileProgress } = input;
+	const totalFileCount = fileBatches.reduce((sum, batch) => sum + batch.length, 0);
 	const allDiagnostics = [];
 	const droppedFiles = [];
 	let firstDropReason = null;
@@ -5633,10 +5953,24 @@ const spawnLintBatches = async (input) => {
 			return [...await spawnLintBatch(batch.slice(0, splitIndex)), ...await spawnLintBatch(batch.slice(splitIndex))];
 		}
 	};
-	for (const batch of fileBatches) allDiagnostics.push(...await spawnLintBatch(batch));
+	let scannedFileCount = 0;
+	for (const batch of fileBatches) {
+		let batchFileIndex = 0;
+		const progressInterval = onFileProgress && batch.length > 1 ? setInterval(() => {
+			if (batchFileIndex < batch.length) {
+				batchFileIndex += 1;
+				onFileProgress(scannedFileCount + batchFileIndex, totalFileCount);
+			}
+		}, 50) : null;
+		const batchDiagnostics = await spawnLintBatch(batch);
+		if (progressInterval !== null) clearInterval(progressInterval);
+		allDiagnostics.push(...batchDiagnostics);
+		scannedFileCount += batch.length;
+		onFileProgress?.(scannedFileCount, totalFileCount);
+	}
 	if (droppedFiles.length > 0 && onPartialFailure) {
-		const previewFiles = droppedFiles.slice(0, PREVIEW_COUNT).join(", ");
-		const remainderHint = droppedFiles.length > PREVIEW_COUNT ? `, +${droppedFiles.length - PREVIEW_COUNT} more` : "";
+		const previewFiles = droppedFiles.slice(0, 3).join(", ");
+		const remainderHint = droppedFiles.length > 3 ? `, +${droppedFiles.length - 3} more` : "";
 		const reasonHint = firstDropReason ? ` — first failure: ${firstDropReason}` : "";
 		onPartialFailure(`${droppedFiles.length} file(s) failed to lint and were skipped (${previewFiles}${remainderHint})${reasonHint}`);
 	}
@@ -5756,7 +6090,8 @@ const runOxlint = async (options) => {
 			rootDirectory,
 			nodeBinaryPath,
 			project,
-			onPartialFailure
+			onPartialFailure,
+			onFileProgress: options.onFileProgress
 		});
 		writeOxlintConfig(configPath, buildConfig(extendsPaths));
 		try {
@@ -5837,7 +6172,8 @@ var Linter = class Linter extends Context.Service()("react-doctor/Linter") {
 				configSourceDirectory: input.configSourceDirectory,
 				onPartialFailure: (reason) => {
 					collectedFailures.push(reason);
-				}
+				},
+				onFileProgress: input.onFileProgress
 			}),
 			catch: ensureReactDoctorError
 		});
@@ -5864,6 +6200,48 @@ var Linter = class Linter extends Context.Service()("react-doctor/Linter") {
 		return stream;
 	} }));
 };
+var ProgressCapture = class ProgressCapture extends Context.Service()("react-doctor/ProgressCapture") {
+	static layer = Layer.effect(ProgressCapture, Ref.make([]));
+};
+/**
+* `Progress` is the terminal-feedback service. Layer slot for ora
+* (CLI), log lines, GitHub Action `::group::`, or a no-op for silent
+* modes. Tests use `layerCapture` to record start/succeed/fail
+* events into a Ref instead of mocking the underlying spinner module.
+*/
+var Progress = class Progress extends Context.Service()("react-doctor/Progress") {
+	/**
+	* Layer that uses an injected factory. The cli package provides
+	* its own factory backed by the existing ora-based `spinner.ts`
+	* helper; this layer keeps the core package free of an ora dep.
+	*/
+	static layerOra = (factory) => Layer.succeed(Progress, Progress.of({ start: (text) => Effect.sync(() => factory(text)) }));
+	static layerNoop = Layer.succeed(Progress, Progress.of({ start: () => Effect.succeed({
+		update: () => Effect.void,
+		succeed: () => Effect.void,
+		fail: () => Effect.void
+	}) }));
+	static layerCapture = Layer.effect(Progress, Effect.map(ProgressCapture, (events) => Progress.of({ start: (text) => Effect.gen(function* () {
+		yield* Ref.update(events, (existing) => [...existing, {
+			_tag: "Started",
+			text
+		}]);
+		return {
+			update: (displayText) => Ref.update(events, (existing) => [...existing, {
+				_tag: "Updated",
+				text: displayText
+			}]),
+			succeed: (displayText) => Ref.update(events, (existing) => [...existing, {
+				_tag: "Succeeded",
+				text: displayText
+			}]),
+			fail: (displayText) => Ref.update(events, (existing) => [...existing, {
+				_tag: "Failed",
+				text: displayText
+			}])
+		};
+	}) }))).pipe(Layer.provideMerge(ProgressCapture.layer));
+};
 const translateProjectInfoError = (cause, directory) => {
 	if (cause instanceof NoReactDependencyError) return new ReactDoctorError({ reason: new NoReactDependency({ directory: cause.directory }) });
 	if (cause instanceof ProjectNotFoundError) return new ReactDoctorError({ reason: new ProjectNotFound({ directory: cause.directory }) });
@@ -5961,7 +6339,11 @@ const calculateScore = async (diagnostics, options = {}) => {
 			...options.metadata?.framework ? { framework: options.metadata.framework } : {},
 			...options.metadata?.reactVersion ? { reactVersion: options.metadata.reactVersion } : {},
 			...typeof options.metadata?.sourceFileCount === "number" ? { sourceFileCount: options.metadata.sourceFileCount } : {},
-			...options.metadata?.defaultBranch ? { defaultBranch: options.metadata.defaultBranch } : {}
+			...options.metadata?.defaultBranch ? { defaultBranch: options.metadata.defaultBranch } : {},
+			...options.metadata?.doctorVersion ? { doctorVersion: options.metadata.doctorVersion } : {},
+			...options.metadata?.githubEventName ? { githubEventName: options.metadata.githubEventName } : {},
+			...options.metadata?.githubActorAssociation ? { githubActorAssociation: options.metadata.githubActorAssociation } : {},
+			...options.metadata?.githubViewerPermission ? { githubViewerPermission: options.metadata.githubViewerPermission } : {}
 		}));
 		const response = await fetch(requestUrl, {
 			method: "POST",
@@ -6006,6 +6388,32 @@ var Score = class Score extends Context.Service()("react-doctor/Score") {
 	}) }));
 	static layerOf = (result) => Layer.succeed(Score, Score.of({ compute: () => Effect.succeed(result) }));
 };
+const getObjectProperty = (value, propertyName) => {
+	if (typeof value !== "object" || value === null) return void 0;
+	return Reflect.get(value, propertyName);
+};
+const getStringProperty = (value, propertyName) => {
+	const propertyValue = getObjectProperty(value, propertyName);
+	return typeof propertyValue === "string" && propertyValue.length > 0 ? propertyValue : void 0;
+};
+const readGithubEventPayload = (eventPath) => {
+	if (eventPath === void 0 || eventPath.length === 0) return null;
+	try {
+		return JSON.parse(readFileSync(eventPath, "utf8"));
+	} catch {
+		return null;
+	}
+};
+const resolveGithubActionsScoreMetadata = (environment = process.env) => {
+	if (environment.GITHUB_ACTIONS !== "true") return {};
+	const pullRequest = getObjectProperty(readGithubEventPayload(environment.GITHUB_EVENT_PATH), "pull_request");
+	const eventName = environment.GITHUB_EVENT_NAME;
+	const actorAssociation = getStringProperty(pullRequest, "author_association");
+	return {
+		...eventName !== void 0 && eventName.length > 0 ? { githubEventName: eventName } : {},
+		...actorAssociation !== void 0 ? { githubActorAssociation: actorAssociation } : {}
+	};
+};
 const NO_HOOKS = {
 	beforeLint: () => Effect.void,
 	afterLint: () => Effect.void
@@ -6021,26 +6429,33 @@ const fileReader = (filesService, rootDirectory) => (filePath) => {
 	}));
 	return lines === null ? null : [...lines];
 };
+const LINT_FAIL_TEXT = "Scanning failed (lint, non-fatal).";
+const LINT_NATIVE_BINDING_FAIL_TEXT = (nodeVersion) => `Scanning failed — oxlint native binding not found (Node ${nodeVersion}).`;
+const DEAD_CODE_FAIL_TEXT = "Scanning failed (dead-code analysis, non-fatal).";
+const formatLintFailText = (reasonTag, nodeVersion) => {
+	if (reasonTag === "OxlintUnavailable" || reasonTag === "OxlintSpawnFailed") return LINT_NATIVE_BINDING_FAIL_TEXT(nodeVersion);
+	return LINT_FAIL_TEXT;
+};
 /**
 * The full inspect orchestration as a single composable Effect.
 *
-* Wires the 8 services into a streaming pipeline:
+* Phases:
 *
-*   Config.resolve(directory)
-*     -> Project.discover(resolvedDirectory)
-*     -> Git metadata for score attribution
-*     -> Stream.fromIterable(env diagnostics: reduced-motion + pnpm hardening)
-*     -> Stream.concat(Linter.run(...))    [folds ReactDoctorError into Ref]
-*     -> Stream.concat(DeadCode.run(...))  [folds Error into Ref]
-*     -> Stream.filterMap(perElementPipeline.apply)  [auto-suppress / severity / ignore / inline]
-*     -> Stream.tap(Reporter.emit)         [side-channel: future LSP / NDJSON]
-*     -> Stream.runCollect
-*     -> Score.compute(filtered)
+*   1. Config.resolve(directory) → Project.discover → Git metadata
+*   2. beforeLint hook (e.g. CLI renders the project-detection block)
+*   3. environment checks (reduced-motion + pnpm hardening)
+*   4. Linter.run + DeadCode.run — forked as concurrent fibers so
+*      their wall-clock times overlap. Progress spinners stay
+*      sequential (lint first, then dead-code) for clean terminal
+*      output. GitHub viewer permission also runs as a background
+*      fiber during this phase.
+*   5. afterLint hook
+*   6. Reporter.finalize
+*   7. Score.compute against the surface-filtered diagnostic set
 *
-* Lint and dead-code failures are folded via `Stream.catchTag` into
-* Ref state on the orchestrator side — they don't sink the whole
-* scan, and the renderer (cli or programmatic api) surfaces them
-* via `skippedCheckReasons`.
+* The orchestrator owns spinner lifecycle via `Progress`; callers
+* choose `Progress.layerOra(...)` for CLI feedback or
+* `Progress.layerNoop` for silent / programmatic runs.
 */
 const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 	const projectService = yield* Project;
@@ -6051,6 +6466,7 @@ const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 	const scoreService = yield* Score;
 	const deadCodeService = yield* DeadCode;
 	const gitService = yield* Git;
+	const progressService = yield* Progress;
 	const partialFailuresRef = yield* LintPartialFailures;
 	const resolvedConfig = yield* configService.resolve(input.directory);
 	const scanDirectory = resolvedConfig.resolvedDirectory;
@@ -6061,18 +6477,25 @@ const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 		gitService.headSha(scanDirectory).pipe(Effect.orElseSucceed(() => null)),
 		gitService.defaultBranch(scanDirectory).pipe(Effect.orElseSucceed(() => null))
 	], { concurrency: 3 });
-	const scoreMetadata = {
-		...repo !== null ? { repo } : {},
-		...sha !== null ? { sha } : {},
-		framework: project.framework,
-		...project.reactVersion !== null ? { reactVersion: project.reactVersion } : {},
-		sourceFileCount: project.sourceFileCount,
-		...defaultBranch !== null ? { defaultBranch } : {}
-	};
+	const githubActionsScoreMetadata = input.isCi ? resolveGithubActionsScoreMetadata() : {};
+	const githubViewerPermissionFiber = yield* Effect.forkChild(input.resolveLocalGithubViewerPermission === true && !input.isCi && repo !== null ? gitService.githubViewerPermission({
+		directory: scanDirectory,
+		repo
+	}).pipe(Effect.orElseSucceed(() => null)) : Effect.succeed(null));
 	const lintIncludePaths = computeJsxIncludePaths([...input.includePaths]) ?? resolveLintIncludePaths(scanDirectory, resolvedConfig.config);
 	const beforeLint = hooks.beforeLint ?? NO_HOOKS.beforeLint;
 	const afterLint = hooks.afterLint ?? NO_HOOKS.afterLint;
 	yield* beforeLint(project, lintIncludePaths ?? void 0);
+	const isDiffMode = input.includePaths.length > 0;
+	const transform = buildDiagnosticPipeline({
+		rootDirectory: scanDirectory,
+		userConfig: resolvedConfig.config,
+		readFileLinesSync: fileReader(filesService, scanDirectory),
+		respectInlineDisables: input.respectInlineDisables
+	});
+	const applyPerElementPipeline = (rawStream) => rawStream.pipe(Stream.filterMap(filterMapNullable(transform.apply)), Stream.tap((diagnostic) => reporterService.emit(diagnostic)));
+	const environmentDiagnostics = isDiffMode ? [] : [...checkReducedMotion(scanDirectory), ...checkPnpmHardening(scanDirectory)];
+	const envCollected = yield* Stream.runCollect(applyPerElementPipeline(Stream.fromIterable(environmentDiagnostics)));
 	const lintFailure = yield* Ref.make({
 		didFail: false,
 		reason: null,
@@ -6082,15 +6505,20 @@ const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 		didFail: false,
 		reason: null
 	});
-	const isDiffMode = input.includePaths.length > 0;
-	const transform = buildDiagnosticPipeline({
+	const shouldRunDeadCode = input.runDeadCode && !isDiffMode;
+	const deadCodeFiber = yield* Effect.forkChild(shouldRunDeadCode ? Stream.runCollect(applyPerElementPipeline(deadCodeService.run({
 		rootDirectory: scanDirectory,
-		userConfig: resolvedConfig.config,
-		readFileLinesSync: fileReader(filesService, scanDirectory),
-		respectInlineDisables: input.respectInlineDisables
-	});
-	const environmentDiagnostics = isDiffMode ? [] : [...checkReducedMotion(scanDirectory), ...checkPnpmHardening(scanDirectory)];
-	const emptyDiagnosticStream = Stream.empty;
+		userConfig: resolvedConfig.config
+	}).pipe(Stream.catchTag("ReactDoctorError", (error) => Stream.unwrap(Effect.gen(function* () {
+		yield* Ref.set(deadCodeFailure, {
+			didFail: true,
+			reason: error.message
+		});
+		return Stream.empty;
+	})))))) : Effect.succeed([]));
+	const scanProgress = yield* progressService.start("Scanning...");
+	const scanStartTime = Date.now();
+	let lastReportedTotalFileCount = 0;
 	const rawLintStream = linterService.run({
 		rootDirectory: scanDirectory,
 		project,
@@ -6101,34 +6529,54 @@ const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 		adoptExistingLintConfig: input.adoptExistingLintConfig,
 		ignoredTags: input.ignoredTags,
 		userConfig: resolvedConfig.config ?? void 0,
-		configSourceDirectory: resolvedConfig.configSourceDirectory ?? void 0
+		configSourceDirectory: resolvedConfig.configSourceDirectory ?? void 0,
+		onFileProgress: (scannedFileCount, totalFileCount) => {
+			lastReportedTotalFileCount = totalFileCount;
+			Effect.runSync(scanProgress.update(`Scanning (${scannedFileCount}/${totalFileCount})...`));
+		}
 	}).pipe(Stream.catchTag("ReactDoctorError", (error) => Stream.unwrap(Effect.gen(function* () {
 		yield* Ref.set(lintFailure, {
 			didFail: true,
 			reason: error.message,
 			reasonTag: error.reason._tag
 		});
-		return emptyDiagnosticStream;
+		return Stream.empty;
 	}))));
-	const deadCodeStream = input.runDeadCode && !isDiffMode ? deadCodeService.run({
-		rootDirectory: scanDirectory,
-		userConfig: resolvedConfig.config
-	}).pipe(Stream.catchTag("ReactDoctorError", (error) => Stream.unwrap(Effect.gen(function* () {
-		yield* Ref.set(deadCodeFailure, {
-			didFail: true,
-			reason: error.message
-		});
-		return emptyDiagnosticStream;
-	})))) : emptyDiagnosticStream;
-	const transformedStream = Stream.fromIterable(environmentDiagnostics).pipe(Stream.concat(rawLintStream), Stream.concat(deadCodeStream), Stream.filterMap(filterMapNullable(transform.apply)), Stream.tap((diagnostic) => reporterService.emit(diagnostic)));
-	const survivingDiagnostics = yield* Stream.runCollect(transformedStream);
-	yield* reporterService.finalize;
+	const lintCollected = yield* Stream.runCollect(applyPerElementPipeline(rawLintStream));
 	const lintFailureState = yield* Ref.get(lintFailure);
-	const deadCodeFailureState = yield* Ref.get(deadCodeFailure);
 	yield* afterLint(lintFailureState.didFail);
-	const finalDiagnostics = [...survivingDiagnostics];
+	if (lintFailureState.didFail) {
+		yield* Fiber.interrupt(deadCodeFiber);
+		yield* scanProgress.fail(formatLintFailText(lintFailureState.reasonTag, process.version));
+	}
+	const deadCodeCollected = lintFailureState.didFail ? [] : yield* Fiber.join(deadCodeFiber);
+	const deadCodeFailureState = yield* Ref.get(deadCodeFailure);
+	const scanElapsedSeconds = ((Date.now() - scanStartTime) / 1e3).toFixed(1);
+	const totalFileCount = lastReportedTotalFileCount || (lintIncludePaths?.length ?? project.sourceFileCount);
+	if (!lintFailureState.didFail) if (deadCodeFailureState.didFail) yield* scanProgress.fail(DEAD_CODE_FAIL_TEXT);
+	else yield* scanProgress.succeed(`Scanned ${totalFileCount} ${totalFileCount === 1 ? "file" : "files"} in ${scanElapsedSeconds}s`);
+	yield* reporterService.finalize;
+	const finalDiagnostics = [
+		...envCollected,
+		...lintCollected,
+		...deadCodeCollected
+	];
+	const githubViewerPermission = yield* Fiber.join(githubViewerPermissionFiber);
+	const scoreMetadata = {
+		...repo !== null ? { repo } : {},
+		...sha !== null ? { sha } : {},
+		framework: project.framework,
+		...project.reactVersion !== null ? { reactVersion: project.reactVersion } : {},
+		sourceFileCount: project.sourceFileCount,
+		...defaultBranch !== null ? { defaultBranch } : {},
+		...input.doctorVersion !== void 0 ? { doctorVersion: input.doctorVersion } : {},
+		...githubActionsScoreMetadata,
+		...githubViewerPermission !== null ? { githubViewerPermission } : {}
+	};
+	const scoreSurface = input.scoreSurface ?? "score";
+	const scoreDiagnostics = filterDiagnosticsForSurface([...finalDiagnostics], scoreSurface, resolvedConfig.config);
 	const score = lintFailureState.didFail ? null : yield* scoreService.compute({
-		diagnostics: finalDiagnostics,
+		diagnostics: scoreDiagnostics,
 		isCi: input.isCi,
 		metadata: scoreMetadata
 	});
@@ -6151,9 +6599,25 @@ const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 	"inspect.directory": input.directory,
 	"inspect.includePathCount": input.includePaths.length,
 	"inspect.runDeadCode": input.runDeadCode,
-	"inspect.isCi": input.isCi
+	"inspect.isCi": input.isCi,
+	"inspect.scoreSurface": input.scoreSurface ?? "score"
 } }));
-Layer.mergeAll(Project.layerNode, Config.layerNode, DeadCode.layerNode, Files.layerNode, Git.layerNode, Linter.layerOxlint, LintPartialFailures.layerLive, Reporter.layerNoop, Score.layerHttp);
+/**
+* Default layer stack for the production CLI / programmatic API:
+* real Node-side services for Project / Config / Files / Git / Linter /
+* DeadCode; HTTP for Score; noop Progress (the CLI overrides with
+* `Progress.layerOra(...)` for terminal feedback); the silent Reporter
+* (the orchestrator already returns the diagnostic array via
+* `Stream.runCollect`).
+*
+* Callers tweak by replacing individual layers: `--no-score` swaps
+* `Score.layerHttp` for `Score.layerOf(null)`; `--no-lint` swaps
+* `Linter.layerOxlint` for `Linter.layerOf([])`; `--no-dead-code`
+* swaps `DeadCode.layerNode` for `DeadCode.layerOf([])`; a caller
+* with a pre-loaded config swaps `Config.layerNode` for
+* `Config.layerOf(resolved)`.
+*/
+const layerInspectLive = Layer.mergeAll(Project.layerNode, Config.layerNode, DeadCode.layerNode, Files.layerNode, Git.layerNode, Linter.layerOxlint, LintPartialFailures.layerLive, Progress.layerNoop, Reporter.layerNoop, Score.layerHttp);
 const parseNodeVersion = (versionString) => {
 	const [major = 0, minor = 0, patch = 0] = versionString.replace(/^v/, "").trim().split(".").map(Number);
 	return {
@@ -6253,37 +6717,6 @@ const resolveNodeForOxlint = () => {
 		});
 	});
 });
-var ProgressCapture = class ProgressCapture extends Context.Service()("react-doctor/ProgressCapture") {
-	static layer = Layer.effect(ProgressCapture, Ref.make([]));
-};
-(class Progress extends Context.Service()("react-doctor/Progress") {
-	/**
-	* Layer that uses an injected factory. The cli package provides
-	* its own factory backed by the existing ora-based `spinner.ts`
-	* helper; this layer keeps the core package free of an ora dep.
-	*/
-	static layerOra = (factory) => Layer.succeed(Progress, Progress.of({ start: (text) => Effect.sync(() => factory(text)) }));
-	static layerNoop = Layer.succeed(Progress, Progress.of({ start: () => Effect.succeed({
-		succeed: () => Effect.void,
-		fail: () => Effect.void
-	}) }));
-	static layerCapture = Layer.effect(Progress, Effect.map(ProgressCapture, (events) => Progress.of({ start: (text) => Effect.gen(function* () {
-		yield* Ref.update(events, (existing) => [...existing, {
-			_tag: "Started",
-			text
-		}]);
-		return {
-			succeed: (displayText) => Ref.update(events, (existing) => [...existing, {
-				_tag: "Succeeded",
-				text: displayText
-			}]),
-			fail: (displayText) => Ref.update(events, (existing) => [...existing, {
-				_tag: "Failed",
-				text: displayText
-			}])
-		};
-	}) }))).pipe(Layer.provideMerge(ProgressCapture.layer));
-});
 /**
 * Zip-Slip defense: `git diff --cached --name-only` is the source
 * of `relativePath`, and git normalizes paths during ordinary
@@ -6482,10 +6915,6 @@ const buildJsonReport = (input) => {
 		error: null
 	};
 };
-const testFileResultCache = /* @__PURE__ */ new Map();
-const clearAutoSuppressionCaches = () => {
-	testFileResultCache.clear();
-};
 /**
 * Programmatic façade over `Git.diffSelection`. Async because the
 * Git service runs through Effect's `ChildProcess` (true subprocess
@@ -6582,48 +7011,32 @@ var import_picocolors = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin((
 	module.exports.createColors = createColors;
 })))(), 1);
 import_picocolors.default.red, import_picocolors.default.yellow, import_picocolors.default.cyan, import_picocolors.default.green, import_picocolors.default.dim, import_picocolors.default.gray, import_picocolors.default.bold;
-const resolveDiagnoseTarget = (directory) => {
-	if (isFile(path.join(directory, "package.json"))) return directory;
-	const reactSubprojects = discoverReactSubprojects(directory);
-	if (reactSubprojects.length === 0) return null;
-	if (reactSubprojects.length === 1) return reactSubprojects[0].directory;
-	throw new AmbiguousProjectError(directory, reactSubprojects.map((subproject) => path.relative(directory, subproject.directory)).toSorted());
-};
+/**
+* Back-compat alias: the streaming pipeline holds its caches in
+* per-pipeline closures that are garbage-collected when the pipeline
+* goes out of scope, so there is nothing to clear at module scope. The
+* public CLI's `clearCaches()` still calls this for symmetry with the
+* other `clear*` helpers.
+*/
+const clearAutoSuppressionCaches = () => {};
 //#endregion
 //#region ../api/dist/index.js
-const buildLayerStack = () => Layer.mergeAll(Project.layerNode, Config.layerNode, Files.layerNode, Git.layerNode, Linter.layerOxlint, LintPartialFailures.layerLive, DeadCode.layerNode, Score.layerHttp, Reporter.layerNoop);
 const diagnose = async (directory, options = {}) => {
 	const startTime = globalThis.performance.now();
-	const requestedDirectory = path.resolve(directory);
-	/**
-	* Pre-resolve the rootDir redirect + auto-fallback to nested React
-	* subprojects BEFORE handing off to runInspect. These two
-	* directory-shape concerns predate the project-discovery boundary:
-	* the rootDir redirect happens against the config (which lives at
-	* the requested directory), and resolveDiagnoseTarget walks down to
-	* find a nested React project when the requested directory itself
-	* lacks a package.json. runInspect itself only knows "go discover
-	* the project at this directory".
-	*/
-	const initialLoadedConfig = loadConfigWithSource(requestedDirectory);
-	const directoryAfterRedirect = resolveConfigRootDir(initialLoadedConfig?.config ?? null, initialLoadedConfig?.sourceDirectory ?? null) ?? requestedDirectory;
-	const resolvedDirectory = resolveDiagnoseTarget(directoryAfterRedirect);
-	if (!resolvedDirectory) throw new ProjectNotFoundError(directoryAfterRedirect);
+	const scanTarget = resolveScanTarget(directory);
+	const includePaths = options.includePaths ?? [];
 	const program = runInspect({
-		directory: resolvedDirectory,
-		includePaths: options.includePaths ?? [],
-		customRulesOnly: initialLoadedConfig?.config?.customRulesOnly ?? false,
-		respectInlineDisables: options.respectInlineDisables ?? initialLoadedConfig?.config?.respectInlineDisables ?? true,
-		adoptExistingLintConfig: initialLoadedConfig?.config?.adoptExistingLintConfig ?? true,
-		ignoredTags: new Set(initialLoadedConfig?.config?.ignore?.tags ?? []),
-		runDeadCode: options.deadCode ?? initialLoadedConfig?.config?.deadCode ?? true,
-		isCi: false
+		directory: scanTarget.resolvedDirectory,
+		includePaths,
+		customRulesOnly: scanTarget.userConfig?.customRulesOnly ?? false,
+		respectInlineDisables: options.respectInlineDisables ?? scanTarget.userConfig?.respectInlineDisables ?? true,
+		adoptExistingLintConfig: scanTarget.userConfig?.adoptExistingLintConfig ?? true,
+		ignoredTags: new Set(scanTarget.userConfig?.ignore?.tags ?? []),
+		runDeadCode: options.deadCode ?? scanTarget.userConfig?.deadCode ?? true,
+		isCi: false,
+		resolveLocalGithubViewerPermission: true
 	});
-	const output = await Effect.runPromise(program.pipe(Effect.provide(buildLayerStack()), Effect.provide(layerOtlp), Effect.catchReasons("ReactDoctorError", {
-		NoReactDependency: (reason) => Effect.die(new NoReactDependencyError(reason.directory)),
-		ProjectNotFound: (reason) => Effect.die(new ProjectNotFoundError(reason.directory)),
-		AmbiguousProject: (reason) => Effect.die(new AmbiguousProjectError(reason.directory, [...reason.candidates]))
-	}, (_reason, error) => Effect.die(new Error(error.message)))));
+	const output = await Effect.runPromise(restoreLegacyThrow(program.pipe(Effect.provide(layerInspectLive), Effect.provide(layerOtlp))));
 	if (output.didLintFail && output.lintFailureReason !== null) console.error("Lint failed:", output.lintFailureReason);
 	const skippedChecks = [];
 	const skippedCheckReasons = {};